This is exactly what prompted me to put the FOUR LINE CRIT statement when the default password isn't changed along with a 10 second delay before proceeding. Still I see questions posted about the 10 second delay and asking what it means. Not sure how to make it more clear. /b On Tue, Mar 14, 2017 at 1:19 PM, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:

Is nice because they mention FreeSWITCH in the tag of the link, but the link is about FreePBX.

Anyway, it's true: if you do not use the standard security practice, and leave your FreeSWITCH with standard password "1234", or maybe you change the standard password to "password", you probably will be hacked, and phone calls will be originated from your FreeSWITCH that you do not want to originate.

But, man, that's what you, and me, and anyone is expecting.

Also, please do not drive wrong way in the autobahn :))

-giovanni

On 14 March 2017 at 16:42, Mario G <mario_fs@mgtech.com> wrote:

...

Thought some may be interested in this. I first saw it today via Apple News… Related to tracing bomb threats and Jewish attacks… FreeSWITCH mentioned twice. http://www.theverge.com/2017/3/14/14913118/jcc-bomb-threats- anonymous-phone-calls-pdx-hacking _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

--

Sincerely,

Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- *Brian West* brian@freeswitch.org *Twitter: @FreeSWITCH , @briankwest* http://www.freeswitchbook.com http://www.freeswitchcookbook.com Allison prompts for FreeSWITCH: *https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch> Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch> *T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *Skype:*briankwest

almost... until the user to test set userid = password ... and forget to change it... ops... hacked... it's all about good practices. Regards, António On 03/14/2017 07:39 PM, Mirko Brankovic wrote:

Cance default password to uuid(), so every new install will get random one ... Bulletproof :°D

On Mar 14, 2017 19:30, "Brian West" <brian@freeswitch.org <mailto:brian@freeswitch.org>> wrote:

This is exactly what prompted me to put the FOUR LINE CRIT statement when the default password isn't changed along with a 10 second delay before proceeding. Still I see questions posted about the 10 second delay and asking what it means. Not sure how to make it more clear.

/b

On Tue, Mar 14, 2017 at 1:19 PM, Giovanni Maruzzelli <gmaruzz@gmail.com <mailto:gmaruzz@gmail.com>> wrote:

Is nice because they mention FreeSWITCH in the tag of the link, but the link is about FreePBX.

Anyway, it's true: if you do not use the standard security practice, and leave your FreeSWITCH with standard password "1234", or maybe you change the standard password to "password", you probably will be hacked, and phone calls will be originated from your FreeSWITCH that you do not want to originate.

But, man, that's what you, and me, and anyone is expecting.

Also, please do not drive wrong way in the autobahn :))

-giovanni

On 14 March 2017 at 16:42, Mario G <mario_fs@mgtech.com <mailto:mario_fs@mgtech.com>> wrote:

Thought some may be interested in this. I first saw it today via Apple News… Related to tracing bomb threats and Jewish attacks… FreeSWITCH mentioned twice. http://www.theverge.com/2017/3/14/14913118/jcc-bomb-threats-anonymous-phone-... <http://www.theverge.com/2017/3/14/14913118/jcc-bomb-threats-anonymous-phone-calls-pdx-hacking> _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com>

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org <http://confluence.freeswitch.org> http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org

--

Sincerely,

Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com>

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org <http://confluence.freeswitch.org> http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org

--

*/Brian West/* brian@freeswitch.org <mailto:brian@freeswitch.org>

*/Twitter: @FreeSWITCH , @briankwest/*

http://www.freeswitchbook.com http://www.freeswitchcookbook.com <http://www.freeswitchcookbook.com>

Allison prompts for FreeSWITCH:

*https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch>

Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>

*T:*+19184209001 <tel:+1%20918-420-9001> | *F:*+19184209002 <tel:+1%20918-420-9002> | *M:*+1918424WEST (9378) *Skype:*briankwest

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com>

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org <http://confluence.freeswitch.org> http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

Make the default password very obscure ramdomized on the fly... that way people will be crying because they can't figure out a password instead of having noobies hacked :) On Tue, Mar 14, 2017 at 9:40 PM Mirko Brankovic <mirkobrankovic@gmail.com> wrote:

Indeed ;)

On Mar 14, 2017 20:38, "Antonio Silva" <asilva@wirelessmundi.com> wrote:

almost... until the user to test set userid = password ... and forget to change it... ops... hacked...

it's all about good practices.

Regards, António

On 03/14/2017 07:39 PM, Mirko Brankovic wrote:

Cance default password to uuid(), so every new install will get random one ... Bulletproof :°D

On Mar 14, 2017 19:30, "Brian West" <brian@freeswitch.org> wrote:

This is exactly what prompted me to put the FOUR LINE CRIT statement when the default password isn't changed along with a 10 second delay before proceeding. Still I see questions posted about the 10 second delay and asking what it means. Not sure how to make it more clear.

/b

On Tue, Mar 14, 2017 at 1:19 PM, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:

Is nice because they mention FreeSWITCH in the tag of the link, but the link is about FreePBX.

Anyway, it's true: if you do not use the standard security practice, and leave your FreeSWITCH with standard password "1234", or maybe you change the standard password to "password", you probably will be hacked, and phone calls will be originated from your FreeSWITCH that you do not want to originate.

But, man, that's what you, and me, and anyone is expecting.

Also, please do not drive wrong way in the autobahn :))

-giovanni

On 14 March 2017 at 16:42, Mario G <mario_fs@mgtech.com> wrote:

Thought some may be interested in this. I first saw it today via Apple News… Related to tracing bomb threats and Jewish attacks… FreeSWITCH mentioned twice.

http://www.theverge.com/2017/3/14/14913118/jcc-bomb-threats-anonymous-phone-... _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

--

Sincerely,

Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

--

*Brian West* brian@freeswitch.org

*Twitter: @FreeSWITCH , @briankwest*

http://www.freeswitchbook.com http://www.freeswitchcookbook.com

Allison prompts for FreeSWITCH:

*https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch>

Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>

*T:*+19184209001 <+1%20918-420-9001> | *F:*+19184209002 <+1%20918-420-9002> | *M:*+1918424WEST (9378) *Skype:*briankwest

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.orghttp://www.freeswitchsolutions.com

Official FreeSWITCH Siteshttp://www.freeswitch.orghttp://confluence.freeswitch.orghttp://www.cluecon....

FreeSWITCH-users mailing listFreeSWITCH-users@lists.freeswitch.orghttp://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-usershttp://www.frees...

