Re: [Serusers] Proxy_authorize, www_authorize

OK, I see what you mean. I think the policy you recommend will do just fine in order to stop the most obvious types of abuse of a sip server. (If you want more paranoid "firewalling" you need to know sip really well, and there is always a risk that you stop legal cases). Thanks for yor advice. The following script should do the trick then, huh ? Lasse # REQUESTS DIRECTED TO MY DOMAIN if (uri=~"[@:]mydomain\.com") { # Challenge registrations if (method=="REGISTER") { if (!www_authorize("mydomain.com", "subscriber")) { www_challenge("mydomain.com", "1"); break; }; save("location"); break; }; # Challenge any other request where the sender has my domain in From if (search("(f|From).*mydomain\.com")) { if (!proxy_authorize("mydomain.com", "subscriber")) { proxy_challenge("mydomain.com", "1"); break; }; }; # native SIP destinations are handled using our USRLOC DB if (!lookup("location")) { sl_send_reply("404", "Not Found"); break; }; # REQUESTS DIRECTED TO OTHER DOMAINS } else { # Challenge any request where the sender has my domain in From if (search("(f|From).*mydomain\.com")) { if (!proxy_authorize("mydomain.com", "subscriber")) { proxy_challenge("mydomain.com", "1"); break; }; # Drop INVITE requests where the sender does not have my domain in From } else { if (method=="INVITE") { sl_send_reply("403", "Forbidden"); break; }; }; }; # forward to current uri now if (!t_relay()) { sl_reply_error(); }; On Wednesday 05 March 2003 23.05, Jiri Kuthan wrote: