View source for Enabling peap authentication with freeRADIUS server

[[Main Page|Home]] > [[CentOS]] > [[CentOS 6.x]] > [[Freeradius configuration]] > [[Enabling peap authentication with freeRADIUS server|Enabling peap with freeRADIUS]]

'''Note that below steps just work upto enabling peap without causing any startup problems. The settings could not be tested with any NAS client as LinkSYS switch was not available.'''

#Open '<tt>/etc/raddb/radiusd.conf</tt> file. 
##In modules, go to mschap sub-section and do following changes:
##*Add 'use_mppe=yes'
##*Uncomment 'require_encryption=yes'
##*Uncomment 'require_strong=yes'
##Verify that 'authorize' section has line '<tt>mschap</tt>'
##Verify that authenticate section has lines
##:<pre>
##::Auth_Type MS-CHAP {
##::&nbsp; &nbsp; mschap
##::}
##:</pre>
#Edit '<tt>/etc/raddb/eap.conf</tt>' file and do following modifications:
##Change '<tt>default_eap_type</tt>' from '<tt>md5</tt>' to '<tt>peap</tt>'.
##Uncomment
##:<pre>
##::peap {
##::&nbsp; &nbsp; default_eap_type=mschapv2
##::}
##:</pre>
#Configure yum and install/update '<tt>openssl</tt>'
#Search for file with name '<tt>ssl.conf</tt>' or '<tt>openssl.conf</tt>' using locate command. Sometimes the file is named '<tt>/etc/ssl/ssl.conf</tt>'. In CentOS 5.4 the file is named '<tt>/etc/pki/tls/openssl.conf</tt>'
##Edit the file in following manner
##*In '<tt>[CA_default]</tt>' section change to
##*:<pre>
##*::dir = certificates      #Where everything is kept
##*::default_days = 3650
##*:</pre>
##*In '<tt>req_distinguished_name</tt>' section
##*:<pre>
##*::countryName_default = IN
##*::stateOrProvinceName_default = AP
##*::localityName_default = Hyderabad
##*::0.organizationName_default = Rekall Software
##*::commonName=Common Name    (Uncomment this line)
##*::emailAddress_default = saurabh@example.com
##*:</pre>
#Search for file with name '<tt>CA</tt>' or '<tt>CA.sh</tt>'. In Cent OS 5.4 the file is located in folder '<tt>/etc/pki/tls/misc</tt>'. Change value for '<tt>CATOP</tt>' defined in this file to 'certificates'.
#Go to folder '<tt>/etc/pki/tls</tt>' and run command '<tt>./misc/CA -newca</tt>'. (Here it is important to come to folder '<tt>/etc/pki/tls</tt>' before we run the shell script as the name of folder 'certificates' that we entered during earlier modifications is relative and we want the folder certificates to be created in '<tt>/etc/pki/tls</tt>')
##Enter PEM passphrase as 'rekall123' during testing.  Let other things have default value as we entered in SSL configuration file. For common name we can use something like 'ca.barjatiya.com'. Optional challenge password can also be 'rekall123' and company name 'Rekall Software'. Enter the first passphrase again and the certificate will get generated.
#Use commands 
#:<pre>
#::openssl req -new -nodes -keyout radiuskey.pem -out radiusreq.pem
#::openssl ca -out radius_cert.pem -infiles ./radiusreq.pem
#:</pre>
#:Enter passphrase used while creating CA and we will get a files '<tt>radius_cert.pem</tt>' and '<tt>radiuskey.pem</tt>' to be used in freeRADIUS server.
#Run following commands (most of them are self explanatory)
#:<pre>
#::cd /etc/pki/tls
#::cp radius_cert.pem radiuskey.pem /etc/raddb
#::cp certificates/cacert.pem /etc/raddb
#::cd /etc/raddb
#::openssl dhparam -check -text -5 512 -out dh
#::dd if=/dev/random of=random count=2
#::chown radiusd:radiusd dh random radiuskey.prem radius_cert.pem
#::chmod 0400 dh random radiuskey.prem radius_cert.pem
#::chown root:radiusd cacert.pem
#::chmod 0444 cacert.pem
#:</pre>
#Edit file '<tt>/etc/raddb/eap.conf</tt>'. In section modules -&gt; eap -&gt; tls add/uncomment following entries
#:<pre>
#::private_key_file = ${raddbdir}/radiuskey.pem
#::certificate_file = ${raddbdir}/radius_cert.pem
#::CA_file = ${raddbdir}/cacert.pem
#::dh_file = ${raddbdir}/dh
#::random_file = ${raddbdir}/random
#:</pre>
#Start radiusd using '<tt>/usr/sbin/radiusd -X</tt>' and ensure that it is working. If it is not working check every ssmall detail from start to this sstep. In case you do not find the problem search for error message on web search engines and try to resolve the problem. Document steps and error message you receive here.





[[Main Page|Home]] > [[CentOS]] > [[CentOS 6.x]] > [[Freeradius configuration]] > [[Enabling peap authentication with freeRADIUS server|Enabling peap with freeRADIUS]]