6.24. manager.conf
Asterisk AMI: Manager
AMI (Asterisk Manager Interface) is an easy way to connect to your running Asterisk, to check its status and make modifications, or simply give access to other users/client to observe certain events, or even make changes themselves. With it you can run all the commands you can execute via the console(CLI) in the Asterisk. AMI is useful when you do not have a direct access to the machine on which Asterisk is running or fore some reason (like security) you do not want to currently log on to it, so you only log-on to the Asterisk itself via the 'Manager'.
Recommendations
In this tutorial we presume that you have a previous knowledge of what Asterisk is, if not, it will be better for you to start with our "asterisk" and "extensions.conf" tutorials.
Configuring the AMI: manager.conf
in "/etc/asterisk/" is a file named "manager.conf" -> this is the configuration file in which is described the users allowed to connect to the AMI, their secrets, the IP's from which they can connect, their privileges etc.
example:
Here is the example of the manager.conf that we use for this tutorial.
The set of access level:
"system, call, log, verbose, command, agent, user".
Each command needs a certain level of permission to be executed - in Asterisk's CLI, when you type "show manager commands", a list of all commands with the needed permission for execution is displayed.
The highest access level option is "all" – as you may guess from its name – it grants all permissions for the current user.
The permissions are given for two options - "read" and "write"
"read" -> this options refers to the permission of the user requests to view/read on his display the result of a command he sends to the asterisk via the AMI. Besides that he/she will be able to monitor what is happening to (who/what is calling through) the Asterisk.
"write" -> this options refers to the permission of the user to change/modify the asterisk settings/files.
(Use this in cases something has to be changed/modified, but the Asterisk response must not be seen by others)
If you want to see the sequence of the commands that you must enter, when in CLI type "show manager command <command_name>" (or when logged to the AMI - "action: command <CRLF> command: show manager command <command_name>")
"<CRLF>" -> means new-line (hitting the "Enter" key)
The synopsis of a command line is:
Example for using of the command line:
Here is what is happening in the Asterisk's CLI (note that the Verbose option must be 2 or more in order this to be displayed):
Important notice: abuse of the AMI
Although You can not make changes to the configuration files of Asterisk using the manager (even the "command" action will not allow You to execute command outside of the Asterisk), but the commands like "stop now" can be called by a user logged to the AMI with the level of privilege to use "command" option, so be very careful when giving the access options of the users, and to whom You give accounts for the manager.
Also in the new version of Asterisk - 1.4.0 , You also can (but in beta 3 that has been released this still is not functional) change the dialplan trough the CLI, and in the dailplan you can use the "System" and "TrySystem" commands that can execute commands in the "shell" with "root" privilege. So be very careful to whom you really give AMI accounts.
One of the ways to use the AMI in relatively safe way - is to make a "php" script that connects to the AMI and sends the command you requested, and the "php" script should only make the connection to the AMI and parse the result - the command must be requested from some kind of other html/javascript/php site.
Here is an example line of a "php" script, do not forget to create the "socket" variable, also to create a login function:
function getrestart()
{
$socket=$this->connect();
$query=array("Action: Command",
"Command: restart now");
$this->query2($socket,$query);
return true;
}
Commands we recommend You to view (and remember):
In CLI:
When logged to the AMI:
Related tutorials we recommend You to read:
AMI (Asterisk Manager Interface) is an easy way to connect to your running Asterisk, to check its status and make modifications, or simply give access to other users/client to observe certain events, or even make changes themselves. With it you can run all the commands you can execute via the console(CLI) in the Asterisk. AMI is useful when you do not have a direct access to the machine on which Asterisk is running or fore some reason (like security) you do not want to currently log on to it, so you only log-on to the Asterisk itself via the 'Manager'.
Recommendations
In this tutorial we presume that you have a previous knowledge of what Asterisk is, if not, it will be better for you to start with our "asterisk" and "extensions.conf" tutorials.
