After getting all the prequisites in, (there are only really two you need to build by hand, iksemel and libSRTP. sox is optional. The rest are RPMs.), I started the ./configure. Success. Then make. Halfway through, the machine shuts down because I'm consuming too many resources. The first time I thought it was a fluke, but after the second time, I gave up.
But I was still intrigued to see if I could do it, so I moved to the Rackspace cloud and set up a CentOS 6 virtual machine with 20 GB of virtual drive and 512 MB of RAM. Again, no uploading a boot ISO. This isn't VMWare. The build went a lot faster when installing required RPMs. On CentOS, sox is available in the repo. On Amazon's AMI box, it was not.
However, FreePBX 2.10 won't install with Asterisk 10. You can install Asterisk 1.8, then install FreePBX, and then upgrade Asterisk to 10. So far, it works. I can't do testing of every feature, but it is easier to test in the cloud than building yet another box in my basement. (With the exception of DAHDI, of course.)
Rackspace is nice and conservative with its default CentOS build. Iptables is left open to everyone for one port -- 22 tcp -- for ssh. It responds to ping, too, but you can fix that. There's no way I was going to open up much more to everyone, like https (which works fine for FreePBX 2.10), or SIP, or RTP ephemeral ports.
How I did that: Use iptables to limit SSH to my own IP addresses, including a backup address or two. Then install OpenVPN. Given that I'm already managing certificates for https and Asterisk it's not a stretch. It's a lot easier if you have your own certificate server rather than using the scripts provided with each component. (Rant: Everyone who needs to configure https, ssl, tls, or OpenVPN on live Internet-connected machines should be required to complete a tutorial on the CONCEPTS of PKI before being allowed get access to CA and certificate creation scripts for live Internet boxes. Both Asterisk and OpenVPN ship with them.)
OpenVPN runs on port 1194 udp. So what's the other open port? 5222 for Gtalk. I just wish Google had a list of its public IPs for me to enter into iptables.
To access the box, I dial in to the OpenVPN with my certificate that has a password-protected encrypted key. Then I connect to the web interface via https. Snom phones connect via OpenVPN with a certificate and cleartext key. For backup and remote logging, the Cloud server also connects back to my basement via OpenVPN. OpenVPN is easier to configure and seems to have better uptime than my IPSec tunnels. I just hope it's as secure as IPSec.
Total cost so far: $5. It's running under a dollar a day, which is fine for a test box for a little while. I'm a little worried that I won't be able to let go after tweaking it out just the way I want it.
Downside: if iptables stops, my box is getting hacked. I'm afraid to ask how much a dedicated firewall (virtual or real) would cost.
Bug I haven't been able to fix yet: sometimes Snom can't connect via TLS or TCP after getting there through OpenSSL. UDP always works. I'm still working to figure out why.
I'd like to do an selinux policy, too, but that's going to take some time.
]]>At this point, I started to appreciate PBX-in-a-Flash a little more because that distro does a full ./configure, make, make install for Asterisk and Dahdi. The stock FreePBX distribution doesn't, but it does get things up and running quick.
After getting FreePBX running, I downloaded libsrtp and Asterisk 10. I had the same trouble with libsrtp in the Asterisk ./configure as before, so Google the error and add -fPIC etc. to the Makefile. After a couple of attempts, Asterisk finished configuring and making and installed and started. I could make calls back and forth.
However, when I first added tlsenable=yes and a path to my certs to my sip_general_custom.conf and restarted Asterisk 10, it did nothing for TLS. Asterisk wasn't even listening on port 5061. And AES encryption on an IAX2 trunk back to my production Asterisk box failed with the following error:
WARNING[1248] /usr/src/asterisk-10.0.0/include/asterisk/crypto.h: AES encryption disabled. Install OpenSSL.
OpenSSL was installed. On further investigation, I discovered that the res_crypto module was not loading or loadable.
OpenSSL-devel was not installed. So I went back and did a yum-install openssl-devel and recompiled and reinstalled Asterisk 10. Then TLS worked fine.
