06InstanceFreeRadiusLdap - amagerard/FreeRadius GitHub Wiki
RedHat/FreeRadius
| 01 Sypnoptic | 02 Network | 03 FreeRadius | 04 InstanceDefault | |
|---|---|---|---|---|
| 05 InstanceSql | 06 InstanceLdap | 07 InstanceAD | 08 Selinux | 09 GnomeShell |
| DaloRadius | OpenLdap | SambaAD |
6. Instance Freeradius-ldap.
6.1 Principle.
It is not recommended to install the user accounts ldap on the Freeradius server.
The ldap is on another server (example: openldap server).
Freeradius will use a secure ldap connection to access the ldap on openldap server .
I will create a freeradius-ldap instance reserved for users of the ldap hosted on the openldap server.
6.2 Openldap.
Go to Install Openldap.
IMPORTANT.
Your openldap server should be ready to continue.
Very important.
the mods-available/ldap needs to have the same CA as freeradius and openldap.
6.3 Add user system ldaprad.
groupadd ldaprad
useradd -g ldaprad -s /bin/false -d /etc/freeradius-ldap ldaprad
Give permissions for ldaprad.
setfacl -m u:ldaprad:rx /etc/pki/tls/private/freeradius.key
setfacl -m u:ldaprad:rx /etc/pki/tls/certs/freeradius.crt
setfacl -m u:ldaprad:rx /etc/pki/tls/private/CA.key
setfacl -m u:ldaprad:rx /etc/pki/tls/certs/CA.crt
6.4 Freeradius-ldap installation.
Copy /etc/raddb to /etc/freeradius-sql.
cp -R /etc/raddb/* /etc/freeradius-ldap/
chgrp -R ldaprad /etc/freeradius-ldap
6.5 Configuration.
vi /etc/freeradius-ldap/radiusd.conf
prefix = /usr
sysconfdir = /etc
localstatedir = /var
sbindir = /usr/sbin
logdir = ${localstatedir}/log/freeradius-ldap
raddbdir = ${sysconfdir}/freeradius-ldap
radacctdir = ${logdir}/radacct
name = freeradius-ldap
user = ldaprad
group = ldaprad
Create the directory for the logs.
mkdir /var/log/freeradius-ldap
mkdir /var/log/freeradius-ldap/radacct
touch /var/log/freeradius-ldap/radius.log
chown -R ldaprad:ldaprad /var/log/freeradius-ldap
chmod 0755 /var/log/freeradius-ldap
6.6 Create a freeradius-ldap service.
Create the /run/freeradius-ldap folder at startup.
vi /usr/lib/tmpfiles.d/freeradius-ldap.conf
#Type Path Mode UID GID Age Argument
d /run/freeradius-ldap 0775 root ldaprad - -
You must restart to activate
"/usr/lib/tmpfiles.d/freeradius-ldap.conf"
reboot
Copy the service radiusd.service to freeradius-ldap.service.
See InstanceDefault chapter 3.1.
cp /opt/freeradius/redhat/radiusd.service /usr/lib/systemd/system/freeradius-ldap.service
Edit the file.
vi /usr/lib/systemd/system/freeradius-ldap.service
[Service]
Type=forking
WatchdogSec=0
NotifyAccess=all
EnvironmentFile=-/etc/sysconfig/radiusd
# FreeRADIUS can do static evaluation of policy language rules based
# on environmental variables which is very useful for doing per-host
# customization.
# Unfortunately systemd does not allow variable substitutions such
# as %H or $(hostname) in the EnvironmentFile.
# We provide HOSTNAME here for convenience.
Environment=HOSTNAME=%H
# Limit memory to 2G this is fine for %99.99 of deployments. FreeRADIUS
# is not memory hungry, if it's using more than this, then there's probably
# a leak somewhere.
MemoryMax=2G
RuntimeDirectory=radiusd radiusd/tmp
RuntimeDirectoryMode=0775
User=ldaprad
Group=ldaprad
PIDFile=/run/freeradius-ldap/freeradius-ldap.pid
#ExecStartPre=/usr/sbin/radiusd $FREERADIUS_OPTIONS -Cx -lstdout
ExecStart=/usr/sbin/radiusd -d /etc/freeradius-ldap -l /var/log/freeradius-ldap/radius.log
Restart=on-failure
RestartSec=5
ExecReload=/usr/sbin/radiusd -d /etc/freeradius-ldap -l /var/log/freeradius-ldap/radius.log
