Installation Manual for ViciBox v.9.0

Contact Information
http://www.vicibox.com/
http://www.vicidial.com/
+1 863-393-9330

Foreword

ViciBox v.9.0 is a departure from the previous installation methods that ViciBox has used. Since OpenSuSE has abandoned the live installer with OpenSuSE Leap v.42.1 the ‘OEM’ installer has been used instead. Unfortunately the OEM install method does not allow for a Live ISO to be used. Instead the OEM installer only installs to the first detected drive in the system. This means that advanced options such as MD software RAID, partition schemes, or other pre-install items are no longer available at the time of install.

For those requiring RAID support it is recommend to use a hardware RAID solution. One recommended RAID card is an LSI 9211. This card provides a hardware-based RAID1 or RAID10 solution that is robust and fully supported by the OS while also being relatively inexpensive and having  support for drives greater then 3TB. It is NOT recommended to use RAID0 on any server regardless of function.

ViciBox v.9.0 is built with the following software and features :
•	OpenSuSE Leap v.15.1
•	Kernel v.4.12.14
•	Asterisk v.13.27.0-vici
•	DAHDI v.2.11.1
•	LibPRI v.1.6.0
•	Amfletec VoiceSync v.1.3.8
•	OpenR2 v.1.3.3 for MFC/R2 supporting
•	ViciDial SVN revision 3133 – Version 2.14-718a   Build 190902-0839
•	Automated G729/G723 optimized codec installation
•	Integrated ViciBox Firewall with VoIPbl.org and White/Dynamic/Black IP ACL
•	CertBot set-up script to generate valid LetsEncrypt.org SSL certificates
•	WebRTC ViciPhone ready (requires a functioning SSL/HTTPS setup)
•	MUST USE VICIDIAL SVN 3133 OR NEWER FOR WEB SERVERS (more in notices)
Hardware Recommendations and Server Dimensioning

Minimum specification :
15 agents ViciBox Express without recording, 75 agents Web, 25 agents Telephony without recording
•	Four Core CPU 2.0+ Ghz
•	4+ GB RAM
•	160+ GB drive

Recommended specification :
15 agents ViciBox Express, 50 agents Database, 150 agents Web, 25 agents Telephony
•	Four core CPU 2.0+ Ghz
•	8+ GB RAM
•	250+ GB RAID1 drive configuration (SSD preferable)

Recommended Database specification :
Approximately 150 agents, or 300 agents with double the amount of RAM and CPU cores
•	Eight core CPU 2.0+ Ghz
•	16+ GB RAM (More RAM generally gives better DB performance)
•	500+ GB RAID1 drive configuration for the OS
•	250+ GB SSD RAID10 drive configuration mounted under /srv/mysql for MySQL

Please note that the figures presented above are a conservative guideline and the actual system capacity is heavily determined by the number of agents, number of leads, concurrent call count, dialing ratio if applicable, recording settings and lengths, enabled campaign options, and the general performance of the underlying hardware. It is for this reason that additional specifications were provided should any minor load issues arise. Particular attention should be paid to the size of the RAM and drive(s) installed in the system if calls are being recorded. The most frequent issue new installations experience is a crashed server due to the hard drive filling up with recordings or RAM filling up from recording calls with long call times.

A ViciBox ‘Express’ install is a single server that performs all roles involved in ViciDial. It is the simplest and fastest installation method but also has the least capacity. If the planned agent capacity in the future is not likely to exceed 15 to 20 agents then the ‘Express’ installation method is preferable as it’s so much simpler to get started with.

Clustering is where multiple individual servers perform specific roles within ViciDial. Those roles are Database, Web, Telephony, and Archive server. Clustering should generally be used for an install consisting of more then 15 to 20 agents. If you do not know or are unsure of whether you should perform a cluster install please consult with the free community-based ViciDial forums or use the paid-for ViciDial Group support. Please be prepared to explain your planned installation including number of agents, call type (Outbound/Blended/Inbound), expected outbound dialing ratio or concurrent inbound call volume, recording and archival requirements, and any other unique processes or requirements you may have. This will help others generate an accurate answer to your questions.

