Administrace komentářů

Zdravim,
potrebuji zabezpecit radius komunikaci mezi FreeRADIUS serverem a OpenWrt AP. Vyhazel jsem z navodu radsecproxy a navodu na ssl.

Na serveru je nasledujici konfigurace:

root@server:/# cat /etc/radsecproxy.conf 
ListenUDP		localhost:11812
ListenTLS		*:2084
LogLevel		3
LogDestination		x-syslog:///
LoopPrevention		on
tls server {
    CACertificateFile	/etc/radsecproxy/ca/certs/cacert.pem
    CACertificatePath	/etc/radsecproxy/ca/certs/
    CertificateFile	/etc/radsecproxy/ca/certs/server.pem
    CertificateKeyFile	/etc/radsecproxy/ca/private/server.key.pem
}

server localhost {
	port 1812
	type udp
	secret testing123
}
client localhost {
	type udp
	secret testing123
}
client * {
	type tls
	tls server
	certificateNameCheck off
	secret testing123-1
}
realm * {
	server localhost
}

root@client:/# cat /etc/radsecproxy.conf 
ListenUDP		localhost:1812
LogDestination		x-syslog:///log_daemon
tls client {
    CACertificateFile	/etc/cert/cacert.pem
    CACertificatePath	/etc/cert/
    CertificateFile	/etc/cert/client..pem
    CertificateKeyFile	/etc/cert/client.key.pem
}
client 127.0.0.1 {
	type	udp
	secret	testing123-1
}
server 192.168.1.1 { # IP serveru
	type	tls
	secret	testing123-1
	port 2084
	tls client
	certificateNameCheck off
}
realm * {
	server 192.168.1.1
}

Zkousel jsem uz asi milion veci, ale stale se mi nedari spojeni. Vzdy to zustane vyset na chybe ignoring request, no matching TLS client
Vypis ze serveru:

root@server:/# radsecproxy -c /etc/radsecproxy.conf -d 3 -f
Nov 17 21:19:36 2012: createlistener: listening for udp on localhost:11812
Nov 17 21:19:36 2012: createlistener: listening for tls on *:2084
Nov 17 21:19:43 2012: tlsservernew: incoming TLS connection from 192.168.1.68
Nov 17 21:19:43 2012: tlsservernew: ignoring request, no matching TLS client
Nov 17 21:19:45 2012: tlsservernew: incoming TLS connection from 192.168.1.68
Nov 17 21:19:45 2012: tlsservernew: ignoring request, no matching TLS client
Nov 17 21:19:47 2012: tlsservernew: incoming TLS connection from 192.168.1.68
Nov 17 21:19:47 2012: tlsservernew: ignoring request, no matching TLS client
^C
root@server:/# 

root@client:/# radsecproxy -c /etc/radsecproxy.conf -d 3 -f
Nov 17 21:19:43 2012: createlistener: listening for udp on localhost:1812
Nov 17 21:19:43 2012: connecttcphostlist: trying to open TCP connection to 192.168.1.1 port 2084
Nov 17 21:19:43 2012: connecttcphostlist: TCP connection to 192.168.1.1 port 2084 up
Nov 17 21:19:45 2012: connecttcphostlist: trying to open TCP connection to 192.168.1.1 port 2084
Nov 17 21:19:45 2012: connecttcphostlist: TCP connection to 192.168.1.1 port 2084 up
Nov 17 21:19:47 2012: connecttcphostlist: trying to open TCP connection to 192.168.1.1 port 2084
Nov 17 21:19:47 2012: connecttcphostlist: TCP connection to 192.168.1.1 port 2084 up
^C
root@client:/# 

Netusite nekdo, co delam spatne s certifikaty?

Dekuji za pomoc!