ACL for ESL issue ?
Hello, I was trying to enable esl connections from outside of fs host. To do so I've followed https://wiki.freeswitch.org/wiki/Mod_event_socket#Configuration and changed default event_socket.conf.xml from: <configuration name="event_socket.conf" description="Socket Client"> <settings> <param name="nat-map" value="false"/> <param name="listen-ip" value="::"/> <param name="listen-port" value="8021"/> <param name="password" value="ClueCon"/> </settings></configuration> to: <configuration name="event_socket.conf" description="Socket Client"> <settings> <param name="nat-map" value="false"/> <param name="listen-ip" value="0.0.0.0"/> <param name="listen-port" value="8021"/> <param name="password" value="ClueCon"/> </settings></configuration> and issued: reload mod_event_socket. Trying to telnet to fs host on port 8021 I observe: Content-Type: text/rude-rejectionContent-Length: 24 Access Denied, go away.Content-Type: text/disconnect-noticeContent-Length: 67 Disconnected, goodbye.See you at ClueCon! http://www.cluecon.com/Connection closed by foreign host. And in fs log i can see the following: mod_event_socket.c:2603 IP "someiphere" Rejected by acl "loopback.auto" But as far as I understand the event_socket.conf.xml doesn't mention any ACL set up against ESL connection ?Would someone please be so kind to point what am I missing ?Thanks.Regards,Pavel.
You need to create a new ACL in acl.conf.xml and set that ACL in event_socket so you will be allowed to connect. loopback.auto would allow connections only from 127.0.0.1. Thank you, — Muhammad Naseer Bhatti
On Sep 11, 2015, at 2:58 PM, Pavel <my.post@hotmail.com> wrote:
Hello, I was trying to enable esl connections from outside of fs host. To do so I've followed https://wiki.freeswitch.org/wiki/Mod_event_socket#Configuration <https://wiki.freeswitch.org/wiki/Mod_event_socket#Configuration> and changed default event_socket.conf.xml from:
<configuration name="event_socket.conf" description="Socket Client"> <settings> <param name="nat-map" value="false"/> <param name="listen-ip" value="::"/> <param name="listen-port" value="8021"/> <param name="password" value="ClueCon"/> </settings> </configuration>
to:
<configuration name="event_socket.conf" description="Socket Client"> <settings> <param name="nat-map" value="false"/> <param name="listen-ip" value="0.0.0.0"/> <param name="listen-port" value="8021"/> <param name="password" value="ClueCon"/> </settings> </configuration>
and issued: reload mod_event_socket.
Trying to telnet to fs host on port 8021 I observe:
Content-Type: text/rude-rejection Content-Length: 24
Access Denied, go away. Content-Type: text/disconnect-notice Content-Length: 67
Disconnected, goodbye. See you at ClueCon! http://www.cluecon.com/ <http://www.cluecon.com/> Connection closed by foreign host.
And in fs log i can see the following:
mod_event_socket.c:2603 IP "someiphere" Rejected by acl "loopback.auto"
But as far as I understand the event_socket.conf.xml doesn't mention any ACL set up against ESL connection ? Would someone please be so kind to point what am I missing ? Thanks. Regards, Pavel.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>
Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>
Muhammad, Thanks for your reply. I suppose that Steven's answer is more on topic of my question. Regards, Pavel.From: nbhatti@gmail.com Date: Fri, 11 Sep 2015 20:16:51 +0300 To: freeswitch-users@lists.freeswitch.org Subject: Re: [Freeswitch-users] ACL for ESL issue ? You need to create a new ACL in acl.conf.xml and set that ACL in event_socket so you will be allowed to connect. loopback.auto would allow connections only from 127.0.0.1. Thank you,—Muhammad Naseer Bhatti On Sep 11, 2015, at 2:58 PM, Pavel <my.post@hotmail.com> wrote:Hello, I was trying to enable esl connections from outside of fs host. To do so I've followed https://wiki.freeswitch.org/wiki/Mod_event_socket#Configuration and changed default event_socket.conf.xml from: <configuration name="event_socket.conf" description="Socket Client"> <settings> <param name="nat-map" value="false"/> <param name="listen-ip" value="::"/> <param name="listen-port" value="8021"/> <param name="password" value="ClueCon"/> </settings></configuration> to: <configuration name="event_socket.conf" description="Socket Client"> <settings> <param name="nat-map" value="false"/> <param name="listen-ip" value="0.0.0.0"/> <param name="listen-port" value="8021"/> <param name="password" value="ClueCon"/> </settings></configuration> and issued: reload mod_event_socket. Trying