Freeradius

Tabla de contenidos
1 Freeradius con Soporte EAP-TLS e Integrado LDAP
1.1 Instalacin
1.2 Configuracin
1.3 Generar los Certificados
1.3.1 Generar el Certificado de la CA
1.3.2 Generamos el Certificado para el
Servidor
1.3.3 Copiando los Certificados a
/etc/wireless-auth/
1.3.4 Configuracin de los Certificados en
/etc/freeradius/radiusd.conf
1.3.5 Creando Certificados para los Clientes
1.4 Integracin LDAP

Freeradius con Soporte EAP-TLS e Integrado LDAP

Instalacin
En Debian, el paquete Freeradius es generado sin soporte para EAP-TLS, debido a problemas de licencia de
la librera OpenSSL, necesaria para implementar 802.1x, vamos a necesitar que esta caracterstica se
encuentre activa.
Para activar el soporte EAP-TLS, debemos generar el paquete recompilando con la opcin --with-eap-tls,
previamente es necesario descargar las fuentes del paquete freeradius.

Descargando las fuentes del paquete freeradius.

Editamos el fichero /etc/apt/sources.list y agregamos la entrada deb-src para Debian Etch.

grep src
{{{
bolivar:/usr/src# aptitude update
Des:1 http://ftp.debian.org etch Release.gpg [386B]
Ign http://ftp.debian.org etch/main Translation-es
Ign http://ftp.debian.org etch/contrib Translation-es
Ign http://ftp.debian.org etch/non-free Translation-es
Obj http://ftp.debian.org etch Release
Ign http://ftp.debian.org etch/main Packages/DiffIndex
Ign http://ftp.debian.org etch/contrib Packages/DiffIndex
Ign http://ftp.debian.org etch/non-free Packages/DiffIndex
Des:2 http://ftp.debian.org etch/main Sources [1218kB]
Des:3 http://ftp.debian.org etch/contrib Sources [18,3kB]
Des:4 http://ftp.debian.org etch/non-free Sources [28,1kB]
Obj http://ftp.debian.org etch/main Packages
Obj http://ftp.debian.org etch/contrib Packages
Obj http://ftp.debian.org etch/non-free Packages

Freeradius con Soporte EAP-TLS e Integrado LDAP

Freeradius
Descargados 1265kB en 1min6s (19,2kB/s).
Leyendo lista de paquetes... Hecho
}}}

Instalamos los paquetes necesarios para poder obtener fuentes de paquetes:

dpkg-dev

{{{
bolivar# aptitude install dpkg-dev
}}}

Entramos al directorio /usr/src

{{{
cd /usr/src
}}}

Usando el comando apt-get source descargamos las fuentes de freeradius para

Debian Etch

{{{
bolivar:/usr/src# apt-get source freeradius
Leyendo lista de paquetes... Hecho
Creando rbol de dependencias
Leyendo la informacin de estado... Hecho
Necesito descargar 2605kB de archivos fuente.
Des:1 http://ftp.debian.org etch/main freeradius 1.1.3-3 (dsc) [998B]
Des:2 http://ftp.debian.org etch/main freeradius 1.1.3-3 (tar) [2587kB]
Des:3 http://ftp.debian.org etch/main freeradius 1.1.3-3 (diff) [17,1kB]
Descargados 2605kB en 2min9s (20,2kB/s)
gpg: Signature made sb 16 dic 2006 19:50:31 VET using DSA key ID EA59038E
gpg: Can't check signature: public key not found
dpkg-source: extracting freeradius in freeradius-1.1.3
dpkg-source: info: unpacking freeradius_1.1.3.orig.tar.gz
dpkg-source: info: applying freeradius_1.1.3-3.diff.gz
}}}

Editamos los ficheros control y rules para personalizar el paquete freeradius.

Entramos al directorio freeradius-1.1.3/debian

Instalacin

Freeradius

{{{
bolivar:/usr/src# cd freeradius-1.1.3/debian/
bolivar:/usr/src/freeradius-1.1.3/debian#
}}}

Editamos el fichero control.

