Changes between Version 79 and Version 80 of WikiStart


Ignore:
Timestamp:
Jul 31, 2013, 4:40:07 PM (11 years ago)
Author:
walter
Comment:

freeradius gedeelte opschonen

Legend:

Unmodified
Added
Removed
Modified

  • WikiStart

    v79 v80  
    840840De rol van deze machine is het centraal afhandelen/doorzetten van het radius verkeer van verschillende eduroam AP's uit het wireless Leiden netwerk, daarnaast functioneert deze machine als internet gateway/concentrator van het verkeer van diezelfde eduroam AP's. De verbinding(en) tussen de eduroam AP's en deze centrale machine worden met openvpn tunnels over het Wireless Leiden netwerk tot stand gebracht. Als hardware gebruiken we een via-epia m met twee bedraade netwerk interfaces. De eerste netwerk interface is gekoppeld aan de gateway waarvan het externe ip gewhitelist moet zijn voor contact met de eduroam Surf Foundation radius proxy. De tweede netwerk interface hangt aan de Wireless Leiden infrastructuur. De plaatsing van deze machine komt het meest tot z'n recht op een locatie waar al het eduroam gerelateerde internetverkeer een daarvoor aangewezen internet verbinding van een educatieve i.s.p. (Surfnet) in kan. De surfnet aansluiting van Universiteit Leiden in de Pieterskerk is daarvoor uitstekend geschikt en geoorloofd! Na de installatie van het OS FREEBSD/DEBIAN, word de benodigde software freeradius, isc-dhcp-server, openvpn en syslog-ng geladen en geconfigureerd. Tenslotte moet er een nat/gateway met bijbehorende firewall rules worden opgezet en heeft het pakket openvpn keys/certificates nodig zie 3 certnode van deze handleiding!
    841841
    842 ==== 2.1a Install & configure FreeBSD 8.3 ====
     842==== 2.1 Install & configure FreeBSD 8.3 ====
    843843TODO:Ligt een kant en klare FREEBSD 8.3 disk klaar hoe verder te configureren?
    844844
    845 ==== 2.1b Install & configure debian 7 wheezy ====
     845==== 2.2a Install & configure debian 7 wheezy ====
    846846Voor het OS is debian 7 wheezy i386 gekozen, dit omdat de VIA-EPIA-m geen 5/686 cmov cpu instructieset ondersteunt! De definitieve setup zal op ubuntu 12.04 lts server of freebsd draaien. Met een minimale install inclusief "SSH server" en "standaard tools" word deze debian 7 installatie later uitgebouwd en geconfigureerd. Installeer eerst debian op betreffende machine, download hiervoor de cd/usb image, plaats deze op usbstick en start de installatie. Opmerking, onthoud dat de machine tijdens de installatie en daarna toegang tot internet nodig heeft om alle pakketten te installeren en dus de configuratie te voltooien!
    847847
    … …  
    908908        netmask 255.255.255.0 #! bigger subnet for more clients/AP's? <---
    909909}}}
     910
     911Continue setting up isc-dhcp-server. Besides editing the conf file, the service also needs to be removed from its default boot routine because it starts to early before its openvpn interface is online!
     912
     913#example code# /etc/dhcp/dhcpd.conf
     914{{{
     915option domain-name "eduroam.org";
     916option domain-name-servers 8.8.8.8; #! since no local dns server is running on this machine specify a correct one! <---
     917default-lease-time 600;
     918max-lease-time 7200;
     919#subnet 192.168.4.0 netmask 255.255.255.0 {
     920#       range 192.168.4.100 192.168.4.150;
     921#       option routers 192.168.4.1;
     922
     923#ap's different lease
     924class "ubntaps" {
     925        match if (substring (hardware, 1, 3) = DC:9F:DB);
     926}
     927
     928class "eduroamusers" {
     929        match if not (substring (hardware, 1, 3) = DC:9F:DB);
     930}
     931
     932subnet 192.168.4.0 netmask 255.255.255.0 {
     933        option routers 192.168.4.1;
     934
     935pool {
     936        allow members of "ubntaps";
     937        range 192.168.4.3 192.168.4.66;
     938}
     939
     940pool {
     941        allow members of "eduroamusers";
     942        range 192.168.4.150 192.168.4.250;
     943}
     944
     945}
     946
     947
     948}
     949}}}
     950
     951Remove isc-dhcp-server from its normal startup instance!
