DaloRADIUS. Almalinux 8. FreeRADIUS 3 + DaloRADIUS: различия между версиями

Материал из Wiki
Перейти к навигации Перейти к поиску
м (Cless переименовал страницу DaloRADIUS. Oracle Linux 8. FreeRADIUS 3 + DaloRADIUS в DaloRADIUS. Almalinux 8. FreeRADIUS 3 + DaloRADIUS без оставления перенаправления)
 
(не показаны 4 промежуточные версии этого же участника)
Строка 3: Строка 3:
__ОБЯЗАТЕЛЬНОЕ_ОГЛАВЛЕНИЕ__
__ОБЯЗАТЕЛЬНОЕ_ОГЛАВЛЕНИЕ__


== Ссылки ==
= Ссылки =
https://bytexd.com/freeradius-centos/
https://bytexd.com/freeradius-centos/


== Установка и настройка ==
= Установка и настройка =
'''DISABLE SELINUX!'''
'''DISABLE SELINUX!'''


Строка 74: Строка 74:
<code>mysql -u root -p radius < /etc/raddb/mods-config/sql/main/mysql/schema.sql</code>
<code>mysql -u root -p radius < /etc/raddb/mods-config/sql/main/mysql/schema.sql</code>


<code>nano /etc/raddb/sites-available/default</code><blockquote>РАСКОММЕНТИРУЕМ ВСЕ "sql", СЛЕДУЮЩИЕ СТРОКИ ДЛЯ ПРИМЕРА</blockquote>
<code>nano /etc/raddb/sites-available/default</code><blockquote>РАСКОММЕНТИРУЕМ ВСЕ "sql" (а также исправляем "-sql" на "sql"), СЛЕДУЮЩИЕ СТРОКИ ДЛЯ ПРИМЕРА</blockquote>
  ...
  ...
  authorize {
  authorize {
Строка 87: Строка 87:
  }
  }
  ...
  ...
<code>nano /etc/raddb/sites-available/inner-tunnel</code><blockquote>РАСКОММЕНТИРУЕМ ВСЕ "sql", СЛЕДУЮЩИЕ СТРОКИ ДЛЯ ПРИМЕРА</blockquote>
<code>nano /etc/raddb/sites-available/inner-tunnel</code><blockquote>РАСКОММЕНТИРУЕМ ВСЕ "sql" (а также исправляем "-sql" на "sql"), СЛЕДУЮЩИЕ СТРОКИ ДЛЯ ПРИМЕРА</blockquote>
  ...
  ...
  authorize {
  authorize {
Строка 184: Строка 184:
<code>systemctl status radiusd.service httpd</code>
<code>systemctl status radiusd.service httpd</code>


