Knowledgebase

This guide describes a repeatable procedure for installing Issabel 5 on a fresh Alma/Rocky Linux 8 (Minimal) VPS and preparing the server for production use.

The procedure covers the base operating system, PHP 7.4, Issabel 5 installation, timezone configuration, Webmin, CSF Firewall, custom SIP port forwarding, delayed CSF restart, swap space, static IP configuration, GeoIP-based Fail2Ban exceptions, Asterisk protection, Let's Encrypt SSL configuration, and FOP2 HTTPS configuration.

1. Requirements

• Operating System: Alma/Rocky Linux 8 (Minimal)
• Access: Root access
• Console: VPS Console or VNC access recommended
• Public IPv4: Required for most production PBX deployments
• Fresh VPS: Recommended

Start with a clean Alma/Rocky Linux 8 Minimal installation.

2. Login Through VPS Console

For the initial setup, log in directly through the VPS provider's Console or VNC as root.

Keeping console access available is important because firewall and network configuration changes can temporarily interrupt SSH connectivity.

3. Configure EPEL Repository

Install and enable the Extra Packages for Enterprise Linux repository:

dnf install -y epel-release

dnf config-manager --set-enabled epel

4. Install the Remi Repository

Determine the Alma/Rocky Linux major version:

RHEL_VERSION=$(rpm -E %{rhel})

Install the corresponding Remi repository:

dnf install -y https://rpms.remirepo.net/enterprise/remi-release-${RHEL_VERSION}.rpm

5. Enable PHP 7.4

Enable the Remi PHP 7.4 module:

dnf module enable php:remi-7.4 -y

dnf config-manager --set-enabled remi

dnf makecache

Do not upgrade the PHP environment to a newer major version before confirming compatibility with the Issabel 5 installation being used.

6. Reboot the Server

Synchronize pending disk writes and reboot:

chmod +x /etc/rc.d/rc.local
sync
reboot

After the server boots again, log in through the VPS Console or SSH.

7. Install Basic Utilities

Install the utilities required during the installation and administration process:

dnf -y install wget nano unzip nmap nmap-ncat tcpdump traceroute

8. Install Issabel 5

Run the Issabel 5 network installer:

wget -O - http://repo.issabel.org/issabel5-netinstall.sh | bash

Post-Installation Questions

Follow the questions displayed by the Issabel installer and provide the required information.

Wait for the installation process to complete before making additional system changes.

9. Verify Issabel After Installation

Before continuing with firewall hardening, verify that:

• The Issabel web interface is accessible.
• Asterisk is running.
• The server has the expected IP address.
• The system can access the Internet.
• You still have VPS Console/VNC access.

10. Configure Timezone and NTP

For a PBX server, correct system time is important for CDRs, logs, scheduled tasks, certificates, and monitoring.

For Bangladesh-based deployments, configure the timezone as follows:

timedatectl set-timezone Asia/Dhaka

timedatectl set-ntp true

Verify the configuration:

timedatectl

Confirm that the timezone is Asia/Dhaka and NTP synchronization is enabled.

11. Webmin Minimal

Webmin (minimal) can be installed as an necessary server administration interface.

Visit:   https://sourceforge.net/projects/webadmin/files/webmin/

Enter the latest version folder and find the minimal version installation file.

cd /tmp
wget https://sourceforge.net/projects/webadmin/files/webmin/2.660/webmin-2.660-minimal.tar.gz
gunzip webmin-2.660-minimal.tar.gz
tar xf webmin-2.660-minimal.tar
cd webmin-2.660
./setup.sh /usr/local/webmin

During the installation questionnaire, choose a custom port, such as 49500.

For production servers, Webmin should preferably be restricted to trusted administrative IP addresses rather than exposed publicly without access control, or use a custom port.

12. Install and Configure CSF Firewall (CSF GUI / Managed by Webmin)

Install and configure ConfigServer Security & Firewall (CSF) after confirming that the basic Issabel installation is working.

