IPSec vs. TLS/SSL

IPSec - IPSeic is Security protocol, run at IP Layer, suit consist of Authentication Header (AH) and Encapsulation Security Payload (ESP). IPSec is common use with Site - to - Site configuration.

TLS/SSL - Transport Layer Secure, Socket Secure Layer, run at transport layer, application aware ssl support.

TLS/SSL has advantange than IPSec following topics below:
- Most application e.g. SIP Client, Web browser already supported TLS/SSL. It's easier than IPSec which require complexity Security Association configuration. Although, there is IPv6 , supported IPsec, but it's quite so long time that all users + applications will use IPv6 with IPSec.

- TLS/SSL doesn't have problem with NAT, but IPSec has.

- All ISPs (router) allow SSL port (e.g. 443 ) because there are lots of users use this port for doing the bank statements etc. , but some ISP don't allow for IPSec traffic unless you pay more for enterprise solution.

DW CS3 & Vista

Today, I edit the web page for a conference.
I try to edit with notepad or editplus but it doesn't support Unicode. That mean, I cannot save French language in the file. So, I look for another html tool that's Dreamweaver!!

After I install to install Dreamweaver (DW) CS3. After it finished, I found 2 problems.
1) file.mxt does not support design view in CS3, you need to add extension in DW for 3 files
- C:\Users\[username]\AppData\Roaming\Adobe\Dreamweaver 9\Configuration\Extensions.txt
- C:\Program Files\Adobe\Adobe Dreamweaver CS3\configuration\Extensions.txt
- C:\Program Files\Adobe\Adobe Dreamweaver CS3\Configuration\DocumentTypes MMDocumentTypes.xml

Reference: http://kb.adobe.com/selfservice/viewContent.do?externalId=tn_16410

2) if you use M$ Vista, please run notepad.exe with administrator right, and open the file from notepad. Don't forget to use funtion wordwarp to see all text.

Restart DW CS3 and get it!

OpenIMS KDE #2

Start Windows Manager
# startx

This will start classical X-windows manager

If you'd like to start KDE Windows Manager
/etc/init.d/xdm start

OpenIMS KDE

Problem:
OpenIMS KDE image file in "http://www.openimscore.org/vm" is too large
for open in VMware player 2.0?

Solution:
There is no problem in VMware 1.0.3, but in the VMware verion 2.5.0, there is a problem with this message:

VMware workstation cannot open one of the virtual disks needed by this VM because it is larger than the maximum file size

You have to do this =>

Adding diskLib.sparseMaxFileSizeCheck= "FALSE"' to OpenIMS.vmx file.

And get it!!

SIP Security

SIP Security define mechanism for secure SIP in RFC 3261 following topics below:

- HTTP Digest => Easiest, still vulnerability
- S/MIME => Using PKI, authen on SIP header, encrypt on SDP, use X. 509 Certificate to vertify public key
- Open PGP => Same as S/MIME but Open PGP must be trust "public key" before using. (Deprecated)
- IPSec => Use PKI that work in IP layer, Network aware, complex setup for Key exchange and Security Association setup
- TLS/SSL => Use PKI that work in Transport layer, Software awareness only,easier than IPSec

My Asterisk Testbeded

Today, I had setup asterisk testbeded at ENSEEIHT.

There are 3 computers.

Linux: Ubuntu 8.04
SIP Client: LinPhone (recommend) , Ekiga (there is sound problem)
SIP Client: X-Lite (Windows)
SIP Server: Asterisk

Asterisk acts as SIP proxy+registra server.
Linphone acts as SIP phone client.

Step by step:
1. Just install it by using synaptic => Asterisk & LinPhone

2. Modify sip.conf and extension.conf following below:

/etc/asterisk/sip.conf

 
[general]
context=default
bindport=5060
bindaddr=0.0.0.0
srvlookup=yes

[100]                         ; this is the sip user name
secret=100                 ; this is the password
type=friend







host=dynamic            ;anyone can connect







context=from-internal







qualify=yes







port=5060







dtmfmode=rfc2833















[200]







secret=200







type=friend







host=dynamic







context=from-internal







qualify=yes







port=5060







dtmfmode=rfc2833















[300]







secret=300







type=friend







host=dynamic







context=from-internal







qualify=yes







port=5060







dtmfmode=rfc2833

/etc/asterisk/extension.conf

[from-internal]







exten => 100,1,Dial(SIP/100)







exten => 200,1,Dial(SIP/200)







exten => 300,1,Dial(SIP/300)

3. Start asterisk service => #/etc/init.d/asterisk start [it normally starts after you install by synaptic]
4. Connect to asterisk terminal => #asterisk -r
5. You will have SIP console => *CLI>

6. CLI> sip show peers
// this command for check the sip status

7. CLI> sip show users
// this command show users

8. Start linphone (SIP Phone client), there is error message about port because linphone also use UDP: port 5060 same as asterisk service. So, you should change port of linphone. However, you can use #gconf-edit command for changing "Ekiga" listening port. In my case, I use UDP: port 5100

9. Go to client machine and start linphone (SIP Phone client). Client machine will not have port collision since it does not run asterisk server.

10. Register user with asterisk (SIP server). Account & User name is the same that specified in sip.conf.
eg. there are

Account Name=100,user=100, pass=100
Account Name=200,user=200, pass=200
Account Name=300,user=300,pass=300

SIP URI looks like => 100@asteriskIP.fr

11. After you registed with asterisk, please check the status in asterisk server with
*CLI> sip show peers
The status should label with "O.K."

12. You can call any one who already registered in asterisk server.

3G-IMS Tutorial

Good tutorials:

• 3G-IMS Tutorial
• Network Security Slides
• Distributed Computing (Java)

By Professor : Jae-Oh, Lee