Hardening VICIdial: AMI Users, MySQL Accounts and Default Web Paths

Every stock VICIdial install ships with the same Asterisk Manager credentials, the same MySQL users, and the same web paths. They are documented publicly, which means they are in every scanner’s wordlist. This post covers what to change and, importantly, what else breaks when you change it.

Do this on a maintenance window. Several of these steps will drop agent sessions if you get them wrong.

1. The AMI User in manager.conf

Open /etc/asterisk/manager.conf. A default install contains:

[cron]
secret = 1234
read = system,call,log,verbose,command,agent,user,originate
write = system,call,log,verbose,command,agent,user,originate

Username cron, password 1234. Anyone who reaches port 5038 can originate calls through your trunks.

First, bind the manager interface to loopback only. In the [general] section:

[general]
enabled = yes
port = 5038
bindaddr = 127.0.0.1

On a single-server install that alone is sufficient. On a cluster, bind to the private interface instead and restrict per-user:

[myadmin9k]
secret = pKq3vR8xLm2wZt
deny = 0.0.0.0/0.0.0.0
permit = 127.0.0.1/255.255.255.255
permit = 10.10.10.0/255.255.255.0
read = system,call,log,verbose,command,agent,user,originate
write = system,call,log,verbose,command,agent,user,originate

Now update VICIdial to use the new credentials. Two places:

VARserver_user => myadmin9k
VARserver_pass => pKq3vR8xLm2wZt

Then reload and restart the perl daemons:

asterisk -rx "manager reload"
/usr/share/astguiclient/ADMIN_keepalive_ALL.pl

Verify:

asterisk -rx "manager show users"

If agents cannot dial after this, you missed one of the three locations. All three must match.

2. MySQL / MariaDB Accounts

Defaults are cron / 1234 and custom / custom1234.

Create replacements:

CREATE USER 'vdadmin7z'@'localhost' IDENTIFIED BY 'Xr4mVq9tLp2s';
GRANT ALL PRIVILEGES ON asterisk.* TO 'vdadmin7z'@'localhost';

CREATE USER 'vdcustom7z'@'localhost' IDENTIFIED BY 'Bn8kWe3jHd6y';
GRANT SELECT,INSERT,UPDATE,DELETE ON asterisk.* TO 'vdcustom7z'@'localhost';

FLUSH PRIVILEGES;

On a cluster, replace localhost with each node’s private IP rather than using %.

Update /etc/astguiclient.conf on every server in the cluster:

VARDB_user => vdadmin7z
VARDB_pass => Xr4mVq9tLp2s
VARDB_custom_user => vdcustom7z
VARDB_custom_pass => Bn8kWe3jHd6y

Restart the screens so the perl scripts pick up new credentials:

/usr/share/astguiclient/ADMIN_keepalive_ALL.pl --restart

Only once everything is confirmed working should you drop the old accounts:

DROP USER 'cron'@'localhost';
DROP USER 'custom'@'localhost';

Also set a root password if one is not set, and remove anonymous users:

mysql_secure_installation

Answer no to “remove test database” only if you have a reason to keep it. Everything else, yes.

3. Change the Default Web Paths

Default paths, known to everyone:

• /vicidial/admin.php
• /agc/vicidial.php
• /RECORDINGS/

Change them in your Apache config. On ViciBox the vhost is under /etc/apache2/vhosts.d/; on a CentOS/Alma scratch install it is typically in /etc/httpd/conf.d/.

Alias /c7k-admin /srv/www/htdocs/vicidial
Alias /c7k-agent /srv/www/htdocs/agc

Then in Admin → System Settings, update the agent and admin URLs so VICIdial generates correct links internally.

Protect the recordings directory with basic auth at minimum:

htpasswd -c /etc/apache2/recordings.passwd qauser

<Directory /srv/www/htdocs/RECORDINGS>
    AuthType Basic
    AuthName "Recordings"
    AuthUserFile /etc/apache2/recordings.passwd
    Require valid-user
</Directory>

Then update Admin → System Settings → Recording Web Link so playback links in reports still resolve.

If phpMyAdmin was installed, remove it or restrict it by IP. A public phpMyAdmin fronting a database with default credentials is the shortest path to a compromised dialer.

4. SSH

Disable root login and password auth entirely once you have a working key.

ssh-copy-id -i ~/.ssh/id_ed25519.pub admin@your.server.ip

In /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
Port 22022

systemctl restart sshd

Keep your existing session open while you test the new one in a second terminal. Locking yourself out of a production dialer is an expensive lesson.

5. Firewall

Only three things need to reach the box from the internet: agent web access, SIP from your carriers, and RTP from your carriers.

firewall-cmd --permanent --new-zone=carriers
firewall-cmd --permanent --zone=carriers --add-source=203.0.113.0/24
firewall-cmd --permanent --zone=carriers --add-port=5060/udp
firewall-cmd --permanent --zone=carriers --add-port=10000-20000/udp
firewall-cmd --permanent --zone=public --remove-service=ssh
firewall-cmd --reload

Agents on dynamic IPs are the awkward case. ViciBox ships a dynamic portal package (vicibox-dynportal) that lets an agent authenticate to a web page and have their IP added to an allow set. That is a far better answer than opening 443 to the world.

6. Restrict Outbound Dialling Patterns

Toll fraud does not usually come through the web interface. It comes through a permissive dialplan. Replace any _9X. catch-all with explicit country patterns:

exten => _91NXXNXXXXXX,1,AGI(agi://127.0.0.1:4577/call_log)
exten => _91NXXNXXXXXX,n,Dial(SIP/mytrunk/${EXTEN:1},,tTo)
exten => _91NXXNXXXXXX,n,Hangup()

If you only call the US and Canada, there is no reason your dialplan should be able to reach a satellite prefix.

Verification Checklist

• asterisk -rx "manager show users" — no cron user
• SELECT user,host FROM mysql.user; — no cron or custom
• Browsing /vicidial/admin.php returns 404
• asterisk -rx "sip show peers" — all trunks still OK
• An agent can log in, dial out, and a recording plays back from the report

Work through it in order and check each one. Half-applied hardening that breaks agent logins is worse than none.