First, let’s install the RADIUS server, FreeRADIUS. On the server that is going to host it do:<\/p>\r\n\r\n\r\n\r\n
sudo apt-get install freeradius make<\/pre>\r\n\r\n\r\n\r\nThere are many different ways that FreeRADIUS can be configured, and honestly I don’t understand most of them. Here’s what I found that worked for me.<\/p>\r\n\r\n\r\n\r\n
Turn off the proxy feature on the server (unless you know you need it) by editing \/etc\/freeradius\/radiusd.conf and changing the following line:<\/p>\r\n\r\n\r\n\r\n
proxy_requests = no<\/pre>\r\n\r\n\r\n\r\nYou may also want to look over the logging features in that configuration file to set what gets logged and where. I use “auth=yes” in the log{} block so that I log every time someone connects to the wifi. It also tells me which access point they connected to.<\/p>\r\n\r\n\r\n\r\n
<\/p>\r\n\r\n\r\n\r\n
WHAT IS A RADIUS CLIENT?<\/h4>\r\n\r\n\r\n\r\n
FreeRADIUS may throw you for a loop talking about servers and clients. The client is NOT what you think – it’s not the user’s laptop or phone. The client is the WAP, because it performs the authentication request against the server. By default, FreeRADIUS will set up the localhost of the server as a client as well, and we won’t be needing that so let’s disable it in the ‘\/etc\/freeradius\/clients.conf’ file by commenting it out.<\/p>\r\n\r\n\r\n\r\n
#client localhost {\r\n # Allowed values are:\r\n # dotted quad (1.2.3.4)\r\n # hostname (radius.example.com)\r\n# ipaddr = 127.0.0.1\r\n\r\n # OR, you can use an IPv6 address, but not both\r\n # at the same time.\r\n# ipv6addr = :: # any. ::1 == localhost\r\n...\r\n#}<\/pre>\r\n\r\n\r\n\r\nAnd now we add an entry for our WAP in that. Create a new random password that you’ll enter into the WAP itself that it uses to authenticate against the RADIUS server. Again in the ‘\/etc\/freeradius\/clients.conf’ file:<\/p>\r\n\r\n\r\n\r\n
client mywap {\r\n ipaddr = 192.168.1.100<\/strong>\r\n secret = myRandomP@55w05D<\/strong>\r\n require_message_authenticator = yes\r\n}<\/pre>\r\n\r\n\r\n\r\nPlease be sure you’ve changed the parts I put in bold. You will need a client entry for each WAP that is on your network. I recommend a different password for each one, in addition to needing the static IP address of the WAP.<\/p>\r\n\r\n\r\n\r\n
EAP CONFIGURATION<\/h4>\r\n\r\n\r\n\r\n
Next we want to edit the configuration for the Extensible Authentication Protocol (EAP). Rather than telling you what to comment, I’m going to just show you what you need. Edit ‘\/etc\/freeradius\/eap.conf’ to look something like this:<\/p>\r\n\r\n\r\n\r\n
# -*- text -*-\r\n# Example \/etc\/freeradius\/eap.conf file\r\neap {\r\n\tdefault_eap_type = tls\r\n\ttimer_expire = 60\r\n\tignore_unknown_eap_types = no\r\n\tcisco_accounting_username_bug = no\r\n\tmax_sessions = 4096\r\n\ttls {\r\n\t\tcertdir = ${confdir}\/certs\r\n cadir = ${confdir}\/certs\r\n private_key_password = myserverkeypassword<\/strong>\r\n private_key_file = ${certdir}\/server.key\r\n\t\tcertificate_file = ${certdir}\/server.pem\r\n\t\tCA_path = ${cadir}\r\n\t\tCA_file = ${cadir}\/ca.pem\r\n\t\tdh_file = ${certdir}\/dh\r\n\t\trandom_file = \/dev\/urandom\r\n\t\tcipher_list = \"HIGH\"\r\n\t\tmake_cert_command = \"${certdir}\/bootstrap\"\r\n\t\tecdh_curve = \"prime256v1\"\r\n\t\tcache {\r\n\t\t\tenable = no # Optionally enable\r\n\t\t\tlifetime = 24 # hours\r\n\t\t\tmax_entries = 255\r\n\t\t}\r\n\t\tverify {\r\n\t\t\ttmpdir = \/tmp\/radiusd\r\n\t\t\tclient = \"\/usr\/bin\/openssl verify -CAfile ${..CA_file} %{TLS-Client-Cert-Filename}\"\r\n\t\t}\r\n\t\tocsp {\r\n\t\t\tenable = no # optionally enable\r\n\t\t\toverride_cert_url = yes\r\n\t\t\turl = \"http:\/\/127.0.0.1\/ocsp\/\"\r\n\t\t}\r\n\t}\r\n\tttls {\r\n\t\tdefault_eap_type = md5\r\n\t\tcopy_request_to_tunnel = no\r\n\t\tuse_tunneled_reply = no\r\n\t\tvirtual_server = \"inner-tunnel\"\r\n\t}\r\n}<\/pre>\r\n\r\n\r\n\r\nThe “myserverkeypassword” above will need to match the password you use when generating the server’s keys later.<\/p>\r\n\r\n\r\n\r\n
What we’ve done mostly is disable other protocols like LEAP and PEAP and MSCHAPv2 among others, none of which are good ideas to use. Only EAP-TLS will be used.<\/p>\r\n\r\n\r\n\r\n