to telnet to fs host on port 8021 I observe: Content-Type: text/rude-rejectionContent-Length: 24 Access Denied, go away.Content-Type: text/disconnect-noticeContent-Length: 67 Disconnected, goodbye.See you at ClueCon! http://www.cluecon.com/Connection closed by foreign host. And in fs log i can see the following: mod_event_socket.c:2603 IP "someiphere" Rejected by acl "loopback.auto" But as far as I understand the event_socket.conf.xml doesn't mention any ACL set up against ESL connection ?Would someone please be so kind to point what am I missing ?Thanks.Regards,Pavel. _________________________________________________________________________Professional FreeSWITCH Consulting Services: consulting@freeswitch.orghttp://www.freeswitchsolutions.comOfficial FreeSWITCH Siteshttp://www.freeswitch.orghttp://confluence.freeswitch.orghttp://www.cluecon.... mailing listFreeSWITCH-users@lists.freeswitch.orghttp://lists.freeswitch.org/mailman/listinfo/freeswitch-usersUNSUBSCRIBE:htt... _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
You need to use one or more apply-inbound-acl to allow access via ACLs you have created. If you don't supply apply-inbound-acl then the default will be loopback.auto, to lock access down to local access only. In 1.2 the default was to not apply any ACL (allow anyone), in 1.4 it requires you to be explicit or it'll only allow local connections even if you listen on 0.0.0.0 or ::. This is more secure. If you're opening it up to remote access you want to be very careful about who you allow to connect. The protocol is unencrypted, the password is sent in plaintext, and it provides the ability to crash freeswitch or execute system commands as the freeswitch user. So it's a security hole that you don't want to be any more open than it absolutely has to be. On 11 September 2015 at 12:58, Pavel <my.post@hotmail.com> wrote:
Hello, I was trying to enable esl connections from outside of fs host. To do so I've followed https://wiki.freeswitch.org/wiki/Mod_event_socket#Configuration and changed default event_socket.conf.xml from:
<configuration name="event_socket.conf" description="Socket Client"> <settings> <param name="nat-map" value="false"/> <param name="listen-ip" value="::"/> <param name="listen-port" value="8021"/> <param name="password" value="ClueCon"/> </settings> </configuration>
to:
<configuration name="event_socket.conf" description="Socket Client"> <settings> <param name="nat-map" value="false"/> <param name="listen-ip" value="0.0.0.0"/> <param name="listen-port" value="8021"/> <param name="password" value="ClueCon"/> </settings> </configuration>
and issued: reload mod_event_socket.
Trying to telnet to fs host on port 8021 I observe:
Content-Type: text/rude-rejection Content-Length: 24
Access Denied, go away. Content-Type: text/disconnect-notice Content-Length: 67
Disconnected, goodbye. See you at ClueCon! http://www.cluecon.com/ Connection closed by foreign host.
And in fs log i can see the following:
mod_event_socket.c:2603 IP "someiphere" Rejected by acl "loopback.auto"
But as far as I understand the event_socket.conf.xml doesn't mention any ACL set up against ESL connection ? Would someone please be so kind to point what am I missing ? Thanks. Regards, Pavel.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Steven, thanks a lot for your reply. The implicit apply-inbound-acl with a value of loopback.auto was my initial guess, but there were no mentions of it in wiki (perhaps I'd overlooked it). Would you be so kind to also answer is there any way to stack some acls like this: <configuration name="event_socket.conf" description="Socket Client"> <settings> <param name="nat-map" value="false"/> <param name="listen-ip" value="0.0.0.0"/> <param name="listen-port" value="8021"/> <param name="password" value="ClueCon"/> <param name="apply-inbound-acl" value="loopback.auto"/> <param name="apply-inbound-acl" value="192.168.1.0/24"/> </settings></configuration> Regards,Pavel. From: steveayre@gmail.com Date: Mon, 14 Sep 2015 09:18:57 +0100 To: freeswitch-users@lists.freeswitch.org Subject: Re: [Freeswitch-users] ACL for ESL issue ? You need to use one or more apply-inbound-acl to allow access via ACLs you have created. If you don't supply apply-inbound-acl then the default will be loopback.auto, to lock access down to local access only. In 1.2 the default was to not apply any ACL (allow anyone), in 1.4 it requires you to be explicit or it'll only allow local connections even if you listen on 0.0.0.0 or ::. This is more secure. If you're opening