How to suspend certain users from the system using flush_inbound_reg
Hi, we are trying to figure out how to suspend certain subscribers from our system and we have some problems with removing thier registrations. The UAs are ATAs. This is what we do: 1) We remove the subscriber extension from the conf\directory .xml files 2) We do reloadxml 3) We flush user's registration with flush_inbound_reg but, the users are still able to make calls as if they were still registered. To make it clearer, their registrations are removed from the registration list (checked with sofia status), but they system still accepts the calls from them. From this, it seems that if ATA is never rebooted - we are not able to ban these users from the system. Only after the ATA is rebooted user is not able to make calls any more, as the ATA can not register any more - since they users are removed from the directory. But before we reboot ATA everything works as nothing had been done. Does anyone have an idea what are we doing wrong? We expect that after the registration is removed from the FS the UA should not be able to make a call but this is not what happnes. Can anybody help please? Thanks, Katarina _________________________________________________________________ Keep your friends updated—even when you’re not signed in. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/soc...
Hi Katarina, Sounds like you have enabled ipauth by having cidr attributes within the extension file. E.g: <user id="test" cidr="192.168.0.0/16"> If this is the case, then username/password tuplles will fail (because you have disabled them) but ipauth will work, and FS will allow unregistered calls. Also, check you conf/autoload_configs/acl.conf.xml to see if your default domains acl state is one of allow rather than deny. E.g: <list name="domains" default="allow"> <node type="allow" domain="$${domain}"/> </list> This type of list is bad news anyway. I've seen it allow unregistered calls from anyone simply by them knowing your domain. What we do in our set-up is remove the default ACLs altogether, and apply our own custom ones + firewalling at the border. Hope this helps you a little. 2010/1/3 katarina djakovic <kdjakovic@hotmail.com>
Hi,
we are trying to figure out how to suspend certain subscribers from our system and we have some problems with removing thier registrations. The UAs are ATAs.
This is what we do:
1) We remove the subscriber extension from the conf\directory .xml files 2) We do reloadxml 3) We flush user's registration with flush_inbound_reg
but, the users are still able to make calls as if they were still registered. To make it clearer, their registrations are removed from the registration list (checked with sofia status), but they system still accepts the calls from them. From this, it seems that if ATA is never rebooted - we are not able to ban these users from the system.
Only after the ATA is rebooted user is not able to make calls any more, as the ATA can not register any more - since they users are removed from the directory. But before we reboot ATA everything works as nothing had been done.
Does anyone have an idea what are we doing wrong? We expect that after the registration is removed from the FS the UA should not be able to make a call but this is not what happnes.
Can anybody help please? Thanks, Katarina
------------------------------ Keep your friends updated— even when you’re not signed in.<http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/social-network-basics.aspx?ocid=PID23461::T:WLMTAGL:ON:WL:en-xm:SI_SB_5:092010>
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Ahmed Naji
Hello Katarina, You could do this several ways, but it has to be more than just removing their extension. * You could use mod_nibblebill to enforce a zero balance so they can't make calls. * You could use dialplan logic and xml_curl where a variable set in the database gets populated in the user's directory entry and enforced in the dialplan condition. * You could use ACL logic and xml_curl where a variable set in the database gets populated in the user's directory entry and enforced via ACLs. (auth-calls in sofia combined with auth-acl in the directory) Hope this helps, -Bill katarina djakovic wrote:
Hi,
we are trying to figure out how to suspend certain subscribers from our system and we have some problems with removing thier registrations. The UAs are ATAs.
This is what we do:
1) We remove the subscriber extension from the conf\directory .xml files 2) We do reloadxml 3) We flush user's registration with flush_inbound_reg
but, the users are still able to make calls as if they were still registered. To make it clearer, their registrations are removed from the registration list (checked with sofia status), but they system still accepts the calls from them. From this, it seems that if ATA is never rebooted - we are not able to ban these users from the system.
Only after the ATA is rebooted user is not able to make calls any more, as the ATA can not register any more - since they users are removed from the directory. But before we reboot ATA everything works as nothing had been done.
Does anyone have an idea what are we doing wrong? We expect that after the registration is removed from the FS the UA should not be able to make a call but this is not what happnes.
