New SIPStation Module – Beta Testers Welcome

SIPStation has always had a goal of being simple to understand and easy to use with FreePBX. When we acquired SIPStation along with FreePBX at the end of February the basics were there. You could buy trunks and DIDs, plug in a keycode into your SIPStation module and be up and running in minutes!

That part hasn’t changed but we’ve been busy since day one doing everything from adding proper phone and ticketing support to overhauling and upgrading the infrastructure and data center locations to adding new features and functionality to the service.

In addition to the trunks and DIDs needed to establish basic phone service, you can incorporate:

    • Toll Free Service
    • International Dialing
    • System wide failover to a phone number
    • System wide failover to an IP or FQDN
    • Per DID failover to a phone number
    • Per DID failover to an IP or FQDN
    • Additional E911 Locations per DID

One of our goals is to make your phone service experience as streamlined and integrated as possible into everything else that you do within FreePBX. The current SIPStation module has provided easy configuration functionality by putting in a keycode obtained from your account. The new version, available for beta testing now with FreePBX 2.11, adds much more!

Failover Numbers and IPs or FQDN

Configuring a failover number is easy. You can provide a single number for your PBX that will be called in the event we can’t reach you. On a per DID basis, you can provide a different

Global and per DID failover number and location

number which will take precedence over the system wide number. If you have a FQDN or IPaddress configured for the system it will be displayed in the module. (In order to add a failover IP location, you must contact support so we can help assure that the system is properly configured and tested. You can even have us configure a unique IP or FQDN for each DID if specific applications require this.)

Each SIP account requires an e911 address to be registered with the account. A single DID is chosen to be your “Master” e911 DID. If you call 911, we will transmit that DID as your Caller ID to the e911 dispatch regardless of what you send us.

Master and Additional E911 Locations

If your PBX services multiple locations and/or you want specific phones to have a different DID transmitted to the e911 operator, you can easily enable additional locations. You simply choose

Additional e911 Locationsthe “Set E911” option on the DID, add the address information, agree to the terms and submit it.If you want a different DID to be your master e911 DID, such as the main receptionist phone number, once e911 enabled, simply choose the option to make that DID your master. You can do this to any of your SIPStation DIDs and we’ve priced the service very reasonably, at just $1.95/month for each additional location you have enabled for e911!  The Additional E911 Addresses link provides more information including how to enable a second site that has multiple extensions and multiple DIDs with just one additional e911 enabled DID.

Additional Module Enhancements

In addition to these integrated SIPStation features, the module will automatically add routes to a brand new system that has no routes configured. If there are routes configured, a push of a button will allow you to add these routes in addition to your existing routes.

In the old SIPStation module Incoming route configuration for each DID was limited to User Extensions, or you had to go to the normal inbound route section of FreePBX to route to other destinations. The new module allows you to pick any destination on your system, right from the SIPStation page!

Download and Beta Test

If you would like to try out the new module and are running FreePBX 2.11, you can download it from our mirror site here. It will be available on 2.10 as well when we release. Issues can be reported to SIPStation support or directly in the FreePBX issue tracking system.

The FreePBX and Schmooze Team!

Security Notice

Earlier this week we detected a breach to one of our servers as a result of a vulnerability in the OpenX Open Source project that was reported earlier this month. We utilize OpenX within the server infrastructure. The hacker got to our system prior to us updating the server.

We closed the security hole upon detecting it and have spent many dozens of engineering hours scanning through our systems to isolate areas that might have been compromised.

Shortly into this process, one of our community members reported an anomaly in a Distro upgrade script that was quickly tracked down to a compromised upgrade script on our server. We were able to contain this issue quickly such that only 8 other customers downloaded the script.

Before elaborating on the breach I want to take the opportunity to talk about something positive in the mist of this ugly issue. Our upgrade scripts are open, human readable scripts. As such, thousands of eyes can review our work and it was this process that helped quickly discover and contain the vulnerability. For that we are very grateful!

The vulnerability in the upgrade script does the following. Upon running the upgrade it goes out to a pastebin site and installs a very small script to the following location on the compromised system :


That script is designed to receive two parameters: a password and an arbitrary string that can be decoded and executed in PHP on the compromised server. Since the upgrade script goes out to an anonymous pastebin site to download and install faris.php, the hacker does not know about the compromised system. Therefore, the hacker is not able to directly track the system. This means the hacker must randomly scan the entire internet seeking out systems open to the internet that respond to an http request to the faris.php script. As is the case with many vulnerabilities, the hacker probably had scripts running around the internet looking for this faris.php script so it can download and execute an unknown attack. Our efforts tracking down this vulnerability made it clear that this hacker has compromised other projects and there are certainly scripts out there looking for faris.php Since the hacker protected their vulnerability with a password that is hashed, it makes it extremely difficult for ‘[i]copy-cat[/i]’ hackers to write and scan the internet for such compromised systems to do their own damage.

