Archive for the ‘openser’ Category

SiVuS: un escáner de vulnerabilidad para las redes VoIP

October 12, 2008

SiVuS es un escáner de vulnerabilidad para las redes VoIP que utilizan el protocolo SIP. Este escáner proporciona varias características para verificar la robustez y para asegurar la implementación de una red VoIP segura.

Las características de este escáner son las siguientes:

Generador de mensajes SIP: puede ser utilizado para enviar varios tipos de mensajes a un componente del SIP incluyendo contenido del SDP. Esta característica se puede utilizar para probar ediciones específicas del SIP o para generar varios ataques, como por ejemplo un ataque de denegación de servicios.

Explorador de componentes del SIP: explora una gama de direcciones IP para identificar los anfitriones que utilizan el protocolo SIP y se puedan utilizar como blancos para el análisis adicional. Es una opción del explorador que permite el descubrimiento preliminar de blancos antes de una exploración real.

Explorador de la vulnerabilidad del SIP: El explorador proporciona la configuración flexible de varias opciones que se puedan utilizar, para verificar la robustez y la seguridad de una implementación del protocolo SIP. Se realizan chequeos como: análisis de las cabeceras de mensajes del protocolo SIP para identificar vulnerabilidades tales como desbordamientos del buffer o ataques de denegación de servicio, autentificación de mensajes que identifican componentes del SIP, autentificación de las peticiones del registro, inspección para las comunicaciones seguras (SIPS) y verificación de las capacidades de cifrado.

Componente de log: posee un completo sistema de log en HTML que permite omitir mensajes de error para hacer logs mas fáciles de comprender, también posee base de datos para históricos.

Ayuda del SIP: el interfaz de SiVuS proporciona ayuda rápida en los aspectos más comunes sobre SIP que pueden ser útiles a un usuario mientras que realizan SiVuS. La ayuda del SIP proporciona información sobre última versión del estándar RFC 3261 (SIP), muestra también ayuda a un usuario para construir mensajes del SIP a través del generador.

Descarga Sivus 1.09:
http://www.vopsecurity.org/sivus-1.09.exe

Manual Sivus 1.09:
http://www.vopsec.net/SiVuS-User-Doc.pdf

Seguridad en VoIP a través del protocolo ZRTP.
http://vtroger.blogspot.com/2007/10/seguridad-en-voip-travs-del-protocolo.html

Herramienta de test de penetración para VoIP:
http://vtroger.blogspot.com/2007/10/herramienta-de-test-de-penetra

Algunos clientes IMS

August 15, 2008

Con la maqueta de open ims core funcionando aparece la necesidad de conseguir clientes IMS y sip con los cuales podamos probar:


There are several IMS clients out there recently, which can be used with the Open IMS Core.

  • FOKUS’ OpenIC (Open IMS Client) is available only commercially (Contact: info@open-ims.org). Yet, there is also a free binary OpenIC_Lite version available right here
  • The UCT IMS Client which is available under the GPL
  • The IMS Communicator, also under the GPL

Instale el ultimo y lo estoy probando a ver que tal, hasta el momento veo que tiene una pinta bastente fea pero hace lo que tiene que hacer…pero como siempre digo este tema esta evolucionando a una velocidad vertiginosa, conasulten siempre las fuentes: http://www.openimscore.org/node/72

Openser, OpenIMS Core, kamailio, linux, asterisk……

Using MS Windows Messenger with a custom SIP Server

August 13, 2008

De hecho no solo windows messenger puede perfectamente trabajar con openser, opensips, openimscore, sino tambien gaim y otros clientes que ya mencionaremos.

Con MS Windows tenemos los siguientes features:

Supported protocols: SIP 2.0., UDP/TCP/IP/TLS, SIMPLE

Voice codecs: G.723.1, G.722.1, GSM6.10, G.711 (que malo no tiene el G729)

Features: local buddy list, presence, audio and video, instant messaging

Using MS Windows Messenger with a custom SIP Server (obtenido de: http://www.voice-system.ro/docs/sip-ms-msg/ar01s03.html#id2472711

Although MS provides its own SIP server, known as MS Live Communications Server, this article is based on experiences during the usage of MS Windows Messengers with SIP Express Router (SER).

In your real configuration, you have to replace the addresses presented in this document with the proper values for your SIP service. So, in the next examples we will use “sip-server.net” as the address of the SIP server (registrar and proxy), “3333@sip-server.net” as the SIP address of local user and “4444@sip-server.net” as the SIP address of the remote user.

3.1. Configure MS Windows Messenger

Make sure the version of MS Windows Messenger is 4.6, 4.7 or 5.0+.

3.1.1. Start MS Windows Messenger

- Start -> Programs -> Windows Messenger

3.1.2. Go to Options

- from menu, select “Tools” -> “Options…

3.1.3. Go to Accounts

- select “Accounts” tab

- select “Communications Service

- in the “Communications Service Account” section, fill in the “Sign-in name” field with the address of your SIP account, e.g., “3333@sip-server.net”.

3.1.4. Advanced Option

- click on “Advanced…” button

- select “Configure Settings

- outbound proxy: to enable outbound proxy fill in the “Server name or IP address” with the address of your SIP server, e.g., “sip-server.net:5060

- communication protocol: select an option from “Connect Using” list, e.g., “UDP” — this is the most recommended protocol for SIP

- click OK

- click OK in Options window

3.1.5. Register with your SIP server

- click on “Click here to sign in

3.1.6. Authentication

- if the SIP server requires user authentication

- fill the “Sign-in name” field with your SIP address, e.g., “3333@sip-server.net

- fill the “Username Name” field with the user name of your SIP account, e.g., “3333

- fill the “Password” field with the password of your SIP account (chosen by you or given by your SIP provider during the subscription to SIP service)

- press “OK” button

3.1.7. Online

- you can start voice sessions or send instant messages

3.2. Use MS Windows Messenger

Once you are online, you can start chatting or talking with your friends using Windows Messenger, or, if you have a webcam, you can have a video conference.

