Hi,
I am trying to make SER working with FreeRADIUS. However, I got an error using www_challenge, " 0(3184) parse error (119,25-26): unknown command, missing loadmodule?" The 119 line is www_challenge("", "0"); I did load auth module. Any idea?
Here is my config:
#
# $Id: ser-basic.cfg,v 1.1.2.2 2008/06/12 13:15:06 alfredh Exp $ # # This a very basic config file w aliases and anamed route but # w/o authentication, accounting, database, multi-domain support etc.
# Please refer to ser.cfg for a more complete example #
# ----------- global configuration parameters ------------------------
debug=3 # debug level (cmd line: -dddddddddd)
#memdbg=10 # memory debug message level
#memlog=10 # memory statistics log level #log_facility=LOG_LOCAL0 # sets the facility used for logging (see syslog(3))
/* Uncomment these lines to enter debugging mode fork=no log_stderror=yes */
check_via=no # (cmd. line: -v)
dns=no # (cmd. line: -r)
rev_dns=no # (cmd. line: -R)
listen=202.158.197.134
port=5060
children=4
#user=ser
#group=ser
#disable_core=yes #disables core dumping
#open_fd_limit=1024 # sets the open file descriptors limit #mhomed=yes # usefull for multihomed hosts, small performance penalty #disable_tcp=yes #tcp_accept_aliases=yes # accepts the tcp alias via option (see NEWS)
#
# ------------------ module loading ----------------------------------
loadmodule "/usr/local/lib/ser/modules/sl.so"
loadmodule "/usr/local/lib/ser/modules/tm.so"
loadmodule "/usr/local/lib/ser/modules/rr.so"
loadmodule "/usr/local/lib/ser/modules/textops.so"
loadmodule "/usr/local/lib/ser/modules/maxfwd.so"
loadmodule "/usr/local/lib/ser/modules/usrloc.so"
loadmodule "/usr/local/lib/ser/modules/registrar.so"
loadmodule "/usr/local/lib/ser/modules/ctl.so"
loadmodule "/usr/local/lib/ser/modules/auth.so"
loadmodule "/usr/local/lib/ser/modules/auth_radius.so"
# ----------------- setting module-specific parameters ---------------
# -- usrloc params --
modparam("usrloc", "db_mode", 0)
# -- rr params --
# add value to ;lr param to make some broken UAs happy modparam("rr", "enable_full_lr", 1)
# ctl params
# by default ctl listens on unixs:/tmp/ser_ctl if no other address is # specified in modparams; this is also the default for sercmd modparam("ctl", "binrpc", "unixs:/tmp/ser_ctl") # listen on the "standard" fifo for backward compatibility modparam("ctl", "fifo", "fifo:/tmp/ser_fifo") # listen on tcp, localhost #modparam("ctl", "binrpc", "tcp:localhost:2046")
# -- auth_radius params --
modparam("auth_radius", "radius_config", "/usr/local/etc/radiusclient-ng/radiusclient.conf")
# ------------------------- request routing logic -------------------
# main routing logic
route{
# initial sanity checks -- messages with
# max_forwards==0, or excessively long requests
if (!mf_process_maxfwd_header("10")) {
sl_reply("483","Too Many Hops");
break;
}
if (msg:len >= max_len ) {
sl_reply("513", "Message too big");
break;
}
# we record-route all messages -- to make sure that
# subsequent messages will go through our proxy; that's
# particularly good if upstream and downstream entities
# use different transport protocol
if (!method=="REGISTER") record_route();
# subsequent messages withing a dialog should take the
# path determined by record-routing
if (loose_route()) {
# mark routing logic in request
append_hf("P-hint: rr-enforced\r\n");
route(FORWARD);
break;
}
if (!uri==myself) {
# mark routing logic in request
append_hf("P-hint: outbound\r\n");
route(FORWARD);
break;
}
# if the request is for other domain use UsrLoc
# (in case, it does not work, use the following command
# with proper names and addresses in it)
if (uri==myself) {
if (method=="REGISTER") {
# authentication
if (!radius_www_authorize("")) {
www_challenge("", "0");
break;
};
save_contacts("location");
break;
}
# native SIP destinations are handled using our USRLOC DB
if (!lookup_contacts("location")) {
sl_reply("404", "Not Found");
break;
}
append_hf("P-hint: usrloc applied\r\n");
}
route(FORWARD);
}
route[FORWARD]
{
# send it out now; use stateful forwarding as it works reliably
# even for UDP2TCP
if (!t_relay()) {
sl_reply_error();
}
}
Thanks,
Leon
Hi,
From SER version 2.x in order to challenge a SIP Request with FreeRADIUS
authorization You need to use the radius_proxy_authorize(digest_realm) function. And analogously proxy_authorize(digest_realm, credentials) if You want to use SER database.
Kind regards, - Tomasz Zieleniewski
2009/5/6 Leon Li Leon.Li@aarnet.edu.au
Hi,
I am trying to make SER working with FreeRADIUS. However, I got an error using www_challenge, " 0(3184) parse error (119,25-26): unknown command, missing loadmodule?" The 119 line is www_challenge("", "0"); I did load auth module. Any idea?
Here is my config:
#
# $Id: ser-basic.cfg,v 1.1.2.2 2008/06/12 13:15:06 alfredh Exp $ # # This a very basic config file w aliases and anamed route but # w/o authentication, accounting, database, multi-domain support etc.
