One of the first things that everyone will have to do when switching from legacy voice services such as POTS or PRI is to calculate the expected costs of a new service.

Very often people hear me recommend pay as you go solutions and they immediately freak out saying it will be too expensive. Even though they have no idea what the costs involved look like.

Pay as you go services like VoIP.ms, VoicePulse, and others are very cost effective means of handling your calling as long as you correctly calculate all the costs of the legacy system and the new proposal.

First you need to realize that many legacy services hide most of your calling detail from you making this a very hard thing to truly understand. POTS lines have no detailed billing for local calling. Some carriers will not even tell you what your usage was unless you go over your long distance plan. So you only see call information for everything after that 5,000 minute package line item. There is no such thing as unlimited. Anyone selling that has fine print and they pay interconnect charges on all minutes used, so you can be certain that your monthly rate is high enough for that POTS line to cover expected usage.

This can seem like a very daunting task, but it is not as hard as it sounds. Like anything involving cost, math and reality are your friends. First off there are only so many working minutes in a month for a business. Then you can just take those numbers, factor in a percentage of hours per day on the phone, and add some wiggle room.

2017	Days /Month	Hours / Day	Minutes / Month
January	22	8	10,560
February	20	8	9,600
March	23	8	11,040
April	20	8	9,600
May	23	8	11,040
June	22	8	10,560
July	21	8	10,080
August	23	8	11,040
September	23	8	11,040
October	22	8	10,560
November	22	8	10,560
December	23	8	11,040
Average Minutes per Month			10,400

The math here in case anyone does not get it is Days per Month * Hours per Day * Minutes per Hour.

So this means one person on the phone for 100% of their work shift for the full month will cost $104 in a general $0.01 per minute pay as you go SIP trunk.

Thus, it is quite easy to extrapolate some basic numbers now that we know this. I usually plug all this into a spreadsheet and play with numbers in front of the client.

An SMB looking at SIP trunking has 15 POTS lines from the ILEC that cost $40/month after taxes (being generous here), so 15 * $40 = $600. If we assume all 15 lines were used 100% of the time, SIP would look all kinds of expensive. Using the average from the table above 10,400 * 15 * $0.01 = $1,560. Holy crap! More than $1,500 a month for something that only costs them $600 right now. So where is the savings? Well that comes in because no business uses all of their legacy POTS lines 100% of the time, ever. Because with POTS once all the lines are used, it is impossible to make or receive any more calls. So in the legacy POTS world, we over buy what we actually need on average in order to handle the high volume times.

If you can actually get a true CDR (call detail record) from your existing PBX or provider, then you can make real numbers here, but most likely you will be estimating. Assuming you need to estimate, the process will depend on the call flow. Simply do the best you can to poke the stakeholders for as much detail as you can get to narrow the margin of error for the estimation.

A small general office with 35 people or so will hover around 4-5 simultaneous calls (total inbound and outbound) on average for most of the workday. First hour, lunch hour, and last hour are lower usage.

Based on this you can calculate a better estimate, 10,400 * 5 * $0.01 = $520, we are cheaper than POTS already and long distance charges have not even been calculated for the old service yet. General long distance rates are $0.02 to $0.03 per minute. The 5,000 or 10,000 minute bundles are calculated along those rates for every client I have ever converted. Ever single minute of intestate, intrastate, interlata, and intralata calling simply adds to the cost and improves the RoI of a pay as you go SIP trunk.

Now every office is different. Some places are on the phone more than others, but they are also paying more per month most of the time. I have seen the SIP trunk savings fall in this type of range time after time.

Part of the FreePBX 13 Setup Guide

Credit: Work hours chart

I promised everyone a detailed setup guide back at MangoCon '16. Well, I finally have it ready for you all.

FreePBX 13 Setup Guide

Pre-Installation

• Initial Discovery
  • Estimating SIP trunk costs
• Host Choice
  • How to decide where you want your PBX
    • Instructions for Vultr
• Service Provider Choice
  • How to decide what kind of phone service to get
    • Instructions for VoIP.ms SIP trunk setup

Installation

• Install from the ISO
• Initial GUI setup
• Configure the Firewall
• System Admin setup
• Create your first exentsions
• Trunk setup
• Conference setup
• Ring group setup
• Creating system recordings
• IVR setup
• Using time groups and time conditions
• Caller ID setup
• Inbound call routing
• Outbound call routing

Setting up Desk Phones and Soft Phones

• Coming Soon™

Updating and Upgrading your FreePBX 13 System

• Updating the FreePBX Operating System
• Upgrading the FreePBX Firmware
• Upgrading the FreePBX System Modules

No sane person manually updates all of their stuff all of the time.