Can anybody help please? Thanks, Katarina
------------------------------------------------------------------------ Keep your friends updated— even when you’re not signed in. <http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/social-network-basics.aspx?ocid=PID23461::T:WLMTAGL:ON:WL:en-xm:SI_SB_5:092010>
------------------------------------------------------------------------
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
First a note. Registration and authentication are completely different. Removing the registration has to do with the switch knowin where to send the calls and nothing to do with auth for receiving calls. There is one caveat to this. We do support nonce count, and it could be using the auth from the previous registration that is still valid. Double check the nc from the registrations and the call and see if that rings true. We may want to add something to explicitly expire the nonce when youflush reg but I need some confirmation on that first. Otherwise the other responces seem to cover the possibilities. Crank up the debug and check sip trace for more details on what is allowing the call through and report back. Mike On Jan 3, 2010, at 11:50 AM, katarina djakovic <kdjakovic@hotmail.com> wrote:
Hi,
we are trying to figure out how to suspend certain subscribers from our system and we have some problems with removing thier registrations. The UAs are ATAs.
This is what we do:
1) We remove the subscriber extension from the conf\directory .xml files 2) We do reloadxml 3) We flush user's registration with flush_inbound_reg
but, the users are still able to make calls as if they were still registered. To make it clearer, their registrations are removed from the registration list (checked with sofia status), but they system still accepts the calls from them. From this, it seems that if ATA is never rebooted - we are not able to ban these users from the system.
Only after the ATA is rebooted user is not able to make calls any more, as the ATA can not register any more - since they users are removed from the directory. But before we reboot ATA everything works as nothing had been done.
Does anyone have an idea what are we doing wrong? We expect that after the registration is removed from the FS the UA should not be able to make a call but this is not what happnes.
Can anybody help please? Thanks, Katarina
Keep your friends updated— even when you’re not signed in. _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch- users http://www.freeswitch.org
Dear all, thanks for your suggestions, they helped us to understand what was happening. The mistake was ours, we had auth-calls parameter in the profile set to false, and that was the cause of the problem, since the calls went through regardless of the directory settings. Thanks again, Katarina From: mike@jerris.com To: freeswitch-users@lists.freeswitch.org Date: Sun, 3 Jan 2010 20:24:15 -0500 Subject: Re: [Freeswitch-users] How to suspend certain users from the system using flush_inbound_reg First a note. Registration and authentication are completely different. Removing the registration has to do with the switch knowin where to send the calls and nothing to do with auth for receiving calls. There is one caveat to this. We do support nonce count, and it could be using the auth from the previous registration that is still valid. Double check the nc from the registrations and the call and see if that rings true. We may want to add something to explicitly expire the nonce when youflush reg but I need some confirmation on that first. Otherwise the other responces seem to cover the possibilities. Crank up the debug and check sip trace for more details on what is allowing the call through and report back. Mike On Jan 3, 2010, at 11:50 AM, katarina djakovic <kdjakovic@hotmail.com> wrote: Hi, we are trying to figure out how to suspend certain subscribers from our system and we have some problems with removing thier registrations. The UAs are ATAs. This is what we do: 1) We remove the subscriber extension from the conf\directory .xml files 2) We do reloadxml 3) We flush user's registration with flush_inbound_reg but, the users are still able to make calls as if they were still registered. To make it clearer, their registrations are removed from the registration list (checked with sofia status), but they system still accepts the calls from them. From this, it seems that if ATA is never rebooted - we are not able to ban these users from the system. Only after the ATA is rebooted user is not able to make calls any more, as the ATA can not register any more - since they users are removed from the directory. But before we reboot ATA everything works as nothing had been done. Does anyone have an idea what are we doing wrong? We expect that after the registration is removed from the FS the UA should not be able to make a call but this is not what happnes. Can anybody help please? Thanks, Katarina Keep your friends updated— even when you’re not signed in. _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _________________________________________________________________ Windows Live: Friends get your Flickr, Yelp, and Digg updates when they e-mail you. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/soc...
participants (4)
-
Ahmed Naji
-
Bill W.
-
katarina djakovic
-
Michael Jerris