(new machine, new installation of Openser and serweb)
I use serweb-0.9.3.tgz and Openser cvs version.
I have not changed any password, just installed as it is. serweb is at
/usr/local/serweb
httpd.conf includes the line:
Alias /serweb "/usr/local/serweb/html"
The apache error.log includes:
[Fri Oct 14 00:45:58 2005] [error] [client 192.168.250.108] client
denied by server configuration: /usr/local/serweb/html
755 is the permission for /usr/local/serweb and below
Since a test file in the directory /usr/local/serweb/test.html shows the
same error, I am sure it is an apache 2.0 configuration error.
What do I miss?
bye
Ronald Wiplinger
Hi (sorry for second posting),
I have my SER working when i try to talk to other SIP servers.
However, i cannot make calls inside my own network.
I am using LDAP to authenticate my users, and I have sipldap script
that circulates in the web. Everything works fine until there, i get
the following output when the user exists:
sip:username@host
isn´t this what was supposed to happen? When i then try to
(!lookup("location")) { if (!exec_dset("/etc/ser/sipldap")) {
sl_send_reply("404", "Not Found"); break; } else { log(1," sipldap
call"); }; }; #!lookup
I get the Not Found message. But if i call the following way:
username@username_IP
the call works fine.. any ideia?
Jose Simoes
Hi everybody,
I create a separate thread for the whole "tls improvement, let's create a
module, lets see what to do with it" because for me it was getting a bit
messier. Too many threads all talking about the same :)
The TLS bussiness, we agree, is ugly and there is no one-fits-all solution,
so we must try to be flexible, even if it means more development.
Breaking it down, one more summary:
1) TLS transport layer authentication
Allow for various levels of verification and peer certificate requirement.
That is, request a cert from the peer or not, what to do if the certificate
provided by the peer is not signed by one of our CAs (or if there is no peer
cert at all), how the verification should be done (just check against our
trusted CAs or do some DNS resolution for the provided Subject/CN on the ip
we receive the connection from), etc.
2) Lifting the TLS authentication to the SIP layer for SIP authentication
and authorization, according to "whatever" local policy
I think here a tls_tools module is what we need. Let's think on what
functions are needed to cover most needs. Proposals up to now include
functions such as: tls_check_from/to( "SubjectName"/"CN"),
tls_is_peer_cert_present(), tls_is_peer_cert_valid(),
tls_is_peer_domain_trusted() as in white/black list, etc.
3) Incoming requests
3.1) Single domain
This does not present much of a problem. Just present whatever certificate
the proxy is serving. Use the tls_tools module to further authenticate and
authorize the requeset.
3.2) Multi-domain
This present a lot of problems, but there are solutions:
3.2.a) Use a different ip:port per domain ... good enough if the domains
served are not changing often.
3.2.b) Present the host certificate, not one per domain ... usable as a
fall-back scenario if everything else fails.
3.2.c) Use TLS Extensions, so the requesting proxy notifies the receiving
proxy of the domain it is requesting. I just found some guys (i think an
initial project from stanford, i don't know now) that implemented the TLS
Servername Extension (http://www.edelweb.fr/EdelKey/). I am still waiting
for more answers on the ssl-users mailing list, hopefully it is already
included in the core, otherwise this solution would mean having to compile
openssl locally :(
4) Outgoing requests
4.1) Single domain
Again, not much of a problem.
4.2) Multiple domain
Solution here is simpler. Provided that the domains are internally setup,
select the desired one when forwarding the request (either automatically or
via some function in tls_tools module). TLS domains can currently only be
set up statically in the config file, thus some dynamic mechanism to create
new ones has to be found (database, serctl? ).
5) Out-of-the-box setup
That is, ser should allow to work using some very simplistic TLS form just
by compiling it with TLS=1 and turning the tls_disabled=0 parameter. In this
scenario, TLS could work using anonymous ciphers (no need for certificates)
and would accept any incoming request (no verification of certs against CAs,
or come with a generic root CA, but that would be more complex). In this
mode, a huuge warning should be issued.
