Take a look on the user credentials
on Radius DB… Radius is rejecting the authentication, so there should be
some mismatch between Your login credentials and what Radius has in its DB.
Try to run this command and
see what’s the result (linux version):
radiusclient
-f <conf-dir-of-radiusclient-ng>/radiusclient.conf -p 123 'User-Name=some@valid.user'
'Password=Guess';echo $?
It should return:
Reply-Message
= 'Authenticated'
Edson.
From:
users-bounces@openser.org [mailto:users-bounces@openser.org] On Behalf Of Hamid Ali Asgari
Sent: quarta-feira, 14 de junho de
2006 11:29
To: users@openser.org
Subject: [Users] SIP Clients Can't
REGISTER
Hi,
I have followed the Intrsuctions on setting up
FreeRADIUS with OpenSER. (http://openser.org/docs/openser-radius-1.0.x.html)
But the server doesn’t allow the
registration:
Config:
================================================================================================
# $Id$
#
# radius config script
#
# ----------- global configuration parameters
------------------------
debug=7
# debug level (cmd line: -dddddddddd)
fork=no
log_stderror=yes # (cmd line: -E)
check_via=no # (cmd. line: -v)
dns=no
# (cmd. line: -r)
rev_dns=no # (cmd.
line: -R)
port=5060
children=4
listen=udp:192.168.10.18
alias="openser.org"
alias="mydomain.com"
#fifo="/tmp/openser_fifo"
# ------------------ module loading
----------------------------------
mpath="/usr/local/lib/openser/modules/"
loadmodule "mysql.so"
loadmodule "sl.so"
loadmodule "tm.so"
loadmodule "rr.so"
loadmodule "maxfwd.so"
loadmodule "avpops.so"
loadmodule "usrloc.so"
loadmodule "registrar.so"
loadmodule "textops.so"
loadmodule "xlog.so"
loadmodule "uri.so"
loadmodule "acc.so"
loadmodule "auth.so"
loadmodule "auth_radius.so"
loadmodule "group_radius.so"
loadmodule "avp_radius.so"
# ----------------- setting module-specific
parameters ---------------
# -- usrloc params --
#modparam("usrloc","db_url","mysql://openser:openserrw@localhost/openser")
modparam("usrloc", "db_mode", 2)
# -- acc params --
modparam("acc", "radius_flag", 1)
modparam("acc",
"radius_missed_flag", 2)
modparam("acc", "log_flag", 1)
modparam("acc", "log_missed_flag",
1)
modparam("acc", "service_type",
15)
modparam("acc", "radius_extra",
"Sip-Src-IP=$si;Sip-Src-Port=$sp")
modparam("acc|auth_radius|group_radius|avp_radius",
"radius_config",
"/usr/local/etc/radiusclient-ng/radiusclient.conf")
# -- group_radius params --
modparam("group_radius",
"use_domain", 1)
# -- avpops params --
modparam("avpops", "avp_aliases",
"day=i:101;time=i:102")
# -- rr params --
# add value to ;lr param to make some broken UAs
happy
modparam("rr", "enable_full_lr",
1)
# ------------------------- request routing
logic -------------------
# main routing logic
route{
# initial sanity checks --
messages with
# max_forwards==0, or excessively
long requests
if
(!mf_process_maxfwd_header("10")) {
sl_send_reply("483","Too
Many Hops");
exit;
};
if (msg:len >= 2048 ) {
sl_send_reply("513", "Message too big");
exit;
};
# check if user is suspended
if(is_method("REGISTER|INVITE|MESSAGE|OPTIONS|SUBSCRIBE"))
{
if
(radius_is_user_in("From", "suspended")) {
sl_send_reply("403", "Forbidden - suspended");
exit;
};
};
# we record-route all messages --
to make sure that
# subsequent messages will go
through our proxy; that's
# particularly good if upstream
and downstream entities
# use different transport protocol
if (!method=="REGISTER")
record_route();
# subsequent messages withing a
dialog should take the
# path determined by record-routing
if (loose_route()) {
# mark
routing logic in request
append_hf("P-hint: rr-enforced\r\n");
if(is_method("BYE"))
{ # log it
all the time
acc_rad_request("200 ok");
acc_log_request("200 ok");
}
route(1);
};
if(is_method("INVITE")
&& !has_totag())
{ # set the acc flags
setflag(1);
setflag(2);
};
if (!uri==myself) {
# check if
user is allowed to do voip calls to other domains
if(is_method("INVITE|MESSAGE")) {
if (!radius_is_user_in("From", "voip")) {
sl_send_reply("403", "Forbidden VoIP");
