Building Elastix 4 via RPM Repo
-
@Dashrender said:
@scottalanmiller said:
@Dashrender said:
How, that is a lot of power for your provider.
how is it not? People expect certain functionalities, not having them puts a provider at a big disadvantage. And having rapidly built systems is huge. And reliable performance. If you let people install from ISO you get a performance mess.
I understand not allowing own ISO, but allowing the hosted root reset, that seems crazy.
Physical access ALWAYS means the ability to reset. No exception. But this allows it to be easy, automated and available to the customer. It's a pretty important feature. Imagine a hosted system where you are barred from doing a password reset like you would on a local one. That would be almost impossible for anyone not in a pure DevOps world to manage.
-
@scottalanmiller said:
@Dashrender said:
@scottalanmiller said:
@Dashrender said:
How, that is a lot of power for your provider.
how is it not? People expect certain functionalities, not having them puts a provider at a big disadvantage. And having rapidly built systems is huge. And reliable performance. If you let people install from ISO you get a performance mess.
I understand not allowing own ISO, but allowing the hosted root reset, that seems crazy.
Physical access ALWAYS means the ability to reset. No exception. But this allows it to be easy, automated and available to the customer. It's a pretty important feature. Imagine a hosted system where you are barred from doing a password reset like you would on a local one. That would be almost impossible for anyone not in a pure DevOps world to manage.
Physical sure, where you not implying they could do it with some kernal mod? Maybe I misunderstood.
-
@Dashrender said:
Physical sure, where you not implying they could do it with some kernal mod? Maybe I misunderstood.
Kernel mod is pretty dramatic. It's just an app normally.
-
@Dashrender said:
Physical sure, where you not implying they could do it with some kernal mod? Maybe I misunderstood.
So the important thing is that you have given up no security, just enabled a feature that benefits you.
-
Hi There.
Not sure if this is entirely related but I've installed Elastix 4 onto a Centos 7 Digital Ocean droplet.
I've got to the point where I need to start the elastix-firstboot. but I can't find how to do it?
Any ideas?
If I need to create a new thread, let me know.
thanks -
@BigfootNetworks said:
Hi There.
Not sure if this is entirely related but I've installed Elastix 4 onto a Centos 7 Digital Ocean droplet.
I've got to the point where I need to start the elastix-firstboot. but I can't find how to do it?
Any ideas?
If I need to create a new thread, let me know.
thanksWe are using Digital Ocean, too. The script at the top specifically worked on DO and installs elastix-firstboot as it goes, there shouldn't be any manual intervention.
Did you get any errors? What version of the ISO are you working from?
-
So I just used your script to install on Centos 7 on Azure. I do get the prompt for MySQL and Freepbx passwords at the end. However after the reboot my sudoers file has been overwritten (WTF?) essentially locking me out as a root user. Now I can't open the httpd ports or even start httpd. Bummer. Anyone else experiencing this on other VM services. I use azure because I have a free account and its just for testing. Maybe if I start fresh and open the ports before the install -will that work? But still left with the problem of root access blown away!
-
@dom I don't see anything in that script that would make changes to the /etc/sudoers file. Could it be something wacky with Azure?
-
@travisdh1 said:
@dom I don't see anything in that script that would make changes to the /etc/sudoers file. Could it be something wacky with Azure?
It's not my script, it doesn't touch that. However, Elastix has a track record of modifying /etc/sudoers with their RPM packages. So if you rely on /etc/sudoers, you must keep it updated after any yum run. Just part of the nature of Elastix.
-
@dom said:
Maybe if I start fresh and open the ports before the install -will that work? But still left with the problem of root access blown away!
Yes, open ports and enable root access directly prior to installation. CentOS is root on by default, you'll need to run that way for Elastix or make custom accommodations for their RPMs.
-
BTW Im quite new to linux.
I tried another install a few days back and it was after installing this /root/rpmbuild/RPMS/noarch/elastix-firstboot-3.0.0-6.noarch.rpm
is when my sudoers files was overwritten - its not your script.So how do I do this? "So if you rely on /etc/sudoers, you must keep it updated after any yum run". LINUX noob...sorry guys
-
-
@dom said:
So how do I do this? "So if you rely on /etc/sudoers, you must keep it updated after any yum run". LINUX noob...sorry guys
If you are new to Linux, I would not use sudoers for this one specific workload. Generally, yes, sudoers is great. This will cause you no end of pain on Elastix, it's worth skipping.
If you want to be reasonably secure without sudoers you can do this...
- Set a password (long and complex) for the root user.
- Create non-root users for you to log in as.
- Always log in as your non-root user.
- Access root with this command:
- su - which will ask you for that root password before letting you access root
- You can also block root access via SSH and only allow your user(s) accounts to access over SSH
Ideal? No, not at all. Does it work? Yes, and it is more secure that tons of normal installs and more secure than CentOS / RHEL defaults.
-
Additionally, you can make your user accounts access via keys instead of passwords for another layer of protection.
-
So what if you want to fix the suders problem?
Try this...
- Fix sudoers and test it. Make sure that it does what you want.
- Copy the /etc/sudoers file to /etc/sudoers.custommaster
- Make a cron job that runs every fifteen minutes that does this...
- cp /etc/sudoers.custommaster /etc/sudoers
Not great, but it replaces suders four times and hour (more if you want) so if you lose access, you wait a few minutes and it puts it back.
Tools like Ansible and Chef would handle this too, but that is was more complex.
-
As a general point, Azure isn't ideal for Linux. It's expensive and unnecessarily complex and limited. It's not bad, but as a new Linux user it is certainly worth considering another platform.
I mostly use Rackspace and Digital Ocean for Linux VMs. Vultr is pretty good, too. AWS is good, but very hard to use.
-
@scottalanmiller said:
As a general point, Azure isn't ideal for Linux. It's expensive and unnecessarily complex and limited. It's not bad, but as a new Linux user it is certainly worth considering another platform.
I mostly use Rackspace and Digital Ocean for Linux VMs. Vultr is pretty good, too. AWS is good, but very hard to use.
He has free space and is using it for testing/lab. there is nothing wrong with Linux under Azure any more than there is under any other hosted provider.
-
@JaredBusch said:
He has free space and is using it for testing/lab. there is nothing wrong with Linux under Azure any more than there is under any other hosted provider.
Azure does not provide console access and expects that you address the traditional needs for it yourself. It requires more effort and expertise than is requires by DO, RS and Vultr which are prepared for the VPS type mode. If you are a large enterprise, these things are not so big of a deal on Azure. If you are an SMB, it often presents additional risk and complexity which results in more cost.
-
said:
Try this...
Awesome, thanks for the tips. Yes Azure is just our test lab I get $190/month credit so why not use it, right? Ill try the cron job and see if that works, will let you know.
-
@dom said:
said:
Try this...
Awesome, thanks for the tips. Yes Azure is just our test lab I get $190/month credit so why not use it, right? Ill try the cron job and see if that works, will let you know.
That makes sense then.
