error: incoming packet message processed, error 401: Unauthorised

[Andrew O]

hi everyone,

i've just installed a coturn server on Ubuntu via the latest debian package.

The server starts up and listens fine, however I'm having trouble connecting to it as a stun/turn client.

The error that I'm getting repeatedly within the logs is:

94: read_client_connection:4457:start

94: read_client_connection: data.buffer=0x7f2208000a0c, data.len=128

94: IPv4. Local relay addr: 100.76.110.84:49155

94: session 130000000000000002: new, realm=<dev.mydomain.com>, username=<kurento>, lifetime=600

94: session 130000000000000002: realm <dev.mydomain.com> user <kurento>: incoming packet ALLOCATE processed, success

94: write_client_connection:4243:start

94: write_client_connection: prepare to write to s 0x7f2208025f10

94: write_client_connection:4263:end

94: read_client_connection:4563:end

94: udp_server_input_handler:620:start

94: read_client_connection:4457:start

94: read_client_connection: data.buffer=0x7f2208000a0c, data.len=60

94: session 130000000000000001: realm <dev.mydomain.com> user <>: incoming packet message processed, error 401: Unauthorised

what I've done as part of setup:

1. i've configured a standard user with a password via turnadmin
2. i can see that network connectivity is correct - there's a single NAT in place between the client and the server
3. I'm starting this as a daemon with the following arguments (via /etc/init.d/coturn):
   DAEMON_ARGS="-c /etc/turnserver.conf -f -o -a -v -r dev.mydomain.com --user=kurento:mypassword --no-stdout-log --external-ip $
   

Any ideas why i'm getting the unauthorised error? 

Note: i've seen the posts about a single unauthorised error being normal, however i'm getting them consistently with no further access.

Note2: IP addresses, domains, and passwords have been changed for the extract above.

thanks in advance

Andrew

[Oleg Moskalenko]

If you getting multiple 401 errors then that means that your client does not provide correct credentials to the server.

Sent from my iPhone

--
You received this message because you are subscribed to the Google Groups "TURN Server (Open-Source project)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to turn-server-project-rfc57...@googlegroups.com.
To post to this group, send email to turn-server-project...@googlegroups.com.
Visit this group at http://groups.google.com/group/turn-server-project-rfc5766-turn-server.
For more options, visit https://groups.google.com/d/optout.

[Jordi Herms]

Andrew did you solve this problem? I'm getting also a lot of 401 errors

thanks

jordi

El divendres, 6 març de 2015 22:49:09 UTC+1, Andrew O va escriure:

[Oleg Moskalenko]

401 errors when the server is still able to authenticate the users is
a normal situation.

401 errors when the server is not authenticating the users means that
the users credentials are set incorrectly or the client is providng
wrong credentials.

[Alvaro Gil]

Hi Oleg,

Can you explain a little more why 401 are a normal situation?

I am noticing 401 responses lack of <username>, I wonder who/what is generating those requests.

Also in my logs I have these two lines, it is ok to say to say that first line bind the client but second deny access for all requests from that client, so that should not be a security issue?

221: session 000000000000000002: realm <myrealm.com> user <>: incoming packet BINDING processed, success

221: session 000000000000000002: realm <myrealm.com> user <>: incoming packet message processed, error 401: Unauthorized

Finally, this line is the one that worries me most...

229: session 000000000000000002: closed (2nd stage), user <myuser> realm <myrealm.com> origin <>, local 172.30.0.219:3478, remote 186.54.16.216:51932, reason: allocation timeout

That line comes after ALLOCATE, CREATE_PERMISSION and REFRESH processed, success.

Can you explain me what does it mean exactly?

Thank you very much for your work and help!

To unsubscribe from this group and stop receiving emails from it, send an email to turn-server-project-rfc5766-turn-server+unsubscribe@googlegroups.com.
To post to this group, send email to turn-server-project-rfc5766-turn-...@googlegroups.com.

[Oleg Moskalenko]

Read about the authentication process in TURN/STUN. 401 message is a
legitimate message during negotiations.

Allocation timeout is an internal message, that means that the client
did not send ALLOCATE request. That can happen when the client is a
STUN client, for example.

Oleg

>> turn-server-project-rfc57...@googlegroups.com.

>> To post to this group, send email to

>> turn-server-project...@googlegroups.com.

>> Visit this group at
>> http://groups.google.com/group/turn-server-project-rfc5766-turn-server.
>> For more options, visit https://groups.google.com/d/optout.
>

> --
> You received this message because you are subscribed to the Google Groups
> "TURN Server (Open-Source project)" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to

> turn-server-project-rfc57...@googlegroups.com.

> To post to this group, send email to

> turn-server-project...@googlegroups.com.
> Visit this group at

> https://groups.google.com/group/turn-server-project-rfc5766-turn-server.

[Alvaro Gil]

Thanks for your insight.

>> turn-server-project-rfc5766-turn-server+unsubscribe@googlegroups.com.

>> To post to this group, send email to

>> turn-server-project-rfc5766-turn-...@googlegroups.com.

>> Visit this group at
>> http://groups.google.com/group/turn-server-project-rfc5766-turn-server.
>> For more options, visit https://groups.google.com/d/optout.
>
> --
> You received this message because you are subscribed to the Google Groups
> "TURN Server (Open-Source project)" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to

> turn-server-project-rfc5766-turn-server+unsubscribe@googlegroups.com.

> To post to this group, send email to

> turn-server-project-rfc5766-turn-...@googlegroups.com.

> Visit this group at
> https://groups.google.com/group/turn-server-project-rfc5766-turn-server.
>
> For more options, visit https://groups.google.com/d/optout.

--

Alvaro

[Ramya Raj]

Hi Alvaro

        Did you solved that? I'm also facing the same problem. 

Thanks

RAMYA

[manikanta nandam]

Hi,

For me initially i am getting unauthenticated error, when i disconnect call and recall again then my call is getting connected and Incoming packet message processed is successful.

Anyone got the solution.

4: handle_udp_packet: New UDP endpoint: local addr 142.93.217.231:3478, remote addr 106.51.36.182:61354

4: session 001000000000000001: realm <someRealm> user <>: incoming packet BINDING processed, success

4: session 001000000000000001: realm <someRealm> user <>: incoming packet message processed, error 401: Unauthorized

4: handle_udp_packet: New UDP endpoint: local addr 142.93.217.231:3478, remote addr 106.51.36.182:53525

4: session 000000000000000001: realm <someRealm> user <>: incoming packet BINDING processed, success

4: session 000000000000000001: realm <someRealm> user <>: incoming packet message processed, error 401: Unauthorized

4: session 001000000000000001: realm <someRealm> user <>: incoming packet BINDING processed, success

4: session 000000000000000001: realm <someRealm> user <>: incoming packet BINDING processed, success

4: IPv4. Local relay addr: 142.93.217.231:54581

4: session 000000000000000001: new, realm=<someRealm>, username=<test>, lifetime=600

4: session 000000000000000001: realm <someRealm> user <test>: incoming packet ALLOCATE processed, success

4: IPv4. Local relay addr: 142.93.217.231:60565

4: session 001000000000000001: new, realm=<someRealm>, username=<test>, lifetime=600

4: session 001000000000000001: realm <someRealm> user <test>: incoming packet ALLOCATE processed, success

4: session 000000000000000001: realm <someRealm> user <test>: incoming packet ALLOCATE processed, success

4: session 001000000000000001: realm <someRealm> user <test>: incoming packet ALLOCATE processed, success

14: session 000000000000000001: realm <someRealm> user <test>: incoming packet BINDING processed, success