Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-17 Thread Phil Mayers
On 16/01/13 13:34, Ajay Garg wrote: Ping :) Anyone managed to get this working on gnome-applet? :) $ gnome-applet bash: gnome-applet: command not found... You're being way too vague, inconsistent and hand-wavy for me to want to spend any time on this. If you can be *specific* about what

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-17 Thread Ajay Garg
Hmm.. I am not exactly sure what package contains the gnome handle to edit network-settings (in Fedora-14, it was called nm-applet). Thanks !!! On Thu, Jan 17, 2013 at 5:03 PM, Phil Mayers p.may...@imperial.ac.ukwrote: -- Regards, Ajay - List info/subscribe/unsubscribe? See

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-17 Thread Phil Mayers
On 17/01/13 11:52, Ajay Garg wrote: Hmm.. I am not exactly sure what package contains the gnome handle to edit network-settings (in Fedora-14, it was called nm-applet). Ok, then I give up. Maybe someone else is willing to spend time deciphering vagueness, but I'm not. Best of luck. - List

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-16 Thread Ajay Garg
Ping :) Anyone managed to get this working on gnome-applet? :) On Sat, Jan 12, 2013 at 3:37 PM, Ajay Garg ajaygargn...@gmail.com wrote: Same dreaded logs as before :( A.L.M., could you please try once with the gnome-applet once for a change ? :P -- Regards, Ajay -- Regards, Ajay

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-16 Thread A . L . M . Buxey
Hi, Ping :) Anyone managed to get this working on gnome-applet? :) On Sat, Jan 12, 2013 at 3:37 PM, Ajay Garg ajaygargn...@gmail.com wrote: Same dreaded logs as before :( A.L.M., could you please try once with the gnome-applet once for a change ? :P what you

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-12 Thread Ajay Garg
Same dreaded logs as before :( A.L.M., could you please try once with the gnome-applet once for a change ? :P -- Regards, Ajay - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-10 Thread Ajay Garg
On Thu, Jan 10, 2013 at 3:32 AM, a.l.m.bu...@lboro.ac.uk wrote: Hi, b) Now, from the gnome-panel applet, I try connecting to the WPA/WPA-2 Enterprise network, by setting the following settings :: Wireless Security :

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-09 Thread Phil Mayers
On 01/09/2013 06:15 AM, Ajay Garg wrote: However, I get the exact same earlier dreaded logs :( Sigh. This really is the thread of doom. Find a working CA/server cert (from another machine, generated with the same steps) and your failing ones. Then compare the output of: openssl x509

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-09 Thread Ajay Garg
On Wed, Jan 9, 2013 at 4:55 PM, Phil Mayers p.may...@imperial.ac.uk wrote: On 01/09/2013 06:15 AM, Ajay Garg wrote: However, I get the exact same earlier dreaded logs :( Sigh. This really is the thread of doom. Find a working CA/server cert (from another machine, generated with the same

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-09 Thread Phil Mayers
On 09/01/13 13:41, Ajay Garg wrote: Followed the above, and compared the structures of certs generated on Fedora-17 and Fedora-14. The structures were identical. Then you're doing something wrong on the client I'm afraid. - List info/subscribe/unsubscribe? See

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-09 Thread Alan Buxey
The certs resulting from a make install and initial run of 'radiusd -X' are valid and will work. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-09 Thread Ajay Garg
On Wed, Jan 9, 2013 at 7:59 PM, Phil Mayers p.may...@imperial.ac.uk wrote: On 09/01/13 13:41, Ajay Garg wrote: Followed the above, and compared the structures of certs generated on Fedora-17 and Fedora-14. The structures were identical. Then you're doing something wrong on the client I'm

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-09 Thread A . L . M . Buxey
Hi, b) Now, from the gnome-panel applet, I try connecting to the WPA/WPA-2 Enterprise network, by setting the following settings :: Wireless Security : WPA/WPA2-Enterprise

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-08 Thread Ajay Garg
Thanks A.L.M. On Tue, Jan 8, 2013 at 3:26 PM, a.l.m.bu...@lboro.ac.uk wrote: Hi, Does TLS work at your end? yes. using it quite fine. using the scripts supplied by the FreeRADIUS package with some local changes due to our security requirements and naming schemas etc. Could you

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-08 Thread John Dennis
On 01/08/2013 05:10 AM, Ajay Garg wrote: Could you please specify the order of scripts to be run, so that proper certificates may be generated - both for the server, and the client? :P You were given the answer. It's not just a matter of running the scripts it also requires knowing what the

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-08 Thread Ajay Garg
On Tue, Jan 8, 2013 at 6:45 PM, John Dennis jden...@redhat.com wrote: On 01/08/2013 05:10 AM, Ajay Garg wrote: Could you please specify the order of scripts to be run, so that proper certificates may be generated - both for the server, and the client? :P You were given the answer. It's not

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-08 Thread John Dennis
On 01/08/2013 03:53 PM, Ajay Garg wrote: On Tue, Jan 8, 2013 at 6:45 PM, John Dennis jden...@redhat.com mailto:jden...@redhat.com wrote: On 01/08/2013 05:10 AM, Ajay Garg wrote: Could you please specify the order of scripts to be run, so that proper certificates