A cluster should always start with at least one dedicated Telephony server and at least a combination Database/Web server. If the total agent capacity will be less then 50 agents then the recommended (not minimum) server specification provided above should be adequate for the combination Database and Web server. Where possible it is recommended to start a cluster with three servers. One server for the Database, one server for the Telephony, and one server for the Web. By doing this from the start it makes expanding and upgrading the cluster easier later on.

Telephony servers DO NOT scale vertically with the server hardware. What this means is that an 8 core server with 16GB RAM, which is twice the CPU/RAM as the recommended hardware specification, will not result in doubling that servers agent capacity. Instead it’s highly likely that Asterisk, the underlying telephony engine, will become overloaded at the higher agent count. When asterisk gets overloaded it will start doing strange things if not just hanging or crashing.

Increasing the overall agent capacity of the Web and Telephony roles in a ViciDial cluster is done horizontally. This means that increasing overall capacity is accomplished by adding additional servers for the role that needs increased. For example, if additional Telephony capacity was needed, a second or third or fourth telephony server would be added to the cluster.

When more then one Web server is used in a cluster it is advised to set-up load balancing between them. This allows the agent load to be distributed across multiple back-end web servers. The methods to do this very but with Apache, the default web service in ViciBox, it can be accomplished using mod_proxy. The process of setting up an HTTP load balancer is beyond the scope of this document, but various walk-throughs exist online to accomplish this. Alternatively, the ViciDial Group can help assist in setting up a load balancer using Apache. Alternatively, you would need to point half of your agents browsers to one Web server and half to the second Web server to properly increase your agent web capacity.

Load balancing agents across multiple Telephony servers is already built into ViciDial using the ‘Phone Alias’ options. A soft phone that can support connecting to multiple servers is required for this to function properly. If ViciPhone, a ViciDial WebRTC browser based SIP client, is used then the multiple server configuration is built in. ViciPhone also simplifies the login procedure as the agent’s phone extension is stored with their User record and the phone configuration is loaded on the fly during login.

ViciBox installation notices

•	Unfortunately older Asterisk versions such as v.11, v.1.8, etc, fail to compile against the newer libraries used in OpenSuSE v.15.1 which is what ViciBox v.9.0 is based on. Therefore ViciBox v.9.0 can only be used with Asterisk 13.
•	ViciBox v.9.0 uses the newer PHP v.7 compared to PHP v.5 used in older versions of ViciBox. There are some known bugs related to PHP7 that prevents older code bases of ViciDial from working or displaying properly. A pre-existing cluster may need the SVN code base (not ViciBox itself or the server’s OS) upgraded in order to add new ViciBox v.9.0 based web servers to that cluster. It is highly recommend to run a ViciDial Code Base of SVN 3133 (Build 190902-0839 or Version 2.14-718a) or later wherever ViciBox v.9.0 is used as a web server.

Phase 1 – OS Installation

 1.	Download the current ViciBox ISO from http://download.vicidial.com/iso/vicibox/server/
 2.	Burn ISO to CD/DVD or USB thumb drive and boot from it.
 3.	At the boot screen, using the up or down arrow keys, select “Install_ViciBox_v9_0” and press ENTER to begin the installation process.
 4.	VERIFY THAT THE CORRECT DRIVE IS SHOWN FOR INSTALLATION; Everything after this step results in any data that previously exists on the target drive being lost
 5.	After verifying that the correct OS drive is shown, use the left or right arrow keys to highlight ‘Yes’ and press ENTER to start the installation; After a few minutes the server will reboot and bring you to a ‘vicibox9 login: ‘ prompt
 6.	Type ‘root’ at the login prompt and press the ENTER key.
 7.	At the ‘Password:’ prompt type in ‘vicidial’ and press the ENTER key

The very first time you log into the system after installing it a OS setup wizard will run. This will give you the option to change the language, keyboard layout, and local time zone. Afterwards you should end up at a red prompt that says vicibox9:~ #

Phase 1.5 – OS configuration items

Change ‘root’ password – HIGHLY RECOMMENDED
 1.	If not already, please login as the ‘root’ user to get to the root prompt. The default root password is ‘vicidial’ unless changed previously
 2.	Type ‘passwd’ and press the ENTER key
 3.	When prompted, type in the new root password you want to use keeping in mind that it is case sensitive; The password is not shown on the screen for security reasons
 4.	When prompted, type in the new root password a second time to verify it; If the password chosen is considered weak the system might complain that it is a ‘BAD PASSWORD’ but will still allow you to use it

Please use secure passwords where possible. A strong password is at least 12 characters long and a mix of upper case, lower case, numbers, and special characters like ! % @ _ -  ( ) etc. A randomly generated password string is the most secure but usually the most difficult to remember. Regardless of the password you choose please make sure you can remember the password. If the root password is lost then nothing can be done on the local system. It is not trivial to recover a lost root password and requires someone to physically be at the server during the recovery.

