Changes between Initial Version and Version 1 of AdminRadius

Timestamp:

May 10, 2020, 11:21:21 PM (6 years ago)

Author:

bau

Comment:

--

AdminRadius

@@ +1 @@
+= Radius-Server auf der paedml =
+
+[https://wiki.linuxmuster.net/community/anwenderwiki:freeradius?s%5B%5D=freeradius Hintergrundinformation bei linuxmuster.net]
+
+== benötigte Pakete ==
+* freeradius
+* freeradius-common
+* freeradius-ldap
+* libfreeradius2
+* freeradius-utils [zum Testen]
+
+== weitere Schritte ==
+* eventuell Test durchführen von localhost
+* /etc/freeradius/clients.conf
+  {{{
+client 10.1.0.0/16 {
+        secret          = "Hier das Zugriffs-Secret angeben / wird vom UnifiManager benötigt"
+        shortname       = Unifi_Management
+}
+  }}}
+* damit ist nun auch ein radtest von der VM unifi möglich:
+  {{{
+radtest steve testing 10.1.0.X:1812 10 "Zugriffs-Secret von Oben"
+  }}}
+* /etc/freeradius/module/ldap
+  {{{
+     ldap {
+     (...)
+        server = "localhost"
+        identity = "cn=admin,dc=kg-fds,dc=de"                                  # Oder entsprechend (siehe /etc/ldap/slapd.conf)
+        password = "PW aus Datei /etc/ldap/slapd.conf"
+        basedn = "ou=accounts,dc=kg-fds,dc=de"                                 # Oder entsprechend
+        filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
+        base_filter = "(objectclass=posixAccount)"
+        groupname_attribute = cn
+        groupmembership_filter = (&(objectClass=posixGroup)(memberUid=%u))
+        groupmembership_attribute = radiusGroupName
+     (...)
+     }
+  }}}
+
+* /etc/freeradius/sites-available/default
+  {{{
+authorize {
+(...)
+        #
+        #  The ldap module will set Auth-Type to LDAP if it has not
+        #  already been set
+        ldap
+(...)
+}
+
+
+authenticate {
+(...)
+        # Uncomment it if you want to use ldap for authentication
+        #
+        # Note that this means "check plain-text password against
+        # the ldap database", which means that EAP won't work,
+        # as it does not supply a plain-text password.
+        Auth-Type LDAP {
+                ldap
+        }
+(...)        
+}
+
+  }}}
+
+* /etc/freeradius/sites-available/inner-tunnel
+  {{{
+server inner-tunnel {
+
+authorize {
+(...)
+        ldap
+(...)
+}
+
+
+authenticate {
+(...)
+        Auth-Type LDAP {
+                ldap
+        }
+(...)
+}
+
+}
+  }}}
+
+
+* /etc/freeradius/eap.conf
+  {{{
+        eap {
+(...)
+                default_eap_type = peap
+(...)
+                ttls {
+                        default_eap_type = mschapv2
+                }
+(...)
+                peap {
+(...)
+                        default_eap_type = mschapv2
+                }
+        }
+(...)
+  }}}
+* /etc/freeradius/modules/pap
+  {{{
+(...)
+auto_header = yes
+(...)
+  }}}
+
+* /etc/freeradius/user
+  {{{
+DEFAULT Ldap-Group == "cn=p_wifi,ou=groups,dc=kg-fds,dc=de"  # Oder entsprechend
+DEFAULT Auth-Type := Reject
+Reply-Message = "Your are not allowed to access the WLAN!"
+    
+  }}}
+
+* Radtest mit EAP von localhost:
+  {{{
+radtest -t eap-md5 steve testing localhost 10 testing123
+  }}}
+* Radtest mit gültigem User und EAP von localhost:
+  {{{
+radtest -t eap-md5 user password localhost 10 testing123
+  }}}