En la linea 3, quitamos el texto libssl-dev, ya que esto causa que no se pueda
instalar el paquete freeradius si esta instalado libss-dev

{{{
3 Build-Conflicts: libssl-dev
}}}
{{{
3 Build-Conflicts:
}}}

En la linea 2, vamos a quitar lo que por ahora no, para esta instalacin
especifica: libmysqlclient15-dev | libmysqlclient-dev, libiodbc2-dev y
agregamos libssl-dev

libmysqlclient-dev, libgdbm- dev,

libldap2-dev, libsasl2-dev,
libiodbc2-dev,
libkrb5-dev, snmp, autotools-dev, dpatch (>= 2), libperl-dev, li

btool, dpkg-dev (>= 1.13.19)

{{{
2 Build-Depends: debhelper (>= 5), libltdl3-dev, libpam0g-dev, libgdbm-dev, libldap2-dev, libsasl
libkrb5-de
v, snmp, autotools-dev, dpatch (>= 2), libperl-dev, libtool, dpkg-dev (>= 1.13.19),
}}}

Eliminamos las declaraciones de los paquetes freeradius-mysql,

freeradius-iodbc y freeradius-dialupadmin, esto lo logramos eliminando
desde la linea 44 en adelante:
{{
45
46
47
48
49
50
51
52
53

Package: freeradius-mysql
Architecture: any
Conflicts: radiusd-freeradius-mysql
Replaces: radiusd-freeradius-mysql
Depends: freeradius (= ${binary:Version}), ${shlibs:Depends}
Description: MySQL module for FreeRADIUS server
The FreeRADIUS server can use MySQL to authenticate users and do accounting,
and this module is necessary for that.

Instalacin

Freeradius
54 Package: freeradius-iodbc
55 Architecture: any
56 Depends: freeradius (= ${binary:Version}), ${shlibs:Depends}
57 Description: iODBC module for FreeRADIUS server
58 The FreeRADIUS server can use iODBC to access databases to authenticate users
59 and do accounting, and this module is necessary for that.
60
61 Package: freeradius-dialupadmin
62 Architecture: all
63 Depends: php4
64 Suggests: apache2-mpm-prefork | httpd, php4-mysql | php4-pgsql, libdate-manip-perl
65 Recommends: ${perl:Depends}
66 Description: set of PHP scripts for administering a FreeRADIUS server
67 These scripts provide a web-based interface for administering a FreeRADIUS
68 server which stores authentication information in either SQL or LDAP.
}}}

El fichero queda de esta manera control :

Ahora editamos el fichero rules
Buscamos la linea 26, y reemplazamos
--without-rlm_eap_tls por --with-rlm_eap_tls.
La linea 26 debe quedar de la siguiente manera:

{{{
26 buildssl=--without-rlm_eap_peap --with-rlm_eap_tls --without-rlm_eap_ttls --without-rlm_otp
--without-rlm_sql_postgresql --without-snmp --without- rlm_sql_iodbc --without-rlm_sql_mysql --wi
}}}
* Debemos Dejar --without-rlm_sql_postgresql en la linea 26
* En la linea 27 quitamos sql_mysql y sql_iodbc
* Quedaria de la siguiente manera:

{{{
26 buildssl=--without-rlm_eap_peap --with-rlm_eap_tls --without-rlm_eap_ttls --without-rlm_otp --w
27 modulelist=krb5 ldap
}}}
* El fichero rules queda de la siguiente manera: rules
* Salimos al directorio /usr/src/freeradius-1.1.3
{{{
bolivar:/usr/src/freeradius-1.1.3# cd ..
}}}

* Luego ejecutamos el comando dpkg-buildpackage para revisar las dependencias y generar el paquete
{{{
bolivar:/usr/src/freeradius-1.1.3# dpkg-buildpackage
dpkg-buildpackage: set CFLAGS to default value: -g -O2
dpkg-buildpackage: set CPPFLAGS to default value:
dpkg-buildpackage: set LDFLAGS to default value:
dpkg-buildpackage: set FFLAGS to default value: -g -O2
dpkg-buildpackage: set CXXFLAGS to default value: -g -O2

Instalacin

Freeradius
dpkg-buildpackage: source package freeradius
dpkg-buildpackage: source version 1.1.3-3
dpkg-buildpackage: source changed by Mark Hymers <[email protected]>
dpkg-buildpackage: host architecture i386
dpkg-checkbuilddeps: Unmet build dependencies: snmp dpatch (>= 2)
dpkg-buildpackage: warning: Build dependencies/conflicts unsatisfied; aborting.
dpkg-buildpackage: warning: (Use -d flag to override.)
}}}
* Instalamos los paquetes necesarios debhelper libltdl3-dev libpam0g-dev libgdbm-dev
libldap2-dev libsasl2-dev libkrb5-dev snmp autotools-dev dpatch libperl-dev libtool libssl-dev

