eap/tls authentication using smartcard
Hello! Has anyone got eap/tls authentication working with smartcards? I'm trying to do that but I don't get it work. Below is a part of the radiusd log while trying to logon: --> User-Name = KARLSSON JONNY XX --> BUF-Name = FINSIGN CA for Citizen --> subject = /C=FI/O=VRK-FINSIGN Gov. CA/CN=FINSIGN CA for Citizen --> issuer = /C=FI/O=VRK-FINSIGN Gov. CA/CN=FINSIGN CA for Citizen --> verify return:1 chain-depth=0, error=0 --> User-Name = KARLSSON JONNY X --> BUF-Name = KARLSSON JONNY X --> subject = /C=FI/SN=KARLSSON/gn=JONNY/CN=KARLSSON JONNY /serialNumber=X --> issuer = /C=FI/O=VRK-FINSIGN Gov. CA/CN=FINSIGN CA for Citizen --> verify return:1 TLS_accept: SSLv3 read client certificate A rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal handshake_failure TLS Alert read:fatal:handshake failure TLS_accept:failed in SSLv3 read certificate verify A rlm_eap_tls: SSL_read Error 3141:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1037:SSL alert number 40 3141:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:822: Error code is . 5 Error in SSL . 5 rlm_eap_tls: BIO_read Error Error code is . 5 Error in SSL . 5 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok modcall: group authenticate returns ok Delaying request 73 for 1 seconds Finished request 73 Going to the next request Waking up in 3 seconds... [EMAIL PROTECTED] root]# I'm using freeradius-0.9.0, Cisco AP 1230B, and windows xp client. Regards Jonny Karlsson Arcada - Polytechnic - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
problems with certificate auth
Hello! I am using Windows XP client, Cisco 1230B AP, And freeradius-0.9.0 (on redhat 9.0). I am trying to set up certificate authentication to my wireless network with the help of the radius server. I have followed the instructions on http://www.impossiblereflex.com/8021x/eap-tls-HOWTO.htm in detail but I still have a strange problem: When radius server is on and when I'm trying to log in to my wireless lan the radius log give me the following error during the authentication process: . . . rlm_eap_tls: Length Included undefined: before/accept initialization TLS_accept: before/accept initialization Segmentation fault I have included the complete radiusd log file as a file attachment. Has anyone had any similar poblems, and managed to fix it? I would be very grateful if anyone could give me some hints! Regards Jonny Karlsson Arcada - Polytechnic -- [EMAIL PROTECTED] raddb]# radiusd -X -f -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients Using deprecated clients file. Support for this will go away soon. read_config_files: reading realms Using deprecated realms file. Support for this will go away soon. radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 tls: rsa_key_exchange = yes tls: dh_key_exchange = yes tls: rsa_key_length = 1024 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "/trusted-ca-list" tls: pem_file_type = yes tls: private_key_file = "/certificates/test-radius.pem" tls: certificate_file = "/certificates/test-radius.pem" tls: CA_file = "/trusted-ca-list/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/lx/DH" tls: random_file = "/etc/lx/random" tls: fragment_size = 1024 tls: include_length = yes rlm_eap_tls: conf N ctx stored rlm_eap: Loaded and initialized the type tls Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users"
eap/tls on freeradius
Hello! Does anyone know how to implement eap/tls on Freeradius-0.9.0? I have tried older versions allso but I allways get the same error message when starting the radiusd server: "rlm_eap: Failed to link EAP-Type/tls: file not found". I have allso tried to follow the instructions on http://www.impossiblereflex.com/8021x/eap-tls-HOWTO.htm in detail about 4-5 times but it just doesn't work. Does anyone know a better manual for this or can anyone explain to me in detail how I can get it work? I don't understand how it can be so difficult!! I am using RedHat 9.0 as operating system. regards Jonny -- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