3.2.1. Start a chat session

- click “Send a instant message” from “I want to…” list

- select “Other

- enter the address of destination in “e-mail address” field

- choose “Communication Service” in “Service” select box

- click “OK

- type the message in the new window

- press “Enter” or click on “Send” button

3.2.2. Start a voice conversation

- click “Start a voice conversation” from “I want to…” list

- select “Other

- enter the address of destination in “e-mail address” field

- choose “Communication Service” in “Service” select box

- click “OK

- wait until the remote party accepts your call

- you can send also instant messages while talking by typing the message in the input field in the bottom of the new window and pressing “Send” button.

Openwengo

OpenWengo is a community of enthusiasts and developers, creating free software products related to communication over IP. The flagship product of the OpenWengo project is a softphone which allows you to make free PC to PC video and voice calls, and to integrate all your IM contacts in one place.

OpenWengo was started and is supported by the french VoIP provider Wengo . Through our partnership with Wengo, we also offer very cheap PC to telephone and SMS rates. OpenWengo is an active community – come join us.

To get started, download the software and let us know what you think.

WengoPhone 2.1 (OpenWengo 2.1.2)
For Windows (other platforms)

Compilando opensips con soporte mysql y configuracion

August 12, 2008

1.- Habilitar soporte para mysql:

Para habilitar el soporte de MySQL editamos el fichero Makefile y localizamos esta sección:

exclude_modules?= jabber cpl-c pa mysql postgres osp unixodbc \
avp_radius auth_radius group_radius uri_radius xmpp \
presence pua pua_mi pua_usrloc \
mi_xmlrpc perl snmpstats

y eliminamos “mysql”, dejándolo así:

exclude_modules?= jabber cpl-c pa postgres osp unixodbc \
avp_radius auth_radius group_radius uri_radius xmpp \
presence pua pua_mi pua_usrloc \
mi_xmlrpc perl snmpstats

Mismo procedime¡iento que con openser.

2.- Cambio de password de mysql:
The default user is root and the password is, as they say blank for default.

You can set the root password by typing this:

CODE
# mysqladmin -u root password ‘new-password’

You can then login by typing this:

CODE
# mysql -u root –p


Then you’ll be prompted to provide the password you specified earlier.

You also might want to delete the anonymous user in the User’s table. The default configuration of MySQL allows any user access to the system without
providing a username or password.

Delete the user by typing this:

CODE

# mysql -u root –p
mysql> use mysql
mysql> delete from user where User=”;
mysql> quit

Framp:

Try stopping the mysql daemon

CODE
/etc/init.d/mysql stop


Run

CODE
mysqld_safe –skip-grant-tables &


Enter as root

CODE
mysql -u root -p

To change root password

CODE
mysql client – mysql -u root


and write

CODE

use mysql
update user set password=PASSWORD(”NEW-ROOT-PASSWORD”) where User=’root’;

3.- Resetear el password MySQL (por si se le olvido cual era el anterior):

# /etc/init.d/mysql stop
# echo SET PASSWORD FOR ‘root’@'localhost’ = PASSWORD\(‘NuevoPassword’\)\; >reset_pass
# mysqld_safe –init-file=reset_pass
# rm reset_pass
# /etc/init.d/mysql start

4.- Habilitar el DBENGINE como mysql:

All files containing openserctl in the name should be downloaded. Then place the files on the local file system as follows:

openserctl => /usr/local/sbin/
openserctlrc => /usr/local/etc/openser/
openserctl.{base,sqlbase,ctlbase,fifo,unixsock,mysql,pgsql} => /usr/local/lib/openser/opensectl/

Edit now /usr/local/etc/openserctrc and add:
DBENGINE=MYSQL
CTLENGINE=FIFO

Do: chmod +x /usr/local/sbin/openserctl

Also, you can set the database parameters – the comments in /usr/local/etc/openserctrc give you more details.


5.- Creando la base de datos opensips:

opensipsdbctl create opensips

6.- Agregando suscriptores:

opensipsctl add user password email

rm para borrar

7.- Revisar estructura de la base de datos de mysql:

mysql -u root

show databases;

use opensips;

show tables;

select * from suscriber;

Openser ahora se llama opensips

August 10, 2008

El proyecto openser se llama ahora opensips.

OpenSIPS (Open SIP Server) is a mature Open Source implementation of a SIP server. OpenSIPS is more than a SIP proxy/router as it includes application-level functionalities. OpenSIPS, as a SIP server, is the core component of any SIP-based VoIP solution. With a very flexible and customizable routing engine, OpenSIPS ‘unifies voice, video, IM and presence services in a highly efficient way, thanks to its scalable (modular) design.
What OpenSIPS has to offer, comes in a reliable and high-performance flavour – OpenSIPS is one of the fastest SIP servers, with a throughput that confirms it as a solution up to enterprise or carrier-grade class.

Notas sobre instalacion, compilacion, configuracion: (copia del archivo de texto que viene cuando nos bajamos el paquete de la pagina):

$Id: INSTALL 4555 2008-08-03 03:41:05Z dan_pascu $

===========================================

OpenSIPS Installation Notes

http://www.opensips.org/

===========================================

This memo gives you hints how to set up OpenSIPS quickly. To
understand how OpenSIPS works and how to configure it properly,
read admin’s guide available from OpenSIPS website. We also
urge you to read latest ISSUES (available from OpenSIPS website
too) and check for potential problems in this release.
Users of previous releases are encouraged to read NEWS to
learn how to move to this new OpenSIPS version.

