<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:st2="urn:schemas-microsoft-com:office:smarttags" xmlns:st1="schemas-snapanumber-com/snap" xmlns="http://www.w3.org/TR/REC-html40"
xmlns:ns0="urn:schemas-microsoft-com:office:smarttags">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]--><o:SmartTagType
namespaceuri="urn:schemas-microsoft-com:office:smarttags" name="PostalCode"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="Street"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="State"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="PersonName"/>
<o:SmartTagType namespaceuri="schemas-snapanumber-com/snap" name="dial"
downloadurl="http://www.snapanumber.com"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="address"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="City"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="place"/>
<!--[if !mso]>
<style>
st2\:*{behavior:url(#default#ieooui) }st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]-->
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:Arial;}
p.MsoAutoSig, li.MsoAutoSig, div.MsoAutoSig
{mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman";}
@page Section1
{size:612.0pt 792.0pt;
margin:72.0pt 116.0pt 72.0pt 116.0pt;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>You
do realize you are describing everything that Corraleta can do…..but of
course it’s Java so you aren’t interested.<o:p></o:p></span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>For
anyone else on the list feel free to call to request the SDK install guide.<o:p></o:p></span></font></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:black'>Regards,</span></font><font size=2 color=navy face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:navy'><o:p></o:p></span></font></p>
<p class=MsoAutoSig><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><ns0:PersonName w:insAuthor="Dean.Collins"
w:insDate="2007-04-21T06:49:00Z" w:endInsAuthor="Dean.Collins"
w:endInsDate="2007-04-21T06:49:00Z"><font color=black><span style='color:black'>Dean
Collins</span></font></ns0:PersonName></span></font><br>
<font size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:
Arial;color:black'><a href="mailto:dean@mexuar.com"
title="mailto:dean@mexuar.com">dean@mexuar.com</a> <br>
<st1:dial w:st="on">+1-212-203-4357</st1:dial> Ph</span></font><o:p></o:p></p>
<p class=MsoAutoSig><font size=3 face=Arial><span style='font-size:12.0pt;
font-family:Arial'><a
href="http://click.mexuar.com/webuser/click/7/userurl/Cognation"
target=corraleta><span style='text-decoration:none'><img border=0 width=125
height=25 id="_x0000_i1025" src="cid:image001.gif@01C783E1.5FA64180"
alt="Call Button"></span></a><a
href="http://click.mexuar.com/webuser/nojs/7/userurl/Cognation"
target=corraleta></a></span></font><br>
<font size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:
Arial;color:black'>--------------------------------------------------------------------<br>
<a href="http://www.mexuar.com/" target="_blank"><strong><b><font
color="#525f3f" face=Arial><span style='font-family:Arial;color:#525F3F'>www.Mexuar.com</span></font></b></strong></a><br>
Want to voice enable your website?<br>
Use Corraleta to reach your customers in 10 seconds or less.<o:p></o:p></span></font></p>
<p class=MsoAutoSig><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
-----Original Message-----</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
From: asterisk-users-bounces@lists.digium.com [mailto:asterisk-users-</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
bounces@lists.digium.com] On Behalf Of Salvatore Giudice</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
Sent: Saturday, 21 April 2007 1:46 AM</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
To: 'Asterisk Users Mailing List - Non-Commercial Discussion'</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
Subject: RE: [asterisk-users] Softphone that supports central provisioning?</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
A complete provisioning system for soft phones could impart some of the same</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
authentication models used for popular IM clients. Imagine a large</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
enterprise who wants to give out several thousand soft phones to employees</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
in a turnkey fashion requiring the employee's network credentials to</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
authenticate at the start of each session. Generally, it is not acceptable</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
to use employee credentials to perform SIP digest authentication. Employee</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
credentials are meant for employees, not devices or software that sets up a</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
session on behalf of an employee.</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
The solution to this kind of setup is to use a soft phone that can be</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
downloaded on demand and presents the employee with a simple</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
username/password/domain login box. In one such system that I worked on, the</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
client would take the credentials from the employee and authenticate via</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
HTTPS to a simple CGI script that authenticates the credentials against an</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
Active Directory setup. Once the employee is authenticated, the CGI script</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
sets a temporary password in a database that is accessible by a radius</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
server and sends back all the provisioning information including the</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
employee's office number and the temporary session password via XML in the</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
HTTPS POST response. The client then logs into the SIP service using the</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
session credentials.</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
The employee is required to re-authenticate at the start of each soft phone</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
session or after a timed interval when the temporary session password is</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
expired from radius.</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
The advantages to this kind of setup are:</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
1.) you don't have employee credentials stored in soft phones</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
