| 00:17.29 | tm1000 | coreyfarrell: ! lol |
| 00:17.36 | tm1000 | Thanks guys! |
| 00:49.47 | *** join/#asterisk-dev tuxd00d (~tuxd00d@wsip-24-248-81-186.ph.ph.cox.net) |
| 02:46.23 | *** join/#asterisk-dev Juggie (~Juggie@unaffiliated/juggie) |
| 04:23.43 | *** join/#asterisk-dev tuxd00d (~tuxd00d@ip68-106-11-138.ph.ph.cox.net) |
| 06:33.02 | *** join/#asterisk-dev tsearle (~tsearle@37.19.10.33) |
| 06:33.02 | *** mode/#asterisk-dev [+o tsearle] by ChanServ |
| 06:54.52 | *** join/#asterisk-dev CELYA_ (~Thunderbi@LStLambert-657-1-90-73.w80-13.abo.wanadoo.fr) |
| 07:12.19 | *** join/#asterisk-dev jkroon (~jkroon@uls-154-73-35-201.wall.uls.co.za) |
| 07:15.58 | *** join/#asterisk-dev tzafrir (~tzafrir@local.xorcom.com) |
| 07:15.58 | *** mode/#asterisk-dev [+o tzafrir] by ChanServ |
| 07:36.35 | *** join/#asterisk-dev hehol (~hehol@gatekeeper.loca.net) |
| 07:37.49 | *** join/#asterisk-dev pchero_work (~pchero@109.70.54.56) |
| 08:25.11 | stefan27 | My understanding of default SIP authentication is that in such a transaction the client responds to challenge via a response field essentially (simplified) calculated as MD5(secret+<some public string>). The public string is public to anyone who can view the SIP messages, but it may vary from transaction to transaction (it may contain server and client nonce). Now the response is a 128 |
| 08:25.11 | stefan27 | bit value, and an attacker who can inspect the SIP message transaction can use brute force to find the (probably unique) secret string of length 8-14 chars that produces the given md5-response, but he could not do that if the secret itself had much greater entropy than 128 bits, say 30 alphanumerical chars? |
| 08:25.31 | stefan27 | My question then is why does the common recommendation for password seems to be 8-14 random chars rather than say 32? |
| 08:25.52 | stefan27 | I'm aware md5 is old and one should ideally use an encrypted transport |
| 08:29.11 | stefan27 | I wonder whether long passwords is a feasible work-around when one does not have tls or restrict-by-src-ip mechanisms |
| 08:33.10 | stefan27 | On second thought this might be more #asterisk |
| 08:33.59 | tsearle | that sounds more like a sip-rfc question, heh |
| 08:34.17 | stefan27 | it relates to best practices of using asterisk though |
| 08:34.22 | tsearle | in latest pjsips there are auth-token mechanisms |
| 08:34.46 | tsearle | so you can do auth based on shared secret |
| 08:35.31 | stefan27 | modern systems typically support TLS also, I'm looking at some old chan_sip systems talking to very old physical PBXes |
| 08:36.38 | stefan27 | I'm curious what's the best I can do without changing architecture or setup |
| 08:37.15 | stefan27 | probably I can insert stuff in the middle |
| 08:51.35 | tsearle | well I've used ephemeral authentication of kamailio with resonable success |
| 08:51.52 | tsearle | then you have time limited login/passwords |
| 08:52.30 | tsearle | you could have chan_sip integrate with such a system by using realtime and have a batch updating the credentials in the database periodically |
| 08:53.33 | tsearle | https://kamailio.org/docs/modules/4.2.x/modules/auth_ephemeral.html |
| 08:56.18 | tsearle | from an old equipment standpoint it's still the standard digest auth, it's just that their login/pass is continously changing |
| 08:56.38 | tsearle | so if you have a management system that can keep updating login/pass this should work |
| 09:17.05 | stefan27 | right, that might be feasible - thanks for the tips |
| 14:08.00 | *** join/#asterisk-dev bford (d8cff501@gateway/web/freenode/ip.216.207.245.1) |
| 14:08.00 | *** mode/#asterisk-dev [+o bford] by ChanServ |
| 14:10.51 | *** join/#asterisk-dev kharwell (kharwell@nat/digium/x-bwxililqodxkybtp) |
| 14:10.51 | *** mode/#asterisk-dev [+o kharwell] by ChanServ |
| 14:15.44 | *** join/#asterisk-dev rmudgett (rmudgett@nat/digium/x-mbtiyhjupiwexhgl) |
| 14:15.44 | *** mode/#asterisk-dev [+o rmudgett] by ChanServ |
| 15:15.26 | *** join/#asterisk-dev cresl1n (~Adium@asterisk/libpri-and-libss7-expert/Cresl1n) |
| 15:15.26 | *** mode/#asterisk-dev [+o cresl1n] by ChanServ |
| 16:58.01 | *** join/#asterisk-dev cresl1n (~Adium@asterisk/libpri-and-libss7-expert/Cresl1n) |
| 16:58.01 | *** mode/#asterisk-dev [+o cresl1n] by ChanServ |
| 18:35.17 | *** join/#asterisk-dev jkroon (~jkroon@165.16.204.165) |
| 19:39.14 | *** join/#asterisk-dev DivideBy0 (~DivideBy0@unaffiliated/divideby0x0) |
| 19:39.14 | *** mode/#asterisk-dev [+o DivideBy0] by ChanServ |
| 19:58.19 | *** join/#asterisk-dev NirS (~nirs@87.69.215.252) |
| 19:58.29 | NirS | Good afternoon everybody |
| 20:29.34 | NirS | wab7bk |
| 21:13.04 | *** join/#asterisk-dev tzafrir (~tzafrir@212.29.194.37) |
| 21:13.04 | *** mode/#asterisk-dev [+o tzafrir] by ChanServ |
| 23:26.20 | *** part/#asterisk-dev kharwell (kharwell@nat/digium/x-bwxililqodxkybtp) |