HOWTO PEAP + FreeRadius + XP Client
George KNIGHT
georgeknight at gmail.com
Thu May 1 00:21:34 CEST 2008
Allan,
I thank you for your advice and your time.
A person like you who is dealing with freeradius on a daily basis may have a
tendency of thinking that using/installing/troubleshooting freeradius is
very easy. But for a complete new beginner, like myself, things seem more
complicated. I'll give an example from my own experience; 3 years ago when I
started as a network admin in my company, it took me almost 10 days to
figure out how to properly instal apache/mysql/php on a linux box. Now, it
takes me under 15 minutes to install them all. I wrote a step-by-step
instruction for the process at the time and distributed to everyone on the
net. Based on the feedback I got from people, everyone seems to agree that
it provided them a simple and easy to follow steps for the installation. I
felt happy that I helped other people the way that I was helped at all the
time through different forums on the internet.
When I started implementing the FreeRadius, I thought I would find some
documentation to start with. But unfortunately, after spending days, i
couldn't find such a document. The more I read, the more i surprised that I
couldn't figure this out. I know that it shouldn't be much difficult but
here I am still struggling to make this work.
I don't want to take your and other people's valuable time any more, so here
is where I am now;
I installed the FreeRadous 2.0.2 with Yast tool with SuSE SLES. It installed
it OK. And then i made changes to eap.conf and radiusd.conf files to start
my test. I run radiusd -X and here is what I got;
# radiusd -X
FreeRADIUS Version 2.0.2, for host i686-suse-linux-gnu, built on Feb 14 2008
at 15:34:49
Copyright (C) 1999-2008 The FreeRADIUS server project and contributors.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License.
Starting - reading configuration files ...
including configuration file /etc/raddb/radiusd.conf
including configuration file /etc/raddb/proxy.conf
including configuration file /etc/raddb/clients.conf
including configuration file /etc/raddb/snmp.conf
including configuration file /etc/raddb/eap.conf
including configuration file /etc/raddb/sql.conf
including configuration file /etc/raddb/sql/mysql/dialup.conf
including configuration file /etc/raddb/sql/mysql/counter.conf
including configuration file /etc/raddb/policy.conf
including files in directory /etc/raddb/sites-enabled/
including configuration file /etc/raddb/sites-enabled/default
including dictionary file /etc/raddb/dictionary
main {
prefix = "/usr"
localstatedir = "/var"
logdir = "/var/log/radius"
libdir = "/usr/lib/freeradius"
radacctdir = "/var/log/radius/radacct"
hostname_lookups = no
max_request_time = 30
cleanup_delay = 5
max_requests = 1024
allow_core_dumps = no
pidfile = "/var/run/radiusd/radiusd.pid"
user = "radiusd"
group = "radiusd"
checkrad = "/usr/sbin/checkrad"
debug_level = 0
proxy_requests = yes
security {
max_attributes = 200
reject_delay = 1
status_server = yes
}
}
client localhost {
ipaddr = 127.0.0.1
require_message_authenticator = no
secret = "testing123"
nastype = "other"
}
client 10.10.30.3 {
require_message_authenticator = no
secret = "testing123"
shortname = "10.10.30.3"
nastype = "cisco"
}
radiusd: #### Loading Realms and Home Servers ####
proxy server {
retry_delay = 5
retry_count = 3
default_fallback = no
dead_time = 120
wake_all_if_all_dead = no
}
home_server localhost {
ipaddr = 127.0.0.1
port = 1812
type = "auth"
secret = "testing123"
response_window = 20
max_outstanding = 65536
zombie_period = 40
status_check = "status-server"
ping_check = "none"
ping_interval = 30
check_interval = 30
num_answers_to_alive = 3
num_pings_to_alive = 3
revive_interval = 120
status_check_timeout = 4
}
home_server_pool my_auth_failover {
type = fail-over
home_server = localhost
}
realm example.com {
auth_pool = my_auth_failover
}
realm LOCAL {
}
radiusd: #### Instantiating modules ####
instantiate {
Module: Linked to module rlm_exec
Module: Instantiating exec
exec {
wait = yes
input_pairs = "request"
shell_escape = yes
}
Module: Linked to module rlm_expr
Module: Instantiating expr
Module: Linked to module rlm_expiration
Module: Instantiating expiration
expiration {
reply-message = "Password Has Expired "
}
Module: Linked to module rlm_logintime
Module: Instantiating logintime
logintime {
reply-message = "You are calling outside your allowed timespan "
minimum-timeout = 60
}
}
radiusd: #### Loading Virtual Servers ####
server {