== Работа с DaloRADIUS ==
= Работа с DaloRADIUS =


=== Идем в веб-интерфейс ===
=== Идем в веб-интерфейс ===
Строка 202: Строка 202:
=== Настройки скорости клиента в случае подключения через Mikrotik Hotspot ===
=== Настройки скорости клиента в случае подключения через Mikrotik Hotspot ===
[[Файл:Daloradius+mikrotik-ONLY-hotspot rate-limit.jpg|без|мини]]
[[Файл:Daloradius+mikrotik-ONLY-hotspot rate-limit.jpg|без|мини]]
= FREERADIUS + CA CERT + DOMAIN =
<blockquote>It's necessary in order to work EAP auth on certain devices like Samsung and Honor. They demand '''CA cert''' and '''Domain name'''.</blockquote>
== Links ==
https://www.titley.com/index.php/about-us/nigel/creating-self-signed-certificates-for-a-wpa-enterprise-wifi-using-freeradius/
https://networkradius.com/articles/2021/10/25/EAP-production-certificates.html
https://wiki.alpinelinux.org/wiki/FreeRadius_EAP-TLS_configuration
== Configuring ==
=== Server radius ===
Backup original config
<code>mv /etc/raddb/certs /etc/raddb/certs.ORIG</code>
Create config directory
<code>mkdir /etc/raddb/certs</code>
Go to the config dir
<code>cd /etc/raddb/certs</code>
Create necessary config files<blockquote>All these files are exist in the backuped directory '''/etc/raddb/certs.ORIG''', but for the understanding of the proccess of the generating certs '''we will create them manually'''.</blockquote>Server cert<code>nano /etc/raddb/certs/server.cnf</code><blockquote>Pay attention to the settings:
...
[ CA_default ]
...
default_days        = '''3650'''
...
[ req ]
...
input_password        = '''PassWord'''
output_password        = '''PassWord'''
...
[server]
countryName = '''RU'''
stateOrProvinceName = '''SAR'''
localityName = '''DUB'''
organizationName = '''DUBKI'''
emailAddress = '''admin@mail.ru'''
commonName = "'''rad03.d.loc'''"
...
[alt_names]
DNS.1 = '''rad03.d.loc'''
...</blockquote><syntaxhighlight lang="ini">
[ ca ]
default_ca = CA_default
[ CA_default ]
dir = ./
certs = $dir
crl_dir = $dir/crl
database = $dir/index.txt
new_certs_dir = $dir
certificate = $dir/server.pem
serial = $dir/serial
crl = $dir/crl.pem
private_key = $dir/server.key
RANDFILE = $dir/.rand
name_opt = ca_default
cert_opt = ca_default
default_days = 3650
default_crl_days = 30
default_md = sha256
preserve = no
policy = policy_match
[ policy_match ]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ req ]
prompt = no
distinguished_name = server
default_bits = 2048
input_password = PassWord
output_password = PassWord
req_extensions = v3_req
[server]
countryName = RU
stateOrProvinceName = SAR
localityName = DUB
organizationName = DUBKI
emailAddress = admin@mail.ru
commonName = "rad03.d.loc"
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names
#  This should be a host name of the RADIUS server.
#  Note that the host name is exchanged in EAP *before*
#  the user machine has network access.  So the host name
#  here doesn't really have to match anything in DNS.
[alt_names]
DNS.1 = rad03.d.loc
# NAIRealm from RFC 7585
otherName.0 = 1.3.6.1.5.5.7.8.8;FORMAT:UTF8,UTF8:*.example.com
</syntaxhighlight>
CA cert
<code>nano /etc/raddb/certs/ca.cnf</code><blockquote>
Pay attention to the settings:
...
[ CA_default ]
...
default_days        = '''3650'''
..
[ req ]
...
input_password = '''PassWord'''
output_password = '''PassWord'''
...
[certificate_authority]
countryName = '''RU'''
stateOrProvinceName = '''SAR'''
localityName = '''DUB'''
organizationName = '''DUBKI'''
emailAddress = '''admin@mail.ru'''
commonName = "'''Dubki Certificate Authority'''"
...</blockquote><syntaxhighlight lang="ini">
[ ca ]
default_ca = CA_default
[ CA_default ]
dir = ./
certs = $dir
crl_dir = $dir/crl
database = $dir/index.txt
new_certs_dir = $dir
certificate = $dir/ca.pem
serial = $dir/serial
crl = $dir/crl.pem
private_key = $dir/ca.key
RANDFILE = $dir/.rand
name_opt = ca_default
cert_opt = ca_default
default_days = 3650
default_crl_days = 30
default_md = sha256
preserve = no
policy = policy_match
crlDistributionPoints = URI:http://www.example.org/example_ca.crl
[ policy_match ]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ req ]
prompt = no
distinguished_name = certificate_authority
default_bits = 2048
input_password = PassWord
output_password = PassWord
x509_extensions = v3_ca
[certificate_authority]
countryName = RU
stateOrProvinceName = SAR
localityName = DUB
organizationName = DUBKI
emailAddress = admin@mail.ru
commonName = "Dubki Certificate Authority"
[v3_ca]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
basicConstraints = critical,CA:true
crlDistributionPoints = URI:http://www.example.org/example_ca.crl
</syntaxhighlight>
We are not going to use Client Certs, but still you can leave it as an example. Moreover, it's necessary in order to the file '''Bootstrap''' working properly.
<code>nano /etc/raddb/certs/client.cnf</code><blockquote>
Pay attention to the settings:
...
[ CA_default ]
...
default_days        = '''3650'''
...
[ req ]
...
input_password        = '''ClientPassWord'''
output_password        = '''ClientPassWord'''
...
[client]
countryName = '''RU'''
stateOrProvinceName = '''SAR'''
localityName = '''DUB'''
organizationName = '''DUBKI'''
emailAddress = '''user01@yandex.ru'''
commonName = "'''rad03.d.loc'''"
...</blockquote><syntaxhighlight lang="ini">
[ ca ]
default_ca = CA_default
[ CA_default ]
dir = ./
certs = $dir
crl_dir = $dir/crl
database = $dir/index.txt
new_certs_dir = $dir
certificate = $dir/ca.pem
serial = $dir/serial
crl = $dir/crl.pem
private_key = $dir/ca.key
RANDFILE = $dir/.rand
name_opt = ca_default
cert_opt = ca_default
default_days = 3650
default_crl_days = 30
default_md = sha256
preserve = no
policy = policy_match
[ policy_match ]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ req ]
prompt = no
distinguished_name = client
default_bits = 2048
input_password = PassWord
output_password = PassWord
[client]
countryName = RU
stateOrProvinceName = SAR
localityName = DUB
organizationName = DUBKI
emailAddress = user01@yandex.ru
commonName = "rad03.d.loc"
</syntaxhighlight>
<code>nano /etc/raddb/certs/inner-server.cnf</code><blockquote>
Pay attention to the settings:
...
[ CA_default ]
default_days        = '''3650'''
...
[ req ]
input_password        = '''PassWord'''
output_password        = '''PassWord'''
...
[server]
countryName = '''RU'''
stateOrProvinceName = '''SAR'''
localityName = '''DUB'''
organizationName = '''DUBKI'''
emailAddress = '''admin@mail.ru'''
commonName = "'''rad03.d.loc'''"
...</blockquote><syntaxhighlight lang="ini">
[ ca ]
default_ca = CA_default
[ CA_default ]
dir = ./
certs = $dir
crl_dir = $dir/crl
database = $dir/index.txt
new_certs_dir = $dir
certificate = $dir/server.pem
serial = $dir/serial
crl = $dir/crl.pem
private_key = $dir/server.key
RANDFILE = $dir/.rand
name_opt = ca_default
cert_opt = ca_default
