ViciBox v.10.0.2 released January 9th, 2023

[Kumba]

10.0.2 is another roll-up release along with a few tweaks. This will likely be one more release right before OpenSuSE v.15.3 goes EOL. So far the package updates have been working great.

-----
10.0.1 is mostly a roll-up release of all the package fixes and everything. Everything will work directly out of the box without any package updates or anything.

-----

The dot-oh release of ViciBox v.10 is finally here. The VB-firewall has changed a little bit from V9 and the vicibox-certbot script has been replaced by the much less problematic vicibox-ssl. Other then that, it's essentially the same installation method and utilities.

You can download the ISO here:
http://download.vicidial.com/iso/vicibo ... 10.0.0.iso
http://download.vicidial.com/iso/vicibo ... 10.0.0.md5
http://download.vicidial.com/iso/vicibo ... 0.0-md.iso
http://download.vicidial.com/iso/vicibo ... 0.0-md.md5


If you have any installation issues please start a new thread with a good title like "Vicibox 10 can't do <thing here>" so we can work on it. Once the time is right I will start a ViciBox v.10 bugfix thread. Hopefully there won't be much here as a lot of the installer and such has moved to being package based. I will probably push out a new version every 6 months or so unless there's a pretty glaring install issue.

This version of ViciBox is based on OpenSuSE v.15.3 and all it's goodness. It also has a 'vicibox-ast16' script which will allow you to install Asterisk 16 once ViciDial has tested and is production ready for Asterisk 16.

[roger.milligan]

Thanks Kumba.

That's great news. We'll be rebuilding a Vici cluster for a 150 agent customer in the next month and will be replacing a VERY old VERSION: 2.8-403a BUILD: 130510-1350 with ViciBox v 10. We've done the best we can to mitigate the AMD issues with Asterisk 13 on other ViciBox installs, but will be keen to get this site onto Asterisk 16 asap.

Roger

[vkad]

Hi,

Thanks for the release.

The links seem to be down.

[Kumba]

Not sure how I did that, but I messed up the link. They're up and working now.

[carpenox]

the vicibox-ast16 is not active yet correct? i just tried it (from the beta4 and trying zypper up) or is it only avail on the final release?

[Kumba]

the vicibox-ast16 is not active yet correct? i just tried it (from the beta4 and trying zypper up) or is it only avail on the final release?

It was added to the final release.

[carpenox]

i noticed theres pjsip support now as well, good shit, thats whats up

[Nefariousparity]

How is asterisk 16? Is it more stable under load, does it have better or the same answering machine detection than 13? Because of 13, we have been running a 8.0.1 with asterisk 11.25.1 albeit a very locked down 8.0.1 with 11.25.1.

[Kumba]

You can install asterisk 16 whenever you want, but ViciDial code itself is still being tested. That means you'll be in somewhat dubious waters as proper support and a release is done.

[carpenox]

kumba, does the phpMyAdmin install to the actual lcoation of /srv/www/htdocs/phpMyAdmin? i dont see it as a symlink and its not working

[Kumba]

kumba, does the phpMyAdmin install to the actual lcoation of /srv/www/htdocs/phpMyAdmin? i dont see it as a symlink and its not working

Just downloaded the v.10.0.0 release from the website, and I see /srv/www/htdocs/phpMyAdmin in there. If I go to http://some.server.ip/phpMyAdmin it loads up just fine. The configuration currently restricts access to only from LAN RFC1918 IP space.

[carpenox]

Got it thx

[carpenox]

ok so a couple bugs which i will submit to the tracker, but the first one is, the ssl package using acme.sh doesnt seem to work with webrtc, ive tried on like 7 servers, and on all of them, once i use certbot certonly --webroot it then works. The second major bug is that the VB-firewall does not actually work to allow IP's to the services listed in the trusted zone, or even the public zone for that matter does not allow any IP's once you have firewalld turned on if you are applying the whitelist or dynamic list, the program processes the IP's, but it does not actually allow them access.

[bbakirtas]

everything is so good, easy setup ,performance software but answering machine detection problem persists.this problem is caused by asterisk not vicidial.
total 26 call 13 answering machine 13 human answer, answering machine rate 50%

[alo]

Did you try asterisk 16 and still see those results for AMD or you just were still using asterisk 13?

[carpenox]

yes i am using 16 and AMD isnt much better

[GenXOutsourcing]

everything is so good, easy setup ,performance software but answering machine detection problem persists.this problem is caused by asterisk not vicidial.
total 26 call 13 answering machine 13 human answer, answering machine rate 50%

AMD does not make a Human answer. of those 13 Human answers, how many were human? of the 15 Answering Machines, how many were actually machines?

[carpenox]

IPSet voipblip not found! Skipping...

the vb-firewall does this for all triggers Kumba, any ideas?

[bbakirtas]

everything is so good, easy setup ,performance software but answering machine detection problem persists.this problem is caused by asterisk not vicidial.
total 26 call 13 answering machine 13 human answer, answering machine rate 50%

AMD does not make a Human answer. of those 13 Human answers, how many were human? of the 15 Answering Machines, how many were actually machines?