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

The funniest part is if you actually read the article and followed the links to the examples they were FreePBX and bugs there lol From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of David Villasmil Sent: Tuesday, March 14, 2017 3:47 PM To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> Subject: Re: [Freeswitch-users] Hacked FreeSWITCH mentioned on the Verge regarding bomb threats Make the default password very obscure ramdomized on the fly... that way people will be crying because they can't figure out a password instead of having noobies hacked :) On Tue, Mar 14, 2017 at 9:40 PM Mirko Brankovic <mirkobrankovic@gmail.com <mailto:mirkobrankovic@gmail.com> > wrote: Indeed ;) On Mar 14, 2017 20:38, "Antonio Silva" <asilva@wirelessmundi.com <mailto:asilva@wirelessmundi.com> > wrote: almost... until the user to test set userid = password ... and forget to change it... ops... hacked... it's all about good practices. Regards, António On 03/14/2017 07:39 PM, Mirko Brankovic wrote: Cance default password to uuid(), so every new install will get random one ... Bulletproof :°D On Mar 14, 2017 19:30, "Brian West" <brian@freeswitch.org <mailto:brian@freeswitch.org> > wrote: This is exactly what prompted me to put the FOUR LINE CRIT statement when the default password isn't changed along with a 10 second delay before proceeding. Still I see questions posted about the 10 second delay and asking what it means. Not sure how to make it more clear. /b On Tue, Mar 14, 2017 at 1:19 PM, Giovanni Maruzzelli <gmaruzz@gmail.com <mailto:gmaruzz@gmail.com> > wrote: Is nice because they mention FreeSWITCH in the tag of the link, but the link is about FreePBX. Anyway, it's true: if you do not use the standard security practice, and leave your FreeSWITCH with standard password "1234", or maybe you change the standard password to "password", you probably will be hacked, and phone calls will be originated from your FreeSWITCH that you do not want to originate. But, man, that's what you, and me, and anyone is expecting. Also, please do not drive wrong way in the autobahn :)) -giovanni On 14 March 2017 at 16:42, Mario G <mario_fs@mgtech.com <mailto:mario_fs@mgtech.com> > wrote: Thought some may be interested in this. I first saw it today via Apple News… Related to tracing bomb threats and Jewish attacks… FreeSWITCH mentioned twice. http://www.theverge.com/2017/3/14/14913118/jcc-bomb-threats-anonymous-phone-... _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org -- Sincerely, Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18 _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org -- Brian West brian@freeswitch.org <mailto:brian@freeswitch.org> Twitter: @FreeSWITCH , @briankwest http://www.freeswitchbook.com http://www.freeswitchcookbook.com Allison prompts for FreeSWITCH: <https://www.gofundme.com/allison-prompts-for-freeswitch> https://www.gofundme.com/allison-prompts-for-freeswitch Got Bugs? Report them <https://freeswitch.org/jira> here! | Reddit: <https://www.reddit.com/r/freeswitch> /r/freeswitch T:+19184209001 <tel:+1%20918-420-9001> | F:+19184209002 <tel:+1%20918-420-9002> | M:+1918424WEST (9378) Skype:briankwest _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

btw the problem is always with users/customers that change the demo password "1234" (where there is a delay of 10 seconds put there by this purpose) to something like "password". And what I can do about this? I will put a safeguard against silly passwords, and you will make the effort to circumvent also that safeguard because "is easier for my users"? On 14 March 2017 at 21:56, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:

NO, the default password of the demo configuration is just that, a DEFAULT password of a DEMO configuration.

That is meant to DEMO just OUT OF THE BOX

So, it must stay this way, because it just works, and is a demo

Then, if you put a demo in production, the problem is between the monitor and the seat, not in the software

On 14 March 2017 at 21:46, David Villasmil <david.villasmil.work@gmail.com

...

wrote:

...

Make the default password very obscure ramdomized on the fly... that way people will be crying because they can't figure out a password instead of having noobies hacked :)

On Tue, Mar 14, 2017 at 9:40 PM Mirko Brankovic <mirkobrankovic@gmail.com> wrote:

...

Indeed ;)

On Mar 14, 2017 20:38, "Antonio Silva" <asilva@wirelessmundi.com> wrote:

almost... until the user to test set userid = password ... and forget to change it... ops... hacked...

it's all about good practices.

Regards, António

On 03/14/2017 07:39 PM, Mirko Brankovic wrote:

Cance default password to uuid(), so every new install will get random one ... Bulletproof :°D

On Mar 14, 2017 19:30, "Brian West" <brian@freeswitch.org> wrote:

This is exactly what prompted me to put the FOUR LINE CRIT statement when the default password isn't changed along with a 10 second delay before proceeding. Still I see questions posted about the 10 second delay and asking what it means. Not sure how to make it more clear.

/b

On Tue, Mar 14, 2017 at 1:19 PM, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:

Is nice because they mention FreeSWITCH in the tag of the link, but the link is about FreePBX.

Anyway, it's true: if you do not use the standard security practice, and leave your FreeSWITCH with standard password "1234", or maybe you change the standard password to "password", you probably will be hacked, and phone calls will be originated from your FreeSWITCH that you do not want to originate.

But, man, that's what you, and me, and anyone is expecting.

Also, please do not drive wrong way in the autobahn :))

-giovanni

On 14 March 2017 at 16:42, Mario G <mario_fs@mgtech.com> wrote:

Thought some may be interested in this. I first saw it today via Apple News… Related to tracing bomb threats and Jewish attacks… FreeSWITCH mentioned twice. http://www.theverge.com/2017/3/14/14913118/jcc-bomb-threats- anonymous-phone-calls-pdx-hacking ____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

--

Sincerely,

Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

--

*Brian West* brian@freeswitch.org

*Twitter: @FreeSWITCH , @briankwest*

http://www.freeswitchbook.com http://www.freeswitchcookbook.com

Allison prompts for FreeSWITCH:

*https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch>

Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>

*T:*+19184209001 <+1%20918-420-9001> | *F:*+19184209002 <+1%20918-420-9002> | *M:*+1918424WEST (9378) *Skype:*briankwest

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.orghttp://www.freeswitchsolutions.com

Official FreeSWITCH Siteshttp://www.freeswitch.orghttp://confluence.freeswitch.orghttp://www.cluecon....

FreeSWITCH-users mailing listFreeSWITCH-users@lists.freeswitch.orghttp://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-usershttp://www.frees...

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

--

Sincerely,

Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18

-- Sincerely, Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18

Giovanni is correct, anything that raises the barrier of entry will only hinder us as a project, We can't solve the PEBKAC, Humans ultimately are the weak link in the security chain. /b On Tue, Mar 14, 2017 at 4:57 PM, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:

btw the problem is always with users/customers that change the demo password "1234" (where there is a delay of 10 seconds put there by this purpose) to something like "password".