     952{{{
     953update-rc.d isc-dhcp-server disable
     954}}}
     955
     956Continue setting up openvpn. Remember that the openvpn server needs:'openvpn.conf', 'up.sh' (script that will initiate the isc-dhcp-server as soon as the openvpn tap0 interface is available) and offcourse server-certificate files (created in part 3.1 of this howto)!
     957
     958#example code# /etc/openvpn/openvpn.conf
     959{{{
     960port 1194
     961proto tcp #udp
     962dev tap0
     963ca /etc/openvpn/ca.crt
     964cert /etc/openvpn/eduradprox.crt #!check name <---
     965key /etc/openvpn/eduradprox.key #!check name <---
     966dh /etc/openvpn/dh1024.pem
     967server-bridge 192.168.3.1 255.255.255.0 192.168.3.100 192.168.3.150 #! still not understood? <---
     968mode server
     969persist-key
     970persist-tun
     971verb 4
     972log /var/log/openvpn.log
     973script-security 2 #! Allows isc-dhcp-server as external program to be started by up.sh <---
     974up /etc/openvpn/up.sh
     975#duplicate-cn #! allowing this lowers security<---
     976status /var/db/openvpn-status.log
     977keepalive 10 180
     978}}}
     979
     980#example code# /etc/openvpn/up.sh
     981{{{
     982#!/bin/sh
     983ifup tap0 >/dev/null 2>&1 #allow-hotplug takes care of this?
     984#/sbin/ifconfig $1 192.168.4.1/24 up | exit 0
     985/bin/sleep 7
     986service isc-dhcp-server restart >/dev/null 2>&1
     987#/sbin/ifconfig bridge0 addm $1 | exit 0
     988}}}
     989
     990Flag the up.sh script as executable other wise openvpn cannot run!
     991{{{
     992chmod +x /etc/openvpn/up.sh
     993}}}
     994
     995
     996Copy the following server/eduradprox files made on the certnode /etc/openvpn/ to the openvpn server directory.
     997{{{
     998cp eduradprox.key eduradprox.crt ca.crt dh1024.pem /etc/openvpn/
     999}}}
     1000
     1001Setup syslog-ng, this will sort remote log files by hostname and day!
     1002
     1003#example code# /etc/syslog-ng/conf.d/00load-remote.conf
     1004{{{
     1005source s_net { udp(); };
     1006destination df_remote { file("/var/log/remote-log/AP$HOST/$DAY$MONTH$YEAR.log" owner(root) group(adm) perm(0600) create_dirs(yes) dir_perm(0700)); };
     1007log { source(s_net); destination(df_remote); };
     1008}}}
     1009
     1010To allow nat/routing and function as a local gateway/concentrator for the tunneld traffic from eduroam accesspoints (openvpn clients) the following config must be set every boot.
     1011{{{
     1012## add the following firewall masquerade code "quick and dirty" at the end of the rc.local file before exit0!
     1013nano /etc/rc.local
     1014}}}
     1015
     1016#example code# /etc/rc.local
     1017{{{
     1018
     1019#enable forwarding at ip level
     1020echo "1" > /proc/sys/net/ipv4/ip_forward
     1021
     1022#enable nat/routing from eth0
     1023/sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
     1024
     1025#enable nat/routing to eth0 directly
     1026/sbin/iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
     1027/sbin/iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
     1028
     1029#enable nat/routing to tap0 openvpn
     1030/sbin/iptables -A FORWARD -i eth0 -o tap0 -m state --state RELATED,ESTABLISHED -j ACCEPT
     1031/sbin/iptables -A FORWARD -i tap0 -o eth0 -j ACCEPT
     1032
     1033#before exit 0
     1034}}}
     1035
     1036TODO firewall rules Lokaal netwerk nog afschermen!!! zodat eduroam alleen internet op kan en niet netwerk van anywi/katzy/radiusverkeer, wellicht bepaalde porten filteren eduroamcookbook?
