freeradius2 + iODBC + Informix
Greeting, Fajar A. Nugraha-2, Alan DeKok-2. After yours answers i tried to rebuild freeradius with unixodbc module. 1. Install unixodbc and unixodbc-dev 2. Download 2.1.12 package: freeradius_2.1.12+dfsg-1.2ubuntu8.debian.tar.gz freeradius_2.1.12+dfsg-1.2ubuntu8.dsc freeradius_2.1.12+dfsg.orig.tar.bz2 2. Edit debian/rules : --prefix=/usr \ --exec-prefix=/usr \ --mandir=$(mandir) \ --sysconfdir=/etc \ --libdir=$(libdir) \ --datadir=/usr/share \ --localstatedir=/var \ --with-raddbdir=$(raddbdir) \ --with-logdir=/var/log/$(package) \ --enable-ltdl-install=no --enable-strict-dependencies \ --with-large-files --with-udpfromto --with-edir \ --enable-developer \ --config-cache \ --without-rlm_eap_tnc \ --with-rlm_sql_postgresql_lib_dir=`pg_config --libdir` \ --with-rlm_sql_postgresql_include_dir=`pg_config --includedir` \ --without-rlm_eap_ikev2 \ --without-rlm_sql_oracle \ !! --without-rlm_sql_iodbc \ !! --with-rlm_sql_unixodbc \ --with-system-libtool 3. Build package: dpkg-buildpackage -d -rfakeroot 4. Install deb packet: dpkg -i freeradius_2.1.12+dfsg-1.2ubuntu8_amd64.deb 5. Change sql.conf: +++++++++++++++++++++++++++++++++++++++++++++ sql { # # Set the database to one of: # # mysql, mssql, oracle, postgresql # database = "unixodbc" # # Which FreeRADIUS driver to use. # driver = "rlm_sql_${database}" # Connection info: server = "test.server.ru" port = 1425 login = "test" password = "test123" radius_db = "test" ... +++++++++++++++++++++++++++++++++++++++++++++ 6. freeradius -X showed me: rlm_sql (sql): Driver rlm_sql_unixodbc (module rlm_sql_unixodbc) loaded and linked rlm_sql (sql): Attempting to connect to test@test.server.ru:1425/test rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #0 rlm_sql_unixodbc: Connection failed rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. 7. On test.server.ru i used tcpdump utils to see incoming packets from my machine with freeradius - but the entering packets was not detected. Please, help me find the mistake. -- ============================================ С уважением, Богучарский Иван Владимирович. Начальник СУТС ОРЭТС и ШПД ЗАО "Коламбия-Телеком". тел. 8-937-084-25-89.
On Wed, Jan 14, 2015 at 7:04 PM, vanish <vanishox@coltel.ru> wrote:
+++++++++++++++++++++++++++++++++++++++++++++ sql { # # Set the database to one of: # # mysql, mssql, oracle, postgresql # database = "unixodbc"
# # Which FreeRADIUS driver to use. # driver = "rlm_sql_${database}"
# Connection info: server = "test.server.ru" port = 1425 login = "test" password = "test123" radius_db = "test"
I'm pretty sure that's not the right syntax to specify odbc connection in FR. A Google search for "freeradius odbc" returns this on top: http://www.easysoft.com/applications/freeradius/odbc-authorization.html "Server" should be whatever you set the DSN in odbc, and you should test it first (i.e. using isql) to verify that it works. Also check for database-specific quirks. For example, a database vendor force the use of $HOME/.odbc.ini, creating it if it doesn't exists, and completely ignore /etc/odbc.ini. This effectively means any program that uses odbc must have the correct $HOME variable set to be able to use odbc. -- Fajar
Hi, how to turn on client certificate verification for PEAP? I added the following line to eap.conf file: peap { EAP-TLS-Require-Client-Cert = Yes } However, it seems has no effect. Thanks Jim
On 16 Mar 2015, at 20:01, Jim Shi <hanmao_shi@apple.com> wrote:
Hi, how to turn on client certificate verification for PEAP?