And what I can do about this?

I will put a safeguard against silly passwords, and you will make the effort to circumvent also that safeguard because "is easier for my users"?

On 14 March 2017 at 21:56, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:

...

NO, the default password of the demo configuration is just that, a DEFAULT password of a DEMO configuration.

That is meant to DEMO just OUT OF THE BOX

So, it must stay this way, because it just works, and is a demo

Then, if you put a demo in production, the problem is between the monitor and the seat, not in the software

On 14 March 2017 at 21:46, David Villasmil <david.villasmil.work@gmail.co m> wrote:

...

Make the default password very obscure ramdomized on the fly... that way people will be crying because they can't figure out a password instead of having noobies hacked :)

On Tue, Mar 14, 2017 at 9:40 PM Mirko Brankovic < mirkobrankovic@gmail.com> wrote:

...

Indeed ;)

On Mar 14, 2017 20:38, "Antonio Silva" <asilva@wirelessmundi.com> wrote:

almost... until the user to test set userid = password ... and forget to change it... ops... hacked...

it's all about good practices.

Regards, António

On 03/14/2017 07:39 PM, Mirko Brankovic wrote:

Cance default password to uuid(), so every new install will get random one ... Bulletproof :°D

On Mar 14, 2017 19:30, "Brian West" <brian@freeswitch.org> wrote:

This is exactly what prompted me to put the FOUR LINE CRIT statement when the default password isn't changed along with a 10 second delay before proceeding. Still I see questions posted about the 10 second delay and asking what it means. Not sure how to make it more clear.

/b

On Tue, Mar 14, 2017 at 1:19 PM, Giovanni Maruzzelli <gmaruzz@gmail.com

...

wrote:

Is nice because they mention FreeSWITCH in the tag of the link, but the link is about FreePBX.

Anyway, it's true: if you do not use the standard security practice, and leave your FreeSWITCH with standard password "1234", or maybe you change the standard password to "password", you probably will be hacked, and phone calls will be originated from your FreeSWITCH that you do not want to originate.

But, man, that's what you, and me, and anyone is expecting.

Also, please do not drive wrong way in the autobahn :))

-giovanni

On 14 March 2017 at 16:42, Mario G <mario_fs@mgtech.com> wrote:

Thought some may be interested in this. I first saw it today via Apple News… Related to tracing bomb threats and Jewish attacks… FreeSWITCH mentioned twice. http://www.theverge.com/2017/3/14/14913118/jcc-bomb-threats- anonymous-phone-calls-pdx-hacking ____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

--

Sincerely,

Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

--

*Brian West* brian@freeswitch.org

*Twitter: @FreeSWITCH , @briankwest*

http://www.freeswitchbook.com http://www.freeswitchcookbook.com

Allison prompts for FreeSWITCH:

*https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch>

Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>

*T:*+19184209001 <+1%20918-420-9001> | *F:*+19184209002 <+1%20918-420-9002> | *M:*+1918424WEST (9378) *Skype:*briankwest

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.orghttp://www.freeswitchsolutions.com

Official FreeSWITCH Siteshttp://www.freeswitch.orghttp://confluence.freeswitch.orghttp://www.cluecon....

FreeSWITCH-users mailing listFreeSWITCH-users@lists.freeswitch.orghttp://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-usershttp://www.frees...

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

--

Sincerely,

Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18

--

Sincerely,

Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- *Brian West* brian@freeswitch.org *Twitter: @FreeSWITCH , @briankwest* http://www.freeswitchbook.com http://www.freeswitchcookbook.com Allison prompts for FreeSWITCH: *https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch> Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch> *T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *Skype:*briankwest

Anything that changes, makes it more difficult to toy with out of the box will throw road blocks on potential new users, I'd like to focus more on education of the end users on how to properly secure FreeSWITCH and the available security concepts that you can use in various situations. /b On Tue, Mar 14, 2017 at 5:07 PM, acheraime . <acheraime@gmail.com> wrote:

I meant to say in production. A demo is a demo.

On Tue, Mar 14, 2017 at 5:04 PM, Brian West <brian@freeswitch.org> wrote:

...

Giovanni is correct, anything that raises the barrier of entry will only hinder us as a project, We can't solve the PEBKAC, Humans ultimately are the weak link in the security chain.

/b

On Tue, Mar 14, 2017 at 4:57 PM, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:

...

btw the problem is always with users/customers that change the demo password "1234" (where there is a delay of 10 seconds put there by this purpose) to something like "password".

And what I can do about this?

I will put a safeguard against silly passwords, and you will make the effort to circumvent also that safeguard because "is easier for my users"?

On 14 March 2017 at 21:56, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:

...

NO, the default password of the demo configuration is just that, a DEFAULT password of a DEMO configuration.

That is meant to DEMO just OUT OF THE BOX

So, it must stay this way, because it just works, and is a demo

Then, if you put a demo in production, the problem is between the monitor and the seat, not in the software

On 14 March 2017 at 21:46, David Villasmil < david.villasmil.work@gmail.com> wrote:

...

Make the default password very obscure ramdomized on the fly... that way people will be crying because they can't figure out a password instead of having noobies hacked :)

On Tue, Mar 14, 2017 at 9:40 PM Mirko Brankovic < mirkobrankovic@gmail.com> wrote:

...

Indeed ;)

On Mar 14, 2017 20:38, "Antonio Silva" <asilva@wirelessmundi.com> wrote:

almost... until the user to test set userid = password ... and forget to change it... ops... hacked...

it's all about good practices.

Regards, António

On 03/14/2017 07:39 PM, Mirko Brankovic wrote:

Cance default password to uuid(), so every new install will get random one ... Bulletproof :°D

On Mar 14, 2017 19:30, "Brian West" <brian@freeswitch.org> wrote:

This is exactly what prompted me to put the FOUR LINE CRIT statement when the default password isn't changed along with a 10 second delay before proceeding. Still I see questions posted about the 10 second delay and asking what it means. Not sure how to make it more clear.

/b

On Tue, Mar 14, 2017 at 1:19 PM, Giovanni Maruzzelli < gmaruzz@gmail.com> wrote:

Is nice because they mention FreeSWITCH in the tag of the link, but the link is about FreePBX.

Anyway, it's true: if you do not use the standard security practice, and leave your FreeSWITCH with standard password "1234", or maybe you change the standard password to "password", you probably will be hacked, and phone calls will be originated from your FreeSWITCH that you do not want to originate.

But, man, that's what you, and me, and anyone is expecting.