We are looking at mechanisms to put in place to help further protect against a vulnerability such as this. The FreePBX module admin already has a cross check to md5 hashes when downloading module upgrades. That mechanism is an improvement though by far not immune to being fooled. We are examining the Distro upgrade script process as well as the current Module Admin system to plan on future improvements to further cross check against such attacks or general download corruption.

Although we are still scanning various systems, we feel this is probably the extent of the damage done by this compromise. If we find other issues that need communicating we will do such.

[b]The FreePBX Team[/b]

Balancing the Multiple Faces of Open Source

Why do we spend so much of our personal time keeping FreePBX vibrant and thriving? Why do you choose to spend time helping this project, or using FreePBX vs. the many other choices out there? What about the name FreePBX? Some of you love the name and some of you find it a hindrance to your business efforts.

Running a project as big and widespread as FreePBX involves a balancing act we must constantly adjust in an effort to bring value to all of the different camps of users while continuing to provide the fun, motivation and justification for us to drive the project forward keeping it the leader of the Open Source PBX world and the dominant platform in adoption and influence of Asterisk.

Keeping the project fun is at the top of our list. Without fun there is no motivation, there are few contributors and the project would stagnate. The very name of the project, FreePBX, is a motivation to many as to the fun factor of working with us. What’s in the name? Too often ‘Free’ is associated with no cost when anyone who has worked with it knows that there is always a cost, whether monetarily in seeking help or your own time in learning and getting the project to work for your needs. To us, ‘Free’ is about the Freedom to Choose™ meaning breaking free of the constraints and limitations of the proprietary phone system word. Since fun is always an important factor, our latest T-Shirt, distributed to all the recent attendees of our last OTTS FreePBX Training class demonstrates one version of our fun:

Defending You From Propietary Phone Systems Everywhere, Join The FreePBX Revolution

Defending You From Proprietary Phone Systems Everywhere, Join The FreePBX Revolution

This meaning of ‘Free’ probably resonates with many more of you but I’m sure there are those who still feel the name is a hindrance in their sales efforts. This highlights the balancing act we are faced with. Where this group may have trouble with the name, another camp of users may be in love with the name and what it stands for but has trouble with the commercial module side of FreePBX fearing it somehow detracts from the spirit or purity of the project while the first camp may find these offerings of significant value in their sales efforts against competitive market forces.

Our goal is to find a way to balance all of these efforts. Fun is important; empowering the different channels and user camps of FreePBX is important; our ability to make a viable living to keep all of us employed full time in keeping this project at the forefront of telephony is important. All of these contribute to keeping your confidence in the stability and long-term viability of FreePBX so you can feel confident that you (and your customers where applicable) will be taken care of. As such, we drive efforts on all fronts to try and accommodate all of the different camps out there!

Tony and I were in Huntsville, AL two weeks ago conducting an OTTS FreePBX training and Reseller Certification Testing while also interfacing with the core Asterisk development team around FreePBX 2.12 / Asterisk 12 plans. OTTS and the Reseller program are efforts that deliver valuable education and services to a camp of you while providing one source of income for the project. While we were there, we got a “call for help” from another camp, Kyle, the highly motivated ‘hobbyist’ … dedicated long time telephone historian buff and motivated local student who was trying to get FreePBX to work with a DAHDi card provided by Mark Spencer (his mentor) and some VERY OLD (read antique) phones that Kyle collects. Mark received the call for help while we were having dinner together and told Kyle he’d stop by later with “a couple of friend’s” who were in town visiting. In comes the fun part, when Kyle opened the door and was introduced to “meet Philippe and Tony, they run FreePBX” … watching his jaw drop, speechless…  

Front left to right: Marc Spencer (founder of Asterisk), Tony Lewis (FreePBX Distro Lead), Philippe Lindheimer (FreePBX Lead) and in the back: Kyle.

Front left to right: Marc Spencer (founder of Asterisk), Tony Lewis (FreePBX Distro Lead), Philippe Lindheimer (FreePBX Lead) and in the back: Kyle.

This experience exemplifies the importance of balance. I won’t ever forget the feeling of reward watching Kyle’s expression when he was introduced to us. Even more exciting was seeing him receive his first phone call on one of his vintage phones, after we saved him hours of work by downloading the recently revived DAHDi Configuration module and instantly bringing his system to life!

This experience would not have been possible had we not been in Huntsville, teaching OTTS to some of the other camps while brining income into the project to help it thrive. Over the years we’ve provided free or very low cost scholarships for OTTS to many participants who had themselves contributed countless time and energy into the project but didn’t have the means or justification to pay for its expense.