it up to remote access you want to be very careful about who you allow to connect. The protocol is unencrypted, the password is sent in plaintext, and it provides the ability to crash freeswitch or execute system commands as the freeswitch user. So it's a security hole that you don't want to be any more open than it absolutely has to be. On 11 September 2015 at 12:58, Pavel <my.post@hotmail.com> wrote: Hello, I was trying to enable esl connections from outside of fs host. To do so I've followed https://wiki.freeswitch.org/wiki/Mod_event_socket#Configuration and changed default event_socket.conf.xml from: <configuration name="event_socket.conf" description="Socket Client"> <settings> <param name="nat-map" value="false"/> <param name="listen-ip" value="::"/> <param name="listen-port" value="8021"/> <param name="password" value="ClueCon"/> </settings></configuration> to: <configuration name="event_socket.conf" description="Socket Client"> <settings> <param name="nat-map" value="false"/> <param name="listen-ip" value="0.0.0.0"/> <param name="listen-port" value="8021"/> <param name="password" value="ClueCon"/> </settings></configuration> and issued: reload mod_event_socket. Trying to telnet to fs host on port 8021 I observe: Content-Type: text/rude-rejectionContent-Length: 24 Access Denied, go away.Content-Type: text/disconnect-noticeContent-Length: 67 Disconnected, goodbye.See you at ClueCon! http://www.cluecon.com/Connection closed by foreign host. And in fs log i can see the following: mod_event_socket.c:2603 IP "someiphere" Rejected by acl "loopback.auto" But as far as I understand the event_socket.conf.xml doesn't mention any ACL set up against ESL connection ?Would someone please be so kind to point what am I missing ?Thanks.Regards,Pavel. _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
From a read of the source code, yes you can do that.
Although the value is an ACL name, not a CIDR... you'd want to create an ACL named something like 'lan' and add 192.168.1.0/24 to that. On 14 September 2015 at 11:56, Pavel <my.post@hotmail.com> wrote:
Steven, thanks a lot for your reply. The implicit apply-inbound-acl with a value of loopback.auto was my initial guess, but there were no mentions of it in wiki (perhaps I'd overlooked it). Would you be so kind to also answer is there any way to stack some acls like this:
<configuration name="event_socket.conf" description="Socket Client"> <settings> <param name="nat-map" value="false"/> <param name="listen-ip" value="0.0.0.0"/> <param name="listen-port" value="8021"/> <param name="password" value="ClueCon"/> <param name="apply-inbound-acl" value="loopback.auto"/> <param name="apply-inbound-acl" value="192.168.1.0/24"/> </settings> </configuration>
Regards, Pavel.
------------------------------ From: steveayre@gmail.com Date: Mon, 14 Sep 2015 09:18:57 +0100 To: freeswitch-users@lists.freeswitch.org Subject: Re: [Freeswitch-users] ACL for ESL issue ?
You need to use one or more apply-inbound-acl to allow access via ACLs you have created.
If you don't supply apply-inbound-acl then the default will be loopback.auto, to lock access down to local access only.
In 1.2 the default was to not apply any ACL (allow anyone), in 1.4 it requires you to be explicit or it'll only allow local connections even if you listen on 0.0.0.0 or ::. This is more secure.
If you're opening it up to remote access you want to be very careful about who you allow to connect. The protocol is unencrypted, the password is sent in plaintext, and it provides the ability to crash freeswitch or execute system commands as the freeswitch user. So it's a security hole that you don't want to be any more open than it absolutely has to be.
On 11 September 2015 at 12:58, Pavel <my.post@hotmail.com> wrote:
Hello, I was trying to enable esl connections from outside of fs host. To do so I've followed https://wiki.freeswitch.org/wiki/Mod_event_socket#Configuration and changed default event_socket.conf.xml from:
<configuration name="event_socket.conf" description="Socket Client"> <settings> <param name="nat-map" value="false"/> <param name="listen-ip" value="::"/> <param name="listen-port" value="8021"/> <param name="password" value="ClueCon"/> </settings> </configuration>
to:
<configuration name="event_socket.conf" description="Socket Client"> <settings> <param name="nat-map" value="false"/> <param name="listen-ip" value="0.0.0.0"/> <param name="listen-port" value="8021"/> <param name="password" value="ClueCon"/> </settings> </configuration>
and issued: reload mod_event_socket.