     1037
     1038==== 2.2b Freeradius ====
    9101039
    9111040Continue setting up freeradius. See following 5 example config files for eduroam SP + idP setup.
    … …  
    12061335}}}
    12071336
    1208 ===== 2.1bb Freeradius TTLS/PEAP certificates =====
    1209 
    1210 During install of freeradius, certificates are probably auto generated see "/etc/freeradius/certs" folder. These are needed for the eduroam idP part to allow local authentication of the users we created with a "@wleiden.net" realm. However these certificates are made with a common/default credentials like "Freeradius CA etc" but they can also be customized "Wireless Leiden CA department et " by editing the *.cnf (ca, client, server)files and running the ./bootstrap command. See /usr/share/doc/freeradius/examples/certs/. Probably there is still some parameter in one of the *.cnf file that is common between the ca client and server, therefor it also writes the private key into the public certificate?
    1211 
    1212 * Bootstrap will probably not run for a second time so move/delete all other files excepts these: bootstrap ca.cnf client.cnf README server.cnf xpextensions.
    1213 * For editing/customizing the *.cnf files make sure the "server.cnf" and "client.cnf" have a different "commonname" at the end of their files otherwise database TXTDB 2 error.
    1214 * Warning the *.pem file we will deploy among users needs to be stripped of bag attributes and PRIVATEKEY!!!!
    1215 
    1216  *Mac/Linux
    1217 The "server.pem" file is the one that needs to be distributed/deployed among the eduroam users to correctly setup their supplicants for safely logging in, for Mac and Linux. For Mac it works, only validating the origin of the certificate !ITSELF! gives a warning (red* mark), since we didn't use/bought a known verified root CA so Mac OSX cannot Validate the "WirelessLeiden CA department" with the certificates it already has from verizon/thawte/etc. We can buy a certificate or we need to supply our own ROOT CA in our case "ca.pem" file. Than the Mac operating systems thinks everything is fine and the red mark about a certificate from a possible unknown provider will be gone. After importing this "root" "ca.pem" it can be easily converted by Mac OSX to "ca.cer" to be usable by Windows XP-8, since windows systems only allows Root (dutch=basis) certificates "ca.cer" to match its radius supplicant instead of "server.pem".
    1218 
    1219  *Windows
    1220 In Windows double click the ca.cer file and import it into the ROOT store! Than you will be able to select it in the PEAP / supplicant option when you setup the eduroam window in network settings! Freeradius by default creates a ca.der file which can be renamed to cer to be used by windows. If Freeradius/certs/ folder also contains a ca.cer it can be automatically be pushed to windows clients for installing!
    1221 
    1222 Convert a DER file (.crt .cer .der) to PEM
    1223 openssl x509 -inform der -in certificate.cer -out certificate.pem
    1224 
    1225 Convert a PEM file to DER
    1226 openssl x509 -outform der -in certificate.pem -out certificate.der
     1337===== 2.2c Freeradius TTLS/PEAP certificates =====
     1338
     1339During install of freeradius, certificates are probably auto generated see "/etc/freeradius/certs" folder. These files are needed for the eduroam idP part to allow safe local authentication via ssl/ttls of the local users we created with a "@wleiden.net" realm. However these certificates are made with common/default credentials like "Freeradius CA etc" but they must be replaced by a certificates supplied from a official Root Certificate Authority Verisign/Comodo/etc to function in a enterprise environment. For testing purposes they can also be generated and customized for instance "Wireless Leiden CA department" by editing the *.cnf (ca, client, server)files and running the ./bootstrap command, see /usr/share/doc/freeradius/examples/certs/.