Also, please do not drive wrong way in the autobahn :))

-giovanni

On 14 March 2017 at 16:42, Mario G <mario_fs@mgtech.com> wrote:

Thought some may be interested in this. I first saw it today via Apple News… Related to tracing bomb threats and Jewish attacks… FreeSWITCH mentioned twice. http://www.theverge.com/2017/3/14/14913118/jcc-bomb-threats- anonymous-phone-calls-pdx-hacking ____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

--

Sincerely,

Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

--

*Brian West* brian@freeswitch.org

*Twitter: @FreeSWITCH , @briankwest*

http://www.freeswitchbook.com http://www.freeswitchcookbook.com

Allison prompts for FreeSWITCH:

*https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch>

Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>

*T:*+19184209001 <+1%20918-420-9001> | *F:*+19184209002 <+1%20918-420-9002> | *M:*+1918424WEST (9378) *Skype:*briankwest

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.orghttp://www.freeswitchsolutions.com

Official FreeSWITCH Siteshttp://www.freeswitch.orghttp://confluence.freeswitch.orghttp://www.cluecon....

FreeSWITCH-users mailing listFreeSWITCH-users@lists.freeswitch.orghttp://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-usershttp://www.frees...

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

--

Sincerely,

Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18

--

Sincerely,

Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

--

*Brian West* brian@freeswitch.org

*Twitter: @FreeSWITCH , @briankwest*

http://www.freeswitchbook.com http://www.freeswitchcookbook.com

Allison prompts for FreeSWITCH:

*https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch>

Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>

*T:*+19184209001 <(918)%20420-9001> | *F:*+19184209002 <(918)%20420-9002> | *M:*+1918424WEST (9378) *Skype:*briankwest

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

--

*Adolphe CHER-AIME*

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- *Brian West* brian@freeswitch.org *Twitter: @FreeSWITCH , @briankwest* http://www.freeswitchbook.com http://www.freeswitchcookbook.com Allison prompts for FreeSWITCH: *https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch> Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch> *T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *Skype:*briankwest

Agreed! One practice that I would highly recommend any one to stay away from is using numeric extension number "1001" as sip username and dictionary based passwords. On Tue, Mar 14, 2017 at 4:57 PM, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:

btw the problem is always with users/customers that change the demo password "1234" (where there is a delay of 10 seconds put there by this purpose) to something like "password".

And what I can do about this?

I will put a safeguard against silly passwords, and you will make the effort to circumvent also that safeguard because "is easier for my users"?

On 14 March 2017 at 21:56, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:

...

NO, the default password of the demo configuration is just that, a DEFAULT password of a DEMO configuration.

That is meant to DEMO just OUT OF THE BOX

So, it must stay this way, because it just works, and is a demo

Then, if you put a demo in production, the problem is between the monitor and the seat, not in the software

On 14 March 2017 at 21:46, David Villasmil <david.villasmil.work@gmail.co m> wrote:

...

Make the default password very obscure ramdomized on the fly... that way people will be crying because they can't figure out a password instead of having noobies hacked :)

On Tue, Mar 14, 2017 at 9:40 PM Mirko Brankovic < mirkobrankovic@gmail.com> wrote:

...

Indeed ;)

On Mar 14, 2017 20:38, "Antonio Silva" <asilva@wirelessmundi.com> wrote:

almost... until the user to test set userid = password ... and forget to change it... ops... hacked...

it's all about good practices.

Regards, António

On 03/14/2017 07:39 PM, Mirko Brankovic wrote:

Cance default password to uuid(), so every new install will get random one ... Bulletproof :°D

On Mar 14, 2017 19:30, "Brian West" <brian@freeswitch.org> wrote:

This is exactly what prompted me to put the FOUR LINE CRIT statement when the default password isn't changed along with a 10 second delay before proceeding. Still I see questions posted about the 10 second delay and asking what it means. Not sure how to make it more clear.

/b

On Tue, Mar 14, 2017 at 1:19 PM, Giovanni Maruzzelli <gmaruzz@gmail.com

...

wrote:

Is nice because they mention FreeSWITCH in the tag of the link, but the link is about FreePBX.

Anyway, it's true: if you do not use the standard security practice, and leave your FreeSWITCH with standard password "1234", or maybe you change the standard password to "password", you probably will be hacked, and phone calls will be originated from your FreeSWITCH that you do not want to originate.

But, man, that's what you, and me, and anyone is expecting.

Also, please do not drive wrong way in the autobahn :))

-giovanni

On 14 March 2017 at 16:42, Mario G <mario_fs@mgtech.com> wrote:

Thought some may be interested in this. I first saw it today via Apple News… Related to tracing bomb threats and Jewish attacks… FreeSWITCH mentioned twice. http://www.theverge.com/2017/3/14/14913118/jcc-bomb-threats- anonymous-phone-calls-pdx-hacking ____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

--

Sincerely,

Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

--

*Brian West* brian@freeswitch.org

*Twitter: @FreeSWITCH , @briankwest*

http://www.freeswitchbook.com http://www.freeswitchcookbook.com

Allison prompts for FreeSWITCH:

*https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch>

Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>

*T:*+19184209001 <+1%20918-420-9001> | *F:*+19184209002 <+1%20918-420-9002> | *M:*+1918424WEST (9378) *Skype:*briankwest

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.orghttp://www.freeswitchsolutions.com

Official FreeSWITCH Siteshttp://www.freeswitch.orghttp://confluence.freeswitch.orghttp://www.cluecon....

FreeSWITCH-users mailing listFreeSWITCH-users@lists.freeswitch.orghttp://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-usershttp://www.frees...

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

--

Sincerely,

Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18

--

Sincerely,

Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- *Adolphe CHER-AIME*

IMHO, a demo config shouldn't be shipped out by default, it's very risky. If everyone using freeswitch (or any other softswitch for that matter) for the first time was a seasoned sysops, then yes. But this is very much not the case. So maybe it would be safer for everyone to ship it out with a locked-down config, so that user WILL learn how fs works by having to open features one at a time... and then describe in the wiki how to implement the demo config from a git repo. This way EVERYONE using fs for the first time Will know they are using a demo config with everything defaulted and "open"... But this is just my opinion. On Tue, Mar 14, 2017 at 9:58 PM Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:

btw the problem is always with users/customers that change the demo password "1234" (where there is a delay of 10 seconds put there by this purpose) to something like "password".

And what I can do about this?

I will put a safeguard against silly passwords, and you will make the effort to circumvent also that safeguard because "is easier for my users"?

On 14 March 2017 at 21:56, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:

NO, the default password of the demo configuration is just that, a DEFAULT password of a DEMO configuration.

