Hello, I have a question I can't seem to answer with the mail archives or documentation. Let me begin by explaining what I'm trying to do: - PEAP/MSCHAPv2 authentication, no client certificates, with a WinXP supplicant. - The server certificate is self-signed.
From the FAQ, I have:
- Installed the hot fix from MS KB 885453 - Included the required OID 1.3.6.1.5.5.7.3.1 in the server certificate - Followed MS requirements for server certificates in KB 814394 The only way I can get this setup to work, is if I import my root certificate onto my client machine. Otherwise, I get the typical Access-Request and Access-Challenge back and forth. My question: Is importing the root certificate onto your client necessary when self-signing your own server certificate? If not, then I guess I'm still doing something wrong, but I would like to make sure before I continue to troubleshoot. Any help is greatly appreciated. Regards, Damian Davalos
Damian Davalos wrote:
The only way I can get this setup to work, is if I import my root certificate onto my client machine. Otherwise, I get the typical Access-Request and Access-Challenge back and forth.
Yes.
My question: Is importing the root certificate onto your client necessary when self-signing your own server certificate?
Yes. The EAP-TLS "howto" PDF on the web site includes this step. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Hi, what means plaese this : There appears to be another RADIUS server running on the authentication port 1812. what i can do ? and i don´t found process radiud ? output of ps auxf: [root@Vigor207 radius]# ps auxf USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.2 2032 620 ? Ss 10:13 0:02 init [5] root 2 0.0 0.0 0 0 ? S 10:13 0:00 [migration/0] root 3 0.0 0.0 0 0 ? SN 10:13 0:00 [ksoftirqd/0] root 4 0.0 0.0 0 0 ? S 10:13 0:00 [watchdog/0] root 5 0.0 0.0 0 0 ? S< 10:13 0:00 [events/0] root 6 0.0 0.0 0 0 ? S< 10:13 0:00 [khelper] root 7 0.0 0.0 0 0 ? S< 10:13 0:00 [kthread] root 10 0.0 0.0 0 0 ? S< 10:13 0:00 \_ [kblockd/0] root 11 0.0 0.0 0 0 ? S< 10:13 0:00 \_ [kacpid] root 73 0.0 0.0 0 0 ? S< 10:13 0:00 \_ [cqueue/0] root 76 0.0 0.0 0 0 ? S< 10:13 0:00 \_ [khubd] root 78 0.0 0.0 0 0 ? S< 10:13 0:00 \_ [kseriod] root 130 0.0 0.0 0 0 ? S 10:13 0:00 \_ [pdflush] root 131 0.0 0.0 0 0 ? S 10:13 0:02 \_ [pdflush] root 132 0.0 0.0 0 0 ? S< 10:13 0:00 \_ [kswapd0] root 133 0.0 0.0 0 0 ? S< 10:13 0:00 \_ [aio/0] root 287 0.0 0.0 0 0 ? S< 10:13 0:00 \_ [kpsmoused] root 308 0.0 0.0 0 0 ? S< 10:13 0:00 \_ [kmirrord] root 318 0.0 0.0 0 0 ? S< 10:13 0:00 \_ [kjournald] root 344 0.0 0.0 0 0 ? S< 10:14 0:00 \_ [kauditd] root 807 0.0 0.0 0 0 ? S< 10:14 0:00 \_ [kgameportd] root 1239 0.0 0.0 0 0 ? S< 10:14 0:00 \_ [kmpathd/0] root 1263 0.0 0.0 0 0 ? S< 10:14 0:00 \_ [kjournald] root 370 0.0 0.1 2908 456 ? S<s 10:14 0:01 /sbin/udevd -d root 1624 0.0 0.1 2276 340 ? Ss 10:14 0:00 /sbin/dhclient -1 -q -lf /var/lib/dhcli root 1694 0.0 0.1 8348 484 ? Ss 10:14 0:00 /usr/sbin/restorecond root 1703 0.0 0.2 1792 712 ? Ss 10:14 0:00 syslogd -m 0 root 1706 0.0 0.1 1640 400 ? Ss 10:14 0:00 klogd -x root 1729 0.0 0.1 2124 384 ? Ss 10:14 0:00 mcstransd rpc 1740 0.0 0.2 1772 544 ? Ss 10:14 0:00 portmap root 1759 0.0 0.3 1888 792 ? Ss 10:14 0:00 rpc.statd root 1788 0.0 0.2 4928 556 ? Ss 10:14 0:00 rpc.idmapd dbus 1802 0.1 0.5 13644 