TOC

1. Supported Architectures and Requirements
2. Howto Build opensips From Source Distribution
3. Quick-Start Installation Guide
A) Getting Help
B) Disclaimers
C) Quick Start
D) opensips with Persistent Data Storage
4. Troubleshooting

1. Supported Architectures and Requirements
——————————————-

Supported architectures: Linux/i386, Linux/armv4l, FreeBSD/i386, OpenBSD/i386
Solaris/sparc64, NetBSD/sparc64
(for other architectures the Makefiles might need to be edited)

There are various configuration options defined in the Makefile.

Requirements:

- gcc / suncc / icc : gcc >= 2.9x; 4.[012] recommended (it will work with
older version but it might require some options tweaking for best
performance)
- bison or yacc (Berkley yacc)
- flex
- GNU make (on Linux this is the standard “make”, on FreeBSD and Solaris is
called “gmake”) version >= 3.79.
- sed and tr (used in the makefiles)
- GNU tar (“gtar” on Solaris) and gzip if you want “make tar” to work
- GNU install or BSD install (on Solaris “ginstall”) if you want “make
install”, “make bin”, “make sunpkg” to work
- openssl if you want to compile the TLS support
- libsctp if you want to compile the SCTP support
- libmysqlclient & libz (zlib) -libs and devel headers- if you want mysql DB
support (the db_mysql module)
- libpq / postgresql -libs and devel headers- if you want postgres DB
support (the db_postgres module)
- unixodbc -libs and devel headers- if you want unixodbc DB
support (the db_unixodbc module)
- libexpat if you want the jabber gateway support (the jabber module) or the
XMPP gateway support
- libxml2 if you want to use the cpl-c (Call Processing Language) or
the presence modules (presence and pua*)
- libradius-ng -libs and devel headers- if you want to use functionalities
with radius support – authentication, accounting, group support, etc
- unixodbc – libs and devel headers – if you want UNIXODBC support as
DB underlayer
- libxmlrpc-c3 – libs and devel headers – if you want to have XML-RPC support
for the Management interface (MI)
- libperl – libs and devel headers – if you want PERL connector to support
perl scripting from you config file (perl module)
- libsnmp9 – libs and devel headers – if you want SNMP client functionality
(SNMP AgentX subagent) for opensips
- libldap libs and devel headers v2.1 or greater – if you want LDAP support
- libconfuse and devel headers – if you want to compile the carrierroute
module

OS Notes:

- FreeBSD/OpenBSD/NetBSD: make sure gmake, bison or yacc & flex are installed
- Solaris: as above; you can use Solaris’s yacc instead of bison. You might
need also gtar and ginstall.

2. Howto Build opensips From Source Distribution
——————————————-

(NOTE: if make doesn’t work try gmake instead)

- compile with default options (TLS support is enabled by “TLS=1″; SCTP
support is enabled by “SCTP=1″):

make #builds only opensips core, equivalent to make opensips
make modules

or make all #builds everything

-compile debug mode version

make mode=debug all

-compile only the textops module

make modules=modules/textops modules

-compile all the “default” modules except textops and db_mysql

make skip_modules=”textops db_mysql” modules

-compile all default modules and include uri_radius (not compiled by default):

make include_modules=”uri_radius” modules

-compile all the modules from the modules subdirectory (even the one excluded
by default):

make exclude_modules=”" modules

-compile all the modules from the modules subdirectory excluding exec:

make exclude_modules=exec modules
or
make exclude_modules=”" skip_modules=exec modules

-generate README file for textops module

make modules=modules/textops modules-readme

-compile with gcc-3.2 instead of gcc

make CC=gcc-3.2 all

or

CC=gcc-3.2 make all

Make targets:

Clean:

make clean (clean the modules too)
make proper (clean also the dependencies)
make distclean (the same as proper)
make mantainer-clean (clean everything, including auto generated files,
tags, *.dbg a.s.o)

Compile:

make proper
make
(or gmake on non-Linux systems)
make modules
or make modules exclude_modules=”exec” etc.

Make tags:

make TAGS

Create a tar.gz with the sources (in ../):

make tar

Create a tar.gz with the binary distribution (in ../):

make bin

Create a gzipped solaris package (in ../):

make sunpkg

Create debian packages (in ../):

make deb

or

dpkg-buildpackage

Install:

make prefix=/usr/local install

Note: If you use prefix parameter in make install then you also need
to use this parameter in previous make commands, i.e. make, make modules,
or make all. If you fail to do this then OpenSIPS will look for the default
configuration file in a wrong directory, because the directory of the
default configuration file is hard coded into opensips during compile time.
When you use a different prefix parameter when installing then the
directory hard coded in opensips and the directory in which the file will be
installed by make install will not match. (You can specify exact location
of the configuration file using -f parameter of opensips).

For example, if you do the following:
make all
make prefix=/ install

Then the installation will put the default configuration file into
/etc/opensips/opensips.cfg (because prefix is /), but opensips will look for the
file in /usr/local/etc/opensips/opensips.cfg (because there was no prefix
parameter in make all and /usr/local is the default value of prefix).

Workaround is trivial, use the same parameters in all make commands:
make prefix=/ all
make prefix=/ install

That applies to other make parameters as well (for example parameters
“modules” or “excluded_modules”).

3. Quick-Start Installation Guide
———————————————-

A) Getting Help

This guide gives you instructions on how to quickly set up OpenSIPS
on your box. In case the default configuration does not fly, check
documentation at opensips site
http://www.opensips.org/
to learn how to configure OpenSIPS for your site.

If the documentation does not resolve your problem you may try contacting
our user forum by E-mail at users@opensips.org — that is the mailing list
of opensips community. To participate in the mailing list, subscribe at the
following web address:
http://www.opensips.org/cgi-bin/mailman/listinfo/users

B) Disclaimers

Note well the default “quick-start” configuration is very simple in order
to be easily installable. It provides minimum features. Particularly,
authentication is by default disabled, which means anyone can register using
any name with the server. (This is on purpose to avoid installation
dependencies on MySQL which is needed for storing user credentials.)

