Apache Provisioning Port Setup

Manually Configuring Apache to host phone configurations for auto provisioning


Note: If your FreePBX based system is Registered AND Licensed for System Admin Pro from Sangoma you can set this up via the Web Admin GUI.
Please see their documentation at System Admin - Port Management

For manual configuration see Below

HTTPS (SSL) Provisioning

Create Phone HTTPS (SSL) Provisioning Config

  1. SSH into your PBX using an ssh client like PuTTy and make sure you have root/sudo access.
  2. Create config file
    nano /etc/httpd/conf.d/clearlyip-ssl.conf
  3. Paste the config below or download the attached clearlyip-ssl.conf config and upload to the /etc/httpd/conf.d/ directory on your PBX
    1. Verify the port assignments on line 21 & 22
      Note: Be sure these ports don't conflict with any in Admin --> System Admin --> Port Management
    2. Verify Certs defined on lines 25-27
    3. Verify the AuthUserFile assigned on line 54
  4. Ext nano via Ctrl+X, press Y & Enter to save the config.
  5. Restart Apache to apply the config. 
    systemctl restart httpd.service

Configure Clearly Devices Template for HTTPS (SSL) Provisioning

  1. Log into your PBX's Admin Web GUI
  2. Go into Clearly Devices and in each of your templates:
    1. Verify the HTTP Username & Password are set to what was configured in Manual Apache Auth Setup
    2. Verify the Provision Protocol is set to HTTPS
    3. Verify the Provision Port is set to what was set in step 3.a
    4. Verify the Provision Server is set to the IP Address or FQDN of the PBX where this Apache instance is configured.

Apache Config for HTTPS (SSL) Provisioning Config


  Config Download: clearlyip-ssl.conf 
  1. # If ssh_module isn't already loaded load it.
  2. # This Avoids conflict with System Admin Configs.
  3. <IfModule !ssl_module.so>
  4.   LoadModule ssl_module modules/mod_ssl.so
  5.   SetEnv SSLSETUP true
  6.   SSLPassPhraseDialog builtin
  7.   SSLSessionCache shmcb:/var/cache/mod_ssl/scache(512000)
  8.   SSLSessionCacheTimeout 300
  9.   SSLRandomSeed startup file:/dev/urandom  256
  10.   SSLRandomSeed connect builtin
  11.   SSLCryptoDevice builtin

  13.   # https://mozilla.github.io/server-side-tls/ssl-config-generator/
  14.   SSLProtocol all -SSLv2 -SSLv3
  15.   SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
  16.   SSLHonorCipherOrder on
  17. </IfModule>


  20. # Define Provisioning Port
  21. Listen 5443
  22. <VirtualHost _default_:5443>
  23.   SSLEngine on
  24.   # Make sure these point to your cert files
  25.   SSLCertificateFile /etc/httpd/pki/webserver.crt
  26.   SSLCertificateKeyFile /etc/httpd/pki/webserver.key
  27.   SSLCertificateChainFile /etc/httpd/pki/ca-bundle.crt

  29.   <Directory "/tftpboot/">
  30.     # Apache 2.4
  31.     <IfModule mod_authz_core.c>
  32.       <FilesMatch "(^\.|.php$)">
  33.         Require all denied
  34.       </FilesMatch>
  35.       Require all granted
  36.     </IfModule>
  37.     # Apache 2.2
  38.     <IfModule !mod_authz_core.c>
  39.       <FilesMatch "(^\.|.php$)">
  40.         Deny from all
  41.       </FilesMatch>
  42.       Allow from all
  43.     </IfModule>
  44.   </Directory>


  47.   DocumentRoot /tftpboot/
  48.   SetEnvIf User-Agent '.*MSIE.*' nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0

  50.   <Directory /tftpboot/>
  51.     AuthType Basic
  52.     AuthName Restricted
  53.     # Make sure this matches what you set when creating the user
  54.     AuthUserFile /etc/httpd/phoneuser.auth
  55.     Require valid-user
  56.   </Directory>

  58. </VirtualHost>

HTTP (Non-SSL) Provisioning

Note: If you are only setting up Non-SSL provisioning you don't need to Follow the Above SSL config or the Cert Setup in Apache SSL Certificate Setup Wiki.

Create Phone HTTPS (SSL) Provisioning Config

  1. SSH into your PBX using an ssh client like PuTTy and make sure you have root/sudo access.
  2. Create config file
    nano /etc/httpd/conf.d/clearlyip.conf
  3. Paste the config below or download the attached clearlyip.conf config and upload to the /etc/httpd/conf.d/ directory on your PBX
    1. Verify the port assignments on line 1 & 2
      Note: Be sure these ports don't conflict with any in Admin --> System Admin --> Port Management
    2. Verify the AuthUserFile assigned on line 12
      Note: Make sure you have configured Authentication according to Apache Authentication Setup Wiki.  Having unauthenticated provisioning could pose a security risk.
  4. Ext nano via Ctrl+X, press Y & Enter to save the config.
  5. Restart Apache to apply the config. 
    systemctl restart httpd.service

Configure Clearly Devices Template for HTTPS (SSL) Provisioning

  1. Log into your PBX's Admin Web GUI
  2. Go into Clearly Devices and in each of your templates:
    1. Verify the HTTP Username & Password are set to what was configured in Apache Authentication Setup
    2. Verify the Provision Protocol is set to HTTP
    3. Verify the Provision Port is set to what was set in step 3.a above
    4. Verify the Provision Server is set to the IP Address or FQDN of the PBX where this Apache instance is configured.

Apache Config for HTTP (Non-SSL) Provisioning Config

Config Download: clearlyip.conf
  1. Listen 8888
  2. <VirtualHost *:8888>
  3.   Alias /.well-known /var/www/html/.well-known
  4.   Alias /.freepbx-known /var/www/html/.freepbx-known
  5.   RewriteEngine on
  6.   RewriteRule ^/\.(well-known|freepbx-known)/ - [H=text/plain,L]
  7.   RewriteRule (^\.|/\.) - [F]
  8.   DocumentRoot /tftpboot/
  9.   <Directory /tftpboot/>
  10.     AuthType Basic
  11.     AuthName Restricted
  12.     AuthUserFile /etc/httpd/phoneuser.auth
  13.     Require valid-user
  14.   </Directory>
  15. </VirtualHost>



    		 RSS of this page