default_days = 3650
default_crl_days = 30
default_md = sha256
preserve = no
policy = policy_match
[ policy_match ]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ req ]
prompt = no
distinguished_name = server
default_bits = 2048
input_password = PassWord
output_password = PassWord
[server]
countryName = RU
stateOrProvinceName = SAR
localityName = DUB
organizationName = DUBKI
emailAddress = admin@mail.ru
commonName = "rad03.d.loc"
</syntaxhighlight>
Script '''Bootstrap''', which generates certs
<code>nano /etc/raddb/certs/bootstrap</code><syntaxhighlight lang="bash">
#!/bin/sh
#
# Bootstrap script should be run only once. If there are already certificates
# generated, skip the execution.
#
cd `dirname $0`
if [ $(ls -l *.{pem,crt,key} 2>/dev/null | wc -l) != 0 ]; then
  exit 0
fi
#
#  This is a wrapper script to create default certificates when the
#  server starts via systemd. It should also ensure that the
#  permissions and owners are correct for the generated files. Once
# the certificates have been created, this file should be deleted.
#
#  $Id: 0f719aafd4c9abcdefbf547dedb6e7312c535104 $
#
umask 027
cd `dirname $0`
if [ ! -e random ]; then
  ln -sf /dev/urandom random
fi
make -h > /dev/null 2>&1
#
#  If we have a working "make", then use it.  Otherwise, run the commands
#  manually.
#
if [ "$?" = "0" ]; then
  make all
  ret=$?
  chown root:radiusd dh ca.* client.* server.*
  chmod 640 dh ca.* client.* server.*
  exit $ret
fi
#
#  The following commands were created by running "make -n", and edited
#  to remove the trailing backslash, and to add "exit 1" after the commands.
#
#  Don't edit the following text.  Instead, edit the Makefile, and
#  re-generate these commands.
#
if [ ! -e dh ]; then
  cp rfc3526-group-18-8192.dhparam dh
fi
if [ ! -e server.key ]; then
  openssl req -new  -out server.csr -keyout server.key -config ./server.cnf || exit 1
  chmod g+r server.key
fi
if [ ! -e ca.key ]; then
  openssl req -new -x509 -keyout ca.key -out ca.pem -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf || exit 1
fi
if [ ! -e index.txt ]; then
  touch index.txt
fi
if [ ! -e serial ]; then
  echo '01' > serial
fi
if [ ! -e server.crt ]; then
  openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr  -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf || exit 1
fi
if [ ! -e server.p12 ]; then
  openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12  -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1
  chmod g+r server.p12
fi
if [ ! -e server.pem ]; then
  openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1
  openssl verify -CAfile ca.pem server.pem || exit 1
  chmod g+r server.pem
fi
if [ ! -e ca.der ]; then
  openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der || exit 1
fi
if [ ! -e client.key ]; then
  openssl req -new  -out client.csr -keyout client.key -config ./client.cnf
  chmod g+r client.key
fi
if [ ! -e client.crt ]; then
  openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr  -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf
fi
chown root:radiusd dh ca.* client.* server.*
chmod 640 dh ca.* client.* server.*
</syntaxhighlight>
<code>nano /etc/raddb/certs/Makefile</code><syntaxhighlight lang="bash">
######################################################################
#
# Make file to be installed in /etc/raddb/certs to enable
# the easy creation of certificates.
#
# See the README file in this directory for more information.
#
# $Id: 5cbfd467cefab45ee63e728b96d471994fa82528 $
#
######################################################################
DH_KEY_SIZE = 2048
OPENSSL = openssl
EXTERNAL_CA = $(wildcard external_ca.*)
ifneq "$(EXTERNAL_CA)" ""
PARTIAL = -partial_chain
endif
#
#  Set the passwords
#
include passwords.mk
######################################################################
#
#  Make the necessary files, but not client certificates.
#
######################################################################
.PHONY: all
all: index.txt serial dh server ca client
.PHONY: client
client: client.pem
.PHONY: ca
ca: ca.der ca.crl
.PHONY: server
server: server.pem server.vrfy
.PHONY: inner-server
inner-server: inner-server.pem inner-server.vrfy
.PHONY: verify
verify: server.vrfy client.vrfy
passwords.mk: server.cnf ca.cnf client.cnf inner-server.cnf
@echo "PASSWORD_SERVER = '$(shell grep output_password server.cnf | sed 's/.*=//;s/^ *//')'" > $@
@echo "PASSWORD_INNER = '$(shell grep output_password inner-server.cnf | sed 's/.*=//;s/^ *//')'" >> $@
@echo "PASSWORD_CA = '$(shell grep output_password ca.cnf | sed 's/.*=//;s/^ *//')'" >> $@
@echo "PASSWORD_CLIENT = '$(shell grep output_password client.cnf | sed 's/.*=//;s/^ *//')'" >> $@
@echo "USER_NAME = '$(shell grep emailAddress client.cnf | grep '@' | sed 's/.*=//;s/^ *//')'" >> $@
@echo "CA_DEFAULT_DAYS  = '$(shell grep default_days ca.cnf | sed 's/.*=//;s/^ *//')'" >> $@
######################################################################
#
#  Diffie-Hellman parameters
#
######################################################################
dh:
cp rfc3526-group-18-8192.dhparam dh
######################################################################
#
#  Create a new self-signed CA certificate
#
######################################################################
ca.key ca.pem: ca.cnf
@[ -f index.txt ] || $(MAKE) index.txt
@[ -f serial ] || $(MAKE) serial
$(OPENSSL) req -new -x509 -keyout ca.key -out ca.pem \
-days $(CA_DEFAULT_DAYS) -config ./ca.cnf \
-passin pass:$(PASSWORD_CA) -passout pass:$(PASSWORD_CA)
chmod g+r ca.key
ca.der: ca.pem
$(OPENSSL) x509 -inform PEM -outform DER -in ca.pem -out ca.der
ca.crl: ca.pem
$(OPENSSL) ca -gencrl -keyfile ca.key -cert ca.pem -config ./ca.cnf -out ca-crl.pem -key $(PASSWORD_CA)
$(OPENSSL) crl -in ca-crl.pem -outform der -out ca.crl
rm ca-crl.pem
######################################################################
#
#  Create a new server certificate, signed by the above CA.
#
######################################################################
server.csr server.key: server.cnf
$(OPENSSL) req -new  -out server.csr -keyout server.key -config ./server.cnf
chmod g+r server.key
server.crt: server.csr ca.key ca.pem
$(OPENSSL) ca -batch -keyfile ca.key -cert ca.pem -in server.csr  -key $(PASSWORD_CA) -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf
server.p12: server.crt
$(OPENSSL) pkcs12 -export -in server.crt -inkey server.key -out server.p12  -passin pass:$(PASSWORD_SERVER) -passout pass:$(PASSWORD_SERVER)
chmod g+r server.p12
server.pem: server.p12
$(OPENSSL) pkcs12 -in server.p12 -out server.pem -passin pass:$(PASSWORD_SERVER) -passout pass:$(PASSWORD_SERVER)
chmod g+r server.pem
.PHONY: server.vrfy
server.vrfy: ca.pem
@$(OPENSSL) verify $(PARTIAL) -CAfile ca.pem server.pem
