People, Please do excuse me if this is a FAQ. I've so far not worked out a way to implement IP authentication effectively. I have a number of gateways/end points/...etc. hitting the switch without registration and originating calls to a number of upstreams I have configured. So far, everything is smooth and FREESwitch is legendary in every way. Over 10,000 simultaneous sessions at 120cps, on a dual-Xeon machine running CentOS and CPU usage is barely a blip. My problem is authentication. I need a method to authenticate end points based only on their IP addresses. I am currently filtering access through the firewalls, but I would really like to delegate this task to FS in prep for an SBC setup I'm working on. If I remove the firewall filters, then anyone is able to get in. I could't workout precisely how ACLs work in FS from the WiKi and the documentation, and I haven't been able to make sense of how Digest functions either. Can anyone shed some light on those two areas ? I would like to really get to the bottom of this and update the WiKi pages with the working setup once done. Regards, Ahmed. -- Ahmed A. Ibrahim-Naji Al-Alousi Ph.D., MIEE, MBCS
Check out: http://wiki.freeswitch.org/wiki/ACL#Users It'll automatically add users with a cidr= attribute to the ACL list. This way you can set channel variables in the users and use them through your dialplan, all authenticated by ip address. Cheers, Mathieu Rene Avant-Garde Solutions Inc Office: + 1 (514) 664-1044 x100 Cell: +1 (514) 664-1044 x200 mrene@avgs.ca On 20-Dec-09, at 3:19 PM, Ahmed Naji wrote:
People,
Please do excuse me if this is a FAQ.
I've so far not worked out a way to implement IP authentication effectively. I have a number of gateways/end points/...etc. hitting the switch without registration and originating calls to a number of upstreams I have configured.
So far, everything is smooth and FREESwitch is legendary in every way. Over 10,000 simultaneous sessions at 120cps, on a dual-Xeon machine running CentOS and CPU usage is barely a blip.
My problem is authentication. I need a method to authenticate end points based only on their IP addresses. I am currently filtering access through the firewalls, but I would really like to delegate this task to FS in prep for an SBC setup I'm working on. If I remove the firewall filters, then anyone is able to get in.
I could't workout precisely how ACLs work in FS from the WiKi and the documentation, and I haven't been able to make sense of how Digest functions either.
Can anyone shed some light on those two areas ? I would like to really get to the bottom of this and update the WiKi pages with the working setup once done.
Regards,
Ahmed.
-- Ahmed A. Ibrahim-Naji Al-Alousi Ph.D., MIEE, MBCS _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I recently added an overview to this wiki page to help make things more clear as to which ACL you need for different purposes. http://wiki.freeswitch.org/wiki/ACL#Overview Thanks, Bill W. Mathieu Rene wrote:
Check out: http://wiki.freeswitch.org/wiki/ACL#Users
It'll automatically add users with a cidr= attribute to the ACL list. This way you can set channel variables in the users and use them through your dialplan, all authenticated by ip address.
Cheers,
Mathieu Rene Avant-Garde Solutions Inc Office: + 1 (514) 664-1044 x100 Cell: +1 (514) 664-1044 x200 mrene@avgs.ca <mailto:mrene@avgs.ca>
Bill, Thanks for your ACL Overview. Perhaps you can help me understand more clearly. If you include the "local-network-acl" and "apply-inbound-acl" params in the sip_profiles and setup the list for "localnet.auto" in acl.conf.xml, does this mean you do not have to include the cidr attribute for individual extensions in the directory/default folder? Is "apply-inbound-acl" supposed to exist in both internal and external profiles while "apply-inbound-acl" is only in the internal? Thanks, Lars
-----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users- bounces@lists.freeswitch.org] On Behalf Of Bill W Sent: Monday, December 21, 2009 9:03 AM To: freeswitch-users@lists.freeswitch.org Subject: Re: [Freeswitch-users] Authenticating end points by IP
I recently added an overview to this wiki page to help make things more clear as to which ACL you need for different purposes.
http://wiki.freeswitch.org/wiki/ACL#Overview
Thanks, Bill W.
Mathieu Rene wrote:
Check out: http://wiki.freeswitch.org/wiki/ACL#Users
It'll automatically add users with a cidr= attribute to the ACL list. This way you can set channel variables in the users and use them through your dialplan, all authenticated by ip address.
Cheers,
Mathieu Rene Avant-Garde Solutions Inc Office: + 1 (514) 664-1044 x100 Cell: +1 (514) 664-1044 x200 mrene@avgs.ca <mailto:mrene@avgs.ca>
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hello Lars, You can apply any acl to any profile. What you should do really depends on what you want to accomplish. But let's take a simple example. Let's say you want to allow any phone on your internal network (192.168.0.0/24) to connect to your internal profile and make calls without having to provide a password. Then you could simply put these entries in your internal sofia profile. <param name="apply-inbound-acl" value="192.168.0.0/24"/> <param name="apply-register-acl" value="192.168.0.0/24"/> In that case, you do not need to include anything in the directory. The cidr entries in the directory are for providing additional control for each user id and what IPs they are allowed to make calls from. For your external profile, you may not want to have any ACLs at all, as you may not want to limit which IPs can connect to your switch to send you incoming calls. BUT, you need to make sure the dialplan connected to that external profile doesn't allow anyone to dial numbers that are not hosted on your system without proper authentication or controls. And believe me, people WILL try to do that. I've set up my system to email me whenever this happens and I have logged over 100 attempts to dial international numbers just since December 3rd. Hope this helps, Bill Lars Zeb wrote:
Bill,
Thanks for your ACL Overview. Perhaps you can help me understand more clearly.
If you include the "local-network-acl" and "apply-inbound-acl" params in the sip_profiles and setup the list for "localnet.auto" in acl.conf.xml, does this mean you do not have to include the cidr attribute for individual extensions in the directory/default folder?
Is "apply-inbound-acl" supposed to exist in both internal and external profiles while "apply-inbound-acl" is only in the internal?
Thanks, Lars
Excellent work and answers. Thanks gentlemen. I'm firing off a new thread re: codecs et. al. Have a great Christmas and a wonderful, prosperous New Year. Regards, Ahmed. 2009/12/21 Bill W <freeswitch@aastral.net>
I recently added an overview to this wiki page to help make things more clear as to which ACL you need for different purposes.
http://wiki.freeswitch.org/wiki/ACL#Overview
Thanks, Bill W.
Mathieu Rene wrote:
Check out: http://wiki.freeswitch.org/wiki/ACL#Users
It'll automatically add users with a cidr= attribute to the ACL list. This way you can set channel variables in the users and use them through your dialplan, all authenticated by ip address.
Cheers,
Mathieu Rene Avant-Garde Solutions Inc Office: + 1 (514) 664-1044 x100 Cell: +1 (514) 664-1044 x200 mrene@avgs.ca <mailto:mrene@avgs.ca>
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Ahmed A. Ibrahim-Naji Al-Alousi Ph.D., MIEE, MBCS
participants (4)
-
Ahmed Naji
-
Bill W
-
Lars Zeb
-
Mathieu Rene