For the record, here are the packages I installed for Asterisk 10 on a FreePBX 2.9.0.9 distro. Dahdi and Asterisk-Add-Ons are not covered here.
zlib-devel-1.2.3-3.i386
libxml2-devel-2.6.26-2.1.2.8.el5_5.1.i386
sqlite-devel-3.3.6-5.i386
doxygen-1.4.7-1.1.i386
keyutils-libs-devel-1.2-1.el5.i386
e2fsprogs-devel-1.39-23.el5_5.1.i386
libsepol-devel-1.15.2-3.el5.i386
libselinux-devel-1.33.4-5.5.el5.i386
krb5-devel-1.6.1-36.el5_5.6.i386
openssl-devel-0.9.8e-12.el5_5.7.i386
mysql-devel-5.0.77-4.el5_5.4.i386
Another thing: You can add your SIP parameters (like tlsenable=yes) to the SIP configuration page that's available in FreePBX now, instead of hand-editing /etc/asterisk/sip_general_custom.conf.
Next: An selinux policy for Asterisk?
]]>To get encryption running in Asterisk, take things step by step. Asterisk encryption is really two types of enrcryption: SIP-S, or SIP over TLS for signalling -- traditional PKI using OpenSSL; and SRTP for the voice traffic. Each is configured independently under each extension. Asterisk Encryption is not end-to-end. It is extension-to-Asterisk, and maybe Asterisk-to-Asterisk on trunks. Asterisk encryption is not foolproof, and it will not encrypt calls to the PSTN. It's still vulnerable to MITM attacks with faked certs, and to a compromise of your Asterisk install. Also, just because your connection to Asterisk is encrypted and the lock symbol shows up on your phone doesn't mean the other extension (or trunk) on the other side of Asterisk is also secure.
The key for SRTP is exchanged over the SIP channel, so if SIP's not encrypted, what's the point of bothering with SRTP? If you want to see what you're missing by not using encryption, download Cain from oxid.it and run it while you register the Bria softphone client and make a call from your windows computer. You get hashes of your SIP passwords and recordings of your phone calls, all from a GUI Windows program. If you have a network tap or span port in the right spot, you can intercept every call and signal between your Asterisk server and its SIP endpoints.
To get started, Asterisk 1.8 requires libsrtp. (You can thank Cisco for making it available, too.) You'll need to download, configure, make, make runtest, and make install before you hit ./configure on your Asterisk source. (Yes, recompiling Asterisk is necessary.) Then, when you do ./configure on your Asterisk source, you'll get an error when it finally gets to checking your libsrtp availability. Google the error phrase, and you'll learn what to change in the CFLAGS line of your libsrtp Makefile. Recompile and reinstall libsrtp, then reconfigure Asterisk. Then in your Asterisk source, make menuselect and select libsrtp under resources. Don't forget to make sure your other cool Asterisk features (like gtalk) are still enabled before you save and exit. Then recompile and reinstall Asterisk. There are plenty of tutorials for these steps on the Interwebs.
Once Asterisk is running again, you can start by getting a certificate for TLS. I am not going to do yet another certificate from self-signed CA howto here. There's an excellent one over at madboa. It's nice for Asterisk to now include a CA/Cert script, but you should really understand how SSL works. I know people who send private keys via email.
Another note about certificates: even if all your workstations are in a friendly LAN with the same DNS suffix, use the fully-qualified Domain Name (FQDN) for your Asterisk certificate. Some endpoints (Bria, I'm looking at you) require FQDN and cannot validate the certificate if you're getting to your Asterisk server by a short name. Using IP addresses for the registrar in your endpoints? That won't work either. You'll need the CA cert on some endpoints but not others. (Snom phones like certs in DER format; Asterisk and Aastra like PEM. To copy from PEM to DER, try this:
openssl x509 -in input.crt -inform PEM -out output.crt -outform DER
Once you get your CA and certificate, your sip_general_custom.conf file should have lines as follows. (In FreePBX, sip_general_custom.conf is the one you can hand-edit safely.)
tcpenable=yes ; If you don't have TCP enabled for SIP now, go ahead and enter this and test it.
tlsenable=yes
tlsbindaddr=0.0.0.0
tlsclientmethod=tlsv1
tlscertfile=/etc/asterisk/keys/asterisk.crt ; concatenate the key file to the bottom of the cert file so they're together.
tlscafile=/etc/asterisk/keys/asteriskCA.crt
tlscipher=AES256-SHA:AES128-SHA:RC4-SHA:RC4-MD5;
Some say put "ANY" there for tlscipher. I suggest you want encryption that's strong but compatible with your endpoints. For valid strings, look here: http://www.openssl.org/docs/apps/ciphers.html#CIPHER_STRINGS. To see which one your endpoint is using, you'll need to do a network capture via Wireshark. If there's no shared cipher between your endpoint and Asterisk, you'll see something like this in your logs:
/var/log/asterisk/full:[2012-01-03 13:59:30] VERBOSE[29926] tcptls.c: == Problem setting up ssl connection:
error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher
Also, you'll need to trust your self-signed CA in Linux. (Seriously, don't set tlsdontverifyserver=yes -- it's just lame.)
