RadSec ... anyone?
Has anyone managed to test the radsec work in the "master" branch? After all of the requests for it, there has been a surprising lack of response to it's public release. Alan DeKok.
On May 30, 2011, at 11:26 AM, Brivaldo Junior wrote:
Has anyone managed to test the radsec work in the "master" branch?
Alan, I like to know and forward your message to our EDUROAM project here.
Indeed, Alan Buxley et al, seemed to be the ones most interested in it for ORPS to NRPS stuff. You're a member of the JANET 802.1X SIG, why not poke them for an invite? -Arran Arran Cudbard-Bell RM-RF Limited - Security consultation and contracting VoIP: +1 916-436-1352 Cell: +44 7854041841
Hi,
Indeed, Alan Buxley et al, seemed to be the ones most interested in it for ORPS to NRPS stuff. You're a member of the JANET 802.1X SIG, why not poke them for an invite?
dont worry Arran, I'm aware of the recent update to support RADSEC but have been busy (indeed, pretty much out of office for past couple of weeks) - looking forward to running the new engine and getting packets from a FR running RADSEC :-) alan
Alan Buxey <A.L.M.Buxey@lboro.ac.uk> wrote:
Indeed, Alan Buxley et al, seemed to be the ones most interested in it for ORPS to NRPS stuff. You're a member of the JANET 802.1X SIG, why not poke them for an invite?
dont worry Arran, I'm aware of the recent update to support RADSEC but have been busy (indeed, pretty much out of office for past couple of weeks) - looking forward to running the new engine and getting packets from a FR running RADSEC :-)
Apparently by moving to RADSEC we will have to embrace SMNPesque traffic wrapped in XML, wrapped in SOAP, wrapped in HTTP, aka IF-MAP... I also suspect I have to fill out a stack of parchment with a quill and ship the permission slips via the Mayflower to get a signed cert for my organisation. Happy to be proven wrong though :) Cheers -- Alexander Clouter .sigmonster says: To the landlord belongs the doorknobs.
hi, with FR 3.0rc1 (well, current GIT) there is an error for anyone starting from scratch with bare config and 'radiusd -X' - the system kills the child because its taking too long to generate the DH/cert etc Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time ...................................+.........................................+....................................+...................................................................+.....................................+...................................................................+..........................................................+...+............................................................+...........+.................+.................................................................................................+.................................+....................................................................+............................................+.................+...............................................................+............+..............+.............................Child PID 24723 is taking too much time: forcing failure and killing child. failed to read from child output rlm_eap_tls: Failed initializing SSL context rlm_eap: Failed to initialize type tls /etc/raddb/modules/eap[17]: Instantiation failed for module "eap" /etc/raddb/sites-enabled/default[292]: Failed to load module "eap". /etc/raddb/sites-enabled/default[234]: Errors parsing authenticate section. [root@server freeradius-server]# ......................+................................................+.........+............+................................................................................+........+..+.....................+..............................+.......................+....+.....................................................................................................................+..............................................+........................................................................+...........................................+............................+...................................................+.............+..................................................+...........................................................................+..............................................................+........+.....................................................................+...............................+.......+....+..............+..+.[root@server free[root@boppit[root@[root@server freeradius-server]# ...................................................+..................................................+.....................+...............................................................................................+...............................................................................+.....................+.....................................................................+.............................................+.................+...................+..................................+......................................+........................................+.......................+.......................................+...........................+....................................................................+........+................................................+.......................................................................+.....................+.....+...............................+..........................................................................................................................+.+...............................+.....+...............................................................................................................................................................................................................................................................+...............+...................................................................+...+......................+....+.......................................................+................................................................................................+.......................................................................................+.......+............................................................................................................+...............................................+............................................+..+...............................................................................................+......................................+........................................................................+..+........................................+................................................+............+....................+........+.............+.....................+.............+.....................................+................................................................+................................................+...........................................................................................................