- Freeradius-Users - lists.freeradius.org

Problems with the authentication TLS
by Martin Silvero 11 Sep '08

11 Sep '08

I wrote the documentation as redundancy, forgiveness if disturbed. What can be wrong password CA file? I got one at random, should be like any other? thanks!! -- -- Silvero Martin

1 0

Problems with the authentication TLS
by Martin Silvero 11 Sep '08

11 Sep '08

the truth is that follow in the footsteps of the file certs / readme I looked at the howto -> http://freeradius.org/doc/EAPTLS.pdf and says nothing of the buildup of certificates. I follow these steps: README *********************************************************************************************** This directory contains scripts to create the server certificates. To make a set of default (i.e. test) certificates, simply type: $ ./bootstrap The "openssl" command will be run against the sample configuration files included here, and will make a self-signed certificate authority (i.e. root CA), and a server certificate. This "root CA" should be installed on any client machine needing to do EAP-TLS, PEAP, or EAP-TTLS. The Microsoft "XP Extensions" will be automatically included in the server certificate. Without those extensions Windows clients will refuse to authenticate to FreeRADIUS. In general, you should use self-signed certificates for 802.1x (EAP) authentication. When you list root CAs from other organizations in the "CA_file", you permit them to masquerade as you, to authenticate your users, and to issue client certificates for EAP-TLS. If FreeRADIUS was configured to use OpenSSL, then simply starting the server in root in debugging mode should also create test certificates, i.e.: $ radiusd -X That will cause the EAP-TLS module to run the "bootstrap" script in this directory. The script will be executed only once, the first time the server has been installed on a particular machine. This bootstrap script SHOULD be run on installation of any pre-built binary package for your OS. In any case, the script will ensure that it is not run twice, and that it does not over-write any existing certificates. If you already have CA and server certificates, rename (or delete) this directory, and create a new "certs" directory containing your certificates. Note that the "make install" command will NOT over-write your existing "raddb/certs" directory, which means that the "bootstrap" command will not be run. NEW INSTALLATIONS OF FREERADIUS We suggest that new installations use the test certificates for initial tests, and then create real certificates to use for normal user authentication. See the instructions below for how to create the various certificates. The old test certificates can be deleted by running the following command: $ rm -f *.pem *.der *.csr *.crt *.key *.p12 serial* index.txt* Then, follow the instructions below for creating real certificates. Once the final certificates have been created, you can delete the "bootstrap" command from this directory, and delete the "make_cert_command" configuration from the "tls" sub-section of eap.conf. If you do not want to enable EAP-TLS, PEAP, or EAP-TTLS, then delete the relevant sub-sections from the "eap.conf" file. MAKING A ROOT CERTIFICATE $ vi ca.cnf Edit the "input_password" and "output_password" fields to be the password for the CA certificate. Edit the [certificate_authority] section to have the correct values for your country, state, etc. $ make ca.pem This step creates the CA certificate. $ make ca.der This step creates the DER format of the self-signed certificate, which is can be imported into Windows. MAKING A SERVER CERTIFICATE $ vi server.cnf Edit the "input_password" and "output_password" fields to be the password for the server certificate. Edit the [server] section to have the correct values for your country, state, etc. Be sure that the commonName field here is different from the commonName for the CA certificate. $ make server.pem This step creates the server certificate. If you have an existing certificate authority, and wish to create a certificate signing request for the server certificate, edit server.cnf as above, and type the following command. $ make server.csr You will have to ensure that the certificate contains the XP extensions needed by Microsoft clients. MAKING A CLIENT CERTIFICATE Client certificates are used by EAP-TLS, and optionally by EAP-TTLS and PEAP. The following steps outline how to create a client certificate that is signed by the server certificate created above. You will have to have the password for the server certificate in the "input_password" and "output_password" fields of the server.cnf file. $ vi client.cnf Edit the "input_password" and "output_password" fields to be the password for the client certificate. You will have to give these passwords to the end user who will be using the certificates. Edit the [client] section to have the correct values for your country, state, etc. Be sure that the commonName field here is the User-Name that will be used for logins! $ make client.pem The users certificate will be in "commonName.pem", i.e. "user(a)example.com.pem". To create another client certificate, just repeat the steps for making a client certificate, being sure to enter a different login name for "commonName", and a different password. PERFORMANCE EAP performance for EAP-TLS, TTLS, and PEAP is dominated by SSL calculations. That is, a normal system can handle PAP authentication at a rate of 10k packets/s. However, SSL involves RSA calculations, which are very expensive. To benchmark your system, do: $ openssl speed rsa or $ openssl speed rsa2048 to test 2048 bit keys. A 1GHz system will likely do 30 calculations/s. A 2Ghz system may do 50 calculations/s, or more. That number is also the number of authentications/s that can be done for EAP-TLS (or TTLS, or PEAP). *************************************************************************************************** What is the password that this wrong? thank you!! -- --