I added the following line to eap.conf file:
peap {
}
However, it seems has no effect.
authorize { update control { EAP-TLS-Require-Client-Cert = Yes } } Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Hi, Arran, Actually we would like to have PEAP + MSCHAP + client certificate validation, Looks PEAP + MSCHAP is working, we just want to additional client certificate validation. Do you meant to add the following
authorize { update control { EAP-TLS-Require-Client-Cert = Yes } }
to site-enabled/default? Thanks Jim
On Mar 16, 2015, at 5:06 PM, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 16 Mar 2015, at 20:01, Jim Shi <hanmao_shi@apple.com> wrote:
Hi, how to turn on client certificate verification for PEAP?
I added the following line to eap.conf file:
peap {
}
However, it seems has no effect.
authorize { update control { EAP-TLS-Require-Client-Cert = Yes } }
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 18 Mar 2015, at 12:16, Jim Shi <hanmao_shi@apple.com> wrote:
Hi, Arran, Actually we would like to have PEAP + MSCHAP + client certificate validation,
Looks PEAP + MSCHAP is working, we just want to additional client certificate validation.
Do you meant to add the following
authorize { update control { EAP-TLS-Require-Client-Cert = Yes } }
to site-enabled/default?
Apparently, according to the interwebs. I personally have never tested it. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On Wed, Mar 18, 2015 at 08:35:36PM -0400, Arran Cudbard-Bell wrote:
On 18 Mar 2015, at 12:16, Jim Shi <hanmao_shi@apple.com> wrote: Actually we would like to have PEAP + MSCHAP + client certificate validation,
Looks PEAP + MSCHAP is working, we just want to additional client certificate validation. ...
Apparently, according to the interwebs. I personally have never tested it.
I played around with this a long time ago when I was hacking on the TLS code. I think it will be hard finding a supplicant that actually supports it - it might be possible to configure wpa-supplicant to send a client cert with PEAP. Generally you have two options - client cert auth, or username/password auth. Trying to do both together seems practically impossible. (We wanted to for staff laptops to verify both the machine and the user - in the end settled on EAP-TLS to get onto the network, then user has to log into the domain, which was about as good as we could get.) Thanks, Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi,
Actually we would like to have PEAP + MSCHAP + client certificate validation,
do you mean PEAPv0/MSCHAPv2 AND PEAPv0/TLS ? or do you mean you'd like to do PEAPv0/MSCHAPv2 and check that the client is actually checking the server certificate? alan
PEAP + MSCHAPv2, at same time, we want the radius server validate the certificate provided by the client. Thanks Jim
On Mar 19, 2015, at 4:11 AM, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
Actually we would like to have PEAP + MSCHAP + client certificate validation,
do you mean PEAPv0/MSCHAPv2 AND PEAPv0/TLS ?
or do you mean you'd like to do PEAPv0/MSCHAPv2 and check that the client is actually checking the server certificate?
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mar 19, 2015, at 12:12 PM, Jim Shi <hanmao_shi@apple.com> wrote:
PEAP + MSCHAPv2, at same time, we want the radius server validate the certificate provided by the client.
The server will always validate the certificate provided by the client. If you want to REQUIRE client certificates, use the configuration posted earlier. Alan DeKok.
Thanks Alan. Jim
On Mar 19, 2015, at 10:36 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Mar 19, 2015, at 12:12 PM, Jim Shi <hanmao_shi@apple.com> wrote:
PEAP + MSCHAPv2, at same time, we want the radius server validate the certificate provided by the client.
The server will always validate the certificate provided by the client.
If you want to REQUIRE client certificates, use the configuration posted earlier.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (7)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Arran Cudbard-Bell -
Fajar A. Nugraha -
Jim Shi -
Matthew Newton -
vanish