Allan,&nbsp;<div><br></div><div>I thank you for your advice and your time.&nbsp;</div><div><br></div><div>A person like you who is dealing with freeradius on a daily basis may have a tendency of thinking that using/installing/troubleshooting freeradius is very easy. But for a complete new beginner, like myself, things seem more complicated. I&#39;ll give an example from my own&nbsp;experience;&nbsp;3 years ago when I started as a network admin in my company, it took me almost 10 days to figure out how to properly instal apache/mysql/php on a linux box. Now, it takes me under 15 minutes to install them all. I wrote a step-by-step instruction for the process at the time and distributed to everyone on the net. Based on the feedback I got from people, everyone seems to agree that it provided them a simple and easy to follow steps for the installation. I felt happy that I helped other people the way that I was helped at all the time through different forums on the internet.</div>
<div><br></div><div>When I started implementing the FreeRadius, I thought I would find some documentation &nbsp;to start with. But unfortunately, after spending days, i couldn&#39;t find such a document. The more I read, the more i surprised that I couldn&#39;t figure this out. I know that it shouldn&#39;t be much difficult but here I am still struggling to make this work.</div>
<div><br></div><div>I don&#39;t want to take your and other people&#39;s valuable time any more, so here is where I am now;</div><div><br></div><div>I installed the FreeRadous 2.0.2 with Yast tool with SuSE SLES. It installed it OK. And then i made changes to eap.conf and radiusd.conf files to start my test. I run radiusd -X and here is what I got;</div>
<div><br></div><div><br></div><div># radiusd -X</div><div>FreeRADIUS Version 2.0.2, for host i686-suse-linux-gnu, built on Feb 14 2008 at 15:34:49</div><div>Copyright (C) 1999-2008 The FreeRADIUS server project and contributors.</div>
<div>There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A</div><div>PARTICULAR PURPOSE.</div><div>You may redistribute copies of FreeRADIUS under the terms of the</div><div>GNU General Public License.</div>
<div>Starting - reading configuration files ...</div><div>including configuration file /etc/raddb/radiusd.conf</div><div>including configuration file /etc/raddb/proxy.conf</div><div>including configuration file /etc/raddb/clients.conf</div>
<div>including configuration file /etc/raddb/snmp.conf</div><div>including configuration file /etc/raddb/eap.conf</div><div>including configuration file /etc/raddb/sql.conf</div><div>including configuration file /etc/raddb/sql/mysql/dialup.conf</div>
<div>including configuration file /etc/raddb/sql/mysql/counter.conf</div><div>including configuration file /etc/raddb/policy.conf</div><div>including files in directory /etc/raddb/sites-enabled/</div><div>including configuration file /etc/raddb/sites-enabled/default</div>
<div>including dictionary file /etc/raddb/dictionary</div><div>main {</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;prefix = &quot;/usr&quot;</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;localstatedir = &quot;/var&quot;</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;logdir = &quot;/var/log/radius&quot;</div>
<div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;libdir = &quot;/usr/lib/freeradius&quot;</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;radacctdir = &quot;/var/log/radius/radacct&quot;</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;hostname_lookups = no</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;max_request_time = 30</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;cleanup_delay = 5</div>
<div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;max_requests = 1024</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;allow_core_dumps = no</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;pidfile = &quot;/var/run/radiusd/radiusd.pid&quot;</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;user = &quot;radiusd&quot;</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;group = &quot;radiusd&quot;</div>
<div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;checkrad = &quot;/usr/sbin/checkrad&quot;</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;debug_level = 0</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;proxy_requests = yes</div><div>&nbsp;security {</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;max_attributes = 200</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;reject_delay = 1</div>
<div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;status_server = yes</div><div>&nbsp;}</div><div>}</div><div>&nbsp;client localhost {</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;ipaddr = <a href="http://127.0.0.1">127.0.0.1</a></div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;require_message_authenticator = no</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;secret = &quot;testing123&quot;</div>
<div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;nastype = &quot;other&quot;</div><div>&nbsp;}</div><div>&nbsp;client <a href="http://10.10.30.3">10.10.30.3</a> {</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;require_message_authenticator = no</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;secret = &quot;testing123&quot;</div>
<div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;shortname = &quot;<a href="http://10.10.30.3">10.10.30.3</a>&quot;</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;nastype = &quot;cisco&quot;</div><div>&nbsp;}</div><div>radiusd: #### Loading Realms and Home Servers ####</div><div>&nbsp;proxy server {</div>