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-08 Thread Ajay Garg
John, I changed the sequence in step b) of SERVER-SIDE as :: su - rm /etc/raddb/modules/dhcp_sqlippool cd /etc/raddb/certs make destroycerts

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-07 Thread Ajay Garg
I tried attaching the debug log-file, but the mail-message was rejected by the mailing list for exceeding 100KB How am I supposed to attach the complete logs? On Mon, Jan 7, 2013 at 11:35 AM, Ajay Garg ajaygargn...@gmail.com wrote: On Sun, Jan 6, 2013 at 8:00 PM, Alan DeKok

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-07 Thread Phil Mayers
On 07/01/13 13:18, Ajay Garg wrote: I tried attaching the debug log-file, but the mail-message was rejected by the mailing list for exceeding 100KB How am I supposed to attach the complete logs? You're supposed to *look* at them first; I'd give strong odds the answer you seek is in there.

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-07 Thread Alan DeKok
Ajay Garg wrote: I tried attaching the debug log-file, but the mail-message was rejected by the mailing list for exceeding 100KB How am I supposed to attach the complete logs? Shorten it. Much of the conf file output can be deleted. Or, READ IT. Odds are that the answers to your

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-07 Thread Alan DeKok
Ajay Garg wrote: here are the logs that should identify the problem :: ... [tls] TLS 1.0 Alert [length 0002], fatal decrypt_error TLS Alert read:fatal:decrypt error TLS_accept: failed in SSLv3 read client certificate A rlm_eap: SSL error error:1409441B:SSL routines:SSL3_READ_BYTES:tlsv1

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-07 Thread A . L . M . Buxey
Hi, the client sent a cert that your server didnt like. correct cert configured on the client? alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-07 Thread Ajay Garg
Thanks Alan, and A.L.M. I too thought the same looking at the decrypt failure messages. As I told in my startup-mail on this thread, the procedure :: su - cd /etc/raddb/certs make clean make

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-07 Thread John Dennis
On 01/07/2013 12:18 PM, Ajay Garg wrote: Thanks Alan, and A.L.M. I too thought the same looking at the decrypt failure messages. As I told in my startup-mail on this thread, the procedure :: su - cd /etc/raddb/certs

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-07 Thread Alan Buxey
Ummm, if you are using those scripts then you have local certs which are different on each server...and thus the client wouldnt match. If you require both servers to be used by the same client then you need to use the same CA on both server installs. Likewise, only one server/CA should be

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-07 Thread Ajay Garg
Thanks John I am indeed looking for a ground-zero-solution :) On Tue, Jan 8, 2013 at 12:14 AM, John Dennis jden...@redhat.com wrote: On 01/07/2013 12:18 PM, Ajay Garg wrote: Thanks Alan, and A.L.M. I too thought the same looking at the decrypt failure messages. As I told in my

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-07 Thread John Dennis
On 01/07/2013 02:41 PM, Ajay Garg wrote: Upon restarting, it shows a missing server.pem error. I reckon that we need to run make server too at some point of time (so that server.pem gets generated after make destroycerts). make destroycerts should have removed all the pem files and keys. After

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-07 Thread Ajay Garg
John, I am confused. I will be grateful if you could specify the sequence of commands to be run after make destroycerts. Note that :: a) Running JUST make client generates client.pem and ca.pem, but no server.pem. b) Running JUST make generates server.pem and ca.pem, but no client.pem.

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-07 Thread John Dennis
On 01/07/2013 03:32 PM, Ajay Garg wrote: John, I am confused. I will be grateful if you could specify the sequence of commands to be run after make destroycerts. Note that :: a) Running JUST make client generates client.pem and ca.pem, but no server.pem. b) Running JUST make generates

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-07 Thread Ajay Garg
Thanks John. I am still getting the exact same error (as pasted in 3-4 mails earlier). I am doubting that this has got to do something with two ca.pem being generated in the calls to make and make client. My freeradius version is freeradius-2.2.0-0.fc17.i686 Does TLS work at your end? On Tue,

Failure with TLS authentication and Freeradius on Fefora-17

2013-01-06 Thread Ajay Garg
Hi all. I have been facing a very particular issue, when trying to connect to a WPA/WPA-2 Enterprise connection via TLS authentication (note that TTLS and PEAP authentication work perfect). Settings :: a) As per

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-06 Thread Ajay Garg
I just realised that I can put the issue in a simpler realm (not requiring any externally written client-code files ) :: I am unable to get TLS-authentication working, when a Fedora-17-client tries to connect to a WPA/WPA2-Enterprise network through gnome-shell-applet, via

Re: Failure with TLS authentication and Freeradius on Fefora-17

2013-01-06 Thread Alan DeKok
Ajay Garg wrote: I just realised that I can put the issue in a simpler realm (not requiring any externally written client-code files ) :: I am unable to get TLS-authentication working, when a Fedora-17-client tries to connect to a WPA/WPA2-Enterprise network through gnome-shell-applet, via