Up to Discussions in OpenSBC

This Question is Answered

1 "correct" answer available (5 pts) 2 "helpful" answers available (1 pts)
10 Replies Last post: Mar 19, 2010 4:44 AM by peters  
Click to view peters's profile  
peters
6 posts since
Dec 9, 2009

Mar 8, 2010 6:19 AM

reject unregistered users


Hi All,

i would like to know, how to correctly set up opensbc. SIP extensions register towards openSBC public IP, users are configured in local domain accounts. All-registration is disabled. In B2Bua-routes there is route like [sip:*] sip:LAN_IP_OF_PBX:5060.

But it is possible, even without registration to make a succesfull call. Trust-all-hosts is disabled as well.

Is this correct behaviour?

I'm asking because i thought SBC is configured well, but it seem's it wasn't, and somebody from china made a lot of calls through us...

Many thanks,

Peter

Tags: opensbc, configuration
Click to view ehernaez's profile  
ehernaez
67 posts since
Aug 28, 2007
1. Mar 11, 2010 11:46 AM in response to: peters
Re: reject unregistered users
Sorry to hear about the fraud calls. Unregistered users can still send calls if there is a matching entry in the B2BUA-Routes. Instead of that approach, try using the Host Access List. Uncheck the 'Trust All Hosts' option, and enter only the IP address ranges from which you wish to accept INVITEs. Keep in mind that OSBC checks the source IP address of the inbound packet, and not the properties of the SIP header.
Click to view peters's profile  
peters
6 posts since
Dec 9, 2009
2. Mar 11, 2010 3:28 PM in response to: ehernaez
Re: reject unregistered users
It was disabled as you proposed:

[Host-Access-List]
Trust-All-Hosts=False
Trusted-Host-List Array Size=0
Enable-Selective-Banning=True
Banned-Host-List Array Size=0

My understanding was, that only registered users can make calls. We used opensbc for remote extensions at home (behind DSL routers). None of them has static public IP, so i can't really use selective hosts....
Do you have any suggestions?

Many thanks,
Peter
Click to view joegen's profile  
joegen
519 posts since
Apr 28, 2007
3. Mar 17, 2010 9:13 PM in response to: peters
Re: reject unregistered users
There is a provision in b2bua-routes (accept-all-calls). Uncheck taht so that each call will be challenged by the sbc against the configured accounts.
Click to view peters's profile  
peters
6 posts since
Dec 9, 2009
4. Mar 18, 2010 6:06 AM in response to: joegen
Re: reject unregistered users
It is and was unchecked. But still unregistred users can make calls. I'm posting also my config file, maybe there is something else misconfigured.

I'm running 1.1.6-9

Peter
Attachments:
Click to view joegen's profile  
joegen
519 posts since
Apr 28, 2007
5. Mar 18, 2010 7:08 AM in response to: peters
Re: reject unregistered users
sorry my bad. i answered your post without my first cup of coffee for the day. its Trusted-Domains/Accept-All-Calls. Make sure its not unchecked.
Click to view peters's profile  
peters
6 posts since
Dec 9, 2009
6. Mar 18, 2010 7:12 AM in response to: joegen
Re: reject unregistered users
yes it is/was disabled....

Peter
Click to view joegen's profile  
joegen
519 posts since
Apr 28, 2007
7. Mar 18, 2010 8:02 AM in response to: peters
Re: reject unregistered users
could be a bug in the config module. can you check it then save and uncheck it again then save? I know you ahvent touched it because trusted-domains is not in your ini.
Click to view peters's profile  
peters
6 posts since
Dec 9, 2009
8. Mar 18, 2010 8:26 AM in response to: joegen
Re: reject unregistered users
You were right, it was missing in configuration. I enabled/disabled it, now in config there is:

[Trusted-Domains]
Accept-All-Calls=False
Trusted-Domain-List Array Size=0
X-Remote-Info-List Array Size=0

Configuration survives also reboot.

Now, if making call with user which is not in local-domain-accounts, call is rejected with 403 Forbidden, which is correct.
But, I'm able to make calls with user defined in local-domain-accounts, where user is not registered. So it allows me to make calls without user registration.

Peter
Click to view joegen's profile  
joegen
519 posts since
Apr 28, 2007
9. Mar 18, 2010 6:34 PM in response to: peters
Re: reject unregistered users

Hi Peter,


INVITEs are authenticated seperately from REGISTERs. So for as long as a UA has proper credential it doesn't matterwhether it's REGISTERed or not. That is not a bug. It's actually how things work generally in SIP.


Joegen

Click to view peters's profile  
peters
6 posts since
Dec 9, 2009
10. Mar 19, 2010 4:44 AM in response to: joegen
Re: reject unregistered users
Hi Joegen,

you are right, it is working as it should. I was testing it with correct credentials, therefore even without registration calls were possible. After changing the username/password, it doesn't allow to make calls.
Many thanks for help,

Peter

Actions

More Like This