That is meant to DEMO just OUT OF THE BOX

So, it must stay this way, because it just works, and is a demo

Then, if you put a demo in production, the problem is between the monitor and the seat, not in the software

On 14 March 2017 at 21:46, David Villasmil <david.villasmil.work@gmail.com

...

wrote:

Make the default password very obscure ramdomized on the fly... that way people will be crying because they can't figure out a password instead of having noobies hacked :)

On Tue, Mar 14, 2017 at 9:40 PM Mirko Brankovic <mirkobrankovic@gmail.com> wrote:

Indeed ;)

On Mar 14, 2017 20:38, "Antonio Silva" <asilva@wirelessmundi.com> wrote:

almost... until the user to test set userid = password ... and forget to change it... ops... hacked...

it's all about good practices.

Regards, António

On 03/14/2017 07:39 PM, Mirko Brankovic wrote:

Cance default password to uuid(), so every new install will get random one ... Bulletproof :°D

On Mar 14, 2017 19:30, "Brian West" <brian@freeswitch.org> wrote:

This is exactly what prompted me to put the FOUR LINE CRIT statement when the default password isn't changed along with a 10 second delay before proceeding. Still I see questions posted about the 10 second delay and asking what it means. Not sure how to make it more clear.

/b

On Tue, Mar 14, 2017 at 1:19 PM, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:

Is nice because they mention FreeSWITCH in the tag of the link, but the link is about FreePBX.

Anyway, it's true: if you do not use the standard security practice, and leave your FreeSWITCH with standard password "1234", or maybe you change the standard password to "password", you probably will be hacked, and phone calls will be originated from your FreeSWITCH that you do not want to originate.

But, man, that's what you, and me, and anyone is expecting.

Also, please do not drive wrong way in the autobahn :))

-giovanni

On 14 March 2017 at 16:42, Mario G <mario_fs@mgtech.com> wrote:

Thought some may be interested in this. I first saw it today via Apple News… Related to tracing bomb threats and Jewish attacks… FreeSWITCH mentioned twice.

http://www.theverge.com/2017/3/14/14913118/jcc-bomb-threats-anonymous-phone-... _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

--

Sincerely,

Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

--

*Brian West* brian@freeswitch.org

*Twitter: @FreeSWITCH , @briankwest*

http://www.freeswitchbook.com http://www.freeswitchcookbook.com

Allison prompts for FreeSWITCH:

*https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch>

Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>

*T:*+19184209001 <+1%20918-420-9001> | *F:*+19184209002 <+1%20918-420-9002> | *M:*+1918424WEST (9378) *Skype:*briankwest

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.orghttp://www.freeswitchsolutions.com

Official FreeSWITCH Siteshttp://www.freeswitch.orghttp://confluence.freeswitch.orghttp://www.cluecon....

FreeSWITCH-users mailing listFreeSWITCH-users@lists.freeswitch.orghttp://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-usershttp://www.frees...

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

--

Sincerely,

Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18

--

Sincerely,

Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18 _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

That’s a better idea. If any phone is registered with 1234 you can’t dial out any gateway. You can have a big demo but no outside connection. Going outside requires changing the password on all phones.

On Mar 14, 2017, at 2:40 PM, Michael Jerris <mike@jerris.com> wrote:

The demo config includes no way to dial out of a gateway…

...

On Mar 14, 2017, at 5:06 PM, David Villasmil <david.villasmil.work@gmail.com <mailto:david.villasmil.work@gmail.com>> wrote:

IMHO, a demo config shouldn't be shipped out by default, it's very risky. If everyone using freeswitch (or any other softswitch for that matter) for the first time was a seasoned sysops, then yes. But this is very much not the case.

So maybe it would be safer for everyone to ship it out with a locked-down config, so that user WILL learn how fs works by having to open features one at a time... and then describe in the wiki how to implement the demo config from a git repo.

This way EVERYONE using fs for the first time Will know they are using a demo config with everything defaulted and "open"...

But this is just my opinion. On Tue, Mar 14, 2017 at 9:58 PM Giovanni Maruzzelli <gmaruzz@gmail.com <mailto:gmaruzz@gmail.com>> wrote: btw the problem is always with users/customers that change the demo password "1234" (where there is a delay of 10 seconds put there by this purpose) to something like "password".

And what I can do about this?

I will put a safeguard against silly passwords, and you will make the effort to circumvent also that safeguard because "is easier for my users"?

On 14 March 2017 at 21:56, Giovanni Maruzzelli <gmaruzz@gmail.com <mailto:gmaruzz@gmail.com>> wrote: NO, the default password of the demo configuration is just that, a DEFAULT password of a DEMO configuration.

That is meant to DEMO just OUT OF THE BOX

So, it must stay this way, because it just works, and is a demo

Then, if you put a demo in production, the problem is between the monitor and the seat, not in the software

On 14 March 2017 at 21:46, David Villasmil <david.villasmil.work@gmail.com <mailto:david.villasmil.work@gmail.com>> wrote: Make the default password very obscure ramdomized on the fly... that way people will be crying because they can't figure out a password instead of having noobies hacked :)

On Tue, Mar 14, 2017 at 9:40 PM Mirko Brankovic <mirkobrankovic@gmail.com <mailto:mirkobrankovic@gmail.com>> wrote: Indeed ;)

On Mar 14, 2017 20:38, "Antonio Silva" <asilva@wirelessmundi.com <mailto:asilva@wirelessmundi.com>> wrote: almost... until the user to test set userid = password ... and forget to change it... ops... hacked...

it's all about good practices.

Regards, António

On 03/14/2017 07:39 PM, Mirko Brankovic wrote:

...

Cance default password to uuid(), so every new install will get random one ... Bulletproof :°D

On Mar 14, 2017 19:30, "Brian West" <brian@freeswitch.org <mailto:brian@freeswitch.org>> wrote: This is exactly what prompted me to put the FOUR LINE CRIT statement when the default password isn't changed along with a 10 second delay before proceeding. Still I see questions posted about the 10 second delay and asking what it means. Not sure how to make it more clear.

/b

On Tue, Mar 14, 2017 at 1:19 PM, Giovanni Maruzzelli <gmaruzz@gmail.com <mailto:gmaruzz@gmail.com>> wrote: Is nice because they mention FreeSWITCH in the tag of the link, but the link is about FreePBX.

Anyway, it's true: if you do not use the standard security practice, and leave your FreeSWITCH with standard password "1234", or maybe you change the standard password to "password", you probably will be hacked, and phone calls will be originated from your FreeSWITCH that you do not want to originate.

But, man, that's what you, and me, and anyone is expecting.