What about those of you who find the name FreePBX a hindrance to your sales effort? Over the last 2+ years, since version 2.10, we have redesigned the inner workings of FreePBX to allow for significant branding capabilities. At a basic level it is relatively easy to change major logos and links in Advanced Settings to your own. It is also possible, with the addition of a custom skinning module, to significantly redesign the look and feel of the FreePBX GUI and completely remove the name ‘FreePBX’ from the GUI pages. This can be done if you have reasonably experienced talent, or we offer an OEM program to do this for you inclusive of a custom online module repository to both keep your skinning module up-to-date and limit the available online modules to those that you want to be viewed by your customers. For those of you who want to have our Copyright removed, we even have a rider to the OEM program to have this done as well. (Important reminder, GPL allows you to take our code and change it, removing FreePBX as you desire and with its removal, removing the requirement to include trademark notices. However, it does NOT allow for the removal of Copyright Notices. As long as you are using any of the Copyright protected portions of FreePBX, which is most of FreePBX, you must include the Copyright unless you work through our program thus getting permission to remove it from the Copyright holders.)

So … whether you are an enthusiast, a reseller/integrator, a do-it-yourself business owner, an OEM or another camp within the hundreds of thousands of FreePBX users out there, we want you to understand that all of you are important to us and we are in a constant balancing act to try to keep FreePBX fun, interesting, innovative, stable, attractive and sellable in ways that meet everyone’s needs. We always love to hear what you like and are always open to your feedback in all its forms, and more often then not, we may have already provided solutions to some of the challenges or requests that you are looking for!

Philippe – On Behalf of the FreePBX and Schmooze Teams!

FreePBX 2.11 Final

If you’ve been on top of the online module repository then you may have noticed that the last Framework and Core update brought your 2.11 system up to final release state. As we discussed in [url=/news/2013-04-18/quick-release-candidate-and-otts-space-still-available] one of our last blogs[/url] this has been a long release but we are excited to mark it final and equally excited to see how many systems out there are running it in production!

To try and go through a run down of what 2.11 added would be a bit too overwhelming for a blog post. We encourage you to join the 15,000 or more 2.11 users out there in experiencing all the great work we’ve done! If you want a first hand walkthrough and enjoy making last minute plans, there’s still a couple seats left in next weeks [url=/training]OTTS FreePBX training at Digium Headquarters in Huntsville, AL[/url].

With 2.11 behind us we’ll probably be taking a short breather and while doing such, expect to see some updates to the “trac” side of the website where we will be migrating it to some much improved ticketing and tracking tools that Andrew (tm1000) has been doing such a great job working on. That will also solve the problem that many of you have had not being able to add attachments to trac tickets that we ran into in a server upgrade a few months ago.

Moving forward, the development team has already spent some time with the Asterisk developers to comprehend the huge upcoming changes in Asterisk 12 later this year. This is going to involve a huge effort on our part given the entire SIP stack has been replaced and significant other chunks such as the Asterisk manager have changed drastically. There will be a huge burden on the part of the FreePBX team to adapt to these changes and enable the rest of the eco system to follow suit!

For now, go upgrade your systems to 2.11 if you’ve been waiting for this “official” milestone and see what the last many months has in store for you!

Philippe – On behalf of the FreePBX and Schmooze Team!

Quick Release Candidate and OTTS Space Still Available

We usually have quite a few beta sites up before moving to a release candidate but having over 10,000 beta systems out there is a bit of a record:) … maybe a little embarrassing that we did not ‘deem’ it release candidate quality some time ago. With all that said though, we have now rolled the release candidate and given how heavily 2.11 has been tested and is in production, it’s simply a formality and we should be moving to final release within a week or so!

The 2.11 release has been a bit of a ‘victim’ of feature creep which has caused a somewhat perpetual cycle. As time went be we added features ranging from the [url=/news/2012-11-05/2-11-beta-1-release-is-out]new popOver ability[/url] to many new modules ranging from Motif (google voice) to a DAHDi configuration to [url=]the commercial endpoint manager[/url] and the list goes on. As these features and new modules kept pouring in we of course kept prolonging the beta cycle. It’s important to us when we say something is production ready, it really is … even though over 10,000 of you seem pretty happy with what’s there:)

For those of you running 2.10 and prior, never fear, we’ll release the 2.10 to 2.11 upgrade tool tomorrow which will give you easy GUI access to migrate your 2.10 and prior systems.

[b]OTTS Training at Digium Headquarters[/b]

Tony [url=/news/2013-03-12/open-telephony-training-seminar-may-2013-huntsville-alabama]blogged[/url] about the [url=/training]upcoming training at Digium Headquarters in Huntsville, AL[/url] where we will also be conducting the first [url=/news/2013-03-29/announcing-the-schmooze-certified-reseller-program-for-freepbx-and-pbxact]Certified Reseller Program Testing[/url] for those interested in doing such. Whether interested in that or not, the class will continue its legacy of detailed in depth FreeBPX and Asterisk training that has been so well received. Also, with 2.11 just behind us, here’s you chance to try and convince us of that next feature that you really want to see happen in the upcoming release, over drinks maybe:)

For now, we hope to see you in Huntsville. There’s still space available but the training facility is smaller then others we’ve done classes at so we will be limited once capacity is reached!

[b]Philippe[/b] – From the FreePBX and Schmooze Team!