Kamailio doesn't start with TLS

List overview All Threads
Download

newer

older

5.2.3 - dispatcher module looses...

kamcmd uac.* commands dont find...

Олег Подгуйко

4 Jun 2019 4 Jun '19

2:21 p.m.

Im trying to use kamailio with websocket and tls. It will be use as registrar for websocket clients. I'm using default config with additional websocket, https and tls modules. I created some certs for it and everething looks like good. But when I started kamailio via (systemctl start kamailio) I get some errors июн 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) INFO: <core> [core/udp_server.c:205]: probe_max_receive_buffer(): SO_RCVBUF is finally 425984 июн 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) DEBUG: <core> [core/tcp_main.c:2753]: tcp_init(): added 37.143.9.210:443 июн 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) ERROR: <core> [core/tcp_main.c:2855]: tcp_init(): bind(9, 0x7fb6ef026f84, 16) on 37.143.9.210:443 : Permission denied июн 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) ERROR: tls [tls_init.c:342]: tls_h_init_si(): Error while initializing TCP part of TLS socket 37.143.9.210:443 июн 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) DEBUG: rtpengine [rtpengine.c:1986]: mod_destroy(): rtpengine_hash_table_destroy() success! If I start it via /usr/sbin/kamailio - all work. What I do wrong? -- Олег Подгуйко

Attachments:

attachment.html (text/html — 1.3 KB)

Show replies by date

Daniel-Constantin Mierla

4 Jun 4 Jun

3:15 p.m.

Hello, what is the operating system you are using? Cheers, Daniel On 04.06.19 14:21, Олег Подгуйко wrote:

...

-- Daniel-Constantin Mierla -- www.asipto.com www.twitter.com/miconda -- www.linkedin.com/in/miconda

Karsten Horsmann

5:20 p.m.

Hi, Starting via cli works and via systemctl not. That's an sign for some permissions that systemctl what's to set (group for example or user) are not there. Also included files like tls.cfg and certificates are not readable for the user:group systemctl what's to start Kamailio. Cheers Karsten Daniel-Constantin Mierla <miconda(a)gmail.com> schrieb am Di., 4. Juni 2019, 15:16:

...

Hello, what is the operating system you are using? Cheers, Daniel On 04.06.19 14:21, Олег Подгуйко wrote: Im trying to use kamailio with websocket and tls. It will be use as registrar for websocket clients. I'm using default config with additional websocket, https and tls modules. I created some certs for it and everething looks like good. But when I started kamailio via (systemctl start kamailio) I get some errors июн 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) INFO: <core> [core/udp_server.c:205]: probe_max_receive_buffer(): SO_RCVBUF is finally 425984 июн 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) DEBUG: <core> [core/tcp_main.c:2753]: tcp_init(): added 37.143.9.210:443 июн 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) ERROR: <core> [core/tcp_main.c:2855]: tcp_init(): bind(9, 0x7fb6ef026f84, 16) on 37.143.9.210:443 : Permission denied июн 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) ERROR: tls [tls_init.c:342]: tls_h_init_si(): Error while initializing TCP part of TLS socket 37.143.9.210:443 июн 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) DEBUG: rtpengine [rtpengine.c:1986]: mod_destroy(): rtpengine_hash_table_destroy() success! If I start it via /usr/sbin/kamailio - all work. What I do wrong? -- Олег Подгуйко _______________________________________________ Kamailio (SER) - Users Mailing Listsr-users@lists.kamailio.orghttps://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users -- Daniel-Constantin Mierla -- www.asipto.comwww.twitter.com/miconda -- www.linkedin.com/in/miconda _______________________________________________ Kamailio (SER) - Users Mailing List sr-users(a)lists.kamailio.org https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

Олег Подгуйко

9:22 p.m.

...