{{{
bolivar:/usr/src/freeradius-1.1.3# aptitude install aptitude install debhelper libltdl3-dev libpam
libldap2-dev libsasl2-dev libkrb5-dev snmp autotools-dev dpatch libperl-dev libtool libssl-dev
Leyendo lista de paquetes... Hecho
Creando rbol de dependencias
Leyendo la informacin de estado... Hecho
Leyendo la informacin de estado extendido
Inicializando el estado de los paquetes... Hecho
Leyendo las descripciones de las tareas... Hecho
}}}
* Luego solo queda ejecutar el comando dpkg-buildpackage para generar los paquetes.

Luego de haber generado el paquete, tenemos en el directorio /usr/src, los archivos .deb
correspondientes:

{{{
bolivar:/usr/src#
-rw-r--r-- 1 root
-rw-r--r-- 1 root
-rw-r--r-- 1 root
}}}

ls *.deb -l
src 752138 2008-12-02 03:33 freeradius_1.1.3-3_i386.deb
src 32402 2008-12-02 03:33 freeradius-krb5_1.1.3-3_i386.deb
src 46730 2008-12-02 03:33 freeradius-ldap_1.1.3-3_i386.deb

Usamos el comando dpkg -i para instalar los paquetes.

{{{
bolivar:/usr/src# dpkg -i freeradius_1.1.3-3_i386.deb
Seleccionando el paquete freeradius previamente no seleccionado.
(Leyendo la base de datos ...
207333 ficheros y directorios instalados actualmente.)
Desempaquetando freeradius (de freeradius_1.1.3-3_i386.deb) ...
Configurando freeradius (1.1.3-3) ...
Stopping FreeRADIUS daemon: freeradius/var/run/freeradius/freeradius.pid not found....
Starting FreeRADIUS daemon: freeradiusTue Dec 2 09:43:39 2008 : Info: Starting - reading configur
.
Processing triggers for man-db ...

Instalacin

Freeradius

}}}
{{{
bolivar:/usr/src# dpkg -i freeradius-ldap_1.1.3-3_i386.deb
Seleccionando el paquete freeradius-ldap previamente no seleccionado.
(Leyendo la base de datos ...
207646 ficheros y directorios instalados actualmente.)
Desempaquetando freeradius-ldap (de freeradius-ldap_1.1.3-3_i386.deb) ...
Configurando freeradius-ldap (1.1.3-3) ...
Reloading configuration files for FreeRADIUS daemon.../var/run/freeradius/freeradius.pid not found
}}}

Configuracin
* La configuracin gira en torno a 2 ficheros de configuracin /etc/freeradius/radiusd.conf:
{{{
/etc/freeradius# vim radiusd.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

prefix = /usr
exec_prefix = /usr
sysconfdir = /etc
localstatedir = /var
sbindir = ${exec_prefix}/sbin
logdir = /var/log/freeradius
raddbdir = /etc/freeradius
raacctdir = ${logdir}/radacct
confdir = ${raddbdir}
run_dir = ${localstatedir}/run/freeradius
log_file = ${logdir}/radius.log
libdir = /usr/lib
pidfile = ${run_dir}/radiusd.pid
user = freerad
group = freerad
max_request_time = 30
delete_blocked_requests = no
cleanup_delay = 5
max_requests = 1024
bind_address = *
port = 0
hostname_lookups = no
allow_core_dumps = no
regular_expressions = yes
extended_expressions = yes
log_stripped_names = no
log_auth = no
log_auth_badpass = no
log_auth_goodpass = no
usercollide = no
lower_user = no
lower_pass = no
nospace_user = no
nospace_pass = no
checkrad = ${sbindir}/checkrad
security {
max_attributes = 200
reject_delay = 1
status_server = no