Let's try to focus on specifics, so we can get this working as soon as
possible.
Regards,
Cesc
hi all,
I came to kno about the parameter modparam("acc", "db_table_acc", "acc_table").
Does this mean that I can have different acc tables for my different type of customers. Is this possible.
If yes, then how? If i declare the appropriate flag and then use setflag at the places i want to account, will it work.
Can someone please explain it to me. Any suggestions would help me a lot.
Thanx
jayesh
---------------------------------
Yahoo! Music Unlimited - Access over 1 million songs. Try it free.
Andres,
Mediaproxy does that, it does a DNS lookup to locate the server(s) for
each call. Use a dynamic DNS engine (like the geo module of Power DNS)
and you can distribute geographically the streams per user.
Adrian
Hi,
Can anybody think of a way to assign a subscriber's call to a specific
rtpproxy? The idea is to have one main SER server but multiple rtpproxy
servers handling the media stream close to where the subs are. The SER
server can be a continent away but the rtpproxy is in the same city as
the users. I was thinking of using ACL (groups) somehow but not sure if
it is at all possible.
Any ideas?
Thanks,
Hi,
I have been searching on how can I terminate an active sessions,
and I read in the list that there are some using fifo to disconnect
active calls. Does any body can help me about this? I don;t know how to
construct a command using fifo, but from the admin guide there is a
reference for fifo command, but i don;t know how to use it. Can anybody
give me the command to terminate the call using t_uac_dlg command?
Thanks,
--
Ryan Pagquil
Infodyne Inc. - PhilOnline.com
3603 Antel Global Corporate Center
Doña Julia Vargas Ave.
Ortigas Center Pasig City
Tel: 687-0715
Web: www.philonline.com
do u mean user-id remains same when they move across cities ?
-----Original Message-----
From: Duncan Glendinning [mailto:Duncan.Glendinning@cox.net]
Sent: Thursday, October 13, 2005 5:51 AM
To: serusers(a)lists.iptel.org
Subject: [Serusers] SRC-Based Routing?
I am using SER is the primary SIP server in front of four Asterisk PBX's
each located in a different city(e.g., City 1: 899xxxx, City 2: 598xxxx,
City 3: 356xxxx, City 4: 829xxxx). Users are identified by a 7 digit number
based on their home city. For PSTN-bound destinations, I want to be able to
direct SIP calls to the appropriate Asterisk server based on who is calling.
Using the src IP address isn't sufficient as users move around the network -
in one city one day and another city another day.
For example, I want a call from user 8991234(a)domain.com
<mailto:8991234@domain.com> to 91234567(a)domain.com
<mailto:91234567@domain.com> to be sent to the server in City 1 because
user 8991234 resides in City 1. I can't use the src ip address because
users move around in the network. I have wondered about using a city-based
db in addition to a global db. Being a newcomer to this, I'm hoping that
there is a simple solution to this problem.
Your help and insights would be greatly appreciated,
Duncan
---
<mailto:Duncan.Glendinning@cox.net> Duncan.Glendinning(a)cox.net
I cannot figure out why the serweb page is empty.
if I go to http://host/serweb it redirects me to
http://host/serweb/user/index.php
The page source code is than just:
<html><body></body></html>
# pear install log
Skipping package "pear/Log", already installed as version 1.9.0
No valid packages found
install failed
config.php contains:
$config->enable_loging = true;
$config->log_file = "/var/log/serweb";
$config->log_level = "PEAR_LOG_DEBUG";
/var/log/serweb will not be created! If I touch serweb and give the
permission 777 it still remains empty.
php.ini includes:
register_globals = On
I double checked the config files, I checked that the user ser can login
to mysql database with the password on localhost.
What do I miss?
bye
Ronald Wiplinger
