AUTHORIZATION SETTINGS

• The tab Settings / Administrators / Administrators) has been completely rewritten to the new interface with customized authorization settings for Scheduling module. Newly there are no assigned in global authorization rules for "Masteradmin" and "Main Admin" administrators but it is necessary to apply individual rules for all administrators for scheduling. Scheduling module can be visible for all administrators which have marked checkbox "Use scheduling". If the checkbox is not marked administrator has no option to see, add or customize tasks to scheduling.
• There are new 3 basic types of authorization rules for administrators for scheduling:
• 1) Administrator - Full rights. It means Administrator can see all tasks with full option to customize them, make a new scheduling plans, etc.
• 2) Leader - Full rights but only for particular group of technicians. In this case Leader is able to see all tasks with full option to customize them, make a new scheduling plans, etc. but only for particular group, so they are not able to see tasks of another leaders or their groups.
• 3) Technician - Can see only those tasks which has been assigned to them but cannot see tasks of another technician in the same or different group. In the case of enabled authorization Technician it is possible to individually customize additional authorization like add, change or delete tasks.
• Authorization for sending of e-mails with assigned in tasks or requests from Client portal can be enabled individually.
• By this update all authorization rules has been replaced from older version to the new one but it is recommended to check validity of this authorization rules because not all authorization rules can be replaced automatically.
• Authorization "Allowed Invoicing groups" - If a new invoicig group is added to the system, it will not be visible for all administrators automatically (except "Master Admin" authorization level) but it is necessary to allow visibility of the new group for particular administrator of the system.

VOIP SERVICE - BULK IMPORT OF PHONE NUMBERS

• In the case of active VOIP service for client, there is an button "Another IP phones" to assign anothe phone numbers for this service. To assign new phone numbers as bulk there is now also possible to "Add range of IP phone numbers" by clicking on particular button.

NAT ADDRESSES

• New tab added "Settings / IP Pools / IP Pools NAT". There it is possible to define ranges of IP addresses which are used to NAT private IP addresses of clients. Each NAT pool has option to assign in a router which is provided NAT on and also to define used IP addresses which will not be offered to clients in the system.

NEW SYSTEM VARIABLES

• $DVBC_PACKAGES$
• $DVBC_PACKAGES_PRICE_WITH_VAT$
• $DVBC_PACKAGES_PRICE_WITHOUT_VAT$

• $IPTV_DISCOUNT$
• $IPTV_FLAT_RATE$
• $IPTV_FLAT_RATE_NOTE$
• $IPTV_DEPOSIT$
• $IPTV_CONTRACT_RENEWAL$

• Further details about system variables are available under the tab "Settings / Contracts / Own templates".

GOOGLE MAPS - COORDINATES

• If in the client card are incorrect coordinates for displaying location on Google maps, the system runs internal script (once per day) which will set up correct coordinates at those clients. Google API has limited number of attempts for location corrections (one-hundred times per day), so when the daily limit is exceeded script will be ran next day to continue.

PHOTOGALLERY - EXIF INFORMATION

• Adding of photos to client card now also includes EXIF information which are displayed below photo preview. Currently system save information about taken date, device model and GPS coordinates of photo taken location (if available). If coordinates are retrieved system will display also "Earth" icon below the photo preview to display location on Google maps by clicking on the icon.
• By clicking on the photo to display it in larger window there are also displayed EXIF information, if available.
• Retrieving of EXIF information is available for new uploaded photos only.

INTERNET SERVICE

• Maps are now displayed in Change service INTERNET, and loaded after the initial page load. The page is now able to load faster (up to 50%).
• When editing the pop-menu "Router" it displays Active routers first and underneath are Monitored routers. They are separated by the title Active and Monitored.

IP NAT POOLS

• In the tab "Settings / IP pools / IP pools NAT" an option in the table for clicking "Number of engaged IP addresses" was added, to display the list of engaged IP addresses.

