Access from anywhere: securing FOP2

sub0

We have a customer that needs access to FOP2 from any public IP. They have been using Fonality's HUD and would like a similar experience..

Apart from strong passwords, what are the best practices for securing FOP2?

nicolas

you can use https and strong passwords. You can limit access to /fop2/admin via .htaccess or similar as you might probably do not want access to the manager from everywhere.

Best regards,

AlexRS

Try to use fail2ban if FOP2 write bad auth in log.

sub0

AFAIK FOP2 does not write bad auth anywhere. Does it?

Also AFAIK, fop2 auth occurs over port 4445 so https would not encrypt those passwords.

Thanks for great support as always.

nicolas

FOP2 does write an audit log if you enable it via the -a command line parameter, including Bad authentication attempts. Try adding -a /var/log/fop2_audit.log to the startup parameters in the /etc/sysconfig/fop2 file if you want.

As for passwords on the wire, they are hashed/encrypted, they are not transferred plain text.

Best regards,

JSANCHEZ1008

Hi Nicolas. FOP2 writes bad authentication attempts logs only for regular user https://mypbx.com/fop2 but not for admin user https://mypbx.com/fop2/admin

Thanks in advance.