Ctrl K
ring2all.com

Provisioning Security Settings Module Documentation

Table of Contents

  1. Module Overview (Technical)
  2. Module Overview (Commercial/Business)
  3. Module Overview (End User/Administrator)
  4. Configuration Fields
  5. Common Scenarios & Examples
  6. Limitations & Important Notes
  7. Troubleshooting Tips
  8. Glossary

---

1. Module Overview (Technical)

What Is Provisioning Security Settings?

Provisioning Security Settings is a provisioning authentication module that configures HTTP Basic Authentication for device configuration requests. It protects provisioning files from unauthorized access.

Architecture

Plaintext
┌─────────────────────────────────────────────────────────────────┐
│          Provisioning Security Architecture                    │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  IP Phone                                                       │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │  Device Request                                          │   │
│  │                                                          │   │
│  │  GET /provisioning/AA-BB-CC-DD-EE-FF.cfg                │   │
│  │  Authorization: Basic dXNlcjpwYXNz                      │   │
│  │                                                          │   │
│  └──────────────────────────────────────────────────────────┘   │
│       │                                                         │
│       ▼                                                         │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │        Nginx Proxy                                       │   │
│  │                                                          │   │
│  │  Security Enabled?                                       │   │
│  │  ├─ Yes → Validate credentials                          │   │
│  │  │        ├─ Valid → Serve config file                  │   │
│  │  │        └─ Invalid → 401 Unauthorized                 │   │
│  │  │                                                       │   │
│  │  └─ No → Serve config file directly                     │   │
│  │                                                          │   │
│  └──────────────────────────────────────────────────────────┘   │
│       │                                                         │
│       ▼                                                         │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │        Provisioning Files                                │   │
│  │                                                          │   │
│  │  /var/www/provisioning/                                 │   │
│  │  ├─ AA-BB-CC-DD-EE-FF.cfg                              │   │
│  │  ├─ 11-22-33-44-55-66.cfg                              │   │
│  │  └─ .htpasswd (generated credentials)                  │   │
│  │                                                          │   │
│  └──────────────────────────────────────────────────────────┘   │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Key Files

FileDescription
modules/provisioningSecurity/Frontend module
.htpasswdGenerated password file
Nginx configAuth configuration
---

2. Module Overview (Commercial/Business)

Business Value

Provisioning Security provides configuration protection:

Without SecurityWith Security
Open accessAuth required
Config exposureProtected files
No credentialsUsername/password
Security riskAccess control

Use Cases

  1. Secure Deployments

- Protect device configs

- Prevent unauthorized access

  1. Credential Protection

- Hide SIP passwords

- Secure extension data

  1. Compliance

- Access control audit

- Security requirements

  1. Multi-tenant Security

- Isolated configurations

- Per-domain credentials

Feature Highlights

FeatureBenefit
HTTP Basic AuthStandard authentication
Enable/DisableToggle security
Username/PasswordSimple credentials
Nginx IntegrationWeb server auth
Password FileAuto-generated htpasswd
---

3. Module Overview (End User/Administrator)

What Can You Do?

  • Enable/disable provisioning security
  • Set authentication username
  • Set authentication password
  • Generate htpasswd file
  • Protect device configurations

Provisioning Security Interface

Plaintext
┌─────────────────────────────────────────────────────────────────┐
│              Provisioning Security Settings                     │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Authentication Settings                                        │
│                                                                 │
│  Enable Security (HTTP Basic Auth): ✓                          │
│                                                                 │
│  Username: [provisioning            ]                          │
│    Username for provisioning authentication                     │
│                                                                 │
│  Password: [••••••••••••            ]                          │
│    Password for provisioning authentication                     │
│                                                                 │
│  ──────────────────────────────────────────────────────────────│
│                                                                 │
│  ⓘ Note:                                                       │
│  • Enabling this will require devices to valid authenticate    │
│    when requesting configuration files.                         │
│  • Ensure your Nginx server is configured to use the           │
│    generated password file.                                     │
│                                                                 │
│  [Save]                                                         │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Quick Tips

TIP
Device Configuration: Configure matching credentials on phones.
TIP
Strong Password: Use complex passwords for security.
WARNING
Nginx Required: Ensure Nginx is configured to use the password file.