    12271340
    12281341{{{
    … …  
    12461359}}}
    12471360
    1248 Continue setting up isc-dhcp-server. Besides editing the conf file, the service also needs to be removed from its default boot routine because it starts to early before its openvpn interface is online!
    1249 
    1250 #example code# /etc/dhcp/dhcpd.conf
    1251 {{{
    1252 option domain-name "eduroam.org";
    1253 option domain-name-servers 8.8.8.8; #! since no local dns server is running on this machine specify a correct one! <---
    1254 default-lease-time 600;
    1255 max-lease-time 7200;
    1256 #subnet 192.168.4.0 netmask 255.255.255.0 {
    1257 #       range 192.168.4.100 192.168.4.150;
    1258 #       option routers 192.168.4.1;
    1259 
    1260 #ap's different lease
    1261 class "ubntaps" {
    1262         match if (substring (hardware, 1, 3) = DC:9F:DB);
    1263 }
    1264 
    1265 class "eduroamusers" {
    1266         match if not (substring (hardware, 1, 3) = DC:9F:DB);
    1267 }
    1268 
    1269 subnet 192.168.4.0 netmask 255.255.255.0 {
    1270         option routers 192.168.4.1;
    1271 
    1272 pool {
    1273         allow members of "ubntaps";
    1274         range 192.168.4.3 192.168.4.66;
    1275 }
    1276 
    1277 pool {
    1278         allow members of "eduroamusers";
    1279         range 192.168.4.150 192.168.4.250;
    1280 }
    1281 
    1282 }
    1283 
    1284 
    1285 }
    1286 }}}
    1287 
    1288 Remove isc-dhcp-server from its normal startup instance!
    1289 {{{
    1290 update-rc.d isc-dhcp-server disable
    1291 }}}
    1292 
    1293 Continue setting up openvpn. Remember that the openvpn server needs:'openvpn.conf', 'up.sh' (script that will initiate the isc-dhcp-server as soon as the openvpn tap0 interface is available) and offcourse server-certificate files (created in part 3.1 of this howto)!
    1294 
    1295 #example code# /etc/openvpn/openvpn.conf
    1296 {{{
    1297 port 1194
    1298 proto tcp #udp
    1299 dev tap0
    1300 ca /etc/openvpn/ca.crt
    1301 cert /etc/openvpn/eduradprox.crt #!check name <---
    1302 key /etc/openvpn/eduradprox.key #!check name <---
    1303 dh /etc/openvpn/dh1024.pem
    1304 server-bridge 192.168.3.1 255.255.255.0 192.168.3.100 192.168.3.150 #! still not understood? <---
    1305 mode server
    1306 persist-key
    1307 persist-tun
    1308 verb 4
    1309 log /var/log/openvpn.log
    1310 script-security 2 #! Allows isc-dhcp-server as external program to be started by up.sh <---
    1311 up /etc/openvpn/up.sh
    1312 #duplicate-cn #! allowing this lowers security<---
    1313 status /var/db/openvpn-status.log
    1314 keepalive 10 180
    1315 }}}
    1316 
    1317 #example code# /etc/openvpn/up.sh
    1318 {{{
    1319 #!/bin/sh
    1320 ifup tap0 >/dev/null 2>&1 #allow-hotplug takes care of this?
