diff --git a/clients/valleywide/session-logs/2026-07/2026-07-10-mike-vwp-ymcs-rogue-account-mac-audit.md b/clients/valleywide/session-logs/2026-07/2026-07-10-mike-vwp-ymcs-rogue-account-mac-audit.md new file mode 100644 index 00000000..aa8deeca --- /dev/null +++ b/clients/valleywide/session-logs/2026-07/2026-07-10-mike-vwp-ymcs-rogue-account-mac-audit.md @@ -0,0 +1,81 @@ +## User +- **User:** Mike Swanson (mike) +- **Machine:** GURU-5070 +- **Role:** admin + +## Session Summary + +Audited and cleaned up the Valley Wide Plastering (VWP) VoIP phone fleet across PacketDial (NetSapiens PBX) and Yealink YMCS. Started by listing all VWP extensions and their MAC addresses. PacketDial had 15 extensions/users (101-117 plus call queue 200) but only one MAC-provisioned SIP device (ext 105, MAC 805e0cdd7441). Pulled full MACs from YMCS (21 devices in the VWP site) and matched them to extensions by the last-4 recorded in the repo. Found the OUI prefix is NOT uniform (805e0cdd, 805e0c78, 805e0c6a, 44dbd26f, 249ad814, 805e0c08, 805ec032), so last-4 matching is the only reliable key. + +Diagnosed a rogue-config complaint: the Reception phone (MAC 805e0cdd71b1, ext 101) was picking up an ext-100 config. Root cause was a leftover YMCS device account 100@vwp.91912.service (remark "VWP Extension 100 - Final", id 0cc15aa7fb68496db826e5af0b5df825) from the 2026-07-09 provisioning-exploration test extension. PacketDial was already correct (MAC 805e0cdd71b1 -> ext 101; ext 100 returns 404 on the PBX), so YMCS was overriding the RPS config. Deleted the rogue account via POST /v2/dm/delAccounts and rebooted the reception phone. Then, at Mike's direction, deleted ALL VWP YMCS device accounts (the remaining legit 102a@vwp.91912.service too), leaving zero YMCS-pushed SIP accounts - VWP is now fully PacketDial-RPS-based, with YMCS used for device management only. + +Corrected a mapping error: ext 103 (Rose) was recorded with last-4 5217, which does not exist in YMCS. The actual device is 805e0cdd73bd (Mike gave "37bd", a transposition of 73bd). Updated extension-mapping.md and renamed the YMCS device to "Rose - 103" via PATCH /v2/dm/devices/{id}. + +Investigated Ty (ext 114, MAC 805e0cdd6d01) and Rose (ext 103, MAC 805e0cdd73bd): both online in YMCS but unregistered on the PBX, last provisioned ~2026-04-23 (before the 2026-07-09 RPS URL fix). Renamed Ty's device to "Ty - 114" and rebooted both Ty and Rose. A definitive RPS-device dump then revealed the real blocker: of 21 VWP phones, only 14 are bound to the OIT - PacketDial RPS server; 7 are unbound (serverName null) - including both Ty and Rose (the other 5 are spares). Reception (71b1) is in the bound group, which is why its reboot fixed it. Recommended binding Ty + Rose to the OIT RPS server (id 019f4ca999e0740e968c35513dd4ec10) then rebooting; awaiting go-ahead. Also answered ad-hoc lookups (Tammy 106 = 44dbd26f6a36; no device ending 90d6 exists in YMCS). + +## Key Decisions + +- **Deleted ALL VWP YMCS accounts, not just the rogue one** - at Mike's direction, to make every VWP phone provision purely from PacketDial RPS. YMCS SIP-account push was the anomaly causing conflicts; RPS-only