August 2005 - Freeradius-Users - lists.freeradius.org

Re: urgent help needed!! freeradius peap enterasys ap 3000 xp certificate failure?
by Jamie Crawford 16 Aug '05

16 Aug '05

Thanks for your response. I downloaded my cacert.pem and imported it into my xp client as a trusted root authority and that did not help. Here are the steps I took to create my certs. Remember I am trying to use "PEAP". Thanks!!!! Here's what I did to create the certs. rhel as 4.0 freeradius 1.0.4 On my freeradius server I went to: /usr/share/ssl/openssl.cnf changed "dir = ./productionCA" changed "countryName_default = US" changed "stateOrProviceName_default = Missouri" changed "localityName_default = Warrensburg" changed "0.organizationName_default = CMSU" changed "organizationalUnitName_default = Information Services" changed "commonName_default = Wireless" changed "emailAddress_default = email(a)email.edu" changed "challengePassword_default = password" I saved the file. Then I went into /usr/share/ssl/misc/CA and changed "CATOP=./productionCA" Then I went back into the usr/share/ssl directory and ran /usr/share/ssl/misc/CA -newca Entered my passphrase "password" Verified "password" Hit the default of "US" for Country name Hit the default of "MIssouri" for state name Hit the default of "Warrensburg" for state name Hit the default of "CMSU" for organization name Hit the defaut of "Information Services" for organizational unit name Hit the default of "WIRELESS" for the common name Hit the default of "email(a)email.edu" for the email address Now I have my new root certificate (cacert.pem) and private key (cakey.pem). In my /usr/share/ssl/productionCA directory I have" -rw-r--r-- 1 root root 1346 Aug 16 14:54 cacert.pem drwxr-xr-x 2 root root 4096 Aug 16 14:52 certs drwxr-xr-x 2 root root 4096 Aug 16 14:52 crl -rw-r--r-- 1 root root 0 Aug 16 14:52 index.txt drwxr-xr-x 2 root root 4096 Aug 16 14:52 newcerts drwxr-xr-x 2 root root 4096 Aug 16 14:52 private -rw-r--r-- 1 root root 3 Aug 16 14:52 serial In the "private" directory I have: -rw-r--r-- 1 root root 963 Aug 16 14:54 cakey.pem Now I create my server certificate, but first I must create the "xpextensions" file because WindowsXP expects certain attributes in server and client certificates. Contents of "xpextensions" [ xpserver_ext ] extendedKeyUsage = 1.3.6.1.5.5.7.3.1 Now I run: openssl req -new -keyout server_key.pem -out server_req.pem -days 730 -config openssl.cnf This asks for the PEM pass phrase: So I enter "password" I verify "password" Hit the default of "US" for Country name Hit the default of "MIssouri" for state name Hit the default of "Warrensburg" for state name Hit the default of "CMSU" for organization name Hit the defaut of "Information Services" for organizational unit name Enter in "server.cmsu.edu" for the common name Hit the default of "email(a)email.edu" for the email address It asks for a "challenge password" so I type in "password" It asks for a "optional company name" and I hit enter for nothing. This creates the files "server_req.pem" which contains the actual request-an unsigned certificate and "server_key.pem" the private key. Now I will use the ca key to sign the request. openssl ca -config openssl.cnf -policy_anything -out server_cert.pem -extensions xpserver_ext -extfile xpextensions -infiles server_req.pem This asks for the pass phrase for "/productionCA/private/cakey.pem" I type in "password" Check that the request matches the signature Signature ok Certificate Details: Serial Number: 1 (0x1) Validity Not Before: Aug 16 20:09:23 2005 GMT Not After : Aug 16 20:09:23 2006 GMT Subject: countryName = US stateOrProvinceName = Missouri localityName = Warrensburg organizationName = CMSU organizationalUnitName = Information Services commonName = server.cmsu.edu emailAddress = email(a)email.edu X509v3 extensions: X509v3 Extended Key Usage: TLS Web Server Authentication Certificate is to be certified until Aug 16 20:09:23 2006 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated This command reads the file server_req.pem and after prompting for my CA key's passphrase, saves a signed version of it plus its corresponding private key to the file server_cert.pem. Now I opend up my signed certificate "server_cert.pem" and delete everything before the line --------BEGIN CERTIFICATE-------- Now I concatenate it and my key into a single file by typing: cat server_key.pem server_cert.pem > server_keycert.pem Next I copy the server_keycert.pem file and cacert.pem file over to my certs directory. Whie in this directory I run these two commands to create the "dh" file and "random" file. openssl dhparam -check -text -5 512 -out dh dd if=/dev/urandom of=random count=2 my eap.conf file tls { private_key_password = password private_key_file = ${raddbdir}/certs/server_keycert.pem certificate_file = ${raddbdir}/certs/server_keycert.pem # Trusted Root CA list CA_file = ${raddbdir}/certs/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random >>> Zoltan Ori <z.ori(a)morehead-st.edu> 08/16/05 1:25 PM >>> On Tuesday 16 August 2005 10:28, Jamie Crawford wrote: > Everything seems to work great until > the certificate negotiation, then it blows chunks. > Bad or wrong certificates. Server and supplicant need a copy of the same trusted root certificate. Zoltan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Can't install experimental-modules and disable-shared
by freeradius＠zoftdev.com 16 Aug '05