If you're on Fedora or CentOS, the folder is /etc/pki/tls/certs.
# ln -s myAsteriskCA.cer `openssl x509 -hash -noout -in myAsteriskCA.cer`.0
then verify:
# openssl verify -CApath /etc/pki/tls/certs /etc/asterisk/keys/myAsterisk.cer
should get you a:
/etc/asterisk/keys/myAsterisk.cer: OK
Once you have a certificate in place, restart Asterisk and see what comes up:
/var/log/asterisk/full:[2012-01-02 23:37:26] VERBOSE[24700] tcptls.c: SSL certificate ok
Then you can try connecting with TLS. In FreePBX, you go to the particular extension you want to test and select TLS Only and reload. Each endpoint is different. Once TLS is successful, you can try setting the extension to use SRTP encryption in FreePBX.
Notes on Phones:
Each phone is different. Bria was easy, so you may want to start with that to see if Asterisk is working correctly. In account settings, domain needs to be a FQDN that matches what you've assigned the certificate. You also need to import the your CA cert into Windows' CA certificate store. For signaling transport, select TLS. For SRTP, select "Make and accept only encrypted calls" for Media Encryption. With any luck, when you hit the apply button, you should see "All accounts are active." While Bria for Windows validates certificates, it's optional on the Bria for iPhone/iPad.
The other software phone, 3CX, has settings for TLS but gets caught in an SSL handshake loop when trying to register, in spite of a shared cipher suite.
For the SNOM 370 to connect via SRTP successfully, I had to set RTP/SAVP to Mandatory. (Identity | RTP in the Snom Menu.) If you have multiple SIP accounts to the same Asterisk server in your SNOM phone, having any one ID configuration incorrect can break them all (Error message "Not acceptable here" whenever you dial). Also set the SRTP Key to 80-bit; 32-bit is the SNOM default, which doesn't work. (This has changed in Asterisk 10: Add option encryption_taglen to set auth taglen only 32 and 80 are supported currently.)
Also, disable RTCP support in SNOM if you don't want Asterisk to crash when it's doing SRTP.
user_host1!: my.asterisk.net;transport=tls
user_host2!: my.asterisk.net;transport=tls
user_srtp1!: on
user_srtp2!: on
user_symmetrical_rtp1!: off
user_symmetrical_rtp2!: off
user_server_type1!: asterisk
user_server_type2!: asterisk
user_savp1!: mandatory
user_savp2!: mandatory
empty_tls_client_cert!: off
xcap_via_tls!: true
tls_server_authentication!: on
user_auth_tag1!: off
user_auth_tag2!: off
support_rtcp!: off
On Aastra 6757iCT I got TLS working, and SRTP for inbound. Unfortunately, when SRTP is active, dialing out doesn't work at all, with "call failed" every time so far. I've gone through most of the DTMF options, inluding SIP, and still no joy. The difference between CA certs and Trusted Certs on the TLS support page is not clear to me. Aastra says to put your CA root & intermediate certs in CA Certs and Trusted Certs on the TLS support menu. For my mode -- persistent TLS -- I have only trusted certificates, a PEM file with concatenated public certs of my Asterisk server and its issuing CA.) Also, you need to manually set all the ports to 5061 for TLS. The others phones switched ports automatically. Relevant lines:
sip local port: 5061
sip local tls port: 5061
sip proxy port: 5061
sip registrar port: 5061
sip outbound proxy port: 5061
sip srtp mode: 0
(SRTP disabled -- so dialing out can work.)
sip transport protocol: 4
sips trusted certificates: asterisk2.pem
sips persistent tls: 1
I'd like to make more progress on the Aastra, but it requires even more reboots than the Snom.
Finally, run Cain again to see if your phones are encrypted for SIP and Voice. Even when SRTP is encrypting voice traffic, you can tell that a call is happening and how log it lasts. If you can't get a tap, you can do a TCP dump to a .cap file on your Asterisk server and then open it with Wireshark. Then you can take a look to see if the data looks encrypted.
