Opensource Systemadmin module

Update: While it did run and compile on IncrediblePBX-2025, it does not put the module in /var/www/html/admin/modules and it put other parts in /usr/local/freepbx which is not where FreePBX is located on this system.

I have just run this install against an IncrediblePBX-2025 system (Debian-12, Asterisk-22, FreePBX-17) and it installs correctly.

So there is an issue with how FreePBX is installed on TangoPBX or an issue with Ubuntu-2204.

Well there are two pieces two this module. The actual PHP stuff that gets installed like a normal module and the compiled scripts that would be used by the module front end.

So you’re saying that GitHub - hannes427/systemadmin_php doesn’t install in the proper place of /var/www/html/admin/modules?

Correct, It installs the sysadmin directory wherever you are when you do the git clone.

@NerdUno has solved a piece of it.

Well it looks like there isn’t a tar.gz file to install via Module Admin like normal. That would mean you would need to manually place it in /var/www/html/admin/modules/systemadmin

With Ward Mundy’s suggested mods, it compiles on IncrediblePBX-2025 and places the sysadmin directory and subtending files in the /var/www/html/admin/modules/ directory. However, the module does not appear in the FreePBX GUI (at least I could not find it.) I did a full fwconsole restart but don’t see any sign of the module in the GUI.

I’ll let someone else take it from here.

Thank you all for the comments. I will provide deb-packages for the binary part and a *PBX-package for the php-files asap.

Regarding TangoPBX Distro: It seems that the required packages for compiling are installed in a different path on Ubuntu. When developing the package and writing the first post in this thread, I wasn’t aware that the TanGOPBX distribution is based on Ubuntu. Therefore, I only developed it locally on OpenSUSE and tested it on Debian 12. In the process of writing the instructions in the post Opensource Systemadmin module - #5 by Hannes" it worked under Debian 12, and all the required packages were installed. However, I cannot rule out that some necessary packages may have been installed from previous tests, which is why they were missing in my instructions. I am currently creating clean test machines for Debian 12 and Ubuntu 22.04, and I will post updated installation instructions as soon as they are ready so that you can choose between installing the provided deb-packages or compilling it on your own.

I’ve created installation instructions in the corresponding Github repos, deb-pakages for Debian 12 and Ubuntu 22.04 and also an archive for the module, which has to be installed in the web interface of the PBX.

2 Likes

For someone that didn’t have time for support, you’re doing an INCREDIBLE JOB! :100:

2 Likes

Thank you very much! When I wrote the sentence stating that I am unable to support the package adequately due to time constraints, I was more referring to the time when it is in a stable release. At that point, the package may indeed be used by (large) companies, for whom it’s not an option to say, “Okay, our phone system is not functional due to a bug, and we’ll just have to wait until someone ‘takes pity’ and fixes a bug in this module.” Instead, bug fixes need to be released relatively promptly. :wink:

1 Like

Circling back to why I asked this question

I was worried that your observation would happen

It is a git clone. Unless you specify the local directory to put the files in, it clones it in the current directory you are in. It creates a directory named after the repo.

Here are the steps to get this working with Incredible PBX 2025-U:

  1. From the Linux CLI:
cd /tmp
wget https://github.com/hannes427/sysadmin/raw/refs/heads/master/install/systemadmin-1.0.0-Ubuntu22-04.deb
apt install ./systemadmin-1.0.0-Ubuntu22-04.deb
mkdir /dev/md
  1. From the FreePBX GUI:
Login as Admin
Navigate to Module Admin
Click Upload Modules
Choose From Web and enter the following:
https://github.com/hannes427/systemadmin_php/raw/refs/heads/master/install/systemadmin.tar.gz
  1. Enable the Systemadmin module in Module Admin and Apply Config.

  2. To use SysAdmin Module, choose: Admin → Systemadmin

P.S. Attempts to use Debian were a total bust, but we do have things working with Incredible PBX 2027-U after a couple tweaks to permit FreePBX 16:

sed -i 's|<supported>17.0|<supported>16.0|' /var/www/html/admin/modules/systemadmin/module.xml
sed -i 's|<version>17.0.1|<version>16.0.1|' /var/www/html/admin/modules/systemadmin/module.xml
1 Like

[Below, replace * with Free, Tango, or Incredible]

Questions that come to mind about a sysadmin module… beginning with a comment… thank you for taking on this effort. I am 100% behind any open-source *PBX module development.

That said, I would back up and ask the question “why sysadmin?” For GUI-based administration of all things Linux, including the network stack, web server, email server, vpn server, etc., there are existing tools. Webmin and Cockpit are two that come to mind. I guess what I am thinking about is separation of concerns. Other than single-screen convenience, what is the big value (considering risk, see below) a sysadmin PBX module brings.