---

4. Configuration Fields

Authentication Settings

FieldDescription
Enable SecurityToggle HTTP Basic Auth
UsernameAuth username
PasswordAuth password

Generated Files

FilePurpose
.htpasswdApache/Nginx password file
Nginx configAuth location directive
---

5. Common Scenarios & Examples

Scenario 1: Enable Security

  1. Navigate to Provisioning Security Settings
  2. Check "Enable Security (HTTP Basic Auth)"
  3. Enter username (e.g., "provisioning")
  4. Enter strong password
  5. Click Save
  6. Configure Nginx to use password file

Scenario 2: Disable Security

  1. Navigate to Provisioning Security Settings
  2. Uncheck "Enable Security"
  3. Click Save
  4. Note: Configs now accessible without auth

Scenario 3: Change Credentials

  1. Navigate to Provisioning Security Settings
  2. Update username and/or password
  3. Click Save
  4. Update credentials on all devices

Scenario 4: Configure Phones

  1. Enable security in web interface
  2. On each phone, set provisioning credentials:

- Provisioning URL

- Username

- Password

  1. Reboot phones to apply

---

6. Limitations & Important Notes

Technical Notes

NOTE
Nginx Configuration: Manual Nginx setup may be required.
NOTE
Device Support: All modern IP phones support HTTP Basic Auth.
WARNING
Credential Update: Changing credentials requires updating all devices.

Best Practices

  1. Enable in Production: Always enable for production deployments
  2. Strong Passwords: Use complex, unique passwords
  3. HTTPS Recommended: Use HTTPS to encrypt credentials in transit
  4. Document Credentials: Keep secure record of credentials
  5. Test After Changes: Verify devices can still provision

Nginx Configuration Example

Nginx
location /provisioning {
    auth_basic "Provisioning";
    auth_basic_user_file /path/to/.htpasswd;
    
    root /var/www;
    autoindex off;
}

Phone Configuration

VendorSetting
YealinkProvisioning → Authentication
GrandstreamMaintenance → Upgrade → Auth
PolycomConfig → Provisioning → User/Pass
---

7. Troubleshooting Tips

Common Issues

SymptomPossible CauseSolution
401 UnauthorizedWrong credentialsCheck username/password
Phones not provisioningAuth not enabled on phoneConfigure phone auth
htpasswd not foundPath incorrectCheck file location
Nginx errorConfig not reloadedReload Nginx

Test Authentication

Bash
# Test provisioning URL with auth
curl -u username:password https://server/provisioning/test.cfg

# Test without auth (should fail if enabled)
curl https://server/provisioning/test.cfg

Check htpasswd File

Bash
# View htpasswd file
cat /path/to/.htpasswd

# Verify password (htpasswd tool)
htpasswd -v /path/to/.htpasswd username

Reload Nginx

Bash
# Test configuration
nginx -t

# Reload
systemctl reload nginx

---

8. Glossary

TermDefinition
HTTP Basic AuthStandard web authentication
htpasswdApache/Nginx password file
ProvisioningAutomatic device configuration
401 UnauthorizedAuthentication required/failed
CredentialsUsername and password pair
---

Lua Script Status ℹ️

Configuration Module

ComponentStatus
Provisioning Securityℹ️ Configuration - generates htpasswd file
Provisioning Security Settings is a configuration module. It generates the htpasswd file used by Nginx for HTTP Basic Authentication. No Lua handlers are required.

---

Documentation last updated: January 2026
AI Assistant

👋 Hello! I'm your Ring2All documentation assistant. I can help you find information about configuring and using the Ring2All PBX platform.

How can I help you today?