Obihai 200/202/300/302 ATA Setup Guide

[Liptonbrisk]

https://www.obitalk.com/forum/index.php?topic=707.0

Capturing Messages via Syslog

A syslog is a log of the status and debug messages sent out by your OBi unit. The messages are sent in syslog format over the network to an IP address and UDP port number you specify in the OBi's System Management (Device Admin) configuration settings.

You must use a program known as a syslog server to capture these messages and store them in a log file.
This log file is very useful for troubleshooting.

To troubleshoot issues with a SIP service (for SP1 or SP2 Service), you can also tell the OBi to log all the SIP messages exchanged with the ITSP. By default these SIP messages are not logged.

Here are the instructions on how to set-up your OBi so that it sends debug messages to the IP address x.y.w.z and port number ppppp. You will replace x.y.w.z and ppppp with the actual IP address and port number where your syslog server program is running.

Step 1: Find your OBi's IP address.
From phone handset attached to the OBi, press *** 1. The OBi's IP address will be announced.

Step 2: Configure the OBi's parameters for where to send debug messages.
Open the OBi's webpage (http://obi-ip-address) and navigate to System Management / Device Admin / Syslog.
Fill-in the "Server" parameter with x.y.w.z, and "Port" parameter ppppp – if different than default (514).
Note that ppppp must be in the range 1 - 65535.

Step 3: Enable logging of SIP Messages for SP1 (or SP2)
From the OBi device web page Voice Services settings, go to the SP1 Service (or SP2 Service) settings.
Change the "X_SipDebugOption" parameter to "Log All Messages."

Note: If your OBi device is managed from within OBiTALK, you have the option of configuring the syslog parameters from the OBiTALK-based OBi Expert Configuration web pages.

-------------------------------------------------------
Obihai Syslog Server Program for Windows
-------------------------------------------------------
There are many free syslog server programs available for download from the Internet.
You are free to use any that you like.
It is best to use one that supports time-stamping of the log messages.

For your convenience, Obihai Technology provides a free syslog server program.

The Internet Archive has the file.

Note: This program is for Windows machines only.
It must be run under the Windows Command Prompt, i.e. DOS window.

Syntax when running the Obihai syslog server:

C:\>syslogd -help
Usage: syslogd [-p=port] [-o=filename] [-nl] [-s=all]

-p: Listen to syslog messages at a port number other than the default (514).
For example -p=9000
-o: Output location and name for the log file of the captured syslog messages.
For example -o=c:\temp\test.log
-s: Options to control time-stamping and source IP Address.
-s=time enables time-stamping of each message
-s=ip enables logging the source IP address of each message
-s=all enables both time-stamp and source address
Note that -s=all is equivalent to -s=time -s=ip
-nl: Insert an extra blank line after each message (for better readability).


Please run the Obihai syslog server program with the following options (which includes time-stamping):

C:\>syslogd -nl -s=all

If you are using another syslog server program, please enable the time-stamping option of the program (usually time-stamping is enabled by default).

[Liptonbrisk]

As of December 18, 2023, the "E" for entering Obitalk's Expert Menu has disappeared from Obitalk.com for the OBi2xx series ATAs. In other words, you're not supposed to be allowed to use Obitalk.com to configure or provision your OBi2xx series ATA anymore. There's probably a way to still do so using Obitalk.com (at the time of typing this post), but officially, you're not allowed.

[Liptonbrisk]

Also, the successor to the OBi2xx series ATAs appears to be Poly 4xx series ATAs.
https://support.hp.com/ca-en/product/se ... 2101854845

HP owns Poly.

Poly 4xx series ATAs support G.722 audio codec, but Freephoneline doesn't.
Poly 4xx series ATAs do not support consumer Google Voice.

[Liptonbrisk]

Obitalk is dead after October 31, 2024: https://support.hp.com/ca-en/document/i ... 1049883-16

Don't use Obitalk.com anymore for configuring or provisioning Freephoneline.

[Liptonbrisk]

Obitalk is dead after October 31, 2024: https://support.hp.com/ca-en/document/i ... 1049883-16

Don't use Obitalk.com anymore for configuring or provisioning Freephoneline.

This also applies to the PDF guide. Ignore instructions for using the Obitalk web portal.

[Liptonbrisk]

With respect to a discussion I've had in another thread, I have switched over to naf modded firmware, but doing so isn't necessary for Freephoneline at the time I'm typing.

btw, as obi202 has no more firmware updates

Officially, there are no more firmware updates. However, many are switching to naf modded firmware (myself included). You can search for Obifirmware. Discussions concerning it are located at at this forum over here. I will not be providing support for updating firmware (or for problems arising from trying to update it), until Freephoneline requires it, so it's better to ask questions over there where the firmware developer is active.

what will be solution if its internal SSL license expires in future

That doesn't matter for Freephoneline.