<div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;retry_delay = 5</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;retry_count = 3</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;default_fallback = no</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;dead_time = 120</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;wake_all_if_all_dead = no</div><div>&nbsp;}</div><div>&nbsp;home_server localhost {</div>
<div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;ipaddr = <a href="http://127.0.0.1">127.0.0.1</a></div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;port = 1812</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;type = &quot;auth&quot;</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;secret = &quot;testing123&quot;</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;response_window = 20</div>
<div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;max_outstanding = 65536</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;zombie_period = 40</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;status_check = &quot;status-server&quot;</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;ping_check = &quot;none&quot;</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;ping_interval = 30</div>
<div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;check_interval = 30</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;num_answers_to_alive = 3</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;num_pings_to_alive = 3</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;revive_interval = 120</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;status_check_timeout = 4</div><div>&nbsp;}</div><div>
&nbsp;home_server_pool my_auth_failover {</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;type = fail-over</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;home_server = localhost</div><div>&nbsp;}</div><div>&nbsp;realm <a href="http://example.com">example.com</a> {</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;auth_pool = my_auth_failover</div>
<div>&nbsp;}</div><div>&nbsp;realm LOCAL {</div><div>&nbsp;}</div><div>radiusd: #### Instantiating modules ####</div><div>&nbsp;instantiate {</div><div>&nbsp;Module: Linked to module rlm_exec</div><div>&nbsp;Module: Instantiating exec</div><div>&nbsp;&nbsp;exec {</div>
<div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;wait = yes</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;input_pairs = &quot;request&quot;</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;shell_escape = yes</div><div>&nbsp;&nbsp;}</div><div>&nbsp;Module: Linked to module rlm_expr</div><div>&nbsp;Module: Instantiating expr</div><div>&nbsp;Module: Linked to module rlm_expiration</div>
<div>&nbsp;Module: Instantiating expiration</div><div>&nbsp;&nbsp;expiration {</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;reply-message = &quot;Password Has Expired &nbsp;&quot;</div><div>&nbsp;&nbsp;}</div><div>&nbsp;Module: Linked to module rlm_logintime</div><div>&nbsp;Module: Instantiating logintime</div>
<div>&nbsp;&nbsp;logintime {</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;reply-message = &quot;You are calling outside your allowed timespan &nbsp;&quot;</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;minimum-timeout = 60</div><div>&nbsp;&nbsp;}</div><div>&nbsp;}</div><div>radiusd: #### Loading Virtual Servers ####</div>
<div>server {</div><div>&nbsp;modules {</div><div>&nbsp;Module: Checking authenticate {...} for more modules to load</div><div>&nbsp;Module: Linked to module rlm_pap</div><div>&nbsp;Module: Instantiating pap</div><div>&nbsp;&nbsp;pap {</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;encryption_scheme = &quot;auto&quot;</div>
<div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;auto_header = no</div><div>&nbsp;&nbsp;}</div><div>&nbsp;Module: Linked to module rlm_chap</div><div>&nbsp;Module: Instantiating chap</div><div>&nbsp;Module: Linked to module rlm_mschap</div><div>&nbsp;Module: Instantiating mschap</div><div>
&nbsp;&nbsp;mschap {</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;use_mppe = yes</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;require_encryption = no</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;require_strong = no</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;with_ntdomain_hack = no</div><div>&nbsp;&nbsp;}</div><div>&nbsp;Module: Linked to module rlm_unix</div>
<div>&nbsp;Module: Instantiating unix</div><div>&nbsp;&nbsp;unix {</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;radwtmp = &quot;/var/log/radius/radwtmp&quot;</div><div>&nbsp;&nbsp;}</div><div>&nbsp;Module: Linked to module rlm_eap</div><div>&nbsp;Module: Instantiating eap</div><div>
&nbsp;&nbsp;eap {</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;default_eap_type = &quot;peap&quot;</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;timer_expire = 60</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;ignore_unknown_eap_types = no</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;cisco_accounting_username_bug = no</div><div>&nbsp;&nbsp;}</div><div>
&nbsp;Module: Linked to sub-module rlm_eap_md5</div><div>&nbsp;Module: Instantiating eap-md5</div><div>&nbsp;Module: Linked to sub-module rlm_eap_leap</div><div>&nbsp;Module: Instantiating eap-leap</div><div>&nbsp;Module: Linked to sub-module rlm_eap_gtc</div>
<div>&nbsp;Module: Instantiating eap-gtc</div><div>&nbsp;&nbsp; gtc {</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;challenge = &quot;Password: &quot;</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;auth_type = &quot;PAP&quot;</div><div>&nbsp;&nbsp; }</div><div>&nbsp;Module: Linked to sub-module rlm_eap_tls</div>