Changing Timezone – HIGHLY RECOMMENDED
 1.	If not already, please login as the ‘root’ user to get to the root prompt.
 2.	Type ‘vicibox-timezone’ and press the ENTER key
 3.	Using the TAB key, or by pressing ALT-R, to move the highlight bar to the ‘Region’ window; The highlight bar should be in this window by default
 4.	Using the up and down arrow keys, select the appropriate region for where this server is located
 5.	Press the TAB key once, or press ALT-Z, to move the highlight bar to the ‘Time Zone’ window
 6.	Using the up and down arrow keys, select the appropriate location with the same time zone for where this server is located; The time zones are listed by city so you’ll need to find a city from the list that is in the same time zone as the server
 7.	Press ALT-O to OK the changes to the system’s timezone
 8.	Verify the correct time zone is being displaying by typing ‘date’ and pressing the ENTER key; A reboot might be necessary to get the time zone to display correctly, also if the system time in the BIOS itself is wrong then the time displayed will also be wrong

ViciBox will attempt to synchronize it’s time using NTP over the internet. If it’s unable to synchronize the local system time you will need to set it manually in the BIOS. Using ‘vicibox-timezone’ is preferred to using ‘yast timezone’ since the latter option won’t modify the time zone in the web servers php configuration. This will result in the system time being correct but the web interface time being off.

Network Configuration – HIGHLY RECOMMENDED
 1.	If not already, please login as the ‘root’ user to get to the root prompt.
 2.	Type ‘yast lan’ and press the ENTER key to start the network configuration. Optionally, you can type ‘yast’ and navigate to the network configuration by going to System → Network Settings.
 3.	Using the TAB key, press it until the network card is highlighted. If you have multiple network cards, use the up and down arrow keys to select the proper network card to configure.
 4.	Press ALT-I to edit the configuration of the selected network interface.
 5.	Press ALT-T to select ‘Statically assigned IP Address’. All servers in a ViciDial cluster should have a statically assigned IP.
 6.	Press ALT-I or the TAB key to move to the ‘IP Address’ field.
 7.	Enter the IP Address for this network interface. This IP is determined by your network environment and is beyond the scope of this installation guide.
 8.	Press ALT-S or the TAB key to move to the ‘Subnet Mask’ field.
 9.	Enter the Subnet Mask for your network environment. The subnet mask can be entered in either dotted notation (A.B.C.D) or CIDR notation (/XX).
 10.	Press ALT-G to view the General settings for this network interface.
 11.	Press ALT-X to change the Firewall Zone for this network interface.
 12.	Using the Up and Down Arrow keys, select the ‘Internal Zone’ for the network interface if it is not directly attached to the Internet or ‘External Zone’ if it is directly attached to the Internet. For example, if the IP address for this server is an RFC1918 private IP like 192.168.X.Y or 10.X.Y.Z then this should be considered an Internal Zone connection.
 13.	Press ALT-N to accept the configuration changes and return to the Network Settings screen. If you have multiple network interfaces to configure you can repeat steps 3 through 12 for each of the additional interfaces. Network configurations can be complex and consulting a qualified network technician is recommended if there is any doubt as to what settings to use.
 14.	Press ALT-S to configure the Hostname and DNS settings.
 15.	Press ALT-T or the TAB key to move to the ‘Hostname’ field.
 16.	Enter the unique Hostname for this server. All servers MUST have a unique 16-character or less hostname for a clustered installation to install properly. The recommended naming convention is to use DBX, WebX, and DialX where X represents the numerical sequence of that server. For example, the first Telephony server would be Dial1, the second Dial2, etc. The web servers would be web1, web2, etc. Please avoid arbitrary names like ‘Zeus’, ‘Batman’, ‘Lemonade’, etc.
 17.	Press ALT-D or the TAB key to move to the ‘Domain Name’ field.
 18.	Enter the Domain Name for this server. The domain name ‘vicibox.local’ can be used if a domain name is not known or not set-up in the current Network Environment.
 19.	Press ALT-1 or the TAB key to move to the ‘Name Server 1’ field.
 20.	Enter the primary DNS server for your network. This will typically be the IP address the router if you are using a private IP, or the DNS servers for your ISP if you are not. The ip ‘8.8.8.8’ can be used if the primary DNS server is not known or provided.
 21.	Press ALT-2 or the TAB key to move to the ‘Name Server 2’ field.
 22.	Enter the secondary DNS server for your network. This will typically be the DNS server from your ISP. The ip ‘4.2.2.1’ can be used if the primary DNS server is not known or provided.
 23.	Press ALT-U to change to the Routing screen.
 24.	Press ALT-F or the TAB key to change to the ‘Default IPv4 Gateway’.
 25.	Enter the Default Gateway for your network. This will typically be the router’s IP if the server is configured with a private IP address or the gateway as provided by the ISP if it’s directly attached to the network.
 26.	Press ALT-O to select ‘OK’ and save the network configuration. This will cause the network to reload and the changes to become active. It is possible during this step that the network will not reload cleanly. To prevent this issue from causing any problems it is recommended to reboot the server prior to the Phase 2 ViciDial installation.
 27.	Once back at the root prompt, type ‘ping -c6 google.com’ and verify that the server is properly able to ping out onto the internet.