Trying to telnet to fs host on port 8021 I observe:
Content-Type: text/rude-rejection Content-Length: 24
Access Denied, go away. Content-Type: text/disconnect-notice Content-Length: 67
Disconnected, goodbye. See you at ClueCon! http://www.cluecon.com/ Connection closed by foreign host.
And in fs log i can see the following:
mod_event_socket.c:2603 IP "someiphere" Rejected by acl "loopback.auto"
But as far as I understand the event_socket.conf.xml doesn't mention any ACL set up against ESL connection ? Would someone please be so kind to point what am I missing ? Thanks. Regards, Pavel.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
<param name="apply-inbound-acl" value="192.168.1.0/24"/> It should work too. On Mon, Sep 14, 2015 at 10:47 AM, Steven Ayre <steveayre@gmail.com> wrote:
From a read of the source code, yes you can do that.
Although the value is an ACL name, not a CIDR... you'd want to create an ACL named something like 'lan' and add 192.168.1.0/24 to that.
On 14 September 2015 at 11:56, Pavel <my.post@hotmail.com> wrote:
Steven, thanks a lot for your reply. The implicit apply-inbound-acl with a value of loopback.auto was my initial guess, but there were no mentions of it in wiki (perhaps I'd overlooked it). Would you be so kind to also answer is there any way to stack some acls like this:
<configuration name="event_socket.conf" description="Socket Client"> <settings> <param name="nat-map" value="false"/> <param name="listen-ip" value="0.0.0.0"/> <param name="listen-port" value="8021"/> <param name="password" value="ClueCon"/> <param name="apply-inbound-acl" value="loopback.auto"/> <param name="apply-inbound-acl" value="192.168.1.0/24"/> </settings> </configuration>
Regards, Pavel.
------------------------------ From: steveayre@gmail.com Date: Mon, 14 Sep 2015 09:18:57 +0100 To: freeswitch-users@lists.freeswitch.org Subject: Re: [Freeswitch-users] ACL for ESL issue ?
You need to use one or more apply-inbound-acl to allow access via ACLs you have created.
If you don't supply apply-inbound-acl then the default will be loopback.auto, to lock access down to local access only.
In 1.2 the default was to not apply any ACL (allow anyone), in 1.4 it requires you to be explicit or it'll only allow local connections even if you listen on 0.0.0.0 or ::. This is more secure.
If you're opening it up to remote access you want to be very careful about who you allow to connect. The protocol is unencrypted, the password is sent in plaintext, and it provides the ability to crash freeswitch or execute system commands as the freeswitch user. So it's a security hole that you don't want to be any more open than it absolutely has to be.
On 11 September 2015 at 12:58, Pavel <my.post@hotmail.com> wrote:
Hello, I was trying to enable esl connections from outside of fs host. To do so I've followed https://wiki.freeswitch.org/wiki/Mod_event_socket#Configuration and changed default event_socket.conf.xml from:
<configuration name="event_socket.conf" description="Socket Client"> <settings> <param name="nat-map" value="false"/> <param name="listen-ip" value="::"/> <param name="listen-port" value="8021"/> <param name="password" value="ClueCon"/> </settings> </configuration>
to:
<configuration name="event_socket.conf" description="Socket Client"> <settings> <param name="nat-map" value="false"/> <param name="listen-ip" value="0.0.0.0"/> <param name="listen-port" value="8021"/> <param name="password" value="ClueCon"/> </settings> </configuration>
and issued: reload mod_event_socket.
Trying to telnet to fs host on port 8021 I observe:
Content-Type: text/rude-rejection Content-Length: 24
Access Denied, go away. Content-Type: text/disconnect-notice Content-Length: 67
Disconnected, goodbye. See you at ClueCon! http://www.cluecon.com/ Connection closed by foreign host.
And in fs log i can see the following:
mod_event_socket.c:2603 IP "someiphere" Rejected by acl "loopback.auto"
But as far as I understand the event_socket.conf.xml doesn't mention any ACL set up against ESL connection ? Would someone please be so kind to point what am I missing ? Thanks. Regards, Pavel.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- *Brian West* brian@freeswitch.org *Twitter: @FreeSWITCH , @briankwest* http://www.freeswitchbook.com http://www.freeswitchcookbook.com Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch> *T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest
participants (4)
-
Brian West
-
Muhammad Naseer Bhatti
-
Pavel
-
Steven Ayre