Also, please do not drive wrong way in the autobahn :))

-giovanni

On 14 March 2017 at 16:42, Mario G <mario_fs@mgtech.com <mailto:mario_fs@mgtech.com>> wrote: Thought some may be interested in this. I first saw it today via Apple News… Related to tracing bomb threats and Jewish attacks… FreeSWITCH mentioned twice. http://www.theverge.com/2017/3/14/14913118/jcc-bomb-threats-anonymous-phone-... <http://www.theverge.com/2017/3/14/14913118/jcc-bomb-threats-anonymous-phone-calls-pdx-hacking>

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

DEMO CONFIG (is a DEMO) is already: 1) printing in RED, CAPITALS, AS AN ERROR, a message ANY TIME a call is made from a DEMO ACCOUNT 2) DEMO CONFIG HAS NO MEANS TO USE GATEWAYS, ALL CALLS ARE INTERNAL 3) DEMO CONFIG puts a DELAY, eg A PAUSE, of TEN (10) seconds before ANSWERING (INTERNAL) CALLS Why are we fussing about it at all? If someone put the effort of editing and modifying the DEMO CONFIG to circumvent all these safeguards, why you believe we can do more to revent him to? -giovanni On 15 March 2017 at 06:23, Sergey Safarov <s.safarov@gmail.com> wrote:

I can add RPM package script that's change default password to random Team, is required do to it?

ср, 15 марта 2017, 1:13 Mario G <mario_fs@mgtech.com>:

...

That’s a better idea. If any phone is registered with 1234 you can’t dial out any gateway. You can have a big demo but no outside connection. Going outside requires changing the password on all phones.

On Mar 14, 2017, at 2:40 PM, Michael Jerris <mike@jerris.com> wrote:

The demo config includes no way to dial out of a gateway…

On Mar 14, 2017, at 5:06 PM, David Villasmil <david.villasmil.work@gmail. com> wrote:

IMHO, a demo config shouldn't be shipped out by default, it's very risky. If everyone using freeswitch (or any other softswitch for that matter) for the first time was a seasoned sysops, then yes. But this is very much not the case.

So maybe it would be safer for everyone to ship it out with a locked-down config, so that user WILL learn how fs works by having to open features one at a time... and then describe in the wiki how to implement the demo config from a git repo.

This way EVERYONE using fs for the first time Will know they are using a demo config with everything defaulted and "open"...

But this is just my opinion. On Tue, Mar 14, 2017 at 9:58 PM Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:

btw the problem is always with users/customers that change the demo password "1234" (where there is a delay of 10 seconds put there by this purpose) to something like "password".

And what I can do about this?

I will put a safeguard against silly passwords, and you will make the effort to circumvent also that safeguard because "is easier for my users"?

On 14 March 2017 at 21:56, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:

NO, the default password of the demo configuration is just that, a DEFAULT password of a DEMO configuration.

That is meant to DEMO just OUT OF THE BOX

So, it must stay this way, because it just works, and is a demo

Then, if you put a demo in production, the problem is between the monitor and the seat, not in the software

On 14 March 2017 at 21:46, David Villasmil <david.villasmil.work@gmail. com> wrote:

Make the default password very obscure ramdomized on the fly... that way people will be crying because they can't figure out a password instead of having noobies hacked :)

On Tue, Mar 14, 2017 at 9:40 PM Mirko Brankovic <mirkobrankovic@gmail.com> wrote:

Indeed ;)

On Mar 14, 2017 20:38, "Antonio Silva" <asilva@wirelessmundi.com> wrote:

almost... until the user to test set userid = password ... and forget to change it... ops... hacked...

it's all about good practices.

Regards, António

On 03/14/2017 07:39 PM, Mirko Brankovic wrote:

Cance default password to uuid(), so every new install will get random one ... Bulletproof :°D

On Mar 14, 2017 19:30, "Brian West" <brian@freeswitch.org> wrote:

This is exactly what prompted me to put the FOUR LINE CRIT statement when the default password isn't changed along with a 10 second delay before proceeding. Still I see questions posted about the 10 second delay and asking what it means. Not sure how to make it more clear.

/b

On Tue, Mar 14, 2017 at 1:19 PM, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:

Is nice because they mention FreeSWITCH in the tag of the link, but the link is about FreePBX.

Anyway, it's true: if you do not use the standard security practice, and leave your FreeSWITCH with standard password "1234", or maybe you change the standard password to "password", you probably will be hacked, and phone calls will be originated from your FreeSWITCH that you do not want to originate.

But, man, that's what you, and me, and anyone is expecting.

Also, please do not drive wrong way in the autobahn :))

-giovanni

On 14 March 2017 at 16:42, Mario G <mario_fs@mgtech.com> wrote:

Thought some may be interested in this. I first saw it today via Apple News… Related to tracing bomb threats and Jewish attacks… FreeSWITCH mentioned twice. http://www.theverge.com/2017/3/14/14913118/jcc-bomb- threats-anonymous-phone-calls-pdx-hacking

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- Sincerely, Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18

Bundle a dictionary of commonly used passwords and reject the calls if the password is on the blacklist? ;) On 14 March 2017 at 18:29, Brian West <brian@freeswitch.org> wrote:

This is exactly what prompted me to put the FOUR LINE CRIT statement when the default password isn't changed along with a 10 second delay before proceeding. Still I see questions posted about the 10 second delay and asking what it means. Not sure how to make it more clear.

/b

On Tue, Mar 14, 2017 at 1:19 PM, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:

...

Is nice because they mention FreeSWITCH in the tag of the link, but the link is about FreePBX.

Anyway, it's true: if you do not use the standard security practice, and leave your FreeSWITCH with standard password "1234", or maybe you change the standard password to "password", you probably will be hacked, and phone calls will be originated from your FreeSWITCH that you do not want to originate.

But, man, that's what you, and me, and anyone is expecting.

Also, please do not drive wrong way in the autobahn :))

-giovanni

On 14 March 2017 at 16:42, Mario G <mario_fs@mgtech.com> wrote:

...

Thought some may be interested in this. I first saw it today via Apple News… Related to tracing bomb threats and Jewish attacks… FreeSWITCH mentioned twice. http://www.theverge.com/2017/3/14/14913118/jcc-bomb-threats- anonymous-phone-calls-pdx-hacking ____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

--

Sincerely,

Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

--

*Brian West* brian@freeswitch.org

*Twitter: @FreeSWITCH , @briankwest*

http://www.freeswitchbook.com http://www.freeswitchcookbook.com

Allison prompts for FreeSWITCH:

*https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch>

Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>

*T:*+19184209001 <(918)%20420-9001> | *F:*+19184209002 <(918)%20420-9002> | *M:*+1918424WEST (9378) *Skype:*briankwest

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

I think if any change were to be made it would be best to set the default password to nothing (empty string) in the default config and not allow FS to start with an empty password. Put comments in the config file and documentation for the install to include setting a password. I don’t think that would be too much of a barrier to entry for newbie users and would eliminate FS from that default password decision. If the user sets an insecure password and gets hacked then they are totally responsible. Just my .02 Kevin

On Mar 15, 2017, at 9:09 AM, Brian West <brian@freeswitch.org> wrote:

I do believe Giovanni hit the nail on the head. And in all honesty it wouldn't matter what we try to do to protect the end user from themselves, If they don't fully grasp the concepts and how the security model works there isn't much more we can do as project to prevent bad deployments with shady security settings.