1364 ? Ssl 10:14 0:25 dbus-daemon --system root 1812 0.0 0.2 2344 660 ? Ss 10:14 0:00 hcid: processing events root 1824 0.0 0.1 1712 368 ? Ss 10:14 0:00 /usr/sbin/sdpd root 1836 0.0 0.0 0 0 ? S< 10:14 0:00 [krfcommd] root 1870 0.0 0.2 33176 608 ? Ssl 10:14 0:00 pcscd root 1888 0.0 0.1 1876 352 ? Ss 10:14 0:00 /usr/bin/hidd --server root 1905 0.0 0.2 9036 744 ? Ssl 10:14 0:00 automount root 1922 0.0 0.1 1640 436 ? Ss 10:14 0:00 /usr/sbin/acpid root 1931 0.0 0.1 5056 488 ? Ss 10:14 0:00 ./hpiod root 1936 0.0 0.5 12840 1408 ? S 10:14 0:00 python ./hpssd.py root 1942 0.0 0.4 4484 1032 ? S 10:14 0:00 /bin/sh /usr/local/mvts/bin/mp_kerneld. root 2012 0.0 0.9 34220 2344 ? S 10:15 0:00 \_ /usr/local/mvts/./bin/mp_kerneld.x root 2013 0.0 0.9 34220 2344 ? S 10:15 0:00 \_ /usr/local/mvts/./bin/mp_kernel root 2014 0.0 0.9 34220 2344 ? S 10:15 0:00 \_ /usr/local/mvts/./bin/mp_ke root 2015 0.0 0.9 34220 2344 ? S 10:15 0:00 \_ /usr/local/mvts/./bin/mp_ke root 2016 0.0 0.9 34220 2344 ? S 10:15 0:00 \_ /usr/local/mvts/./bin/mp_ke root 2017 0.0 0.9 34220 2344 ? S 10:15 0:00 \_ /usr/local/mvts/./bin/mp_ke root 2019 0.0 0.9 34220 2344 ? R 10:15 0:01 \_ /usr/local/mvts/./bin/mp_ke root 2023 0.0 0.9 34220 2344 ? S 10:15 0:00 \_ /usr/local/mvts/./bin/mp_ke root 2024 0.0 0.9 34220 2344 ? S 10:15 0:00 \_ /usr/local/mvts/./bin/mp_ke root 2025 0.0 0.9 34220 2344 ? S 10:15 0:00 \_ /usr/local/mvts/./bin/mp_ke root 2026 0.0 0.9 34220 2344 ? S 10:15 0:00 \_ /usr/local/mvts/./bin/mp_ke root 2027 0.0 0.9 34220 2344 ? S 10:15 0:00 \_ /usr/local/mvts/./bin/mp_ke root 1953 0.0 0.5 9980 1328 ? Ss 10:14 0:00 cupsd root 1963 0.0 0.2 5168 708 ? Ss 10:14 0:00 /usr/sbin/sshd root 2028 0.0 0.4 8508 1112 ? Ss 10:15 0:00 sendmail: accepting connections smmsp 2037 0.0 0.3 7564 860 ? Ss 10:15 0:00 sendmail: Queue runner@01:00:00 for /va root 2047 0.0 0.1 1864 332 ? Ss 10:15 0:00 gpm -m /dev/input/mice -t exps2 root 2056 0.0 0.4 5224 1032 ? Ss 10:15 0:00 crond xfs 2087 0.0 0.6 3752 1656 ? Ss 10:15 0:00 xfs -droppriv -daemon root 2104 0.0 0.1 2204 388 ? Ss 10:15 0:00 /usr/sbin/atd root 2118 33.6 18.3 60820 46880 ? S 10:15 116:27 /usr/bin/python /usr/sbin/yum-updatesd avahi 2128 0.0 0.4 2864 1200 ? Ss 10:15 0:02 avahi-daemon: running [Vigor207.local] avahi 2129 0.0 0.0 2864 168 ? Ss 10:15 0:00 \_ avahi-daemon: chroot helper process 68 2138 0.0 0.7 5756 1952 ? Ss 10:15 0:10 hald root 2139 0.0 0.3 3332 1008 ? S 10:15 0:00 \_ hald-runner 68 2145 0.0 0.3 2292 808 ? S 10:15 0:00 \_ hald-addon-acpi: listening on a 68 2153 0.0 0.3 2292 836 ? S 10:15 0:00 \_ hald-addon-keyboard: listening root 2162 0.0 0.2 2244 664 ? S 10:15 0:06 \_ hald-addon-storage: polling /de root 2164 0.0 0.2 2248 664 ? S 10:15 0:00 \_ hald-addon-storage: polling /de root 2236 0.0 0.1 1952 448 ? S 10:15 0:00 /usr/sbin/smartd -q never root 2241 0.0 0.1 1624 376 tty1 Ss+ 10:15 0:00 /sbin/mingetty tty1 root 2242 0.0 0.1 1624 376 tty2 Ss+ 10:15 0:00 /sbin/mingetty tty2 root 2243 0.0 0.1 1624 376 tty3 Ss+ 10:15 0:00 /sbin/mingetty tty3 root 2244 0.0 0.1 1624 376 tty4 Ss+ 10:15 0:00 /sbin/mingetty tty4 root 2245 0.0 0.1 1624 396 tty5 Ss+ 10:15 0:00 /sbin/mingetty tty5 root 2246 0.0 0.1 1624 376 tty6 Ss+ 10:15 0:00 /sbin/mingetty tty6 root 2247 0.0 0.4 4484 1024 ? Ss 10:15 0:00 /bin/sh /etc/X11/prefdm -nodaemon root 2273 0.0 1.1 16752 2892 ? S 10:15 0:00 \_ /usr/sbin/gdm-binary -nodaemon root 2337 0.0 0.8 15980 2092 ? S 10:15 0:00 \_ /usr/sbin/gdm-binary -nodaemon root 2344 3.3 7.4 26192 19036 tty7 Ss+ 10:15 11:41 \_ /usr/bin/Xorg :0 -audit 0 - root 2378 0.0 2.7 23144 7128 ? Ss 10:15 0:00 \_ /usr/bin/gnome-session root 2430 0.0 0.1 4284 488 ? Ss 10:15 0:00 \_ /usr/bin/ssh-agent /usr root 2341 0.0 0.3 16752 844 ? S 10:15 0:00 /usr/sbin/gdm-binary -nodaemon root 2433 0.0 0.2 2816 516 ? S 10:15 0:00 /usr/bin/dbus-launch --exit-with-sessio root 2434 0.0 0.5 13380 1324 ? Ssl 10:15 0:00 /bin/dbus-daemon --fork --print-pid 8 - root 2441 0.0 1.6 7940 4104 ? S 10:15 0:02 /usr/libexec/gconfd-2 5 root 2444 0.0 0.2 2536 568 ? S 10:15 0:00 /usr/bin/gnome-keyring-daemon root 2446 0.0 3.1 34148 8000 ? Sl 10:15 0:03 /usr/libexec/gnome-settings-daemon root 2463 0.1 3.6 18236 9236 ? Ss 10:15 0:33 metacity --sm-client-id=default1 root 2466 0.0 2.4 45868 6360 ? Ss 10:15 0:08 gnome-power-manager root 2468 0.0 5.5 50196 14200 ? Ss 10:15 0:07 gnome-panel --sm-client-id default2 root 2470 0.0 6.4 88412 16452 ? Ss 10:15 0:05 nautilus --no-default-window --sm-clien root 2475 0.0 1.1 38624 2960 ? Ssl 10:15 0:00 /usr/libexec/bonobo-activation-server - root 2478 0.0 3.1 44956 8152 ? Ss 10:15 0:00 eggcups --sm-client-id default4 root 2482 0.0 1.1 11216 2996 ? S 10:15 0:00 /usr/libexec/gnome-vfs-daemon root 2484 0.0 1.2 15692 3160 ? Ss 10:15 0:00 bluez-pin --dbus root 2501 0.0 3.5 46060 9156 ? Ss 10:15 0:00 nm-applet --sm-disable root 2504 0.0 0.6 16344 1688 ? Sl 10:15 0:00 ./escd --key_Inserted="/usr/bin/esc" -- root 2506 0.0 0.0 0 0 ? Z 10:15 0:00 \_ [netstat] <defunct> root 2510 0.0 1.8 15232 4672 ? Ss 10:15 0:00 pam-panel-icon --sm-client-id default0 root 2514 0.0 0.2 1804 640 ? S 10:15 0:00 \_ /sbin/pam_timestamp_check -d root root 2522 0.0 0.4 2520 1140 ? S 10:16 0:00 /usr/libexec/gam_server root 2533 0.0 4.1 47704 10612 ? S 10:16 0:12 /usr/libexec/wnck-applet --oaf-activate root 2535 0.0 3.4 76636 8704 ? S 10:16 0:00 /usr/libexec/trashapplet --oaf-activate root 2543 0.0 0.3 2436 828 ? S 10:16 0:00 /usr/libexec/mapping-daemon root 2565 0.0 2.9 23236 7640 ? S 10:16 0:00 /usr/libexec/notification-area-applet - root 2567 0.0 3.7 28452 9536 ? S 10:16 0:00 /usr/libexec/clock-applet --oaf-activat root 2569 0.0 4.4 48772 11316 ? S 10:16 0:00 /usr/libexec/mixer_applet2 --oaf-activa root 2574 0.0 1.4 16636 3788 ? Ss 10:16 0:04 gnome-screensaver root 2585 0.3 6.6 66608 17096 ? Sl 10:21 1:16 gnome-terminal root 2590 0.0 0.2 2444 684 ? S 10:21 0:00 \_ gnome-pty-helper root 2591 0.0 0.5 4624 1460 pts/1 Ss 10:21 0:00 \_ bash root 1483 0.8 8.3 60600 21352 pts/1 S 15:35 0:12 | \_ gedit radius.log root 1583 0.0 0.3 4188 920 pts/1 R+ 16:01 0:00 | \_ ps auxf root 1464 0.0 0.5 4624 1532 pts/2 Ss+ 15:32 0:01 \_ bash root 1535 0.0 0.5 4624 1448 pts/3 Ss+ 15:52 0:00 \_ bash root 2667 0.0 3.4 40572 8912 ? S 10:41 0:02 /usr/libexec/notification-daemon root 1210 0.0 0.4 4436 1076 ? S 14:08 0:00 /bin/sh /usr/lib/firefox-1.5.0.7/firefo root 1219 0.0 0.4 4440 1096 ? S 14:08 0:00 \_ /bin/sh /usr/lib/firefox-1.5.0.7/ru root 1224 1.6 18.8 156488 48048 ? Sl 14:08 1:51 \_ /usr/lib/firefox-1.5.0.7/firefo Abdelghani ELMALHI Devesestr. 1 45897 Gelsenkirchen Deutschland Tel. 00 49 176 65 84 38 50 --------------------------------- Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses.
