asterisk-20

;;;;;;;ASTERISK INSTALL;;;;;;;;;;;;

cd /usr/src
wget http://downloads.asterisk.org/pub/telephony/asterisk/asterisk-20-current.tar.gz
tar xzvf asterisk-20-current.tar.gz
cd /usr/src/asterisk-20.6.0/
contrib/scripts/install_prereq install
./configure --with-pjproject-bundled
make menuselect
make -j4 && make install && make samples && make config && ldconfig
;Дадим права
adduser --system --group --home /var/lib/asterisk --no-create-home --gecos "Asterisk" asterisk
usermod -a -G dialout,audio asterisk
chown -R asterisk: /var/{lib,log,run,spool}/asterisk /usr/lib/asterisk /etc/asterisk


sed -i 's/;runuser = asterisk/runuser = asterisk/' /etc/asterisk/asterisk.conf
sed -i 's/;rungroup = asterisk/rungroup = asterisk/' /etc/asterisk/asterisk.conf
sed -i '/^;\[radius\]/ s/^;//' /etc/asterisk/cdr.conf
sed -i '/^;radiuscfg =>/ s/^;//' /etc/asterisk/cdr.conf
sed -i '/^;full.log => n/ s/^;//' /etc/asterisk/logger.conf


systemctl enable asterisk
systemctl stop asterisk && systemctl start asterisk && systemctl status asterisk
asterisk -rvvvvvv


sed -i -e '$a\' -e 'cd /etc/asterisk/' ~/.bashrc
export CDPATH="/etc/asterisk/"


apt install -y rsyslog

mcedit /etc/logrotate.d/rsyslog

###Добавить


/var/log/asterisk/queue_log
/var/log/asterisk/messages.log
/var/log/asterisk/full.log

{
    rotate 6
    size 20M
    missingok
    notifempty
    compress
    delaycompress
    sharedscripts
    postrotate
    /usr/lib/rsyslog/rsyslog-rotate
    endscript
}





------------------------------------------------------------------
service rsyslog restart
------------------------------------------------------------------

crontab -e

* * * * * /usr/sbin/logrotate /etc/logrotate.conf

-----------------------------------------------------------------
tail -f /var/log/syslog | grep CRON
-----------------------------------------------------------------
ls -lh  /var/log/syslog

ls -lh /var/log/asterisk/



****************************************************************
### В папку /etc/logrotate.d     добаить asterisk
 /var/log/asterisk/messages.log
 /var/log/asterisk/full.log
 /var/log/asterisk/security.log
.
{
compress
delaycompress
nocreate
nocopytruncate
nomissingok
rotate 6
size 2M
noolddir
postrotate
/usr/sbin/asterisk -rx 'logger reload'
endscript
}

/var/log/asterisk/cdr-csv/Master.csv {
compress
missingok
delaycompress
nocreate
nocopytruncate
rotate 253
noolddir
postrotate
/usr/sbin/asterisk -rx 'logger reload'
endscript
}


***************************************************************



apt install -y mc


apt install -y odbc-postgresql unixodbc
odbcinst -q -d
odbcinst -q -d -n 'PostgreSQL Unicode'

mcedit /etc/odbcinst.ini
mcedit /etc/odbc.ini
mcedit /etc/asterisk/cdr_adaptive_odbc.conf
mcedit /etc/asterisk/res_odbc.conf
mcedit /etc/asterisk/cel_odbc.conf
mcedit /etc/asterisk/cdr_odbc.conf
mcedit /etc/asterisk/sorcery.conf





mcedit /etc/odbcinst.ini
[PostgreSQL Unicode]
Description=PostgreSQL ODBC driver (Unicode version)
Debug=1
CommLog=1
Driver = /usr/lib/x86_64-linux-gnu/odbc/psqlodbcw.so
Setup = /usr/lib/x86_64-linux-gnu/odbc/libodbcpsqlS.so
Driver64        = /usr/lib/x86_64-linux-gnu/odbc/psqlodbcw.so
Setup64         = /usr/lib/x86_64-linux-gnu/odbc/libodbcpsqlS.so
UsageCount = 2