Why shouldn’t the management of the network have to be done by the root user – which is not to say, someone who can access the *PBX admin GUI, but actual root. In a lot of cases, PBX admin and root user are one and the same. Yet we pretend that we have separation of user and root by chowning everything as asterisk and running the daemons as asterisk and still logging in and working as root all the time…

What I am getting at is perhaps root-level admin stuff should be completely separated from *PBX. For something like firewall, which actually does make a lot of sense to control from the PBX GUI, write a server daemon that runs as root to alter nftables and has a tight API that the PBX can interact with. I recognize that firewall is not in scope here with your module. In FreePBX (commercial), sysadmin and firewall are tightly coupled, and this is problematic.

Take note that a vulnerabilty in a Sangoma commercial module a few years ago resulted in attackers being able to pop stuff in incron and run as root. I know you’re not using incron here, but the point is, this (sysadmin, system-root-level interaction) is going to be the area where black hats focus their attention.

Having already made my case against “The Sangoma way” I will say that the other two ways have a couple issues in my opinion. Sudo is going to require manual setup to start with. Setuid binary requires the php script to make a system call to it and system/shell calls are a common place for hackers to bust through. The fourth way I previously mentioned, a strictly controlled server daemon with a tight API to talk to it, is probably the most secure.

2 Likes

Good points, Bill. It’s the primary reason we deployed a whitelist-only firewall with Incredible PBX that blocked all anonymous web access rather than risk an intrusion because of a design hole that was left inadvertently unplugged. Perhaps we should save that discussion for a different thread as I’m sure some of the ClearlyIP folks will want to chime in regarding the FreePBX firewall design.

The DNS and Network Config options both choke in Incredible PBX but work fine in TangoPBX. Error was Greek to me as a novice programmer. :slight_smile:

Can't get neplan config for interface bonding_masters: Command failed: Unexpected YAML structure found Segmentation fault

DNS and Network Config work OK for me on IncrediblePBX Debian. However the Storage option bombed out until I manually created the /dev/md directory.

I’m beginning to see that support for multiple OS’s will be difficult for new modules. I suspect that is why FreePBX settled for Debian-12 for their deployment.

When I started this thread, I actually wanted to receive comments like this—what do others generally think about the idea of such a module, are there any problems with my solution that I haven’t considered, and is there a better solution (I was indeed aware of the risks associated with setUID programs). Since I have never had formal training as a developer (neither in PHP nor in C++), but taught myself everything, I’m also interested in whether there are bugs in my source code that could be exploited by hackers. So i really appreciate your comment!

That is a good question. But I can imagine that this ‘single-screen convenience’ is one reason for the success of FreePBX. Let’s say a small company with a maximum of 10 employees. Every client and the only server are Windows-based. But they want a cheep PBX. With FreePBX, they don’t have to learn how $Linux-Distro works and they don’t have to fiddle with the command line. To install a new system, some users just want to insert a CD into the drive (consider it a metaphor for an easy installation—regardless of whether they actually insert a CD/DVD into a drive, plug a USB stick into a USB port, or specify an ISO image as the boot device in a virtual machine) and everything needed is installed automatically. And after the installation, they can do everything gui-based. Of cause, the “gui-part” is also possible with webmin or cockpit so this could be another/better way. To be honest, I didn’t think of Webmin when I came up with the idea to develop this module, and I wasn’t familiar with Cockpit.

That’s an interesting idea, but at least for now, it’s well beyond what I could quickly program. However, you’ve sparked my curiosity about how one might develop such a solution—so thank you for that too! :wink:

I understood your point, and I’m of course aware that such things (including the system calls through PHP files you mentioned) are exactly the attack vectors that hackers try to exploit to break into a system and that it’s important to ensure that vulnerabilities like code injection are effectively prevented.

3 Likes

FIXED: Bug causing DNS and Network Config options to fail in Incredible PBX

echo "network:
    ethernets:
        ens18:
            dhcp4: true
    version: 2" > /etc/netplan/incrediblepbx.yaml

This module is handy in that you put several things in the GUI that are normally achieved at the Linux level. IncrediblePBX can do most of these things already using scripts included in the /root home directory; including firewall modification. This pretty much restricts acces to a root user. IncrediblePBX is also locked down; allowing only whitelisted IP addresses to access the system. There is no access to the firewall via the GUI.

So different distributions have different ways of providing similar features. Due to the ability to use FreePBX on various Linux distributions (Debian, Ubuntu, Rocky, etc.) writing a universal FreePBX module can be tricky. Somehow a module has to live within the FreePBX ecosystem and remain OS independent for installation and use. Not only that, it has to either be backwards compatible with earlier versions of FreePBX (mainly due to the PHP versions) or limited to only one version. Either way, there is maintenance required as the eco system evolves over time.

This Sysadmin module is useful for those who don’t want to dig into the OS level features too much.

1 Like