TV

• Now it's possible to use the service Sledovanitv.cz in combination with ISPadmin. Clients are identified by IP addresses in their Active Internet services. After the browser displays the URL of sledovanitv.cz, he is rerouted to ISPadmin (https://[isp.example.cz]/new/www/sledovani-tv/identify) , which identifies the client and invokes a reroute to the sign in form on sledovanitv.cz. If the Client needs an list of TV stations for VLC, their is the possibility of using the URL https://[isp.example.cz]/new/www/sledovani-tv/channels, which returns, after authentication, a list of TV channels.
• After commissioning , it is necessary to agree on Rerouteing with sledovanitv.cz s.r.o from their URL sledovanitv.cz to ISPadmin ISPadmina https://[isp.example.cz]/new/www/sledovani-tv/identify

Send and receive SMS via the protocol SMPP

• Added support for sending and receiving SMS via the Internet protocol SMPP. If a SMS gateway (for example 2N VoiceBlue) supports the SMPP protocol, it is possible for the system to send and receive SMS. The gateway is connected via Ethernet and ISPadmin is communicating via the TCP / IP protocol. The main advantage is that the gate does not have to be placed directly next to the ISPadmin server, but can also be located anywhere (e.g., in another server room). So it can be used in combination with virtualization, where it is sometimes difficult to map a serial or USB port on an SMS gateway to a specific virtual installation.
• In the tab Settings Syst. settings General, it is now possible to set up new parameters:
  • sms_notify: sett value to 3 for SMPP protocol usage.
  • sms_smpp_ip_address: IP address of the SMS gateway
  • sms_smpp_login: login name
  • sms_smpp_password: login password
• Accordingly it is possible to send SMS to clients, send automatic system notifications and notices

GOOGLE MAPS

• In the tab Other Map, a new filter All states of clients and All Routers is added. By selecting the filter states of clients all clients belonging to this state are displayed on the map and the same applies for the Router filter.

INFO PAGE

• New Tab Settings Info Page Inf. messages.
• A new filter in Tariff internet was added. It is now possible to inform only clients with a specific internet tariff.
• A new column No. of clients was added. It displays the count of clients that are affected by an information message, it can be clicked on to display a list of affected clients.

SYSTEM VARIABLES

• New system variables for the service Mobile were added:
  • $MOBILE_NAME$ - Service name
  • $MOBILE_STREET_INST$ - Street (of installation)
  • $MOBILE_CITY_INST$ - City (of installation)
  • $MOBILE_Postcode_INST$ - Postcode Code (of installation)
  • $MOBILE_FLAT_INST$ - apartment(of installation)
  • $MOBILE_FLOOR_INST$ - floor(of installation)
  • $MOBILE_CONNECTED_FROM$ - connected from (date)
  • $MOBILE_INVOICED_FROM$ - invoiced from (date)
  • $MOBILE_INVOICING_PERIOD$ - invoicing period (date)
  • $MOBILE_CONTRACT_NUMBER$ - contract Number
  • $MOBILE_PRICE_WITH_VAT$ - price per month incl. VAT
  • $MOBILE_PRICE_WITHOUT_VAT$ - price per month excl. VAT
• New rewritten system variables page (in the tab Settings Contracts / List of system variables). Now it is possible to hide or display individual sections of the system variables.
• The configuration of system variables is moved to a new tab (Settings Code lists Syst. variables).

SENDING AND RECEIVING SMS OVER THE SMPP PROTOCOL

• In the tab Settings Syst. settings General, it is now possible to set new parameters.
  • sms_smpp_port: TCP Port for the communication between a SMPP gateway.
  • sms_smpp_sender: sender identification.

SYSTEM VARIABLES

• New system variables for the service Internet were added.
  • $INT_PRICE_WITH_VAT_INV_PERIOD$: The price for an invoice period with VAT
  • $INT_PRICE_WITHOUT_VAT_INV_PERIOD$: The price for an invoice period without VAT

• New system variables for the service IPTV:
  • $IPTV_CONTRACT_LIFETIME$: Minimal duration of a contract

DASHBOARD

• Dashboard has been introduced into the system. Important information from ISPadmin can now be displayed on one screen.
• After you login to the system, a Dashboard icon is displayed in the upper toolbar, and opens Dashboard in a new window.
• It is recommended to be used on a separate screen where Dashboard is run with certain settings.
• Dashboard comprises of various panels, Widgets. You can set displayed widgets with a button in the upper right corner. Each widget can be individually configured, e.g. refresh time or colour scheme. Any configuration is stored individually for each administrator.
• There is a Fullscreen button in the upper left corner.
• There are following widgets available at the moment:
  • Scheduled Outages: all scheduled outages are displayed, active ones are highlighted in red.
  • Routers CPU load: routers with higher CPU load are displayed. You can set the CPU load value in widget settings.
  • Received SMS: all received SMS are displayed; the same values as in Statistics History. You can set a number of days for displaying received SMS.
  • Offline routers: offline routers are displayed with off-line time