######################################################################
#
#  Create a new client certificate, signed by the the above server
#  certificate.
#
######################################################################
client.csr client.key: client.cnf
$(OPENSSL) req -new  -out client.csr -keyout client.key -config ./client.cnf
chmod g+r client.key
client.crt: client.csr ca.pem ca.key
$(OPENSSL) ca -batch -keyfile ca.key -cert ca.pem -in client.csr  -key $(PASSWORD_CA) -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf
client.p12: client.crt
$(OPENSSL) pkcs12 -export -in client.crt -inkey client.key -out client.p12  -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)
chmod g+r client.p12
client.pem: client.p12
$(OPENSSL) pkcs12 -in client.p12 -out client.pem -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)
chmod g+r client.pem
cp client.pem $(USER_NAME).pem
.PHONY: client.vrfy
client.vrfy: ca.pem client.pem
c_rehash .
$(OPENSSL) verify -CApath . client.pem
######################################################################
#
#  Create a new inner-server certificate, signed by the above CA.
#
######################################################################
inner-server.csr inner-server.key: inner-server.cnf
$(OPENSSL) req -new  -out inner-server.csr -keyout inner-server.key -config ./inner-server.cnf
chmod g+r inner-server.key
inner-server.crt: inner-server.csr ca.key ca.pem
$(OPENSSL) ca -batch -keyfile ca.key -cert ca.pem -in inner-server.csr  -key $(PASSWORD_CA) -out inner-server.crt -extensions xpserver_ext -extfile xpextensions -config ./inner-server.cnf
inner-server.p12: inner-server.crt
$(OPENSSL) pkcs12 -export -in inner-server.crt -inkey inner-server.key -out inner-server.p12  -passin pass:$(PASSWORD_INNER) -passout pass:$(PASSWORD_INNER)
chmod g+r inner-server.p12
inner-server.pem: inner-server.p12
$(OPENSSL) pkcs12 -in inner-server.p12 -out inner-server.pem -passin pass:$(PASSWORD_INNER) -passout pass:$(PASSWORD_INNER)
chmod g+r inner-server.pem
.PHONY: inner-server.vrfy
inner-server.vrfy: ca.pem
@$(OPENSSL) verify $(PARTIAL) -CAfile ca.pem inner-server.pem
######################################################################
#
#  Miscellaneous rules.
#
######################################################################
index.txt:
@touch index.txt
serial:
@echo '01' > serial
print:
$(OPENSSL) x509 -text -in server.crt
printca:
$(OPENSSL) x509 -text -in ca.pem
clean:
@rm -f *~ *old client.csr client.key client.crt client.p12 client.pem
#
# Make a target that people won't run too often.
#
destroycerts:
rm -f *~ dh *.csr *.crt *.p12 *.der *.pem *.key index.txt* \
serial*  *\.0 *\.1 ca-crl.pem ca.crl
</syntaxhighlight>
<code>nano /etc/raddb/certs/xpextensions</code><syntaxhighlight lang="ini">
#
#  File containing the OIDs required for Windows
#  and iOS
#
#  http://support.microsoft.com/kb/814394/en-us
#
#  https://support.apple.com/en-us/HT210176
#
[ xpclient_ext]
extendedKeyUsage = 1.3.6.1.5.5.7.3.2
crlDistributionPoints = URI:http://www.example.com/example_ca.crl
[ xpserver_ext]
extendedKeyUsage = 1.3.6.1.5.5.7.3.1
crlDistributionPoints = URI:http://www.example.com/example_ca.crl
#
#  Add this to the PKCS#7 keybag attributes holding the client's private key
#  for machine authentication.
#
#  the presence of this OID tells Windows XP that the cert is intended
#  for use by the computer itself, and not by an end-user.
#
#  The other solution is to use Microsoft's web certificate server
#  to generate these certs.
#
# 1.3.6.1.4.1.311.17.2
</syntaxhighlight>
Set Bootstrap file execute permission
<code>chmod +x ./bootstrap</code>
Generate Dhparam file '''/etc/raddb/certs/dh'''
<code>openssl dhparam -out dh 2048</code>
Run certs generation<blockquote>There must be no errors on the output</blockquote><code>./bootstrap</code>
You will get new files, including some important ones: '''ca.pem''', '''server.pem'''.
Edit freeradius EAP settings
<code>nano /etc/raddb/mods-enabled/eap</code><blockquote>'''private_key_password = PassWord''' - This password must be the same as the password in the '''server.cnf'''</blockquote>
...
# Edit
...
private_key_password = '''PassWord'''
private_key_file = '''/etc/raddb/certs/server.pem'''
...
certificate_file = '''/etc/raddb/certs/server.pem'''
ca_file = '''/etc/raddb/certs/ca.pem'''
...
dh_file = '''/etc/raddb/certs/dh'''
...
Check freeradius manually
<code>systemctl stop radiusd</code>
<code>radius -X</code>
If there're no errors, restart freeradius service
<code>systemctl restart radiusd</code>
Copy '''/etc/raddb/certs/ca.pem''' from the Radius server to your Desktop device.
=== Client Android ===
==== Install the CA certificate to your phone ====
You phone now needs to be told to trust the certificate that the RADIUS server is presenting.
Somehow you have to get the '''ca.pem''' CA certificate onto your phone and you have to do it in a trusted fashion.
There are several possible ways to do this:
* Link your phone to your computer via a USB cable and transfer the file
* Write the certificate file to an SD card
*Use a trusted messaging service such as WhatsApp to transfer the file.
Once you have it over to your phone go to your settings menu and select:
<code>Security -> Advanced -> Encryption and Credentials -> Install a certificate -> Wi-Fi certificate</code>
All being well you will then be presented with a file chooser with your ca.pem in it. Select the file and give the certificate a name when asked by the pop-up.
Choose something obvious like “'''Dubki WIFI Radius''' '''rad03.d.loc'''”.
Click on OK.
You should get a message telling you that the certificate has been installed. Your phone will now trust certificates signed by your Certification Authority.
==== Connect to your WI-FI ====
Go your network configuration section and select the wi-fi section.
You should see the wi-fi network you want displayed (assuming that the network side of things is all set up).
Click on this network.
You will be presented with a screen with a number of incomprehensible questions:
* For “<u>EAP method</u>” select “'''PEAP'''”
* For “<u>Phase 2 authentication method” select</u> “'''MSCHAPV2'''”
* For “<u>CA certificate</u>” select the name you gave the CA certificate, in our case: "'''Dubki WIFI Radius rad03.d.loc'''"
* For “<u>Domain</u>” select the commonName value you set in the '''server.cnf''' file at the Radius server, in our case: '''rad03.d.loc'''
* Fill in your username and password under “<u>Identity</u>” and “<u>Password</u>”: these are the '''Login''' and '''Pass''' of any user at your Freeradius Server.
* Press “'''Save'''”
All being well you will connect securely to the wifi. Subsequent connections will be automatic.
__БЕЗ_РЕДАКТИРОВАНИЯ_РАЗДЕЛА__
__БЕЗ_РЕДАКТИРОВАНИЯ_РАЗДЕЛА__
[[Категория:AlmaLinux 8]]