Configuring the AMI: manager.conf
in "/etc/asterisk/" is a file named "manager.conf" -> this is the configuration file in which is described the users allowed to connect to the AMI, their secrets, the IP's from which they can connect, their privileges etc.
example:
[general] ; -> the name of the main default context - it must not be changed
enabled = yes ; -> this option by default is set to "no" you must change it to "yes" in order for the AMI to work
port = 5038 ; -> this is the port to which the AMI will listen (when you connect to the AMI you must specify this port) - it is recommended that You should not change this option unless you are fully aware of what you are doing (know which ports on the machine running Asterisk are open)
bindaddr = 0.0.0.0 ; -> this binds the AMI to all the IPs of the server. If, for example, your server has 2 LAN controllers, one with internal IP assigned to it(like 192.168.*.* or 10.0.0.*) and one with external IP (like 212.84.73.125 or 83.50.44.*), you can change the bind option to: "bindaddr = 192.168.*.*", so only the internal network will be able to connect to the AMI;
displayconnects = yes ; -> should the command-line display the connections to the Asterisk;
[test] ; -> this is the username You will need to identify when connecting to the AMI at log-on
secret = my_secret ; -> this is the password that the current You or the user must enter at log-on
deny=0.0.0.0/0.0.0.0 ; -> here You tell all the IPs that You or the user can not log-in from (0.0.0.0/0.0.0.0 -> means all IP's are forbiden)
permit = 127.0.0.1/255.255.255.0
permit = 10.2.2.48/255.255.255.0 ; -> here You specify the IPs that You or the user will be able to connect from
read = all ; -> here you type the permissions you want to give to Yourself or the user for reading
write = all ; -> here you type the permissions you want to give to Yourself or the user for writing
writetimeout = 1000 ;-> this is how much time the AMI will wait for the next command (in case of delay, of a long distance connection for example) in milliseconds
enabled = yes ; -> this option by default is set to "no" you must change it to "yes" in order for the AMI to work
port = 5038 ; -> this is the port to which the AMI will listen (when you connect to the AMI you must specify this port) - it is recommended that You should not change this option unless you are fully aware of what you are doing (know which ports on the machine running Asterisk are open)
bindaddr = 0.0.0.0 ; -> this binds the AMI to all the IPs of the server. If, for example, your server has 2 LAN controllers, one with internal IP assigned to it(like 192.168.*.* or 10.0.0.*) and one with external IP (like 212.84.73.125 or 83.50.44.*), you can change the bind option to: "bindaddr = 192.168.*.*", so only the internal network will be able to connect to the AMI;
displayconnects = yes ; -> should the command-line display the connections to the Asterisk;
[test] ; -> this is the username You will need to identify when connecting to the AMI at log-on
secret = my_secret ; -> this is the password that the current You or the user must enter at log-on
deny=0.0.0.0/0.0.0.0 ; -> here You tell all the IPs that You or the user can not log-in from (0.0.0.0/0.0.0.0 -> means all IP's are forbiden)
permit = 127.0.0.1/255.255.255.0
permit = 10.2.2.48/255.255.255.0 ; -> here You specify the IPs that You or the user will be able to connect from
read = all ; -> here you type the permissions you want to give to Yourself or the user for reading
write = all ; -> here you type the permissions you want to give to Yourself or the user for writing
writetimeout = 1000 ;-> this is how much time the AMI will wait for the next command (in case of delay, of a long distance connection for example) in milliseconds
Here is the example of the manager.conf that we use for this tutorial.
The set of access level:
"system, call, log, verbose, command, agent, user".
Each command needs a certain level of permission to be executed - in Asterisk's CLI, when you type "show manager commands", a list of all commands with the needed permission for execution is displayed.
The highest access level option is "all" – as you may guess from its name – it grants all permissions for the current user.
The permissions are given for two options - "read" and "write"
"read" -> this options refers to the permission of the user requests to view/read on his display the result of a command he sends to the asterisk via the AMI. Besides that he/she will be able to monitor what is happening to (who/what is calling through) the Asterisk.
