-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, today I found tha FS isn't authenticating incomming calls from local extensions. I use an ACL and I have auth-calls set to true in default sip profile. <param name="apply-inbound-acl" value="domains"/> FS log shows, that ACL is granting access but FS doesn't authenticate the call. When I disable the ACL in default profile, authentication is performed. FS WIKI doku (http://wiki.freeswitch.org/wiki/Acl#Sofia) chapter "sip_profiles" says this: "The acl behaviour is modfied by auth-calls, accept-blind-reg and accept-blind-auth" I rather think ACL disables those parameters. What I want is an ACL check followed by authentication. I use "FreeSWITCH Version 1.0.trunk (13112M)" Any ideas? regards helmut -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) iD8DBQFKCtih4tZeNddg3dwRAjtYAJsGqPjBp+FVEKZl4GTQNq3TLoh+JwCgiUiZ wJcqu2XOQ7TV+0tBU8REEFc= =M/pp -----END PGP SIGNATURE-----
Wouldn't disable be a modification? Anyway the domains ACL from acl.conf.xml reads all the cidr= tags in the domains specified to build the ACL /b On May 13, 2009, at 9:26 AM, Helmut Kuper wrote:
Hash: SHA1
Hello,
today I found tha FS isn't authenticating incomming calls from local extensions. I use an ACL and I have auth-calls set to true in default sip profile.
<param name="apply-inbound-acl" value="domains"/>
FS log shows, that ACL is granting access but FS doesn't authenticate the call. When I disable the ACL in default profile, authentication is performed.
FS WIKI doku (http://wiki.freeswitch.org/wiki/Acl#Sofia) chapter "sip_profiles" says this:
"The acl behaviour is modfied by auth-calls, accept-blind-reg and accept-blind-auth"
I rather think ACL disables those parameters.
What I want is an ACL check followed by authentication.
I use "FreeSWITCH Version 1.0.trunk (13112M)"
Any ideas?
regards helmut
Brian West brian@freeswitch.org -- Meet us at ClueCon! http://www.cluecon.com
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Brian, yes indeed, disabling is a kind of modification. Hm, I' not sure if we misunderstand. ACL is working. auth-calls also. But together ACL disables somehow authentication. I'm not using cidr in my directory. Is there a way to get both working like this: 1. Calls comes in 2. ACL is applied 3. Authentication is performed 4. FS is executing the call regards Helmut On 13.05.2009 16:32, Brian West wrote:
Wouldn't disable be a modification? Anyway the domains ACL from acl.conf.xml reads all the cidr= tags in the domains specified to build the ACL
/b
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) iD8DBQFKCt5P4tZeNddg3dwRAqGWAJ4owWbow3QWNSlM6y9u2VuLTe9UVQCfZkq6 HkwAX2o7Rd0G+ElsVUMuy10= =mDEj -----END PGP SIGNATURE-----
On May 13, 2009, at 9:50 AM, Helmut Kuper wrote:
Hi Brian,
yes indeed, disabling is a kind of modification.
Hm, I' not sure if we misunderstand. ACL is working. auth-calls also. But together ACL disables somehow authentication. I'm not using cidr in my directory.
That means you do have somewhere in your ACL the IP's, I would double check that. Did you happen to change your ACL to default allow? Show me your acl.conf.xml
Is there a way to get both working like this:
1. Calls comes in 2. ACL is applied 3. Authentication is performed 4. FS is executing the call
regards Helmut
Brian West brian@freeswitch.org -- Meet us at ClueCon! http://www.cluecon.com
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello Brian, yes, you are right, I defined the phone network as an ACL and I want it. Obvoiusly I didn't explained my problem clearly. I want both: ACL *AND* SIP-Authentication vor each call and each local extension/user, but I'm only able to have ACL *OR* SIP-Auth. Is there a way to configure it? regards Helmut On 13.05.2009 17:03, Brian West wrote:
On May 13, 2009, at 9:50 AM, Helmut Kuper wrote:
Hi Brian,
yes indeed, disabling is a kind of modification.
Hm, I' not sure if we misunderstand. ACL is working. auth-calls also. But together ACL disables somehow authentication. I'm not using cidr in my directory.
That means you do have somewhere in your ACL the IP's, I would double check that.
Did you happen to change your ACL to default allow?
Show me your acl.conf.xml
Is there a way to get both working like this:
1. Calls comes in 2. ACL is applied 3. Authentication is performed 4. FS is executing the call
regards Helmut
Brian West brian@freeswitch.org <mailto:brian@freeswitch.org>
-- Meet us at ClueCon! http://www.cluecon.com <http://www.cluecon.com/>
------------------------------------------------------------------------
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
- -- Mit freundlichen Grüßen Helmut Kuper Finanzdienstleistungen und Entwicklung Telefax: (0441) 8000-2799 mailto:helmut.kuper@ewetel.de ___________________________________ EWE TEL GmbH Cloppenburger Straße 310 26133 Oldenburg EWE TEL GmbH Handelsregister Amtsgericht Oldenburg HRB 3723 Vorsitzender des Aufsichtsrates: Heiko Harms Geschäftsführung: Hans-Joachim Iken (Vorsitzender), Dr. Norbert Schulz, Dirk Thole Homepage: http://www.ewetel.de ___________________________________ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) iD8DBQFKCuet4tZeNddg3dwRAloYAJ9XHbybGqLQWJ1xN+d0i04BK8D/8QCbBHHv 7zWauA2VyTC1lzJJE8nH8zc= =Atsf -----END PGP SIGNATURE-----
No you can't have ACL AND SIP auth at the same time.. ACL lets them in... you can however use respond 407 in the dialplan to cause it to auth again. /b On May 13, 2009, at 10:30 AM, Helmut Kuper wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Hello Brian,
yes, you are right, I defined the phone network as an ACL and I want it. Obvoiusly I didn't explained my problem clearly.
I want both: ACL *AND* SIP-Authentication vor each call and each local extension/user, but I'm only able to have ACL *OR* SIP-Auth.
Is there a way to configure it?
regards Helmut
Brian West brian@freeswitch.org -- Meet us at ClueCon! http://www.cluecon.com
Don't use the ACL on the profile and use the ACL command in the dialplan then you can do it. /b On May 13, 2009, at 10:30 AM, Helmut Kuper wrote:
I want both: ACL *AND* SIP-Authentication vor each call and each local extension/user, but I'm only able to have ACL *OR* SIP-Auth.
Brian West brian@freeswitch.org -- Meet us at ClueCon! http://www.cluecon.com
participants (2)
-
Brian West
-
Helmut Kuper