Hi, julien blanc wrote: > hi ! > > I'd like to set up an authentication system (for wireless clients) based > on freeradius. > > I'm using a DC windows 2003 with Active Directory to manage my users and > groups... i know ... its baaaad :-) but i don't have the choice ! > > I have built a linux server (fedora core 5), with freeradius, a kerberos > client, samba and winbind to reach my domain. No problems so far. > > I'd like to authenticate my supplicants with PEAP-MSCHAP v2 and so i > must set up a PKI for the TLS tunnel.
well, you need a server certificate for your FreeRADIUS server. > My problem is here. I don't know how to use certificates in the > freeradius directory: This is some root-CA certificate and its secrete key: > root.pem, root.p12, root.der This is a client cert signed by above root-CA certificate and its secrete key (you only need this when doing EAP-TLS): > cert-clt.pem, cert-clt.p12, cert-clt.der This is a server cert signed by above root-CA certificate and its secrete key (you can use this cert as server certificate of FreeRADIUS): > cert-srv.pem, cert-srv.p12, cert-srv.der The slides on <http://www.dfn.de/content/fileadmin/1Dienstleistungen/Roaming/DFNRoaming-Workshop-20070426-Handout.pdf> page 20ff might help. Googles language tools might be some help :-/ > any advice ... suggestions or anything else ??? As for the passwords of the .p12 files or secret keys: you set them yourself if you did not leave them empty.... On the Windows supplicants you can import the root.pem file. *Check* that this file *does not* contain the private key. It's in ASCII format, so you can look into the file and will see, if it's just the cert or if there is an additional key in the file. If the latter is the case make a copy of that file and remove the key part. Rename the file to .cer or .crt and import the result into Windows supplicants by double clicking or MMCs certificate snap-in. Client certificates are *not* needed for PEAP ms-chapv2. HTH -- Beste Gruesse / Kind Regards Reimer Karlsen-Masur DFN-PKI FAQ: https://www.pki.dfn.de/faqpki -- Dipl.-Inform. Reimer Karlsen-Masur (PKI Team), Phone +49 40 808077-615 DFN-CERT Services GmbH, https://www.dfn-cert.de, Phone +49 40 808077-555 Sitz / Register: Hamburg, AG Hamburg, HRB 88805, Ust-IdNr.: DE 232129737
smime.p7s
Description: S/MIME Cryptographic Signature
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
