<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
new conf wrote:
<blockquote
cite="mid:7bdef0530904021303pcd981a8u8c0e25c0e3980e2f@mail.gmail.com"
type="cite"><b>thank you Stefan, </b><br>
<br>
<i>Use that path as<br>
option to --with-sysconf-dir=</i><br>
<br>
that means, when compiling the radius at installation?<br>
<br>
<b>to Ivan Kalik:</b><br>
<i><br>
Best advice - don't do that!!! Certificates are *much* safer on a server<br>
than on a USB device - what are you going to do if someone walks off<br>
with it?</i><br>
<br>
:) yesss I'm with your advice, but if the usb device is a smartcard, it
becoms other thing.. the problem is that I must understand what are the
inpout/output of this device to reach it and extract the information..<br>
ouuf, lonng road!! :(<br>
<br>
</blockquote>
You can't just mount a smartcard as a mass storage device and access
key data, that would defeat the entire purpose of a smartcard. Managing
keys on a smartcard is one of the problems PKCS11 was developed to
address (I believe you'll also need a driver specific to the smartcard
that PKCS11 will load, your smartcard vendor can provide this for you).
OpenSSL has some type of support for PKCS11, exactly what I'm not sure,
but that's the direction you want to head, learn how to configure
OpenSSL for PKCS11. Armed with that information you'll be able to
ascertain if the current OpenSSL support in FreeRADIUS is sufficient to
pass that configuration information down to OpenSSL when it initializes
(this might very well require a code change).<br>
<pre class="moz-signature" cols="72">--
John Dennis <a class="moz-txt-link-rfc2396E" href="mailto:jdennis@redhat.com"><jdennis@redhat.com></a>
Looking to carve out IT costs?
<a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a>
</pre>
</body>
</html>