1 # Using RadSec (RADIUS/TLS)
3 ### Make sure that libradsec is at bae5640d (or later), branch 'libradsec'
4 git log | egrep bae5640d || echo you need to pull
6 ### Get radsecproxy built
7 cd ~/moonshot-tlv/libradsec
9 ./configure --prefix=/usr/local/moonshix=/usr/local/moonshot --enable-tls
11 git checkout libradsec
13 ### Configure radsecproxy like this:
14 cat > /usr/local/moonshot/etc/radsecproxy.conf << EOF
16 CACertificateFile /home/moonshot/moonshot-tlv/libradsec/lib/tests/demoCA/newcerts/01.pem
17 CertificateFile /home/moonshot/moonshot-tlv/libradsec/lib/tests/demoCA/newcerts/02.pem
18 CertificateKeyFile /home/moonshot/moonshot-tlv/libradsec/lib/tests/demoCA/private/c2key.pem
23 certificateNameCheck off
36 /usr/local/moonshot/sbin/radsecproxy -c /usr/local/moonshot/etc/radsecproxy.conf
38 ### Configure /usr/local/moonshot/etc/radsec.conf as
41 cacertfile = "/home/moonshot/moonshot-tlv/libradsec/lib/tests/demoCA/newcerts/01.pem"
42 certfile = "/home/moonshot//moonshot-tlv/libradsec/lib/tests/demoCA/newcerts/03.pem"
43 certkeyfile = "/home/moonshot//moonshot-tlv/libradsec/lib/tests/demoCA/private/c3key.pem"
45 hostname = "localhost"
51 Note that this adds a second "realm" called gss-eap-tls. In order to
52 make mech_eap use this instead of the ordinare gss-eap, edit
53 createRadiusHandle() in mech_eap/accept_sec_context.c to read
55 const char *configStanza = "gss-eap-tls";
57 If you intend to switch to RadSec entirely, name the realm "gss-eap"
58 in radsec.conf and don't make the change createRadiusHandle().
60 ### Test with a simple RadSec client
61 lib/examples/client /usr/local/moonshot/etc/radsec.conf gss-eap-tls
62 Code: 2, Identifier: 0, Lenght: 20
65 ### Test with gss-server and gss-client
66 ~/krb5-1.9/src/appl/gss-sample/gss-server host@moonshot-test.project-moonshot.org &
67 ~/krb5-1.9/src/appl/gss-sample/gss-client -mech "{1 3 6 1 4 1 5322 22 1 18}" -user steve@local -pass testing 127.0.0.1 host@localhost bar
69 This should produce lots of interesting output, ending with
71 Received message: "bar"