16 Aug '05

Hi all I can't install freeradius by ./configure \ --with-openssl-includes=/usr/local/openssl/include \ --with-openssl-libraries=/usr/local/openssl/lib \ --with-experimental-modules \ --disable-shared make make install how to install freeradius experimental-modules (use sqlcounter) adn disable-shared (use eap-peap)? thanks you.

2 1

urgent help needed!! freeradius peap enterasys ap 3000 xp certificate failure?
by Jamie Crawford 16 Aug '05

16 Aug '05

Hello, Trying to setup freeradius to use peap authentication using xp clients and using enterasys 3000 access points. Everything seems to work great until the certificate negotiation, then it blows chunks. I've followed the how to's on tlpd.org and "securing wlan's with wpa and freeradius" from the linux journal articles. Attached is the output of radiusd -X -A. Any help is appreciated!!!! Thanks

2 1

PEAP Configuration
by Juan Daniel Moreno 16 Aug '05

16 Aug '05

Hello, I am trying to configure PEAP protocol with my freeRadius 1.0.4. I have already configured PAP, CHAP, MS-CHAP v1, MS-CHAP v2, EAP-md5, LEAP but I really don't understand the documentations about it. Can anybody help me? Thanks a lot. JUAN DANIEL MORENO

2 1

Require NAS dependant radius return attributes
by Ben Thompson 16 Aug '05

16 Aug '05

Hi I have a problem which I want to find out if I can solve using FreeRADIUS. I am setting up an 802.1x based network where I want to use RADIUS assigned VLAN's. I have succesfully tested this with Cisco wireless access point's and FreeRADIUS 1.0.1 using a users file like this :- >>>snip>>> test3999 NT-Password := "35C8397B2320E568467904861A2AF40F" Tunnel-Private-Group-ID:1 = 3999, Fall-Through = Yes test4025 NT-Password := "35C8397B2320E568467904861A2AF40F" Tunnel-Private-Group-ID:1 = 4025, Fall-Through = Yes DEFAULT Tunnel-Type:1 = VLAN, Tunnel-Medium-Type:1 = IEEE-802 >>>snip>>> The trouble is I need to assign different VLAN's to users depending which access point they connect from. What I would like to know is if it is possible to use Huntgroups to look up the VLAN id based on something like the IP address of the access point? Example: Let's say I have two access points called AP1 and AP2. If a user connects to AP1, I want the RADIUS server to look up from somewhere what is the correct VLAN to assign to people using AP1 and return the correct attributes to suit. If the same user connects to AP2 I want the VLAN id to be the correct one for AP2 which may be different to AP1. Any advice would be appreciated, Ben Thompson