ExecReload=/bin/kill -HUP $MAINPID
# Don't elevate privileges after starting
NoNewPrivileges=true
# Allow binding to secure ports, broadcast addresses, and raw interfaces.
#
# This list of capabilities may not be exhaustive, and needs
# further testing. Please uncomment, test, and report any issues.
#CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_SETUID CAP_SETGID CAP_CHOWN CAP_DAC_OVERRIDE
# Private /tmp that isn't shared by other processes
PrivateTmp=true
# cgroups are readable only by radiusd, and child processes
ProtectControlGroups=true
# don't load new kernel modules
ProtectKernelModules=true
# don't tune kernel parameters
ProtectKernelTunables=true
# Only allow native system calls
SystemCallArchitectures=native
# We shouldn't be writing to the configuration directory
ReadOnlyDirectories=/etc/freeradius-ldap/
# We can read and write to the log directory.
ReadWriteDirectories=/var/log/freeradius-ldap/
[Install]
WantedBy=multi-user.target
Change ports of sites-available/default.
Modify listen port 0 by 2812 and accounting config.
vi /etc/freeradius-ldap/sites-available/default
server default {
listen {
type = auth
ipaddr = *
port = 2812
limit {
----- # Do not change anything
}
}
# This second "listen" section is for listening on the accounting
listen {
type = acct
ipaddr = *
# ipv6addr = ::
port = 2813
limit {
}
}
Change port of sites-available/inner-tunnel.
Replace the port 18120 by 28120.
vi /etc/freeradius-ldap/sites-available/inner-tunnel
server inner-tunnel {
listen {
ipaddr = 127.0.0.1
port = 28120
type = auth
}
Change line 366 /etc/freeradius-ldap/sites-enabled/inner-tunnel.
vi /etc/freeradius-ldap/sites-available/inner-tunnel
# Instead of "use_tunneled_reply", change this "if (0)" to an
# "if (1)".
#
if (1) {
Ignoring sql /etc/freeradius-ldap/sites-enabled/default
Put "#" before line with -sql.
#-sql
Ignoring sql /etc/freeradius-ldap/sites-enabled/inner-tunnel
Put "#" before line with -sql.
#-sql
6.7 Mods-available.
Edit the ldap file.
vi /etc/freeradius-ldap/mods-available/ldap
# Lightweight Directory Access Protocol (LDAP)
ldap {
server = 'openldap.ol26modk.com'
identity = 'cn=Manager,dc=ol26modk,dc=com'
password = X2m56AB50!
base_dn = 'dc=ol26modk,dc=com'
update {
# Comment this line
# control:Password-With-Header += 'userPassword'
# add the line
control:Cleartext-Password += 'userPassword'
tls {
start_tls = yes
ca_file = /etc/pki/tls/certs/CA.crt
ca_path = /etc/pki/tls/certs
certificate_file = /etc/pki/tls/certs/freeradius.crt
private_key_file = /etc/pki/tls/private/freeradius.key
random_file = /dev/urandom
tls_min_version = "1.2"
Create the ldap link in mods-nabled.
ln -s /etc/freeradius-ldap/mods-available/ldap /etc/freeradius-ldap/mods-enabled/ldap
Edit the eap file.
Maybe already done Instancedefault chapter eap 4.4.
vi /etc/freeradius-ldap/mods-available/eap
eap {
tls-config tls-common {
private_key_file = /etc/pki/tls/private/freeradius.key
certificate_file = /etc/pki/tls/certs/freeradius.crt
ca_file = /etc/pki/tls/certs/CA.crt
ca_path = /etc/pki/tls/certs
Change permissions.
chgrp -R ldaprad /etc/freeradius-ldap/mods-enabled
6.8 Check if there are any other errors.
To this step, freeradius-ldap must not announce an error.
If there are errors, review the configuration.
radiusd -d /etc/freeradius-ldap -l /var/log/freeradius-ldap/radius.log -X
Ctrl+C exit.
If it's good.
systemctl enable --now freeradius-ldap
Check the ports.
netstat -tunlp | grep radiusd
udp 0 0 127.0.0.1:28120 0.0.0.0:* 2575/radiusd
udp 0 0 0.0.0.0:53552 0.0.0.0:* 2575/radiusd
udp 0 0 0.0.0.0:2812 0.0.0.0:* 2575/radiusd
udp 0 0 0.0.0.0:2813 0.0.0.0:* 2575/radiusd
6.9 Nas.
The nas is a device that makes its authentication request to freereadius.