    1321 #/sbin/ifconfig $1 192.168.4.1/24 up | exit 0
    1322 /bin/sleep 7
    1323 service isc-dhcp-server restart >/dev/null 2>&1
    1324 #/sbin/ifconfig bridge0 addm $1 | exit 0
    1325 }}}
    1326 
    1327 Flag the up.sh script as executable other wise openvpn cannot run!
    1328 {{{
    1329 chmod +x /etc/openvpn/up.sh
    1330 }}}
    1331 
    1332 
    1333 Copy the following server/eduradprox files made on the certnode /etc/openvpn/ to the openvpn server directory.
    1334 {{{
    1335 cp eduradprox.key eduradprox.crt ca.crt dh1024.pem /etc/openvpn/
    1336 }}}
    1337 
    1338 Setup syslog-ng, this will sort remote log files by hostname and day!
    1339 
    1340 #example code# /etc/syslog-ng/conf.d/00load-remote.conf
    1341 {{{
    1342 source s_net { udp(); };
    1343 destination df_remote { file("/var/log/remote-log/AP$HOST/$DAY$MONTH$YEAR.log" owner(root) group(adm) perm(0600) create_dirs(yes) dir_perm(0700)); };
    1344 log { source(s_net); destination(df_remote); };
    1345 }}}
    1346 
    1347 To allow nat/routing and function as a local gateway/concentrator for the tunneld traffic from eduroam accesspoints (openvpn clients) the following config must be set every boot.
    1348 {{{
    1349 ## add the following firewall masquerade code "quick and dirty" at the end of the rc.local file before exit0!
    1350 nano /etc/rc.local
    1351 }}}
    1352 
    1353 #example code# /etc/rc.local
    1354 {{{
    1355 
    1356 #enable forwarding at ip level
    1357 echo "1" > /proc/sys/net/ipv4/ip_forward
    1358 
    1359 #enable nat/routing from eth0
    1360 /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
    1361 
    1362 #enable nat/routing to eth0 directly
    1363 /sbin/iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
    1364 /sbin/iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
    1365 
    1366 #enable nat/routing to tap0 openvpn
    1367 /sbin/iptables -A FORWARD -i eth0 -o tap0 -m state --state RELATED,ESTABLISHED -j ACCEPT
    1368 /sbin/iptables -A FORWARD -i tap0 -o eth0 -j ACCEPT
    1369 
    1370 #before exit 0
    1371 }}}
    1372 
    1373 TODO firewall rules Lokaal netwerk nog afschermen!!! zodat eduroam alleen internet op kan en niet netwerk van anywi/katzy/radiusverkeer, wellicht bepaalde porten filteren eduroamcookbook?
     1361* Bootstrap will probably not run for a second time so move/delete all other files excepts these: bootstrap ca.cnf client.cnf README server.cnf xpextensions.
     1362* For editing/customizing the *.cnf files make sure the "server.cnf" and "client.cnf" have a different "commonname" at the end of their files otherwise database TXTDB 2 error.
     1363* Security Warning the *.pem file we will deploy among users needs to be stripped of bag attributes and PRIVATEKEY!!!!
     1364* server.pem must be in der format so that the certificate can be pushed to a windows machine?
     1365
     1366The "server.pem" file is the one that needs to be distributed/deployed among the eduroam users to correctly setup their supplicants for safely logging in, for Mac and Linux. Windows systems only allows Root (dutch=basis) certificates "ca.cer" to be matched against the "server.pem" supplied from the radius server supplicant instead of "server.pem" directly. Therefor windows users need the ca.cer file instead of the server.cer/der te be installed, freeradius can also push the certificate so it can be installed upon first authentication!
     1367
     1368In Windows double click the ca.cer file and import it into the ROOT store! Than you will be able to select it in the PEAP / supplicant option when you setup the eduroam window in network settings! Freeradius by default creates a ca.der file which can be renamed to cer to be used by windows. If Freeradius/certs/ folder also contains a ca.cer it can be automatically be pushed to windows clients for installing or change the pem into der of server.pem?
     1369
     1370{{{
     1371#Convert a DER file (.crt .cer .der) to PEM
     1372openssl x509 -inform der -in certificate.cer -out certificate.pem
     1373
     1374#Convert a PEM file to DER
     1375openssl x509 -outform der -in certificate.pem -out certificate.der
     1376}}}
    13741377
    13751378=== 3 certnode & easy-rsa ===