"write" -> this options refers to the permission of the user to change/modify the asterisk settings/files.
(Use this in cases something has to be changed/modified, but the Asterisk response must not be seen by others)
If you want to see the sequence of the commands that you must enter, when in CLI type "show manager command <command_name>" (or when logged to the AMI - "action: command <CRLF> command: show manager command <command_name>")
"<CRLF>" -> means new-line (hitting the "Enter" key)
The synopsis of a command line is:
action: <the action to be preformed - login, command, AgentLogoff, etc.> <CRLF>
<Synopsis -> key command>: <value/text> <CRLF>
<Synopsis -> Variables>: <variable> = <value> <CRLF>
....
<CRLF>
<Synopsis -> key command>: <value/text> <CRLF>
<Synopsis -> Variables>: <variable> = <value> <CRLF>
....
<CRLF>
Example for using of the command line:
Here is what is happening in the Asterisk's CLI (note that the Verbose option must be 2 or more in order this to be displayed):
Important notice: abuse of the AMI
Although You can not make changes to the configuration files of Asterisk using the manager (even the "command" action will not allow You to execute command outside of the Asterisk), but the commands like "stop now" can be called by a user logged to the AMI with the level of privilege to use "command" option, so be very careful when giving the access options of the users, and to whom You give accounts for the manager.
Also in the new version of Asterisk - 1.4.0 , You also can (but in beta 3 that has been released this still is not functional) change the dialplan trough the CLI, and in the dailplan you can use the "System" and "TrySystem" commands that can execute commands in the "shell" with "root" privilege. So be very careful to whom you really give AMI accounts.
One of the ways to use the AMI in relatively safe way - is to make a "php" script that connects to the AMI and sends the command you requested, and the "php" script should only make the connection to the AMI and parse the result - the command must be requested from some kind of other html/javascript/php site.
Here is an example line of a "php" script, do not forget to create the "socket" variable, also to create a login function:
function getrestart()
{
$socket=$this->connect();
$query=array("Action: Command",
"Command: restart now");
$this->query2($socket,$query);
return true;
}
Commands we recommend You to view (and remember):
In CLI:
"show manager commands"
When logged to the AMI:
"action: listcommands"
Related tutorials we recommend You to read:
| User Comments |
|
dipesh (dipesh dot d2007 at gmail dot com) 13 June 2007 15:02:05 what is the exact meaning of each these entires in manager.conf? system,call,log,verbose,command,agent,user |
| Add Comment |
Latest Headlines:
-
T.38 faxing with Zoiper 2.15 is now easier than ever
section: voip software
-
Asterisk 1.4.21 Released
section: Asterisk
-
Asterisk 1.4.20 Released
section: Asterisk
-
Asterisk 1.4.20-rc2 Released
section: Asterisk
-
Asterisk 1.4.20-rc1 Now Available
section: Asterisk
- News Archives (older news)
Latest Tutorials:
-
Sending Fax from Zoiper to Zoiper using T.38
added 08/Dec/2008 18:16
-
VMAuthenticate (dialplan application)
added 01/Mar/2008 15:57
-
Siptronic ST-530
added 06/Nov/2007 17:57
-
Siemens C455 IP hardphone
added 05/Nov/2007 10:24
-
Zoiper
added 22/Oct/2007 17:53
Latest Comments:
-
nice...
tutorial: X-Lite - SIP softphone
-
Badly need your help. Things are only im...
tutorial: Grandstream HandyTone-486 - SIP Analog Telephone Adapter (ATA)
-
how do i rectify this problem? all incom...
tutorial: Troubleshooting
-
How are you. Summer afternoon - Summer a...
tutorial: Cisco 7960 IP Phone - SIP firmware version
-
where is the tar file you mention above ...
tutorial: Cisco 7960 IP Phone - SIP firmware version