2 1

How To Install Freeradius with LDAP - Need Help
by niel m 11 Sep '08

11 Sep '08

Hello Sir/Madam, Good Evening Im niel, I was researching about this topic Freeradius with LDAP support for authentication. I am very pressured because i want to implement such as this one using my AP in the office. If anyone can help me with this problem. Either some of below; - URL of a web that states step-by-step procedure on how to implement such system - or giving me some personal advice. I appreciate any help I can get to solve this system Thanks, Niel

2 1

Python Module with IPPOOL module
by Michael da Silva Pereira 11 Sep '08

11 Sep '08

Hi there, I'm not sure if anybody has been able to do this, Haven't found much on the web for the Python with freeradius, but I'm trying to allocate a IP Pool to a specific set of users with a Python module. Now I know the Pool-Name is a check item and not a Reply Item, but can I do this from Python or is just not possible? The python handles my Auth, Acct, etc.. However I'm trying to drop different users into different IP-Pools depending on criteria in a database. So I'm unable to do this from users files and such... Any ideas? Thanks, Michael da Silva Pereira

2 1

Password attrib problem
by Yawar Hadi 11 Sep '08

11 Sep '08

hi all, i have a little problem with user-password attrib. i get the usr password as plain-text in my authorize function of rlm_sql module .when get it from request...... but i want to get it from request in accounting function of rlm_Sql module. its encrypted why........ char *pass[25]; pass =request->password->strvalue; printf("password is : %s",pass); on console its shows like #password is : ?0t\364\237 have any one deal with this problem.plz share your experience with me to overcome this issur. thanks in advance. -- Best regards Yawar Hadi Noshahi QAU Islamabad (+92-0300-5504798)

2 5

Problems with the authentication TLS
by Martin Silvero 11 Sep '08

11 Sep '08

ok, ready! my problem now is the certificates. when I create, the problem is dont can created the user certificate, reading the howto of wiki in the page ( http://freeradius.org/doc/EAPTLS.pdf ). i have this: [root@radius certs]# make client.pem openssl ca -batch -keyfile server.key -cert server.crt -in client.csr -key `grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf Using configuration from ./client.cnf unable to load CA private key 23294:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:461: 23294:error:0906A065:PEM routines:PEM_do_header:bad decrypt:pem_lib.c:425: make: *** [client.crt] Error 1 then the user certificates dont created.... somewhere now exactly which thw certificates of the last version im install in user pc? this? --> ca.der and client.key? why is the extension of certificates than used for the users? thanks!! -- -- Silvero Martin

2 1

Freeradius eap extension
by Fernando 11 Sep '08

11 Sep '08

Hi all, I have some cuestions development related. First one: can eap-ttls method carry inside any eap method? if not... can eap-ttls be extended to do it? Second one: with the actual release, Is it possible to develop a new eap-method that carries inside an undetermined number of eap methods? Regards, Fernando.

2 1

: Re: Cisco VPN Server 3000 + Radius + LDAP = heeelp!!
by Osvaldo Campos M. - Administrador Red STI 10 Sep '08

10 Sep '08

Sorry!!!... faded format when sending the earlier mail -- Osvaldo H. Campos Molina Administrador de Red STI - Univ. de Chile

1 0

RADIUS Administration interface
by Alan DeKok 10 Sep '08

10 Sep '08

I've added a RADIUS administration interface to the latest git tree. It's experimental (i.e. VERY), and has little authentication or authorization. It's purpose is to test the concepts, and to see if it's what users want. Server configuration: raddb/sites-available/control-socket Client: radmin You get a prompt, and not much else. Typing "help" gets you some information: radmin> help hup [module] - sends a HUP signal to the server, or optionally to one module terminate - terminates the server, and causes it to exit show <command> - do sub-command of show set <command> - do sub-command of set You can HUP the server, ask it to stop, see the configuration of a module, show the list of loaded modules. As an interesting note, you can also *change* parts of the configuration of a running system. And then hup *just* one module, rather than the whole server. And then maybe the server crashes. :) Don't use this in production. Once it's a little more developed, we'll add features like "authentication" of the users on the administration interface. And "command authorization". Alan DeKok.

7 11

Making each virtual server have their own sql.conf file
by Nataniel Klug 10 Sep '08

10 Sep '08

Hello all, Here I am again. I need to make that every virtual server I have running look for it's data on different mysql database and tables. For this I need to set up each virtual server too look into it's own sql.conf... I could not find any doc about this. PS.: Why even if a client gets reject from the server the still sends reply like this: Sending Access-Reject of id 138 to 127.0.0.1 port 44881 Mikrotik-Rate-Limit = "100k/200k 200k/400k 80k/160k 180/180 8 60k/120k" Waiting for some tips... -- Att, NATANIEL KLUG nata(a)cnett.com.br LEIA O DIA-A-DIA DO NATA http://nataklug.blogspot.com/ Cyber Nett - Internet Banda Larga www.cnett.com.br (42) 3635-2957 Rua Diogo Pinto, 1046, Centro Laranjeiras do Sul - PR Brasil - 85301-290 "... também os sábios possuem coração tangível e podem, por vezes, usar da ciência como meio de demonstrar impressões sentimentais de que muitos não os julgam suscetíveis." Visconde de Taunay

2 1