If you could paste the freeswitch log on startup to pb. Assuming tls is set to true on the sofia profile and the tls-cert-dir has the cacert.pem and agent.pem it should be starting up. You can also from a running freeswitch just turn debug level on (F8) run fsctl send_sighup (rotates to a clean log file) then type reload mod_sofia then fsctl send_sighup again once its finished loading and PB that log. ~Mitch

On Thu, 15 Mar 2012 11:39:45 -0700 Mitch Capper <mitch.capper@gmail.com> wrote: Ok, I found why I had "tls [false]": I had the same block commented below with false for tls (so, xml isn't able to comment several lines in one comment block, just another reason to hate it...) Now reloading mod_sofia show that tls is enabled - good; but I lost 5060 & 5080 ports and still no 5061 nor 5081 - weird. JY -- 40 isn't old. If you're a tree.

On Thu, 15 Mar 2012 11:39:45 -0700 Mitch Capper <mitch.capper@gmail.com> wrote: There's definitely something wrong in my conf: I restarted from the last working one (w/o tls nor srtp) to make sure my base was clear. I followed the wiki (http://wiki.freeswitch.org/wiki/SIP_TLS): * generated certs: CA & svr, * modified conf/vars (enabling port 5081 only), * restart FS netstat -pan|grep swit tcp 0 0 0.0.0.0:8787 0.0.0.0:* LISTEN 10576/freeswitch tcp 0 0 127.0.0.1:8021 0.0.0.0:* LISTEN 10576/freeswitch tcp 0 0 192.168.1.25:5060 0.0.0.0:* LISTEN 10576/freeswitch tcp 0 0 127.0.0.1:8021 127.0.0.1:57654 ESTABLISHED 10576/freeswitch tcp6 0 0 ::1:5060 :::* LISTEN 10576/freeswitch udp 0 0 192.168.1.25:5060 0.0.0.0:* 10576/freeswitch udp 0 0 192.168.1.25:53226 192.168.1.1:5351 ESTABLISHED 10576/freeswitch udp6 0 0 ::1:5060 :::* 10576/freeswitch no more 5080 port, and of course no 5081. A "reload mod_sofia" agrees w/ my conf: tls false for 5061 & true for 5081. Could it be linked to the fact I use fusionpbx, or what else (apart nescafé:)? JY -- The first guy that rats gets a belly-full of slugs in the head. Understand? -- Joey Glimco, trade unionist

On Thu, 15 Mar 2012 17:25:19 -0700 Mitch Capper <mitch.capper@gmail.com> wrote:

Post your sofia profile xml file

I'm not really sure of what you want nor where to get it, so I attached conf/autoload_configs/sofia.conf.xml (?) I also attached the only file I see connected to one of my accounts: conf/directory/default/v_01.xml

and the log to pb we can take a look from there.

I don't know what "log to pb" means, so I attached the result of reload mod_sofia. JY --

On Thu, 15 Mar 2012 21:10:02 -0400 Brian Foster <bdfoster@endigotech.com> wrote:

We need to see the profile configuration file. See /usr/local/freeswitch/conf/sip_profiles/internal.xml

Also 'pb' is the pastebin, so pastebin everything to http://pastebin.freeswitch.org. pb everything separately and give links and the description in your reply so we can decode what we are seeing.

Ok, this is clear. Log part corresponding to "reload mod_sofia": http://pastebin.freeswitch.org/18650 conf/sip_profiles/internal.xml http://pastebin.freeswitch.org/18651 conf/vars.xml http://pastebin.freeswitch.org/18652 conf/directory/default.xml http://pastebin.freeswitch.org/18655 conf/directory/default/v_01.xml http://pastebin.freeswitch.org/18654 JY --

On Thu, 15 Mar 2012 18:41:44 -0700 Mitch Capper <mitch.capper@gmail.com> wrote:

To confirm are you trying to enable tls on your public profile (5080/5081) or internal profile (5060/5061)

Well, it depends on your answer to my last post.

Also in looking at the vars.xml you cannot comment out X-PRE-PROCESS lines.

You must break the X-PRE-PROCESS tag up, as its actually handled BEFORE xml comments are taken into effect. I think you were noticing this oddness before and so the best way is to ensure you alter the tagname itself to fix that.

