Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an asterisk system that I'm attempting to get to work as a backup for our 3com system. We already use it for a conference bridge. Our phones are the 3com 3C10402B, so I don't have the issue of older 3com phones that come without a SIP image.

The 3com phones are communicating SIP with the Asterisk, but are unable to register because they present a digest username value that doesn't match what Asterisk thinks it should.

As an example, here are the relevant lines from a successful registration from a soft phone:

Server sends:
WWW-Authenticate: Digest algorithm=MD5, realm="asterisk", nonce="1cac3853"
Phone responds:
Authorization: Digest username="2321", realm="asterisk", nonce="1cac3853", uri="sip:192.168.254.12", algorithm=md5, response="d32df9ec719817282460e7c2625b6120"

For the 3com phone, those same lines look like this (and fails):

Server sends:
WWW-Authenticate: Digest algorithm=MD5, realm="asterisk", nonce="6c915c33"
Phone responds:
Authorization: Digest username="sip:2321@192.168.254.12", realm="asterisk", nonce="6c915c33", uri="sip:192.168.254.12", opaque="", algorithm=MD5, response="a89df25f19e4b4598595f919dac9db81"

Basically, Asterisk wants to see a username in the Digest username field of 2321, but the 3com phone is sending sip:2321@192.168.254.12.

Anyone know how to tell asterisk to accept this format of username in the digest authentication?

Here is the sip.conf info for that extension:

[2321]
deny=0.0.0.0/0.0.0.0
disallow=all
type=friend
secret=1234
qualify=yes
port=5060
permit=0.0.0.0/0.0.0.0
nat=yes
mailbox=2321@device
host=dynamic
dtmfmode=rfc2833
dial=SIP/2321
context=from-internal
canreinvite=no
callerid=device <2321>
allow=ulaw, alaw
call-limit=50

... and for those interested in the grit, here is the debug output of the registration attempt:


REGISTER sip:192.168.254.12 SIP/2.0
v: SIP/2.0/UDP 192.168.254.157:5060
t: 
f: 
i: fa4451d8-01d6-1cc2-13e4-00e0bb33beb9
CSeq: 18580 REGISTER
Max-Forwards: 70
m: ;dt=544
Expires: 3600
User-Agent: 3Com-SIP-Phone/V8.0.1.3
X-3Com-PhoneInfo: firstRegistration=no; primaryCallP=192.168.254.12; secondaryCallP=0.0.0.0;


--- (11 headers 0 lines) ---
Using latest REGISTER request as basis request
Sending to 192.168.254.157 : 5060 (no NAT)


SIP/2.0 100 Trying
Via: SIP/2.0/UDP 192.168.254.157:5060;received=192.168.254.157
From: 
To: 
Call-ID: fa4451d8-01d6-1cc2-13e4-00e0bb33beb9
CSeq: 18580 REGISTER
User-Agent: Asterisk PBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY
Supported: replaces
Contact: 
Content-Length: 0



SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 192.168.254.157:5060;received=192.168.254.157
From: 
To: ;tag=as3fb867e2
Call-ID: fa4451d8-01d6-1cc2-13e4-00e0bb33beb9
CSeq: 18580 REGISTER
User-Agent: Asterisk PBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY
Supported: replaces
WWW-Authenticate: Digest algorithm=MD5, realm="asterisk", nonce="6c915c33"
Content-Length: 0


Scheduling destruction of SIP dialog 'fa4451d8-01d6-1cc2-13e4-00e0bb33beb9' in 32000 ms (Method: REGISTER)
confbridge*CLI>

REGISTER sip:192.168.254.12 SIP/2.0
v: SIP/2.0/UDP 192.168.254.157:5060
t: 
f: 
i: fa4451d8-01d6-1cc2-13e4-00e0bb33beb9
CSeq: 18581 REGISTER
Max-Forwards: 70
m: ;dt=544
Expires: 3600
User-Agent: 3Com-SIP-Phone/V8.0.1.3
Authorization: Digest username="sip:2321@192.168.254.12", realm="asterisk", nonce="6c915c33", uri="sip:192.168.254.12", opaque="", algorithm=MD5, response="a89df25f19e4b4598595f919dac9db81"
X-3Com-PhoneInfo: firstRegistration=no; primaryCallP=192.168.254.12; secondaryCallP=0.0.0.0;


--- (12 headers 0 lines) ---
Using latest REGISTER request as basis request
Sending to 192.168.254.157 : 5060 (NAT)


SIP/2.0 100 Trying
Via: SIP/2.0/UDP 192.168.254.157:5060;received=192.168.254.157
From: 
To: 
Call-ID: fa4451d8-01d6-1cc2-13e4-00e0bb33beb9
CSeq: 18581 REGISTER
User-Agent: Asterisk PBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY
Supported: replaces
Contact: 
Content-Length: 0



SIP/2.0 403 Authentication user name does not match account name
Via: SIP/2.0/UDP 192.168.254.157:5060;received=192.168.254.157
From: 
To: ;tag=as3fb867e2
Call-ID: fa4451d8-01d6-1cc2-13e4-00e0bb33beb9
CSeq: 18581 REGISTER
User-Agent: Asterisk PBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY
Supported: replaces
Content-Length: 0


Scheduling destruction of SIP dialog 'fa4451d8-01d6-1cc2-13e4-00e0bb33beb9' in 32000 ms (Method: REGISTER)

Thanks for your input!

share|improve this question

migrated from superuser.com Jan 6 '11 at 12:12

This question came from our site for computer enthusiasts and power users.

    
Bounty added. I wish I had more points to give the bounty, but I'm relatively new here - I'm more active on stackoverflow. Thanks for checking out this question! –  Matt Apr 5 '10 at 14:32

2 Answers 2

This is a workaround that I found that is OK for my situation, but I'd generally consider it a gross hack. I found this gem in chan_sip.c:

/* Always OK if no secret */
if (ast_strlen_zero(secret) && ast_strlen_zero(md5secret))
  return AUTH_SUCCESSFUL;

So, my workaround is to put:

secret=

In the config for each extension. This is OK for me because I'm not worried about someone on my network trying to register for an extension that isn't theirs. In general, however, it's totally insecure because it bypasses any further authentication (including my issue with the username mismatch).

share|improve this answer
    
Not sure if this is ok, but accepting my own answer with nothing better posted. –  Matt Apr 12 '10 at 1:35

From everything that I can find (and I'm sure you've looked to), your setup seems to be correct.

My only suggestion would be to set defaultip=192.168.254.12 which appears to be the only think I can see missing between what I've read as the standard and your sip.conf

Good Luck!

share|improve this answer
    
Thanks, but that won't do it. –  Matt Apr 8 '10 at 20:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.