exit;
};
};
# mark
routing logic in request
append_hf("P-hint: outbound\r\n");
route(1);
};
# if the request is for other
domain use UsrLoc
# (in case, it does not work, use
the following command
# with proper names and addresses
in it)
if (uri==myself) {
#
authenticate registers
if
(method=="REGISTER") {
if (!radius_www_authorize("mydomain.com")) {
www_challenge("mydomain.com", "0");
exit;
};
# check the src ip address
if(!avp_check("i:2", "eq/$src_ip/ig"))
{
sl_send_reply("403", "Forbidden IP");
exit;
};
save("location");
exit;
};
# calls to
pstn
if(uri=~"sip:00[1-9][0-9]+@") {
if(is_method("INVITE") && !has_totag()) {
if (!radius_is_user_in("From", "pstn")) {
sl_send_reply("403", "Forbidden PSTN");
exit;
};
};
# set gateway address
rewritehostport("192.168.10.18:5090");
route(1);
};
# load
callee's avps
if(avp_load_radius("callee"))
{
# check if user has time filter enabled
if(avp_check("i:3", "eq/i:1"))
{
# print time in an avp
avp_printf("i:100", "$Tf");
# extract day
avp_subst("i:100/i:101", "/(.{3}) .+/*\1*/");
if(!avp_check("i:6", "fm/$day")) {
sl_send_reply("403", "Forbidden - day");
exit;
};
# extract 'hours:minutes'
avp_subst("i:100/i:102", "/(.{10}) (.{5}):.+/\2/");
if((is_avp_set("i:4") && avp_check("i:4",
"gt/$time"))
|| (is_avp_set("i:5") && avp_check("i:5",
"lt/$time"))) {
sl_send_reply("403", "Forbidden - time");
exit;
};
};
};
# native
SIP destinations are handled using our USRLOC DB
if
(!lookup("location")) {
# log to acc as missed call
acc_rad_request("404 Not Found");
acc_log_request("404 Not Found");
sl_send_reply("404", "Not Found");
exit;
};
append_hf("P-hint: usrloc applied\r\n");
};
route(1);
}
# generic forward
route[1] {
# send it out now; use stateful
forwarding as it works reliably
# even for UDP2TCP
if (!t_relay()) {
sl_reply_error();
};
exit;
}
#
================================================================================================
Users file on RADIUS:
### --- avps ---
101@mydomain.com Auth-Type := Accept, Service-Type ==
"SIP-Callee-AVPs"
Sip-Avp +=
"#3#1",
Sip-Avp +=
"#4:08:00",
Sip-Avp +=
"#5:16:00",
Sip-Avp +=
"#6:Mon,Wed,Thu,Fri"
102@mydomain.com Auth-Type := Accept, Service-Type ==
"SIP-Callee-AVPs"
Sip-Avp +=
"#3#1",
Sip-Avp +=
"#4:08:00",
Sip-Avp +=
"#5:16:00",
Sip-Avp +=
"#6:Mon,Wed,Thu,Free"
DEFAULT Auth-Type := Accept, Service-Type ==
"SIP-Callee-AVPs"
### --- group checking ---
### --- user 101 ---
101@mydomain.com Auth-Type := Accept, Sip-Group ==
"voip", Service-Type == "Group-Check"
Reply-Message = "Authorized"
101@mydomain.com Auth-Type := Accept, Sip-Group ==
"pstn", Service-Type == "Group-Check"
Reply-Message = "Authorized"
### --- user 102 ---
102@mydomain.com Auth-Type := Accept, Sip-Group ==
"voip", Service-Type == "Group-Check"
Reply-Message = "Authorized"
DEFAULT Auth-Type := Reject, Service-Type ==
"Group-Check"
### --- user authentication ---
101@mydomain.com Auth-Type := Digest, User-Password
== "101"
Reply-Message = "Authenticated",
Sip-Avp +=
"rpid:101",
Sip-Avp +=
"#2:192.168.10.17",
# Sip-Avp +=
"#2:192.168.2.11"
102@mydomain.com Auth-Type := Digest, User-Password
== "102"
Reply-Message = "Authenticated",
Sip-Avp +=
"rpid:102",
# Sip-Avp +=
"#2:192.168.2.12"
================================================================================================
And bellow is the dubug from radiusd –X and openser -E –ddddddd:
OpenSER Debug:
*****************************
0(4084) SIP Request:
0(4084) method: <REGISTER>
0(4084) uri:
<sip:mydomain.com>
0(4084) version: <SIP/2.0>
0(4084) parse_headers: flags=2
0(4084) DEBUG:parse_to:end of header reached,
state=8
0(4084) DEBUG: get_hdr_field: <To> [19];
uri=[sip:101@mydomain.com]
0(4084) DEBUG: to body [sip:101@mydomain.com
]
0(4084) get_hdr_field: cseq <Cseq>:
<2> <REGISTER>
0(4084) Found param type 232, <branch> =
<z9hG4bK-eb137d5b6c8524d7c778e5629555a97e>; state=16
0(4084) end of header reached, state=5
0(4084) parse_headers: Via found, flags=2
0(4084) parse_headers: this is the first via
0(4084) After parse_msg...