In addition to basic network configuration, you can configure the built-in firewall by typing ‘yast firewall’. This interface will allow you to open ports and selectively allow access for certain IPs. This will not configure the ViciBox Firewall (VB-firewall.pl) but will allow static firewall entries.

Change Keyboard Layout – RECOMMENDED IF NOT USING US KEYBOARD
 1.	If not already, please login as the ‘root’ user to get to the root prompt.
 2.	Type ‘yast keyboard’ and press the ENTER key to load the keyboard configuration screen
 3.	Using the up and down arrow keys, move the highlight bar so that the correct keyboard layout is selected
 4.	Press ALT-O to select ‘OK’ and save changes to the system; A reboot might be required for the keyboard layout changes to be properly loaded

Change Language – RECOMMENDED IF LOCAL IT STAFF NOT ENGLISH SPEAKING
 1.	If not already, please login as the ‘root’ user to get to the root prompt.
 2.	Type ‘yast language’ and press the ENTER key to load the language configuration screen
 3.	Using the TAB key, or by pressing ALT-L, move the highlight bar to the Primary Language drop down box; By default, the highlight bar should already be in the drop down box
 4.	Using the up and down arrow keys, select the appropriate primary language for this server; The primary language will change the text used during login and in the ‘yast’ configuration screens. It will not change the default language that ViciDial uses or the language that the vicibox wizard installs with
 5.	Press ALT-O to select ‘OK’ and save chagnes to the system; A reboot might be required for the keyboard layout changes to be properly loaded

Install Updates – RECOMMENDED AND REQUIRES INTERNET CONNECTIVITY
 1.	If not already, please login as the ‘root’ user to get to the root prompt.
 2.	Type ‘zypper ref’ to refresh all installed repositories for the latest packages.
 3.	Type ‘zypper up’ to install updated packages and any package changes. This step might take a while depending upon the age of the installed ViciBox image and the speed of your internet connection.
 4.	After the updates are done installing, type ‘reboot’ and press the ENTER key to reboot the server; This is optional, but recommended just to make sure things are loaded cleanly

Phase 2 – ViciDial Installation

There are two different types of ViciDial installations. The first one is an ‘Express’ install which is used for a single server installations. The second type is a ‘Cluster’ install which is where ViciDial is using multiple servers to perform the different functions. The actual installer is the same for both options but the ‘Express’ install has predetermined settings given to the installer making it the least involved and fastest to set-up.

If the expected current or future agent capacity is going to exceed 15 to 20 agents if it recommended that ViciDial be installed as a cluster. An express install can be migrated to a cluster install at a later time but the it takes a lot of work to split it apart and is disruptive to the agents.

