Free voice recording with Oreka on ESXi

   If you need a free voice recording software - the good choice is Oreka GPL. It is stable and easy to use. Still it has some limitations. For example, it is impossible to delete old audio files automatically (this can be fixed in the future, but it doesn't work for 1.2 version). So we have a choice to use some commercial soft or to improve Oreka GPL functionality. This post describes a simple and free voice recording solution for small sites based on Oreka GPL under ESXi VM.

   The solution is fairly universal but it was first tested in a simple lab network: Cisco 2811 router with PVDM2-16 on board, Catalyst 2960, IBM x3250 server, 2 Cisco 7962G IP phones.

   Internet connection is mandatory for 'yum install' to work, otherwise you can spend your free time looking for packages. Oreka GPL doesn't use any kind of CTI sorcery. It relies on simple SPAN or RSPAN to intercept every RTP and signalling packet, extract information and record it. For above example SPAN configuration on C2960 is simple, just redirect all traffic from IP-phones to Oreka VM:

monitor session 1 source interface Gi0/18 - 19
monitor session 1 destination interface Gi0/17

   CAUTION! A dedicated physical port for voice recording VM is mandatory. It is impossible to use ESXi/Oreka VM management port for this purpose.
   It is not necessary to use virtualization for voice recording. But the server is valuable. With the help of ESXi it is possible to virtualize it for free and keep some spare resources. ESXi installation and configuration procedures are not documented here, I assume that you already have some experience with this software.
   It seems reasonable to install Oreka under CentOS, because it is free, lightweight OS and it is well supported by Oreka community.
   So, let's start!

   1) Create new VM. Choose Linux, Centos 4/5 (32-bit) under 'Guest Operating System' tab. I'd recommend to configure 3-4 Gb virtual disk for a lab VM. If you plan to implement this VM in real network environment, calculate disk space carefully, or choose 'Allocate and commit space on demand' to let disk file grow. Remove floppy drive from VM configuration (CD/DVD drive can be removed after successful CentOS installation).
   2)Create new vSwitch with one physical adapter dedicated for voice recording.

   3)Add new Ethernet Adapter to Oreka VM configuration. The first Ethernet Adapter (management) will be connected to management network.

The second adapter (recording) have to be connected to vSwitch dedicated for voice recording.

   4) Configure OS image under 'CD/DVD Drive' tab, power on VM and install operating system. In the network devices tab configure management interface, hostname, default gateway and DNS servers. Do not enable voice recording interface.

Do not install Gnome or KDE or any additional packages (it is not prohibited, but not necessary). Customize installation to remove any excess software.
   5) Use ssh and connect to Oreka VM management IP. I'll use root account. You can create another one to improve security, but I believe it is not strictly necessary in this particular case.
   6) (Optional) Change voice recording interface to promiscuous mode. Type

vi /etc/rc.d/rc.sysinit

and add the following line (eth1 - voice recording interface):

ifconfig eth1 promisc

   7) Edit /etc/sysconfig/network-scripts/ifcfg-eth1 to activate voice recording interface, do not use DHCP or any static IP. Here is the sample:

# Advanced Micro Devices [AMD] 79c970 [PCnet32 LANCE]
DEVICE=eth1
BOOTPROTO=static
HWADDR=00:0C:29:7C:73:5D
ONBOOT=yes
HOTPLUG=no

   8) Restart network services:

/etc/init.d/network restart

   9) Check configuration:

[root@oreka-voice-rec ~]#ifconfig eth1
Link encap:Ethernet HWaddr 00:0C:29:7C:73:5D
inet6 addr: fe80::20c:29ff:fe7c:735d/64 Scope:Link
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:3 errors:0 dropped:0 overruns:0 frame:0
TX packets:5 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:180 (180.0 b) TX bytes:398 (398.0 b)
Interrupt:67 Base address:0x2080

   10) Copy Oreca installer to some VM directory.

