Cloud Asterisk 10: Freepbx 2.10, Gtalk. Two open ports. $5.

When Amazon started offering free virtual machines, I jumped and started setting up Asterisk from scratch. You can't just upload an ISO and boot from that. (That would be WAY too easy for an IaaS provider like Amazon to offer free.)

After getting all the prequisites in, (there are only really two you need to build by hand, iksemel and libSRTP. sox is optional. The rest are RPMs.), I started the ./configure. Success. Then make. Halfway through, the machine shuts down because I'm consuming too many resources. The first time I thought it was a fluke, but after the second time, I gave up.

But I was still intrigued to see if I could do it, so I moved to the Rackspace cloud and set up a CentOS 6 virtual machine with 20 GB of virtual drive and 512 MB of RAM. Again, no uploading a boot ISO. This isn't VMWare. The build went a lot faster when installing required RPMs. On CentOS, sox is available in the repo. On Amazon's AMI box, it was not.

However, FreePBX 2.10 won't install with Asterisk 10. You can install Asterisk 1.8, then install FreePBX, and then upgrade Asterisk to 10. So far, it works. I can't do testing of every feature, but it is easier to test in the cloud than building yet another box in my basement. (With the exception of DAHDI, of course.)

Rackspace is nice and conservative with its default CentOS build. Iptables is left open to everyone for one port -- 22 tcp -- for ssh. It responds to ping, too, but you can fix that. There's no way I was going to open up much more to everyone, like https (which works fine for FreePBX 2.10), or SIP, or RTP ephemeral ports.

How I did that: Use iptables to limit SSH to my own IP addresses, including a backup address or two. Then install OpenVPN. Given that I'm already managing certificates for https and Asterisk it's not a stretch. It's a lot easier if you have your own certificate server rather than using the scripts provided with each component. (Rant: Everyone who needs to configure https, ssl, tls, or OpenVPN on live Internet-connected machines should be required to complete a tutorial on the CONCEPTS of PKI before being allowed get access to CA and certificate creation scripts for live Internet boxes. Both Asterisk and OpenVPN ship with them.)

OpenVPN runs on port 1194 udp. So what's the other open port? 5222 for Gtalk. I just wish Google had a list of its public IPs for me to enter into iptables.

To access the box, I dial in to the OpenVPN with my certificate that has a password-protected encrypted key. Then I connect to the web interface via https. Snom phones connect via OpenVPN with a certificate and cleartext key. For backup and remote logging, the Cloud server also connects back to my basement via OpenVPN. OpenVPN is easier to configure and seems to have better uptime than my IPSec tunnels. I just hope it's as secure as IPSec.

Total cost so far: $5. It's running under a dollar a day, which is fine for a test box for a little while. I'm a little worried that I won't be able to let go after tweaking it out just the way I want it.

Downside: if iptables stops, my box is getting hacked. I'm afraid to ask how much a dedicated firewall (virtual or real) would cost.

Bug I haven't been able to fix yet: sometimes Snom can't connect via TLS or TCP after getting there through OpenSSL. UDP always works. I'm still working to figure out why.

I'd like to do an selinux policy, too, but that's going to take some time.

Update: Video calls seem to be working between extensions between a Nortel 1535 and the Bria softphone. Since the Nortel doesn't support TLS/SRTP, I can't test video encryption yet.

Upgrading to Asterisk 1.8 x64 Gotchas

I've been running Asterisk at home for a couple of years now. The initial setup using pbxinaflash was super-quick and provided a ton of cool features out of the box. Some other stuff needing tweaking, like the analog cards. (FYI: PBXIAF runs on top of FreePBX, which runs on top of Asterisk.)

So a few days ago, PBXInAFlash, releases a new version that includes support for video calls using discounted hardware video phones. Video calls have been available forever using software and computer cams. The availability of an affordable hardware phone means that there's a chance I can give one to my mom. What's the big deal with a hardware phone? My mom already knows how to use it. Everybody knows how to answer a hard phone.