<div>&nbsp;Module: Instantiating eap-tls</div><div>&nbsp;&nbsp; tls {</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;rsa_key_exchange = no</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;dh_key_exchange = yes</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;rsa_key_length = 512</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;dh_key_length = 512</div><div>
&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;verify_depth = 0</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;pem_file_type = yes</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;private_key_file = &quot;/etc/raddb/certs/server.pem&quot;</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;certificate_file = &quot;/etc/raddb/certs/server.pem&quot;</div>
<div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;CA_file = &quot;/etc/raddb/certs/ca.pem&quot;</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;private_key_password = &quot;whatever&quot;</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;dh_file = &quot;/etc/raddb/certs/dh&quot;</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;random_file = &quot;/etc/raddb/certs/random&quot;</div>
<div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;fragment_size = 1024</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;include_length = yes</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;check_crl = no</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;cipher_list = &quot;DEFAULT&quot;</div><div>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;make_cert_command = &quot;/etc/raddb/certs/bootstrap&quot;</div>
<div>&nbsp;&nbsp; }</div><div>rlm_eap: SSL error error:0200100D:system library:fopen:Permission denied</div><div>rlm_eap_tls: Error reading certificate file /etc/raddb/certs/server.pem</div><div>rlm_eap: Failed to initialize type tls</div>
<div>/etc/raddb/eap.conf[17]: Instantiation failed for module &quot;eap&quot;</div><div>/etc/raddb/sites-enabled/default[252]: Failed to find module &quot;eap&quot;.</div><div>/etc/raddb/sites-enabled/default[199]: Errors parsing authenticate section.</div>
<div>&nbsp;}</div><div>}</div><div>Errors initializing modules</div><div>comp-010:/home/srn #</div><div><br></div><div><br></div><div>This is one.&nbsp;</div><div>And other thing is that the command bootstrap couldn&#39;t finish creating certificates. How may I solve this problem. And if finish creating certs&nbsp;successfully, which certificates should I install to the XP SP2 client and where? You suggested to read the file at&nbsp;<a href="http://freeradius.org/doc/EAPTLS.pdf">http://freeradius.org/doc/EAPTLS.pdf</a> but believe me it didn&#39;t help me. And it also gives information for TLS implementation. NOthing for PEAP.</div>
<div><br></div><div>I hope I am not asking silly questions that would make you feel like you are wasting your time.</div><div><br></div><div>Thank you.</div><div><br></div><div>George Knight</div><div><br></div><div>&nbsp;<br>
<br><div class="gmail_quote">On Tue, Apr 29, 2008 at 3:03 PM, Alan DeKok &lt;<a href="mailto:aland@deployingradius.com">aland@deployingradius.com</a>&gt; wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class="Ih2E3d">George KNIGHT wrote:<br>
&gt; Before I write my question here, I just want to let all of you know that<br>
&gt; I did lots of searching in both google and this email list. But couldn&#39;t<br>
&gt; find anything to get the answer.<br>
&gt;<br>
&gt; My question is I have been looking for a HOWTO paper for a beginner to<br>
&gt; set freeradius as an AAA server in a wireless environment to Windows XP<br>
&gt; SP2 clients. I will use Windows&#39; own PEAP client. Is there such a paper<br>
&gt; someone can give me the link?<br>
<br>
</div>$ ./configure<br>
$ make<br>
$ make install<br>
$ radiusd -X<br>
<br>
- Un-check &quot;verify server certificate&quot; in Windows (ONLY for testing).<br>
<br>
- Add a user to the database (username/password, example in the FAQ)<br>
<br>
 &nbsp;That&#39;s it.<br>
<div class="Ih2E3d"><br>
&gt; I&#39;m very frustrated to find out that there is no information available<br>
&gt; for a setup from the scratch.<br>
<br>
</div> &nbsp;Part of the problem is that in 2.0, there is so little to do...<br>
<div class="Ih2E3d"><br>
&gt; I wrote papers like that before for<br>
&gt; various topics such as subversion implementation for a multiple OS<br>
&gt; environment, VoIP implementation with a Linux based open sources S/W<br>
&gt; etc. I have intention to write such a paper for how to set up PEAP<br>
&gt; implementation with freeradius as well. But for that, I&#39;m hoping someone<br>
&gt; can give me a good start.<br>
<br>
</div> &nbsp;The EAP-TLS &quot;howtos&quot; contain additional documentation:<br>
<br>
<a href="http://freeradius.org/doc/" target="_blank">http://freeradius.org/doc/</a><br>
<div class="Ih2E3d"><br>
&gt; Clients are going to be computers with WinCE as their OS and they will<br>
&gt; contact to the LAN wirelessly. What I want to achieve is authenticating<br>
&gt; this clients with server-AAA using PEAP before letting them use the<br>
&gt; other network resources.<br>
<br>
</div> &nbsp;Install 2.0, start the server.<br>
<br>
 &nbsp;See also raddb/certs/README. &nbsp;You can create &quot;real&quot; certificates, and<br>
import them into WinCE.<br>
<br>
 &nbsp;There is very, very, little to change in order to get PEAP to work.<br>
<font color="#888888"><br>
 &nbsp;Alan DeKok.<br>
</font><div><div></div><div class="Wj3C7c">-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>
</div></div></blockquote></div><br></div>