mcedit /etc/odbc.ini
[mypostgresqldb]
Description=My Postgresql sample database
Driver=PostgreSQL Unicode
Driver  = postgresql
Username = postgres
Password = 1234566
Servername = 10.20.7.122
Database = aster117
Port = 5432
ReadOnly = No
Protocol = 7.4+
ShowOidColumn = No
FakeOidIndex  = No
RowVersioning = No
ShowSystemTables = No
Fetch = Yes
BoolsAsChar = Yes
SSLmode = disable
ConnSettings =



mcedit /etc/asterisk/res_odbc.conf
[aster117-res_odbc]
enabled=>yes
dsn=>mypostgresqldb
max_connections => 1
pre-connect=>yes
username=>postgres
password=>1234566
database=>aster117



mcedit /etc/asterisk/cdr_adaptive_odbc.conf
[cdr_adaptive_connection]
connection=aster117-res_odbc
table=cdr
loguniqueid=yes
usegmtime=no
alias start => calldate
alias realdst => realdst
alias remoteip => remoteip
alias start => calldate
alias hangupcause => hangupcause
alias peerip => peerip
alias recvip => recvip
alias fromuri => fromuri
alias useragent => useragent
alias filename => filename


mcedit /etc/asterisk/extconfig.conf
[settings]
ps_aors => odbc,aster117-res_odbc
ps_aster117_publications => odbc,aster117-res_odbc
ps_auths => odbc,aster117-res_odbc
ps_contacts => odbc,aster117-res_odbc
ps_domain_aliases => odbc,aster117-res_odbc
ps_endpoint_id_ips => odbc,aster117-res_odbc
ps_endpoints => odbc,aster117-res_odbc
ps_globals => odbc,aster117-res_odbc
ps_inbound_publications => odbc,aster117-res_odbc
ps_outbound_publishes => odbc,aster117-res_odbc
ps_registrations => odbc,aster117-res_odbc
ps_transports => odbc,aster117-res_odbc
queues => odbc,aster117-res_odbc
queue_members => odbc,aster117-res_odbc
musiconhold => odbc,aster117-res_odbc
musiconhold_entry => odbc,aster117-res_odbc


mcedit /etc/asterisk/sorcery.conf
[test_sorcery_section]
test=memory

[test_sorcery_cache]
test/cache=test
test=memory
; The following object mapping is the default mapping of external MWI mailbox
; objects to give persistence to the message counts.
;
;[res_mwi_external]
;mailboxes=astdb,mwi_external

;
; The following object mappings set PJSIP objects to use realtime database mappings from extconfig
; with the table names used when automatically generating configuration from the alembic script.
;
[res_pjsip]
endpoint=realtime,ps_endpoints
endpoint=config,pjsip.conf,criteria=type=endpoint
auth=realtime,ps_auths
auth=config,pjsip.conf,criteria=type=auth
aor=realtime,ps_aors
aor=config,pjsip.conf,criteria=type=aor
;transport=config,pjsip.conf,criteria=type=transport
;domain_alias=realtime,ps_domain_aliases
contact=realtime,ps_contacts

[res_pjsip_endpoint_identifier_ip]
identify=realtime,ps_endpoint_id_ips

[res_pjsip_outbound_publish]
outbound-publish=realtime,ps_outbound_publishes

[res_pjsip_pubsub]
inbound-publication=realtime,ps_inbound_publications

[res_pjsip_publish_asterisk]
asterisk-publication=realtime,ps_asterisk_publications


*********************************************************************
systemctl stop asterisk && systemctl start asterisk && systemctl status asterisk
asterisk -rvvvvvv

odbc show all

#####################################################################


######################################################################################


asterisk
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
mcedit /etc/asterisk/pjsip.conf

[transport-udp-nat]
type=transport
protocol=udp
bind=0.0.0.0
local_net=10.10.50.0/24
external_media_address=109.105.165.107
external_signaling_address=109.105.165.107

[acl]
type=acl
deny=0.0.0.0/0.0.0.0
permit=176.59.192.0-176.59.223.255
permit=10.0.0.0/8
permit=83.102.160.66
permit=109.105.165.0/24