In the Fedora realm, I use dnf-automatic.
http://dnf.readthedocs.io/en/latest/automatic.html
The below instructions are for Fedora 26 and newer as the exact name of the timer changed from what it previously was.

Update: 2018/12/04

As of Fedora 28 (possibly 27), the original timer and service name was implemented.

dnf install -y dnf-automatic

Now you need to edit the /etc/dnf/automatic.conf file to do what you want.
Generally I change the following fields from their default values to this.

apply_updates = yes
emit_via = email
email_from = [email protected]
email_to = [email protected]
email_host = your.smtp.server

Optionally, edit the timer frequency. I leave it at the default of 1 day.

nano /usr/lib/systemd/system/dnf-automatic.timer

Sart and Enable the timer.

systemctl enable --now dnf-automatic.timer

You can list the time to see the status

systemctl list-timers --all

It will look like this

NEXT                         LEFT       LAST                         PASSED       UNIT                         ACTIVATES
Tue 2017-11-21 22:42:15 CST  52min left Tue 2017-11-21 21:42:15 CST  7min ago     dnf-makecache.timer          dnf-makecache.servi
Wed 2017-11-22 20:47:10 CST  22h left   Tue 2017-11-21 20:47:10 CST  1h 2min ago  systemd-tmpfiles-clean.timer systemd-tmpfiles-cl
n/a                          n/a        Tue 2017-11-21 21:47:57 CST  1min 59s ago dnf-automatic.timer  dnf-automatic.service
n/a                          n/a        n/a                          n/a          sysstat-collect.timer        sysstat-collect.ser
n/a                          n/a        n/a                          n/a          sysstat-summary.timer        sysstat-summary.ser

5 timers listed.

I typically reboot at this point and then check the timer again to make sure it is running as expected.

systemctl list-timers
NEXT                         LEFT          LAST PASSED UNIT                         ACTIVATES
Tue 2017-11-21 22:00:00 CST  5min left     n/a  n/a    sysstat-collect.timer        sysstat-collect.service
Tue 2017-11-21 22:04:18 CST  9min left     n/a  n/a    dnf-makecache.timer          dnf-makecache.service
Tue 2017-11-21 22:09:18 CST  14min left    n/a  n/a    systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service
Tue 2017-11-21 22:54:18 CST  59min left    n/a  n/a    dnf-automatic.timer  dnf-automatic.service
Wed 2017-11-22 00:07:00 CST  2h 12min left n/a  n/a    sysstat-summary.timer        sysstat-summary.service

And damn is it a sexy looking GUI.

They have totally overhauled it to look more like UNMS.

So the topic came up in another thread and I thought it would be good to have a thread for those who want to talk about their trials and such.

I'll start off by saying that this is something for those who want it known. I want the additional pressure knowing that others are aware of my progress.

Most of my Adult life I was > 300 pounds. IN 2001 the Doctor said I was Type 2 Diabetic and needed drugs. I said screw that. I can be not a fat bastard.
I started eating better. A few years later I started exercising at work on my breaks. Just steps or walking the parking lot.

I went from 350 pounds (160kg) in 2001 to 176 pounds (80kg) in 2007 (on my wedding day). Many things changed in my life since 2007 and I gained some weight back (maxed at 109kg / 240 lbs).

I want to get back under 90kg / 200lbs. My goal for the next 15 days is to get under 100kg.

Me and a co-worker have been tracking it all year. Here is my progress.

That goal weight is just the US standard for 5' 10" medium build. My goal will be to stay under 90kg / 200lbs.

A lot of people want content filtering. DNS content filtering is the best bet for almost everyone.

If you run a Pi-Hole DNS filter for blocking adds and malicious site already, you can add porn quite easily.

Add this url to the lists.
https://raw.githubusercontent.com/chadmayfield/pihole-blocklists/master/lists/pi_blocklist_porn_top1m.list

Then Click Save and Update.

@travisdh1 said in Would You Hire Someone in IT Who Does Not Have a Home Lab:

@scottalanmiller said in Would You Hire Someone in IT Who Does Not Have a Home Lab:

@Dashrender said in Would You Hire Someone in IT Who Does Not Have a Home Lab:

I think one of Scott's points is that you don't need a decked out box to make a lab happen.

I had an old 486 running Novell Netware what seems like 100 years ago, and a Pentium running Windows NT 4.0 This was when P II's were the rage, or was it PIIIs?

