DaloRADIUS. Almalinux 8. FreeRADIUS 3 + DaloRADIUS

Ссылки

https://bytexd.com/freeradius-centos/

Установка и настройка

DISABLE SELINUX!

DISABLE FIREWALLD!

systemctl stop firewalld

systemctl disable firewalld

Utils

dnf install -y nano wget mc

HTTPD

dnf install -y httpd

systemctl enable --now httpd

MariaDB

dnf -y install mariadb-server

systemctl enable --now mariadb

mysql_secure_installation

PHP

dnf install -y dnf-utils http://rpms.remirepo.net/enterprise/remi-release-8.rpm

Если необходима неумолчальная версия PHP (Умолчальная - PHP 7.2)

dnf module list php

dnf module reset php

dnf -y install @php

dnf -y install php-{common,opcache,cli,gd,curl,mysqlnd,devel,pear,mbstring,xml}

sudo systemctl enable --now php-fpm

If you also intend to install daloRADIUS, the freeRADIUS GUI, you’ll also need to install PEAR, a PHP extension, from which we’ll install some dependencies.

dnf -y install php-pear

Next we install the DB and MDB2 libraries from the PEAR repository. These are required by daloRADIUS to work.

pear install DB MDB2

FreeRADIUS

dnf module list freeradius

dnf install -y @freeradius freeradius-utils freeradius-mysql

systemctl enable radiusd.service

Создание сертификатов

cd  /etc/raddb/certs

./bootstrap

Создание БД

mysql -u root -p

   MariaDB [(none)]> CREATE DATABASE radius;

   MariaDB [(none)]> GRANT ALL ON radius.* TO radius@localhost IDENTIFIED BY "PassWord#1";

   MariaDB [(none)]> FLUSH PRIVILEGES;

   MariaDB [(none)]> \q

mysql -u root -p radius < /etc/raddb/mods-config/sql/main/mysql/schema.sql

nano /etc/raddb/sites-available/default

РАСКОММЕНТИРУЕМ ВСЕ "sql" (а также исправляем "-sql" на "sql"), СЛЕДУЮЩИЕ СТРОКИ ДЛЯ ПРИМЕРА

...
authorize {
    sql
}
    
accounting {
    sql
}
session {
    sql
}
...

nano /etc/raddb/sites-available/inner-tunnel

РАСКОММЕНТИРУЕМ ВСЕ "sql" (а также исправляем "-sql" на "sql"), СЛЕДУЮЩИЕ СТРОКИ ДЛЯ ПРИМЕРА

...
authorize {
    sql
}
session {
    sql
}
...

ln -s /etc/raddb/mods-available/sql /etc/raddb/mods-enabled/

nano /etc/raddb/mods-available/sql

...

#dialect = "sqlite"
dialect = "mysql"
#driver = "rlm_sql_null"
driver = "rlm_sql_mysql"
server = "127.0.0.1"
port = 3306
login = "radius"
password = "radius_123"
radius_db = "radius"
# Clients will ONLY be read on server startup.
read_clients = yes
# Table to keep radius client info
client_table = "nas"

...

# COMMENT tls SECTION

mysql {
    # If any of the files below are set, TLS encryption is enabled
    # tls {
    #       ca_file = "/etc/ssl/certs/my_ca.crt"
    #       ca_path = "/etc/ssl/certs/"
    #       certificate_file = "/etc/ssl/certs/private/client.crt"
    #       private_key_file = "/etc/ssl/certs/private/client.key"
    #       cipher = "DHE-RSA-AES256-SHA:AES128-SHA"
    #       tls_required = yes
    #       tls_check_cert = no
    #       tls_check_cert_cn = no
    #}
    # If yes, (or auto and libmysqlclient reports warnings are
    # available), will retrieve and log additional warnings from
    # the server if an error has occured. Defaults to 'auto'
    warnings = auto
}

...
# Comment relative path and add absolute path
#$INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf
$INCLUDE /etc/raddb/mods-config/sql/main/mysql/queries.conf
...

chgrp -h radiusd /etc/raddb/mods-enabled/sql

Проверка FreeRADIUS

radiusd -X

DaloRADIUS

cd /tmp && wget https://github.com/lirantal/daloradius/archive/refs/tags/1.3.zip

dnf -y install unzip

unzip 1.3.zip

sudo mv daloradius-1.3/ /var/www/html/daloradius

cd /var/www/html/daloradius

mysql -u root -p radius < contrib/db/fr2-mysql-daloradius-and-freeradius.sql

mysql -u root -p radius < contrib/db/mysql-daloradius.sql

mkdir /var/www/html/daloradius/library

cp /var/www/html/daloradius/library/daloradius.conf.php.sample /var/www/html/daloradius/library/daloradius.conf.php

chown -R apache:apache /var/www/html/daloradius/

chmod 664 /var/www/html/daloradius/library/daloradius.conf.php

nano /var/www/html/daloradius/library/daloradius.conf.php

...
$configValues['FREERADIUS_VERSION'] = '3';
$configValues['CONFIG_DB_ENGINE'] = 'mysqli';
$configValues['CONFIG_DB_HOST'] = 'localhost';
$configValues['CONFIG_DB_PORT'] = '3306';
$configValues['CONFIG_DB_USER'] = 'root';
$configValues['CONFIG_DB_PASS'] = 'PassWord#1';
$configValues['CONFIG_DB_NAME'] = 'radius';
...

systemctl restart radiusd.service httpd

systemctl status radiusd.service httpd

Работа с DaloRADIUS

Идем в веб-интерфейс

http://192.168.1.11/daloradius

administrator

radius

Добавляем NAS

Добавляем пользователя

Настройки скорости клиента в случае подключения через Mikrotik Hotspot

FREERADIUS + CA CERT + DOMAIN

It's necessary in order to work EAP auth on certain devices like Samsung and Honor. They demand CA cert and Domain name.