what means plaese this :
There appears to be another RADIUS server running on the authentication port 1812.
what i can do ? and i don´t found process radiud ?
output of ps auxf:
Jeez. What a process table. And not at all relevant concerning port usage. try netstat -tunelup which gives you all the ports your machine listens on and the process doing it. (Linux at least, don't know about others). Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter@restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473
Hi, please reply to the list. And if you do contact me personally, my list of preferred languages is German, Luxembourgish, English, French, Spanish. French is fairly low down on this list, and may result in unexpected misunderstandings. Comments inline below. ------------------ rebonjour monsieur, quand j´ ai donner la commande netstat -tunelup, voial la r´eponse : [root@Vigor207 raddb]# netstat -tunelup Aktive Internetverbindungen (Nur Server) Proto Recv-Q Send-Q Local Address Foreign Address State Benutzer Inode PID/Program name [...] udp 0 0 192.168.100.207:1812 0.0.0.0:* 0 7223 2012/mp_kerneld.x udp 0 0 192.168.100.207:1813 0.0.0.0:* 0 7224 2012/mp_kerneld.x udp 0 0 192.168.100.207:1814 0.0.0.0:* 0 7225 2012/mp_kerneld.x [...] There you are. Some program named mp_kerneld.x is occupying the port. That's why freeradius won't start. Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter@restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473
# netstat -tunelup Aktive Internetverbindungen (Nur Server) Proto Recv-Q Send-Q Local Address Foreign Address State Benutzer Inode PID/Program name [...] udp 0 0 192.168.100.207:1812 0.0.0.0:* 0 7223 2012/mp_kerneld.x udp 0 0 192.168.100.207:1813 0.0.0.0:* 0 7224 2012/mp_kerneld.x udp 0 0 192.168.100.207:1814 0.0.0.0:* 0 7225 2012/mp_kerneld.x [...]
There you are. Some program named mp_kerneld.x is occupying the port. That's why freeradius won't start.
See this Thread: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg33532.h tml HTH, Thibault
Hi Damian, I have configured freeradius for PEAP/MSCHAPv2 authentication, no client certificates, with a WinXP supplicant. When i created the certificates i studied these guides : http://www.linuxjournal.com/article/8095 , http://www.linuxjournal.com/article/8151. I copied the server certificate to the radius server as the guide said , and some other files like dh , random. I did not make client certificates. In PEAP/MSCHAPv2 authentication client certificates are not necessary. On Thu, 2007-03-22 at 15:30 -0700, Damian Davalos wrote:
Hello,
I have a question I can't seem to answer with the mail archives or documentation.
Let me begin by explaining what I'm trying to do:
- PEAP/MSCHAPv2 authentication, no client certificates, with a WinXP supplicant. - The server certificate is self-signed.
From the FAQ, I have:
- Installed the hot fix from MS KB 885453 - Included the required OID 1.3.6.1.5.5.7.3.1 in the server certificate - Followed MS requirements for server certificates in KB 814394
The only way I can get this setup to work, is if I import my root certificate onto my client machine. Otherwise, I get the typical Access-Request and Access-Challenge back and forth.
My question: Is importing the root certificate onto your client necessary when self-signing your own server certificate?
If not, then I guess I'm still doing something wrong, but I would like to make sure before I continue to troubleshoot.
Any help is greatly appreciated.
Regards,
Damian Davalos
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
___________________________________________________________ Inbox full of spam? Get leading spam protection and 1GB storage with All New Yahoo! Mail. http://uk.docs.yahoo.com/nowyoucan.html
participants (6)
-
Alan DeKok -
apolyxrono -
Damian Davalos -
elmalhi abdelghani -
Stefan Winter -
Thibault Le Meur