No. Driver is sql_mysql.c file in src/modules/rlm_sql/drivers/rlm_sql_mysql/ folder of your distribution. You will need to edit the source file and recompile to have freeradius mysql client ask for a SSL connection. Ivan Kalik Kalik Informatika ISP Dana 9/6/2008, "Anders Holm" <anders.holm@sysadmin.ie> piše:

Where $driver has a value of rlm_sql_mysql?

//anders

----- Original Message ----- From: "Ivan Kalik" <tnt@kalik.net> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Monday, June 9, 2008 2:51:09 PM GMT +00:00 GMT Britain, Ireland, Portugal Subject: Re: MySQL connection over SSL possible?

You will probably need to adapt the driver with mysql_ssl_set():

http://dev.mysql.com/doc/refman/5.0/en/mysql-ssl-set.html

Ivan Kalik Kalik Informatika ISP

Dana 9/6/2008, "Anders Holm" <anders.holm@sysadmin.ie> piĹĄe:

...

Hi folks.

I'm wondering, would it be possible to encrypt the connection to the backend data store (it being MySQL) using SSL? MySQL would have support for this, but I sppear to not find any documentation for Freeradius on how to set that side up for it .. Any pointers appreciated ..

//anders

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Anders Holm wrote:

So, that's a "yes" .. :)

Yes.

rlm_sql_mysql is the driver, and I'd rather not have my own version running, but would love to see that rolled in, if possible. My only problem with creating a patch and send it in is more that I am not a coder really. I'd be more likely to create more problems then I'd solve .. ;)

There are other options. Alan DeKok.

"There are other options." Yes, I've come up with a few. Would you have others as well? Suggestions are welcome in all cases .. //anders ----- Original Message ----- From: "Alan DeKok" <aland@deployingradius.com> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Monday, June 9, 2008 5:57:48 PM GMT +00:00 GMT Britain, Ireland, Portugal Subject: Re: MySQL connection over SSL possible? Anders Holm wrote:

So, that's a "yes" .. :)

Yes.

rlm_sql_mysql is the driver, and I'd rather not have my own version running, but would love to see that rolled in, if possible. My only problem with creating a patch and send it in is more that I am not a coder really. I'd be more likely to create more problems then I'd solve .. ;)

There are other options. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Hitting "Reply All" in most MUAs would do this. The list should be smart enough to only forward on one copy per recipient ... ALL mails I receive for this list has the list in *both* TO and CC headers ........ //anders ----- Original Message ----- From: "Nicolas Goutte" <nicolas.goutte@extragroup.de> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Wednesday, June 11, 2008 11:15:38 AM GMT +00:00 GMT Britain, Ireland, Portugal Subject: Re: MySQL connection over SSL possible? Please try to avoid to send emails to the list as "TO" *and* as "CC". (I (and probably not only me) get your messages always twice.) Have a nice day! Am 11.06.2008 um 11:31 schrieb Anders Holm:

"There are other options."

Yes, I've come up with a few. Would you have others as well? Suggestions are welcome in all cases ..

//anders

----- Original Message ----- From: "Alan DeKok" <aland@deployingradius.com> To: "FreeRadius users mailing list" <freeradius- users@lists.freeradius.org> Sent: Monday, June 9, 2008 5:57:48 PM GMT +00:00 GMT Britain, Ireland, Portugal Subject: Re: MySQL connection over SSL possible?

Anders Holm wrote:

...

So, that's a "yes" .. :)

Yes.

...

rlm_sql_mysql is the driver, and I'd rather not have my own version running, but would love to see that rolled in, if possible. My only problem with creating a patch and send it in is more that I am not a coder really. I'd be more likely to create more problems then I'd solve .. ;)

There are other options.

Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/ users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/ users.html

Nicolas Goutte extragroup GmbH - Karlsruhe Waldstr. 49 76133 Karlsruhe Germany Geschäftsführer: Stephan Mönninghoff, Hans Martin Kern, Tilman Haerdle Registergericht: Amtsgericht Münster / HRB: 5624 Steuer Nr.: 337/5903/0421 / UstID: DE 204607841 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

<quote> From: you Sender: freeradius-users-bounces... Reply-To: freeradius-users@... To: freeradius-users@ </quote> Yes? That is still for one recipient. Reply-To is where replies to my mail would go. That's set by the MLM (Mailing List Manager) not by my mail client. //anders 2008/6/11 Alan DeKok <aland@deployingradius.com>:

Anders Holm wrote:

...

Hitting "Reply All" in most MUAs would do this. The list should be smart enough to only forward on one copy per recipient ...

It's not. We get 2 copies of every mail you send to the list.

...

ALL mails I receive for this list has the list in *both* TO and CC headers ........

Must be a local mailer thing. I see:

From: you Sender: freeradius-users-bounces... Reply-To: freeradius-users@... To: freeradius-users@

Alan DeKok.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1/ Indeed I did. I did see that in the original mail I replied to. Where that was added is a good question, but I saw it in the mail that was replied to .. I'm saying that this is the way the mail was crafted, as I received it, before replying to it. 2/ Indeed it would be, if it did. Has anyone seen this on any more mails after I responded to the initial request to ask me to stop sending dupes? Yes, this is getting quite off topic .. :) //anders 2008/6/12 Alan DeKok <aland@deployingradius.com>:

This is getting off-topic, but...

