Re: [SR-Users] Help needed for OpenSer with Radius

Hello, the radius client library has a file where you configure the servers, have you configure it? http://www.kamailio.org/docs/openser-radius-1.0.x.html#radiusclient_ng_serv… Cheers, Daniel On 8/3/10 10:13 AM, Pratik Shrestha wrote: Dear Daniel, Yeah right. I totally forgot, its a reverse dns. Now I checked the radius server in debug mode and I cannot see any request from openser trying to connect to radius server. So, the request from openser is not reaching the radius server. Then I installed wireshark and checked the ip address 128.185.38.162 (radius server ip add) in the server where openser was installed. There also I did not find any entry related to 128.185.38.16. So, it seems my configuration is wrong. I am sending you the configuration of openser.cfg and radiusclient.conf. openser.cfg SSH Secure Shell 3.2.3 (Build 279) Copyright (c) 2000-2003 SSH Communications Security Corp - http://www.ssh.com/ This copy of SSH Secure Shell is a non-commercial version. This version does not include PKI and PKCS #11 functionality. Linux isoftel-desktop 2.6.32-21-generic #32-Ubuntu SMP Fri Apr 16 08:10:02 UTC 2010 i686 GNU/Linux Ubuntu 10.04 LTS Welcome to Ubuntu!  * Documentation:  https://help.ubuntu.com/ Last login: Tue Aug  3 10:35:05 2010 from 192.168.0.148 isoftel@isoftel-desktop:~$ cd /usr/local/etc/openser/ isoftel@isoftel-desktop:/usr/local/etc/openser$ cat openser.cfg # # $Id$ # # radius config script # # ----------- global configuration parameters ------------------------ debug=6           # debug level (cmd line: -dddddddddd) log_stderror=yes    # (cmd line: -E) check_via=no    # (cmd. line: -v) dns=no          # (cmd. line: -r) rev_dns=no      # (cmd. line: -R) port=5060 children=4 #listen=udp:localhost #alias="kamailio.org" fifo="/tmp/openser_fifo" # ------------------ module loading ---------------------------------- mpath="/usr/local/lib/openser/modules" loadmodule "mysql.so" loadmodule "sl.so" loadmodule "tm.so" loadmodule "rr.so" loadmodule "maxfwd.so" loadmodule "avpops.so" loadmodule "usrloc.so" loadmodule "registrar.so" loadmodule "textops.so" loadmodule "xlog.so" loadmodule "uri.so" loadmodule "acc.so" loadmodule "auth.so" loadmodule "auth_radius.so" loadmodule "group_radius.so" loadmodule "avp_radius.so" # ----------------- setting module-specific parameters --------------- # -- usrloc params -- #modparam("usrloc","db_url","mysql://openser:openserrw@localhost/openser") modparam("usrloc", "db_mode", 2) # -- acc params -- modparam("acc", "radius_flag", 1) modparam("acc", "radius_missed_flag", 2) modparam("acc", "log_flag", 1) modparam("acc", "log_missed_flag", 1) modparam("acc", "service_type", 15) modparam("acc", "radius_extra", "Sip-Src-IP=$si;Sip-Src-Port=$sp") modparam("acc|auth_radius|group_radius|avp_radius", "radius_config", "/etc/radiusclient-ng/radiusclient.conf") # -- group_radius params -- modparam("group_radius", "use_domain", 1) # -- avpops params -- modparam("avpops", "avp_aliases", "day=i:101;time=i:102") # -- rr params -- # add value to ;lr param to make some broken UAs happy modparam("rr", "enable_full_lr", 1) # -------------------------  request routing logic ------------------- # main routing logic route{     # initial sanity checks -- messages with     # max_forwards==0, or excessively long requests     if (!mf_process_maxfwd_header("10")) {         sl_send_reply("483","Too Many Hops");         exit;     };     if (msg:len >=  2048 ) {         sl_send_reply("513", "Message too big");         exit;     };     # check if user is suspended     if(is_method("REGISTER|INVITE|MESSAGE|OPTIONS|SUBSCRIBE"))     {         if (radius_is_user_in("From", "suspended")) {             sl_send_reply("403", "Forbidden - suspended");             exit;         };     };     # we record-route all messages -- to make sure that     # subsequent messages will go through our proxy; that's     # particularly good if upstream and downstream entities     # use different transport protocol     if (!method=="REGISTER")         record_route();     # subsequent messages withing a dialog should take the     # path determined by record-routing     if (loose_route()) {         # mark routing logic in request         append_hf("P-hint: rr-enforced\r\n");         if(is_method("BYE"))         { # log it all the time             acc_rad_request("200 ok");             acc_log_request("200 ok");         }         route(1);     };     if(is_method("INVITE") && !has_totag())     {   # set the acc flags         setflag(1);         setflag(2);     };     if (!uri==myself) {         # check if user is allowed to do voip calls to other domains         if(is_method("INVITE|MESSAGE")) {             if (!radius_is_user_in("From", "voip")) {                 sl_send_reply("403", "Forbidden VoIP");                 exit;             };         };         # mark routing logic in request         append_hf("P-hint: outbound\r\n");         route(1);     };     # if the request is for other domain use UsrLoc     # (in case, it does not work, use the following command     # with proper names and addresses in it)     if (uri==myself) {         # authenticate registers         if (method=="REGISTER") {             if (!radius_www_authorize("")) {                 www_challenge("", "1");                 