Leftover vulnerabilities: This configuration still uses passwords for client authentication. You can use client-side certs if you want. Certificate Authorities are vulnerable. Bria (at least on Windows) uses the Windows Certificate Authorities that come installed. SNOM phones ship with CA certs aboard. (You still have to upload your own certs to the SNOM phone.) SNOM has no mechanisms for a certificate revocation list, so compromised CAs can be used to impersonate your certificates in a MITM attack. Aastra makes you upload any CA certs for trust.
Finally, for the SNOM phones that have the OpenVPN client, using the OpenVPN connection back to your Asterisk server and encryption within the (encrypted) VPN connection should provide some additional level of security.
(Assuming you haven't left your private keys exposed someplace.)
The secure PBX is not connected to the PSTN. And when you say man-in-the-middle attack, think government-in-the-middle. It's gender neutral.
]]>If you pan out, the placemark icons will cover the continental United States. It also drives home the point that if you're flying high enough and your engine dies, you should be able to glide to an airport.
Improvements: Public airports are in blue; private airports are in red. AWOS data is included where applicable. (If airports have an AWOS, it's included. Note that ATIS is not the same as AWOS.)
Code improvements: All output code is Python. The database is still Microsoft SQL, and the API is adodb for Python. Next: Porting output code to Linux (need a new database connection) and keeping back end MS SQL for now. Long-term: cleaning up and uploading data via python into MySQL.
Random Comments on Python: String manipulation in python is the same as in visual basic script, but different. If statements have no end, just an indent and and end of indent.
The KML file is in the KML archive, as usual. DO NOT USE FOR NAVIGATION.
]]>One of those data sets is Radiological Air Samples from the US DOE/NNSA Response to the 2011 Fukushima Incident. You can see more free data sets on the Data.Gov web site.
Since the set included latitude and longitude, I created a KML file. I have no idea exactly how dangerous those levels of radiation are, but it's still interesting to see what was found and where they sampled.
]]>Also, you can now view KML files in Google Maps by typing in the URL to the KML file in the search bar. You'll end up with a URL in Google Maps that looks like this: http://www.google.com/maps?q=http%3A%2F%2Fcw.sampas.net%2Fkml%2Fxtide.kml&hl=en&ll=37.439974%2C-131.660156&spn=101.116429%2C158.027344&sll=37.0625%2C-95.677068&sspn=54.357317%2C79.013672&vpsrc=6&t=h&z=3&source=gplus-ogsb .
The xtide.kml file is in the usual place.
]]>See the KML and KMZ in the KML Archive. The sheer number of lines and placemarks may use up all your memory.
]]>The main problems were my coordinate lists, where instead of delimiting by a space between tuples, I had delimited with a newline. I also did not close the coordinate sets with the first coordinate. The FAA doesn't either, because it's obvious. You draw a line from the last coordinate to the first. After the loop, I do a recordset.movefirst and write the first coordinate pair AGAIN.
Anyhow, you can see the new file in the KML archive. I may get around to doing more than just the SUA files. I'm also considering migrating the entire codebase to Python for portability. And because all the cool kids are writing in Python, and I can't stay in vbscript forever...
This KML file contains the FAA's special use types of airspace: alert areas, military operations areas, prohibited areas, restricted areas, and warning areas.
]]>Asterisk's built-in encryption is only just starting to work in 1.8, and it would require you to open ports to your Asterisk server from the Internet. Enter OpenVPN, an open-source user-space VPN that's lighter weight than IPSec. Better yet, no per-client licensing fees like Cisco. (Unless you want commercially supported OpenVPN @ $10/client.) Asterisk itself isn't quite ready for the enterprise, but we're all hoping Asterisk 10 is ready for prime time.
Using the built-in OpenVPN server in pfSense 2.0, you can connect your Snom phone across the internet to your internal network, and Asterisk securely. (Although it does not do end-to-end encryption, even if you run OpenVPN on your Asterisk server.)
Part 1: pfSense OpenVPN config
In the pfSense OpenVPN server page, choose the following parameters: (DISCLAIMER: this is certainly not the only way to do this, nor the most secure.) I'm also going to assume you've already used the pfSense Cert Manager to create a CA and issue a client certificate for the your Snom phone.
OpenVPN | Server
General
Disabled: Not checked.
Server Mode: Remote Access (SSL/TLS).