Вторник, 4 июня 2019, 18:20 +03:00 от Karsten Horsmann <khorsmann(a)gmail.com>om>: Hi, Starting via cli works and via systemctl not. That's an sign for some permissions that systemctl what's to set (group for example or user) are not there. Also included files like tls.cfg and certificates are not readable for the user:group systemctl what's to start Kamailio. Cheers Karsten Daniel-Constantin Mierla < miconda(a)gmail.com > schrieb am Di., 4. Juni 2019, 15:16: >Hello, > >what is the operating system you are > using? > >Cheers, >Daniel > >On 04.06.19 14:21, Олег Подгуйко wrote: >>Im trying to use kamailio with websocket and tls. It will be use >> as registrar for websocket clients. >>I'm using default config with additional websocket, https and tls >> modules. I created some certs for it and everething looks like >> good. >>But when I started kamailio via (systemctl start kamailio) I get >> some errors >> >>июн 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) INFO: >> <core> [core/udp_server.c:205]: >> probe_max_receive_buffer(): SO_RCVBUF is finally 425984 >>июн 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) DEBUG: >> <core> [core/tcp_main.c:2753]: tcp_init(): added 37.143.9.210:443 >>июн 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) ERROR: >> <core> [core/tcp_main.c:2855]: tcp_init(): bind(9, >> 0x7fb6ef026f84, 16) on 37.143.9.210:443 : Permission denied >>июн 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) ERROR: >> tls [tls_init.c:342]: tls_h_init_si(): Error while initializing >> TCP part of TLS socket 37.143.9.210:443 >>июн 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) DEBUG: >> rtpengine [rtpengine.c:1986]: mod_destroy(): >> rtpengine_hash_table_destroy() success! >> >> >>If I start it via /usr/sbin/kamailio - all work. >> >>What I do wrong? >> >> >> >>-- >>Олег Подгуйко >>_______________________________________________ >>Kamailio (SER) - Users Mailing List >>sr-users(a)lists.kamailio.org >>https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users >> > >-- >Daniel-Constantin Mierla -- www.asipto.com >www.twitter.com/miconda -- www.linkedin.com/in/miconda _______________________________________________ >Kamailio (SER) - Users Mailing List >sr-users(a)lists.kamailio.org >https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

-- Олег Подгуйко

Karsten Horsmann

5 Jun 5 Jun

7:24 a.m.

Hi, Check if group or user Kamailio is still available. I had the same issue on upgrade from 5.0.x to 5.2.3. In my case group Kamailio was gone. Олег Подгуйко <podguiko(a)mail.ru> schrieb am Di., 4. Juni 2019, 21:22:

...