Текущая версия на 13:05, 4 сентября 2023


Ссылки

https://bytexd.com/freeradius-centos/

Установка и настройка

DISABLE SELINUX!

DISABLE FIREWALLD!

systemctl stop firewalld

systemctl disable firewalld

Utils

dnf install -y nano wget mc

HTTPD

dnf install -y httpd

systemctl enable --now httpd

MariaDB

dnf -y install mariadb-server

systemctl enable --now mariadb

mysql_secure_installation

PHP

dnf install -y dnf-utils http://rpms.remirepo.net/enterprise/remi-release-8.rpm

Если необходима неумолчальная версия PHP (Умолчальная - PHP 7.2)

dnf module list php

dnf module reset php

dnf -y install @php

dnf -y install php-{common,opcache,cli,gd,curl,mysqlnd,devel,pear,mbstring,xml}

sudo systemctl enable --now php-fpm

If you also intend to install daloRADIUS, the freeRADIUS GUI, you’ll also need to install PEAR, a PHP extension, from which we’ll install some dependencies.

dnf -y install php-pear

Next we install the DB and MDB2 libraries from the PEAR repository. These are required by daloRADIUS to work.

pear install DB MDB2

FreeRADIUS

dnf module list freeradius

dnf install -y @freeradius freeradius-utils freeradius-mysql

systemctl enable radiusd.service

Создание сертификатов

cd  /etc/raddb/certs

./bootstrap

Создание БД

mysql -u root -p

   MariaDB [(none)]> CREATE DATABASE radius;

   MariaDB [(none)]> GRANT ALL ON radius.* TO radius@localhost IDENTIFIED BY "PassWord#1";

   MariaDB [(none)]> FLUSH PRIVILEGES;

   MariaDB [(none)]> \q

mysql -u root -p radius < /etc/raddb/mods-config/sql/main/mysql/schema.sql

nano /etc/raddb/sites-available/default

РАСКОММЕНТИРУЕМ ВСЕ "sql" (а также исправляем "-sql" на "sql"), СЛЕДУЮЩИЕ СТРОКИ ДЛЯ ПРИМЕРА

...
authorize {
    sql
}
    
accounting {
    sql
}
session {
    sql
}
...

nano /etc/raddb/sites-available/inner-tunnel

РАСКОММЕНТИРУЕМ ВСЕ "sql" (а также исправляем "-sql" на "sql"), СЛЕДУЮЩИЕ СТРОКИ ДЛЯ ПРИМЕРА

...
authorize {
    sql
}
session {
    sql
}
...

ln -s /etc/raddb/mods-available/sql /etc/raddb/mods-enabled/

nano /etc/raddb/mods-available/sql 

...

#dialect = "sqlite"
dialect = "mysql"
#driver = "rlm_sql_null"
driver = "rlm_sql_mysql"
server = "127.0.0.1"
port = 3306
login = "radius"
password = "radius_123"
radius_db = "radius"
# Clients will ONLY be read on server startup.
read_clients = yes
# Table to keep radius client info
client_table = "nas"

...

# COMMENT tls SECTION

mysql {
    # If any of the files below are set, TLS encryption is enabled
    # tls {
    #       ca_file = "/etc/ssl/certs/my_ca.crt"
    #       ca_path = "/etc/ssl/certs/"
    #       certificate_file = "/etc/ssl/certs/private/client.crt"
    #       private_key_file = "/etc/ssl/certs/private/client.key"
    #       cipher = "DHE-RSA-AES256-SHA:AES128-SHA"
    #       tls_required = yes
    #       tls_check_cert = no
    #       tls_check_cert_cn = no
    #}
    # If yes, (or auto and libmysqlclient reports warnings are
    # available), will retrieve and log additional warnings from
    # the server if an error has occured. Defaults to 'auto'
    warnings = auto
}

...
# Comment relative path and add absolute path
#$INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf
$INCLUDE /etc/raddb/mods-config/sql/main/mysql/queries.conf
...

chgrp -h radiusd /etc/raddb/mods-enabled/sql

Проверка FreeRADIUS

radiusd -X

DaloRADIUS

cd /tmp && wget https://github.com/lirantal/daloradius/archive/refs/tags/1.3.zip

dnf -y install unzip

unzip 1.3.zip

sudo mv daloradius-1.3/ /var/www/html/daloradius

cd /var/www/html/daloradius

mysql -u root -p radius < contrib/db/fr2-mysql-daloradius-and-freeradius.sql

mysql -u root -p radius < contrib/db/mysql-daloradius.sql

mkdir /var/www/html/daloradius/library

cp /var/www/html/daloradius/library/daloradius.conf.php.sample /var/www/html/daloradius/library/daloradius.conf.php

chown -R apache:apache /var/www/html/daloradius/

chmod 664 /var/www/html/daloradius/library/daloradius.conf.php

nano /var/www/html/daloradius/library/daloradius.conf.php 

...
$configValues['FREERADIUS_VERSION'] = '3';
$configValues['CONFIG_DB_ENGINE'] = 'mysqli';
$configValues['CONFIG_DB_HOST'] = 'localhost';
$configValues['CONFIG_DB_PORT'] = '3306';
$configValues['CONFIG_DB_USER'] = 'root';
$configValues['CONFIG_DB_PASS'] = 'PassWord#1';
$configValues['CONFIG_DB_NAME'] = 'radius';
...

systemctl restart radiusd.service httpd

systemctl status radiusd.service httpd

Работа с DaloRADIUS

Идем в веб-интерфейс

http://192.168.1.11/daloradius

administrator

radius

Добавляем NAS

Daloradius nas add.jpg

Добавляем пользователя

Daloradius user add.jpg
Daloradius user attr add.jpg

Настройки скорости клиента в случае подключения через Mikrotik Hotspot

Daloradius+mikrotik-ONLY-hotspot rate-limit.jpg

FREERADIUS + CA CERT + DOMAIN

It's necessary in order to work EAP auth on certain devices like Samsung and Honor. They demand CA cert and Domain name.

Links

https://www.titley.com/index.php/about-us/nigel/creating-self-signed-certificates-for-a-wpa-enterprise-wifi-using-freeradius/

https://networkradius.com/articles/2021/10/25/EAP-production-certificates.html

https://wiki.alpinelinux.org/wiki/FreeRadius_EAP-TLS_configuration

Configuring

Server radius

Backup original config

mv /etc/raddb/certs /etc/raddb/certs.ORIG

Create config directory

mkdir /etc/raddb/certs

Go to the config dir

cd /etc/raddb/certs

Create necessary config files

All these files are exist in the backuped directory /etc/raddb/certs.ORIG, but for the understanding of the proccess of the generating certs we will create them manually.

Server certnano /etc/raddb/certs/server.cnf

Pay attention to the settings:

...

[ CA_default ]

...

default_days        = 3650

...

[ req ]

...

input_password        = PassWord

output_password        = PassWord

...

[server]

countryName = RU

stateOrProvinceName = SAR

localityName = DUB

organizationName = DUBKI

emailAddress = admin@mail.ru

commonName = "rad03.d.loc"

...

[alt_names]

DNS.1 = rad03.d.loc

...