[root@oreka-voice-rec ~]# cd /usr/tmp
[root@oreka-voice-rec tmp]# ftp x.x.x.x
[root@oreka-voice-rec tmp]# ftp x.x.x.x
Connected to x.x.x.x (x.x.x.x).
220-FileZilla Server version 0.9.36 beta
220-written by Tim Kosse (Tim.Kosse@gmx.de)
220 Please visit http://sourceforge.net/projects/filezilla/
Name (x.x.x.x:root): ftp
331 Password required for ftp
Password:
230 Logged on
Remote system type is UNIX.
ftp> binary
200 Type set to I
ftp> get orkaudio-1.2-671-os-i386.centos5-installer.sh.tar
local: orkaudio-1.2-671-os-i386.centos5-installer.sh.tar remote: orkaudio-1.2-671-os-i386.centos5-installer.sh.tar
227 Entering Passive Mode (10,2,96,2,255,41)
150 Connection accepted
226 Transfer OK
17367040 bytes received in 1.64 secs (1e+04 Kbytes/sec)
ftp> quit
221 Goodbye
[root@oreka-voice-rec tmp]# ls
orkaudio-1.2-671-os-i386.centos5-installer.sh.tar

   11) Extract archive content and install Oreka (check Internet connectivity first):

[root@oreka-voice-rec tmp]# tar -xvf orkaudio-1.2-671-os-i386.centos5-installer.sh.tar

   12) Execute Oreka installer:

[root@oreka-voice-rec tmp]# ./orkaudio-1.2-671-i386.centos5-installer.sh

   13) To configure orkaudio simply change /etc/orkaudio/config.xml file. First make a bakup:

cp /etc/orkaudio/config.xml /etc/orkaudio/config.xml-initial

then change <devices> string in the <voipplugin> block to select recording interface:

<devices>eth1</devices>

   14) It is possible to start orkaudio service and record some voice now, but it is reasonable to think about audio retrieval first. You can use OrkWeb/OrkTrack, but it seems to be a raw solution: only IE browser support, DNS mandatory, no built in features for user and their privileges administration, etc. I'll think about another post about OrkWeb/OrkTrack improvement, but for now I propose a simple and secure solution - FTP with virtual users for authentications. Comment or delete following lines in /etc/orkaudio/config.xml:

<!--<TrackerHostname>localhost</TrackerHostname>-->
<!--<TrackerTcpPort>8080</TrackerTcpPort>-->

First we need a good naming scheme to distinguish files by calling/called party, date, time, etc. Lets change default naming by <tapefilenaming> tag in /etc/orkaudio/config.xml. Change <TapeProcessors> and add <TapeFileNaming> lines:

<TapeProcessors>BatchProcessing, TapeFileNaming</TapeProcessors>
<tapefilenaming>[year],-,[month],-,[day],_,[hour],-,[min],-,[sec],_,[shortdirection],_remote-,[remoteparty],_local-,[localparty]</tapefilenaming>

The sample file name under this scheme will be:

2010-10-20_16-44-23_in_remote_201_local_102.wav

   15) Next install MySQL-server to store virtual users accounts. You can use your favourite database here.

yum install mysql-server

   16) Start orkaudio and MySQL services:

[root@voice-rec-lab ~]# chkconfig ––list orkaudio
orkaudio 0:off 1:off 2:on 3:on 4:on 5:on 6:off
[root@voice-rec-lab ~]#service orkaudio start
Starting orkaudio ... Starting orkaudio daemon ... (type 'orkaudio debug' if you prefer running attached to tty) started.
[root@voice-rec-lab ~]# chkconfig ––level 2345 mysqld on
[root@voice-rec-lab ~]# chkconfig ––list mysqld
mysqld 0:off 1:off 2:on 3:on 4:on 5:on 6:off
[root@voice-rec-lab ~]# /etc/init.d/mysqld start

   17) Start /usr/bin/mysql_secure_installation to accomplish following tasks:
   1. set new MySQL root user password;
   2. remove anonymous users;
   3. disallow root login remotely;
   4. remove test database.
   18) We'll use vsftpd as FTP server. vsftpd needs pam-module to access MySQL database. Get and install it:

[root@oreka-voice-rec tmp]# wget ftp://ftp.pbone.net/mirror/centos.karan.org/el5/extras/testing/i386/RPMS/pam_mysql-0.7-0.5.rc1.el5.kb.2.i386.rpm
[root@oreka-voice-rec tmp]# rpm -Uvh pam_mysql-0.7-0.5.rc1.el5.kb.2.i386.rpm
[root@oreka-voice-rec tmp]# ls -al /lib/security/pam_m*
-rwxr-xr-x 1 root root 8024 Mar 11 2010 /lib/security/pam_mail.so
-rwxr-xr-x 1 root root 15848 Mar 11 2010 /lib/security/pam_mkhomedir.so
-rwxr-xr-x 1 root root 3892 Mar 11 2010 /lib/security/pam_motd.so
-rwxr-xr-x 1 root root 36920 Feb 28 2008 /lib/security/pam_mysql.so