In my example, it's a dd-wrt wifi router.
We need a secret key shared between nas and freeradius.
First change all "secret" by another password.
cat /etc/freeradius-ldap/clients.conf| grep secret
Example: new secret = 3bd45df3-3bd45df3
sed -i -e "s/testing123/3bd45df3-3bd45df3/g" /etc/freeradius-ldap/clients.conf
Put a "#" in front of the Ipv6 configurations of clients.conf file.
vi /etc/freeradius-ldap/clients.conf
# IPv6 Client
##client localhost_ipv6 {
## ipv6addr = ::1
## secret = 3bd45df3-3bd45df3
##}
Add a new "nas" at the end of clients.conf file.
vi /etc/freeradius-ldap/clients.conf
client linksys2 {
#ip du linksys2.
ipaddr = 192.168.5.1
# Shared key.
secret = ABjA#3r3bAB6n
}
Change value require_message_authenticator = yes.
vi /etc/freeradius-ldap/clients.conf
# allowed values: yes, no, auto
#
require_message_authenticator = yes
6.10 Proxy.
First change all "secret" by another password.
cat /etc/freeradius-ldap/proxy.conf| grep secret
Example: new secret = 3bd45df3-3bd45df3
sed -i -e "s/testing123/3bd45df3-3bd45df3/g" /etc/freeradius-ldap/proxy.conf
Add a new realm.
vi /etc/freeradius-ldap/proxy.conf
Add at the end of proxy.conf file.
realm ol26modk.com {
type = radius
authhost = LOCAL
accthost = LOCAL
}
Delete realm example.com.
Put a "#" in front.
vi /etc/freeradius-ldap/proxy.conf
## realm example.com {
## auth_pool = my_auth_failover
## }
Change the port 1812 by 2812.
vi /etc/freeradius-ldap/proxy.conf
home_server localhost {
port = 2812
6.11 Logs.
vi /etc/freeradius-ldap/radiusd.conf
Change only these lines.
log {
auth = yes
auth_badpass = yes
auth_goodpass = yes
}
tail -200 /var/log/freeradius-ldap/radius.log
Auth: (2) Login OK: [jemarre/<via Auth-Type = mschap>] (from client localhost port 2812)
6.12 Check user openldap connection.
-
Openldap server.
Ldap database.
User: jemarre
Password: 7YhjiDfg4 -
Freeradius server.
1-Open a terminal console.
systemctl stop freeradius-ldap
radiusd -d /etc/freeradius-ldap -l /var/log/freeradius-ldap/radius.log -X
2-Open another terminal console.
radtest jemarre "7YhjiDfg4" localhost:2812 0 3bd45df3-3bd45df3
Sent Access-Request Id 45 from 0.0.0.0:50187 to 127.0.0.1:2812 length 77
User-Name = "jemarre"
User-Password = "7YhjiDfg4"
NAS-IP-Address = 192.168.50.41
NAS-Port = 0
Message-Authenticator = 0x00
Cleartext-Password = "7YhjiDfg4"
Received Access-Accept Id 45 from 127.0.0.1:2812 to 127.0.0.1:50187 length 20
radtest -t mschap jemarre "7YhjiDfg4" localhost:2812 0 3bd45df3-3bd45df3
Sent Access-Request Id 48 from 0.0.0.0:52137 to 127.0.0.1:2812 length 133
User-Name = "jemarre"
MS-CHAP-Password = "7YhjiDfg4"
NAS-IP-Address = 127.0.0.1
NAS-Port = 2812
Message-Authenticator = 0x00
Cleartext-Password = "7YhjiDfg4"
MS-CHAP-Challenge = 0x697ae9ca2ff6da03
MS-CHAP-Response = 0x00010000000000000000000000000000000000000000000000004692ebe011da80322fcc0786b8d33e7f3ec03b49285d9919
Received Access-Accept Id 48 from 127.0.0.1:2812 to 127.0.0.1:52137 length 84
MS-CHAP-MPPE-Keys = 0x000000000000000051b05c393881ae8342b2abac522eae39
MS-MPPE-Encryption-Policy = Encryption-Allowed
MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed
Information.
Phpldapadmin
The user password must be clear and not MD5.
The user login is UID (User Name) and not the CN.