ViciDial Express Installation
 1.	If not already please login as the ‘root’ user to get to the root prompt.
 2.	At the root prompt type ‘vicibox-express’ and press the ENTER key. This will start the installation wizard. Follow the prompts to continue installation.
 3.	After the installation has finished, type ‘reboot’ and press the ENTER key to reboot the server. You should carefully examine the output of the installer to make sure that it installed properly. Do not assume that just because it finished it had successfully installed.
 4.	From a web browser on a desktop type in the IP Address of FQDN of your server and press the ENTER key.
 5.	If the installation was successful you should see the ViciDial Welcome page.

ViciDial Cluster Installation
 1.	On the primary database server, if not already, please login as the ‘root’ user to get to the root prompt.
 2.	Type ‘vicibox-install’ and press the ENTER key. This will start the installation wizard. Follow the prompts to continue installation making sure to indicate that this server is the DataBase. If using any custom database settings please write them down for later reference when installing the Web and Telephony servers. If this server is also the web server, say ‘Y’ to the web server option as well.
 3.	If you have a secondary database server, please login as the root user to get to the root prompt. 
 4.	On the secondary database server type ‘vicibox-install’ and press the ENTER Key. This will start the installation wizard. Follow the prompts to continue and make sure to select ‘Y’ on Expert Options and indicate that this is a ‘slave’ database server. If a custom database configuration was entered during Step 2 then type ‘N’ for using the default database connection and type in the settings used when asked.
 5.	Once the database(s) has finished installing, please login as the root user on the Web server. 
 6.	On the Web server type ‘vicibox-install’ and press the ENTER key. This will start the installation wizard. Follow the prompts to continue installing and make sure to indicate that this server is the Web server. If a custom database configuration was entered during Step 2 then type ‘N’ for using the default database connection and type in the settings used when asked. If the current server is the same as the database server, you can skip this server since it was previously setup during step 2.
 7.	Once the web server has finished installing, repeat steps 5 and 6 for any additional Web servers to be added to the cluster.
 8.	If ViciBox server for an Archive server, please login as the root user on the archive server.
 9.	On the archive server type ‘vicibox-install’ and press the ENTER key. This will start the installation wizard. Follow the prompts to continue installation and make sure to indicate that this is an Archive server. If a custom database configuration was entered during Step 2 then type ‘N’ for using the default database connection and type in the settings used when asked.
 10.	After at least one Web server has been installed, please login as the root user on the Telephony server.
 11.	On the Telephony server type ‘vicibox-install’ and press the ENTER key. This will start the installation wizard. Follow the prompts to continue installation and make sure to indicate that this is a Telephony server. If a custom database configuration was entered during Step 2 then type ‘N’ for using the default database connection and type in the settings used when asked.
 12.	Repeat step 10 and 11 for any additional Telephony servers you might have.

When doing a cluster installation it is possible to consolidate server roles during the install by inputing the proper options into the vicibox-install wizard. For example, if one server was going to be both the DataBase and Web Server you would say Yes to both the DataBase and Web Server questions during the install. The minimum cluster installation is two servers. One server to be the DataBase and Web and the second server to act as a Telephony server.

It is generally a good idea to reboot all servers in a cluster after completing the installation to make sure everything is loaded cleanly. To reboot a cluster, start by rebooting the database and waiting until it has finished. Once the database has finished the remainder of the servers in the cluster can be rebooted in any order. The Database is the only server required to be up first before any of the other servers will work properly.

Please refer to the ViciDial manual for further instructions on logging into ViciDial and configuring the various options. The default Admin user is ‘6666’ with a password of ‘1234’.

Please use caution when selecting ViciDial passwords such as the phone registration password. If you keep the passwords too simple you open yourself up to hackers committing toll fraud through your system. A secure password contains more then 8 characters and consists of one lowercase letter, one uppercase letter, and one numeral. An example of a secure password would be 'nebl6HE0u25a0Gt'. Please DO NOT use this password, it is ONLY an example. The default phone registration password and server password has already been randomized during the install. When changing them, please keep the above secure password requirements in mind.

Post-Install Configuration Items

Install LetEncrypt/Certbot SSL – Only Applies to web and Telephony servers
 1.	If not already, please login as the ‘root’ user to get to the root prompt.
 2.	Type ‘vicibox-certbot’ to start the simplified CertBot setup wizard.