Anders Holm wrote:

...

<quote> From: you Sender: freeradius-users-bounces... Reply-To: freeradius-users@... To: freeradius-users@ </quote>

Yes? That is still for one recipient. Reply-To is where replies to my mail would go. That's set by the MLM (Mailing List Manager) not by my mail client.

(1) You said you see the list address in "to" and "cc". There is no "cc" in the default headers. (2) If your mailer is replying to *both* "to" and "reply-to", it's broken.

Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2008/6/12 Nicolas Goutte <nicolas.goutte@extragroup.de>: [snip] For me it has worked since then. I have seen only one of each of your

messages.

Have a nice day!

Excellent! One problem solved, and on to the next one. To get back on topic a tad then so, and to describe my experience with the SSL side of things ... I've managed to get stunnel working happily. A few things of note there though .. A/ It wasn't possible to set port numbers for some reson for the SQL connection. Default port was the only way to get it working. B/ Due to A, what I then did was to create virtual interfaces on the loopback interface, as many needed as there are backend SQL servers. C/ Setup stunnel in client mode on the radius box. Forward each <virtual interface>:3306 to <db_host>:<pick a good port> D/ Setup stunnel on <db_host> in server mode. Forward <all_interfaces>:<your good port> to <localhost>:3306 E/ Change sql.conf to point each sql server to the respective virtual interface... When I tried setting the port number to something different I used "port = <port number>" .. That yielded "cannot connect to server using socket" error when running radiusd in debug mode. So, there's two things to take away from that experience. 1/ SSL would be a great option to add to the MySQL shim. 2/ Ability to change port numbers of the MySQL server. Someone may need it, for some interesting reason. I hope this helps others with similar requirements! If I find the time I'll see if I can brush up enough of my C knowledge to create a patch or two for these things, but no promises. Incidentally, I'm also heading off on vacation for a bit, so it won't be tomorrow.. :) //anders

Sorry for my extremely belated reply (been on vacation so deliberately stayed away from email.. :) ) Yes, connecting to a different port using mysql command line tools did work. Used the exact same settings for host and port etc. so ... I should get the source tree checked out at some stage so I can start having a closer look at the latest code to poke at the SSL bits... It's something I'd like to use myself in the future, opposed to any stunnel or ssh port tricks. Such tricks will just trip any such installation when it's time to replace the database host... I'd rather just have it all in the configuration file and be done with it. //anders -----Original Message----- From: freeradius-users-bounces+anders.holm=sysadmin.ie@lists.freeradius.org [mailto:freeradius-users-bounces+anders.holm=sysadmin.ie@lists.freeradius.or g] On Behalf Of A.L.M.Buxey@lboro.ac.uk Sent: 12 June 2008 18:18 To: FreeRadius users mailing list Subject: Re: MySQL connection over SSL possible? Hi,

When I tried setting the port number to something different I used "port = <port number>" .. That yielded "cannot connect to server using socket" error when running radiusd in debug mode.

So, there's two things to take away from that experience.

whoah. one missing step. did you test this setup was actually operational with a simple bit of mysql client action on the FreeRADIUS box... alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Hi, Can anyone here help me to fix the error below: I run instruction in README such make ca.pem make ca.der make server.pem make server.csr make client.pem and then copy ca.der, client.p12 then I install the certificate into Windows XP. When click the client certificate and it shows "Windows doesn't have enough information to verify this certificate" Server cert in Trusted Root Cert "This certificate has expired or is not yet valid. here the ca.cnf [ ca ] default_ca              = CA_default [ CA_default ] dir                     = ./ certs                   = $dir crl_dir                 = $dir/crl database                = $dir/index.txt new_certs_dir           = $dir certificate             = $dir/ca.pem serial                  = $dir/serial crl                     = $dir/crl.pem private_key             = $dir/ca.key RANDFILE                = $dir/.rand name_opt                = ca_default cert_opt                = ca_default default_days            = 1095 default_crl_days        = 365 default_md              = md5 preserve                = no policy                  = policy_match [ policy_match ] countryName             = match stateOrProvinceName     = match organizationName        = match organizationalUnitName  = optional commonName              = supplied emailAddress            = optional [ policy_anything ] countryName             = optional stateOrProvinceName     = optional localityName            = optional organizationName        = optional organizationalUnitName  = optional commonName              = supplied emailAddress            = optional [ req ] prompt                  = no distinguished_name      = certificate_authority default_bits            = 2048 input_password          = 123 output_password         = 123 x509_extensions         = v3_ca [certificate_authority] countryName             = FR stateOrProvinceName     = Radius localityName            = Somewhere organizationName        = Example Inc. emailAddress            = admin@example.com commonName              = "Certificate Authority" [v3_ca] subjectKeyIdentifier    = hash authorityKeyIdentifier  = keyid:always,issuer:always basicConstraints        = CA:true The only thing I'd changed the ca.cnf, client.cnf, server.cnf were default_days and default_crl_days.