Hi, everyone. I've begun experimenting with SRTP and TLS connections since the ZRTP download seems offline for the foreseeable future...sigh. I've got the SRTP enabled in my conf/vars.xml for both internal and external connections, but it appears that I can still connect without security from an unconfigured ATA. What I want to know is how to enforce a secure connection at registration time. Ideally, I'd like to do this both between two freeswitch servers and between a freeswitch server and an ATA. Thanks in advance!
For lack of other responses so far.. these may be hacky: 1) mess with the ports - TLS and regular are on different ports. set 5060 for the tls and disable / firewall the non-tls port. 2) re: srtp you can check if it's on in the dialplan, and if not redirect to some sort of error message instead of completing the call. Not sure you would want to completely disable non-tls/srtp though... I suppose it depends on your usage. -Avi On Sun, May 29, 2011 at 7:37 PM, Chris Cureau <cmcureau@gmail.com> wrote:
Hi, everyone.
I've begun experimenting with SRTP and TLS connections since the ZRTP download seems offline for the foreseeable future...sigh.
I've got the SRTP enabled in my conf/vars.xml for both internal and external connections, but it appears that I can still connect without security from an unconfigured ATA. What I want to know is how to enforce a secure connection at registration time. Ideally, I'd like to do this both between two freeswitch servers and between a freeswitch server and an ATA.
Thanks in advance!
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
You may want to check out my tls patch at: it features the option for tls_only forcing only the encrypted port to be open: http://jira.freeswitch.org/browse/FS-3071 in your dialplan for calls you can set sip_secure_media to true to force it to SRTP. ~Mitch On Sun, May 29, 2011 at 9:37 AM, Chris Cureau <cmcureau@gmail.com> wrote:
Hi, everyone. I've begun experimenting with SRTP and TLS connections since the ZRTP download seems offline for the foreseeable future...sigh. I've got the SRTP enabled in my conf/vars.xml for both internal and external connections, but it appears that I can still connect without security from an unconfigured ATA. What I want to know is how to enforce a secure connection at registration time. Ideally, I'd like to do this both between two freeswitch servers and between a freeswitch server and an ATA. Thanks in advance! _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
What was so wrong with adding ;transport=tls to the URI :P /b On May 30, 2011, at 1:05 PM, Mitch Capper wrote:
You may want to check out my tls patch at:
it features the option for tls_only forcing only the encrypted port to be open: http://jira.freeswitch.org/browse/FS-3071 in your dialplan for calls you can set sip_secure_media to true to force it to SRTP.
~Mitch
This just prevents any unencrypted registration attempts, useful for also stopping brute force attacks and ensuring clients are properly configured and not attempting to connect over an insecure channel. ~mitch On Thu, Jun 2, 2011 at 7:58 AM, Brian West <brian@freeswitch.org> wrote:
What was so wrong with adding ;transport=tls to the URI :P /b On May 30, 2011, at 1:05 PM, Mitch Capper wrote:
You may want to check out my tls patch at:
it features the option for tls_only forcing only the encrypted port to be open: http://jira.freeswitch.org/browse/FS-3071 in your dialplan for calls you can set sip_secure_media to true to force it to SRTP.
~Mitch
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (4)
-
Avi Marcus
-
Brian West
-
Chris Cureau
-
Mitch Capper