DASHBOARD

• Nagios Notification widget added.
• To display Nagios notifications in the Dashboard, you have to create a Dashboard template in Settings Code lists Nagios Templates. Then you create Contact group with Dashboard type in Settings Code lists Nagios Contacts. And finally, check a box in Report outages for Nagios section for monitored device in Hardware Routers.

Detecting and removing

Reacting to the revealed vulnerability, we released ISPadmin, version 4.20, which included a utility for detecting and curing infected Ubiquiti units. Due to the emergency situation we released the very first version of the utility quickly.

Now we are presenting the utility with enhanced functionalities.

Run the utility from ISPadmin console (connected via SSH) under root user, ISPadmin does not detect anything automatically!

/usr/local/script/ispadmin/ubnt_vulnerability_test.pl

When running the utility without any parameter, help is displayed.

Check devices from ISP admin bookmark ROUTERS
/usr/local/script/ispadmin/ubnt_vulnerability_test.pl check <username> <username2> <username3> <username4> <username5> - show ONLY vulnerable and infected ROUTERS ( AP )


Tests all Ubiquiti units inserted in Hardware Routers. If you run this command, the system tries to attack the unit, and if it succeeds, the console displays information with IP address and firmware version. If the system succeeds in connecting to Ubiquiti unit, it tries to determine whether there is the virus or not. If yes, it displays such information in the console. Nothing else. When 10 units are tested, a dot appears on the screen to show you that the script is still running and testing other units.


Check devices like AP ....( may take a long time )
/usr/local/script/ispadmin/ubnt_vulnerability_test.pl checkdevices <username> <username2> <username3> <username4> <username5>
  - show ONLY vulnerable and infected devices ( Acces points )

Tests all devices inserted as “Device attached to device” in Hardware Routers. In this case, the utility doesn´t care about device type since such information might not be available here. The utility tries to attack all IP addresses. If there are a lot of devices in your system, this might take a long time.

Check END USER devices ....( may take a long time )
/usr/local/script/ispadmin/ubnt_vulnerability_test.pl checkusers <username> <username2> <username3> <username4> <username5>
    - show ONLY vulnerable and infected client end device

Tests all IP addresses assigned to clients. The system tests all client-assigned IP addresses for it does not know whether a client has Ubiquiti device, or not. This operation might take a long time, since all IP addresses in the system are tested.

Clean INFECTED devices ( from previous check )
/usr/local/script/ispadmin/ubnt_vulnerability_test.pl cleaninfected
   - show vulnerable and infected devices and  REMOVE infection

If an infected unit is detected in the previous step, you may clean it this way. This operation connects to and cleans just those units, which are marked as infected. It means that prior to this step you have to run the utility with parameters check, checkdevices, or checkusers. Failing this no units are marked as infected and using parameter “cleaninfected” makes no difference.

A mandatory parameters are: check, checkdevices, checkusers, or cleaninfected. You may use user names, which you use for login to Ubiquiti units as an optional parameter. This is needed in cases when a key is stored in Ubiquiti unit after being attacked to enable login via ssh without password. You need to know the user name with which you connect to the system. If unknown, you won´t be able to connect. While running the vulnerability test, a default user name ubnt and user admin are tested. If you use neither of these, the script won´t be able to test vulnerability hence the need for entering a different username used for accessing the unit (no need for password). Then the system will try using these usernames.

Listing of UBNT units in ISPadmin

When you log into ISPadmin, you will see information about Vulnerability of UBNT devices:

In Other Tools > Vulnerability of UBNT devices, you will find a tool for displaying vulnerable devices as detected by the utility - see above.

