Security Recomendation

thats why i dont do http provisioning =)

btw in unix if you remove the x bit from the directory attributes (644 instead of 755) you can't get a listing of files, but you can read a file if you know its name. Which puts it in the same realm as TFTP.

if your using polycoms, FTP is your best provisioning method (just make sure to nologin the shell for the ftp user)

TFTP is another option. There is no authentication... but you'd have to know the filename which would mean having to know the mac address.

Our solution to this problem has been to provision the phones in the office first before sending them out to remote people. Direct provisioning is only available inside the office. The Polycoms, at least, will retain their configuration across reboots if they can't get to the provisioning server. Since our configuration doesn't change that often, this hasn't been a big issue. In the few cases where it has been, it's usually not that hard to walk someone through making a change through the Polycom's web interface, or in a couple cases (firmware upgrades) where we had technical users, walked them through setting up a tftpserver on their laptop, gave them a tarball to download with the contents of the /tftpboot directory (customized for just their phone), and had them connect the phone to their laptop with an ethernet cable.

Our user portal also requires using the VPN for remote folks, since that, too, is only available inside the office.

Well, I agree that Autenticated provisioning is safer, i will look forward to implement that. But, using HTTP, you have very good logs, and you can use HTTPS to encrypt the data. In FTP is not encrypted.

I know that using VPN or restricting the autorpovisioning is a good idea, but if you want to provide multitenant services and you have more than 500 extensions, located around the city, will be much easier to have the autoprovisioning for all your users. Not all are familiar with VPN and all want to ohave the configuration working fine, so if you need to change something, is better doing it remotly than to get there.

Thanks for the recomendations.

agreed, I don't see VPN as practical in a MTE situation as the goal on MTE is one of keeping the load as minimalistic as possible. Encryption seems counter-intuitive to that goal. With regard to security, there is something else of concern. There are now SIP discovery and brute force tools used to guess passwords of extensions. this site has tools that discover all the extensions on your sip channel driver and then uses a dictionary attack to guess the passwords.

Some customers thought it was a good idea to make the sip secret the same value as the extension number. They got compromised quickly and were used to mass market credit card scams to residents all over the US. Make sure your passwords are completely random. Noone has to remember them, the phones just download the value and connect. PBX manager does a good job in its randomizing mode of password generation.

When I think of HTTP config, I think of Grandstream. When I think of Grandstream, I think of a phone rebooting when anyone calls it after a firmware upgrade, and me being somewhere else not being able to give it a factory reset to wipe it's corrupted config file.

We use FTP for our Polycom phones. Each Tenant have unique login/password which also allows advanced customers to hack their provisiong files them selves (or they pay us to do it :). I would like to use FTPS, but the Polycom bootloader doesn't support TLS.

We use HTTP for PAP2T. The provisioning file is encrypted and the files are served by apache. So no security issue here.

/Ole

Hi, can you help us in how to set up the Polycomswith FTP and the Linksys with the encription?

Any help, doc will be very apreciated.

polycom runs FTP right out of the box. You just need to create your ftp account for the provisioning directory. Nothing special is needed on the polycom to tell it to use FTP as its protocol.