Upgrading. The "supported " procedure is to upgrade to the same version of FreePBX that you'll be restoring to, and then do a backup. (Upgrade using module admin, then use the backup module...) So I installed the new release on top of my old Atom D510 server and wiped out all the old data. Restore. Restart Asterisk. Asterisk seg fault crash loop. FreePBX 2.8 doesn't validate every piece of input perfectly, so it can crash. You've been warned. I reinstalled and built from scratch, which is a great thing to be able to do, but not so great from a time perspective.

After installing the base phone system, it was up and running. My custom apps were not. The PBXinaFlash cust app scripts don't all support Asterisk 1.8 or x64. I run a few, and this is how I fixed them.

1. xtide. I go to the beach and I love xtide. PBXIAF tries to install the 386 rpms. Just go to Flaterco, down load the source and compile. Follow the instructions to the letter. ./configure will work but make will fail because you are missing headers. Install the following packages with yum install xxx:
   libXt-devel-1.0.2-3.2.el5.x86_64
   libICE-devel-1.0.1-2.1.x86_64
   libXaw-1.0.2-8.1.i386
   libXt-devel-1.0.2-3.2.el5.i386
   libXaw-devel-1.0.2-8.1.i386
   libXpm-devel-3.5.5-3.x86_64
   libXpm-3.5.5-3.i386
   libXmu-1.0.2-5.i386
   libSM-devel-1.0.1-3.1.x86_64
   libXmu-devel-1.0.2-5.x86_64
   xorg-x11-util-macros-1.0.2-4.fc6.x86_64
   libXaw-devel-1.0.2-8.1.x86_64
   Then make and make install. Then you'll get another error from bad linking, which will look something like this: error while loading shared libraries: xxx.so.1: cannot open shared object file: No such file or directory. Use ldd on the tide command to see what's missing, then find that file and copy it to where the other ones are. It should look something like this:
   ldd /usr/local/bin/tide
   
   libtcd.so.1 => /usr/lib64/libtcd.so.1
   libpng12.so.0 => /usr/lib64/libpng12.so.0
   libz.so.1 => /usr/lib64/libz.so.1
   libstdc++.so.6 => /usr/lib64/libstdc++.so.6
   libm.so.6 => /lib64/libm.so.6
   libgcc_s.so.1 => /lib64/libgcc_s.so.1
   libc.so.6 => /lib64/libc.so.6
   /lib64/ld-linux-x86-64.so.2
   I think my command was copying libtcd.so.1 to /usr/lib64, where it was expected. Now xtide works. I also have an updated harmonics file.
   


2. Swift. I love Allison-8kHz. All my licenses were gone -- g729 as well as Cepstral. Thanks to gmail, I could recover them all, and got a free upgrade to the latest Cepstral Allison: Allison-8kHz for Linux (v5.x), which installed fine. The missing part was swift-app for Asterisk. There's a beta for that that's working.


3. That darn analog cards. I light up my home's antique POTS lines with a Digium 410 and a couple of FXO modules. These were a pain to set up in the initial version, too. Since then, Asterisk has moved from the ZAP architecture to DAHDI, and I though that was where my problem was. Wrong. My problem was the same one that I had the first time. Default settings are for KewlStart instead of LoopStart. Once I changed all the configs to FXO_LS instead of FXO_KS it worked again. This means I can use my antique rotary-dial phone with mechanical bells to dial out my SIP trunk.


4. The IAX trunk to my Mom's house stopped working. I run this over a vpn link. (IPSec ESP w/AES256 so noone can listen in....) FreePBX has a new interface for configuring trunks, inbound and outbound in separate sections. (User and Peer). Keep you configs straight with ServerA/UserA at one end and ServerB/UserB at the other. Then I could dial my mom, but she couldn't dial me. My version of Asterisk requires CallTokens by default. Turned that off in the trunk config and it worked again. (I'd have to implement CallTokens if it wasn't running over a VPN and I wanted to resist DOS attacks.)


5. Video Calls. No problems here -- just enable h.263 and configure the phones.I can even do video calls between the Nortel IP 1535 and the Bria Softphone.