Configuracin

Freeradius
40 }
41 proxy_requests = no
42 $INCLUDE ${confdir}/clients.conf
43 snmp = no
44 thread pool {
45
start_servers = 2
46
max_servers = 10
47
min_spare_servers = 3
48
max_spare_servers = 10
49
max_requests_per_server = 0
50 }
51 modules {
52
eap {
53
default_eap_type = tls
54
timer_expire
= 60
55
tls {
56
private_key_password = Woclicikod
57
private_key_file = /etc/wireless-auth/radius.pem
58
certificate_file = /etc/wireless-auth/radius.pem
59
CA_file = /etc/wireless-auth/root.pem
60
dh_file = /etc/wireless-auth/DH
61
random_file = /etc/wireless-auth/random
62
fragment_size = 1024
63
include_length = yes
64
}
65
}
66
ldap {
67
server
= 192.168.3.253
68
port
= 389
69
net_timeout
= 10
70
timeout
= 10
71
ldap_debug
= 0x0028
72
identity
= "cn=admin,dc=cnti,dc=gob,dc=ve"
73
password
= "123321..."
74
basedn
= "ou=unidades,dc=cnti,dc=gob,dc=ve"
75
filter
= "(&(objectclass=radiusprofile)(uid=%u))"
76
start_tls
= no
77
}
78
preprocess {
79
huntgroups = ${confdir}/huntgroups
80
hints = ${confdir}/hints
81
82
with_ascend_hack = no
83
ascend_channels_per_line = 23
84
85
with_ntdomain_hack = no
86
with_specialix_jetstream_hack = no
87
with_cisco_vsa_hack = no
88
}
89
files {
90
usersfile = ${confdir}/users
91
acctusersfile = ${confdir}/acct_users
92
compat = no
93
}
94
detail {
95
detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d
96
detailperm = 0600
97
}
98
acct_unique {
99
key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port-Id"
100
}
101
radutmp {

Configuracin

Freeradius
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163

filename = ${logdir}/radutmp
username = %{User-Name}
case_sensitive = yes
check_with_nas = yes
perm = 0600
callerid = "yes"
}
radutmp sradutmp {
filename = ${logdir}/sradutmp
perm = 0644
callerid = "no"
}
expr {
}
always fail {
rcode = fail
}
always reject {
rcode = reject
}
always ok {
rcode = ok
simulcount = 0
mpp = no
}
exec {
wait = yes
input_pairs = request
}
exec echo {
wait = yes
program = "/bin/echo %{User-Name}"
input_pairs = request
output_pairs = reply
}
ippool main_pool {
range-3 = (starting IP address)
range-stop = (ending IP address)
netmask = 255.255.255.0
cache-size = 800
session-db = ${raddbdir}/db.ippool
ip-index = ${raddbdir}/db.ipindex
override = no
}
}
instantiate {
expr
}
authorize {
preprocess
eap
ldap
files
}
authenticate {
eap
}
preacct {
preprocess
files
}
accounting {

Configuracin

Freeradius
164
165
166
167
168
169
170
171
172
}}}

acct_unique
detail
radutmp
}
session {
radutmp
}
post-auth {
}

Editamos el fichero /etc/freeradius/clients.conf:

En este fichero, se declaran los bloques respectivos a cada uno de los
agentes nas, que enviaran informacin al servidor FreeRaidus, por ejemplo,
si tenemos un AP que tiene como ip 192.168.3.50, definimos un bloque para
este ap, como esta especificado en el siguiente ejemplo:

{{{
/etc/freeradius# vim clients.conf
client 192.168.3.50 {
secret
= xxxxx
shortname
= ap
nastype
= other
}

client 192.168.3.51 {
secret
shortname
nastype
}

= xxxxxxx
= laboratorio
= other

client 192.168.3.248 {
secret = test-secret
shortname = localhost
}
}}}

Generar los Certificados

Para generar los certificados vamos a hacer uso de tres (3) scripts:
CA.root

head -c 32`

Generar los Certificados

Freeradius
cat /dev/null > $PASSDIR/root.pass
echo $PASSWD >> $PASSDIR/root.pass
fi
fi

rm -rf demoCA

$OPENSSL req -new -x509 -days $VALIDFOR -keyout $PEMDIR/newreq.pem -out \

$PEMDIR/newreq.pem -passin pass:$PASSWD -passout pass:$PASSWD
echo "${PEMDIR}/newreq.pem"
* CA.server
head -c 32`
cat /dev/null > $PASSDIR/$SNAME.pass
echo $PASSWD >> $PASSDIR/$SNAME.pass
fi
fi

if [ -z "${ROOTPASSWD}" ]; then
echo "No root password specified, trying $PASSDIR/root.pass."
if [ -a $PASSDIR/root.pass ]; then
ROOTPASSWD=`cat $PASSDIR/root.pass`
else
echo "FATAL: No root certification password."
exit
fi
fi