DISABLE ALL THE DEFAULT SERVERS<\/h4>\r\n\r\n\r\n\r\n
sudo rm \/etc\/freeradius\/sites-enabled\/*<\/pre>\r\n\r\n\r\n\r\nCreate a new server config file at \/etc\/freeradius\/sites-available\/mynetwork that contains something like the following:<\/p>\r\n\r\n\r\n\r\n
######################################################################\r\nauthorize {\r\n\tpreprocess\r\n\teap {\r\n\t\tok = return\r\n\t}\r\n\texpiration\r\n\tlogintime\r\n}\r\n\r\nauthenticate {\r\n\teap\r\n}\r\n\r\npreacct {\r\n\tpreprocess\r\n\tacct_unique\t\r\n\tsuffix\r\n\tfiles\r\n}\r\n\r\naccounting {\r\n\tdetail\r\n\tunix\r\n\tradutmp\r\n\texec\r\n\tattr_filter.accounting_response\r\n}\r\n\r\nsession {\r\n\tradutmp\r\n}\r\n\r\npost-auth {\r\n\texec\r\n\tPost-Auth-Type REJECT {\r\n\t\tattr_filter.access_reject\r\n\t}\r\n}\r\n\r\npre-proxy {\r\n\r\n}\r\n\r\npost-proxy {\r\n\teap\r\n}<\/pre>\r\n\r\n\r\n\r\nNow, link that to the sites-enabled directory like so:<\/p>\r\n\r\n\r\n\r\n
sudo su -\r\ncd \/etc\/freeradius\/sites-enabled\/\r\nln -s ..\/sites-available\/mynetwork .\/mynetwork<\/pre>\r\n\r\n\r\n\r\nAnd then stop FreeRADIUS and restart it in debug mode to make sure all is loading correctly:<\/p>\r\n\r\n\r\n\r\n
service freeradius stop\r\nfreeradius -X<\/pre>\r\n\r\n\r\n\r\nHopefully it starts up just fine without any errors. You should see “Ready to process requests”. Any error messages you see now is the time to do some research and find out why. Once you’ve finished the test type CTRL-C to stop the server.<\/p>\r\n\r\n\r\n\r\n
CONFIGURE SSL CERTIFICATES<\/h4>\r\n\r\n\r\n\r\n
Assuming all went well, now we start generating SSL certificates. First we want to remove the default certificates and set up a basic framework:<\/p>\r\n\r\n\r\n\r\n
cd \/etc\/freeradius\/certs\/\r\nrm *.pem\r\nrm *.key\r\nmkdir \/var\/certs\r\nmkdir \/var\/certs\/freeradius\r\nchgrp ssl-cert \/var\/certs\/freeradius\r\nchmod 710 \/var\/certs\/freeradius\r\ncp \/usr\/share\/doc\/freeradius\/examples\/certs\/* \/var\/certs\/freeradius\/\r\ncd \/var\/certs\/freeradius\/\r\nrm bootstrap\r\nchmod 600 *\r\nmake destroycerts\r\nmake index.txt\r\nmake serial<\/pre>\r\n\r\n\r\n\r\nNext, edit the ‘ca.cnf’ file and change a few of the defaults. Change the following lines:<\/p>\r\n\r\n\r\n\r\n
[ CA_default ]\r\n..\r\ndefault_days = 1825\r\ndefault_md = sha1\r\n..\r\n[ req ]\r\ndefault_bits = 4096\r\ninput_password = myserverkeypassword<\/strong>\r\noutput_password = myserverkeypassword<\/strong>\r\n..<\/pre>\r\n\r\n\r\n\r\nThat sets certificates good for 5 years (you can change the days to whatever you like) and increases the certificate security considerably from the defaults. The “myserverkeypassword” above should match the one in the eap.conf file at the beginning and should be a randomly generated string. You’ll never have to enter this in a client so make it complicated.<\/p>\r\n\r\n\r\n\r\n
Now, generate the ‘ca.pem’ file:<\/p>\r\n\r\n\r\n\r\n
make ca.pem\r\nmake ca.der\r\nmake printca<\/pre>\r\n\r\n\r\n\r\nNow, edit the “server.cnf” file and do similar changes:<\/p>\r\n\r\n\r\n\r\n
[ CA_default ]\r\n..\r\ndefault_days = 1825\r\ndefault_md = sha1\r\n..\r\n[ req ]\r\n..\r\ndefault_bits = 4096\r\n..<\/pre>\r\n\r\n\r\n\r\nUnder the “[server]” tag put in your appropriate contact information. Now generate the ‘server.pem’ file:<\/p>\r\n\r\n\r\n\r\n
make server.pem<\/pre>\r\n\r\n\r\n\r\nCREATE USER CERTIFICATES<\/h4>\r\n\r\n\r\n\r\n
Now we generate client certificates, but there’s something we need to change in the Makefile first. “nano Makefile”.<\/p>\r\n\r\n\r\n\r\n
Locate the lines that say:<\/strong><\/p>\r\n\r\n\r\n\r\n
