Suggestion for provisioning

[DigitalDaz]

I noticed you have been doing some provisioning work recently, eg the RPS integration and it made me recall an idea I have had for some time that I think enhances security further.

I know that the would be hackers are constantly trying to obtain thos config files.

In a job I had a few years ago we used a third party company for provisioning. One day, I factory reset a phone and it did not come back up. I contacted said third party company and they explained that after 14 days thry removed any credentials from the config files that were sent.

What a brilliant idea, now, even if the hacker gets hold of any config files they will be useless to them for a sip hack using credentials.

I've wanted to implement something like this in fusionpbx for years but never gotten around to it.

Something along the lines of, after a device has been added, send the credentials with the first provision then set some sort of flag that indicates credentials were sent and then omit them from further provisioning. This allows you to make any other changes whilst not sending the credentials.

If there has been a password change or they are going to do a factory reset then go into the device and click a box labelled something like 'Send credntials on next provision', that could be the default fro a newly created device, that way after a factory reset, they get the credntials again.

Anyway, just an idea

 

[Adrian Fretwell]

That sounds like an enhancement we should add to DjangoPBX.

 

[pbxgeek]

@DigitalDaz You are absolutely right that provisioning can become a weak point if it isn't properly secured.

One important distinction with the RPS/ZTP work we've been doing is that FS PBX does not send the actual configuration file or SIP credentials to Yealink RPS or Poly ZTP. Those services are used strictly as redirect services.

After a factory reset, the phone contacts the manufacturer's provisioning service, which tells it where its provisioning server is located. The phone then connects directly to FS PBX, and FS PBX determines whether the provisioning request should be accepted.

There are several controls around that process:

1. Provisioning can be protected with username/password authentication using HTTP Digest authentication.
2. Provisioning access can optionally be restricted by CIDR, so configurations are only served to approved source networks.
3. FS PBX validates the device/vendor being requested.
4. The MAC address must correspond to a device that actually exists in the system before a configuration is generated.

I also strongly recommend using separate provisioning credentials per tenant rather than sharing one set of credentials system-wide. That limits the blast radius considerably if a customer's provisioning credentials are ever compromised.

That said, I like the idea you're proposing as an additional layer of protection: after the phone has successfully received its SIP credentials, FS PBX could stop including those credentials in subsequent provisioning requests.

There could then be an option on the device such as "Send credentials on next provision", which would automatically be enabled for a newly created device and could be manually enabled again before a factory reset or credential change.

That would allow normal configuration changes to continue being pushed to the phone without repeatedly exposing the SIP username/password in every generated configuration.

Another related hardening option would be automatically removing the device from Yealink RPS / Poly ZTP after successful provisioning. FS PBX can already remove those records manually and in bulk. The tradeoff with automating that is that if someone factory-resets a phone unexpectedly, the phone would no longer know where to provision from until the redirect record is added again.

Fortunately, adding it back in FS PBX is only a click away.

I think both ideas are worth considering. I'll let the community weigh in on whether credential suppression after initial provisioning and/or automatic RPS/ZTP removal should become configurable options in FS PBX.