   19) Create a database to store virtual users accounts for FTP authentication:

[root@voice-rec-lab ~]# mysql -u root -p
Enter password:

mysql> CREATE DATABASE orekaftp;
mysql> GRANT SELECT ON orekaftp.* TO 'orekaftp'@'localhost' IDENTIFIED BY 'orekaftppassword';
mysql> FLUSH PRIVILEGES;
mysql> USE orekaftp;
mysql> CREATE TABLE `accounts` (
-> `id` INT NOT NULL AUTO_INCREMENT PRIMARY KEY ,
-> `username` VARCHAR( 30 ) NOT NULL ,
-> `pass` VARCHAR( 50 ) NOT NULL ,
-> UNIQUE ( `username` )
-> ) ENGINE = MYISAM ;
mysql> exit;

   20) Add 'orekaftp' user to allow vsftpd access 'orekaftp' database by its name:

useradd -G users -s /bin/false -d /home/orekaftp orekaftp

   21) Install vsftpd:

[root@oreka-voice-rec tmp]# yum install vsftpd
[root@oreka-voice-rec tmp]# chkconfig ––level 2345 vsftpd on
[root@oreka-voice-rec tmp]# chkconfig ––list vsftpd
vsftpd 0:off 1:off 2:on 3:on 4:on 5:on 6:off

   22) Backup initial vsftpd configuration file and create new one:

[root@oreka-voice-rec tmp]# cp -v /etc/vsftpd/vsftpd.conf /etc/vsftpd/vsftpd.conf-initial
[root@voice-rec-lab ~]# cat /dev/null > /etc/vsftpd/vsftpd.conf
[root@voice-rec-lab ~]# vi /etc/vsftpd/vsftpd.conf

Then copy-paste (change if you need, the text is derived from /usr/share/doc/vsftpd-2.0.5/EXAMPLE/VIRTUAL_USERS/vsftpd.conf):

anonymous_enable=NO
# Allow 'local' users with WRITE permissions (0755)
local_enable=YES
write_enable=NO
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
nopriv_user=orekaftp
chroot_local_user=YES
listen=YES
# here we use the authentication module for vsftpd to check users name and passw
pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES
# here the vsftpd will allow the 'orekaftp' user to login into /var/log/orkaudio/audio directory
guest_enable=YES
guest_username=orekaftp
local_root=/var/log/orkaudio/audio
user_sub_token=$USER
virtual_use_local_privs=YES
user_config_dir=/var/log/orkaudio/audio
/var/log/orkaudio/audio is the default directory for oreka audio files.

   23) Create pam file:

[root@voice-rec-lab ~]# cp /etc/pam.d/vsftpd /etc/pam.d/vsftpd-initial
[root@voice-rec-lab ~]# cat /dev/null > /etc/pam.d/vsftpd
[root@voice-rec-lab ~]# vi /etc/pam.d/vsftpd

Copy-paste:

#%PAM-1.0
session optional pam_keyinit.so force revoke
auth required pam_mysql.so user=orekaftp passwd=orekaftppassword host=localhost db=orekaftp table=accounts usercolumn=username passwdcolumn=pass crypt=3
account required pam_mysql.so user=orekaftp passwd=orekaftppassword host=localhost db=orekaftp table=accounts usercolumn=username passwdcolumn=pass crypt=3

   24) Create users in MySQL database:

[root@voice-rec-lab ~]# mysql -u root -p
Enter password:
mysql> USE orekaftp;
mysql> INSERT INTO accounts (username, pass) VALUES('audiouser', md5('audiopass'));
mysql> select * from accounts;
+----+-----------+----------------------------------+
| id | username | pass
+----+-----------+----------------------------------+
| 1 | audiouser | df8b77f1435f48ea38342498cf2de87b
+----+-----------+----------------------------------+
mysql> exit;

   25) Create /var/log/orkaudio/audio if it is not yet created by orkaudio, change owner, set right permissions and start vsftpd (don't forget to configure firewall, if you have installed it, for incoming FTP):