$OPENSSL req -new -keyout $PEMDIR/newreq.pem -out $PEMDIR/newreq.pem -passin \

pass:$PASSWD -passout pass:$PASSWD
$OPENSSL ca -policy policy_anything -out $PEMDIR/newcert.pem

Generar los Certificados

-key $ROOTPASSWD \

10

Freeradius
-extensions xpserver_ext -extfile xpextensions -days $VALIDFOR -infiles $PEMDIR/newreq.pem
$OPENSSL pkcs12 -export -in $PEMDIR/newcert.pem -inkey $PEMDIR/newreq.pem -out \
$P12DIR/$1.p12 -clcerts -passin pass:$PASSWD -passout pass:$PASSWD
$OPENSSL pkcs12 -in $P12DIR/$SNAME.p12 -out $PEMDIR/$SNAME.pem -passin \
pass:$PASSWD -passout pass:$PASSWD
$OPENSSL x509 -inform PEM -outform DER -in $PEMDIR/$SNAME.pem -out $DERDIR/$SNAME.der

rm -rf $PEMDIR/newcert.pem $PEMDIR/newreq.pem

* CA.client
head -c 16`
cat /dev/null > $PASSDIR/$CLNAME.pass
echo $PASSWD >> $PASSDIR/$CLNAME.pass
fi
fi

if [ -z "${ROOTPASSWD}" ]; then
echo "No root password specified, trying $PASSDIR/root.pass."
if [ -a $PASSDIR/root.pass ]; then
ROOTPASSWD=`cat $PASSDIR/root.pass`
else
echo "FATAL: No root certification password."
exit
fi
fi

$OPENSSL req -new -keyout $PEMDIR/newreq.pem -out $PEMDIR/newreq.pem -passin \

pass:$PASSWD -passout pass:$PASSWD
$OPENSSL ca -policy policy_anything -out $PEMDIR/newcert.pem -passin \
pass:$PASSWD -key $ROOTPASSWD -extensions xpclient_ext -days $VALIDFOR \
-extfile xpextensions -infiles $PEMDIR/newreq.pem

Generar los Certificados

11

Freeradius
$OPENSSL pkcs12 -export -in $PEMDIR/newcert.pem -inkey $PEMDIR/newreq.pem -out \
$P12DIR/$CLNAME.p12 -clcerts -passin pass:$PASSWD -passout pass:$PASSWD
$OPENSSL pkcs12 -in $P12DIR/$CLNAME.p12 -out $PEMDIR/$CLNAME.pem -passin \
pass:$PASSWD -passout pass:$PASSWD
$OPENSSL x509 -inform PEM -outform DER -in $PEMDIR/$CLNAME.pem -out \
$PEMDIR/$CLNAME.der

rm -rf $PEMDIR/newcert.pem $PEMDIR/newreq.pem

Para poder usar los scripts necesitamos primero seguir los siguientes pasos:
Crear un fichero llamado xpextensions en la misma carpeta donde tenemos los
certificados, el contenido de este fichero es el siguiente:

{{{
[ xpclient_ext ]
extendedKeyUsage = 1.3.6.1.5.5.7.3.2

[ xpserver_ext ]
extendedKeyUsage = 1.3.6.1.5.5.7.3.1
}}}

Determinamos la ubicacin del script CA.pl

{{{
bolivar:# locate CA.pl
/mnt/usr/lib/ssl/misc/CA.pl
/mnt/usr/share/doc/openssl/doc/apps/CA.pl.pod.gz
/mnt/usr/share/man/man1/CA.pl.1ssl.gz
/usr/lib/ssl/misc/CA.pl
/usr/share/doc/openssl/doc/apps/CA.pl.pod.gz
/usr/share/man/man1/CA.pl.1ssl.gz
}}}

Generar los Certificados

12

Freeradius
Determinamos la ubicacin de openssl

{{{
bolivar:# which openssl
/usr/bin/openssl
}}}

Instalamos una herramienta para generar las contraseas:

{{{
bolivar:~# aptitude install apg
}}}

Generar el Certificado de la CA
Para generar el certificado de la CA, usamos el script CA.root.
Detalles:
Dejar en blanco los campos: Common Name (eg, YOUR name) []:
Email Address []:

{{{
bolivar:/mnt/root/radius/scripts2# bash CA.root
No root password specified, trying pass/root.pass.
Not found. Generating password, see pass/root.pass for contents.
Generating a 1024 bit RSA private key
....................++++++
.................................................++++++
writing new private key to 'pem/newreq.pem'
----You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----

Generar el Certificado de la CA

13

Freeradius
Country Name (2 letter code) [AU]:VE
State or Province Name (full name) [Some-State]:DC
Locality Name (eg, city) []:Caracas
Organization Name (eg, company) [Internet Widgits Pty Ltd]:CNTI
Organizational Unit Name (eg, section) []:Laboratorio
Common Name (eg, YOUR name) []:
Email Address []:
MAC verified OK
}}}

Generamos el Certificado para el Servidor

Definimos inicialmente un numero de serial dentro de la carpeta demoCA, que es creada por el script
CA.root.

{{{
echo "01" > serial
}}}

Luego invocamos el script CA.server, para generar el certificado del servidor de la siguiente manera
Detalles:
* Los campos Country Name, State or Province Name, Locality Name,
deben tener los mismos valores que en la CA.
En el campo Common Name, se debe colocar el nombre canonico
del servidor, ejemplo : radius.lab.cnti.gob.ve
Dejar en blanco los campos: A challenge password []: An optional
company name []:

{{{
bolivar:/mnt/root/radius/scripts2# bash CA.server freeradius
No password specified, trying pass/freeradius.pass.
No root password specified, trying pass/root.pass.
Generating a 1024 bit RSA private key
............++++++
........................................++++++
writing new private key to 'pem/newreq.pem'
-----

Generamos el Certificado para el Servidor

14

Freeradius
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
----Country Name (2 letter code) [AU]:VE
State or Province Name (full name) [Some-State]:DC
Locality Name (eg, city) []:Caracas
Organization Name (eg, company) [Internet Widgits Pty Ltd]:CNTI
Organizational Unit Name (eg, section) []:Laboratorio
Common Name (eg, YOUR name) []:radius.lab.cnti.gob.ve
Email Address []:

Please enter the following 'extra' attributes

to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /usr/lib/ssl/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Dec
Not After : Dec

2 17:54:15 2008 GMT

2 17:54:15 2009 GMT

Subject:
countryName
stateOrProvinceName
localityName
organizationName
organizationalUnitName
commonName
X509v3 extensions:

=
=
=
=
=
=

VE
DC
Caracas
CNTI
Laboratorio
radius.lab.cnti.gob.ve

X509v3 Extended Key Usage:

TLS Web Server Authentication
Certificate is to be certified until Dec

2 17:54:15 2009 GMT (365 days)

Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y

Generamos el Certificado para el Servidor

15

Freeradius
Write out database with 1 new entries
Data Base Updated
MAC verified OK
}}}

Copiando los Certificados a /etc/wireless-auth/

Creamos la carpeta /etc/wireless-auth

{{{
bolivar:~# mkdir /etc/wireless-auth
}}}

Copiamos los ficheros pem/root.pem (que contiene el certificado pblico de

la CA y la clave privada) y pem/freeradius.pem a /etc
/wireless-auth
{{{
cp pem/freeradius.pem pem/root.pem /etc/wireless-auth/
}}}

Dentro del directorio /etc/wireless-auth, creamos dos ficheros

necesarios DH y random

{{{
cd /etc/wireless-auth
}}}
{{{
bolivar:/etc/wireless-auth# apg -m 20 -n 1 > random
bolivar:/etc/wireless-auth# apg -m 20 -n 1 > DH
}}}

Definimos como dueo de los ficheros dentro de /etc/wireless-auth,

al usuario freerad

{{{
bolivar:/etc/wireless-auth# chown freerad.root *
bolivar:/etc/wireless-auth# cd ..
bolivar:/etc# chown freerad.root wireless-auth/

