trixbox CE v2.6 security settings

EDIT 2/11/09 – For the latest and most complete set of instructions on setting security for trixbox CE v2.6, please see chapter 5 of my trixbox CE v2.6.2 Complete Setup Guide for Small Business located at http://sureteq.com/asterisk/trixboxv2.6.2.htm.

Back to the post…

——————————–
So, when you log into trixbox CE v2.6 and go to ‘PBX Settings,’ you are told that your default admin and mysql passwords should be changed…here’s how to do it. A cleaner, HTML version of these instructions can be found at http://sureteq.com/asterisk/trixbox_CE_v2.6_security.htm.

Change default passwords:

Let’s change our passwords. We need to do this at the Linux CLI.

Update maint password by typing ‘passwd-maint’ at the command line. Enter the password twice.

Update Web meetme password by typing ‘passwd-meetme’ at the command line. Enter the password twice.

FreePBX admin pass:

To change the FreePBX manager pass, you need to edit two separate files and put in the new password.

nano /etc/asterisk/manager.conf

Find ’secret = amp11′ under the [admin] section. Change ‘amp11′ to your new desired password. CTRL+X followed by ‘Y’ to save and exit.

Now, we need to edit the /etc/amportal.conf to use our new password.

nano /etc/amportal.conf

Find the line that says ‘AMPMGRPASS=amp11′ and change the ‘amp11′ to the new password you just set. CTRL+X followed by ‘Y’ to save and exit.

amportal restart

*** NOTE: I have found out the hard way that FreePBX does not like having an exclamation point (!) in the admin password. There may be other special characters that it doesn’t like also.

MySQL passwords:

Update the MySQL asteriskuser password by doing the following at the Linux CLI:

mysqladmin -u asteriskuser -p password new_password_here

Replacing ‘new_password_here’ with your desired password. When you hit ‘Enter’ you’ll be prompted for a password…enter in the default password of ‘amp109.’

Now, we need to edit the /etc/amportal.conf to use our new password.

nano /etc/amportal.conf

Find the line that says ‘AMPDBPASS=amp109′ and change the ‘amp109′ to the new password you just set. CTRL+X followed by ‘Y’ to save and exit.

***NOTE: In the amportal.conf, there are TWO places to change the amp109 password…near the top of the file, and at the very end. The one at the top is commented out, so changing that one doesn’t really do anything…but to be consistent, make sure you change the password in both places.

You will also need to update the password in the /etc/asterisk/cdr_mysql.conf file for call detail records (cdr).

nano /etc/asterisk/cdr_mysql.conf

Find the line that says ‘password=amp109′ and change the ‘amp109′ to the new password you just set. CTRL+X followed by ‘Y’ to save and exit.

service mysqld restart
amportal restart

*** NOTE: I have found out the hard way that FreePBX/MySQL does not like having an exclamation point (!) in the password. There may be other special characters that it doesn’t like also.
It is also a good idea to change the default mysql root user password. To change the default mysql root password, do the following:
mysqladmin -u root -p password new_password_here

Replacing ‘new_password_here’ with your desired password. When you hit ‘Enter’ you’ll be prompted for a password…enter in the default mysql root user password of ‘passw0rd’ (with a zero)

You will also need to update the password in the /etc/asterisk/cbmysql.conf file for meetme settings.

nano /etc/asterisk/cbmysql.conf

Find the line that says ‘password=passw0rd’ and change the ‘passw0rd’ to the new password you just set. CTRL+X followed by ‘Y’ to save and exit.

service mysqld restart
amportal restart

[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]
01
T313C0mun1s7
July 4th, 2008 1:17 pm

Now that we have reached 2.6.1 and they have changed the MTA to Postfix you might wish to add the password change in the file /var/www/html/include/ccsframework/Common.php as well.

02
ric9887
July 29th, 2008 3:36 am

Also, for Meetme to not fail with a db connect failure change :-

/var/www/html/web-meetme/lib/database.php

03
October 10th, 2008 3:46 pm

Change the asteriskuser mysql password wasn’t working for me with a clean install of 2.6.1, however, after speaking with Kerry G, I have the solution:

asteriskuser mysql password:

(from the Linux CLI):

mysql -u root -p
(enter mysql root password, default is passw0rd (with a zero))
mysql> use mysql;
mysql> update user set password=PASSWORD(”new_pass_here”) where User=’asteriskuser’;
mysql> flush privileges;
mysql> quit

Now change to the new password in these files:

/etc/amportal.conf (AMPDBPASS towards the bottom of the file)
/etc/asterisk/cdr_mysql.conf (password field)

Once done, run these commands from the Linux CLI:

service mysqld restart
amportal restart

That should do it. To change the mysql root password, the old way still seemed to work.

mysqladmin -u root -p password new_pass_here
(prompted for old mysql root password – default is ‘passw0rd’ – no quotes, with a zero)

Now change the password in this file:

/etc/asterisk/cbmysql.conf (password field)

Thanks Kerry for the info!