is the consistent model (only ext 102 had ever had a YMCS account besides the test). +- **Matched MACs by last-4, not OUI inference** - the fleet has mixed OUI prefixes, so assuming a common 805e0cdd prefix (my initial guess) was wrong; pulled full MACs live from YMCS instead. +- **Trusted PacketDial over the repo for the Rose mapping** - repo said last-4 5217 (no such YMCS device); PacketDial had MAC 805e0cdd73bd bound to ext 103, so corrected the repo to match reality. +- **Held on binding Ty/Rose to RPS pending confirmation** - rebooting alone won't fix RPS-unbound phones that lack a cached provisioning URL; the correct fix (assign the OIT RPS server) is a further write, so surfaced it and awaited go-ahead rather than acting unilaterally. + +## Problems Encountered + +- **Reception phone showing ext 100** - stale YMCS test account 100@vwp. Resolved: deleted the account + rebooted the phone. +- **Ext 103 mapping wrong (5217)** - no YMCS device with that last-4. Resolved: identified real device 805e0cdd73bd, corrected the doc, renamed the device. +- **Ty/Rose online in YMCS but unregistered on PBX** - root cause is RPS: both are among 7 phones NOT bound to the OIT - PacketDial RPS server (last provisioned ~2026-04-23, pre-URL-fix). Reboots issued but likely insufficient without an RPS-server binding; binding step pending. +- **Inconsistent RPS serverName read on first pass** - an early filtered query showed Ty as bound to "OIT - PacketDial"; the full rps-devices dump showed serverName null. Trusted the definitive full dump: Ty and Rose are unbound. + +## Configuration Changes + +- `clients/valleywide/voip/PROVISIONING-STATUS.md` - added dated sections: ext-100 rogue-account removal + all-VWP-YMCS-accounts-deleted follow-up. +- `clients/valleywide/voip/extension-mapping.md` - ext 103 (Rose) corrected from last-4 5217 to full MAC 805e0cdd73bd. +- **YMCS (live, not repo):** deleted all VWP device accounts (100@vwp id 0cc15aa7..., 102a@vwp id 6e2955d4...); renamed devices 805e0cdd73bd -> "Rose - 103", 805e0cdd6d01 -> "Ty - 114"; rebooted reception (10d6e392...), Ty (2f6a2564...), Rose (fcf47e7d...). + +## Credentials & Secrets + +No new credentials. YMCS auth via vault `services/yealink-ymcs.sops.yaml`; PacketDial reseller key via vault `msp-tools/oitvoip.sops.yaml`; RPS/portal login `msp-tools/oitvoip-provisioning.sops.yaml` (Prov_Admin). + +## Infrastructure & Servers + +- **VWP PacketDial domain:** vwp.91912.service (reseller 91912.service). Main number 480-705-9500. +- **VWP YMCS site:** id 1e7578a6fe0e41cfb5a3e8b40933ffee (21 devices). +- **OIT RPS server:** id 019f4ca999e0740e968c35513dd4ec10, url http://ndp.ucaasnetwork.com/cfg (this is the correct one; NOT the WLC ftp://p.packetdials.net). 