The CertBot verification will only work if this server has a Fully Qualified Doman Name (FQDN) properly pointed to it. Verify that your Fully Qualified Domain Name is properly pointing to this server by going to http://<FQDN> in a web browser. 

ViciBox Firewall

The ViciBox Firewall is an integration of the underlying firewall in the OS, various features of ViciDial, and some add-on ViciBox features. This allows for the relatively easy administration of all network access to the various features of ViciDial. The firewall integration itself supports a Black list, a White list, a Dynamic List with a user authentication portal, a GeoBlock (Geographical Blocking) list, and a community driven VoIP Black list. The firewall is designed to work with both single IP and CIDR-style network blocks for ease of administration. At this time only IPv4 is supported.

By default the firewall is setup to load a community VoIP centric black list from voipbl.org and prevent any SIP, IAX, or WebRTC traffic from reaching the Telephony servers. We have seen large reductions in the number of clients receiving SIP scans and brute force attempts from this one step alone but unfortunately it is not fool-proof. Relying only on the list from voipbl.org means the protection is limited to how reliably an attacker’s IP is reported and how often the list is updated for download. In addition there is also a user definable Black list and a GeoBlock (Geographical Block) list.

The White list and Dynamic list are not compatible with the Black list, VOIP Black list, and GeoBlock options. Similarly the Black list, VoIP Black list, and GeoBlock methods are compatible with each other but are not compatible with the White list or Dynamic list option. This is due to the fundamental different in how these items operate. A white/dynamic list works by blocking all access and only allowing traffic specified by the user. A black/voipbl/geoblock list works by allowing all access except to IPs found in these lists. The following instructions should only be applied to the Web and Telephony servers. Additionally, these rules only apply to the ‘public’ zone in the firewall which is the default for all network interfaces. Please read over the Network Configuration section to change zones if needed.

Access control methods
•	White List – Blocks all access except for IPs specifically defined in a ViciDial IP List
•	Dynamic List – Allows agents to manually authenticate with a portal to gain access to ViciDial
•	Black List – Block any IP specifically defined in a ViciDial IP List (Defaults to SIP/IAX/RTC)
•	VoIPBL – Community generated list of known SIP attackers, works the same as a Black List
•	GeoBlock – Block IPs based on their assigned geographical location, similar to the Black List

IP Lists feature in ViciDial – Required for adding IPs to White and Black lists from ViciDial
 1.	If not already, log into the ViciDial administration web interface.
 2.	In the ViciDial administration interface, click on where it says “Admin” on the left hand navigation bar
 3.	In the expanded menu below “Admin”, click on where it says “System Settings”
 4.	About half way down the shown system settings will be an option labeled “Allow IP Lists”, set this to 1.
 5.	Scroll to the bottom of the page and click “Submit”.
 6.	Click again on the navigation bar where it says “Admin” just like in step 2
 7.	A new option labeled “IP Lists” should now be visible in the expanded menu below Admin. Click on where it says “IP Lists”.
 8.	You should see two IP Lists in there by default, one labeled “ViciWhite” and the other labeled “ViciBlack”.

Black List control
 1.	If not already, please login as the ‘root’ user to get to the root prompt.
 2.	Type ‘crontab -e’ to edit the crontab; Please be careful making modifications in this screen as it may result in undesired or unstable system behavior
 3.	Using the down arrow key, scroll to the very end of the screen until the cursor no longer moves down
 4.	Type in the following to enable the Black List: * * * * * /usr/local/bin/VB-firewall.pl --quiet  
 5.	Press CTRL-X to exit this screen; It will pop up a notification on screen at the bottom left corner
 6.	When asked to Save, press the Y key; Make sure you only press the Y key as it’s auto-detected
 7.	Press the ENTER key to accept the default filename presented; Changing the filename will result in an error and no changes will be made. Usually this happens by pressing more then just the Y key in step 6

This will result in the black list being updated once every minute from the entries entered into the ViciBlack IP List in the ViciDial web administration interface.