[ ca ]
default_ca		= CA_default

[ CA_default ]
dir			= ./
certs			= $dir
crl_dir			= $dir/crl
database		= $dir/index.txt
new_certs_dir		= $dir
certificate		= $dir/server.pem
serial			= $dir/serial
crl			= $dir/crl.pem
private_key		= $dir/server.key
RANDFILE		= $dir/.rand
name_opt		= ca_default
cert_opt		= ca_default
default_days		= 3650
default_crl_days	= 30
default_md		= sha256
preserve		= no
policy			= policy_match

[ policy_match ]
countryName		= match
stateOrProvinceName	= match
organizationName	= match
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

[ policy_anything ]
countryName		= optional
stateOrProvinceName	= optional
localityName		= optional
organizationName	= optional
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

[ req ]
prompt			= no
distinguished_name	= server
default_bits		= 2048
input_password		= PassWord
output_password		= PassWord
req_extensions		= v3_req

[server]
countryName = RU
stateOrProvinceName = SAR
localityName = DUB
organizationName = DUBKI
emailAddress = admin@mail.ru
commonName = "rad03.d.loc"

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

#  This should be a host name of the RADIUS server.
#  Note that the host name is exchanged in EAP *before*
#  the user machine has network access.  So the host name
#  here doesn't really have to match anything in DNS.
[alt_names]
DNS.1 = rad03.d.loc

# NAIRealm from RFC 7585
otherName.0 = 1.3.6.1.5.5.7.8.8;FORMAT:UTF8,UTF8:*.example.com

CA cert

nano /etc/raddb/certs/ca.cnf

Pay attention to the settings:

...

[ CA_default ]

...

default_days        = 3650

..

[ req ]

...

input_password = PassWord

output_password = PassWord

...

[certificate_authority]

countryName = RU

stateOrProvinceName = SAR

localityName = DUB

organizationName = DUBKI

emailAddress = admin@mail.ru

commonName = "Dubki Certificate Authority"

...

[ ca ]
default_ca		= CA_default

[ CA_default ]
dir			= ./
certs			= $dir
crl_dir			= $dir/crl
database		= $dir/index.txt
new_certs_dir		= $dir
certificate		= $dir/ca.pem
serial			= $dir/serial
crl			= $dir/crl.pem
private_key		= $dir/ca.key
RANDFILE		= $dir/.rand
name_opt		= ca_default
cert_opt		= ca_default
default_days		= 3650
default_crl_days	= 30
default_md		= sha256
preserve		= no
policy			= policy_match
crlDistributionPoints	= URI:http://www.example.org/example_ca.crl

[ policy_match ]
countryName		= match
stateOrProvinceName	= match
organizationName	= match
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

[ policy_anything ]
countryName		= optional
stateOrProvinceName	= optional
localityName		= optional
organizationName	= optional
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

[ req ]
prompt = no
distinguished_name = certificate_authority
default_bits = 2048
input_password = PassWord
output_password = PassWord
x509_extensions = v3_ca

[certificate_authority]
countryName = RU
stateOrProvinceName = SAR
localityName = DUB
organizationName = DUBKI
emailAddress = admin@mail.ru
commonName = "Dubki Certificate Authority"

[v3_ca]
subjectKeyIdentifier	= hash
authorityKeyIdentifier	= keyid:always,issuer:always
basicConstraints	= critical,CA:true
crlDistributionPoints	= URI:http://www.example.org/example_ca.crl

We are not going to use Client Certs, but still you can leave it as an example. Moreover, it's necessary in order to the file Bootstrap working properly.

nano /etc/raddb/certs/client.cnf

Pay attention to the settings:

...

[ CA_default ]

...

default_days        = 3650

...

[ req ]

...

input_password        = ClientPassWord

output_password        = ClientPassWord

...

[client]

countryName = RU

stateOrProvinceName = SAR

localityName = DUB

organizationName = DUBKI

emailAddress = user01@yandex.ru

commonName = "rad03.d.loc"

...

[ ca ]
default_ca		= CA_default

[ CA_default ]
dir			= ./
certs			= $dir
crl_dir			= $dir/crl
database		= $dir/index.txt
new_certs_dir		= $dir
certificate		= $dir/ca.pem
serial			= $dir/serial
crl			= $dir/crl.pem
private_key		= $dir/ca.key
RANDFILE		= $dir/.rand
name_opt		= ca_default
cert_opt		= ca_default
default_days		= 3650
default_crl_days	= 30
default_md		= sha256
preserve		= no
policy			= policy_match

[ policy_match ]
countryName		= match
stateOrProvinceName	= match
organizationName	= match
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

[ policy_anything ]
countryName		= optional
stateOrProvinceName	= optional
localityName		= optional
organizationName	= optional
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

[ req ]
prompt			= no
distinguished_name	= client
default_bits		= 2048
input_password		= PassWord
output_password		= PassWord

[client]
countryName = RU
stateOrProvinceName = SAR
localityName = DUB
organizationName = DUBKI
emailAddress = user01@yandex.ru
commonName = "rad03.d.loc"

nano /etc/raddb/certs/inner-server.cnf

Pay attention to the settings:

...

[ CA_default ]

default_days        = 3650

...

[ req ]

input_password        = PassWord

output_password        = PassWord

...

[server]

countryName = RU

stateOrProvinceName = SAR

localityName = DUB

organizationName = DUBKI

emailAddress = admin@mail.ru

commonName = "rad03.d.loc"

...

[ ca ]
default_ca		= CA_default

[ CA_default ]
dir			= ./
certs			= $dir
crl_dir			= $dir/crl
database		= $dir/index.txt
new_certs_dir		= $dir
certificate		= $dir/server.pem
serial			= $dir/serial
crl			= $dir/crl.pem
private_key		= $dir/server.key
RANDFILE		= $dir/.rand
name_opt		= ca_default
cert_opt		= ca_default
default_days		= 3650
default_crl_days	= 30
default_md		= sha256
preserve		= no
policy			= policy_match

[ policy_match ]
countryName		= match
stateOrProvinceName	= match
organizationName	= match
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

[ policy_anything ]
countryName		= optional
stateOrProvinceName	= optional
localityName		= optional
organizationName	= optional
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

[ req ]
prompt			= no
distinguished_name	= server
default_bits		= 2048
input_password		= PassWord
output_password		= PassWord

[server]
countryName = RU
stateOrProvinceName = SAR
localityName = DUB
organizationName = DUBKI
emailAddress = admin@mail.ru
commonName = "rad03.d.loc"

Script Bootstrap, which generates certs

nano /etc/raddb/certs/bootstrap

#!/bin/sh
#
# Bootstrap script should be run only once. If there are already certificates
# generated, skip the execution.
#
cd `dirname $0`
if [ $(ls -l *.{pem,crt,key} 2>/dev/null | wc -l) != 0 ]; then
  exit 0
fi

