More certificate trouble
I've been getting trouble using freeradius with certificate validation, and until now have been running without this option selected in a test environment, however even with validation unselected I'm still having trouble connecting clients, with the debug output showing the below warning: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0xd8b9e275d8bcfbd1 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! So I decided to blitz the certificates and try and start afresh, following Alan's documentation on the http://deployingradius.com/documents/configuration/certificates.html webpage, and have hit a few issues along the way which I can't explain. Firstly, even when using the snake oil certificates I cannot get the radius service to start without manually entering the PEM password, why isn't this happening automatically? Secondly, I've successfully created the certificates after entering the information in server.cnf and ca.cnf, then running the make command, but I'm still seeing the certificate compatibility warning on my Windows client, even with the validate server box unchecked. debug files attached. Thanks for any help, Andi ________________________________
From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>
Ar Dachwedd y 1af 2011 newidiodd UWIC ei henw i Brifysgol Fetropolitan Caerdydd. O Ragfyr 6ed, fel rhan o'r newid yma, bydd pob cyfeiriad e-bost sy'n cynnwys @uwic.ac.uk yn newid i @cardiffmet.ac.uk. Bydd yr holl ebyst a ddanfonir o Brifysgol Fetropolitan Caerdydd yn cael eu danfon o‘r cyfeiriad @cardiffmet.ac.uk newydd. Gwnewch yn siwr eich bod yn diweddaru eich cofnodion cyswllt a'ch cronfeydd data i adlewyrchu hyn. Gellir cael rhagor o wybodaeth ar y wefan yma.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>
Hi Andi, 1st I am no expert .For your first Q , private_key_password= "your pass" is missing from your eap.conf under tls section may be this is why you have to enter the password manually. This is how my tls section is tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/private.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" } Try the configuration. This is the default one except private_key_file name changed. Regards, Prateek
hi, ensure that the eap.conf is configured with the right files and has the right pass-phrase defined. ensure that the process that radiusd runs at has access to those files/directories (file permissions) the default Makefile will generate certs that work - you just need to edit the .cnf files for values that you like/need (server name, expiration/lifetime). ensure that all old stuff (serial, .pem/.cer/.der etc are deleted before re-running alan
hi, your config file also has lots of ^Ms at the end of each line - the sure sign its been touched by a windows box... use 'dos2unix' to clean up your config files alan
Cheers all, Alan, the log I sent was taken from a putty log, so it's likely had some windows tampering. The linux files have only been edited in vi. The information given by Prateek has helped me sort out the pem file issue, but I'm still getting rejected clients with the certificate compatibility warning. Should I be using .key files, or .pem for the ca? Cheers, Andi ________________________________________ From: freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org [freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org] on behalf of alan buxey [A.L.M.Buxey@lboro.ac.uk] Sent: 19 July 2012 12:28 To: FreeRadius users mailing list Subject: Re: More certificate trouble hi, your config file also has lots of ^Ms at the end of each line - the sure sign its been touched by a windows box... use 'dos2unix' to clean up your config files alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx> Ar Dachwedd y 1af 2011 newidiodd UWIC ei henw i Brifysgol Fetropolitan Caerdydd. O Ragfyr 6ed, fel rhan o'r newid yma, bydd pob cyfeiriad e-bost sy'n cynnwys @uwic.ac.uk yn newid i @cardiffmet.ac.uk. Bydd yr holl ebyst a ddanfonir o Brifysgol Fetropolitan Caerdydd yn cael eu danfon o‘r cyfeiriad @cardiffmet.ac.uk newydd. Gwnewch yn siwr eich bod yn diweddaru eich cofnodion cyswllt a'ch cronfeydd data i adlewyrchu hyn. Gellir cael rhagor o wybodaeth ar y wefan yma.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>
Hi,
The information given by Prateek has helped me sort out the pem file issue, but I'm still getting rejected clients with the certificate compatibility warning. Should I be using .key files, or .pem for the ca?
for the CA - we use CRT files - which are x509 format files the client needs to have the cA in its certificate store....so for Windows you need to ensure that it has been put into the correct part of the certificate store (use the certmgr tool) alan
OK thanks. I'm still not sure why I'm getting rejected despite not having the validate server box ticked on my windows client though. Cheers, Andi -----Original Message----- From: freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org [mailto:freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org] On Behalf Of alan buxey Sent: 19 July 2012 13:47 To: FreeRadius users mailing list Subject: Re: More certificate trouble Hi,
The information given by Prateek has helped me sort out the pem file issue, but I'm still getting rejected clients with the certificate compatibility warning. Should I be using .key files, or .pem for the ca?
for the CA - we use CRT files - which are x509 format files the client needs to have the cA in its certificate store....so for Windows you need to ensure that it has been put into the correct part of the certificate store (use the certmgr tool) alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx> Ar Dachwedd y 1af 2011 newidiodd UWIC ei henw i Brifysgol Fetropolitan Caerdydd. O Ragfyr 6ed, fel rhan o'r newid yma, bydd pob cyfeiriad e-bost sy'n cynnwys @uwic.ac.uk yn newid i @cardiffmet.ac.uk. Bydd yr holl ebyst a ddanfonir o Brifysgol Fetropolitan Caerdydd yn cael eu danfon o‘r cyfeiriad @cardiffmet.ac.uk newydd. Gwnewch yn siwr eich bod yn diweddaru eich cofnodion cyswllt a'ch cronfeydd data i adlewyrchu hyn. Gellir cael rhagor o wybodaeth ar y wefan yma.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>
Hi Andi, Sometimes this happens due to packet drop.Bring your sta near to AP & then test. Reagrds, Prateek
Thanks, but this is connected with a wire. I've since found a complete version of eap.conf on the freeradiusd wiki which has helped with all the extra variables required. My server was preconfigured and lots of the extra options had been removed. Still not completely working, but I'm a little wiser on the subject anyway. Cheers, Andi From: freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org [mailto:freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org] On Behalf Of Prateek Kumar Sent: 19 July 2012 14:44 To: FreeRadius users mailing list Subject: Re: More certificate trouble Hi Andi, Sometimes this happens due to packet drop.Bring your sta near to AP & then test. Reagrds, Prateek ________________________________
From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>
Ar Dachwedd y 1af 2011 newidiodd UWIC ei henw i Brifysgol Fetropolitan Caerdydd. O Ragfyr 6ed, fel rhan o'r newid yma, bydd pob cyfeiriad e-bost sy'n cynnwys @uwic.ac.uk yn newid i @cardiffmet.ac.uk. Bydd yr holl ebyst a ddanfonir o Brifysgol Fetropolitan Caerdydd yn cael eu danfon o'r cyfeiriad @cardiffmet.ac.uk newydd. Gwnewch yn siwr eich bod yn diweddaru eich cofnodion cyswllt a'ch cronfeydd data i adlewyrchu hyn. Gellir cael rhagor o wybodaeth ar y wefan yma.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>
Hi,
I’ve since found a complete version of eap.conf on the freeradiusd wiki which has helped with all the extra variables required. My server was preconfigured and lots of the extra options had been removed. Still not completely working, but I’m a little wiser on the subject anyway.
the source tarball from freeradius.org - eg freeradius-server-2.1.12.tar.gz has the definitive eap.conf I'd strongly suggest getting hold of it and usingits provided raddb directory contents as the main reference - as a config file that gets butchered is a pain to recover from and doesnt let you know all the things you are missing.. alan
participants (3)
-
alan buxey -
Morris, Andi -
Prateek Kumar