14/21 VWP phones bound; 7 unbound. +- **Full MAC -> extension (confirmed via YMCS):** + - 101 Reception 805e0cdd71b1 | 102 Jesse 805e0cdd7559 | 103 Rose 805e0cdd73bd | 104 Shelly 805e0c7896b8 | 105 JR 805e0cdd7441 | 106 Tammy 44dbd26f6a36 | 109 Kayla 805e0cdd73b7 | 110 Ron 805e0cdd6509 | 111 Kitchen 805e0c78958e | 113 Chris 805e0cdd755b | 114 Ty 805e0cdd6d01 | 115 Toni 805e0cdd6cf9 | 116 Bart 805e0c6aa890 | 117 Jesse III 805e0cdd6cf5 + - Unmatched/spare devices: 249ad814c479 (T46U), 805e0c08fefa (T46S), 44dbd2a7da95 (T54W), 805e0cdd6fb5, 805e0cdd7453, 805ec03227d6 (T46S "Test 3", now GuruHQ site), 805ec097dacf (T46S) +- **RPS-unbound (serverName null):** 805e0cdd6d01 (Ty), 805e0cdd73bd (Rose), 805e0cdd6fb5, 805e0cdd7453, 44dbd2a7da95, 249ad814c479, 805ec03227d6. +- Ty device: id 2f6a2564ae824fd3bc831f8be79b0af1, lanIp 172.16.9.171, wanIp 4.18.160.106, fw 96.86.0.70. + +## Commands & Outputs + +```bash +# YMCS device list (full MAC) for VWP site +ymcs.py devices --site 1e7578a6fe0e41cfb5a3e8b40933ffee | jq '.data[]|{mac,name,deviceStatus}' +# delete a YMCS device account (rogue ext-100) +ymcs.py raw POST /v2/dm/delAccounts --body '{"accountIds":["0cc15aa7fb68496db826e5af0b5df825"]}' --confirm # successCount 1 +# rename a device (Edit Device = PATCH) +ymcs.py raw PATCH /v2/dm/devices/{id} --body '{"name":"Rose - 103"}' --confirm # 204 +# reboot +ymcs.py reboot --body '{"deviceIds":["{id}"],"deviceType":1}' --confirm # successCount 1 +# RPS binding audit +ymcs.py rps-devices | jq -r '.data[].serverName' | sort | uniq -c # 14 "OIT - PacketDial", 7 null +``` +- PacketDial ext 100 GET -> HTTP 404 (test extension already removed on the PBX). + +## Pending / Incomplete Tasks + +- **Bind Ty (114) + Rose (103) to the OIT - PacketDial RPS server** (id 019f4ca999e0740e968c35513dd4ec10) then reboot -> should register. AWAITING Mike's go-ahead. Reboots already issued but likely insufficient without the RPS binding. +- **Verify registration** of reception (101), Ty (114), Rose (103) on the PBX after re-provision. +- **5 spare RPS-unbound phones** (6fb5, 7453, 44dbd2a7da95, 249ad814c479, 805ec03227d6) - leave unbound until assigned to real extensions. +- **Ext 103 device count:** PacketDial device exists for 103 with MAC 73bd (unregistered) - confirm it registers post-fix. +- Repo doc edits (PROVISIONING-STATUS.md, extension-mapping.md) saved this session; YMCS renames are live. + +## Reference Information + +- extension-mapping: `clients/valleywide/voip/extension-mapping.md` +- status: `clients/valleywide/voip/PROVISIONING-STATUS.md` +- Skills: `.claude/skills/packetdial/` (ns.py), `.claude/skills/yealink-ymcs/` (ymcs.py) +- YMCS Edit Device = PATCH /v2/dm/devices/{deviceId}; Delete Account = POST /v2/dm/delAccounts {accountIds[]}; Reboot = POST /v2/dm/device/reboot {deviceIds[],deviceType:1} +- OIT RPS: http://ndp.ucaasnetwork.com/cfg diff --git a/clients/valleywide/voip/PROVISIONING-STATUS.md b/clients/valleywide/voip/PROVISIONING-STATUS.md index 9bc8ae99..1a8e9210 100644 --- a/clients/valleywide/voip/PROVISIONING-STATUS.md +++ b/clients/valleywide/voip/PROVISIONING-STATUS.md @@ -1,11 +1,32 @@ # VWP Phone Provisioning Status -**Last Updated:** 2026-07-09 20:45 MST +**Last Updated:** 2026-07-10 (ext-100 cleanup) **Status:** Ready for CSV bulk import + Complete VoIP setup documented **Session Summary:** `SESSION-SUMMARY-2026-07-09.md` --- +## 2026-07-10 — Rogue ext-100 account removed (reception phone fix) + +The **Reception** phone (MAC `805e0cdd71b1`, ext 101) was picking up a rogue **ext 100** +config. Root cause: a leftover YMCS device