#
#  This is a wrapper script to create default certificates when the
#  server starts via systemd. It should also ensure that the
#  permissions and owners are correct for the generated files. Once
# the certificates have been created, this file should be deleted.
#
#  $Id: 0f719aafd4c9abcdefbf547dedb6e7312c535104 $
#
umask 027
cd `dirname $0`

if [ ! -e random ]; then
  ln -sf /dev/urandom random
fi

make -h > /dev/null 2>&1

#
#  If we have a working "make", then use it.  Otherwise, run the commands
#  manually.
#
if [ "$?" = "0" ]; then
  make all
  ret=$?
  chown root:radiusd dh ca.* client.* server.*
  chmod 640 dh ca.* client.* server.*
  exit $ret
fi

#
#  The following commands were created by running "make -n", and edited
#  to remove the trailing backslash, and to add "exit 1" after the commands.
#
#  Don't edit the following text.  Instead, edit the Makefile, and
#  re-generate these commands.
#
if [ ! -e dh ]; then
  cp rfc3526-group-18-8192.dhparam dh
fi

if [ ! -e server.key ]; then
  openssl req -new  -out server.csr -keyout server.key -config ./server.cnf || exit 1
  chmod g+r server.key
fi

if [ ! -e ca.key ]; then
  openssl req -new -x509 -keyout ca.key -out ca.pem -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf || exit 1
fi

if [ ! -e index.txt ]; then
  touch index.txt
fi

if [ ! -e serial ]; then
  echo '01' > serial
fi

if [ ! -e server.crt ]; then
  openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr  -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf || exit 1
fi

if [ ! -e server.p12 ]; then
  openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12  -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1
  chmod g+r server.p12
fi

if [ ! -e server.pem ]; then
  openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1
  openssl verify -CAfile ca.pem server.pem || exit 1
  chmod g+r server.pem
fi

if [ ! -e ca.der ]; then
  openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der || exit 1
fi

if [ ! -e client.key ]; then
  openssl req -new  -out client.csr -keyout client.key -config ./client.cnf
  chmod g+r client.key
fi

if [ ! -e client.crt ]; then
  openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr  -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf
fi

chown root:radiusd dh ca.* client.* server.*
chmod 640 dh ca.* client.* server.*

nano /etc/raddb/certs/Makefile

######################################################################
#
#	Make file to be installed in /etc/raddb/certs to enable
#	the easy creation of certificates.
#
#	See the README file in this directory for more information.
#
#	$Id: 5cbfd467cefab45ee63e728b96d471994fa82528 $
#
######################################################################

DH_KEY_SIZE	= 2048
OPENSSL		= openssl
EXTERNAL_CA	= $(wildcard external_ca.*)

ifneq "$(EXTERNAL_CA)" ""
PARTIAL		= -partial_chain
endif

#
#  Set the passwords
#
include passwords.mk

######################################################################
#
#  Make the necessary files, but not client certificates.
#
######################################################################
.PHONY: all
all: index.txt serial dh server ca client

.PHONY: client
client: client.pem

.PHONY: ca
ca: ca.der ca.crl

.PHONY: server
server: server.pem server.vrfy

.PHONY: inner-server
inner-server: inner-server.pem inner-server.vrfy

.PHONY: verify
verify: server.vrfy client.vrfy

passwords.mk: server.cnf ca.cnf client.cnf inner-server.cnf
	@echo "PASSWORD_SERVER	= '$(shell grep output_password server.cnf | sed 's/.*=//;s/^ *//')'"		> $@
	@echo "PASSWORD_INNER	= '$(shell grep output_password inner-server.cnf | sed 's/.*=//;s/^ *//')'"	>> $@
	@echo "PASSWORD_CA	= '$(shell grep output_password ca.cnf | sed 's/.*=//;s/^ *//')'"		>> $@
	@echo "PASSWORD_CLIENT	= '$(shell grep output_password client.cnf | sed 's/.*=//;s/^ *//')'"		>> $@
	@echo "USER_NAME	= '$(shell grep emailAddress client.cnf | grep '@' | sed 's/.*=//;s/^ *//')'"	>> $@
	@echo "CA_DEFAULT_DAYS  = '$(shell grep default_days ca.cnf | sed 's/.*=//;s/^ *//')'"			>> $@

######################################################################
#
#  Diffie-Hellman parameters
#
######################################################################
dh:
	cp rfc3526-group-18-8192.dhparam dh

######################################################################
#
#  Create a new self-signed CA certificate
#
######################################################################
ca.key ca.pem: ca.cnf
	@[ -f index.txt ] || $(MAKE) index.txt
	@[ -f serial ] || $(MAKE) serial
	$(OPENSSL) req -new -x509 -keyout ca.key -out ca.pem \
		-days $(CA_DEFAULT_DAYS) -config ./ca.cnf \
		-passin pass:$(PASSWORD_CA) -passout pass:$(PASSWORD_CA)
	chmod g+r ca.key

ca.der: ca.pem
	$(OPENSSL) x509 -inform PEM -outform DER -in ca.pem -out ca.der

ca.crl: ca.pem
	$(OPENSSL) ca -gencrl -keyfile ca.key -cert ca.pem -config ./ca.cnf -out ca-crl.pem -key $(PASSWORD_CA)
	$(OPENSSL) crl -in ca-crl.pem -outform der -out ca.crl
	rm ca-crl.pem

######################################################################
#
#  Create a new server certificate, signed by the above CA.
#
######################################################################
server.csr server.key: server.cnf
	$(OPENSSL) req -new  -out server.csr -keyout server.key -config ./server.cnf
	chmod g+r server.key

server.crt: server.csr ca.key ca.pem
	$(OPENSSL) ca -batch -keyfile ca.key -cert ca.pem -in server.csr  -key $(PASSWORD_CA) -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf

server.p12: server.crt
	$(OPENSSL) pkcs12 -export -in server.crt -inkey server.key -out server.p12  -passin pass:$(PASSWORD_SERVER) -passout pass:$(PASSWORD_SERVER)
	chmod g+r server.p12

server.pem: server.p12
	$(OPENSSL) pkcs12 -in server.p12 -out server.pem -passin pass:$(PASSWORD_SERVER) -passout pass:$(PASSWORD_SERVER)
	chmod g+r server.pem

.PHONY: server.vrfy
server.vrfy: ca.pem
	@$(OPENSSL) verify $(PARTIAL) -CAfile ca.pem server.pem