/b

On Wed, Mar 15, 2017 at 10:04 AM, Steven Ayre <steveayre@gmail.com> wrote: Bundle a dictionary of commonly used passwords and reject the calls if the password is on the blacklist? ;)

On 14 March 2017 at 18:29, Brian West <brian@freeswitch.org> wrote: This is exactly what prompted me to put the FOUR LINE CRIT statement when the default password isn't changed along with a 10 second delay before proceeding. Still I see questions posted about the 10 second delay and asking what it means. Not sure how to make it more clear.

/b

On Tue, Mar 14, 2017 at 1:19 PM, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote: Is nice because they mention FreeSWITCH in the tag of the link, but the link is about FreePBX.

Anyway, it's true: if you do not use the standard security practice, and leave your FreeSWITCH with standard password "1234", or maybe you change the standard password to "password", you probably will be hacked, and phone calls will be originated from your FreeSWITCH that you do not want to originate.

But, man, that's what you, and me, and anyone is expecting.

Also, please do not drive wrong way in the autobahn :))

-giovanni

On 14 March 2017 at 16:42, Mario G <mario_fs@mgtech.com> wrote: Thought some may be interested in this. I first saw it today via Apple News… Related to tracing bomb threats and Jewish attacks… FreeSWITCH mentioned twice. http://www.theverge.com/2017/3/14/14913118/jcc-bomb-threats-anonymous-phone-... _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

--

Sincerely,

Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- Brian West brian@freeswitch.org

Twitter: @FreeSWITCH , @briankwest

http://www.freeswitchbook.com http://www.freeswitchcookbook.com

Allison prompts for FreeSWITCH:

https://www.gofundme.com/allison-prompts-for-freeswitch

Got Bugs? Report them here! | Reddit: /r/freeswitch

T:+19184209001 | F:+19184209002 | M:+1918424WEST (9378) Skype:briankwest

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- Brian West brian@freeswitch.org

Twitter: @FreeSWITCH , @briankwest

http://www.freeswitchbook.com http://www.freeswitchcookbook.com

Allison prompts for FreeSWITCH:

https://www.gofundme.com/allison-prompts-for-freeswitch

Got Bugs? Report them here! | Reddit: /r/freeswitch

T:+19184209001 | F:+19184209002 | M:+1918424WEST (9378) Skype:briankwest

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

I agree, the big red lines say it all. Even if FS left out a default password someone may put 1234 in. Maybe bigger/more red lines.👺☠️

On Mar 15, 2017, at 7:22 AM, Brian West <brian@freeswitch.org> wrote:

That would negate any existing documentation on getting started, lets not add more work without a solid plan of action to get everything updated and who is going to be responsible for updating everything across Confluence and the Web.

We still have people using 1.0.6 how-to docs that are posted in various places all over the web.

/b

On Wed, Mar 15, 2017 at 10:18 AM, Kevin Wormington <kworm@sofnet.com <mailto:kworm@sofnet.com>> wrote: I think if any change were to be made it would be best to set the default password to nothing (empty string) in the default config and not allow FS to start with an empty password. Put comments in the config file and documentation for the install to include setting a password.

I don’t think that would be too much of a barrier to entry for newbie users and would eliminate FS from that default password decision. If the user sets an insecure password and gets hacked then they are totally responsible.

Just my .02

Kevin

...

On Mar 15, 2017, at 9:09 AM, Brian West <brian@freeswitch.org <mailto:brian@freeswitch.org>> wrote:

I do believe Giovanni hit the nail on the head. And in all honesty it wouldn't matter what we try to do to protect the end user from themselves, If they don't fully grasp the concepts and how the security model works there isn't much more we can do as project to prevent bad deployments with shady security settings.

/b

On Wed, Mar 15, 2017 at 10:04 AM, Steven Ayre <steveayre@gmail.com <mailto:steveayre@gmail.com>> wrote: Bundle a dictionary of commonly used passwords and reject the calls if the password is on the blacklist? ;)

On 14 March 2017 at 18:29, Brian West <brian@freeswitch.org <mailto:brian@freeswitch.org>> wrote: This is exactly what prompted me to put the FOUR LINE CRIT statement when the default password isn't changed along with a 10 second delay before proceeding. Still I see questions posted about the 10 second delay and asking what it means. Not sure how to make it more clear.

/b

On Tue, Mar 14, 2017 at 1:19 PM, Giovanni Maruzzelli <gmaruzz@gmail.com <mailto:gmaruzz@gmail.com>> wrote: Is nice because they mention FreeSWITCH in the tag of the link, but the link is about FreePBX.

Anyway, it's true: if you do not use the standard security practice, and leave your FreeSWITCH with standard password "1234", or maybe you change the standard password to "password", you probably will be hacked, and phone calls will be originated from your FreeSWITCH that you do not want to originate.

But, man, that's what you, and me, and anyone is expecting.

Also, please do not drive wrong way in the autobahn :))

-giovanni

On 14 March 2017 at 16:42, Mario G <mario_fs@mgtech.com <mailto:mario_fs@mgtech.com>> wrote: Thought some may be interested in this. I first saw it today via Apple News… Related to tracing bomb threats and Jewish attacks… FreeSWITCH mentioned twice. http://www.theverge.com/2017/3/14/14913118/jcc-bomb-threats-anonymous-phone-... <http://www.theverge.com/2017/3/14/14913118/jcc-bomb-threats-anonymous-phone-calls-pdx-hacking> _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>

--

Sincerely,

Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18 <tel:%2B39%20347%20266%2056%2018>

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>

-- Brian West brian@freeswitch.org <mailto:brian@freeswitch.org>

Twitter: @FreeSWITCH , @briankwest

http://www.freeswitchbook.com <http://www.freeswitchbook.com/> http://www.freeswitchcookbook.com <http://www.freeswitchcookbook.com/>

Allison prompts for FreeSWITCH:

https://www.gofundme.com/allison-prompts-for-freeswitch <https://www.gofundme.com/allison-prompts-for-freeswitch>

Got Bugs? Report them here! | Reddit: /r/freeswitch

T:+19184209001 <tel:%2B19184209001> | F:+19184209002 <tel:%2B19184209002> | M:+1918424WEST (9378) Skype:briankwest