05
gaoming
February 25th, 2009 1:18 am

Hi – I’m trying to change the db password on my installation of trixbox 2.6.1-i386, but am a bit confused over the cli input in comment #3 above.

In the line,
mysql> update user set password=PASSWORD(”new_pass_here”) where User=’asteriskuser’;
Is the part “where User=’asteriskuser’ meant to be parenthetical, or is there an ‘asteriskuser’ ID that we should enter. If there is an asteriskuser ID that we should enter, should that be “maint” or am I missing something.

Thanks,

Michael Cole

06
February 25th, 2009 11:25 am

Hey gaoming…leave ‘asteriskuser’ as is…that is the user used to connect to MySQL. Only change the part that says ‘new_pass_here.’

07
gaoming
March 1st, 2009 6:51 am

Hi Chris,

Thanks for the advice.

Actually, I ran into another issue with my installation and am doing a fresh install. In doing so, I am following your guide for installing Trixbox v 2.6.2 (although I am installing v2.6.1), and ran into a problem in changing the cdr report password. In your guide you recommended:

Next, change your asteriskuser password for mysql CDR’s (Call Detail Records):

nano /var/www/html/maint/modules/cdrreport/config/database.php

Find the line that says:

‘connection’ => ‘mysqli://asteriskuser:amp109@localhost/asteriskcdrdb’,

Change the ‘amp109′ (in red above) to the asteriskuser password you set. CTRL+X followed by ‘Y’ to save and exit.

However, when I tried this, there was no such file in that directory, and it created a new file. Is there a variation between 2.6.1 and 2.6.2 that is causing this?

Thanks!

08
March 1st, 2009 4:43 pm

It is possible that the procedure has changed from v2.6.1 to v2.6.2. trixbox CE has minor (and sometimes major) differences between each version.

Your best bet is to download and install the latest and greatest, or to simply ignore that step…if it doesn’t appear to be affecting anything, then you should be OK.

09
magicyes
June 1st, 2009 8:39 am

Hi Chris

thank you so much for making this info available, I am still puzzled as to why trixbox does have a comprehensive install tutorial.

then I am running into some problems following the instrucitons I got stuck at “Update the MySQL asteriskuser password”

I used the following command: ” mysqladmin -u asteriskuser -p password newpass” as shown above
and got the following error:
mysqladmin: Can’t turn off logging; error: ‘Access denied; you need the SUPER privilege for this operation’

I also tried to follow comment #3

by using
update user set password=PASSWORD(”new_pass_here”) where User=’asteriskuser’;

and got the following error:
ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘) where User=.asteriskuser.’ at line 1

I am using trixbox 2.6.1 on centos

thank you so much anyway for sharing and helping!

10
magicyes
June 1st, 2009 9:06 am

Chris

just wanted to let you know that after several attempts it seems I managed almost everything.

I am experiencing the same as comment #7

Next, change your asteriskuser password for mysql CDR’s (Call Detail Records):

nano /var/www/html/maint/modules/cdrreport/config/database.php

Find the line that says:

‘connection’ => ‘mysqli://asteriskuser:amp109@localhost/asteriskcdrdb’,

Change the ‘amp109′ (in red above) to the asteriskuser password you set. CTRL+X followed by ‘Y’ to save and exit.

However, when I tried this, there was no such file in that directory, and it created a new file.

and I ignored it as you suggested

I guess I should be fine now
thank you sooooo much once again
if you have a paypal account let me know I’ll buy you a drink :)

good luck with everything! :)

11
June 1st, 2009 1:58 pm

Magicyes,

I’m glad you enjoyed the documentation. Please check http://sureteq.com/asterisk for the latest version of the trixbox CE Complete Setup Guide for Small Business. All of the new password changes are in the security chapter.

Thanks,
-Chris

You must be logged in to post a comment.