Hi, I'm using Centos7 I checked the kamailio.servirse file It looks like [root@p534507 ~]# cat /usr/lib/systemd/system/kamailio.service [Unit] Description=Kamailio (OpenSER) - the Open Source SIP Server Wants=network-online.target After=network-online.target ange[Service] Type=simple User=kamailio Group=kamailio Environment='CFGFILE=/etc/kamailio/kamailio.cfg' Environment='SHM_MEMORY=64' Environment='PKG_MEMORY=4' EnvironmentFile=-/etc/sysconfig/kamailio ExecStart=/usr/sbin/kamailio -DD -P /var/run/kamailio/kamailio.pid -f $CFGFILE -m $SHM_MEMORY -M $PKG_MEMORY Restart=on-failure [Install] WantedBy=multi-user.target [root@p534507 ~]# I changed User and Group....... to root..... and kamailio.service is working now. But it looks like strange for me. Why dint't it work with kamailio user? Вторник, 4 июня 2019, 18:20 +03:00 от Karsten Horsmann < khorsmann(a)gmail.com>gt;: Hi, Starting via cli works and via systemctl not. That's an sign for some permissions that systemctl what's to set (group for example or user) are not there. Also included files like tls.cfg and certificates are not readable for the user:group systemctl what's to start Kamailio. Cheers Karsten Daniel-Constantin Mierla <miconda(a)gmail.com <//e.mail.ru/compose/?mailto=mailto%3amiconda(a)gmail.com>> schrieb am Di., 4. Juni 2019, 15:16: Hello, what is the operating system you are using? Cheers, Daniel On 04.06.19 14:21, Олег Подгуйко wrote: Im trying to use kamailio with websocket and tls. It will be use as registrar for websocket clients. I'm using default config with additional websocket, https and tls modules. I created some certs for it and everething looks like good. But when I started kamailio via (systemctl start kamailio) I get some errors июн 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) INFO: <core> [core/udp_server.c:205]: probe_max_receive_buffer(): SO_RCVBUF is finally 425984 июн 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) DEBUG: <core> [core/tcp_main.c:2753]: tcp_init(): added 37.143.9.210:443 июн 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) ERROR: <core> [core/tcp_main.c:2855]: tcp_init(): bind(9, 0x7fb6ef026f84, 16) on 37.143.9.210:443 : Permission denied июн 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) ERROR: tls [tls_init.c:342]: tls_h_init_si(): Error while initializing TCP part of TLS socket 37.143.9.210:443 июн 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) DEBUG: rtpengine [rtpengine.c:1986]: mod_destroy(): rtpengine_hash_table_destroy() success! If I start it via /usr/sbin/kamailio - all work. What I do wrong? -- Олег Подгуйко _______________________________________________ Kamailio (SER) - Users Mailing Listsr-users(a)lists.kamailio.org <//e.mail.ru/compose/?mailto=mailto%3asr%2dusers@lists.kamailio.org>https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users -- Daniel-Constantin Mierla -- www.asipto.comwww.twitter.com/miconda -- www.linkedin.com/in/miconda _______________________________________________ Kamailio (SER) - Users Mailing List sr-users(a)lists.kamailio.org <//e.mail.ru/compose/?mailto=mailto%3asr%2dusers(a)lists.kamailio.org> https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users -- Олег Подгуйко

Denys Pozniak

11:41 a.m.

Hello! Try to set in the service file: User=kamailio Group=daemon ср, 5 июн. 2019 г. в 08:25, Karsten Horsmann <khorsmann(a)gmail.com>om>:

...

_______________________________________________ Kamailio (SER) - Users Mailing List sr-users(a)lists.kamailio.org https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

-- BR, Denys Pozniak

Олег Подгуйко

12:18 p.m.

When User and Group = kamailio I can't start kamailio.service at all. I get errors ()

...

июн 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) ERROR: <core> [core/tcp_main.c:2855]: tcp_init(): bind(9, 0x7fb6ef026f84, 16) on 37.143.9.210:443 : Permission denied

The question is why? If am using User and Group = root it works. Group Kamailio exist and user too. I suppose Linux does not allow kamailio to bind to 443 port.

...

Среда, 5 июня 2019, 12:42 +03:00 от Denys Pozniak <denys.pozniak(a)gmail.com>om>: Hello! Try to set in the service file: User=kamailio Group=daemon ср, 5 июн. 2019 г. в 08:25, Karsten Horsmann < khorsmann(a)gmail.com >:

Hi, Check if group or user Kamailio is still available. I had the same issue on upgrade from 5.0.x to 5.2.3. In my case group Kamailio was gone. Олег Подгуйко < podguiko(a)mail.ru > schrieb am Di., 4. Juni 2019, 21:22:

Вторник, 4 июня 2019, 18:20 +03:00 от Karsten Horsmann < khorsmann(a)gmail.com >: Hi, Starting via cli works and via systemctl not. That's an sign for some permissions that systemctl what's to set (group for example or user) are not there. Also included files like tls.cfg and certificates are not readable for the user:group systemctl what's to start Kamailio. Cheers Karsten Daniel-Constantin Mierla < miconda(a)gmail.com > schrieb am Di., 4. Juni 2019, 15:16: >Hello, > >what is the operating system you are > using? > >Cheers, >Daniel > >On 04.06.19 14:21, Олег Подгуйко wrote: >>Im trying to use kamailio with websocket and tls. It will be use >> as registrar for websocket clients. >>I'm using default config with additional websocket, https and tls >> modules. I created some certs for it and everething looks like >> good. >>But when I started kamailio via (systemctl start kamailio) I get >> some errors >> >>июн 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) INFO: >> <core> [core/udp_server.c:205]: >> probe_max_receive_buffer(): SO_RCVBUF is finally 425984 >>июн 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) DEBUG: >> <core> [core/tcp_main.c:2753]: tcp_init(): added 37.143.9.210:443 >>июн 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) ERROR: >> <core> [core/tcp_main.c:2855]: tcp_init(): bind(9, >> 0x7fb6ef026f84, 16) on 37.143.9.210:443 : Permission denied >>июн 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) ERROR: >> tls [tls_init.c:342]: tls_h_init_si(): Error while initializing >> TCP part of TLS socket 37.143.9.210:443 >>июн 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) DEBUG: >> rtpengine [rtpengine.c:1986]: mod_destroy(): >> rtpengine_hash_table_destroy() success! >> >> >>If I start it via /usr/sbin/kamailio - all work. >> >>What I do wrong? >> >> >> >>-- >>Олег Подгуйко >>_______________________________________________ >>Kamailio (SER) - Users Mailing List >>sr-users(a)lists.kamailio.org >>https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users >> > >-- >Daniel-Constantin Mierla -- www.asipto.com >www.twitter.com/miconda -- www.linkedin.com/in/miconda _______________________________________________ >Kamailio (SER) - Users Mailing List >sr-users(a)lists.kamailio.org >https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

-- Олег Подгуйко

_______________________________________________ Kamailio (SER) - Users Mailing List sr-users(a)lists.kamailio.org https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

-- BR, Denys Pozniak

-- Олег Подгуйко

Daniel Tryba

1:39 p.m.

On Wed, Jun 05, 2019 at 01:18:32PM +0300, ???????? ???????????????? wrote:

...

When User and Group = kamailio I can't start kamailio.service at all. I get errors ()??

?????? 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) ERROR: <core> [core/tcp_main.c:2855]: tcp_init(): bind(9, 0x7fb6ef026f84, 16) on?? 37.143.9.210:443 ??: Permission denied

The question is why? If am using User and Group = root it works. Group Kamailio exist and user too.

Check Karsten's message. That has the main reason for certificate related issues: can the user you are trying to run a daemon as actually access the needed files (the certificates).

Karsten Horsmann

21 Jun 21 Jun

4:12 p.m.

Hi List, Port 443 is an privileged port. In my test lab we have the issue that voip user is not allowed to bind to that under 1024 privileged port. Which is the normal behavior I think. I overlooked that detail. Daniel Tryba <d.tryba(a)pocos.nl> schrieb am Mi., 5. Juni 2019, 13:40:

...

On Wed, Jun 05, 2019 at 01:18:32PM +0300, ???????? ???????????????? wrote:

When User and Group = kamailio I can't start kamailio.service at all. I

get errors ()??

>?????? 04 15:00:52 p534507.kvmvps kamailio[23502]: 0(23502) ERROR:

<core> [core/tcp_main.c:2855]: tcp_init(): bind(9, 0x7fb6ef026f84, 16) on?? 37.143.9.210:443 ??: Permission denied

The question is why? If am using User and Group = root it works. Group Kamailio exist and user too.

Check Karsten's message. That has the main reason for certificate related issues: can the user you are trying to run a daemon as actually access the needed files (the certificates). _______________________________________________ Kamailio (SER) - Users Mailing List sr-users(a)lists.kamailio.org https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

1777

days inactive

1794

days old

sr-users@lists.kamailio.org

Manage subscription

8 comments

5 participants

tags (0)

participants (5)

Daniel Tryba
Daniel-Constantin Mierla
Denys Pozniak
Karsten Horsmann
Олег Подгуйко