Links

https://www.titley.com/index.php/about-us/nigel/creating-self-signed-certificates-for-a-wpa-enterprise-wifi-using-freeradius/

https://networkradius.com/articles/2021/10/25/EAP-production-certificates.html

https://wiki.alpinelinux.org/wiki/FreeRadius_EAP-TLS_configuration

Configuring

Server radius

Backup original config

mv /etc/raddb/certs /etc/raddb/certs.ORIG

Create config directory

mkdir /etc/raddb/certs

Go to the config dir

cd /etc/raddb/certs

Create necessary config files

nano /etc/raddb/certs/server.cnf

Pay attention to the settings:

...

[ CA_default ]

...

default_days        = 3650

...

[ req ]

...

input_password        = PassWord

output_password        = PassWord

...

[server]

countryName = RU

stateOrProvinceName = SAR

localityName = DUB

organizationName = DUBKI

emailAddress = admin@mail.ru

commonName = "rad03.d.loc"

...

[alt_names]

DNS.1 = rad03.d.loc

...

[ ca ]
default_ca		= CA_default

[ CA_default ]
dir			= ./
certs			= $dir
crl_dir			= $dir/crl
database		= $dir/index.txt
new_certs_dir		= $dir
certificate		= $dir/server.pem
serial			= $dir/serial
crl			= $dir/crl.pem
private_key		= $dir/server.key
RANDFILE		= $dir/.rand
name_opt		= ca_default
cert_opt		= ca_default
default_days		= 3650
default_crl_days	= 30
default_md		= sha256
preserve		= no
policy			= policy_match

[ policy_match ]
countryName		= match
stateOrProvinceName	= match
organizationName	= match
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

[ policy_anything ]
countryName		= optional
stateOrProvinceName	= optional
localityName		= optional
organizationName	= optional
organizationalUnitName	= optional
commonName		= supplied
emailAddress		= optional

[ req ]
prompt			= no
distinguished_name	= server
default_bits		= 2048
input_password		= PassWord
output_password		= PassWord
req_extensions		= v3_req

[server]
countryName = RU
stateOrProvinceName = SAR
localityName = DUB
organizationName = DUBKI
emailAddress = d.tmb.it@yandex.ru
commonName = "rad03.d.loc"

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

#  This should be a host name of the RADIUS server.
#  Note that the host name is exchanged in EAP *before*
#  the user machine has network access.  So the host name
#  here doesn't really have to match anything in DNS.
[alt_names]
DNS.1 = rad03.d.loc

# NAIRealm from RFC 7585
otherName.0 = 1.3.6.1.5.5.7.8.8;FORMAT:UTF8,UTF8:*.example.com

chmod +x ./bootstrap

openssl dhparam -out dh 2048

./bootstrap

nano /etc/raddb/mods-enabled/eap

...
# Edit
...
private_key_password = PassWord#1
private_key_file = /etc/raddb/certs/server.pem
...
certificate_file = /etc/raddb/certs/server.pem
ca_file = /etc/raddb/certs/ca.pem
...
dh_file = /etc/raddb/certs/dh
...

systemctl restart radiusd

Client Android

Install the CA certificate

You phone now needs to be told to trust the certificate that the RADIUS server is presenting. This is actually fairly simple except for the first part. You are about to encounter at first hand one of the most difficult parts of establishing a trusted connection. Somehow you have to get the ca.pem CA certificate onto your phone and you have to do it in a trusted fashion. There are several possible ways to do this:

• Link your phone to your computer via a USB cable and transfer the file
• Write the certificate file to an SD card

Once you have it over to your phone go to your settings menu and select

Security -> Advanced -> Encryption and Credentials -> Install a certificate -> Wi-Fi certificate

All being well you will then be presented with a file chooser with your ca.pem in it. Select the file and give the certificate a name when asked by the pop-up. Choose something obvious like “Corporate Wifi”. Click on OK. You should get a message telling you that the certificate has been installed. Your phone will now trust certificates signed by your Certification Authority.

Connect to your wi-fi

Go your network configuration section and select the wi-fi section. You should see the wi-fi network you want displayed (assuming that the network side of things is all set up). Click on this network. You will be presented with a screen with a number of incomprehensible questions:

• For “EAP method” select “PEAP”
• For “Phase 2 authentication method” select “MSCHAPV2”
• For “CA certificate” select the name you gave the CA certificate
• For “Domain” select the commonName value you set in the server.cnf file (“server1.grabbit-radius.com”).
• Fill in your username and password under “Identity” and “Password”.
• Press “Save”

All being well you will connect securely to the wifi. Subsequent connections will be automatic.