C) Quick Start

The following step-by step guide gives you instructions how to install the
sql-free distribution of opensips. If you need persistence and authentication,
then you have to install additional MySql support — proceed to section D)
after you are finished with C).

1) Download an RPM or debian package from our site
http://opensips.org/pub/opensips/latest/packages/
If you don’t use an rpm or debian based distribution, see if corresponding
packages are available or try our tar.gz’ed binaries.
If you use Gentoo Linux you do not have to download a package.
For debian, packages are available via the Debian official repositories for
testing and unstable. For stable, use the project’s repository at:
deb http://www.opensips.org/debian stable main

2) install the package
RPM:
rpm -i
debian:
dpkg -i
or if APT repository is used:
apt-get install
gentoo:
emerge opensips
(or if use only stable packets: ACCEPT_KEYWORDS=”~x86″ emerge opensips)
tar.gz:
cd /; tar zxvf _os_arch.tar.gz
(it will install in /usr/local/, and the configuration file in
/usr/local/etc/opensips/opensips.cfg)
Solaris:
gunzip .gz ; pkgadd -d
*BSD:
pkg_add package_name
Note that the OpenSIPS package is in the FreeBSD package tree included,
but is not present in the OpenBSD and NetBSD repository. You’ll probably
have more luck trying to build directly from the source with the tar.gz,
as the package files for this systems are somewhat out of date at the
moment.

3) start the server
RPM + gentoo:
/etc/init.d/opensips start
debian:
opensips is started automatically after the install
(in case something fails you can start it with /etc/init.d/opensips start)
tar.gz:
the tar.gz does not include an init.d script, you’ll have to create one of
your own or adapt one from the source distribution (debian/init.d,
rpm/opensips.init.*, gentoo/opensips.init)
You can start opensips directly with /usr/local/sbin/opensips.
Solaris:
see tar.gz.

4) optionally, watch server’s health using the opensipsctl utility
– to do so, first set the environment variable SIP_DOMAIN to your domain
name, e.g., in Bourne shell, call
export SIP_DOMAIN=”myserver.foobar.com”
– if you are using other than ‘localhost’ mysql server for maintaining
subscriber database, change the variable ‘SQL_HOST’ to the proper
host name in the opensipsctl script
– run the opensipsctl utility
/usr/sbin/opensipsctl moni
or
/usr/local/sbin/opensipsserctl moni (if you installed from a tar.gz
or solaris package)
– you can create a resource file for opensipsctl, name it .opensipsctlrc
and place it in your home directory. You can set there the values for
opensipsctl variables (e.g., SIP_DOMAIN, SQL_HOST, SQL_USER, SQL_DB …)

5) Register with the server using your favourite SIP User Agent.
For example, users of Windows Messenger need to set
in Tools->Options->Accounts the following values:
Sign-in Name: @
Advanced->Configure Settings (on)
Advanced->Server:
Connect Using: UDP

D) opensips with Persistent Data Storage

The default configuration is very simple and features many simplifications.
In particular, it does not authenticate users and loses User Location database
on reboot. To provide persistence, keep user credentials and remember users’
locations across reboots, opensips can be configured to use MySQL. Before you
proceed, you need to make sure MySQL is installed on your box.

1) Download the package containing mysql support for opensips from:
http://www.opensips.org/pub/opensips/
(rpm and deb provided, most of the binary tar.gz distributions and the
solaris package include it; if it is not present you’ll have to rebuild
from the source).
For gentoo please include ‘mysql’ to your USE variable in /etc/make.conf
or give it as variable to the emerge command.
2) install the package
RPM based:
rpm -i
DEB based:
dpkg -i
or if APT repository is used
apt-get install
Gentoo Linux:
emerge opensips
(if do not want to put ‘mysql’ into your USE variable you can type:
USE=”mysql” emerge opensips)
3) create SQL tables
You must specify your database type in the /etc/opensipsctlrc file, e.g.
MySQL. See section 7 for an explanation of further possible parameters.
– if you have a previously installed OpenSIPS on your system, use
/usr/sbin/opensipsdbctl migrate
to convert your OpenSIPS database into new structures
NOTE: “migrate” is available only for mysql DBs
– otherwise, if this is your very first installation, use
/usr/sbin/opensipsdbctl create
to create OpenSIPS database structures
(you will be prompted for password of MySQL “root” user)

4) configure opensips to use SQL
uncomment all lines in configuration file opensips.cfg which are related to
authentication:
– loadmodule “/usr/lib/opensips/modules/db_mysql.so”
– loadmodule “/usr/lib/opensips/modules/auth.so”
– loadmodule “/usr/lib/opensips/modules/auth_db.so”
– modparam(“usrloc”, “db_mode”, 2)
– modparam(“auth”, “calculate_ha1″, yes)
– modparam(“auth_db”, “password_column”, “password”)
– if (!www_authorize(“sip.org”, “subscriber”)) {
www_challenge(“sip.org”, “0″);
break;
};
5) be sure to replace realm, the first parameter in www_* actions,
with name of your server; some broken UAC implementations don’t
authenticate otherwise; the authentication command in your
configuration script should look then like this:
if (!www_authorize(“myserver.foobar.com”, “subscriber”)) {
www_challenge(“myserver.foobar.com”, “0″);
break;
}
6) restart the server
/etc/init.d/opensips restart
7) you can now start managing the server using the opensipsctl utility;
you need to first set the environment variable SIP_DOMAIN to your
local SIP realm, e.g.,
export SIP_DOMAIN=”myserver.foobar.com”
or you can configure via the resource file for opensipsctlrc. The default
file is installed in the etc/ directory of your installation (along with the
OpenSIPS config file). For per user configuration, create .opensipsctlrc
in your home directory.
You can set there the values for opensipsctl variables like:
SIP_DOMAIN – your SIP domain
DBENGINE – database type: MYSQL, PGSQL or DBTEXT by default none is loaded
DBHOST – database host
DBNAME – database name
DBRWUSER – database read/write user
DBROUSER – database read only user
DBROPW – password for database read only user
DBROOTUSER – database super user
ALIASES_TYPE – type of aliases used:
DB – database aliases
UL – usrloc aliases
default none
CTLENGINE – control engine: FIFO or UNIXSOCK
OSIPS_FIFO – path to FIFO file
VERBOSE – verbose – debug purposes – default ’0′

