- Freeradius-Users - lists.freeradius.org

Problem with rlm_realm
by kachin Agarwal 01 Dec '09

01 Dec '09

Hi, I M using freeradius-server 2.1.7. The authentication rate i m getting is just 4 or 5. when i put a timestamp in each of the modules, i found out that the module "rlm_realm" is called about 12 times in each authentication. That is in each handshake between the mobile unit and the radius server the rlm_realm is called many a times. how can i minimize this so that it is called only once. bcoz i m not using any realms. Thanks & Regards, Kachin The INTERNET now has a personality. YOURS! See your Yahoo! Homepage. http://in.yahoo.com/

2 1

Confused by id
by John Gardner 01 Dec '09

01 Dec '09

I'm trying to successfully use FreeRADIUS to help centrally authenticate some linux servers. I'm storing the credentials in a postgres db but I'm confused by the 'id' in the radcheck database. In the SQL HOWTO, they show the id as (mysql); +----+----------------+----------------+------------------+------+ | id | UserName | Attribute | Value | Op | +----+----------------+----------------+------------------+------+ | 1 | fredf | Password | wilma | == | | 2 | barney | Password | betty | == | | 2 | dialrouter | Password | dialup | == | +----+----------------+----------------+------------------+------+ Where as mine (postgres) looks like; id | username | attribute | op | value ----+---------------+---------------+----+------------ 1 | john.gardner | User-Password | := | xxxxxxxxxx 2 | joe.bloggs | User-Password | := | xxxxxxxxxx 3 | john.doe | User-Password | := | xxxxxxxxxx Is this really meant to be 1,2,2 or should this be 1,2,3 sequentially? i.e. as in a incrementing key? Thanks in advance John This email and any files transmitted with it are intended solely for the named recipient and may contain sensitive, confidential or protectively marked material up to the central government classification of ?RESTRICTED" which must be handled accordingly. If you have received this e-mail in error, please immediately notify the sender by e-mail and delete from your system, unless you are the named recipient (or authorised to receive it for the recipient) you are not permitted to copy, use, store, publish, disseminate or disclose it to anyone else. E-mail transmission cannot be guaranteed to be secure or error-free as it could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses and therefore the Council accept no liability for any such errors or omissions. Unless explicitly stated otherwise views or opinions expressed in this email are solely those of the author and do not necessarily represent those of the Council and are not intended to be legally binding. All Council network traffic and GCSX traffic may be subject to recording and/or monitoring in accordance with relevant legislation. South Tyneside Council, Town Hall & Civic Offices, Westoe Road, South Shields, Tyne & Wear, NE33 2RL, Tel: 0191 427 1717, Website: www.southtyneside.info

2 1

inner - outer identity
by lieven.stubbe＠b-holding.be 01 Dec '09

01 Dec '09

Dear, While trying to connect to an access point via peap, eap-tls the connection works successfully using user credentials entered manually. When asking to auth via Windows login, FR uses always the roaming id, how can I change this behaviour to use the windows login, instead of using the roaming id ? Thanx, Lieven Stubbe Belgian Railways

2 1

FreeRADIUS and PostgresSQL
by John Gardner 01 Dec '09

01 Dec '09

Hi everyone I'm using Oracle Enterprise Linux (Red Hat EL clone) and the packaged version of FreeRADIUS (1.1.3) to ultimately authenticate some Linux machines centrally. I've been following the HOWTO at http://wiki.freeradius.org/SQL_HOWTO but some of it does appear to be out of date. I've managed to successfully authenticate using the users file, but when I try to authenticate against the test data I've put in the database I'm getting the following in the logs; rad_recv: Access-Request packet from host 127.0.0.1:38929, id=223, length=64 User-Name = "john.gardner" User-Password = "xxxxxxxxxx" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "john.gardner", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 2 radius_xlat: 'john.gardner' rlm_sql (sql): sql_set_user escaped user --> 'john.gardner' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'john.gardner' ??ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'john.gardner' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql: Failed to create the pair: Unknown attribute "Cleartext-Password" rlm_sql (sql): Error getting data from database rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns fail for request 2 modcall: leaving group authorize (returns fail) for request 2 Finished request 2 Going to the next request Now, it appears that the problem is to do with 'Cleartext-Password' I've stored in the database, but this seems to be correct according to the HOWTO. Can anyone see the problem just from the log? Is there a list of all the correct data that could entered into the database? Thanks in advance John This email and any files transmitted with it are intended solely for the named recipient and may contain sensitive, confidential or protectively marked material up to the central government classification of ?RESTRICTED" which must be handled accordingly. If you have received this e-mail in error, please immediately notify the sender by e-mail and delete from your system, unless you are the named recipient (or authorised to receive it for the recipient) you are not permitted to copy, use, store, publish, disseminate or disclose it to anyone else. E-mail transmission cannot be guaranteed to be secure or error-free as it could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses and therefore the Council accept no liability for any such errors or omissions. Unless explicitly stated otherwise views or opinions expressed in this email are solely those of the author and do not necessarily represent those of the Council and are not intended to be legally binding. All Council network traffic and GCSX traffic may be subject to recording and/or monitoring in accordance with relevant legislation. South Tyneside Council, Town Hall & Civic Offices, Westoe Road, South Shields, Tyne & Wear, NE33 2RL, Tel: 0191 427 1717, Website: www.southtyneside.info