+................................+................+.......................................................+...........................................................................................................+.......................................................+.......................................................................................................................................................................+.....................................+.+..............................................+........................+..+.........................+.........................................................................................................................................................................+..+......................................................................................................................................+..+......+..................+.....................+......+..............................................+....................................................+..................................................................................................+...................................................................................................................+.............+..................................+..................................+.............+.......................+...................................+.........................+..+..........+......................................................+.............................................................................................................................+.....+....................................+.............+.....................+.....................+................................+..............................................+......................................................................+..+...........................+........................................................................+.........................................................+......................+................................................................+.........................+.+.........+............+..................................................+...............................................................................................................................................................................................................+......................................................................................................+...............+...............................................................................................+..............................+.....................................................................................+.........................................................................................+.....+................................+...................+.................+...................................................+........................................................................................................................................................................................................+...+.................+..........+..........+....................................+....................+........................................................+..........................................................................................+........................+......................................................................+................+..........................................+......................................+....+.................+.+.................................+.......................+..................................+.........+..........................................+....................................................+.+............................................................+.+..................................+..........................+......................................................+............................................................................+...................+...........................................................................................................................+.......+.+.....+...+.............................+................+................++*++*++* unable to write 'random state'
Alan Buxey wrote:
with FR 3.0rc1 (well, current GIT) there is an error for anyone starting from scratch with bare config and 'radiusd -X' - the system kills the child because its taking too long to generate the DH/cert etc
Hmm... the "make install" process should probably make the fake certificates. The RPM scripts will then need to be modified to not package those files. Alan DeKok.
On 06/07/2011 12:36 PM, Alan DeKok wrote:
Alan Buxey wrote:
with FR 3.0rc1 (well, current GIT) there is an error for anyone starting from scratch with bare config and 'radiusd -X' - the system kills the child because its taking too long to generate the DH/cert etc
Hmm... the "make install" process should probably make the fake certificates. The RPM scripts will then need to be modified to not package those files.
FWIW in our RPM's we generate the certs during the RPM install phase rather than "upon first use" method used by radiusd -X, thus there is no timing issue. -- John Dennis <jdennis@redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/
hi, gmake[4]: Entering directory `/usr/src/freeradius-server/src/main' /usr/src/freeradius-server/libtool --mode=compile gcc -g -O2 -Wall -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/usr/src/freeradius-server/src -DHOSTINFO=\"i686-pc-linux-gnu\" -DRADIUSD_VERSION=\"3.0.0\" -DOPENSSL_NO_KRB5 -c process.c gcc -g -O2 -Wall -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/usr/src/freeradius-server/src -DHOSTINFO=\"i686-pc-linux-gnu\" -DRADIUSD_VERSION=\"3.0.0\" -DOPENSSL_NO_KRB5 -c process.c -fPIC -DPIC -o .libs/process.o process.c: In function 'request_receive': process.c:1276: error: too few arguments to function 'request_insert' gmake[4]: *** [process.lo] Error 1 the line is return request_insert(listener, packet, client, fun); alan
hi, just noticed that when using RADSEC, the usual 'radiusd -X' is no longer valid /etc/raddb/sites-enabled/tls[7]: Threading must be enabled for TLS sockets to function properly. /etc/raddb/sites-enabled/tls[7]: You probably need to do 'radiusd -fxx -l stdout' for debugging doing as the debug says works fine, of course :-) alan
Alan Buxey wrote:
just noticed that when using RADSEC, the usual 'radiusd -X' is no longer valid
/etc/raddb/sites-enabled/tls[7]: Threading must be enabled for TLS sockets to function properly. /etc/raddb/sites-enabled/tls[7]: You probably need to do 'radiusd -fxx -l stdout' for debugging
doing as the debug says works fine, of course :-)
I'll see if I can find a way to fix that so that "-X" means "threaded" if radsec is enabled. Alan DeKok.
participants (6)
-
Alan Buxey -
Alan DeKok -
Alexander Clouter -
Arran Cudbard-Bell -
Brivaldo Junior -
John Dennis