Apache Provisioning Port Setup - 14IP

Apache Provisioning Port Setup

Manually Configuring Apache to host phone configurations for auto provisioning

Note: If your FreePBX based system is Registered AND Licensed for System Admin Pro from Sangoma you can set this up via the Web Admin GUI.

Please see their documentation at System Admin – Port Management

For manual configuration see Below

HTTPS (SSL) Provisioning

Create Phone HTTPS (SSL) Provisioning Config

  1. SSH into your PBX using an ssh client like PuTTy and make sure you have root/sudo access.

  2. Create config file
    nano /etc/httpd/conf.d/clearlyip-ssl.conf

  3. Paste the config below or download the attached clearlyip-ssl.conf config and upload to the /etc/httpd/conf.d/ directory on your PBX

    1. Verify the port assignments on line 21 & 22
      Note: Be sure these ports don’t conflict with any in Admin –> System Admin –> Port Management

    2. Verify Certs defined on lines 25-27

    3. Verify the AuthUserFile assigned on line 54

  4. Ext nano via Ctrl+X, press Y & Enter to save the config.

  5. Restart Apache to apply the config.
    systemctl restart httpd.service

Configure Clearly Devices Template for HTTPS (SSL) Provisioning

  1. Log into your PBX’s Admin Web GUI

  2. Go into Clearly Devices and in each of your templates:

    1. Verify the HTTP Username & Password are set to what was configured in Manual Apache Auth Setup

    2. Verify the Provision Protocol is set to HTTPS

    3. Verify the Provision Port is set to what was set in step 3.a

    4. Verify the Provision Server is set to the IP Address or FQDN of the PBX where this Apache instance is configured.

Apache Config for HTTPS (SSL) Provisioning Config

Config Download: clearlyip-ssl.conf

  1. # If ssh_module isn’t already loaded load it.

  2. # This Avoids conflict with System Admin Configs.

  3. <IfModule !ssl_module.so>

  4.   LoadModule ssl_module modules/mod_ssl.so

  5.   SetEnv SSLSETUP true

  6.   SSLPassPhraseDialog builtin

  7.   SSLSessionCache shmcb:/var/cache/mod_ssl/scache(512000)

  8.   SSLSessionCacheTimeout 300

  9.   SSLRandomSeed startup file:/dev/urandom  256

  10.   SSLRandomSeed connect builtin

  11.   SSLCryptoDevice builtin

  13.   # https://mozilla.github.io/server-side-tls/ssl-config-generator/

  14.   SSLProtocol all -SSLv2 -SSLv3

  15.   SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS

  16.   SSLHonorCipherOrder on

  17. </IfModule>

  20. # Define Provisioning Port

  21. Listen 5443

  22. <VirtualHost _default_:5443>

  23.   SSLEngine on

  24.   # Make sure these point to your cert files

  25.   SSLCertificateFile /etc/httpd/pki/webserver.crt

  26.   SSLCertificateKeyFile /etc/httpd/pki/webserver.key

  27.   SSLCertificateChainFile /etc/httpd/pki/ca-bundle.crt

  29.   <Directory "/tftpboot/">

  30.     # Apache 2.4

  31.     <IfModule mod_authz_core.c>

  32.       <FilesMatch "(^.|.php$)">

  33.         Require all denied

  34.       </FilesMatch>

  35.       Require all granted

  36.     </IfModule>

  37.     # Apache 2.2

  38.     <IfModule !mod_authz_core.c>

  39.       <FilesMatch "(^.|.php$)">

  40.         Deny from all

  41.       </FilesMatch>

  42.       Allow from all

  43.     </IfModule>

  44.   </Directory>

  47.   DocumentRoot /tftpboot/

  48.   SetEnvIf User-Agent ‘.*MSIE.*’ nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0

  50.   <Directory /tftpboot/>

  51.     AuthType Basic

  52.     AuthName Restricted

  53.     # Make sure this matches what you set when creating the user

  54.     AuthUserFile /etc/httpd/phoneuser.auth

  55.     Require valid-user

  56.   </Directory>

  58. </VirtualHost>

HTTP (Non-SSL) Provisioning

Note: If you are only setting up Non-SSL provisioning you don’t need to Follow the Above SSL config or the Cert Setup in Apache SSL Certificate Setup Wiki.

Create Phone HTTPS (SSL) Provisioning Config

  1. SSH into your PBX using an ssh client like PuTTy and make sure you have root/sudo access.

  2. Create config file
    nano /etc/httpd/conf.d/clearlyip.conf

  3. Paste the config below or download the attached clearlyip.conf config and upload to the /etc/httpd/conf.d/ directory on your PBX

    1. Verify the port assignments on line 1 & 2
      Note: Be sure these ports don’t conflict with any in Admin –> System Admin –> Port Management

    2. Verify the AuthUserFile assigned on line 12
      Note: Make sure you have configured Authentication according to Apache Authentication Setup Wiki. Having unauthenticated provisioning could pose a security risk.

  4. Ext nano via Ctrl+X, press Y & Enter to save the config.

  5. Restart Apache to apply the config.
    systemctl restart httpd.service

Configure Clearly Devices Template for HTTPS (SSL) Provisioning

  1. Log into your PBX’s Admin Web GUI

  2. Go into Clearly Devices and in each of your templates:

    1. Verify the HTTP Username & Password are set to what was configured in Apache Authentication Setup

    2. Verify the Provision Protocol is set to HTTP

    3. Verify the Provision Port is set to what was set in step 3.a above

    4. Verify the Provision Server is set to the IP Address or FQDN of the PBX where this Apache instance is configured.

Apache Config for HTTP (Non-SSL) Provisioning Config

Config Download: clearlyip.conf

  1. Listen 8888

  2. <VirtualHost *:8888>

  3.   Alias /.well-known /var/www/html/.well-known

  4.   Alias /.freepbx-known /var/www/html/.freepbx-known

  5.   RewriteEngine on

  6.   RewriteRule ^/.(well-known|freepbx-known)/ – [H=text/plain,L]

  7.   RewriteRule (^.|/.) – [F]

  8.   DocumentRoot /tftpboot/

  9.   <Directory /tftpboot/>

  10.     AuthType Basic

  11.     AuthName Restricted

  12.     AuthUserFile /etc/httpd/phoneuser.auth

  13.     Require valid-user

  14.   </Directory>

  15. </VirtualHost>