account `100@vwp.91912.service` +(remark "VWP Extension 100 - Final", id `0cc15aa7fb68496db826e5af0b5df825`) from the +2026-07-09 provisioning-exploration test extension. PacketDial was already correct +(MAC `805e0cdd71b1` -> ext 101; ext 100 returns 404 on the PBX), so YMCS was overriding RPS. + +Fix (2026-07-10): deleted the YMCS account via `POST /v2/dm/delAccounts` and rebooted the +reception phone (`POST /v2/dm/device/reboot`) so it re-provisions ext 101 from the OIT RPS +URL. Test ext 100 is now gone from both PacketDial and YMCS; do not go looking for it. + +**Follow-up (same day): ALL VWP YMCS device accounts deleted.** The remaining +`102a@vwp.91912.service` account was also removed, leaving **zero** YMCS-pushed SIP accounts on +the VWP site. Every VWP phone (incl. 102 and 105) now provisions purely from the PacketDial +OIT RPS URL (`http://ndp.ucaasnetwork.com/cfg`) — YMCS is used for device management only, not +SIP-account push. Any phone that still has an old YMCS-pushed account cached (e.g. ext 102, +MAC `805e0cdd7559`) will re-provision from RPS on its next reboot. + +--- + ## CRITICAL FIX COMPLETED **RPS Provisioning URL corrected:** diff --git a/clients/valleywide/voip/extension-mapping.md b/clients/valleywide/voip/extension-mapping.md index 89f14802..c217698b 100644 --- a/clients/valleywide/voip/extension-mapping.md +++ b/clients/valleywide/voip/extension-mapping.md @@ -11,7 +11,7 @@ |-----|------|-------------------|------------|-------| | 101 | Natalya (Receptionist) | Customer Service | customerservice@valleywideplastering.com | ✓ Matched - Gets test phone (805e0cdd71b1 / last 4: 71b1) | | 102 | Jesse | Jesse Guerrero | jesse@valleywideplastering.com | ✓ Matched - Phone MAC last 4: 7559 | -| 103 | Rose | Rose Guerrero | rose@valleywideplastering.com | ✓ Matched - Phone MAC last 4: 5217 | +| 103 | Rose | Rose Guerrero | rose@valleywideplastering.com | ✓ Matched - Full MAC 805e0cdd73bd (corrected 2026-07-10; prior "5217" was wrong / no such device in YMCS) | | 104 | Shelly | Shelly Dooley | shelly@valleywideplastering.com | ✓ Matched - Phone MAC last 4: 96b8 | | 105 | J.R. | JR Guerrero | j-r@valleywideplastering.com | ✓ Matched (also jr@CASARICA.NET) - Phone MAC last 4: 7441 | | 106 | Tammy | Accounts Payable | acctpay@valleywideplastering.com | ✓ Matched - Phone MAC last 4: 6a36 | diff --git a/errorlog.md b/errorlog.md index b99760f2..c2a803ad 100644 --- a/errorlog.md +++ b/errorlog.md @@ -19,6 +19,8 @@ Categories (the `[type]` tag): _(none)_ = skill/command execution failure · +2026-07-10 | GURU-5070 | packetdial | HTTP 404 GET https://pbx.packetdial.com/ns-api/v2/domains/vwp.91912.service/users/100: {"code":404,"message":"Resource not found."} [ctx: cmd=user] (x2) + 2026-07-10 | Mikes-MacBook-Air | packetdial | HTTP 404 DELETE https://pbx.packetdial.com/ns-api/v2/domains/vwp.91912.service/users/105/devices/sip%3A105a%40vwp.91912.service: {"code":404,"message":"Device not found."} [ctx: cmd=raw] 2026-07-10 | Mikes-MacBook-Air | packetdial | HTTP 404 DELETE https://pbx.packetdial.com/ns-api/v2/domains/vwp.91912.service/users/105/devices: {"code":404,"message":"Device not found."} [ctx: cmd=raw]