10+ year old hardware used to be completely usable for most lab setups. now with Virtualization, you need something a bit newer, x64 and supports virtualization, but that started becoming very common 8 or so years ago, so there's that. But real servers aren't needed either. A desktop can run VMWare ESXi or XenServer or Hyper-V just fine (assuming the virtualization hardware is there). Other factors will limit the number of VMs you can run, but hey, this is a lab.

Then today we can get $5/month VMs online - so there are options.

@Dashrender said in Would You Hire Someone in IT Who Does Not Have a Home Lab:

Then today we can get $5/month VMs online - so there are options.

And that's the price to keep it online and running 24x7. You can make scripts and build them when you need them and tear them down when you don't to learn more, cheaper than even the $5 mark!

Yeah, I don't have a HOME lab, but I've been building things in ramnode, Digital Ocean, and Vultr in not quite wild abandon. My current Vultr instance I'm playing with is all the way up to $0.56 for this billing period. That's less than I'd pay for the electric to run something at home.

If you are doing it outside of work hours, then it is a "home" lab IMO.

Just esigned the loan documents. now to go to the bank and get the cashier's check for our cash to close.

Closing tomorrow on our house.

I have had to do this a couple times and always need to look up the command.

So I thought I would drop it here so I can search here first in the future.

DISM /online /Set-Edition:ServerStandard /AcceptEula /ProductKey:XXXXX-XXXXX-XXXXX-XXXXX-XXXXX

Technet Article for doing this on Server 2012: https://technet.microsoft.com/en-us/library/jj574204.aspx

Way back in 2015, I posted a guide for setting up Nginx reverse proxy on CentOS 7.

Well here is the process for Fedora 27 using Certbot to create the certs.

As always I start a guide with a Fedora 27 Minimal install. You are free to start from whatever source you wish, some packages may already be installed on your system if you start form a different template. That is absolutely fine.

Make sure Fedora is up to date

dnf upgrade -y --refresh

Install packages needed

The package policycoreutils-python-utils is required to use semanage if you need to add a non-standard port to SELinux.

dnf install -y certbot-nginx nginx policycoreutils-python-utils

Install nano because I prefer it over vi

Skip this if you want

dnf install -y nano

Open the firewall for inbound traffic on ports 80 and 443.

firewall-cmd --add-port=http/tcp --permanent
firewall-cmd --add-port=https/tcp --permanent
firewall-cmd --reload

Tell SELinux to allow Nginx to connect out to your backend servers

setsebool -P httpd_can_network_connect 1

Verifiy what ports you will be using

Make a list of ports that your proxy will need to reach out on to hit the other servers behind it. These ports will need allowed through SELinux.
Most of the time you never need to do anything here as you are sending traffic back to another webserver on standard ports.
This is the default list of allowed http/tcp ports.
http_port_t tcp 80, 81, 443, 488, 8008, 8009, 8443, 9000

You can see what is current allowed like this
semanage port -l | egrep '(^http_port_t)'

For example I have a nodeBB forum on 4567. This port already has a label, so you need to modify it.
semanage port -m -t http_port_t -p tcp 4567
I also have servers running on ports 8040 and 8090. These have no label so add them..
semanage port -a -t http_port_t -p tcp 8040
semanage port -a -t http_port_t -p tcp 8090

Start nginx and set it to start on boot also

systemctl start nginx
systemctl enable nginx

That is all it takes to get Nginx running, now you need to tell it what to do.

Create a configuration file to route the inbound traffic.

This bit is based on a few assumptions.

1. You are going to use certbot --nginx to obtain your certs
2. You already have the FQDN setup for your domain.
   1. I am using nc.domain.com as an example.
3. You already have the backend Nextcloud server setup and listening on port 80.
   1. I am using 10.150.0.17 as an example backend IP.

Before you can request your SSL certificate, you have to have a valid configuration file in place listening on port 80.
Nginx stores the configuration files in /etc/nginx/conf.d/, so let's make our nextcloud.conf.
I am not going to go aver all the pieces here. If you want ot know more about what all these settings mean, go look them up.
Finally, this is a sample base don Nextcloud. Change it to fit your application needs.
The structure may look strange at first, but there is a method to my madness. It is based on how certbot --nginx works.

cat > /etc/nginx/conf.d/nextcloud.conf <<EOF
server {
    client_max_body_size 40M;
    server_name nc.domain.com;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_set_header X-NginX-Proxy true;
    proxy_redirect off;
    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        proxy_set_header X-NginX-Proxy true;
        proxy_pass http://10.150.0.17;
        proxy_redirect off;
        # Socket.IO Support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
##    ssl_stapling on;
##    ssl_stapling_verify on;
##    ssl_session_cache shared:SSL:10m;
##    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";
    listen 80;
}
##server {
##    client_max_body_size 40M;
#    listen 80;
##    server_name nc.domain.com;
##    return 301 https://$host$request_uri;
##}
EOF

NOTE: This is on purpose only one # while the others have two, # listen 80;.