# Please refer to ser.cfg for a more complete example #
# ----------- global configuration parameters ------------------------
debug=3 # debug level (cmd line: -dddddddddd)
#memdbg=10 # memory debug message level
#memlog=10 # memory statistics log level #log_facility=LOG_LOCAL0 # sets the facility used for logging (see syslog(3))
/* Uncomment these lines to enter debugging mode fork=no log_stderror=yes */
check_via=no # (cmd. line: -v)
dns=no # (cmd. line: -r)
rev_dns=no # (cmd. line: -R)
listen=202.158.197.134
port=5060
children=4
#user=ser
#group=ser
#disable_core=yes #disables core dumping
#open_fd_limit=1024 # sets the open file descriptors limit #mhomed=yes # usefull for multihomed hosts, small performance penalty #disable_tcp=yes #tcp_accept_aliases=yes # accepts the tcp alias via option (see NEWS)
#
# ------------------ module loading ----------------------------------
loadmodule "/usr/local/lib/ser/modules/sl.so"
loadmodule "/usr/local/lib/ser/modules/tm.so"
loadmodule "/usr/local/lib/ser/modules/rr.so"
loadmodule "/usr/local/lib/ser/modules/textops.so"
loadmodule "/usr/local/lib/ser/modules/maxfwd.so"
loadmodule "/usr/local/lib/ser/modules/usrloc.so"
loadmodule "/usr/local/lib/ser/modules/registrar.so"
loadmodule "/usr/local/lib/ser/modules/ctl.so"
*loadmodule "/usr/local/lib/ser/modules/auth.so"*
loadmodule "/usr/local/lib/ser/modules/auth_radius.so"
# ----------------- setting module-specific parameters ---------------
# -- usrloc params --
modparam("usrloc", "db_mode", 0)
# -- rr params --
# add value to ;lr param to make some broken UAs happy modparam("rr", "enable_full_lr", 1)
# ctl params
# by default ctl listens on unixs:/tmp/ser_ctl if no other address is # specified in modparams; this is also the default for sercmd modparam("ctl", "binrpc", "unixs:/tmp/ser_ctl") # listen on the "standard" fifo for backward compatibility modparam("ctl", "fifo", "fifo:/tmp/ser_fifo") # listen on tcp, localhost #modparam("ctl", "binrpc", "tcp:localhost:2046")
# -- auth_radius params --
modparam("auth_radius", "radius_config", "/usr/local/etc/radiusclient-ng/radiusclient.conf")
# ------------------------- request routing logic -------------------
# main routing logic
route{
# initial sanity checks -- messages with # max_forwards==0, or excessively long requests if (!mf_process_maxfwd_header("10")) { sl_reply("483","Too Many Hops"); break; } if (msg:len >= max_len ) { sl_reply("513", "Message too big"); break; } # we record-route all messages -- to make sure that # subsequent messages will go through our proxy; that's # particularly good if upstream and downstream entities # use different transport protocol if (!method=="REGISTER") record_route(); # subsequent messages withing a dialog should take the # path determined by record-routing if (loose_route()) { # mark routing logic in request append_hf("P-hint: rr-enforced\r\n"); route(FORWARD); break; } if (!uri==myself) { # mark routing logic in request append_hf("P-hint: outbound\r\n"); route(FORWARD); break; } # if the request is for other domain use UsrLoc # (in case, it does not work, use the following command # with proper names and addresses in it) if (uri==myself) {
if (method=="REGISTER") {*# authentication*if (!radius_www_authorize("")) {*www_challenge("", "0");*break;* }; save_contacts("location"); break; } # native SIP destinations are handled using our USRLOC DB if (!lookup_contacts("location")) { sl_reply("404", "Not Found"); break; } append_hf("P-hint: usrloc applied\r\n"); } route(FORWARD);}
route[FORWARD]
{
# send it out now; use stateful forwarding as it works reliably # even for UDP2TCP if (!t_relay()) { sl_reply_error(); }}
Thanks,
Leon
Serusers mailing list Serusers@lists.iptel.org http://lists.iptel.org/mailman/listinfo/serusers
Thanks Tomasz,
I know we need different function, however, my problem is that it won't accept www_challenge in ser.cfg which is introduced by auth module, I think.
if (method=="REGISTER") {
# authentication
if (!radius_www_authorize("")) {
www_challenge("", "0");
break;
};
Regards
Leon
From: Tomasz Zieleniewski [mailto:tzieleniewski@gmail.com] Sent: Wednesday, 6 May 2009 6:25 PM To: Leon Li Cc: serusers@lists.iptel.org Subject: Re: [Serusers] SER with RADIUS
Hi,
From SER version 2.x in order to challenge a SIP Request with FreeRADIUS
authorization You need to use the radius_proxy_authorize(digest_realm) function. And analogously proxy_authorize(digest_realm, credentials) if You want to use SER database.
Kind regards, - Tomasz Zieleniewski
2009/5/6 Leon Li Leon.Li@aarnet.edu.au
Hi,
I am trying to make SER working with FreeRADIUS. However, I got an error using www_challenge, " 0(3184) parse error (119,25-26): unknown command, missing loadmodule?" The 119 line is www_challenge("", "0"); I did load auth module. Any idea?
Here is my config:
#
# $Id: ser-basic.cfg,v 1.1.2.2 2008/06/12 13:15:06 alfredh Exp $ # # This a very basic config file w aliases and anamed route but # w/o authentication, accounting, database, multi-domain support etc.