2 1

Error while trying to make root CA
by Peter Carlstedt 01 Dec '09

01 Dec '09

Hello everyone, it took a while for me to understand how to get root privileges in the terminal, i finally decided to login as root though I know I should not do that but I couldnt find a way around it since i need to get into raddb/certs with the terminal so i can remove some files and stuff that the readme say. Well I tried to runt the bootstrap command and got an error saying that it has problems making the Cert Request. Here down below is the output from the bootstrap command. How do I fix this, have I done something that I shouldnt have done? Best regards/ Peter Carlstedt root@peter-desktop:/usr/local/etc/raddb/certs# ./bootstrap openssl req -new -out server.csr -keyout server.key -config ./server.cnf Generating a 2048 bit RSA private key ....................................+++ ......................+++ writing new private key to 'server.key' ----- openssl req -new -x509 -keyout ca.key -out ca.pem \ -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf Generating a 2048 bit RSA private key .......+++ ........................................+++ writing new private key to 'ca.key' ----- problems making Certificate Request 9578:error:0D07A097:asn1 encoding routines:ASN1_mbstring_ncopy:string too long:a_mbstr.c:154:maxsize=2 make: *** [ca.key] Error 1 Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time ..............................................+..................................................................................+.+..........................................+............+............+......+..............................................................................+..........+...............................................................................................................+........+...........................................................................+...................+.......+.+......+............+.............................................................+........................+.................................................................................................................................................+.......................+......................................................................+..........................................................................................................................+............................................+.....+.................................................+.................................................................................................+............+...............+.............................................................................+........................+............+.................................+.+.....................................................+......................+...........................................................+..................................+...........+..................................................+............+........+...............+................................+........................+....................................................................................................................................................................................+........................................................................................+................+.................................................+.............................+..........................+........................................................................+...............+......................................+...............+.............................................+............+..................................+...............+............................+...........+..................++*++*++* Generating a 2048 bit RSA private key .............................................................................................................+++ ..........................................................................+++ writing new private key to 'server.key' ----- Generating a 2048 bit RSA private key ..............................................+++ .......................................................................+++ writing new private key to 'ca.key' ----- problems making Certificate Request 9587:error:0D07A097:asn1 encoding routines:ASN1_mbstring_ncopy:string too long:a_mbstr.c:154:maxsize=2 _________________________________________________________________ Windows Live Hotmail: Your friends can get your Facebook updates, right from Hotmail®. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

1 0

Accounting SQL Entries
by Matt Martin 01 Dec '09

01 Dec '09

Hello list. I have been testing FreeRADIUS for a project we are looking at running to authenticate users for Giganews. I have got the authentication part working well, and the authentication attempts get logged correctly into MySQL. Now, I am trying to log the session details, such as data to and from the host. I've tried various configs, FAQs and similar without little luck. I am slightly stumped as to where to look now. Can anyone offer any help or advice. Thank you. M -- freeradius: FreeRADIUS Version 2.0.4, for host i486-pc-linux-gnu, built on Sep 7 2008 at 23:35:34 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors.