0(4084) preparing to run routing scripts...
0(4084) DEBUG:maxfwd:is_maxfwd_present: value =
20
0(4084) DEBUG: add_param: tag=30167a95
0(4084) DEBUG:parse_to:end of header reached,
state=29
0(4084) radius_is_user_in(): Failure
0(4084) parse_headers: flags=200
0(4084) DEBUG: get_hdr_body : content_length=0
0(4084) found end of header
0(4084) find_first_route:
0(4084) loose_route: There is no Route HF
0(4084) grep_sock_info - checking if host==us:
9==10 && [mydomain.com] == [192.168.10.18]
0(4084) grep_sock_info - checking if port 5060
matches port 5060
0(4084) grep_sock_info - checking if host==us:
9==10 && [mydomain.com] == [192.168.10.18]
0(4084) grep_sock_info - checking if port 5060
matches port 5060
0(4084) check_nonce(): comparing
[448fe8934593e3e7780fffee019ce58577231baf] and
[448fe8934593e3e7780fffee019ce58577231baf]
0(4084)
DEBUG:auth_radius:radius_authorize_sterman: Success
0(4084) DEBUG:auth_radius:generate_avps:
getting SIP AVPs from avpair 225
0(4084) DEBUG:auth_radius:extract_avp: string
is <rpid:101>
0(4084) DEBUG:auth_radius:extract_avp: AVP name
is <rpid>
0(4084) DEBUG:auth_radius:extract_avp: AVP val
is <101>
0(4084) DEBUG:auth_radius:generate_avps: AVP
'rpid'/0='101'/0 has been added
0(4084) DEBUG:auth_radius:extract_avp: string
is <#2:192.168.10.17>
0(4084) DEBUG:auth_radius:extract_avp: AVP name
is <2>
0(4084) DEBUG:auth_radius:extract_avp: AVP val
is <192.168.10.17>
0(4084) DEBUG:auth_radius:generate_avps: AVP
'null'/2='192.168.10.17'/0 has been added
0(4084) DEBUG:avpops:check_avp: check
<192.168.10.17> against <192.168.10.17> as str
0(4084) parse_headers: flags=ffffffffffffffff
0(4084) parse_headers: flags=4000000
0(4084) build_contact(): Created Contact HF:
Contact: <sip:101@192.168.10.17;LINEID=6f5beb97d08670a1c8328ce1526ae928>;expires=300
0(4084) parse_headers: flags=ffffffffffffffff
0(4084) check_via_address(192.168.10.17,
192.168.10.17, 0)
0(4084) DEBUG:destroy_avp_list: destroying list
0xb60f0a50
0(4084) receive_msg: cleaning up
1(4086) build_recv_sock:
<192.168.10.18_5060>
*******************************
RADIUS Debug:
*******************************
rad_recv: Access-Request packet from host
127.0.0.1:32900, id=196, length=185
User-Name
= "101@shatel.ir"
Digest-Attributes = 0x0a05313031
Digest-Attributes = 0x010b73686174656c2e6972
Digest-Attributes =
0x022a34343866663166663933326638303933376130343732663338373631633530366561663636613934
Digest-Attributes = 0x040f7369703a73686174656c2e6972
Digest-Attributes = 0x030a5245474953544552
Digest-Response = "7a3f00f697286dd95c5aa654a9662dea"
Service-Type = Sip-Session
Sip-Uri-User = "101"
NAS-Port =
5060
NAS-IP-Address = 127.0.0.1
Processing the authorize section of
radiusd.conf
modcall: entering group authorize for request 100
modcall[authorize]: module
"preprocess" returns ok for request 100
modcall[authorize]: module "chap"
returns noop for request 100
modcall[authorize]: module "mschap"
returns noop for request 100