# Please refer to ser.cfg for a more complete example #
# ----------- global configuration parameters ------------------------
debug=3 # debug level (cmd line: -dddddddddd)
#memdbg=10 # memory debug message level
#memlog=10 # memory statistics log level #log_facility=LOG_LOCAL0 # sets the facility used for logging (see syslog(3))
/* Uncomment these lines to enter debugging mode fork=no log_stderror=yes */
check_via=no # (cmd. line: -v)
dns=no # (cmd. line: -r)
rev_dns=no # (cmd. line: -R)
listen=202.158.197.134
port=5060
children=4
#user=ser
#group=ser
#disable_core=yes #disables core dumping
#open_fd_limit=1024 # sets the open file descriptors limit #mhomed=yes # usefull for multihomed hosts, small performance penalty #disable_tcp=yes #tcp_accept_aliases=yes # accepts the tcp alias via option (see NEWS)
#
# ------------------ module loading ----------------------------------
loadmodule "/usr/local/lib/ser/modules/sl.so"
loadmodule "/usr/local/lib/ser/modules/tm.so"
loadmodule "/usr/local/lib/ser/modules/rr.so"
loadmodule "/usr/local/lib/ser/modules/textops.so"
loadmodule "/usr/local/lib/ser/modules/maxfwd.so"
loadmodule "/usr/local/lib/ser/modules/usrloc.so"
loadmodule "/usr/local/lib/ser/modules/registrar.so"
loadmodule "/usr/local/lib/ser/modules/ctl.so"
loadmodule "/usr/local/lib/ser/modules/auth.so"
loadmodule "/usr/local/lib/ser/modules/auth_radius.so"
# ----------------- setting module-specific parameters ---------------
# -- usrloc params --
modparam("usrloc", "db_mode", 0)
# -- rr params --
# add value to ;lr param to make some broken UAs happy modparam("rr", "enable_full_lr", 1)
# ctl params
# by default ctl listens on unixs:/tmp/ser_ctl if no other address is # specified in modparams; this is also the default for sercmd modparam("ctl", "binrpc", "unixs:/tmp/ser_ctl") # listen on the "standard" fifo for backward compatibility modparam("ctl", "fifo", "fifo:/tmp/ser_fifo") # listen on tcp, localhost #modparam("ctl", "binrpc", "tcp:localhost:2046")
# -- auth_radius params --
modparam("auth_radius", "radius_config", "/usr/local/etc/radiusclient-ng/radiusclient.conf")
# ------------------------- request routing logic -------------------
# main routing logic
route{
# initial sanity checks -- messages with
# max_forwards==0, or excessively long requests
if (!mf_process_maxfwd_header("10")) {
sl_reply("483","Too Many Hops");
break;
}
if (msg:len >= max_len ) {
sl_reply("513", "Message too big");
break;
}
# we record-route all messages -- to make sure that
# subsequent messages will go through our proxy; that's
# particularly good if upstream and downstream entities
# use different transport protocol
if (!method=="REGISTER") record_route();
# subsequent messages withing a dialog should take the
# path determined by record-routing
if (loose_route()) {
# mark routing logic in request
append_hf("P-hint: rr-enforced\r\n");
route(FORWARD);
break;
}
if (!uri==myself) {
# mark routing logic in request
append_hf("P-hint: outbound\r\n");
route(FORWARD);
break;
}
# if the request is for other domain use UsrLoc
# (in case, it does not work, use the following command
# with proper names and addresses in it)
if (uri==myself) {
if (method=="REGISTER") {
# authentication
if (!radius_www_authorize("")) {
www_challenge("", "0");
break;
};
save_contacts("location");
break;
}
# native SIP destinations are handled using our USRLOC DB
if (!lookup_contacts("location")) {
sl_reply("404", "Not Found");
break;
}
append_hf("P-hint: usrloc applied\r\n");
}
route(FORWARD);
}
route[FORWARD]
{
# send it out now; use stateful forwarding as it works reliably
# even for UDP2TCP
if (!t_relay()) {
sl_reply_error();
}
}
Thanks,
Leon
_______________________________________________ Serusers mailing list Serusers@lists.iptel.org http://lists.iptel.org/mailman/listinfo/serusers
Hi,
In order to use radius you need auth_radius module to use database auth_db. Other thing is that if You want to authorize user as UAS (registrar) then You should use radius_www_authenticate(disgest_realm) function.
Kind regards, - Tomasz
2009/5/7 Leon Li Leon.Li@aarnet.edu.au
Thanks Tomasz,
I know we need different function, however, my problem is that it won’t accept www_challenge in ser.cfg which is introduced by auth module, I think.
if (method=="REGISTER") {*# authentication*if (!radius_www_authorize("")) {*www_challenge("", "0");*break;* };Regards
Leon
*From:* Tomasz Zieleniewski [mailto:tzieleniewski@gmail.com] *Sent:* Wednesday, 6 May 2009 6:25 PM *To:* Leon Li *Cc:* serusers@lists.iptel.org *Subject:* Re: [Serusers] SER with RADIUS
Hi,
From SER version 2.x in order to challenge a SIP Request with FreeRADIUS authorization You need to use the radius_proxy_authorize(digest_realm) function. And analogously proxy_authorize(digest_realm, credentials) if You want to use SER database.
Kind regards,
- Tomasz Zieleniewski
2009/5/6 Leon Li Leon.Li@aarnet.edu.au
Hi,
I am trying to make SER working with FreeRADIUS. However, I got an error using www_challenge, " 0(3184) parse error (119,25-26): unknown command, missing loadmodule?" The 119 line is www_challenge("", "0"); I did load auth module. Any idea?
Here is my config:
#
# $Id: ser-basic.cfg,v 1.1.2.2 2008/06/12 13:15:06 alfredh Exp $ # # This a very basic config file w aliases and anamed route but # w/o authentication, accounting, database, multi-domain support etc.
# Please refer to ser.cfg for a more complete example #
# ----------- global configuration parameters ------------------------
debug=3 # debug level (cmd line: -dddddddddd)
#memdbg=10 # memory debug message level
#memlog=10 # memory statistics log level #log_facility=LOG_LOCAL0 # sets the facility used for logging (see syslog(3))