Obihai ATAs don't have an SSL license that expires in the same manner software does. The concerns related to SSL/TLS and the lack of firmware updates are primarily about outdated trust store. The device might eventually not trust newer SSL certificates presented by servers that require TLS connections (because its list of trusted Certificate Authorities isn't updated).

Specific services, notably the Google Voice integration, rely on a client certificate embedded in the device, which does have an expiration date.

Conversely, standard SIP authentication, such as the digest authentication used by Freephoneline, relies on a challenge-response mechanism using your SIP username and SIP password (hashed with a nonce). This process happens within the SIP protocol messages (SIP signalling).

Where SSL/TLS would matter is If a service provider required SIP over TLS (Transport Layer Security), the TLS connection would need to be established first. This TLS handshake does involve validating the server's SSL certificate. If the Obi202 couldn't validate the server's certificate (due to an outdated trust store), the TLS connection would fail, and it wouldn't even reach the point of sending the SIP authentication messages.

But that doesn't matter for Freephoneline because Freephoneline does not use or support SIP over TLS for its BYOD (Bring Your Own Device) service. It uses unencrypted SIP over UDP ports 5060 and 6060.

The expired client certificate concern is specific to the now-defunct Google Voice integration via OBiTALK's website and not relevant for standard SIP registration with FPL. In other words, you're probably not affected unless you're using Google Voice (or another service provider), which I am also not supporting here.

However, using modded naf firmware from Obifirmware's website still allows users to provision Google Voice, to SSH into Obihai devices, and to potentially update certificates manually. Consumer Google Voice can still be provisioned on OBi202's using naf modded firmware. Perhaps this may be of interest. Again, I'm not supporting anything regarding modded firmware here, until it's absolutely required for Freephoneline to continue working.

which might affect user/pass authentication?

It won't for Freephoneline unless Freephoneline suddenly introduces TLS support, and, even then, I'm not sure they're going to require you to use it.



For what it's worth, in everyone's OBi202/302 ATAs that I am responsible for, I have updated them to firmware version 3.2.2 (Build: 8680EX-arrynrob13), which is the current version at the time of writing this post.

Notably, TLS is no longer potentially affected because a significant update related to the trusted certificates exists in that firmware version.

1. The firmware makes the entire list of trusted Root Certificate Authorities (CAs) user-editable via the file /scratch/rootca.pem. This is a major change from the original firmware, which had a fixed, hardcoded list embedded within it.

2. The firmware update notes state that by default, this user-editable list points to (symlinked to) the cacert-2024-11-26.pem file. This file represents the Mozilla/cURL collection of trusted Root CAs as of November 26, 2024.

So, instead of relying on the old, potentially outdated list embedded in the original firmware (that may contained expired CAs), naf modified firmware defaults to using a much more current and comprehensive set of trusted Root CAs maintained by the broader internet community (Mozilla/cURL). This addresses the problem of an OBI202 ATA failing to trust secure connections (such as those needed for Google Voice, secure provisioning, etc.) due to servers using certificates signed by newer CAs or chains leading back to CAs that had expired in the old, static list.

By using the November 2024 CA bundle, the devices running this firmware should be able to validate most modern SSL/TLS certificates correctly. The new firmware uses the cacert-2024-11-26.pem bundle, which is a collection of many individual Root CA certificates. Each Root CA within that bundle has its own specific expiration date, often many years (even decades) in the future (e.g., 2030s, 2040s). The key benefit is that this bundle (from late 2024) is current. It contains the necessary modern Root CAs trusted by today's secure servers and omits many of the expired ones found in the old firmware's hardcoded list.

The device's ability to trust secure connections now depends on whether a server's certificate chains back to any valid, non-expired Root CA within that loaded bundle. Because the firmware makes /scratch/rootca.pem user-editable, users can theoretically update this bundle themselves in the future, if needed, by downloading a newer version from a trusted source (curl.se, for example).

By using the updated cacert-2024-11-26.pem bundle, the modified firmware fixes validation issues. The device can now correctly verify modern server certificates. Therefore, TLS connections required by services should establish properly, assuming remote servers are configured correctly.

OBi2xx/3xx series ATAs aren't expired when using naf modded firmware.


I also use naf modded firmware on my OBi2182 IP phones.

Installation guides may help you.

If you need further assistance ask at this forum over here, where the firmware developer, naf, is active. I am especially not answering any questions about Google Voice provisioning on Fongo's forums.