##Moonshot Proper
First we need a minimal _/etc/radsec.conf_
- dictionary = "/etc/raddb/dictionary"
realm gss-eap {
type = "UDP"
There are two ways to start _gss-client_ – the first specifies an encryption method to use by its OID 1.3.6.1.4.1.5322.22.1.18 (as seen in /etc/gss/mech):
- /opt/moonshot/bin/gss-client -mech "{1 3 6 1 4 1 5322 22 1 18}" 127.0.0.1 host@localhost bar
+ /opt/moonshot/bin/gss-client -mech "{1.3.6.1.5.5.15.1.1.18 }" 127.0.0.1 host@localhost bar
The second uses __Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO)__<br />
This chooses the "best" mutually-agreeable encryption method for between client and server. To invoke the client using __SPNEGO__, use:
##Common Issues:
-If you see:
+###If you see:
connecting to server: Connection refused
_gss-server_ is not running – start it again, and check its output for any reasons why it doesn't stay running
-If you see:
+###If you see:
GSS-API error initializing context: Unspecified GSS failure. Minor code may provide more information
GSS-API error initializing context: SPNEGO cannot find mechanisms to negotiate
Then _/etc/gss/mech_ is invalid or missing
-If you see:
+###If you see:
Sending init_sec_context token (size=101)...continue needed...
CTRL-EVENT-EAP-STARTED EAP authentication started
Your RADIUS server may not be running, or malfunctioning, run it in debug mode (as mentioned earlier) to find out why.
-If you see:
+###If you see:
Segmentation fault
Then _~/.gss\_eap\_id_ is invalid or missing
-If you see:
+###If you see:
CTRL-EVENT-EAP-METHOD EAP vendor 0 method 4 (MD5) selected
Then you have not correctly set the _default\_eap\_type_ on the RADIUS server.
-If you see:
+###If you see:
GSS-API error gss_pname_to_uid: Unspecified GSS failure. Minor code may provide more information
GSS-API error gss_pname_to_uid: Unknown error
Then there is not a local user that matches your Chargeable-User-Identity
-If you see…
+###If you see…
/opt/moonshot/bin/gss-client: relocation error: /opt/moonshot/bin/gss-client: symbol gss_acquire_cred_with_password, version gssapi_krb5_2_MIT not defined in file libgssapi_krb5.so.2 with link time reference