modules {
Module: Checking authenticate {...} for more modules to load
Module: Linked to module rlm_pap
Module: Instantiating pap
pap {
encryption_scheme = "auto"
auto_header = no
}
Module: Linked to module rlm_chap
Module: Instantiating chap
Module: Linked to module rlm_mschap
Module: Instantiating mschap
mschap {
use_mppe = yes
require_encryption = no
require_strong = no
with_ntdomain_hack = no
}
Module: Linked to module rlm_unix
Module: Instantiating unix
unix {
radwtmp = "/var/log/radius/radwtmp"
}
Module: Linked to module rlm_eap
Module: Instantiating eap
eap {
default_eap_type = "peap"
timer_expire = 60
ignore_unknown_eap_types = no
cisco_accounting_username_bug = no
}
Module: Linked to sub-module rlm_eap_md5
Module: Instantiating eap-md5
Module: Linked to sub-module rlm_eap_leap
Module: Instantiating eap-leap
Module: Linked to sub-module rlm_eap_gtc
Module: Instantiating eap-gtc
gtc {
challenge = "Password: "
auth_type = "PAP"
}
Module: Linked to sub-module rlm_eap_tls
Module: Instantiating eap-tls
tls {
rsa_key_exchange = no
dh_key_exchange = yes
rsa_key_length = 512
dh_key_length = 512
verify_depth = 0
pem_file_type = yes
private_key_file = "/etc/raddb/certs/server.pem"
certificate_file = "/etc/raddb/certs/server.pem"
CA_file = "/etc/raddb/certs/ca.pem"
private_key_password = "whatever"
dh_file = "/etc/raddb/certs/dh"
random_file = "/etc/raddb/certs/random"
fragment_size = 1024
include_length = yes
check_crl = no
cipher_list = "DEFAULT"
make_cert_command = "/etc/raddb/certs/bootstrap"
}
rlm_eap: SSL error error:0200100D:system library:fopen:Permission denied
rlm_eap_tls: Error reading certificate file /etc/raddb/certs/server.pem
rlm_eap: Failed to initialize type tls
/etc/raddb/eap.conf[17]: Instantiation failed for module "eap"
/etc/raddb/sites-enabled/default[252]: Failed to find module "eap".
/etc/raddb/sites-enabled/default[199]: Errors parsing authenticate section.
}
}
Errors initializing modules
comp-010:/home/srn #
This is one.
And other thing is that the command bootstrap couldn't finish creating
certificates. How may I solve this problem. And if finish creating
certs successfully, which certificates should I install to the XP SP2 client
and where? You suggested to read the file at
http://freeradius.org/doc/EAPTLS.pdf but believe me it didn't help me. And
it also gives information for TLS implementation. NOthing for PEAP.
I hope I am not asking silly questions that would make you feel like you are
wasting your time.
Thank you.
George Knight
On Tue, Apr 29, 2008 at 3:03 PM, Alan DeKok <aland at deployingradius.com>
wrote:
> George KNIGHT wrote:
> > Before I write my question here, I just want to let all of you know that
> > I did lots of searching in both google and this email list. But couldn't
> > find anything to get the answer.
> >
> > My question is I have been looking for a HOWTO paper for a beginner to
> > set freeradius as an AAA server in a wireless environment to Windows XP
> > SP2 clients. I will use Windows' own PEAP client. Is there such a paper
> > someone can give me the link?
>
> $ ./configure
> $ make
> $ make install
> $ radiusd -X
>
> - Un-check "verify server certificate" in Windows (ONLY for testing).
>
> - Add a user to the database (username/password, example in the FAQ)
>
> That's it.
>
> > I'm very frustrated to find out that there is no information available
> > for a setup from the scratch.
>
> Part of the problem is that in 2.0, there is so little to do...
>
> > I wrote papers like that before for
> > various topics such as subversion implementation for a multiple OS
> > environment, VoIP implementation with a Linux based open sources S/W
> > etc. I have intention to write such a paper for how to set up PEAP
> > implementation with freeradius as well. But for that, I'm hoping someone
> > can give me a good start.
>
> The EAP-TLS "howtos" contain additional documentation:
>
> http://freeradius.org/doc/
>
> > Clients are going to be computers with WinCE as their OS and they will
> > contact to the LAN wirelessly. What I want to achieve is authenticating
> > this clients with server-AAA using PEAP before letting them use the
> > other network resources.
>
> Install 2.0, start the server.
>
> See also raddb/certs/README. You can create "real" certificates, and
> import them into WinCE.
>
> There is very, very, little to change in order to get PEAP to work.
>
> Alan DeKok.
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20080430/0dfcb405/attachment.html>
More information about the Freeradius-Users
mailing list