######################################################################
#
#  Create a new client certificate, signed by the the above server
#  certificate.
#
######################################################################
client.csr client.key: client.cnf
	$(OPENSSL) req -new  -out client.csr -keyout client.key -config ./client.cnf
	chmod g+r client.key

client.crt: client.csr ca.pem ca.key
	$(OPENSSL) ca -batch -keyfile ca.key -cert ca.pem -in client.csr  -key $(PASSWORD_CA) -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf

client.p12: client.crt
	$(OPENSSL) pkcs12 -export -in client.crt -inkey client.key -out client.p12  -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)
	chmod g+r client.p12

client.pem: client.p12
	$(OPENSSL) pkcs12 -in client.p12 -out client.pem -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)
	chmod g+r client.pem
	cp client.pem $(USER_NAME).pem

.PHONY: client.vrfy
client.vrfy: ca.pem client.pem
	c_rehash .
	$(OPENSSL) verify -CApath . client.pem

######################################################################
#
#  Create a new inner-server certificate, signed by the above CA.
#
######################################################################
inner-server.csr inner-server.key: inner-server.cnf
	$(OPENSSL) req -new  -out inner-server.csr -keyout inner-server.key -config ./inner-server.cnf
	chmod g+r inner-server.key

inner-server.crt: inner-server.csr ca.key ca.pem
	$(OPENSSL) ca -batch -keyfile ca.key -cert ca.pem -in inner-server.csr  -key $(PASSWORD_CA) -out inner-server.crt -extensions xpserver_ext -extfile xpextensions -config ./inner-server.cnf

inner-server.p12: inner-server.crt
	$(OPENSSL) pkcs12 -export -in inner-server.crt -inkey inner-server.key -out inner-server.p12  -passin pass:$(PASSWORD_INNER) -passout pass:$(PASSWORD_INNER)
	chmod g+r inner-server.p12

inner-server.pem: inner-server.p12
	$(OPENSSL) pkcs12 -in inner-server.p12 -out inner-server.pem -passin pass:$(PASSWORD_INNER) -passout pass:$(PASSWORD_INNER)
	chmod g+r inner-server.pem

.PHONY: inner-server.vrfy
inner-server.vrfy: ca.pem
	@$(OPENSSL) verify $(PARTIAL) -CAfile ca.pem inner-server.pem

######################################################################
#
#  Miscellaneous rules.
#
######################################################################
index.txt:
	@touch index.txt

serial:
	@echo '01' > serial

print:
	$(OPENSSL) x509 -text -in server.crt

printca:
	$(OPENSSL) x509 -text -in ca.pem

clean:
	@rm -f *~ *old client.csr client.key client.crt client.p12 client.pem

#
#	Make a target that people won't run too often.
#
destroycerts:
	rm -f *~ dh *.csr *.crt *.p12 *.der *.pem *.key index.txt* \
			serial*  *\.0 *\.1 ca-crl.pem ca.crl

nano /etc/raddb/certs/xpextensions

#
#  File containing the OIDs required for Windows
#  and iOS
#
#  http://support.microsoft.com/kb/814394/en-us
#
#  https://support.apple.com/en-us/HT210176
#
[ xpclient_ext]
extendedKeyUsage = 1.3.6.1.5.5.7.3.2
crlDistributionPoints = URI:http://www.example.com/example_ca.crl

[ xpserver_ext]
extendedKeyUsage = 1.3.6.1.5.5.7.3.1
crlDistributionPoints = URI:http://www.example.com/example_ca.crl

#
#  Add this to the PKCS#7 keybag attributes holding the client's private key
#  for machine authentication.
#
#  the presence of this OID tells Windows XP that the cert is intended
#  for use by the computer itself, and not by an end-user.
#
#  The other solution is to use Microsoft's web certificate server
#  to generate these certs.
#
# 1.3.6.1.4.1.311.17.2

Set Bootstrap file execute permission

chmod +x ./bootstrap

Generate Dhparam file /etc/raddb/certs/dh

openssl dhparam -out dh 2048

Run certs generation

There must be no errors on the output

./bootstrap

You will get new files, including some important ones: ca.pem, server.pem.

Edit freeradius EAP settings

nano /etc/raddb/mods-enabled/eap

private_key_password = PassWord - This password must be the same as the password in the server.cnf

...
# Edit
...
private_key_password = PassWord
private_key_file = /etc/raddb/certs/server.pem
...
certificate_file = /etc/raddb/certs/server.pem
ca_file = /etc/raddb/certs/ca.pem
...
dh_file = /etc/raddb/certs/dh
...

Check freeradius manually

systemctl stop radiusd

radius -X

If there're no errors, restart freeradius service

systemctl restart radiusd

Copy /etc/raddb/certs/ca.pem from the Radius server to your Desktop device.

Client Android

Install the CA certificate to your phone

You phone now needs to be told to trust the certificate that the RADIUS server is presenting.

Somehow you have to get the ca.pem CA certificate onto your phone and you have to do it in a trusted fashion.

There are several possible ways to do this:

  • Link your phone to your computer via a USB cable and transfer the file
  • Write the certificate file to an SD card
  • Use a trusted messaging service such as WhatsApp to transfer the file.

Once you have it over to your phone go to your settings menu and select:

Security -> Advanced -> Encryption and Credentials -> Install a certificate -> Wi-Fi certificate

All being well you will then be presented with a file chooser with your ca.pem in it. Select the file and give the certificate a name when asked by the pop-up.

Choose something obvious like “Dubki WIFI Radius rad03.d.loc”.

Click on OK.

You should get a message telling you that the certificate has been installed. Your phone will now trust certificates signed by your Certification Authority.

Connect to your WI-FI

Go your network configuration section and select the wi-fi section.

You should see the wi-fi network you want displayed (assuming that the network side of things is all set up).

Click on this network.

You will be presented with a screen with a number of incomprehensible questions:

  • For “EAP method” select “PEAP”
  • For “Phase 2 authentication method” select “MSCHAPV2”
  • For “CA certificate” select the name you gave the CA certificate, in our case: "Dubki WIFI Radius rad03.d.loc"
  • For “Domain” select the commonName value you set in the server.cnf file at the Radius server, in our case: rad03.d.loc
  • Fill in your username and password under “Identity” and “Password”: these are the Login and Pass of any user at your Freeradius Server.
  • Press “Save”

All being well you will connect securely to the wifi. Subsequent connections will be automatic.

Источник — https://wiki.cless.pro/index.php?title=DaloRADIUS._Almalinux_8._FreeRADIUS_3_%2B_DaloRADIUS&oldid=1615