a) watch the server status using ‘opensipsctl moni’
b) try to login with your SIP client as user ‘admin’ with
password ‘opensipsrw’
c) try adding new users using
‘opensipsctl add ‘

8) default values (database url, users and passwords) are:
– DEFAULT_DB_URL=”mysql://opensips:opensipsrw@localhost/opensips”
– r/w user: opensips ; passwd: opensipsrw
– r/o user: opensipsro ; passwd: opensipsro
VERY IMPORTANT NOTE: for security reasons, do change the values of
passwords after installation

4. Troubleshooting
——————

Q: SIP requests are replied by opensips with “483 Too Many Hops” or
“513 Message Too Large”

A: In both cases, the reason is probably an error in request routing script
which caused an infinite loop. You can easily verify whether this happens
by watching SIP traffic on loopback interface. A typical reason for
misrouting is a failure to match local domain correctly. If a server fails
to recognize a request for itself, it will try to forward it to current URI
in believe it would forward them to a foreign domain. Alas, it forwards the
request to itself again. This continues to happen until value of
max_forwards header field reaches zero or the request grows too big.
Solutions is easy: make sure that domain matching
is correctly configured. A quick way to achieve that is to introduce a config
option to opensips.cfg: alias=domainname, where domainname shall be replaced
with name of domain, which you wish to server and which appears in
request-URIs.

Install openser with mysql suport

August 8, 2008

Install package using apt-get

Edit your /etc/apt/sources.list. Add one of the following lines, depending of your Debian distribution:

deb http://www.openser.org/debian stable main
deb http://www.openser.org/debian testing main
deb http://www.openser.org/debian unstable main

Then run:

apt-get update
apt-get install openser

To see other available packages for OpenSER do:

apt-cache search openser

To see details about OpenSER package do:

apt-cache show openser

Configure /etc/default/openser:
Choose whether it should boot on start, how much memory you want to assign to openser and whether you need a crash log.

Troubleshooting with ngrep

Before you try to register to your SIP server make sure udp and tcp port 5060 are open. Use ngrep for tracing SIP messages on the SIP server. Useful commands are:

ngrep port 5060
ngrep -q ‘test_user_name’
ngrep -d lo port 5060
If you get the following error when registering: then probably your host forwards the SIP Message to itself. So trace on localhost to see if this is the case. If your server has more than one DNS entry, make sure that you have all hostnames in /etc/hosts and that you have the following line in your openser.cfg alias=”yoursipdomain.ch:5060″

Troubleshooting with the xlog module

For debugging purposes, it may be very helpful to use the xlog module, which logs directly with syslog.

Add the following line to the /etc/syslog.conf file:

# OpenSER messages
# make sure this spacing is done with tabs, spaces may cause errors
local7.* /var/log/openser

# remove local7 from syslog and messages
*.*;auth,authpriv.none,local7.none -/var/log/syslog
*.=info;*.=notice;*.=warn;\
mail,news.none,local7.none -/var/log/messages

And add the following line to the openser.cfg:

log_facility=LOG_LOCAL7
;Add the xlog module:
loadmodule “/usr/lib/openser/modules/xlog.so”

It is particular helpful for logging variables. You can add e.g. follwing line at the beginning of the default route.

xlog(“L_INFO”, “request method: [$rm], from URI: [$fu], To URI: [$tu]“);

The full set of variables is available on http://openser.org/docs/pseudo-variables.html

Control server with openserctl

With sudo openserctl moni you can monitor the state of your openser (whether it is actually running after the installation)

openserctl is located in /usr/sbin, which is not by default in the user PATH. To use openserctl as a non-priviledged user you need to add the path to the environment ( export $PATH=PATH:/usr/sbin) or call with the full path /usr/sbin/openserctl. Addionally you have to change permissions for the fifosockets. Add the following line in /etc/openser/openser.cfg

sock_group=”staff” # openser socket/fifo group, e.g. staff

If you don’t want to type the read/write password every time you make a change via openserctl, you can add the following lines to your /etc/openser/openserctlrc. This is also a good moment to configure the SIP domain.

## password for database read/write user
DBRWPW=openserrw
## your SIP domain
SIP_DOMAIN=yoursipdomain.ch
Be aware that this can be a security problem, as your password is unencrypted in a file. However, this might be anyway the case in /etc/openser/openser.cfg.

Install MySql for persistent user location and authentication

Without MySql database, users can register without authentication and lose user location information on reboot. To provide a persistent user location and authentication, you’ll need a database. If not yet installed, install MySql and openser-mysql-module:

apt-get install mysql-server-4.1
apt-get install openser-mysql-module

Run sudo /usr/sbin/openser_mysql.sh (also available for postgres database) to create the OpenSER database structures. You are asked for MySql root password and to enter your domain (realm) for the sip server. (e.g sip.yourdomain.ch) and if you want to install tables for serweb.

In case you had installed a prior version of openser, run /usr/sbin/openser_mysql.sh reinstall. Just type /usr/sbin/openser_mysql.sh for a complete list of actions.

