SPA504g how to prevent user from using certain phone menu options ?

[jingjok86]

Hi,

We are using about 100 SPA504g phones (firmware 7.4.8a) as SIP phones in an Asterisk setup, I have already configured provisioning with XML configuration files. One thing I could not figure out is how to configure the phone to block some of the menu entries on the phone (i.e. for example preventing the user from pressing the setup button, then choosing FACTORY RESET menu or NETWORK menu entry).

This is a serious security issue.

There is supposed to be a method to hide / unhide / make read-only menu entries since firmware 7.4.6, but I could not find any documentation about how this is configured. The release notes of firmware 7.4.6 point to the admin and provisioning guides which do NOT contain details about this, at least not the versions I found on the Cisco website.

So how exactly do I configure this ?

Thanks !

[nseto]

There are two parameters located in the System tab.

1.  Phone UI user mode.  Default is no.  Set to yes to minimize user functions.

2.  Phone UI readonly.  Default is no.  Set to yes so it's read only.

[jingjok86]

OK, I figured it out and can therefore answer my own question, maybe I can help others with the same problem...

Setting the Phone-UI-User-Mode and Phone-UI-Readonly is not enough, in addition to this you have to set the ua XML attribute for each user menu you want to hide or make read-only in the provisioning XML. ua="ro" makes the entry read-only, ua="na" hides the entry and ua="rw" makes it editable again.

To prevent factory reset you can use Protect_ivr_FactoryReset.

Here an example provisioning XML that prevents the user from doing a factory reset and makes the network connection type (i.e. DHCP / Manual IP), the "enable vlan group" and the "vlan ID" read only. In the same way you can hide / make read-only all other user menu entries on the phone.

You can retrieve the name of the XML elements for the menus with http://phoneip/admin/spacfg.xml

  ...

  Yes

  Yes

  Yes

  ...

[Carlos7673]

any change you can upload the xml file again? its not valid

[Dan Lukes]

You misunderstood. You can't downoad spacfg.xml from there. You need to donwload it from your SPA504G phone.

[joaomigsilva]

Hi everyone,

Do you found the solution for this problem ?

In a competitor brand I have a xml tag for "menu_hidden_admin" or "menu_hidden_user"...

Thanks in advance!

Regards,

João Silva