Updated CSF download, visit >  https://files.directadmin.com/services/ and find { csf-*.*.tar.gz }

systemctl stop firewalld
systemctl disable firewalld
yum remove firewalld -y

cd /usr/src
wget http://frankinternet.s3.us-east-1.amazonaws.com/elastix/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh

systemctl enable csf

Webmin > Webmin Configuration > Webmin Modules ->
From local file > /usr/local/csf/csfwebmin.tgz > Install Module

TCP IN

80,443,4445,49500

UDP IN

80,443,4569,5060,5061,10000:20000,55060

OUT

0:65535

Port Purpose

Country-Based Configuration

For this particular deployment strategy, Bangladesh is configured as the ignored country:

cc_ignore = BD

UDP Firewall Redirect

The external SIP port can be redirected to the standard Asterisk SIP port:

*|55060|*|5060|udp

This redirects UDP traffic arriving on port 55060 to port 5060.

13. Configure CSF Post Script

Create the CSF post script:

nano /etc/csf/csfpost.sh

Add:

#!/bin/bash
sleep 10
systemctl restart fail2ban
sleep 5
exit 0

Make the script executable:

chmod +x /etc/csf/csfpost.sh

This script restarts Fail2Ban after CSF has applied its firewall configuration.

14. Configure Delayed CSF Restart After Boot

Create the systemd service:

nano /etc/systemd/system/csf-delayed-restart.service

Insert:

[Unit]
Description=Restart CSF 5 minutes after boot
After=network.target

[Service]
Type=oneshot
ExecStart=/usr/sbin/csf -r

Create the Timer

nano /etc/systemd/system/csf-delayed-restart.timer

Insert:

[Unit]
Description=Delayed CSF restart after boot

[Timer]
OnBootSec=5min
Unit=csf-delayed-restart.service

[Install]
WantedBy=timers.target

Reload systemd and enable the timer:

systemctl daemon-reload

systemctl enable csf-delayed-restart.timer

Verify:

systemctl status csf-delayed-restart.timer

systemctl list-timers | grep csf

15. Configure Static IP

A production PBX should normally use a stable public IP address.

Before changing the network configuration, record the current settings:

ip addr

ip route

cat /etc/resolv.conf

Configure the static IP using the IP address, gateway, prefix/netmask, and DNS servers supplied by your VPS provider.

16. Configure Swap Space

Check whether swap is already configured:

free -h

swapon --show

If no swap is available, create an appropriately sized swap file based on the VPS memory and expected workload.

Swap should be treated as a safety mechanism and not as a replacement for adequate physical RAM.

17. Configure GeoIP-Based Fail2Ban Ignore

Create the GeoIP helper script:

nano /usr/local/bin/f2b-geoip-ignore

Insert:

#!/bin/bash

IP="$1"

if [ -z "$IP" ]; then
    exit 1
fi

/usr/bin/php -r '
$ip = $argv[1];
$country = geoip_country_code_by_name($ip);
exit($country === "BD" ? 0 : 1);
' "$IP"

Set the correct permissions:

chmod 755 /usr/local/bin/f2b-geoip-ignore

How It Works

The script receives an IP address from Fail2Ban and checks its country code.

• Exit code 0: Fail2Ban ignores the IP.
• Exit code 1: Fail2Ban does not ignore the IP.

In this configuration, IP addresses identified as BD (Bangladesh) are ignored.

18. Configure Fail2Ban for Asterisk

Create the custom Fail2Ban configuration:

nano /etc/fail2ban/jail.d/99-frank-custom.local

Insert:

[DEFAULT]

chain = F2B_INPUT

ignorecommand = /usr/local/bin/f2b-geoip-ignore <ip>


[asterisk]

enabled = 1

banaction = iptables-multiport-issabel

maxretry = 2
findtime = 600
bantime = 604800

ignoreip = 127.0.0.1

port = 0:65535

action = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]
         %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]
         %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s"]

Configuration Summary

Test Fail2Ban Configuration

Always test the configuration before restarting the service:

fail2ban-client -t

Expected result:

OK: configuration test is successful

Restart Fail2Ban:

systemctl restart fail2ban

Check the service:

systemctl status fail2ban

Check all active jails:

fail2ban-client status

Check the Asterisk jail specifically:

fail2ban-client status asterisk

19. Configure Let's Encrypt SSL Certificate and FOP2 HTTPS

For secure access to the Issabel web panel and FOP2 Operator Panel, point a subdomain such as pbx.yourdomain.com to the real public IP address of your Issabel PBX server.