Be aware that password will be reset to openserrw when running reinstall.
View /usr/sbin/openser_mysql.sh, where the following values are defined:
DBHOST=localhost
USERNAME=openser
DEFAULT_PW=openserrw
DBROUSER=openserro

You can change the password of the openser users by entering the database as root:

mysql -u root -p mysql
select * from user;
update user set Password = password(“yournewpassword”) where User=’openser’;
update user set Password = password(“yournewropassword”) where User=’openserro’;

When having another password than the standard password (recommended), you need to add the following line to your configuration file /etc/openser/openser.cfg .

modparam(“usrloc”, “db_url”, “mysql://openser:yournewpassword@localhost/openser”)
fifo_db_url=”mysql://openser:yournewpassword@localhost/openser”
modparam(“usrloc”, “db_mode”, 2)

Alternativly set modparam(“usrloc”, “db_mode”, 1) for reflecting changes immediately to DB. Slower but very reliable and opportune during debugging.

After all changes don’t forget to restart openser /etc/init.d/openser restart .

Adding users to the database

There are different ways how you can

Method 1: You can use openserctl on the command line:

openserctl add testuser secret email-of-testuser@sip.edu

Method 2: Alternativly you can add users directly into the MySql DB into the table subscriber.

Be aware, that if you are using ha1 passwords ( modparam(“auth_db”, “calculate_ha1″, no) ), you’ll have to insert hashed passwords. Find more here.
insert into subscriber (username, domain, password, email_address) values (“username”,”mydomain.ch”,”topsecret”,”email@mydomain.ch”);

Method 3: Install web interface like OpenSER Aministrator or serweb adapting it for openser.

Method 4: Authenticate users via a radius server using the auth_radius module. This section will be covered soon.

Using ENUM

ENUM support: ( http://www.openser.org/docs/modules/0.10.x/enum.html)

Load the enum module: loadmodule “/usr/lib/openser/modules/enum.so”

Define for which number you want to do an enum query: (the number must be in the form +41.. for Switzerland)

if (uri=~”sip:\+[0-9]+@ecs\.switch\.ch”) {

if (!enum_query(“e164.arpa.”)) {
enum_query(“nrenum.net.”);
};

route(1);
exit;
};

Routing:
You need to have different route, depending on where you want to route your users.

######### new route rules ################################

# containing just numbers, send to PSTN Gateway
if (uri=~”^sip:0041[0-9]+@(.+\.)?switch\.ch”) {
xlog(“L_INFO”,”we matched just numbers, entering asterisk route”);
route(2);
exit;
}

######### end route rules ################################

route[2] {

rewritehostport (“asterisk.switch.ch:5065″);
xlog(“L_INFO”,”rewritehostport to asterisk.switch.ch:5065″);
route(1);

}

OpenIC sip client with openser

August 6, 2008

root# openserctl add bob bob bob@localhost
database engine ‘MYSQL’ loaded
Control engine ‘FIFO’ loaded
is_user: user counter=0
check_db_alias: alias counter=0
new user ‘bob’ added

OpenIMSCore Installation Guide

July 24, 2008

http://www.ims-developer.org/content/view/44/56/

http://www.openimscore.org/installation_guide

OpenIMSCore Installation Guide

Installation Guide

Overview

This page is supposed to help you jump-start the Open IMS Core. In the SVN distribution, the whole things is pre-configured and pre-provisioned with a set of minimal data that should be enough for a simple “Alice-calls-Bob” trial.

Quick Install

If you already went once through the installation procedure, this section will help refresh your memory on what steps you are supposed to follow. If this is your first time, skip over it for now and start with Step 1.

      	

mkdir /opt/OpenIMSCore

cd /opt/OpenIMSCore



mkdir FHoSS

svn checkout http://svn.berlios.de/svnroot/repos/openimscore/FHoSS/trunk FHoSS



mkdir ser_ims

svn checkout http://svn.berlios.de/svnroot/repos/openimscore/ser_ims/trunk ser_ims



cd FHoSS

ant compile deploy

cd ..



cd ser_ims

make install-libs all

cd ..



mysql -u root -p

Step 1: Prerequisites

  • Hardware requirements
    • A current Linux desktop class machine should be enough
    • If you want to get ultimate performance:
      • Add several Gigabytes of RAM
      • Have as many CPUs/Cores as
      • Gigabit Ethernet would help
  • Network access
    • A current Linux desktop class machine should be enough
    • Inter-domain NAT is not something we are interested in, so a public IP address would be great
    • Controllable DNS server if you don’t want to have one on your Linux box
  • Software requirements
    • ~100 MBytes of disk space to be on the safe side
    • GCC3/4, make, JDK1.5, ant
    • MySQL installed and started (or other DBMS if you can deal with it)
    • bison, flex
    • libxml2 (> 2.6), libmysql – both with development
    • Linux kernel 2.6 and ipsec-tools (setkey) if you want to use IPSec security
    • Optional: openssl if you would like to enable the TLS security
    • bind installed and running (or other name server if you can deal with it)
    • Browser on the box or that can connect to the box (for user provisioning)
    • Note: we consider that you have all this installed, configured and running.

      Note: we assume for now that you want to install the whole thing on just 1 box.

Step 2: Get the Source Code

Step 3: Compile

  • ser_ims
    • New!!! Do “make install-libs all” in ser_ims
      cd ser_ims

      make install-libs all

      cd ..
    • If something breaks, you probably don’t have all the prerequisites.
  • FHoSS
    • If you don’t have a JDK >=1.5, get one before proceeding
    • Make sure, that the JDK version that you are using is >= 1.5!!!
      # java -version

      java version "1.5.0_07"

      Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_07-b03)

      Java HotSpot(TM) Client VM (build 1.5.0_07-b03, mixed mode)

      It is often the case that users have just installed a 1.5 JDK but they are

      still using their old JDK installation! If you see lots of errors, recheck

      this before posting a bug report!