/* Uncomment these lines to enter debugging mode fork=no log_stderror=yes */
check_via=no # (cmd. line: -v)
dns=no # (cmd. line: -r)
rev_dns=no # (cmd. line: -R)
listen=202.158.197.134
port=5060
children=4
#user=ser
#group=ser
#disable_core=yes #disables core dumping
#open_fd_limit=1024 # sets the open file descriptors limit #mhomed=yes # usefull for multihomed hosts, small performance penalty #disable_tcp=yes #tcp_accept_aliases=yes # accepts the tcp alias via option (see NEWS)
#
# ------------------ module loading ----------------------------------
loadmodule "/usr/local/lib/ser/modules/sl.so"
loadmodule "/usr/local/lib/ser/modules/tm.so"
loadmodule "/usr/local/lib/ser/modules/rr.so"
loadmodule "/usr/local/lib/ser/modules/textops.so"
loadmodule "/usr/local/lib/ser/modules/maxfwd.so"
loadmodule "/usr/local/lib/ser/modules/usrloc.so"
loadmodule "/usr/local/lib/ser/modules/registrar.so"
loadmodule "/usr/local/lib/ser/modules/ctl.so"
*loadmodule "/usr/local/lib/ser/modules/auth.so"*
loadmodule "/usr/local/lib/ser/modules/auth_radius.so"
# ----------------- setting module-specific parameters ---------------
# -- usrloc params --
modparam("usrloc", "db_mode", 0)
# -- rr params --
# add value to ;lr param to make some broken UAs happy modparam("rr", "enable_full_lr", 1)
# ctl params
# by default ctl listens on unixs:/tmp/ser_ctl if no other address is # specified in modparams; this is also the default for sercmd modparam("ctl", "binrpc", "unixs:/tmp/ser_ctl") # listen on the "standard" fifo for backward compatibility modparam("ctl", "fifo", "fifo:/tmp/ser_fifo") # listen on tcp, localhost #modparam("ctl", "binrpc", "tcp:localhost:2046")
# -- auth_radius params --
modparam("auth_radius", "radius_config", "/usr/local/etc/radiusclient-ng/radiusclient.conf")
# ------------------------- request routing logic -------------------
# main routing logic
route{
# initial sanity checks -- messages with # max_forwards==0, or excessively long requests if (!mf_process_maxfwd_header("10")) { sl_reply("483","Too Many Hops"); break; } if (msg:len >= max_len ) { sl_reply("513", "Message too big"); break; } # we record-route all messages -- to make sure that # subsequent messages will go through our proxy; that's # particularly good if upstream and downstream entities # use different transport protocol if (!method=="REGISTER") record_route(); # subsequent messages withing a dialog should take the # path determined by record-routing if (loose_route()) { # mark routing logic in request append_hf("P-hint: rr-enforced\r\n"); route(FORWARD); break; } if (!uri==myself) { # mark routing logic in request append_hf("P-hint: outbound\r\n"); route(FORWARD); break; } # if the request is for other domain use UsrLoc # (in case, it does not work, use the following command # with proper names and addresses in it) if (uri==myself) {
if (method=="REGISTER") {*# authentication*if (!radius_www_authorize("")) {*www_challenge("", "0");*break;* }; save_contacts("location"); break; } # native SIP destinations are handled using our USRLOC DB if (!lookup_contacts("location")) { sl_reply("404", "Not Found"); break; } append_hf("P-hint: usrloc applied\r\n"); } route(FORWARD);}
route[FORWARD]
{
# send it out now; use stateful forwarding as it works reliably # even for UDP2TCP if (!t_relay()) { sl_reply_error(); }}
Thanks,
Leon
Serusers mailing list Serusers@lists.iptel.org http://lists.iptel.org/mailman/listinfo/serusers
Hi,
I got the following settings on my SER handling authentication.
route[AUTHENTICATION]
{
# CANCELs and ACKs cannot be challenged.
if (method == "CANCEL" || method == "ACK") {
break;
}
# Authentication
if (method == "REGISTER") {
if (!radius_www_authenticate(" ")) {
www_challenge("", "1");
break;
}
save("location");
drop;
}
}
However, when I try to run SER with this file, error come up "unknown command, missing loadmodule?" indicating the line in red has problem. If I comment this line, SER starts fine but no authentication performed.
Anyone can help?
Thanks
Leon
From: Tomasz Zieleniewski [mailto:tzieleniewski@gmail.com] Sent: Thursday, 7 May 2009 11:03 PM To: Leon Li Cc: serusers@lists.iptel.org Subject: Re: [Serusers] SER with RADIUS
Hi,
In order to use radius you need auth_radius module to use database auth_db. Other thing is that if You want to authorize user as UAS (registrar) then You should use radius_www_authenticate(disgest_realm) function.
Kind regards, - Tomasz
2009/5/7 Leon Li Leon.Li@aarnet.edu.au
Thanks Tomasz,
I know we need different function, however, my problem is that it won't accept www_challenge in ser.cfg which is introduced by auth module, I think.
if (method=="REGISTER") {
# authentication
if (!radius_www_authorize("")) {
www_challenge("", "0");
break;
};
Regards
Leon
From: Tomasz Zieleniewski [mailto:tzieleniewski@gmail.com] Sent: Wednesday, 6 May 2009 6:25 PM To: Leon Li Cc: serusers@lists.iptel.org Subject: Re: [Serusers] SER with RADIUS
Hi,
From SER version 2.x in order to challenge a SIP Request with FreeRADIUS
authorization You need to use the radius_proxy_authorize(digest_realm) function. And analogously proxy_authorize(digest_realm, credentials) if You want to use SER database.
Kind regards, - Tomasz Zieleniewski
2009/5/6 Leon Li Leon.Li@aarnet.edu.au
Hi,
I am trying to make SER working with FreeRADIUS. However, I got an error using www_challenge, " 0(3184) parse error (119,25-26): unknown command, missing loadmodule?" The 119 line is www_challenge("", "0"); I did load auth module. Any idea?
Here is my config:
#
# $Id: ser-basic.cfg,v 1.1.2.2 2008/06/12 13:15:06 alfredh Exp $ # # This a very basic config file w aliases and anamed route but # w/o authentication, accounting, database, multi-domain support etc.