exit;             };             # check the src ip address             if(!avp_check("i:2", "eq/$src_ip/ig"))             {                 sl_send_reply("403", "Forbidden IP");                 exit;             };             save("location");             exit;         };         # calls to pstn         if(uri=~"sip:00[1-9][0-9]+@") {             if(is_method("INVITE") && !has_totag()) {                 if (!radius_is_user_in("From", "pstn")) {                     sl_send_reply("403", "Forbidden PSTN");                     exit;                 };             };             # set gateway address             rewritehostport("localhost:5090");             route(1);         };         # load callee's avps         if(avp_load_radius("callee"))         {             # check if user has time filter enabled             if(avp_check("i:3", "eq/i:1"))             {                 # print time in an avp                 avp_printf("i:100", "$Tf");                 # extract day                 avp_subst("i:100/i:101", "/(.{3}) .+/*\1*/");                 if(!avp_check("i:6", "fm/$day")) {                     sl_send_reply("403", "Forbidden - day");                     exit;                 };                 # extract 'hours:minutes'                 avp_subst("i:100/i:102", "/(.{10}) (.{5}):.+/\2/");                 if((is_avp_set("i:4") && avp_check("i:4", "gt/$time"))                 || (is_avp_set("i:5") && avp_check("i:5", "lt/$time"))) {                     sl_send_reply("403", "Forbidden - time");                     exit;                 };             };         };         # native SIP destinations are handled using our USRLOC DB         if (!lookup("location")) {             # log to acc as missed call             acc_rad_request("404 Not Found");             acc_log_request("404 Not Found");             sl_send_reply("404", "Not Found");             exit;         };         append_hf("P-hint: usrloc applied\r\n");     };     route(1); } # generic forward route[1] {     # send it out now; use stateful forwarding as it works reliably     # even for UDP2TCP     if (!t_relay()) {         sl_reply_error();     };     exit; } radiusclient-ng.conf # General settings # specify which authentication comes first respectively which # authentication is used. possible values are: "radius" and "local". # if you specify "radius,local" then the RADIUS server is asked # first then the local one. if only one keyword is specified only # this server is asked. auth_order      radius #add 'local' with comma # maximum login tries a user has login_tries     4 # timeout for all login tries # if this time is exceeded the user is kicked out login_timeout   60 # name of the nologin file which when it exists disables logins. # it may be extended by the ttyname which will result in # a terminal specific lock (e.g. /etc/nologin.ttyS2 will disable # logins on /dev/ttyS2) nologin /etc/nologin # name of the issue file. it's only display when no username is passed # on the radlogin command line issue   /etc/radiusclient-ng/issue # RADIUS settings # RADIUS server to use for authentication requests. this config # item can appear more then one time. if multiple servers are # defined they are tried in a round robin fashion if one # server is not answering. # optionally you can specify a the port number on which is remote # RADIUS listens separated by a colon from the hostname. if # no port is specified /etc/services is consulted of the radius # service. if this fails also a compiled in default is used. authserver      128.185.38.162 # RADIUS server to use for accouting requests. All that I # said for authserver applies, too. # acctserver      128.185.38.162 # file holding shared secrets used for the communication # between the RADIUS client and server servers         /etc/radiusclient-ng/servers # dictionary of allowed attributes and values # just like in the normal RADIUS distributions dictionary      /etc/radiusclient-ng/dictionary # program to call for a RADIUS authenticated login login_radius    /usr/sbin/login.radius # file which holds sequence number for communication with the # RADIUS server seqfile         /var/run/radius.seq # file which specifies mapping between ttyname and NAS-Port attribute mapfile         /etc/radiusclient-ng/port-id-map # default authentication realm to append to all usernames if no # realm was explicitly specified by the user # the radiusd directly form Livingston doesnt use any realms, so leave # it blank then default_realm # time to wait for a reply from the RADIUS server radius_timeout  10 # resend request this many times before trying the next server radius_retries  3 # local address from which radius packets have to be sent bindaddr localhost #change with 'localhost' # LOCAL settings # program to execute for local login # it must support the -f flag for preauthenticated login login_local     /bin/login I have edited servers file also with the servername and secret. Thank you very much. Regards, Pratik On Mon, Aug 2, 2010 at 11:26 PM, Daniel-Constantin Mierla <miconda(a)gmail.com> wrote: -- Daniel-Constantin Mierla http://www.asipto.com/ _______________________________________________ SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users(a)lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users