sr-users May 2015

sr-users@lists.kamailio.org

80 participants
116 discussions

TLSv1.2 and weak ciphers
by Attila Megyeri 04 May '15

04 May '15

Hi Daniel, Kamailio folks, We are trying to make our server more secure, but we have some issues. Right now, we have set the TLS method to method = TLSv1+ and cipher_list = HIGH The problem is, that there are still cipher suites offered which are not secure. E.g. If I check with the SSLLabs analizer, I see: This server supports anonymous (insecure) suites (see below for details). Grade set to F. Cipher Suites (SSL 3+ suites in server-preferred order; deprecated and SSL 2 suites always at the end) TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030) ECDH 256 bits (eq. 3072 bits RSA) FS 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028) ECDH 256 bits (eq. 3072 bits RSA) FS 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) ECDH 256 bits (eq. 3072 bits RSA) FS 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x9f) DH 3072 bits (p: 384, g: 1, Ys: 384) FS 256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (0x6b) DH 3072 bits (p: 384, g: 1, Ys: 384) FS 256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x39) DH 3072 bits (p: 384, g: 1, Ys: 384) FS 256 TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA (0x88) DH 3072 bits (p: 384, g: 1, Ys: 384) FS 256 TLS_ECDH_anon_WITH_AES_256_CBC_SHA (0xc019) INSECURE 256 TLS_DH_anon_WITH_AES_256_GCM_SHA384 (0xa7) INSECURE 256 TLS_DH_anon_WITH_AES_256_CBC_SHA256 (0x6d) INSECURE 256 TLS_DH_anon_WITH_AES_256_CBC_SHA (0x3a) INSECURE 256 TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA (0x89) INSECURE 256 TLS_RSA_WITH_AES_256_GCM_SHA384 (0x9d) 256 TLS_RSA_WITH_AES_256_CBC_SHA256 (0x3d) 256 TLS_RSA_WITH_AES_256_CBC_SHA (0x35) 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (0x84) 256 TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (0xc012) ECDH 256 bits (eq. 3072 bits RSA) FS 112 TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (0x16) DH 3072 bits (p: 384, g: 1, Ys: 384) FS 112 TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA (0xc017) INSECURE 112 TLS_DH_anon_WITH_3DES_EDE_CBC_SHA (0x1b) INSECURE 112 TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) 112 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) ECDH 256 bits (eq. 3072 bits RSA) FS 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027) ECDH 256 bits (eq. 3072 bits RSA) FS 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) ECDH 256 bits (eq. 3072 bits RSA) FS 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x9e) DH 3072 bits (p: 384, g: 1, Ys: 384) FS 128 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (0x67) DH 3072 bits (p: 384, g: 1, Ys: 384) FS 128 TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x33) DH 3072 bits (p: 384, g: 1, Ys: 384) FS 128 TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA (0x45) DH 3072 bits (p: 384, g: 1, Ys: 384) FS 128 TLS_ECDH_anon_WITH_AES_128_CBC_SHA (0xc018) INSECURE 128 TLS_DH_anon_WITH_AES_128_GCM_SHA256 (0xa6) INSECURE 128 TLS_DH_anon_WITH_AES_128_CBC_SHA256 (0x6c) INSECURE 128 TLS_DH_anon_WITH_AES_128_CBC_SHA (0x34) INSECURE 128 TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA (0x46) INSECURE 128 TLS_RSA_WITH_AES_128_GCM_SHA256 (0x9c) 128 TLS_RSA_WITH_AES_128_CBC_SHA256 (0x3c) 128 TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (0x41) 128 How can we get rid of these _anon_ cipher suites? Thanks Attila

1 1

Auth User & is_subscriber
by jay binks 04 May '15

04 May '15

Hey, from the examples it looks like the typical usage of is_subscriber is with $fu ( From User ), however im not 100% sure I want this. in-fact, I want it to be the Auth User that is used. After all if a call was Authed, then we authoritatively know what user it is, and I think this should be used over and above the from user ( which could even be set to caller Id in some cases ). Im having some trouble getting is_subscriber to work with the Auth user, does anyone have an example of this working somewhere ? -- Sincerely Jay

2 1

WebSocket data in TCP connection
by mayamatakeshi 04 May '15

04 May '15

Hello, about module websocket, is it possible to associate a value with the TCP connection and have this value readable when handling SIP requests on that connection?

1 4

Regd: Message Routing
by suryakiiran vanam 04 May '15

04 May '15

Hi Team, I am using Jitsi client with Kamailio. I was able to IM between the clients. How can I control the Message routing in Kamailio script. Please help me with any link. Regards, Surya.

2 1

WebRTC video calls
by Ivan Vujisic 04 May '15

04 May '15

I made successful audio calls from browser to browser using Asterisk 13.1 and SIPML5 browser phone. Asterisk can't manage WebRTC video calls due to lack of codec negotiation module, but I also faced RTP ports NAT traversal issue. To my understanding Kamailio is capable to resolve this. Can anybody confirm that he made successful browser to browser video calls with Kamailio sip proxy / registrar in front of Asterisk PBX. Also, any link to good tutorial or doc pages will be appreciated. Best Regards, Ivan Vujisic

2 1

UAC Module
by Ali Jibran 02 May '15

02 May '15

Hi all. I have this setup. Trunk--->Kamailio---->FreeSWITCH I have a trunk from a sip provided and registered successfully with the UAC module. Incoming is working fine. I need to make out going through kamailio too. I have it in the dialplan to forward the invite to kamailio from FreeSWITCH. I can see it the logs that it reaches kamailio. Now how do I make the call via the trunk? Basically this is what I'm trying to workout FS---->kamailio---->trunk. Any help will be much appreciated. Thanks. AJ

3 7

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

sr-users May 2015