    • Do “ant compile deploy” in FHoSS

      New!!! “ant gen” is not needed any more!!!

      cd FHoSS

      ant compile

      ant deploy

      cd ..
  • While you wait for the compilation to finish, you can go ahead and perform Step 4.

Step 4: Configure the Environment

  • Notes:
    • All the installation examples configured to work only on the local loopback

      and the default domain configured as “open-ims.test”.

    • The MySQL access rights are set only for local access
    • We recommend that you try it first like this and then do your changes:
      • Replace 127.0.0.1 where required with your IP address
      • Replace the home domain (open-ims.test) with your own one
      • Change the database passwords

      For this operation the ser_ims/cfg/configurator.sh might help you.

  • DNS
    • A sample DNS zone file can be found in ser_ims/cfg/open-ims.dnszone
    • Copy it to your bind configuration directory
    • Edit named.conf and insert the file there (Would be great to also add reverse DNS entries)
    • Restart the name server
    • Test that the names are resolvable (don’t forget about /etc/resolv.conf pointing to your new DNS server!)
  • MySQL
    • Run the SQL dumps (mysql -u root -p -h localhost New!!! “hssdb.sql” was replaced by “hss_db.sql” !!!
      mysql -u root -p -h localhost 
    • Check if the databases are in there and accessible

Step 5: Configure the IMS Core

  • By now you should have MySQL and DNS working
  • CSCFs
    • Copy the following files to /opt/OpenIMSCore or another location comfortable for you:

      pcscf.cfg, pcscf.sh, icscf.cfg, icscf.xml, icscf.sh, scscf.cfg, scscf.xml, scscf.sh,

      cp ser_ims/cfg/*.cfg .

      cp ser_ims/cfg/*.xml .

      cp ser_ims/cfg/*.sh .

  • FHoSS
      <!–
    • Copy the following files to /opt/OpenIMSCore or another location comfortable for you: FHoSS.sh –>
    • Take a look at the configuration files in FHoSS/deploy/ (available after Step 3 completes)
  • Edit these files to your own preferences (don’t forget to update the DNS zone file accordingly and restart the name server)

Step 6: Start the components

  • CSCFs
    • Start pcscf.sh, icscf.sh and scscf.sh
    • All these should run in parallel.
    • We love debugging, so by default they would stay in foreground.
    • By default you should see periodically log messages with the content of the registrar and with the opened diameter links
  • FHoSS
    • Start FHoSS/deploy/startup.sh
    • If the previous step fails, check that you have the JAVA_HOME environment variable correctly exported and/or modify the script that you just tried to start.
    • Check the web interface on http://localhost:8080/
    • Check if the Diameter Peers are connecting to each other. You can see this in the console of FHoSS or in that of I/S-CSCF

Step 7: Configure Subscribers

  • FHoSS
    • By default, FHoSS comes provisioned with a couple of sample users:
    • Use these or insert new ones.
      • Create a Subscription
      • Create a Private Identity
      • Create a Public Identity
      • Link them
  • SIP-to-IMS Gateway
    • The SIP-to-IMS Gateway is now obsolete and was droped from the project. See the Annex and FAQ for information

      on how you can use the Open IMS Core with SIP clients capable of only MD5 authentication.

  • IMS User Endpoint Configuration
    • Provision with your own UE data or use one of the default users
    • Alice:
      • Private Identity: alice@open-ims.test
      • Secret Key: alice
      • OP: 0×00…0
      • AMF: 0×00…0
      • Use of Anonimity Key: enable
      • Public Identity: sip:alice@open-ims.test
      • Realm: open-ims.test
      • Strict Outbound Proxy: sip:pcscf.open-ims.test:4060
    • Bob: similar
  • SIP User Endpoint Configuration
    • Alice:
      • User part of the SIP URI: alice
      • Host part of the SIP URI/Domain/realm: open-ims.test
      • Password: alice
      • Strict Outbound Proxy: sip:pcscf.open-ims.test:4060
      • !!! Make sure that your SIP client does REGISTER sip:open-ims.test and not REGISTER sip:pcscf.open-ims.test:4060
      • !!! Read the Annex and FAQ related to using MD5-only clients with the Open IMS Core
    • Bob: similar

Step 8: Test!

  • This is the last step. You should have all installed and configured by now
  • Registration uses all components and as such, it is a good test if all is up & running
  • Use Wireshark to see what’s going on:
    • Monitor ports 4060, 5060 and 6060 for SIP traffic
    • Monitor ports 3868, 3869 and 3870 for Diameter traffic

Annex A – DNS HOWTO

A lot of users seem to have difficulties when setting up a DNS server. Although it is not our

purpose to teach you this, here is a summary of this process. But be aware that this does not means that we

are offering any further support for it and you don’t have to read the DNS manual. If you think that

/etc/hosts would be enough, you are wrong as it can not help you with special DNS queries like NAPTR and SRV.

So how do you get a DNS server up and running?

  • Get the bind (or often called named) package installed on your distribution
  • Make sure you are root
  • Locate named.conf (could be in /etc or /etc/bind or /etc/named)
  • Edit that file according to your needs. Here are some things that you need in there:
    options {

    ...

    forward first;

    forwarders {

    {THE_IP_ADDRESS_OF_YOUR_UPSTREAM_DNS_SERVER;} ;

    };

    ...

    };

    ...



    zone "open-ims.test" IN {

    type master;

    file "pri/open-ims.dnszone";

    notify no;

    };

    ...

    On some distributions this file includes other files so be sure to dig through those also.