[root@voice-rec-lab ~]# mkdir /var/log/orkaudio/audio
[root@voice-rec-lab ~]# chown orekaftp:users /var/log/orkaudio/audio
[root@voice-rec-lab ~]# setfacl -m d:u:root:rwx /var/log/orkaudio/audio/
[root@voice-rec-lab ~]# setfacl -m d:g:root:rwx /var/log/orkaudio/audio/
[root@voice-rec-lab ~]# setfacl -m d:o:r-x /var/log/orkaudio/audio/
[root@voice-rec-lab ~]# getfacl /var/log/orkaudio/audio/
getfacl: Removing leading '/' from absolute path names
# file: var/log/orkaudio/audio
# owner: orekaftp
# group: users
user::rwx
group::r-x
other::r-x
default:user::rwx
default:user:root:rwx
default:group::r-x
default:group:root:rwx
default:mask::rwx
default:other::r-x
[root@voice-rec-lab ~]# service vsftpd restart

   26) At this point you can record VoIP and access audio files, but it is necessary to remove old files periodically to clean disk space. Let's write a simple shell script:

[root@oreka-voice-rec tmp]# cd /etc/cron.weekly/
[root@oreka-voice-rec cron.weekly]# vi audio.removal.sh

Copy-paste (it is not necessary optimal, but it works):

#!/bin/sh
#This script removes files and empty subdirectories older then 31 day in specific directory
#Author: Ankudinov Petr
#Version 0.1 beta
#set directory to clean from old files
defined_dir='/var/log/orkaudio/audio'
#set maxage for old files, days
maxage=31
cd $defined_dir
if [ -n "$(ls)" ]; then
  for path in $(find -mtime +$maxage); do
    if [ -e $path ]; then
      if [ -d $path ]; then
        cd $path;
      else
        # optional feedback
        # echo "Old file $path was erased.";
        target_dir="$(dirname "$path")";
        rm -f $path;
        cd "$target_dir";
      fi
      target_dir="$(pwd)";
      while [ "$target_dir" != "$defined_dir" ]; do
        if [ -n "$(ls)" ]; then target_dir="$defined_dir"
          else cd ..;
          # optional feedback
          # echo "Old empty directory $target_dir was erased.";
          rm -rf $target_dir;
          target_dir="$(pwd)";
        fi
      done
      cd $defined_dir
    fi
  done
fi
#rotate log files (for oreka only)
cd /var/log/orkaudio/
#
if [ -e "messages.log.previous.week" ]; then rm -f messages.log.previous.week; fi
if [ -e "orkaudio.log.previous.week" ]; then rm -f orkaudio.log.previous.week; fi
if [ -e "tapelist.log.previous.week" ]; then rm -f tapelist.log.previous.week; fi
#
if [ -e "messages.log" ]; then cp messages.log messages.log.previous.week; rm -f messages.log; fi
if [ -e "orkaudio.log" ]; then cp orkaudio.log orkaudio.log.previous.week; rm -f orkaudio.log; fi
if [ -e "tapelist.log" ]; then cp tapelist.log tapelist.log.previous.week; rm -f tapelist.log; fi

Change permissions:

chmod +x audio.removal.sh

   27) Configure NTP synchronization:

[root@oreka-voice-rec ~]# yum install ntp
[root@oreka-voice-rec ~]# cat /etc/sysconfig/ntpd | grep -i HWC -B 1
# Set to 'yes' to sync hw clock after successful ntpdate
SYNC_HWCLOCK=no
Set 'SYNC_HWCLOCK' to 'yes', add servers to /etc/ntp.conf and start daemon:
[root@oreka-voice-rec ~]# /etc/init.d/ntpd start
[root@oreka-voice-rec ~]# chkconfig --level 2345 ntpd on
[root@oreka-voice-rec ~]# chkconfig --list ntpd
ntpd 0:off 1:off 2:on 3:on 4:on 5:on 6:off

   28) Done. It have to work. At least for local calls. There is one more problem for outside calls with g.729 codec. Oreka supports g.711 only (cause g.729 need licensing) and IP Phone negotiates g.729 by default (if it was set for outside calls). But the problem is not related to Oreka configuration. So, read the next post. =)

P.S.: You can always use more functional commercial version of Oreka.
P.P.S: there are some links, that were useful for this post
1) Set up a virtual FTP server with pam-mysql
2) Installing pam-mysql on CentOS 5.0
3) VSFTPD Virtual users with MySQL on CentOS 5 - HowTO Tutorial
4) vsftpd MAN, Oreka MAN