intermediate CA authentication failing
I am using freeradius 1.0.2. By using the openssl i created selfsigned root certificate and from that i created intermediate ca certificate.By using the intermediate CA i created user certificate.When in 802.1x wired EAP-TLS authentication , from the client side i was providing the certificate certified by the intermediate CA.I copied rootCA and Intermediate CA to /etc/raddb/certs.in that case it is not checking for certificate chain deapth. IT is giving error 22 and unknown CA.please can any body help me . -- View this message in context: http://www.nabble.com/intermediate-CA-authentication-failing-tf4433620.html#... Sent from the FreeRadius - User mailing list archive at Nabble.com.
mallika wrote:
I am using freeradius 1.0.2.
Why?
...in that case it is not checking for certificate chain deapth. IT is giving error 22 and unknown CA.please can any body help me .
Because 1.0.2 doesn't have that functionality. Upgrade to the most recent version of the server. Alan DeKok.
Thank you very much for your reply.Which freeradius server version will support this facility.Because we are implenting it in our product.We are using CENT OS -kernel 2.4.20 .Is there any patches are available to upgrade freeradius.please help me......... Alan DeKok-4 wrote:
mallika wrote:
I am using freeradius 1.0.2.
Why?
...in that case it is not checking for certificate chain deapth. IT is giving error 22 and unknown CA.please can any body help me .
Because 1.0.2 doesn't have that functionality.
Upgrade to the most recent version of the server.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- View this message in context: http://www.nabble.com/intermediate-CA-authentication-failing-tf4433620.html#... Sent from the FreeRadius - User mailing list archive at Nabble.com.
mallika wrote:
Thank you very much for your reply.Which freeradius server version will support this facility.
What part of my message was unclear? The most recent one. Read the web page. It's really not that hard.
Because we are implenting it in our product.
Could you explain why you chose a version that is *years* old?
We are using CENT OS -kernel 2.4.20 .Is there any patches are available to upgrade freeradius.please help me.........
I've been trying... Alan DeKok.
On 9/13/07, mallika <mallikkin@gmail.com> wrote:
Thank you very much for your reply.Which freeradius server version will support this facility.Because we are implenting it in our product.We are using CENT OS -kernel 2.4.20 .Is there any patches are available to upgrade freeradius.please help me.........
Mallika, I don't know if your product is going to use an embedded linux version with some weird hardware.. if that's not the case and you are using an unpatched kernel, you are running toward a shipload of problems. I'd suggest using a recent kernel, with all its bugs fixed. As for freeradius, you should download and compile the latest stable version (and upgrade the needed libraries as well) with its security fixes rather than looking for a patch which is unlikely to work and even to exist at all. Latest stable version is 1.1.7
Dear All, i want to setup a freeradius as a proxy radius for a wholesale, and want to limit the access by using the calling-station-id; so user1@isp1 can connect only from any calling-station-id that belong to isp1, (ex, 555111, 333222) and user2@isp2 can connect only from any calling-station-id that belong to isp2.... i have all the calling station id which belong to the ISPs, but i didnt have the username for every ISP, and want to use the realm instead of the username to do that. can i use the checkval to check for the calling-station-id and realm, or is there anyway to do that?
You can use huntgroups: isp1 Realm == isp1realm Calling-Statin-Id = numbe1, Calling Station-Id = number2 Ivan Kalik Kalik Informatika ISP Dana 13/9/2007, "Ashraf Al-Basti" <Ashraf.Albasti@jt.net.jo> piše:
Dear All, i want to setup a freeradius as a proxy radius for a wholesale, and want to limit the access by using the calling-station-id; so user1@isp1 can connect only from any calling-station-id that belong to isp1, (ex, 555111, 333222) and user2@isp2 can connect only from any calling-station-id that belong to isp2.... i have all the calling station id which belong to the ISPs, but i didnt have the username for every ISP, and want to use the realm instead of the username to do that. can i use the checkval to check for the calling-station-id and realm, or is there anyway to do that?
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Dear, i have added this to huntgroups but nothing happened; if i want to use mysql database as a backend is there any way to do that? tnt@kalik.co.yu wrote:
You can use huntgroups:
isp1 Realm == isp1realm Calling-Statin-Id = numbe1, Calling Station-Id = number2
Ivan Kalik Kalik Informatika ISP
Dana 13/9/2007, "Ashraf Al-Basti" <Ashraf.Albasti@jt.net.jo> piše:
Dear All, i want to setup a freeradius as a proxy radius for a wholesale, and want to limit the access by using the calling-station-id; so user1@isp1 can connect only from any calling-station-id that belong to isp1, (ex, 555111, 333222) and user2@isp2 can connect only from any calling-station-id that belong to isp2.... i have all the calling station id which belong to the ISPs, but i didnt have the username for every ISP, and want to use the realm instead of the username to do that. can i use the checkval to check for the calling-station-id and realm, or is there anyway to do that?
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Try User-Name =~ '@isp1realm$' instead of Realm. Realm attribute might not work in preprocess as it's not set yet. You can use unlang to check for multiple values in 2.0 but I don't know how to implement this function in SQL in 1.1.x. Ivan Kalik Kalik Informatika ISP Dana 16/9/2007, "Ashraf Al-Basti" <Ashraf.Albasti@jt.net.jo> piše:
Dear, i have added this to huntgroups but nothing happened; if i want to use mysql database as a backend is there any way to do that?
tnt@kalik.co.yu wrote:
You can use huntgroups:
isp1 Realm == isp1realm Calling-Statin-Id = numbe1, Calling Station-Id = number2
Ivan Kalik Kalik Informatika ISP
Dana 13/9/2007, "Ashraf Al-Basti" <Ashraf.Albasti@jt.net.jo> piše:
Dear All, i want to setup a freeradius as a proxy radius for a wholesale, and want to limit the access by using the calling-station-id; so user1@isp1 can connect only from any calling-station-id that belong to isp1, (ex, 555111, 333222) and user2@isp2 can connect only from any calling-station-id that belong to isp2.... i have all the calling station id which belong to the ISPs, but i didnt have the username for every ISP, and want to use the realm instead of the username to do that. can i use the checkval to check for the calling-station-id and realm, or is there anyway to do that?
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/usershtml
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (5)
-
Alan DeKok -
Ashraf Al-Basti -
inverse -
mallika -
tnt＠kalik.co.yu