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

mcedit /etc/asterisk/extensions.conf
[zadarma-in]
exten => 620465,1,Set(CHANNEL(accountcode)=277)
same => n,Goto(lk_620465_pbx,620465,1)
same => n,Hangup


[zadarma-out]
exten => _XXX,1,Dial(PJSIP/${EXTEN})                   ; звонки на трехзначные внутренние номера aстериска


exten => 103,1,NoOp("Проверка, переведен ли звонок")
 same => n,GotoIf($["${BLINDTRANSFER}" != ""]?hangup:continue)
 same => n(continue),Dial(PJSIP/${EXTEN})
 same => n,Hangup()
 same => n(hangup),NoOp("Звонок переведенный - вешаем трубку")
 same => n,Hangup()




exten => _XXX.,1,Dial(PJSIP/${EXTEN}@620465)           ; звонки на номера в которых четрые и более цифр через транк 620465

;exten => _XXX,1,Gosub(sub-devstate,${EXTEN},1)
;exten => _XXX,n,Dial(SIP/${EXTEN},90,trm)
;exten => _XXX,n,Hangup()








exten => 101,1,Gosub(sub-devstate,${EXTEN},1)
same => n,Mixmonitor(/home/${EXTEN}n_.${UNIQUEID}.wav,b)
same => n(local_out),Dial(PJSIP/101,3,rt)
same => n,GotoIfTime(18:00-08:00,mon-fri,*,*?local_out)
same => n,Set(CALLERID(num)=00000000)
same => n,Dial(PJSIP/241247@620465)

exten => 1,1,Set(CHANNEL(accountcode)=549)
    same => n,Answer
    same => n,MixMonitor(/home/${EXTEN}n_.${UNIQUEID}.wav,b)
	same => n,Queue(test_all,rt)

exten => 2,1,Set(CDR(description)=ivr:${EXTEN})
    same => n,MixMonitor(/home/${EXTEN}n_.${UNIQUEID}.wav,b)
    same => n,Dial(PJSIP/102,20,rt)
;    same => n,Dial(PJSIP/101,20,rt)
    same => n,GotoIfTime(*,*,28-31,jul?weekend2)
    same => n,GotoIfTime(*,*,1-20,jan?weekend2)
    same => n,Dial(PJSIP/101,15,rt)
    same => n,Set(CALLERID(num)=73452999999)
    same => n,Goto(exten,1,1)
	same => n,Hangup
    same => n(weekend2),Dial(PJSIP/241247@620465,,rt)
	same => n,Hangup


[sub-devstate]
exten => _X.,1,Log(NOTICE, "${EXTEN} has DEVICE STATE ${DEVICE_STATE(SIP/${EXTEN})}")
exten => _X.,n,GotoIf($["${DEVICE_STATE(PJSIP/${EXTEN})}" = "BUSY"]?s-BUSY,1)
exten => _X.,n,GotoIf($["${DEVICE_STATE(PJSIP/${EXTEN})}" = "INUSE"]?s-BUSY,1)
exten => _X.,n,GotoIf($["${DEVICE_STATE(PJSIP/${EXTEN})}" = "INVALID"]?s-INVALID,1)
exten => _X.,n,GotoIf($["${DEVICE_STATE(PJSIP/${EXTEN})}" = "UNAVAILABLE"]?s-UNAVAILABLE,1)
exten => _X.,n,Return()
exten => s-BUSY,1,NoOp(Абонент ${EXTEN} в данный момент разговаривает)
exten => s-BUSY,n,Playback(extension-is-busy)
exten => s-BUSY,n,Hangup(17)
exten => s-INVALID,1,NoOp(Абонент ${EXTEN} не существует)
exten => s-INVALID,n,Goto(no-number,${EXTEN},1)
exten => s-INVALID,n,Hangup(1)
exten => s-UNAVAILABLE,1,NoOp(Абонент ${EXTEN} не доступен)
exten => s-UNAVAILABLE,n,Playback(ss-noservice)
exten => s-UNAVAILABLE,n,Wait(2)
exten => s-UNAVAILABLE,n,Hangup(18)
[no-number]
exten => _X.,1,NoOp(Статус набора - ${DIALSTATUS})
exten => _X.,n,Goto(invalid-number,1)
exten => invalid-number,1,NoOp(Неверно набран номер)
exten => invalid-number,n,Set(CDR(userfield)=No Number)
exten => invalid-number,n,Playback(pbx-invalid)
exten => invalid-number,n,Wait(1)
exten => invalid-number,n,Hangup()
exten => t,1,Playback(vm-goodbye)
exten => t,n,Hangup()
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
#######################################################################################
########################################################################################
########################################################################################