2.) you avoid locking out employee credentials when policy-based password</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
changes are required because of rapid authentication failures from a SIP</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
device with stored credentials</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
3.) no SIP service credentials are stored in the soft phones</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
4.) in the event that the temporary session password is stolen from a soft</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
phone installation, it is only good for a short period of time usually</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
limited to 12 hours</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
5.) HTTPS is a significantly better provisioning method than TFTP (cough</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
Cisco...) because it is encrypted and you have the opportunity to validate a</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
cert from the provisioning server to ensure that the soft phone client is</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
talking directly to the provisioning server. Man in the middle attacks suck.</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
6.) it's a lot easier to change provisioning information for all clients</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
without requiring employees to download a new soft phone with hardcoded</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
settings or trying to get employees to implement changes on their phones</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
manually. For the same reason, it reduces initial setup complexity and also</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
eliminates the bulk of setup related support calls</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
We have put together implementations of this kind of system before for</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
clients. Usually, this kind of scenario is not something we discuss outside</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
our training classes or at conventions. Generally, this kind of system is</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
commonly requested by enterprise and government customers when they seek to</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
extend their phone system to employees for road warrior, pandemic, disaster</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
recovery, or occasional work at home scenarios.</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
--------------------------------------------------</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
Salvatore Giudice</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
Salvatore.Giudice@VoIPSecurityTraining.com</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
VoIP Security Training, LLC</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
http://VoIPSecurityTraining.com</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
<st2:Street w:st="on"><st2:address w:st="on">848 N. Rainbow Blvd. #1676</st2:address></st2:Street></span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
<st2:place w:st="on"><st2:City w:st="on">Las Vegas</st2:City>, <st2:State
w:st="on">NV</st2:State> <st2:PostalCode w:st="on">89107</st2:PostalCode></st2:place></span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
Phone: <st1:dial w:st="on">(702) 979-2906</st1:dial></span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
Fax: <st1:dial w:st="on">(212) 279-2906</st1:dial></span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
-----Original Message-----</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
From: asterisk-users-bounces@lists.digium.com</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
[mailto:asterisk-users-bounces@lists.digium.com] On Behalf Of Tzafrir Cohen</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
Sent: Friday, April 20, 2007 9:01 PM</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
To: asterisk-users@lists.digium.com</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
Subject: Re: [asterisk-users] Softphone that supports central provisioning?</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
On Fri, Apr 20, 2007 at 11:48:20AM -0400, James FitzGibbon wrote:</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
> Has anyone found a softphone that supports pulling it's configuration from</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
a</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
> central server via TFTP/FTP/HTTP, much like hard desk phones use?</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
Why would you want to do that?</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
There are well-known and established tools to "provision" (centrally</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
configure) software running on computers in a entwork. Why should the</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
soft phones be configured any differently?</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
What OS do you use on the desktops?</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
--</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
Tzafrir Cohen</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
icq#16849755 jabber:tzafrir@jabber.org</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
<st1:dial w:st="on">+972-50-7952406</st1:dial>
mailto:tzafrir.cohen@xorcom.com</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
http://www.xorcom.com iax:guest@local.xorcom.com/tzafrir</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
_______________________________________________</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
--Bandwidth and Colocation provided by Easynews.com --</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
asterisk-users mailing list</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
To UNSUBSCRIBE or update options visit:</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
http://lists.digium.com/mailman/listinfo/asterisk-users</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
_______________________________________________</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
--Bandwidth and Colocation provided by Easynews.com --</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
asterisk-users mailing list</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
To UNSUBSCRIBE or update options visit:</span></font></p>
<p class=MsoPlainText><font size=2 face=Arial><span style='font-size:10.0pt'>>
http://lists.digium.com/mailman/listinfo/asterisk-users</span></font></p>
</div>
</body>
</html>