Total 26 call 13 answering machine (mailbox)
13 human answer

[carpenox]

The built in AMD is not perfect, its far from, about 60% effective, so your numbers are on point, but how many answering machines do your agents NOT get to there system and are you using the AMD settings as specified in my blog article here: https://cyburdial.net/answering-machine ... -vicibox9/

[alo]

I thought you said AMD isn't much better then 13 right? Definitely not on the level of asterisk 11?

[carpenox]

correct, i havent noticed much difference, although it does process AMD faster and asterisk runs smoother

[carpenox]

here is the way how to fix the VB-firewall issue on V10:

https://cyburdial.net/how-to-fix-the-fi ... vicibox10/

Hope this helps

[Kumba]

ok so a couple bugs which i will submit to the tracker, but the first one is, the ssl package using acme.sh doesnt seem to work with webrtc, ive tried on like 7 servers, and on all of them, once i use certbot certonly --webroot it then works.

So the first thing I want to mention is that certbot doesn't exist on ViciBox v.10.0.0. That sounds like a remnant from some of the Beta releases. The final release of vicibox-ssl uses the acme.sh script to generate SSL certs. It also generates a unique template file using the format "<HOSTNAME>-RTC". So if you don't change the default hostname, which is 'vicibox10', the template you will want to apply to your WebRTC phones is going to be called 'vicibox10-RTC'. This was done so that you could use vicibox-ssl on a cluster. If you didn't tell vicibox-ssl to generate all the asterisk configs and such for you, then you would need to manually create those.

The second major bug is that the VB-firewall does not actually work to allow IP's to the services listed in the trusted zone, or even the public zone for that matter does not allow any IP's once you have firewalld turned on if you are applying the whitelist or dynamic list, the program processes the IP's, but it does not actually allow them access.

I looked over your other post about fixing VB-firewall by adding some IPSets. So I started by looking to see if those exist in a fresh install of vicibox10:

Code: Select all

vicibox10:/etc/asterisk # firewall-cmd --get-ipsets
blackips blacknets dynamiclist geoblock voipblip voipblnet whiteips whitenets


The IPSets that VB-firewall needs are already there. they are also the correct types:

Code: Select all

vicibox10:/usr/local/bin # firewall-cmd --info-ipset=dynamiclist
dynamiclist
  type: hash:ip
  options: maxelem=262144
  entries:


So the ipsets do exist in the final ViciBox v.10.0.0. I believe correcting the firewall behavior and wrapping it around firewalld was the last thing I fixed in the final V.10.0.0 release. So there's a good chance this would not be correct in any version of the betas. I'll setup and test the dynamic list portion here in a little bit as well.

Are you sure you aren't seeing these issues on some form of the Beta? If you do a 'head -n 1 /etc/vicibox-version' it should tell you what release your install started as.

[carpenox]

ok so a couple bugs which i will submit to the tracker, but the first one is, the ssl package using acme.sh doesnt seem to work with webrtc, ive tried on like 7 servers, and on all of them, once i use certbot certonly --webroot it then works.

So the first thing I want to mention is that certbot doesn't exist on ViciBox v.10.0.0. That sounds like a remnant from some of the Beta releases. The final release of vicibox-ssl uses the acme.sh script to generate SSL certs. It also generates a unique template file using the format "<HOSTNAME>-RTC". So if you don't change the default hostname, which is 'vicibox10', the template you will want to apply to your WebRTC phones is going to be called 'vicibox10-RTC'. This was done so that you could use vicibox-ssl on a cluster. If you didn't tell vicibox-ssl to generate all the asterisk configs and such for you, then you would need to manually create those.

i zyppered in certbot in order to use it, its definitely the final that i am using

The second major bug is that the VB-firewall does not actually work to allow IP's to the services listed in the trusted zone, or even the public zone for that matter does not allow any IP's once you have firewalld turned on if you are applying the whitelist or dynamic list, the program processes the IP's, but it does not actually allow them access.

I looked over your other post about fixing VB-firewall by adding some IPSets. So I started by looking to see if those exist in a fresh install of vicibox10:

Code: Select all

vicibox10:/etc/asterisk # firewall-cmd --get-ipsets
blackips blacknets dynamiclist geoblock voipblip voipblnet whiteips whitenets


The IPSets that VB-firewall needs are already there. they are also the correct types:

Code: Select all

vicibox10:/usr/local/bin # firewall-cmd --info-ipset=dynamiclist
dynamiclist
  type: hash:ip
  options: maxelem=262144
  entries:


So the ipsets do exist in the final ViciBox v.10.0.0. I believe correcting the firewall behavior and wrapping it around firewalld was the last thing I fixed in the final V.10.0.0 release. So there's a good chance this would not be correct in any version of the betas. I'll setup and test the dynamic list portion here in a little bit as well.