Copiando los Certificados a /etc/wireless-auth/

16

Freeradius
}}}

Configuracin de los Certificados en /etc/freeradius/radiusd.conf

Dentro del fichero de configuracin /etc/freeradius/radiusd.conf buscamos el bloque
correspondiente al mdulo EAP-TLS
Detalles:
private_key_password , el password que proteje la clave privada
de freeradius.pem, este password es generado por
el script, y es guardado en el directorio pass/
{{{
bolivar:/mnt/root/radius/scripts2# cd pass/
}}}
{{{
bolivar:/mnt/root/radius/scripts2/pass# cat freeradius.pass
ObbusFind8
}}}

private_key_file, apunta al fichero pem que genera el script

CA.server.
certificate_file, apunta al fichero pem que genera el script
CA.server.
CA_file, apunta el fichero pem que genera el script CA.root

{{{
modules {
eap {
default_eap_type = tls
timer_expire
= 60
tls {
private_key_password = ObbusFind8
private_key_file = /etc/wireless-auth/freeradius.pem
certificate_file = /etc/wireless-auth/freeradius.pem
CA_file = /etc/wireless-auth/root.pem
dh_file = /etc/wireless-auth/DH
random_file = /etc/wireless-auth/random
fragment_size = 1024
include_length = yes
}
}
}}}

Configuracin de los Certificados en /etc/freeradius/radiusd.conf

17

Freeradius

Creando Certificados para los Clientes

Corremos el script CA.client de la siguiente manera:
Detalles:
Se debe especificar el nombre del certificado, en
este caso es cliente
El campo Common Name (eg, YOUR name) []:
debe tener el nombre del usuario, tal y como esta en
el LDAP, ejemplo: cliente

{{{
bolivar:/mnt/root/radius/scripts2# bash CA.client cliente
No password specified, trying pass/cliente.pass.
Not found. Generating password, see pass/cliente.pass for contents.
No root password specified, trying pass/root.pass.
Generating a 1024 bit RSA private key
.....................................................................++++++
...........++++++
writing new private key to 'pem/newreq.pem'
----You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
----Country Name (2 letter code) [AU]:VE
State or Province Name (full name) [Some-State]:DC
Locality Name (eg, city) []:Caracas
Organization Name (eg, company) [Internet Widgits Pty Ltd]:CNTI
Organizational Unit Name (eg, section) []:Laboratorio
Common Name (eg, YOUR name) []:cliente
Email Address []:

Please enter the following 'extra' attributes

to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /usr/lib/ssl/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:

Creando Certificados para los Clientes

18

Freeradius
Serial Number: 2 (0x2)
Validity
Not Before: Dec
Not After : Dec

2 19:02:11 2008 GMT

2 19:02:11 2009 GMT

Subject:
countryName
= VE
stateOrProvinceName
= DC
localityName
= Caracas
organizationName
= CNTI
organizationalUnitName
= Laboratorio
commonName
= cliente
X509v3 extensions:
X509v3 Extended Key Usage:
TLS Web Client Authentication
Certificate is to be certified until Dec

2 19:02:11 2009 GMT (365 days)

Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y

Write out database with 1 new entries
Data Base Updated
MAC verified OK
}}}

Integracin LDAP
Se debe configurar el LDAP: [wiki:LdapRadius Configuracin de LDAP para FreeRadius]
Luego, en el fichero de configuracin principal de freeradius, el cual vimos anteriormente, hay un
bloque ldap
dentro de modules en donde vamos a configurar los parametros de conexin al LDAP.

{{{
ldap {
server
port
net_timeout
timeout
ldap_debug
identity
password
basedn
filter

Integracin LDAP

=
=
=
=
=
=
=
=
=

192.168.3.253
389
10
10
0x0028
"cn=admin,dc=cnti,dc=gob,dc=ve"
"xxx"
"ou=unidades,dc=cnti,dc=gob,dc=ve"
"(&(objectclass=radiusprofile)(uid=%u))"

19

Freeradius
start_tls

= no

}
}}}

server, debe ir la direccin IP o el nombre de dominio del serv

{{{
server = 192.168.3.253
}}}

identity, aqui va la informacin de autenticacin con el LDAP, en el atributo cn definimos el usuario

{{{
identity = "cn=admin,dc=cnti,dc=gob,dc=ve"
}}}

password, aqui va el password de conexin al LDAP.

{{{
password = "xxxx"
}}}

basedn, definimos la rama base de busquedas.

{{{
password = "xxxx"
}}}

filter, aqui se define la busqueda LDAP

{{{
filter = "(&(objectclass=radiusprofile)(uid=%u))"
}}}

Volver

Integracin LDAP

20