You get this with debian as the rlm_eap_tls.so is not included in the debian distribution due to licencing issues with openssl (IIRC). I've installed on debian twice now, and each time I've had to install openssl and freeradius from source. You can be certain of a few compile-time errors, but they are easily fixed by apt-getting the dev packages of whatever is missing. Also if you are installing to use with postgresql, I'd advise installing that from source as well. For your reference, look under /usr/share/doc/freeradius for documentation. In the copyright notes, this can be found: --| START QUOTE |-- "Some GPL parts of this software depend on OpenSSL, the combination of which cannot be distributed in compiled binary form. The following modules cannot be enabled as they directly depend on OpenSSL: rlm_eap_peap rlm_eap_tls rlm_eap_ttls rlm_x99_token Also, the FreeRADIUS core's SNMP support and the rlm_sql_postgresql module transitively depend on OpenSSL via libsnmp{4.2,5} and libpq3 so they cannot be enabled currently, but this is subject to changes in the relevant packages within Debian, or having usable alternate libraries in Debian." --| END QUOTE |-- -- BigMick pelusa vali wrote:
hi everybody, well i'm trying to implement an ap over linux, i use madwifi-ng, debian sarge kernel 2.6.13 and freeradius supplied with debian installation cd's; i'd like to add more security so i decided to use hostapd and freeradius, first i generate my own certificates using openssl, and my hostapd configuration refer to freeradius files and directories; here is my radiusd.conf file:
prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/freeradius log_file = ${logdir}/radius.log libdir = /usr/lib/freeradius pidfile = ${run_dir}/freeradius.pid user = root group = root max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = 192.168.50.1 port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = before lower_pass = before nospace_user = before nospace_pass = before security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp }
$INCLUDE ${confdir}/eap.conf mschap { } ldap { server = "ldap.your.domain" basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users compat = no }
detail { detailperm = 0600 }
acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" }
$INCLUDE ${confdir}/sql.conf
radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = no check_with_nas = yes perm = 0600 callerid = "yes" }
radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" }
attr_filter { attrsfile = ${confdir}/attrs }
counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 }
always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no }
expr { }
digest { }
exec { wait = yes input_pairs = request }
exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply }
ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } }
instantiate { exec expr }
authorize { preprocess chap mschap suffix eap files }
authenticate { Auth-Type PAP { pap }
Auth-Type CHAP { chap }
Auth-Type MS-CHAP { mschap } unix eap }
preacct { preprocess acct_unique suffix files }
accounting { detail unix radutmp }
session { radutmp }
post-auth { }
pre-proxy { }
post-proxy { eap }
and here eap.conf file:
eap { default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no
md5 { }
leap { }
gtc { auth_type = PAP }
tls { private_key_password = wlanserver private_key_file = /etc/freeradius/certs/miscerts/private/cakey.pem certificate_file = /etc/freeradius/certs/miscerts/cacert.crt CA_file = /etc/freeradius/certs/miscerts/cacert.pem dh_file = /etc/freeradius/certs/dh random_file = /etc/freeradius/certs/random fragment_size = 1024 }
ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no }
mschapv2 { } }
well the problem is: when i run freeradius -X i get this error:
rlm_eap:Failed to link EAP-Type/tls: rlm_eap_tls.so:cannot open shared object:no such file or directory radiusd.conf[9]:eap:instantation failed
so could any body help me?? why occurs this error and how could i solve it?? thanks for your help.
_________________________________________________________________ MSN Amor: busca tu ½ naranja http://latam.msn.com/amor/
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html