Point a Subdomain to the Issabel PBX

Create an A record for your PBX subdomain:

pbx.yourdomain.com  ->  YOUR_PBX_REAL_IP

Wait for DNS propagation and confirm that the hostname resolves to the correct public IP address before requesting the certificate.

Install Let's Encrypt Certificate in Issabel

Open the Issabel administration panel and go to:

Issabel Panel > Security > HTTPS Certificate (Let's Encrypt)

Enter your PBX hostname (for example, pbx.yourdomain.com) and install the Let's Encrypt certificate.

Adjust FOP2 SSL Directory

After the certificate has been installed, open PuTTY and log in to your PBX server as root.

Update the FOP2 configuration so that it uses the Let's Encrypt certificate files:

sed -i 's#^ssl_certificate_file=.*#ssl_certificate_file=/etc/letsencrypt/live/pbx.yourdomain.com/fullchain.pem#' /usr/local/fop2/fop2.cfg

sed -i 's#^ssl_certificate_key_file=.*#ssl_certificate_key_file=/etc/letsencrypt/live/pbx.yourdomain.com/privkey.pem#' /usr/local/fop2/fop2.cfg

20. Final Reboot

After completing all configuration and verification steps, reboot the server:

reboot

After the server comes back online, allow approximately five minutes for the delayed CSF restart timer to execute.

21. Call Recordings Auto Delete (Optional)

Cron Job for auto deletion call record files 45 days old:

crontab -e

0 2 * * * find /var/spool/asterisk/monitor/ -type f \( -name "*.wav" -o -name "*.gsm" -o -name "*.WAV" \) -mtime +45 -exec rm -f {} \;

5 2 * * * find /var/spool/asterisk/monitor/ -mindepth 1 -type d -empty -delete

22. Final Verification Checklist

Before considering the server ready for production, verify the following:

• Alma/Rocky Linux 8 boots normally.
• SSH access works.
• VPS Console/VNC access works.
• Public IP address is correct.
• Default gateway is correct.
• DNS resolution works.
• Timezone is set to Asia/Dhaka.
• NTP synchronization is enabled.
• Issabel web interface loads correctly.
• Asterisk is running.
• The PBX subdomain resolves to the correct public IP address.
• The Let's Encrypt certificate is installed and valid.
• FOP2 is configured to use the Let's Encrypt certificate.
• CSF is running.
• Required CSF ports are open.
• SIP port forwarding works if configured.
• RTP ports are allowed.
• CSF delayed restart timer is enabled.
• Fail2Ban is running.
• The Asterisk Fail2Ban jail is active.
• The GeoIP helper script has executable permissions.
• GeoIP lookup works correctly.
• Swap is available if required.
• Webmin is accessible through the intended management path.

23. Useful Troubleshooting Commands

Check IP Address

ip addr

Check Routing

ip route

Check Time and NTP

timedatectl

Check Memory and Swap

free -h

swapon --show

Check CSF Rules

csf -l

Check Fail2Ban

systemctl status fail2ban

fail2ban-client status

Check Asterisk Fail2Ban Jail

fail2ban-client status asterisk

Test Fail2Ban Configuration

fail2ban-client -t

Check CSF Delayed Restart Timer

systemctl status csf-delayed-restart.timer

systemctl list-timers | grep csf

Check Asterisk

systemctl status asterisk

Deployment Summary

The recommended deployment sequence is:

1. Install Alma/Rocky Linux 8 Minimal.
2. Log in through VPS Console/VNC.
3. Enable EPEL.
4. Install Remi repository.
5. Enable PHP 7.4.
6. Reboot.
7. Install wget, nano, and unzip.
8. Install Issabel 5.
9. Complete the Issabel post-installation process.
10. Configure timezone and NTP.
11. Configure static IP.
12. Configure swap.
13. Install Webmin Minimal if required.
14. Configure CSF.
15. Configure custom SIP port forwarding.
16. Configure csfpost.sh.
17. Configure the delayed CSF restart service and timer.
18. Configure the GeoIP Fail2Ban helper.
19. Configure the Asterisk Fail2Ban jail.
20. Test Fail2Ban.
21. Point the PBX subdomain to the public IP address.
22. Install the Let's Encrypt certificate from Issabel.
23. Configure FOP2 to use the Let's Encrypt certificate.
24. Reboot the server.
25. Perform the final verification.