# Please refer to ser.cfg for a more complete example #
# ----------- global configuration parameters ------------------------
debug=3 # debug level (cmd line: -dddddddddd)
#memdbg=10 # memory debug message level
#memlog=10 # memory statistics log level #log_facility=LOG_LOCAL0 # sets the facility used for logging (see syslog(3))
/* Uncomment these lines to enter debugging mode fork=no log_stderror=yes */
check_via=no # (cmd. line: -v)
dns=no # (cmd. line: -r)
rev_dns=no # (cmd. line: -R)
listen=202.158.197.134
port=5060
children=4
#user=ser
#group=ser
#disable_core=yes #disables core dumping
#open_fd_limit=1024 # sets the open file descriptors limit #mhomed=yes # usefull for multihomed hosts, small performance penalty #disable_tcp=yes #tcp_accept_aliases=yes # accepts the tcp alias via option (see NEWS)
#
# ------------------ module loading ----------------------------------
loadmodule "/usr/local/lib/ser/modules/sl.so"
loadmodule "/usr/local/lib/ser/modules/tm.so"
loadmodule "/usr/local/lib/ser/modules/rr.so"
loadmodule "/usr/local/lib/ser/modules/textops.so"
loadmodule "/usr/local/lib/ser/modules/maxfwd.so"
loadmodule "/usr/local/lib/ser/modules/usrloc.so"
loadmodule "/usr/local/lib/ser/modules/registrar.so"
loadmodule "/usr/local/lib/ser/modules/ctl.so"
loadmodule "/usr/local/lib/ser/modules/auth.so"
loadmodule "/usr/local/lib/ser/modules/auth_radius.so"
# ----------------- setting module-specific parameters ---------------
# -- usrloc params --
modparam("usrloc", "db_mode", 0)
# -- rr params --
# add value to ;lr param to make some broken UAs happy modparam("rr", "enable_full_lr", 1)
# ctl params
# by default ctl listens on unixs:/tmp/ser_ctl if no other address is # specified in modparams; this is also the default for sercmd modparam("ctl", "binrpc", "unixs:/tmp/ser_ctl") # listen on the "standard" fifo for backward compatibility modparam("ctl", "fifo", "fifo:/tmp/ser_fifo") # listen on tcp, localhost #modparam("ctl", "binrpc", "tcp:localhost:2046")
# -- auth_radius params --
modparam("auth_radius", "radius_config", "/usr/local/etc/radiusclient-ng/radiusclient.conf")
# ------------------------- request routing logic -------------------
# main routing logic
route{
# initial sanity checks -- messages with
# max_forwards==0, or excessively long requests
if (!mf_process_maxfwd_header("10")) {
sl_reply("483","Too Many Hops");
break;
}
if (msg:len >= max_len ) {
sl_reply("513", "Message too big");
break;
}
# we record-route all messages -- to make sure that
# subsequent messages will go through our proxy; that's
# particularly good if upstream and downstream entities
# use different transport protocol
if (!method=="REGISTER") record_route();
# subsequent messages withing a dialog should take the
# path determined by record-routing
if (loose_route()) {
# mark routing logic in request
append_hf("P-hint: rr-enforced\r\n");
route(FORWARD);
break;
}
if (!uri==myself) {
# mark routing logic in request
append_hf("P-hint: outbound\r\n");
route(FORWARD);
break;
}
# if the request is for other domain use UsrLoc
# (in case, it does not work, use the following command
# with proper names and addresses in it)
if (uri==myself) {
if (method=="REGISTER") {
# authentication
if (!radius_www_authorize("")) {
www_challenge("", "0");
break;
};
save_contacts("location");
break;
}
# native SIP destinations are handled using our USRLOC DB
if (!lookup_contacts("location")) {
sl_reply("404", "Not Found");
break;
}
append_hf("P-hint: usrloc applied\r\n");
}
route(FORWARD);
}
route[FORWARD]
{
# send it out now; use stateful forwarding as it works reliably
# even for UDP2TCP
if (!t_relay()) {
sl_reply_error();
}
}
Thanks,
Leon
_______________________________________________ Serusers mailing list Serusers@lists.iptel.org http://lists.iptel.org/mailman/listinfo/serusers
Hi,
You must use www_authenticate(digest_realm, credentials) function in order to perform the user authentication.
BTW which version of SER do You use?
Kind regards, Tomasz
2009/5/12 Leon Li Leon.Li@aarnet.edu.au
Hi,
I got the following settings on my SER handling authentication.
route[AUTHENTICATION]
{
# CANCELs and ACKs cannot be challenged. if (method == "CANCEL" || method == "ACK") { break; } # Authentication if (method == "REGISTER") { if (!radius_www_authenticate(" ")) { *www_challenge("", "1");* break; } save("location"); drop; }}
However, when I try to run SER with this file, error come up “unknown command, missing loadmodule?” indicating the line in red has problem. If I comment this line, SER starts fine but no authentication performed.
Anyone can help?
Thanks
Leon
*From:* Tomasz Zieleniewski [mailto:tzieleniewski@gmail.com] *Sent:* Thursday, 7 May 2009 11:03 PM
*To:* Leon Li *Cc:* serusers@lists.iptel.org *Subject:* Re: [Serusers] SER with RADIUS
Hi,
In order to use radius you need auth_radius module to use database auth_db. Other thing is that if You want to authorize user as UAS (registrar) then You should use radius_www_authenticate(disgest_realm) function.
Kind regards,
- Tomasz
2009/5/7 Leon Li Leon.Li@aarnet.edu.au
Thanks Tomasz,
I know we need different function, however, my problem is that it won’t accept www_challenge in ser.cfg which is introduced by auth module, I think.
if (method=="REGISTER") {*# authentication*if (!radius_www_authorize("")) {*www_challenge("", "0");*break;* };Regards
Leon
*From:* Tomasz Zieleniewski [mailto:tzieleniewski@gmail.com] *Sent:* Wednesday, 6 May 2009 6:25 PM *To:* Leon Li *Cc:* serusers@lists.iptel.org *Subject:* Re: [Serusers] SER with RADIUS
Hi,
From SER version 2.x in order to challenge a SIP Request with FreeRADIUS authorization You need to use the radius_proxy_authorize(digest_realm) function. And analogously proxy_authorize(digest_realm, credentials) if You want to use SER database.
Kind regards,
- Tomasz Zieleniewski
2009/5/6 Leon Li Leon.Li@aarnet.edu.au
Hi,
I am trying to make SER working with FreeRADIUS. However, I got an error using www_challenge, " 0(3184) parse error (119,25-26): unknown command, missing loadmodule?" The 119 line is www_challenge("", "0"); I did load auth module. Any idea?
Here is my config:
#
# $Id: ser-basic.cfg,v 1.1.2.2 2008/06/12 13:15:06 alfredh Exp $ # # This a very basic config file w aliases and anamed route but # w/o authentication, accounting, database, multi-domain support etc.
