$Revision: 1.4 $
$Date: 2007/11/28 21:31:41 $

# Parameters

## `auth_extra_checks` (flags)

If set to a non-zero value, extra authentication checks will be enabled. The default value is 0 (old behaviour, no extra checks).

Without the extra checks the nonce will protect only against expired values. Some reply attacks are still possible in the expire "window". A possible workarround is to always force qop authentification and always check the uri from the authorization header, but this would not work if an upstream proxy rewrites the uri and it will also not work with a lot of UA implementations.

In this case the nonce value will be used only to hold the expire time (see `nonce_expire`) and an MD5 over it and some secret (the MD5 is used to make sure that nobody tampers with the nonce expire time).

When the extra checks are enabled, the nonce will include and extra MD5 over the selected part/parts of the message (see below) and some other secret. This will be used to check if the selected part of the message is the same when an UA tries to reuse the nonce, thus protecting or severely limiting reply attacks.

The possible flag values for `auth_extra_checks` are: 1 for checking if the message uri changed (uses the whole uri), 2 for checking the callid, 4 for the from tag and 8 for the source ip (see nonce.h). For example setting `auth_extra_checks` to 6 would check if the callid or the from tag changed from the message for which the original nonce was generated (this would allow nonce reuse only within the same dialog and for the expire time). Note that enabling the extra checks will limit nonce caching by UAs, requiring extra challenges and roundtrips, but will provide much better protection.

When the `secret` parameter is set and the extra checks are enabled, the first half of the `secret` will be used for the expire time MD5 and the other half for the extra checks MD5, so make sure you have a long secret (32 chars or longer are recommended).

### Setting the `auth_extra_checks` module parameter

    modparam("auth", "auth_extra_checks", 14) # callid | fromtag | srcip

## `secret` (string)

Default value is randomly generated string.

### Setting secret module parameter

    modparam("auth", "secret", "johndoessecretphrase")

## `nonce_expire` (integer)

Nonces have limited lifetime. After a given period of time nonces will be considered invalid. This is to protect replay attacks. Credentials containing a stale nonce will be not authorized, but the user agent will be challenged again. This time the challenge will contain `stale` parameter which will indicate to the client that it doesn't have to disturb user by asking for username and password, it can recalculate credentials using existing username and password.

The value is in seconds and default value is 300 seconds.

### nonce_expire example

    modparam("auth", "nonce_expire", 600)   # Set nonce_expire to 600s

## `rpid_prefix` (string)

Prefix to be added to Remote-Party-ID header field just before the URI returned from either radius or database.

Default value is "" (empty string).

### rpid_prefix

    modparam("auth", "rpid_prefix", "Whatever <")

## `rpid_suffix` (string)

Suffix to be added to Remote-Party-ID header field after the URI returned from either radius or database.

Default value is ";party=calling;id-type=subscriber;screen=yes".

### rpid_suffix

    modparam("auth", "rpid_suffix", "@1.2.3.4>")