Modified script

When running
/usr/local/script/ispadmin/ubnt_vulnerability_test.pl
with check, checkdevices, checkusers, or cleaninfected parameter, a dialog will be displayed, and you will be able to specify the following parameters:

Help

Check  devices from ISP admin bookmark ROUTERS
/usr/local/script/ispadmin/ubnt_vulnerability_test.pl check             - show ONLY vulnerable and infected ROUTERS ( AP )

Check devices like AP ....( may take a long time )
/usr/local/script/ispadmin/ubnt_vulnerability_test.pl checkdevices      - show ONLY vulnerable and infected devices ( Acces points )

Check  END USER devices ....( may take along time )
/usr/local/script/ispadmin/ubnt_vulnerability_test.pl checkusers        - show ONLY vulnerable and infected client end device

Clean INFECTED devices ( from previous check )
/usr/local/script/ispadmin/ubnt_vulnerability_test.pl cleaninfected     - show vulnerable and infected devices and  REMOVE infection

More on Ubiquiti - security bug in changelog version 4.21, beta1.

Generation of Contracts

• The process of bulk creation of contracts has been implemented into the system replacing the old “Bulk contracts” from Other Bulk Document. This has been discontinued.
• You may generate bulk contracts in Settings Contracts Bulk.
• It is just like an individual contract, except there are filters to select certain clients who you are creating the contracts for. You can also select a type of active service thus creating the number of contracts according the the number of services.
• You can also use system variables, and an automatic transfer to PDF.
• You will see who and when generated bulk contracts, and how many contracts were generated. You can use the number to click on it and display a list of contracts.
• By deleting a contract, you will remove the contract from client´s account.
• Bulk contract is marked as Bulk contract in Client card.

Other

• There is a new item in Other Tools - Check e-mail addresses. When you click on the Continue button, a list of clients with wrong e-mail addresses will be displayed.
• There is a new item in Other Tools - Bulk configuration of NAGIOS notifications (for selected device types).
• There is a new option in Other Tools - Suspend your Client portal. When you click on the Continue button, you can enter a message that will be displayed to your clients.

Other

• The Other Wiki page has been rewritten.

Other

• The Bulk e-mail form (Other Bulk E-mail) now includes a filter for contracts that are about to expire, which will make it much easier for you to send notifications to clients informing them that their contract is about to expire.
• The Other Contact page has been rewritten.

OTHER

• The following pages have been rewritten in Other:
  Free SMS
  ToolsMAC address duplicities
  ToolsMAC address duplicities in Access List
  ToolsClient graphs
  ImportVoIP overviews
• Other Bulk E-mail: You can choose the Enter custom email option in the Sender menu and then enter an email address and a name. This option can come in handy if you do not want to use one of the system email addresses as sender address.
• Scheduling Calendar - Settings: Show unspecified tasks checkbox has been added.
• Ramdisk functionality has been modified. In addition to daily backups, the system now stores 2 most recent monthly backups (as of 28th of each month) as well. We strongly recommend that you run /usr/local/script/ispadmin/rrd_ramdisk.pl stop each time you restart/switch off the system. This way you ensure that the current ramdisk backup is stored and ramdisk is correctly stopped. When the system is restarted, ramdisk will be restored automatically from the last correct backup.
• Depiction of graphs of shared tariffs has been fixed.
• Number of records triggering the delete warning has been optimized in Statistics History.
• A new Overview of displayed info page tool has been created in Other Tools. It shows if an info page was displayed to a client and if this client confirmed it, or not.
• A bug in sending emails to gTLD domains with more than 4 chars has been fixed.

Other

• The  Other Tools / Mikrotik script page has been rewritten.

Other

• The Other Map page has been rewritten and enhanced. If you are experiencing any problems with the display of data on the map, please check whether you have entered the public IP address of the ISPadmin server in the ispadmin_public_address item in Settings Syst. settings General.
• The Tariff change tool in Other Tools has been rewritten.

OTHER

• Other Bulk E-mail: A new filter has been added to the form - Access point.
• Other Free SMS: Now you can enter more than one phone number into the field provided. Numbers must be separated by commas or semicolons.
• The Overdue payment tool in Other Tools has been removed: Overdue invoices can be viewed in Invoicing Overviews Debts Debts.
• The E-mail history tool in Other Tools has been removed: Emails can now be deleted in Statistics History Settings.

OTHER

• The Other Import VoIP import page has been rewritten.
• The Other Backups System page has been rewritten.
• Bug fix - Other Bulk E-mail - A server error occurred when the template was removed.

OTHER

• Bug fix - In some parts of the world, the map showed the wrong location for routers.