client.p12: client.crt\r\n openssl pkcs12 -export -in client.crt -inkey client.key -out client.p12 -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)\r\n\r\nclient.pem: client.p12\r\n openssl pkcs12 -in client.p12 -out client.pem -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)\r\n cp client.pem $(USER_NAME).pem<\/pre>\r\n\r\n\r\n\r\nChange it to read:<\/strong><\/p>\r\n\r\n\r\n\r\n
client.p12: client.crt\r\n openssl pkcs12 -export -in client.crt -inkey client.key -out client.p12 -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)\r\n cp client.p12 $(USER_NAME).p12\r\n\r\nclient.pem: client.p12\r\n openssl pkcs12 -in client.p12 -out client.pem -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)\r\n cp client.pem $(USER_NAME).pem\r\n\r\nclient_android.p12: client.crt\r\n openssl pkcs12 -export -in client.crt -inkey client.key -certfile ca.pem -name \"$(USER_NAME)\" -out client_android.p12 -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)\r\n cp client_android.p12 $(USER_NAME)_android.p12<\/pre>\r\n\r\n\r\n\r\nNote that the above lines will wrap in your browser but if you copy and paste them they should be formatted correctly.<\/strong><\/p>\r\n\r\n\r\n\r\n
Make sure indented lines are tabs and not spaces or the file will not work. This change creates a special case for Android certificates and renames the files to be easier to identify.<\/p>\r\n\r\n\r\n\r\n
Edit ‘client.cnf’ to set your defaults just like you did before but this time for any client certificates. You probably want to shorten the default_days to 365 (will need to regenerate keys for the device in a year) but again change the default_md to sha1 and default_bits to 4096.<\/p>\r\n\r\n\r\n\r\n
In the “[ req ]” section of client.cnf is the “input_password” and “output_password”. Set these both to the same, and keep in mind that this password will be needed when the certificate is installed on the client so keep in mind using mobile keyboards to type it. The “[client]” section uniquely identifies the user in log files, so be sure the emailAddress and commonName are set properly.<\/p>\r\n\r\n\r\n\r\n
Now create the client certificate with:<\/p>\r\n\r\n\r\n\r\n
make client.pem\r\nmake client_android.p12<\/pre>\r\n\r\n\r\n\r\nSimply edit the client.cnf file for the next certificate and run those commands again to generate certificates for each device that will have WIFI access.<\/p>\r\n\r\n\r\n\r\n
Finally, lets set the proper permissions for certificates and create the links we need:<\/p>\r\n\r\n\r\n\r\n
chmod 600 *\r\nchmod 640 ca.pem\r\nchmod 640 server.pem\r\nchmod 640 server.key\r\nchgrp ssl-cert ca.pem\r\nchgrp ssl-cert server.pem\r\nchgrp ssl-cert server.key\r\ncd \/etc\/freeradius\/certs\/\r\nln -s \/var\/certs\/freeradius\/ca.pem ca.pem\r\nln -s \/var\/certs\/freeradius\/server.pem server.pem\r\nln -s \/var\/certs\/freeradius\/server.key server.key<\/pre>\r\n\r\n\r\n\r\nAfter creating new client certificates, the first four lines of the above command should be run again to ensure the security is set properly.<\/p>\r\n\r\n\r\n\r\n
THE RIGHT CERTIFICATES IN THE RIGHT PLACES<\/h4>\r\n\r\n\r\n\r\n
Here’s the files needed:<\/p>\r\n\r\n\r\n\n
- Windows: ca.der and [user].p12<\/li>
- Linux: ca.pem and [user].p12<\/li>
- Android: [user]_android.p12<\/li><\/ul>\n\r\n\r\n\r\n
Note that recent versions of Android will constantly display a warning that your connection is monitored while using wifi with a RADIUS server. There are ways on a rooted device to install the certificate in the root store, but regardless it doesn’t actually affect the operation of the device.<\/p>\r\n\r\n\r\n\r\n
Link: https:\/\/www.ossramblings.com\/using-freeradius-ubuntu-server-wifi<\/a><\/p>\r\n","protected":false},"excerpt":{"rendered":"
INSTALL FREERADIUS First, let’s install the RADIUS server, FreeRADIUS. On the server that is going to host it do: sudo apt-get install freeradius make There are many different ways that FreeRADIUS can be configured, and honestly I don’t understand most … Continue reading