# Please refer to ser.cfg for a more complete example #
# ----------- global configuration parameters ------------------------
debug=3 # debug level (cmd line: -dddddddddd)
#memdbg=10 # memory debug message level
#memlog=10 # memory statistics log level #log_facility=LOG_LOCAL0 # sets the facility used for logging (see syslog(3))
/* Uncomment these lines to enter debugging mode fork=no log_stderror=yes */
check_via=no # (cmd. line: -v)
dns=no # (cmd. line: -r)
rev_dns=no # (cmd. line: -R)
listen=202.158.197.134
port=5060
children=4
#user=ser
#group=ser
#disable_core=yes #disables core dumping
#open_fd_limit=1024 # sets the open file descriptors limit #mhomed=yes # usefull for multihomed hosts, small performance penalty #disable_tcp=yes #tcp_accept_aliases=yes # accepts the tcp alias via option (see NEWS)
#
# ------------------ module loading ----------------------------------
loadmodule "/usr/local/lib/ser/modules/sl.so"
loadmodule "/usr/local/lib/ser/modules/tm.so"
loadmodule "/usr/local/lib/ser/modules/rr.so"
loadmodule "/usr/local/lib/ser/modules/textops.so"
loadmodule "/usr/local/lib/ser/modules/maxfwd.so"
loadmodule "/usr/local/lib/ser/modules/usrloc.so"
loadmodule "/usr/local/lib/ser/modules/registrar.so"
loadmodule "/usr/local/lib/ser/modules/ctl.so"
*loadmodule "/usr/local/lib/ser/modules/auth.so"*
loadmodule "/usr/local/lib/ser/modules/auth_radius.so"
# ----------------- setting module-specific parameters ---------------
# -- usrloc params --
modparam("usrloc", "db_mode", 0)
# -- rr params --
# add value to ;lr param to make some broken UAs happy modparam("rr", "enable_full_lr", 1)
# ctl params
# by default ctl listens on unixs:/tmp/ser_ctl if no other address is # specified in modparams; this is also the default for sercmd modparam("ctl", "binrpc", "unixs:/tmp/ser_ctl") # listen on the "standard" fifo for backward compatibility modparam("ctl", "fifo", "fifo:/tmp/ser_fifo") # listen on tcp, localhost #modparam("ctl", "binrpc", "tcp:localhost:2046")
# -- auth_radius params --
modparam("auth_radius", "radius_config", "/usr/local/etc/radiusclient-ng/radiusclient.conf")
# ------------------------- request routing logic -------------------
# main routing logic
route{
# initial sanity checks -- messages with # max_forwards==0, or excessively long requests if (!mf_process_maxfwd_header("10")) { sl_reply("483","Too Many Hops"); break; } if (msg:len >= max_len ) { sl_reply("513", "Message too big"); break; } # we record-route all messages -- to make sure that # subsequent messages will go through our proxy; that's # particularly good if upstream and downstream entities # use different transport protocol if (!method=="REGISTER") record_route(); # subsequent messages withing a dialog should take the # path determined by record-routing if (loose_route()) { # mark routing logic in request append_hf("P-hint: rr-enforced\r\n"); route(FORWARD); break; } if (!uri==myself) { # mark routing logic in request append_hf("P-hint: outbound\r\n"); route(FORWARD); break; } # if the request is for other domain use UsrLoc # (in case, it does not work, use the following command # with proper names and addresses in it) if (uri==myself) {
if (method=="REGISTER") {*# authentication*if (!radius_www_authorize("")) {*www_challenge("", "0");*break;* }; save_contacts("location"); break; } # native SIP destinations are handled using our USRLOC DB if (!lookup_contacts("location")) { sl_reply("404", "Not Found"); break; } append_hf("P-hint: usrloc applied\r\n"); } route(FORWARD);}
route[FORWARD]
{
# send it out now; use stateful forwarding as it works reliably # even for UDP2TCP if (!t_relay()) { sl_reply_error(); }}
Thanks,
Leon
Serusers mailing list Serusers@lists.iptel.org http://lists.iptel.org/mailman/listinfo/serusers
Serusers mailing list Serusers@lists.iptel.org http://lists.iptel.org/mailman/listinfo/serusers
Hi,
I am using 2.0.0.
And I am using radius_www_authenticate to authenticate via FreeRADIUS. The problem is not with this function, but www_challenge function returns error "unknown command, missing loadmodule?".
Cheers
Leon
From: Tomasz Zieleniewski [mailto:tzieleniewski@gmail.com] Sent: Tuesday, 12 May 2009 5:44 PM To: Leon Li Cc: serusers@lists.iptel.org Subject: Re: [Serusers] SER with RADIUS
Hi,
You must use www_authenticate(digest_realm, credentials) function in order to perform the user authentication.
BTW which version of SER do You use?
Kind regards, Tomasz
2009/5/12 Leon Li Leon.Li@aarnet.edu.au
Hi,
I got the following settings on my SER handling authentication.
route[AUTHENTICATION]
{
# CANCELs and ACKs cannot be challenged.
if (method == "CANCEL" || method == "ACK") {
break;
}
# Authentication
if (method == "REGISTER") {
if (!radius_www_authenticate(" ")) {
www_challenge("", "1");
break;
}
save("location");
drop;
}
}
However, when I try to run SER with this file, error come up "unknown command, missing loadmodule?" indicating the line in red has problem. If I comment this line, SER starts fine but no authentication performed.
Anyone can help?
Thanks
Leon
From: Tomasz Zieleniewski [mailto:tzieleniewski@gmail.com] Sent: Thursday, 7 May 2009 11:03 PM
To: Leon Li Cc: serusers@lists.iptel.org Subject: Re: [Serusers] SER with RADIUS
Hi,
In order to use radius you need auth_radius module to use database auth_db. Other thing is that if You want to authorize user as UAS (registrar) then You should use radius_www_authenticate(disgest_realm) function.
Kind regards, - Tomasz
2009/5/7 Leon Li Leon.Li@aarnet.edu.au
Thanks Tomasz,
I know we need different function, however, my problem is that it won't accept www_challenge in ser.cfg which is introduced by auth module, I think.
if (method=="REGISTER") {
# authentication
if (!radius_www_authorize("")) {
www_challenge("", "0");
break;
};
Regards
Leon
From: Tomasz Zieleniewski [mailto:tzieleniewski@gmail.com] Sent: Wednesday, 6 May 2009 6:25 PM To: Leon Li Cc: serusers@lists.iptel.org Subject: Re: [Serusers] SER with RADIUS
Hi,
From SER version 2.x in order to challenge a SIP Request with FreeRADIUS
authorization You need to use the radius_proxy_authorize(digest_realm) function. And analogously proxy_authorize(digest_realm, credentials) if You want to use SER database.