White List and Dynamic List control
 1.	If not already, please login as the ‘root’ user to get to the root prompt.
 2.	Type ‘crontab -e’ to edit the crontab entry; Please be careful making modifications in this screen as it may result in undesired system behavior
 3.	Using the up and down arrow keys put a # at the beginning of any line containing ‘VB-firewall.pl’ in it; You can modify these lines instead but for simplicity we are commenting them out, making them not run at all
 4.	Using the down arrow key, scroll to the very end of the screen until the cursor no longer moves down
 5.	Type in the following and then press ENTER when done: * * * * * /usr/local/bin/VB-firewall.pl --white --dynamic --quiet 
 6.	Type in the following and then press ENTER when done: @reboot /usr/local/bin/VB-firewall.pl --white --dynamic --quiet 
 7.	Press CTRL-X to exit this screen
 8.	When asked to Save, press the Y key
 9.	Press the ENTER key to accept the default filename presented; Changing the filename will result in an error and no changes will be made
 10.	At the root prompt, type ‘yast firewall’ and press the ENTER key
 11.	Using the up and down arrow keys, move the highlight bar until ‘public’ is highlighted, then press the ENTER key; You can use the TAB key to move the highlight bar to the proper window that public is in if it’s not there by default
 12.	Press the TAB key until the highlight bar moves to the window that has “Allowed” above it; These are the rules that are allowed access to the system
 13.	Using the up and down arrow keys, move the highlight bar to the following items and then press the SPACE bar once: Asterisk; If you also want to control web access through the white and dynamic list, repeat this step for the ‘apache2’ and ‘apache2-ssl’ items
 14.	Press ALT-E to remove these items from the allowed list; DO NOT remove RTP from the allowed list
 15.	Press ALT-A to accept and apply these changes; You should end up back at a root prompt afterwards

Due to the way connection tracking works in the underlying OS, a reboot might be required for the changes to fully come into effect. This will result in only the IPs in the white list and the dynamic authentication from being allowed to connect to ViciDial services.

Dynamic Agent Portal – To be enabled on a single Web server only
 1.	If not already, please login as the ‘root’ user to get to the root prompt.
 2.	At the root prompt, type ‘yast firewall’ and press the ENTER key
 3.	Using the up and down arrow keys, move the highlight bar until ‘public’ is highlighted, then press the ENTER key; You can use the TAB key to move the highlight bar to the proper window that public is in if it’s not there by default
 4.	Press the TAB key until the highlight bar moves to the window that is below “Services”; These are the rules that are available to apply to the firewall
 5.	Using the up and down arrow keys, move the highlight bar to the following items and then press the SPACE bar once: viciportal, viciportal-ssl; If only the SSL option is needed then omit the viciportal option
 6.	Press ALT-D to add these services to the Allowed window; Please be careful adding items to the allowed list as this will make those services accessible from the public internet
 7.	Press ALE-A to accept and apply these changes

This will enable the ViciBox Dynamic Portal. This portal allows agents to authenticate themselves by using their assigned user ID and password from ViciDial. It can be accessed by going to the following URLs in a web browser: http://server:81/valid8.php or http://server:446/valid8.php . When an agent validates themselves their IP is added to the database and picked up by the rest of the servers within 60 seconds. There are options for controlling this behavior by editing the settings contained in the file /srv/www/vhosts/dynportal/inc/defaults.inc.php 

GeoBlock – Enables country-based IP blocking
 1.	If not already, please login as the ‘root’ user to get to the root prompt.
 2.	Type ‘crontab -e’ to edit the crontab; Please be careful making modifications in this screen as it may result in undesired or unstable system behavior
 3.	Using the down arrow key, scroll to the very end of the screen until the cursor no longer moves down
 4.	Type in the following to enable the GeoBlock List: @reboot /usr/local/bin/ipset-geoblock >/dev/null
 5.	Press CTRL-X to exit this screen; It will pop up a notification on screen at the bottom left corner
 6.	When asked to Save, press the Y key; Make sure you only press the Y key as it’s auto-detected
 7.	Press the ENTER key to accept the default filename presented; Changing the filename will result in an error and no changes will be made. Usually this happens by pressing more then just the Y key in step 6
 8.	Manually run the geoblock script by typing ‘ipset-geoblock’ and pressing the ENTER key; You will see some output scroll by and then end up back at the root prompt after a minute or two

The countries that are blocked are stored in the ipset-geoblock file itself. By default the following countries are blocked: CN VN RU IN AF UA TW TH SK SI RO PL PK PH LV LU ID HU HR BD