    THE_IP_ADDRESS_OF_YOUR_UPSTREAM_DNS_SERVER can be found in /etc/resolv.conf.

  • Now copy the file /opt/OpenIMSCore/ser_ims/cfg/open-ims.dnszone to where you configure it above

    (pri/open-ims.dnszone)

    cp /opt/OpenIMSCore/ser_ims/cfg/open-ims.dnszone /var/bind/pri/

    chown -R named:named /var/bind/pri/open-ims.dnszone
  • Then start or re-start the DNS server (remember that these configuration files are not monitored

    for changes so you will have to send a SIGHUP or do a restart to reload them).

    /etc/init.d/named restart
  • You should now test if it works. In the response look if you got the correct answer.
    dig @127.0.0.1 pcscf.open-ims.test
  • To actually use it, you would need to configure it as a DNS server for your machine. Here is

    how your /etc/resolv.conf file should look like:

    # cat /etc/resolv.conf

    nameserver 127.0.0.1

    search open-ims.test

    domain open-ims.test
  • Remember that utilities like the DHCP-Client overwrite this file be default!

Annex B – SIP Clients How-To

The old SIP2IMS module that was performing MD5-to-AKA authentication translation has been deleted as being

obsolete as the core can perform MD5 authentication too. Another reason is that it’s functionality was seriously

flawed by the fact that it was a SIP proxy rather than a full B2BUA.

So how do you get a client registered?

  • First provision the users (or use the default sip:alice@open-ims.test or sip:bob@open-ims.test).

    Make sure than in the HSS provisioning interface in the private identity configuration, you allow the

    use of Digest-MD5 for the respective users

  • Then you have two options for the S-CSCF to trigger an MD5 authentication
    1. Modify the client to send a parameter “algorithm=MD5″ in the Authorization header in the first

      unauthorized REGISTER.

    2. Or modify the scscf.cfg and enable the MD5 authorization as the default authentication method instead

      of AKAv1-MD5.

  • Next just make sure that the client is using the P-CSCF address (sip:pcscf.open-ims.test:4060 by default) as

    strict outbound proxy and the REGISTER Request-URI is “sip:open-ims.test” (or your own domain name) and not

    “sip:pcscf.open-ims.test:4060″ as many SIP clients fail here.

Annex C – Changing the Domain Name and IP-Address of configuration files

OpenIMSCore is preconfigured to work with the domain “open-ims.test” and ip address of default loopback device, “127.0.0.1″.

Following the installation instructions above without changing the configuration files would set up this environment

successfully. For some reasons(like testing roaming,communicating with other external entitites), you would need

to change the domain name. In that case you could use a configuration script(configurator.sh) which is stored under

directory /opt/OpenIMSCore/ser_ims/cfg/

Does it only change *.cfg files?

No, it can also reconfigure *.xml , *.sql and FHoSS configuration files(*.properties).

How do I make use of configurator.sh?

  • You can directly execute it and fetch the files to be changed as arguments. See the example

    below:

     

    # pwd

    /opt/OpenIMSCore

    # ser_ims/cfg/configurator.sh ser_ims/cfg/scscf.cfg ser_ims/cfg/icscf.xml \

    FHoSS/deploy/hss_db.sql FHoSS/deploy/hss.properties

  • Then copy the files to the /opt/OpenIMSCore directory
  • Note that you have to backup your configuration files that you want to reconfigure

Virtualizacion y sistemas de voz sobre IP open source

June 21, 2008

Tenemos poderosas herramientas creadas en el mundo del open source ( y otras no open source pero gratuitas y con otros tipos de licencias) con las cuales podemos crear complejos sistemas de procesamiento, en el caso que hoy nos interesa sistemas de voip, no es un misterio para nadie que ya contamos hoy en dia con servidores bastantes economicos y capacidad de almacenamiento relativamente grande:

vmware o qemu para virtualizar los servidores (vmware algunas versiones son gratis) , siempre qeuda la opcion de usar qemu con la opcion de bridge.

trixswitch y freeswitch: sistemas open source de softswitch

openser: sip express router, front-end de los usuarios sip, excelente manejo de NAT. Manejo de base de datos de usuarios con mysql, funcionalidades de sip register, permite con los script openser.cfg y openserctl.cfg manejar todos los aspectos que queramos del protocolo sip, ademas de poder agregar funcionalidad adicionales con practicamente cualquier lenguaje de programacion.

asterisk: completo sistema de voip, permite funcionalidades de conversion de codecs, conversion de protocolos, registro de usuarios sip, maneja iax(mejor desempeño en voip que sip), voicemail. ivr, funcionalidades de conexion a SS7, PSTN, y otros sistemas voip. Con asterisk es posible manejar las tablas de enrutamiento del sistema telefonico. Posee funcionalidades de AGI (asterisk gateway interface) con los cual es posible agregarle muchas funcionalidades en cualquier lenguaje de programacion. Tiene a su disposicion muchos tipos de interfaces web, con las cuales es posible crear un completo sistema de provisioning de suscriptores desde los canales de venta directo al sistema sin poner en peligro la estabilidad del mismo. Podemos crear ademas con servidores basados y usando otras creaciones tambien opensource sistemas de tarificacion prepago, postpago, sistemas del tipo llama desde donde sea a un numero gratuito y luego de alli ofrecer servicios de voip.

freeradius: en sistemas muy complejos es preferible contar con un sistema de autenticacion de usuarios a fin de evitar clonado de usuarios o creacion de usuarios no autorizados. Funcionalidad de AAA.

Creating and sending INVITE and CANCEL SIP text messages

June 9, 2008

http://www.serveurperso.com/toolz/Flood/UDP%20Flooder%202.0/

http://www.switzernet.com/people/emin-gabrielyan/070403-sip-invite-cancel/


Follow

Get every new post delivered to your Inbox.