Kind regards, - Tomasz Zieleniewski
2009/5/6 Leon Li Leon.Li@aarnet.edu.au
Hi,
I am trying to make SER working with FreeRADIUS. However, I got an error using www_challenge, " 0(3184) parse error (119,25-26): unknown command, missing loadmodule?" The 119 line is www_challenge("", "0"); I did load auth module. Any idea?
Here is my config:
#
# $Id: ser-basic.cfg,v 1.1.2.2 2008/06/12 13:15:06 alfredh Exp $ # # This a very basic config file w aliases and anamed route but # w/o authentication, accounting, database, multi-domain support etc.
# Please refer to ser.cfg for a more complete example #
# ----------- global configuration parameters ------------------------
debug=3 # debug level (cmd line: -dddddddddd)
#memdbg=10 # memory debug message level
#memlog=10 # memory statistics log level #log_facility=LOG_LOCAL0 # sets the facility used for logging (see syslog(3))
/* Uncomment these lines to enter debugging mode fork=no log_stderror=yes */
check_via=no # (cmd. line: -v)
dns=no # (cmd. line: -r)
rev_dns=no # (cmd. line: -R)
listen=202.158.197.134
port=5060
children=4
#user=ser
#group=ser
#disable_core=yes #disables core dumping
#open_fd_limit=1024 # sets the open file descriptors limit #mhomed=yes # usefull for multihomed hosts, small performance penalty #disable_tcp=yes #tcp_accept_aliases=yes # accepts the tcp alias via option (see NEWS)
#
# ------------------ module loading ----------------------------------
loadmodule "/usr/local/lib/ser/modules/sl.so"
loadmodule "/usr/local/lib/ser/modules/tm.so"
loadmodule "/usr/local/lib/ser/modules/rr.so"
loadmodule "/usr/local/lib/ser/modules/textops.so"
loadmodule "/usr/local/lib/ser/modules/maxfwd.so"
loadmodule "/usr/local/lib/ser/modules/usrloc.so"
loadmodule "/usr/local/lib/ser/modules/registrar.so"
loadmodule "/usr/local/lib/ser/modules/ctl.so"
loadmodule "/usr/local/lib/ser/modules/auth.so"
loadmodule "/usr/local/lib/ser/modules/auth_radius.so"
# ----------------- setting module-specific parameters ---------------
# -- usrloc params --
modparam("usrloc", "db_mode", 0)
# -- rr params --
# add value to ;lr param to make some broken UAs happy modparam("rr", "enable_full_lr", 1)
# ctl params
# by default ctl listens on unixs:/tmp/ser_ctl if no other address is # specified in modparams; this is also the default for sercmd modparam("ctl", "binrpc", "unixs:/tmp/ser_ctl") # listen on the "standard" fifo for backward compatibility modparam("ctl", "fifo", "fifo:/tmp/ser_fifo") # listen on tcp, localhost #modparam("ctl", "binrpc", "tcp:localhost:2046")
# -- auth_radius params --
modparam("auth_radius", "radius_config", "/usr/local/etc/radiusclient-ng/radiusclient.conf")
# ------------------------- request routing logic -------------------
# main routing logic
route{
# initial sanity checks -- messages with
# max_forwards==0, or excessively long requests
if (!mf_process_maxfwd_header("10")) {
sl_reply("483","Too Many Hops");
break;
}
if (msg:len >= max_len ) {
sl_reply("513", "Message too big");
break;
}
# we record-route all messages -- to make sure that
# subsequent messages will go through our proxy; that's
# particularly good if upstream and downstream entities
# use different transport protocol
if (!method=="REGISTER") record_route();
# subsequent messages withing a dialog should take the
# path determined by record-routing
if (loose_route()) {
# mark routing logic in request
append_hf("P-hint: rr-enforced\r\n");
route(FORWARD);
break;
}
if (!uri==myself) {
# mark routing logic in request
append_hf("P-hint: outbound\r\n");
route(FORWARD);
break;
}
# if the request is for other domain use UsrLoc
# (in case, it does not work, use the following command
# with proper names and addresses in it)
if (uri==myself) {
if (method=="REGISTER") {
# authentication
if (!radius_www_authorize("")) {
www_challenge("", "0");
break;
};
save_contacts("location");
break;
}
# native SIP destinations are handled using our USRLOC DB
if (!lookup_contacts("location")) {
sl_reply("404", "Not Found");
break;
}
append_hf("P-hint: usrloc applied\r\n");
}
route(FORWARD);
}
route[FORWARD]
{
# send it out now; use stateful forwarding as it works reliably
# even for UDP2TCP
if (!t_relay()) {
sl_reply_error();
}
}
Thanks,
Leon
_______________________________________________ Serusers mailing list Serusers@lists.iptel.org http://lists.iptel.org/mailman/listinfo/serusers
_______________________________________________ Serusers mailing list Serusers@lists.iptel.org http://lists.iptel.org/mailman/listinfo/serusers
use www_authenticate(digest_realm, credentials) instead...
2009/5/13 Leon Li Leon.Li@aarnet.edu.au
Hi,
I am using 2.0.0.
And I am using radius_www_authenticate to authenticate via FreeRADIUS. The problem is not with this function, but *www_challenge function returns error **“unknown command, missing loadmodule?”.*
Cheers
Leon
*From:* Tomasz Zieleniewski [mailto:tzieleniewski@gmail.com] *Sent:* Tuesday, 12 May 2009 5:44 PM
*To:* Leon Li *Cc:* serusers@lists.iptel.org *Subject:* Re: [Serusers] SER with RADIUS
Hi,
You must use www_authenticate(digest_realm, credentials) function in order to perform the user authentication.
BTW which version of SER do You use?
Kind regards, Tomasz
2009/5/12 Leon Li Leon.Li@aarnet.edu.au
Hi,
I got the following settings on my SER handling authentication.
route[AUTHENTICATION]
{
# CANCELs and ACKs cannot be challenged. if (method == "CANCEL" || method == "ACK") { break; } # Authentication if (method == "REGISTER") { if (!radius_www_authenticate(" ")) { *www_challenge("", "1");* break; } save("location"); drop; }}
However, when I try to run SER with this file, error come up “unknown command, missing loadmodule?” indicating the line in red has problem. If I comment this line, SER starts fine but no authentication performed.
Anyone can help?