Protocol: UDP
Device Mode: tun
Interface: WAN
Local Port: 1194 (default)
Description: SnomPhoneVPN
Crypto Settings:
TLS Authentication: Checked (pfSense should populate the box with an OpenVPN Static Key.)
Peer Certificate Authority: InternalCA (What you set up in pfSense's CA Page.)
Peer Certificate Revocation List: (leave default for now.)
Server Certificate: OpenVPNServer (CA: InternalCA)
DH Params Length: 1024
Encryption Algorithm: AES-256-CBC (256-bit)
Hardware Crypto: No Hardware Crypto (Unless you've got a card...)
Tunnel Settings:
Tunnel Network: Choose a private IP space that's not 192.168.x.x, so it doesn't conflict with every NAT home network. (10.1.0.0/24) should work most places.
Redirect gateway: Checked if you want it to be more secure, but you'll lose local access to the phone.
Local Network: Enter yor local LAN IP space here, e.g. the one you Asterisk server is on.
Concurrent connections: 1 or more.
Compression: unchecked.
Inter-client Communications: not checked.
Duplicate connections: leave this checked for testing only.
Client Settings: The only one that needs to be checked is "Provide a virtual adapater IP addresss to clients."
Advanced: Nothing is required here.
Part 2: Client OpenVPN config
Use the OpenVPN client export utility (0.9.6). Export the Configuration Archive. Unzip the files. Rename the x.ovpn file to vpn.cnf and edit it to add /openvpn/ in front of the cert and key file names. Then place it in a dir/folder called openvpn and tar it from within the folder, per SNOM.
Keep in mind that the two other files in there, the personal certificate (x-.p12) and the OpenVPN TLS key (x-tls.key) are the keys to your network, so protect them. (If your certificate file is compromised, you'll need to create a certificate revocation list pronto.) When we selected Remote Access (SSL/TLS) in step one, that means certificate only, and then added the TLS key. So no username and password required. (You can try adding them, but you'll need to hard-code them in another file in the config tarball, so it won't make much difference.)
vpn.cnf after editing:
#----------
dev tun
persist-tun
persist-key
proto udp
cipher AES-256-CBC
tls-client
client
resolv-retry infinite
remote x.x.x.x 1194
tls-remote OpenVPNServer
pkcs12 /openvpn/pfsense-udp-1194.p12
tls-auth /openvpn/pfsense-udp-1194-tls.key 1
#----------
where x.x.x.x is your WAN IP Address, or preferably, your dynamically updated DNS name if your IP is subject to change.
There should be three files for you to place in the tarball: vpn.cnf, the .p12 certificate (with key), and the xtls.key. Once you have the tarball, follow SNOM's instructions to get it onto the phone. (Hint: you'll need to place it on a webserver, but preferably not one that's publicly available or unauthenticated.)
Gotchas:
So what are you to do if you need to collect file details and hashes for every folder within the subfolders of a directory? If you're doing it with VBScript, you'll need a free library available from XStandard. Once you register, you'll get a dll that you'll need to register. (It's 32-bit only, so if you're on a 64-bit box, you'll need to do this:
C:\WINDOWS\SysWOW64\regsvr32.exe XMD5.dll
and then to execute the script:
c:\windows\SysWOW64\cscript.exe FolderReportMD5.vbs )
Anyhow, this script is derived from the Sapien sample scripts. (While there are many free editors out there, I think Sapien's PrimalScript is worth every penny if you'll be doing a lot of Windows scripting.)
And since my MT template doesn't handle code well, here's a link to the text file.
'**************************************************************************
' File: FileListMD5.vbs
'
' Comments: This script uses the MD5 library available here:
' http://www.xstandard.com/en/documentation/xmd5/#api1
' This script runs through a directory tree and writes file attributes to a csv file.
' To run on x64 use C:\WINDOWS\SysWOW64\regsvr32.exe XMD5.dll and then execute via
' c:\windows\SysWOW64\cscript.exe FolderReportMD5.vbs
' Based on Sapien's sample script for FolderProperties.
'**************************************************************************
Set objFSO2 = createobject("scripting.filesystemobject")
'where to put the file list?