3 2

Session-Octets-Limit and sqlcounter
by Hamid Reza Hasani 01 Dec '09

01 Dec '09

Hi, I'm using freeradius-2.1.6, and I'm going to make a download limitation for my users. I used sqlcounter module and config it as follow: sqlcounter monthlydownload { counter-name = "Monthly-Download-Byte" check-name = "Max-Monthly-Download" reply-name = "Session-Octets-Limit" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='%{%k}' AND AcctStartTime > FROM_UNIXTIME('%b')" reset = "monthly" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } According to the log messages, it shows anything is OK: rlm_sqlcounter: Sent Reply-Item for user hrh, Type=Session-Octets-Limit, value=600106145 ++[monthlydownload] returns ok But in proceeding it shows me what it sent, and there isn't Session-Octets-Limit! as you can see bellow: Sending Access-Accept of id 222 to 127.0.0.1 port 32769 Framed-IP-Address := 20.20.20.1 Framed-IP-Netmask := 255.255.255.0 Session-Timeout = 5460 Finished request 0. Where is my problem? more log is available at the end of message. Thanks for you helps. ------ Ya Ali Hamid Reza Hasani More Log: Module: Linked to module rlm_sqlcounter Module: Instantiating monthlydownload sqlcounter monthlydownload { counter-name = "Monthly-Download-Byte" check-name = "Max-Monthly-Download" reply-name = "Session-Octets-Limit" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='%{%k}' AND AcctStartTime > FROM_UNIXTIME('%b')" reset = "monthly" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Reply attribute Session-Octets-Limit is number 3009 rlm_sqlcounter: Counter attribute Monthly-Download-Byte is number 11273 rlm_sqlcounter: Check attribute Max-Monthly-Download is number 11274 rlm_sqlcounter: Current Time: 1259506851 [2009-11-29 18:30:51], Next reset 1259613000 [2009-12-01 00:00:00] rlm_sqlcounter: Current Time: 1259506851 [2009-11-29 18:30:51], Prev reset 1257021000 [2009-11-01 00:00:00] Module: Checking preacct {...} for more modules to load . . . rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='%{User-Name}' AND AcctStartTime > FROM_UNIXTIME('1257021000')' [monthlydownload] expand: SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='%{User-Name}' AND AcctStartTime > FROM_UNIXTIME('1257021000') -> SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000') sqlcounter_expand: '%{sql:SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000')}' [monthlydownload] sql_xlat [monthlydownload] expand: %{User-Name} -> hrh [monthlydownload] sql_set_user escaped user --> 'hrh' [monthlydownload] expand: SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000') -> SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000') [monthlydownload] expand: /usr/var/log/radius/sqltrace.sql -> /usr/var/log/radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: query: SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000') [monthlydownload] sql_xlat finished rlm_sql (sql): Released sql socket id: 3 [monthlydownload] expand: %{sql:SELECT SUM(AcctOutputOctets+AcctInputOctets) FROM radacct WHERE UserName='hrh' AND AcctStartTime > FROM_UNIXTIME('1257021000')} -> 100213 rlm_sqlcounter: Check item is greater than query result rlm_sqlcounter: Authorized user hrh, check_item=600000000, counter=100213 rlm_sqlcounter: Sent Reply-Item for user hrh, Type=Session-Octets-Limit, value=600106145 ++[monthlydownload] returns ok . . . Sending Access-Accept of id 222 to 127.0.0.1 port 32769 Framed-IP-Address := 20.20.20.1 Framed-IP-Netmask := 255.255.255.0 Session-Timeout = 5460 Finished request 0. Going to the next request Waking up in 4.9 seconds.

5 9

mySQL table creation file
by James Hankins 01 Dec '09

01 Dec '09

Greetings, I'm standing up a freeradius server on Centos 5.4 with the yum installed version of Freeradius. Where do I obtain the mysql file to create the default tables for the database? Thank you! Jim

2 1

Re: chilli + freeradius + mysql : Password check failed
by David BiTx0 30 Nov '09