Are you sure you aren't seeing these issues on some form of the Beta? If you do a 'head -n 1 /etc/vicibox-version' it should tell you what release your install started as.

If you apply any list on crontab, it locks you out of the system completely, many many people have reported this issue to me and i have verified it as well, I installed it on about 2 dozen servers so far and every single one has the same issue, and as far as the acme.sh cert, theres audio problems when using it for most people, not all.

[bizfuel]

fyi: the vicibox installation manual hosted on the vicibox website still references v9. Will this be updated to vicibox v10?

[carpenox]

its the same instructions

[GenXOutsourcing]

Not sure if this has anything to do with the issues, but I downloaded a fresh copy of the ISO on 6Oct. When installing, says its v.10.0 BETA

but when checking with head -n 1 /etc/vicibox-version, says V.10.0.0

[pdraganov]

I installed ViciBox 10.0.0 which is based on openSUSE Leap 15.3. According to https://software.opensuse.org/package/mariadb MariaDB package should be 10.5.12, but it is mariadb-10.5.8-1.5.x86_64. This version is vulnerable: CVE-2021-27928, CVE-2021-2372, CVE-2021-2389, so I tried to update it but there is no update in current repositories:

Code: Select all

ll /etc/zypp/repos.d
total 20
-rw-r--r-- 1 root root 134 Sep  1 07:32 openSUSE-Leap-15.3-Oss.repo
-rw-r--r-- 1 root root 158 Sep  1 07:32 openSUSE-Leap-15.3-PERL.repo
-rw-r--r-- 1 root root 173 Sep  1 07:32 openSUSE-Leap-15.3-ViciDial-Ast13.repo
-rw-r--r-- 1 root root 171 Sep  1 07:32 openSUSE-Leap-15.3-ViciDial-ViciBox.repo
-rw-r--r-- 1 root root 154 Sep  1 07:32 openSUSE-Leap-15.3-ViciDial.repo


Can you advise where can I find a proper .repo file, so that I can update openSUSE packages?

[carpenox]

https://software.opensuse.org/

[pdraganov]

Actually not there. I found it in http://download.opensuse.org/update/leap/15.3/oss/openSUSE:Leap:15.3:Update.repo and saved it as /etc/zypp/repos.d/openSUSE-Leap-15.3-Update.repo. I wonder why this file is not included in ViciBox 10 distro.

[bronson]

heads up, the astgui keepalive script was not in my crontab on a new vicibox10 install. I had to add it to the crontab manually.

[carpenox]

yea its not in there, good post back

[kevinhippert]

According to this older post: http://www.vicidial.org/VICIDIALforum/v ... in#p148290
phpmyadmin is not enabled automatically. It requires linking the phpmyadmin folder in /usr/share to /srv/www/htdocs but that is not the case in v10. The phpmyadmin folder is in the /srv/www/htdocs by default on the single server install. Also, you get full access to the databases with cron:1234


To fix this:
#copy the phpmyadmin folder back to /usr/share
cp -r /srv/www/htdocs/phpMyAdmin/ /usr/share/

#then delete the phpmyadmin folder from the htdocs directory
rm -r /srv/www/htdocs/phpMyAdmin/

If you would like to make phpmyadmin available in the future, you can then use the link command in the above mentioned post:
ln -s /usr/share/phpMyAdmin /srv/www/htdocs/

[gcd135]

Hi, to all of you guys that are still having some issues with VB-firewall , just reinstall firewalld and vicibox-firewall .

Code: Select all

269  2021-12-07 09:30:57 zypper remove firewalld
270  2021-12-07 09:31:17 zypper install firewalld
271  2021-12-07 09:31:46 zypper install vicibox-firewall
281  2021-12-07 09:34:19 systemctl enable firewalld
294  2021-12-07 09:38:35 reboot

I tested it by removing/adding --norfc1918, thru lan , then visiting HTTP, with rtp and ssh only allowed @ public zone

Btw, will the update repo http://download.opensuse.org/update/lea ... pdate.repo cause any issues/conflicts on the other packages at vicibox repos? is that why it is not included in ViciBox10 distro?

[vkad]

The error is here for the Dynamic Firewall

In the dynamic section code when the user logs in through the portal the IP is added to the blacklist because of this incorrect logic.

Code: Select all

                doipnetslist(\@dynamicips, $IPBLACK, "X", "DynamicList");


This should be changed to:

Code: Select all

                doipnetslist(\@dynamicips, $IPDYNAMIC, "X", "DynamicList");


[vkad]

Also, make sure that

firewall-cmd --permanent --zone=external --add-source=ipset:dynamiclist

[carpenox]

can this be added to the source publically @matt or @kumba?


great post

[RBecker]

Hey Kumba,
It seems that vicibox-upgrade is missing from the ViciBox v10 server. Is there a new procedure for doing SVN updates and applying the schema changes on v10 or was this just an oversight?

[Nefariousparity]

Can ViciBOX 10 work with 11 like 9 DID? Is there a rollback.