Set objFile = objFSO2.createtextfile("c:\scripts\" & "FileList" & ".csv")
q = """"
'write the header line of the CSV file.
objFile.WriteLine(q & "FilePath" & q & "," & q & "FileName" & q & "," & q & "DateCreated" & q _
& "," & q & "DateLastAccessed" & q & "," & q & "DateLastModified" & q & "," & q & "FileSize" & q &_
"," & q & "MD5Hash" & q & "," & q & "FileAttributes" & q)
'where to start
strSource="C:\folder"
Set objFSO=CreateObject("Scripting.FileSystemObject")
Set objFolder=objFSO.GetFolder(strSource)
Call ProcessFiles(objFolder)
Sub ProcessFiles(objFolder)
Set colFiles=objFolder.Files
For Each file In colFiles
'it's a good idea to clear out the vars on each loop
strFingerPrint = "blank"
strPath = File.Path
Set objMD5 = CreateObject("XStandard.MD5")
strFingerPrint = objMD5.GetCheckSumFromFile(strPath)
Set objMD5 = Nothing
wscript.Echo strFingerPrint
wscript.Echo "File Name:" & vbTab & File.Name
wscript.Echo "Short File Name:" & vbtab & File.ShortName
wscript.Echo "File Path:" & vbtab & File.Path
wscript.Echo "Date Created:" & vbtab & File.DateCreated
wscript.Echo "Date Last Accessed:" & vbtab & File.DateLastAccessed
wscript.Echo "Date Last Modified:" & vbtab & File.DateLastModified
wscript.Echo "File Size:" & vbtab & File.Size
wscript.Echo "File Attributes:"
strFileAttributes = " "
if File.Attributes AND 0 Then wscript.Echo " Normal"
If File.Attributes And 0 Then strFileAttributes = strFileAttributes & " Normal"
if File.Attributes AND 1 then wscript.Echo " Read-only"
If File.Attributes And 1 Then strFileAttributes = strFileAttributes & " Read-only"
if File.Attributes AND 2 then wscript.Echo " Hidden"
If File.Attributes And 2 Then strFileAttributes = strFileAttributes & " Hidden"
if File.Attributes AND 4 then wscript.Echo " System"
If File.Attributes And 4 Then strFileAttributes = strFileAttributes & " System"
if File.Attributes And 8 Then wscript.Echo " Volume"
If File.Attributes And 8 Then strFileAttributes = strFileAttributes & " Volume"
if File.Attributes AND 16 then wscript.Echo " Directory"
If File.Attributes And 16 Then strFileAttributes = strFileAttributes & " Directory"
if File.Attributes And 32 Then wscript.Echo " Archive Bit is set"
If File.Attributes And 32 Then strFileAttributes = strFileAttributes & " Archive Bit is set"
If File.Attributes AND 1024 then wscript.Echo " Alias"
If File.Attributes And 1024 Then strFileAttributes = strFileAttributes & " Alias"
if File.Attributes AND 2048 then wscript.Echo " Compressed"
If File.Attributes And 2048 Then strFileAttributes = strFileAttributes & " Compressed"
'finally, write the line to the csv file
objFile.WriteLine(q & File.Path & _
q & "," & q & File.Name & q & "," & _
q & File.DateCreated & q & "," & q & File.DateLastAccessed & q & "," & q _
& File.DateLastModified & q & "," & q & File.Size & q & "," & q & strFingerPrint & q & "," & q & strFileAttributes & q)
Next
'process Subfolders
Call ProcessSubFolders(objFolder)
End Sub
Sub ProcessSubFolders(objFolder)
Set colSubs=objFolder.SubFolders
For Each folder In colSubs
ProcessFiles(folder)
Next
End Sub
Still tough: mod_rewrite rules to make search engines happy. It also requires a PHP pagination code update, and navigation is still broken on one return link.
All in all, I've done far less syncing of directories and hand-editing of files to upgrade from 2 to 3 than I did from 1 to 2. Then again, I'm not all there yet.
]]>I love the data views that wview provides. It shows trends at a glance that weather.com, NOAA, and NWS don't. Even online weather airport stations have no view that will let you see a trend -- they're all snapshots. With wview, I can tell when the temperature-dewpoint spread is closing.
The best part -- I can collect the data. I can export to MySQL. I can collect solar radiation stats to see if solar panels make sense at my location.
]]>So a few days ago, PBXInAFlash, releases a new version that includes support for video calls using discounted hardware video phones. Video calls have been available forever using software and computer cams. The availability of an affordable hardware phone means that there's a chance I can give one to my mom. What's the big deal with a hardware phone? My mom already knows how to use it. Everybody knows how to answer a hard phone.