30 Nov '09

Hi all, Forgive me for not answering but weekends I do not work J >tnt(a)kalik.net>Is it well written oon the login page? Try simpler password (something>like 12345 - that will work even with CAPS LOCK on). If it still fails>take it up with chillispot people. I have tried with 1234 : --------------------------------- INICIO --------------------------------------------------- Mon Nov 30 10:45:56 2009 : Debug: rlm_sql (sql): Released sql socket id: 4 Mon Nov 30 10:45:56 2009 : Info: ++[sql] returns ok Mon Nov 30 10:45:56 2009 : Info: ++[expiration] returns noop Mon Nov 30 10:45:56 2009 : Info: ++[logintime] returns noop Mon Nov 30 10:45:56 2009 : Info: [pap] Found existing Auth-Type, not changing it. Mon Nov 30 10:45:56 2009 : Info: ++[pap] returns noop Mon Nov 30 10:45:56 2009 : Debug: rlm_sqlcounter: Entering module authorize code Mon Nov 30 10:45:56 2009 : Debug: sqlcounter_expand: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}'' Mon Nov 30 10:45:56 2009 : Info: [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='9799-8798-3665-6561' Mon Nov 30 10:45:56 2009 : Debug: sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='9799-8798-3665-6561'}' Mon Nov 30 10:45:56 2009 : Info: [noresetcounter] sql_xlat Mon Nov 30 10:45:56 2009 : Info: [noresetcounter] expand: %{User-Name} -> 9799-8798-3665-6561 Mon Nov 30 10:45:56 2009 : Info: [noresetcounter] sql_set_user escaped user --> '9799-8798-3665-6561' Mon Nov 30 10:45:56 2009 : Info: [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='9799-8798-3665-6561' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='9799-8798-3665-6561' Mon Nov 30 10:45:56 2009 : Debug: rlm_sql (sql): Reserving sql socket id: 3 Mon Nov 30 10:45:56 2009 : Info: [noresetcounter] row[0] returned NULL Mon Nov 30 10:45:56 2009 : Debug: rlm_sql (sql): Released sql socket id: 3 Mon Nov 30 10:45:56 2009 : Info: [noresetcounter] expand: %{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='9799-8798-3665-6561'} -> Mon Nov 30 10:45:56 2009 : Debug: rlm_sqlcounter: No integer found in string "" Mon Nov 30 10:45:56 2009 : Info: ++[noresetcounter] returns noop Mon Nov 30 10:45:56 2009 : Debug: rlm_sqlcounter: Entering module authorize code Mon Nov 30 10:45:56 2009 : Debug: rlm_sqlcounter: Could not find Check item value pair Mon Nov 30 10:45:56 2009 : Info: ++[dailycounter] returns noop Mon Nov 30 10:45:56 2009 : Debug: rlm_sqlcounter: Entering module authorize code Mon Nov 30 10:45:56 2009 : Debug: rlm_sqlcounter: Could not find Check item value pair Mon Nov 30 10:45:56 2009 : Info: ++[monthlycounter] returns noop Mon Nov 30 10:45:56 2009 : Info: Found Auth-Type = CHAP Mon Nov 30 10:45:56 2009 : Info: +- entering group CHAP {...} Mon Nov 30 10:45:56 2009 : Info: [chap] login attempt by "9799-8798-3665-6561" with CHAP password Mon Nov 30 10:45:56 2009 : Info: [chap] Using clear text password "1234" for user 9799-8798-3665-6561 authentication. Mon Nov 30 10:45:56 2009 : Info: [chap] Password check failed Mon Nov 30 10:45:56 2009 : Info: ++[chap] returns reject Mon Nov 30 10:45:56 2009 : Info: Failed to authenticate the user. Mon Nov 30 10:45:56 2009 : Info: Using Post-Auth-Type Reject Mon Nov 30 10:45:56 2009 : Info: +- entering group REJECT {...} Mon Nov 30 10:45:56 2009 : Info: [attr_filter.access_reject] expand: %{User-Name} -> 9799-8798-3665-6561 Mon Nov 30 10:45:56 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Nov 30 10:45:56 2009 : Info: ++[attr_filter.access_reject] returns updated Mon Nov 30 10:45:56 2009 : Info: Delaying reject of request 0 for 1 seconds Mon Nov 30 10:45:56 2009 : Debug: Going to the next request Mon Nov 30 10:45:56 2009 : Debug: Waking up in 0.9 seconds. Mon Nov 30 10:45:57 2009 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 0 to 192.168.65.99 port 38212 Mon Nov 30 10:45:57 2009 : Debug: Waking up in 4.9 seconds. Mon Nov 30 10:46:02 2009 : Info: Cleaning up request 0 ID 0 with timestamp +40 Mon Nov 30 10:46:02 2009 : Debug: Ready to process requests. --------------------------------------------------- FIN -------------------------------------------------------------------------------------------------- >José Adiel Blandón Rivera canchex(a)gmail.com > >are you using Crypted password in the database? you have to use clear passwords in the database to successful login through chillispot and freeradius. > >Regards I am using Clear passwords : mysql> select * from radcheck; +----+---------------------+--------------------+----+-------+ | id | username | attribute | op | value | +----+---------------------+--------------------+----+-------+ | 2 | 9799-8798-3665-6561 | Cleartext-Password | := | 1234 | +----+---------------------+--------------------+----+-------+ 1 row in set (0.00 sec) mysql> >Charles" charles(a)goma.kivu-online.com > >Whats the version of freeradius are you using? Mon Nov 30 10:45:15 2009 : Info: FreeRADIUS Version 2.1.7, for host i486-pc-linux-gnu, built on Nov 13 2009 at 15:28:37 Mon Nov 30 10:45:15 2009 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Mon Nov 30 10:45:15 2009 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Mon Nov 30 10:45:15 2009 : Info: PARTICULAR PURPOSE. Mon Nov 30 10:45:15 2009 : Info: You may redistribute copies of FreeRADIUS under the terms of the Mon Nov 30 10:45:15 2009 : Info: GNU General Public License v2. Mon Nov 30 10:45:15 2009 : Info: Starting - reading configuration files ... Regards!! _________________________________________________________________ Windows Live: Make it easier for your friends to see what you’re up to on Facebook. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