Test the config

nginx -t

Reload Nginx

nginx -s reload

At this point your application will be publicly accessible via normal HTTP. So let's go get that certificate to encrypt it.

Run certbot

certbot --nginx -n --email [email protected] --agree-tos --domains nc.domain.com

Assuming you did not get an error, your nextcloud.conf has been modified by certbot.

Verify your configuration changed

cat /etc/nginx/conf.d/nextcloud.conf

You will see these new lines after there listen 80; that was at the bottom of the server block.

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/nc.domain.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/nc.domain.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

Uncomment SSL options and HTTP rewrite

Some of you might get why I had all the commented out stuff in there. Made it easy to uncomment now.
First, comment out the listen 80; in the first block we do not want it there.

sed -i "s/    listen 80;/#    listen 80;/" /etc/nginx/conf.d/nextcloud.conf

Now remove the other commented out bits

sed -i "s/##//" /etc/nginx/conf.d/nextcloud.conf

Test the Nginx config and reload

Same as before.

nginx -t

If nothing is in error, reload

nginx -s reload

You now have a fully SSL protected website, with HTTP traffic rerouted to HTTPS.

Don't forget to automate the cert renew

Create a cron job to run the renew everyday. Certbot will not actually do anything if it does not see any certs needing renew within 30 days. So you can run this as often as you want. Cerbot themselves recommends running it twice a day with this.
Use crontab -e to edit your crontab.

0 0,12 * * * python -c 'import random; import time; time.sleep(random.random() * 3600)' && certbot renew 

@scottalanmiller said in Business number texting services:

@jaredbusch said in Business number texting services:

@scottalanmiller said in Business number texting services:

@krzykat said in Business number texting services:

@scottalanmiller
Any update on this? I'm interested.

I've been so busy traveling, it's mind numbing. I'll be stationary by Tuesday. Hit me up, we've got a product. Just zero time to show it to anyone, lol.

Been waiting

I know, I know. This trip is killing me. Watcha doing right now? ;)

When you posted that? Just cleaning up from yard work and powerwashing the house.

Now, just finished dinner and doing server updates across clients.

This is a very interesting article. Science people...

https://www.wired.com/story/the-teeny-tiny-scientific-screwup-that-helped-covid-kill/

@dustinb3403 said in Miscellaneous Tech News:

Security Researcher discovers plan text passwords used for Microsoft rdp

Clickbait headline. The url is much less alarmist.

@scottalanmiller said in Business number texting services:

@krzykat said in Business number texting services:

@scottalanmiller
Any update on this? I'm interested.

I've been so busy traveling, it's mind numbing. I'll be stationary by Tuesday. Hit me up, we've got a product. Just zero time to show it to anyone, lol.

Been waiting

@dashrender said in Wyze Lock:

@dafyre said in Wyze Lock:

I'd buy one of those just because I like the commercial, ROFL.

yeah, it was fun, that's why I posted it.

That was fucking hilarious....

@gjacobse said in Build or Buy?:

The topic of crypto has come up with my wife and I. A co-worker of her’s and another person have been investing in crypto,.. some how one of them made $14k pretty quickly.

I think you need to define investing.

Buying something hoping it will give a quick payout is gambling.

Buying something that you hope over time will appreciate in value is investing.

Gambling always pays off for someone. Never for everyone.

@dashrender said in What Are You Doing Right Now:

WTF? I have to prove I'm human to visit a website now?

Call Phil instead?

@jasgot said in Business number texting services:

Postcards won't work? We have customers using it an love it.

@jaredbusch said in Business number texting services:

No. It is too restrictive.

@pete-s said in Business number texting services:

For instance here is the setup for Textable to Skyetel API:
https://www.textable.co/docs/skyetel-setup-guide/

This seems to be fairly flexible. 10 users is more than needed. Most of the features are more than needed. Number sharing is the big one that is needed.

@pete-s said in Business number texting services:

OK, but that is only a matter of who is the SMS gateway provider. If you for instance use Skyetel for the SIP trunk then you need to use Skyetel for the SMS gateway (since you want the same number).

And then you need software that interacts with the SMS gateway API so the users can handle the SMS.

I know how it works.