echo "select 1" | isql -v mypostgresqldb postgres 1234566





apt remove --auto-remove nftables -y
apt purge nftables -y
apt update
apt install fail2ban iptables iptables-persistent -y
iptables -L -v

systemctl enable iptables

mcedit /etc/asterisk/logger.conf
security => security
console => notice,warning,error
console => notice,warning,error,debug
messages => notice,warning,error
full => notice,warning,error,debug,verbose,dtmf,fax









fail2ban-client unban 10.10.50.16
fail2ban-client unban 37.139.38.15


iptables -nL --line-numbers
iptables -L -n
fail2ban-client reload


mcedit /etc/fail2ban/filter.d/asterisk.conf
#################################################################################################
[INCLUDES]
before = common.conf

[Definition]
_daemon = asterisk
__pid_re = (?:\s*\[\d+\])
iso8601 = \d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+[+-]\d{4}
# All Asterisk log messages begin like this:
log_prefix= (?:NOTICE|SECURITY|WARNING)%(__pid_re)s:?(?:\[C-[\da-f]*\])?:? [^:]+:\d*(?:(?: in)? [^:]+:)?

prefregex = ^%(__prefix_line)s%(log_prefix)s <F-CONTENT>.+</F-CONTENT>$

failregex = ^Registration from '[^']*' failed for '<HOST>(:\d+)?' - (?:Wrong password|Username/auth name mismatch|No matching peer found|Not a local domain|Device does not match ACL|Peer is not supposed to register|ACL error \(permit/deny\)|Not a local domain)$
            ^Call from '[^']*' \(<HOST>:\d+\) to extension '[^']*' rejected because extension not found in context
            ^(?:Host )?<HOST> (?:failed (?:to authenticate\b|MD5 authentication\b)|tried to authenticate with nonexistent user\b)
            ^No registration for peer '[^']*' \(from <HOST>\)$
            ^hacking attempt detected '<HOST>'$
            ^SecurityEvent="(?:FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)"(?:(?:,(?!RemoteAddress=)\w+="[^"]*")*|.*?),RemoteAddress="IPV[46]/[^/"]+/<HOST>/\d+"(?:,(?!RemoteAddress=)\w+="[^"]*")*$
            ^"Rejecting unknown SIP connection from <HOST>(?::\d+)?"$
            ^Request (?:'[^']*' )?from '(?:[^']*|.*?)' failed for '<HOST>(?::\d+)?'\s\(callid: [^\)]*\) - (?:No matching endpoint found|Not match Endpoint(?: Contact)? ACL|(?:Failed|Error) to authenticate)\s*$

ignoreregex =
datepattern = {^LN-BEG}
journalmatch = _SYSTEMD_UNIT=asterisk.service

[lt_journal]

# asterisk can log timestamp if logs into systemd-journal (optional part matching this timestamp, gh-2383):
__extra_timestamp = (?:\[[^\]]+\]\s+)?
__prefix_line = %(known/__prefix_line)s%(__extra_timestamp)s

#######################################################################################################



********************************************************
mcedit /etc/fail2ban/jail.local

[asterisk]

enabled  = true
filter   = asterisk
action   = iptables-multiport[name=asterisk-tcp, port="5060,5061", protocol=tcp]
           iptables-multiport[name=asterisk-udp, port="5060,5061", protocol=udp]
           sendmail-whois[name=Asterisk, dest=root@localhost, sender=fail2ban@localhost]
logpath  = /var/log/asterisk/messages.log
maxretry = 3
bantime = 600100
*****************************************************




fail2ban-client unban 37.139.38.15


iptables -D f2b-asterisk-tcp 1
iptables -D f2b-asterisk-udp 1