2 1

RE: Re: Making certs for Windows users
by Peter Carlstedt 30 Nov '09

30 Nov '09

> Message: 1 > Date: Mon, 30 Nov 2009 09:43:07 +0000 > From: Peter Carlstedt <pc_007(a)hotmail.com> > Subject: Making certs for Windows users > To: <freeradius-users(a)lists.freeradius.org> > Message-ID: <SNT120-W2C8F3E29E26DE093D3F90B4970(a)phx.gbl> > Content-Type: text/plain; charset="iso-8859-1" > > > Hello everyone. > > I got some questions regarding how to make a certificate that works towards windows clients while running Freeradius with PEAP. > > > > Well I have read on the wiki for Freeradius about making a standalone cert for windows clients (root cert) but why do i need that installed on the windows clients when i want to run peap? Isn?t peap meant to work in the way that you shouldnt have to install stand alone certs in the users computers? > > > > Anyway... I dont really understand what it is that i need to do to make real certificates, I?ve read the "readme" file in raddb/certs but dont understand what it says. I have got ca.cnf anf ca.pem etc since i started the radius server the first time where it said that it made some certs, which i guess it test certificates... the readme file only says that i should remove the old ones but when i try to get into the certs folder through the terminal it says i do not have permission to go into that folder.. Im using Ubuntu Desktop and I dont know a way to get into the folder with the root other than typing "sudo cd certs" which do not work. :/ > > > > Can I ignore the part which says that I need to remove the certs created when i run the server the first time and just do changes in the ca.cnf? > > > > As a sidenote, I?ve never worked with certificates before, I know what they are meant to do but more than that i dont know. > > > > Best regards/ Peter Carlstedt > > > > ------------------------------ > Message: 5 > Date: Mon, 30 Nov 2009 11:15:09 +0100 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: Making certs for Windows users > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4B139B2D.8000006(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Peter Carlstedt wrote: > > I got some questions regarding how to make a certificate that works > > towards windows clients while running Freeradius with PEAP. > > The howto's are detailed, and should be relatively clear. > > > Well I have read on the wiki for Freeradius about making a standalone > > cert for windows clients (root cert) but why do i need that installed on > > the windows clients when i want to run peap? > > Because that's how peap works. > > > Isn?t peap meant to work in > > the way that you shouldnt have to install stand alone certs in the users > > computers? > > No. > > > Anyway... I dont really understand what it is that i need to do to make > > real certificates, I?ve read the "readme" file in raddb/certs but dont > > understand what it says. I have got ca.cnf anf ca.pem etc since i > > started the radius server the first time where it said that it made some > > certs, which i guess it test certificates... the readme file only says > > that i should remove the old ones but when i try to get into the certs > > folder through the terminal it says i do not have permission to go into > > that folder.. Im using Ubuntu Desktop and I dont know a way to get into > > the folder with the root other than typing "sudo cd certs" which do not > > work. :/ > > This is Unix 101. You need to be "root" to edit the files in that > directory. Yes I understand that I need root permissions to edit files in that directory BUT is there anyway to get those permission without having to login with the root account? There are reasons of why you should use "sudo"in the terminal as a normal user instead of logging in as the root user. So what i mean is if there are some kind of command which gives me the same permissions as the root user in the terminal, was thinking about that since you can use the command "gksudo nautilus" to browse through directories which has root permission only. Is there any command which can give me the same permissions in the terminal? > > > Can I ignore the part which says that I need to remove the certs created > > when i run the server the first time and just do changes in the ca.cnf? > > Sure. And then it won't work. > > Alan DeKok. > > So the only differences between the test cert and a real one is only what is written in the ca.cnf? I dont need to add or remove anything or make an extra file or something like that? Sorry for all (maybe stupid) questions but Im new to the thing of creating certs. > ------------------------------ Best regards/ Peter Carlstedt _________________________________________________________________ Windows Live: Make it easier for your friends to see what you’re up to on Facebook. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

3 2