Upgrading. The "supported " procedure is to upgrade to the same version of FreePBX that you'll be restoring to, and then do a backup. (Upgrade using module admin, then use the backup module...) So I installed the new release on top of my old Atom D510 server and wiped out all the old data. Restore. Restart Asterisk. Asterisk seg fault crash loop. FreePBX 2.8 doesn't validate every piece of input perfectly, so it can crash. You've been warned. I reinstalled and built from scratch, which is a great thing to be able to do, but not so great from a time perspective.
After installing the base phone system, it was up and running. My custom apps were not. The PBXinaFlash cust app scripts don't all support Asterisk 1.8 or x64. I run a few, and this is how I fixed them.
Intel has since released the Atom D510. The processor is up to a 13-watt draw, runs at about the same speed, and still runs 64-bit. What makes these chipsets better is that they max out at 4 GB of RAM and use genuine Intel Gig NICs that are widely supported and can run jumbo frames. This is a big leap, because the configured price of a fully-built mini-server around the platform remains the same. Supermicro has some great Atom motherboards that can support a home or small office doing various things. (The D525 has since come out. Compare the two here.)
Newegg has some good deals on the Supermicro Atom Rack Server and the tower server for about $70 less. Or you can just buy a motherboard and roll your own. My tower server with D510 runs just under 40 watts with 4 GB of RAM, CD, and hard disk.
What can you do with it? There are a number of Linux and BSD appliances that are free.
1) Run your own telephone switch. FreePBX is an awesome, OS-included version of Asterisk that has a clean web GUI. PBX-In-a-flash is based on FreePBX but has a few extras (nonstandard enhancements like dial weather by airport code and dial your local tide schedule) thrown in. Why would you want to run your own PBX? You can do stupid phone tricks, like really cheap phone service at $.01/minute and $1.50/month per number with Vitelity, for one. Or your own conference line. Or your own trunks over VPNs to other offices. Or just blacklist phone numbers and send telemarketers to their own voice-mail hell.
Keep in mind that to light up your home phone lines, you may need an additional analog card from Sangoma or Digium. (FXS and FXO are different, but can run on the same card.) Once you figure out how cool SIP is, you'll want to replace your house phones with SIP phones. However, you can get started with SIP free using the Xlite soft phone. The iPhone/iPod/iPad version is $7.99. It's perfectly true that you can make phone calls cheap with a Linksys PAP2T or Vonage, but if you're a telephone control freak and want to wage war on telemarketers, Asterisk is for you.
2) Run a great firewall like pfSense. It's based on FreeBSD but has a great Web GUI so you can avoid learning the subtle differences between BSD and Linux. pfSense comes in embedded and full. For the Atom server, running the full version is no sweat. And I run SNORT inline on two interfaces with no issues. A full SNORT IPS signature subscription for home use is just $30/year. And pfSense does not just IPSEC point-to-point VPNs, but also WebVPN. Try that on your Cisco ASA 5505, and you'll be paying a couple grand for the equipment, licenses, and subscription. Check out the plugins for pfSense and you'll see how much you can do with one small box. pfSense 2.0 is almost out of beta and there's a 64-bit version. (Plugins include FreeSwitch, an open-source competitor to (open-source) Asterisk, so if you want, you can even run a PBX on your firewall.)
3) Storage: Run FreeNAS and you'll be able to scale reasonably out of the box. The Atom Motherboard has six SATA slots and two GB NICs that do jumbo frames. Hello iSCSI. With 2TB disks, that's 12 TB of storage. FreeNAS offers CIFS (Windows), Apple (AFP), iSCSI, and NFS mount points. Add a serious SATA RAID card to get even more disk IO performance out of your little Atom box. Obviously, I would recommend the tower server case for FreeNAS because it has room for more disks.
4) Run Apache/PHP/MySQL applications. Run Fedora, CentOS, whatever. You can run your own apps at home on top of your favorite flavor of Linux/BSD. One of my favorites is Gallery2. There's even semi-free apps (free for no enterprise features) like Movable Type (you're reading this on an MT platform), and even run more than one on the same mini-Server.
5) Collect data. Run a weather station. Run a log server. Run a crazy blog and see who hits it with which keywords. Collect IPS events from multiple firewalls and correlate them.
]]>Also, when you use FAA data, be sure to escape special SQL characters in the names. I think there's an O'Brien restricted area. Be aware, there are single quotes in special use area names.
]]>