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>

-- Brian West brian@freeswitch.org <mailto:brian@freeswitch.org>

Twitter: @FreeSWITCH , @briankwest

http://www.freeswitchbook.com <http://www.freeswitchbook.com/> http://www.freeswitchcookbook.com <http://www.freeswitchcookbook.com/>

Allison prompts for FreeSWITCH:

https://www.gofundme.com/allison-prompts-for-freeswitch <https://www.gofundme.com/allison-prompts-for-freeswitch>

Got Bugs? Report them here! | Reddit: /r/freeswitch

T:+19184209001 <tel:%2B19184209001> | F:+19184209002 <tel:%2B19184209002> | M:+1918424WEST (9378) Skype:briankwest

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>

-- Brian West brian@freeswitch.org <mailto:brian@freeswitch.org> Twitter: @FreeSWITCH , @briankwest

http://www.freeswitchbook.com <http://www.freeswitchbook.com/> http://www.freeswitchcookbook.com <http://www.freeswitchcookbook.com/>

Allison prompts for FreeSWITCH:

https://www.gofundme.com/allison-prompts-for-freeswitch <https://www.gofundme.com/allison-prompts-for-freeswitch> Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch> T:+19184209001 | F:+19184209002 | M:+1918424WEST (9378) Skype:briankwest

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

I'm on the side of easy entry. Just like babies we drink milk and on soft diet. As we mature, we eat solid foods - and wiser. Had FS started as solid food, it may have turned me off. Thanks to the gurus! /Nandy On Wed, Mar 15, 2017 at 6:05 PM, Brian West <brian@freeswitch.org> wrote:

You guys recall the message that talks about you have to define a user in a domain when an endpoint tries to register, That one was a single line message, it kept growing and to this day its still asked what does it mean. So more is not always better. :)

/b

On Wed, Mar 15, 2017 at 1:53 PM, Mario G <mario_fs@mgtech.com> wrote:

...

I agree, the big red lines say it all. Even if FS left out a default password someone may put 1234 in. Maybe bigger/more red lines.👺☠️

On Mar 15, 2017, at 7:22 AM, Brian West <brian@freeswitch.org> wrote:

That would negate any existing documentation on getting started, lets not add more work without a solid plan of action to get everything updated and who is going to be responsible for updating everything across Confluence and the Web.

We still have people using 1.0.6 how-to docs that are posted in various places all over the web.

/b

On Wed, Mar 15, 2017 at 10:18 AM, Kevin Wormington <kworm@sofnet.com> wrote:

...

I think if any change were to be made it would be best to set the default password to nothing (empty string) in the default config and not allow FS to start with an empty password. Put comments in the config file and documentation for the install to include setting a password.

I don’t think that would be too much of a barrier to entry for newbie users and would eliminate FS from that default password decision. If the user sets an insecure password and gets hacked then they are totally responsible.

Just my .02

Kevin

...

On Mar 15, 2017, at 9:09 AM, Brian West <brian@freeswitch.org> wrote:

I do believe Giovanni hit the nail on the head. And in all honesty it wouldn't matter what we try to do to protect the end user from themselves, If they don't fully grasp the concepts and how the security model works there isn't much more we can do as project to prevent bad deployments with shady security settings.

/b

On Wed, Mar 15, 2017 at 10:04 AM, Steven Ayre <steveayre@gmail.com> wrote: Bundle a dictionary of commonly used passwords and reject the calls if the password is on the blacklist? ;)

On 14 March 2017 at 18:29, Brian West <brian@freeswitch.org> wrote: This is exactly what prompted me to put the FOUR LINE CRIT statement when the default password isn't changed along with a 10 second delay before proceeding. Still I see questions posted about the 10 second delay and asking what it means. Not sure how to make it more clear.

/b

On Tue, Mar 14, 2017 at 1:19 PM, Giovanni Maruzzelli < gmaruzz@gmail.com> wrote: Is nice because they mention FreeSWITCH in the tag of the link, but the link is about FreePBX.

Anyway, it's true: if you do not use the standard security practice, and leave your FreeSWITCH with standard password "1234", or maybe you change the standard password to "password", you probably will be hacked, and phone calls will be originated from your FreeSWITCH that you do not want to originate.

But, man, that's what you, and me, and anyone is expecting.

Also, please do not drive wrong way in the autobahn :))

-giovanni

On 14 March 2017 at 16:42, Mario G <mario_fs@mgtech.com> wrote: Thought some may be interested in this. I first saw it today via Apple News… Related to tracing bomb threats and Jewish attacks… FreeSWITCH mentioned twice. http://www.theverge.com/2017/3/14/14913118/jcc-bomb-threats- anonymous-phone-calls-pdx-hacking ____________________________________________________________

---

...

Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

--

Sincerely,

Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18

____________________________________________________________

---

...

Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

-- Brian West brian@freeswitch.org

Twitter: @FreeSWITCH , @briankwest

http://www.freeswitchbook.com http://www.freeswitchcookbook.com

Allison prompts for FreeSWITCH:

https://www.gofundme.com/allison-prompts-for-freeswitch

Got Bugs? Report them here! | Reddit: /r/freeswitch

T:+19184209001 | F:+19184209002 | M:+1918424WEST (9378) Skype:briankwest

____________________________________________________________

---

...

Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

____________________________________________________________

---

...

Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

-- Brian West brian@freeswitch.org

Twitter: @FreeSWITCH , @briankwest

http://www.freeswitchbook.com http://www.freeswitchcookbook.com

Allison prompts for FreeSWITCH:

https://www.gofundme.com/allison-prompts-for-freeswitch

Got Bugs? Report them here! | Reddit: /r/freeswitch

T:+19184209001 | F:+19184209002 | M:+1918424WEST (9378) Skype:briankwest

____________________________________________________________

---

...

Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org

____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

--

*Brian West* brian@freeswitch.org

*Twitter: @FreeSWITCH , @briankwest*

http://www.freeswitchbook.com http://www.freeswitchcookbook.com

Allison prompts for FreeSWITCH:

*https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch>

Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>

*T:*+19184209001 <(918)%20420-9001> | *F:*+19184209002 <(918)%20420-9002> | *M:*+1918424WEST (9378) *Skype:*briankwest _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

--

*Brian West* brian@freeswitch.org

*Twitter: @FreeSWITCH , @briankwest*

http://www.freeswitchbook.com http://www.freeswitchcookbook.com

Allison prompts for FreeSWITCH:

*https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch>

Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>

*T:*+19184209001 <(918)%20420-9001> | *F:*+19184209002 <(918)%20420-9002> | *M:*+1918424WEST (9378) *Skype:*briankwest

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org