Thanks
Leon
*From:* Tomasz Zieleniewski [mailto:tzieleniewski@gmail.com] *Sent:* Thursday, 7 May 2009 11:03 PM
*To:* Leon Li *Cc:* serusers@lists.iptel.org *Subject:* Re: [Serusers] SER with RADIUS
Hi,
In order to use radius you need auth_radius module to use database auth_db. Other thing is that if You want to authorize user as UAS (registrar) then You should use radius_www_authenticate(disgest_realm) function.
Kind regards,
- Tomasz
2009/5/7 Leon Li Leon.Li@aarnet.edu.au
Thanks Tomasz,
I know we need different function, however, my problem is that it won’t accept www_challenge in ser.cfg which is introduced by auth module, I think.
if (method=="REGISTER") {*# authentication*if (!radius_www_authorize("")) {*www_challenge("", "0");*break;* };Regards
Leon
*From:* Tomasz Zieleniewski [mailto:tzieleniewski@gmail.com] *Sent:* Wednesday, 6 May 2009 6:25 PM *To:* Leon Li *Cc:* serusers@lists.iptel.org *Subject:* Re: [Serusers] SER with RADIUS
Hi,
From SER version 2.x in order to challenge a SIP Request with FreeRADIUS authorization You need to use the radius_proxy_authorize(digest_realm) function. And analogously proxy_authorize(digest_realm, credentials) if You want to use SER database.
Kind regards,
- Tomasz Zieleniewski
2009/5/6 Leon Li Leon.Li@aarnet.edu.au
Hi,
I am trying to make SER working with FreeRADIUS. However, I got an error using www_challenge, " 0(3184) parse error (119,25-26): unknown command, missing loadmodule?" The 119 line is www_challenge("", "0"); I did load auth module. Any idea?
Here is my config:
#
# $Id: ser-basic.cfg,v 1.1.2.2 2008/06/12 13:15:06 alfredh Exp $ # # This a very basic config file w aliases and anamed route but # w/o authentication, accounting, database, multi-domain support etc.
# Please refer to ser.cfg for a more complete example #
# ----------- global configuration parameters ------------------------
debug=3 # debug level (cmd line: -dddddddddd)
#memdbg=10 # memory debug message level
#memlog=10 # memory statistics log level #log_facility=LOG_LOCAL0 # sets the facility used for logging (see syslog(3))
/* Uncomment these lines to enter debugging mode fork=no log_stderror=yes */
check_via=no # (cmd. line: -v)
dns=no # (cmd. line: -r)
rev_dns=no # (cmd. line: -R)
listen=202.158.197.134
port=5060
children=4
#user=ser
#group=ser
#disable_core=yes #disables core dumping
#open_fd_limit=1024 # sets the open file descriptors limit #mhomed=yes # usefull for multihomed hosts, small performance penalty #disable_tcp=yes #tcp_accept_aliases=yes # accepts the tcp alias via option (see NEWS)
#
# ------------------ module loading ----------------------------------
loadmodule "/usr/local/lib/ser/modules/sl.so"
loadmodule "/usr/local/lib/ser/modules/tm.so"
loadmodule "/usr/local/lib/ser/modules/rr.so"
loadmodule "/usr/local/lib/ser/modules/textops.so"
loadmodule "/usr/local/lib/ser/modules/maxfwd.so"
loadmodule "/usr/local/lib/ser/modules/usrloc.so"
loadmodule "/usr/local/lib/ser/modules/registrar.so"
loadmodule "/usr/local/lib/ser/modules/ctl.so"
*loadmodule "/usr/local/lib/ser/modules/auth.so"*
loadmodule "/usr/local/lib/ser/modules/auth_radius.so"
# ----------------- setting module-specific parameters ---------------
# -- usrloc params --
modparam("usrloc", "db_mode", 0)
# -- rr params --
# add value to ;lr param to make some broken UAs happy modparam("rr", "enable_full_lr", 1)
# ctl params
# by default ctl listens on unixs:/tmp/ser_ctl if no other address is # specified in modparams; this is also the default for sercmd modparam("ctl", "binrpc", "unixs:/tmp/ser_ctl") # listen on the "standard" fifo for backward compatibility modparam("ctl", "fifo", "fifo:/tmp/ser_fifo") # listen on tcp, localhost #modparam("ctl", "binrpc", "tcp:localhost:2046")
# -- auth_radius params --
modparam("auth_radius", "radius_config", "/usr/local/etc/radiusclient-ng/radiusclient.conf")
# ------------------------- request routing logic -------------------
# main routing logic
route{
# initial sanity checks -- messages with # max_forwards==0, or excessively long requests if (!mf_process_maxfwd_header("10")) { sl_reply("483","Too Many Hops"); break; } if (msg:len >= max_len ) { sl_reply("513", "Message too big"); break; } # we record-route all messages -- to make sure that # subsequent messages will go through our proxy; that's # particularly good if upstream and downstream entities # use different transport protocol if (!method=="REGISTER") record_route(); # subsequent messages withing a dialog should take the # path determined by record-routing if (loose_route()) { # mark routing logic in request append_hf("P-hint: rr-enforced\r\n"); route(FORWARD); break; } if (!uri==myself) { # mark routing logic in request append_hf("P-hint: outbound\r\n"); route(FORWARD); break; } # if the request is for other domain use UsrLoc # (in case, it does not work, use the following command # with proper names and addresses in it) if (uri==myself) {
if (method=="REGISTER") {*# authentication*if (!radius_www_authorize("")) {*www_challenge("", "0");*break;* }; save_contacts("location"); break; } # native SIP destinations are handled using our USRLOC DB if (!lookup_contacts("location")) { sl_reply("404", "Not Found"); break; } append_hf("P-hint: usrloc applied\r\n"); } route(FORWARD);}
route[FORWARD]
{
# send it out now; use stateful forwarding as it works reliably # even for UDP2TCP if (!t_relay()) { sl_reply_error(); }}
Thanks,
Leon
Serusers mailing list Serusers@lists.iptel.org http://lists.iptel.org/mailman/listinfo/serusers
Serusers mailing list Serusers@lists.iptel.org http://lists.iptel.org/mailman/listinfo/serusers
-
Leon Li -
Tomasz Zieleniewski