<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Hello,<div><br></div><div>Try allow<b> allowguest=no </b>in sip.conf [general] context and create a peer for kamailio in sip.comf</div><div><br></div><div><br></div><div>Regards</div><div>Cibin</div><div><font face="Menlo"><span style="font-size: 11px;"><br></span></font></div><div><font face="Menlo"><span style="font-size: 11px;"><br></span></font></div><div><font face="Menlo"><span style="font-size: 11px;"><br></span></font></div><div><font face="Menlo"><span style="font-size: 11px;"><br></span></font><div><div>On 17-Jul-2014, at 12:52 pm, <a href="mailto:g.aloitus@gmail.com">g.aloitus@gmail.com</a> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Hello,<br><br>There is a message "Possible Security issue with Kamailio - Asterisk Realtime integration" in Asterisk users mailing list:<br><br><a href="http://lists.digium.com/pipermail/asterisk-users/2013-February/277633.html">http://lists.digium.com/pipermail/asterisk-users/2013-February/277633.html</a><br><br>I think the problem I have is somewhat similar.<br><br>Should I suppose that there is a security risk in Kamailio - Asterisk realtime integration, and if this is a case what I can do to eliminate this risk?<br><br>Best,<br><br>Teijo<br><br>16.7.2014 9:44, <a href="mailto:g.aloitus@gmail.com">g.aloitus@gmail.com</a> kirjoitti:<br><blockquote type="cite">Hello,<br><br>Has anybody any solution or suggestion?<br><br>If I for example launch MicroSIP (no doubt it could be some other SIP<br>client), and simply call:<br><br><a href="sip:some_extension@my.public.ip.address">sip:some_extension@my.public.ip.address</a><br><br>call is established, if there is online user/users. Naturally this<br>incoming call should be handled by Asterisk in context where I have<br>defined unauthorized calls are handled, but in stead, the call goes<br>online user's context.<br><br>To get this situation I don't need to define any account information in<br>MicroSIP.<br><br>I have not set passwords for users in Asterisk to avoid double<br>authorization. May this cause the behavior? I have not set default user<br>or from user in my peer definitions. I am not registering Kamailio to<br>Asterisk - I mean I have no peer definition for Kamailio in sip.conf.<br><br>I do not know what direction to go to. I would be happy, if I should not<br>go to the trial and error path so any help is welcome.<br><br>Thanks in advance,<br><br>Teijo<br><br><br>14.7.2014 9:06, <a href="mailto:g.aloitus@gmail.com">g.aloitus@gmail.com</a> kirjoitti:<br><blockquote type="cite">Hello,<br><br>If one places call, and tell that "my from domain is your Kamailio's<br>IP", call is established, because Asterisk accepts requests from<br>Kamailio. One problem is that it's unpredictable in this case what is<br>the context where thiskind of call is handled by Asterisk.<br><br>This situation requires that I change something in my setup. If I decide<br>accept calls only from my users, I suppose that it can be quite easily<br>done by modifying if statement referred below or at least by applying<br>instructions found here:<br><br><a href="http://www.kamailio.org/dokuwiki/doku.php/examples:restrict-calls-to-registered-users">http://www.kamailio.org/dokuwiki/doku.php/examples:restrict-calls-to-registered-users</a><br><br><br><br>However, I'm somewhat unsure what should I do, if I decide to accept<br>calls from any caller - not only from my users.<br><br>Best,<br><br>Teijo<br><br>12.7.2014 19:36, Muhammad Shahzad kirjoitti:<br><blockquote type="cite">Well, this<br><br>*if (from_uri!=myself && uri!=myself)*<br><br>Means neither source nor destination is our user. Which implies that<br>if our<br>domain is A, then call from domain "B to C" is not possible. However,<br>calls<br>from "B or C to A" and "A to B or C" are possible. That is way an<br>unauthorized user gets passed and reaches asterisk. Asterisk accepts it<br>since call is coming from kamailio and tries to route it back to<br>kamailio,<br>where kamailio finds user online and thus it goes through.<br><br>You should really break down this,<br><br>*if (from_uri!=myself && uri!=myself)*<br><br>into something like this for clarity,<br><br><br>*if (from_uri!=myself) { *<br>* if (uri!=myself) {*<br>* # neither source nor destination is our user*<br>* } else {*<br>* # source is not our user but destination is our user*<br>* };*<br>*} else {*<br>* if (uri!=myself) {*<br>* # source is our user but destination is not our user*<br>* } else {*<br>* # both source and destination are our users*<br>* };*<br>*};*<br><br>Hope this helps.<br><br>Thank you.<br><br><br><br><br>On Fri, Jul 11, 2014 at 5:36 PM, <g.aloitus@gmail.com> wrote:<br><br><blockquote type="cite">Hello,<br><br>I'm using Kamailio version 4.1.4+precise (amd64).<br><br>I have followed "Kamailio 4.0.x and Asterisk 11.3.0 Realtime<br>Integration<br>using Asterisk Database" (http://kb.asipto.com/<br>asterisk:realtime:kamailio-4.0.x-asterisk-11.3.0-astdb). One main<br>difference in my setup compared to that one is that I continued use of<br>Kamailio's database.<br><br>The problem is as follows:<br><br>I decided to put Kamailio and through it Asterisk reachable from<br>internet.<br>I have tried to configure Asterisk so that only calls of registered<br>users<br>would be possible, and they could only call to other registered<br>users or<br>conference rooms and echo test number.<br><br>Then I took the following steps:<br><br>I ensured that there was no online users with kamctl online. Then I<br>launched MicroSIP (www.microsip.org), but I did not defined account, I<br>simply set the protocol to tls and media encryption to mandatory,<br>because<br>I'm using these.<br><br>I called to extension with xxx@my.public.ip.address (where xxx is<br>extension) getting "unauthorized". And that was what I wanted.<br><br>But if there is online users, calls go through, and incoming call is<br>coming from Asterisk (in syslog I can find out that src_user=asterisk).<br><br>Kamailio and Asterisk are listening the same IP address, but different<br>port. I have refused connections to the Asterisk's port with iptables.<br><br>I have defined my public IP address as domain in sip.conf. There is<br>also<br>other domain defined which corresponds to users' domain I am using in<br>Kamailio's database.<br><br>In kamailio.cfg there is if statement which prevents Kamailio not to be<br>open relay:<br><br>if (from_uri!=myself && uri!=myself)<br>...<br><br>If I change this for example:<br><br>if (from_uri!=myself || uri!=myself)<br><br>I get what I want this time: no calls from outside, but I somewhat<br>think<br>that this is not a final solution.<br><br>I have not found from log files such information which would have<br>helped<br>me. I have not yet investigated this problem so much that I could<br>tell the<br>logic behind the selection of online user's identity which is used.<br>However, if I make a call to conference room I notice that Asterisk is<br>thinking that one of online users has joined the conference.<br><br>If I can recall correctly, I started with Kamailio version 3.2, and<br>integrated it with Asterisk 11 (currently 11.10.2). Is there something<br>which has changed in Kamailio, but what I have not changed in my setup<br>which could explain this.<br><br>Best,<br><br>Teijo<br><br>_______________________________________________<br>SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list<br>sr-users@lists.sip-router.org<br>http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users<br><br><br><br>Tämä viestin rungon osa siirretään pyydettäessä.<br></blockquote></blockquote></blockquote></blockquote><br>_______________________________________________<br>SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list<br><a href="mailto:sr-users@lists.sip-router.org">sr-users@lists.sip-router.org</a><br><a href="http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users">http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users</a><br></blockquote></div><br></div></body></html>