rlm_digest: Adding Auth-Type = DIGEST
modcall[authorize]: module "digest"
returns ok for request 100
rlm_realm: Looking up realm
"shatel.ir" for User-Name = "101@shatel.ir"
rlm_realm: No such realm
"shatel.ir"
modcall[authorize]: module "suffix"
returns noop for request 100
rlm_eap: No EAP-Message, not doing EAP
modcall[authorize]: module "eap"
returns noop for request 100
users: Matched entry DEFAULT at
line 152
users: Matched entry 101@shatel.ir
at line 255
modcall[authorize]: module "files"
returns ok for request 100
modcall: leaving group authorize (returns ok) for
request 100
rad_check_password: Found Auth-Type
Digest
auth: type "digest"
Processing the authenticate section of
radiusd.conf
modcall: entering group authenticate for request 100
rlm_digest: Converting
Digest-Attributes to something sane...
Digest-User-Name = "101"
Digest-Realm = "shatel.ir"
Digest-Nonce
= "448ff1ff932f80937a0472f38761c506eaf66a94"
Digest-URI
= "sip:shatel.ir"
Digest-Method = "REGISTER"
A1 = 101:shatel.ir:101
A2 = REGISTER:sip:shatel.ir
H(A1) = a5d8cf73217ea46c8fd8ca5da1c6a2e3
H(A2) = 27e9df2d1a7ed715c7204d1316039120
KD =
a5d8cf73217ea46c8fd8ca5da1c6a2e3:448ff1ff932f80937a0472f38761c506eaf66a94:27e9df2d1a7ed715c7204d1316039120
EXPECTED 7a3f00f697286dd95c5aa654a9662dea
RECEIVED 7a3f00f697286dd95c5aa654a9662dea
modcall[authenticate]: module
"digest" returns ok for request 100
modcall: leaving group authenticate (returns ok) for
request 100
radius_xlat: 'Authenticated'
Sending Access-Accept of id 196 to 127.0.0.1 port
32900
Reply-Message = "Authenticated"
SIP-AVP +=
"rpid:101"
SIP-AVP +=
"#2:85.15.7.17"
Finished request 100
Going to the next request
Waking up in 2 seconds...
rad_recv: Access-Request packet from host
127.0.0.1:32901, id=197, length=64
User-Name
= "101@shatel.ir"
Sip-Group
= "suspended"
Service-Type
= Group-Check
NAS-Port =
0
NAS-IP-Address = 127.0.0.1
Processing the authorize section of
radiusd.conf
modcall: entering group authorize for request 101
modcall[authorize]: module
"preprocess" returns ok for request 101
modcall[authorize]: module "chap"
returns noop for request 101
modcall[authorize]: module "mschap"
returns noop for request 101
modcall[authorize]: module "digest"
returns noop for request 101
rlm_realm: Looking up realm
"shatel.ir" for User-Name = "101@shatel.ir"
rlm_realm: No such realm
"shatel.ir"
modcall[authorize]: module "suffix"
returns noop for request 101
rlm_eap: No EAP-Message, not doing EAP
modcall[authorize]: module "eap"
returns noop for request 101
users: Matched entry DEFAULT at
line 152
users: Matched entry DEFAULT at
line 252
modcall[authorize]: module "files"
returns ok for request 101
modcall: leaving group authorize (returns ok) for
request 101
rad_check_password: Found Auth-Type
Reject
rad_check_password: Auth-Type = Reject,
rejecting user
auth: Failed to validate the user.
Delaying request 101 for 1 seconds
Finished request 101
Any thoughts?
Thanks,
Hamid