2 1

radius_pam integraion with rsa securid technology
by mukherji rakesh 16 Aug '05

16 Aug '05

Dear All I am urgently looking for your help to integrate pam_radius module with my RSA securid server.I am implementing rsa two factor authentication technolgy for my client but getting trouble while installing in linux 9 as rsa has no client software for this upgraded version of Linux.They recomended to use radius_pam module but I am not able to configure it.I have enabled radius server in my rsa server but clients like linux9 is not able to talk with it.I have no idea of the things... So please help me regarding the same. Thanks and regards, Rakesh Mukherjee From:India ( english only ) --------------------------------- Check out Yahoo! India Rakhi Special for Rakhi shopping, contests and lots more. http://in.promos.yahoo.com/rakhi/index.html

1 0

Freeradius with 64-bit Suse Linux 9.3
by dantem.werbung＠web.de 16 Aug '05

16 Aug '05

I tried to install freeradius-1.0.2-5.2.x86_64 at a Suse Linux 9.3 64-bit server, but the radtest doesn't run. I started the radtest and NOTHING happend. Then I installed freeradius-1.0.2-5.2.i586 at a Suse Linux 9.3 32-bit server and it runs without any problems. I also tried to install Freeradius 1.0.4 at the 64-bit server, but it doesn't work as well. I want to install the server to connect from an access-point (SMG SMC2870W) with an easy account manager to see, who connected how long to the internet. Can you please help me to install freeradius at the 64-bit server with an easy manager (e.g. a web-based manager like DialUp Admin). Thanks Daniel _________________________________________________________________________ Mit der Gruppen-SMS von WEB.DE FreeMail können Sie eine SMS an alle Freunde gleichzeitig schicken: http://freemail.web.de/features/?mc=021179

1 0

pam-radius module installation help
by mukherji rakesh 16 Aug '05

16 Aug '05

Dear all, can any one please provide me the guide / steps to install pam_radius module to integrate with RSA Securid technology? I am installing this to implement with my RSA/ACE server but could not do.My linux 9 client can not authenmticate with my RSA server where I have enabled radius server. I am looking for your help. Regards, Rakesh Mukherjee Send instant messages to your online friends http://in.messenger.yahoo.com

1 0

SIGHUP bug to radiusd
by Craig Hancock 15 Aug '05

15 Aug '05

Hello all I am not sure if this is the appropriate list or I should be posting this to devel, but I think there is a bug in freeradius. Last week I discovered when running the command /etc/init.d/radiusd reload the radiusd process stoped accepting request, but still ran and nothing is reported in the logs as to an error or a problem. The init script reload option from what I can tell does a SIGHUP of the running radiusd process. After running strace on the process id I attempted to test my radius server by stopping and starting the process and then doing a reload randomly. That seemed to work ok so next test was to stop the process and run it again, but then attempt to authenticate to it a few times. Each authentication request was successful so while the process was running I attempted to run the init script with the reload command and what outputted to my screen was 'Segementation Fault errors'. I haven't had the oppurtunity to dig down and look at what its Seg Faulting on, but wanted to see if anyone else has experienced this problem. My testing was done on the prebuilt rpm package that is supplied by redhat version 1.0.1-2.RHEL4 as well as the stable version of freeradius version 1.0.4. Our radius server in question provides AAA service for VPN, and wireless users. Please let me know if I need to provide any further information. If this is not the appropriate list I apologize -- ****************************************************** Craig T. Hancock Systems Engineer, Infrastructure Services Office of Information Technology University of Notre Dame ******************************************************

2 1

rlm_smb & mschap
by Craig Hancock 15 Aug '05

15 Aug '05

Can rlm_smb be used to authenticate PEAP 8021X sessions? If so in your configuration file do you have to comment out the mschap section of radiusd.conf file? Also in the eap.conf file do you have to change the section peap section for default_eap_type = mschap to smb? Thanks -- ****************************************************** Craig T. Hancock Systems Engineer, Infrastructure Services Office of Information Technology University of Notre Dame ******************************************************

2 1