This one's really weird! (I pasted your post into the file to make sure I won't ever forget that.) But it don't change anything as the commented line is located before tls activation, so FS first read a false, then a true (except if you tell me it only read once a parm, which would be VERY weird.) -- * Overfiend prefers girls who have developed, and DON'T FUCKING **GIGGLE**

On Thu, 15 Mar 2012 20:34:15 -0700 Mitch Capper <mitch.capper@gmail.com> wrote:

No you double set most of the x-pre-process items so I didn't see any issues but its a very easy way to make a mistake by trying to comment them out:) It gets weirder if you try and comment out an include x-pre-process header as it will still include everything.

According to a precedent post of yours, my test shows that breaking the x-pre-process header in 2 pieces works.

Public certainly can be for remote users but generally public means not-authed (and generally less reason to be encrypted) but as you are just trying to test lets leave it as it is.

Hmm, this one will be entirely private (may be there will be a PSTN exhaust, but here through an ATA, not from a provider); it'll also be a way to make very private conferences.

I still however need: It looks like TLS is enabled on your public profile and should be listening on 5081 and disabled on the internal profile.

Yep, this is what I want I just modified 1 line in vars.xml to do so. BTW, whether conf/directory/default.xml is modified or not don't have any impact: ASA vars.xml is modified, it disable the tls authorized branch.

With that said if you could run "sofia status" at the freeswitch console and then the "netstat -nlp | grep frees" and pb the results.

done sofia status: http://pastebin.freeswitch.org/18665 I PB both results, just in case: netstat -pan|grep swi: http://pastebin.freeswitch.org/18666 netstat -pln|grep swi: http://pastebin.freeswitch.org/18668 JY -- The best way to avoid responsibility is to say, "I've got responsibilities."

On Fri, 16 Mar 2012 07:35:17 -0700 Mitch Capper <mitch.capper@gmail.com> wrote:

Well something is certainly going wrong s sofia isn't showing it listening. Shutdown freeswitch and run: export SOFIA_DEBUG=9 export NUA_DEBUG=9 export NTA_DEBUG=9 export TPORT_DEBUG=9

Then start freeswitch enable console debug (F8), then do reload

In fact, when I hit F8 it says log level's 7; but issuing log level 9 worked - log's a bit hard to recover as it almost continuously scroll: is there a way to temporarily redirect the console output to a file?

mod_sofia and PB the log of what happens.

but here we go: http://pastebin.freeswitch.org/18671 -- It is more rational to sacrifice one life than six. -- Spock, "The Galileo Seven", stardate 2822.3

On Fri, 16 Mar 2012 08:10:11 -0700 Mitch Capper <mitch.capper@gmail.com> wrote:

There is http://wiki.freeswitch.org/wiki/Fs_logger.pl which can capture debug output and post it to PB or a file. It currently requires you to apply a patch from http://jira.freeswitch.org/browse/FS-3188 but that may change soon.

Ok, I'll give it a try, thanks. JY -- Your canceled check is your receipt.

saw your PB and your issue. FS will drop priv by default and I am guessing the freeswitch user can't read the keys you generated, apply proper permissions to them and you should be in good shape: tport_tls_init_master(0x92a3f78): tls key = /usr/local/freeswitch/conf/ssl/agent.pem tls_init_context: invalid local certificate: /usr/local/freeswitch/conf/ssl/agent.pem tls_init_context: 0200100d:system library:fopen:Permission denied tls_init_context: 20074002:BIO routines:FILE_CTRL:system lib tls_init_context: 140ad002:SSL routines:SSL_CTX_use_certificate_file:system lib tls_init_context: invalid private key: /usr/local/freeswitch/conf/ssl/agent.pem tls_init_context(key): 0200100d:system library:fopen:Permission denied ~Mitch

Brian is right on his comments, and the internal profile was missing but looking at the log I did notice a few things: It looks like TLS is enabled on your public profile and should be listening on 5081 and disabled on the internal profile. Normally you would want these reversed tls is generally used for users registering to your FS box rather than your public profile. With that said if you could run "sofia status" and then the "netstat -nlp | grep frees". Thanks ~Mitch