Freeradius ldap - Versionsgeschichte

Thomas: /* negativ */

2018-01-23T15:03:21Z

negativ

Thomas: /* postiv */

2018-01-23T15:02:09Z

postiv

Thomas: /* inner-tunnel */

2018-01-23T14:59:50Z

inner-tunnel

Thomas: /* inner-tunnel */

2018-01-23T14:58:16Z

inner-tunnel

Thomas: /* default */

2018-01-23T14:52:58Z

default

Thomas am 23. Januar 2018 um 14:51 Uhr

2018-01-23T14:51:49Z

Thomas: /* postiv */

2018-01-23T14:37:05Z

postiv

Thomas: /* ldap */

2018-01-23T14:33:50Z

ldap

Thomas: /* radiusd.conf */

2018-01-23T14:27:56Z

radiusd.conf

Thomas: Die Seite wurde neu angelegt: „=clients.conf= *cat /etc/freeradius/clients.conf

 client localhost { ipaddr = 127.0.0.1 secret = sysadm nastype     = other } client 192.168.0.0/16 {  se…“

2018-01-23T14:27:38Z

Die Seite wurde neu angelegt: „=clients.conf= *cat /etc/freeradius/clients.conf <pre> client localhost { ipaddr = 127.0.0.1 secret = sysadm nastype = other } client 192.168.0.0/16 { se…“

Neue Seite

=clients.conf=
*cat /etc/freeradius/clients.conf
<pre>
client localhost {
ipaddr = 127.0.0.1
secret = sysadm
nastype = other
}
client 192.168.0.0/16 {
secret = sysadm
nastype = other
}
client 172.16.0.0/12 {
secret = sysadm
nastype = other
}
client 10.0.0.0/8 {
secret = sysadm
nastype = other
}
</pre>

=radiusd.conf=
<pre>
cat /etc/freeradius/radiusd.conf
prefix = /usr
exec_prefix = /usr
sysconfdir = /etc
localstatedir = /var
sbindir = ${exec_prefix}/sbin
logdir = /var/log/freeradius
raddbdir = /etc/freeradius
radacctdir = ${logdir}/radacct
name = freeradius
confdir = ${raddbdir}
run_dir = ${localstatedir}/run/${name}
db_dir = ${raddbdir}
libdir = /usr/lib/freeradius
pidfile = ${run_dir}/${name}.pid
user = freerad
group = freerad
max_request_time = 30
cleanup_delay = 5
max_requests = 1024
listen {
type = auth
ipaddr = *
port = 0
}
listen {
ipaddr = *
port = 0
type = acct
}
hostname_lookups = no
allow_core_dumps = no
regular_expressions = yes
extended_expressions = yes
log {
destination = files
file = ${logdir}/radius.log
syslog_facility = daemon
stripped_names = no
auth = no
auth_badpass = no
auth_goodpass = no
}
checkrad = ${sbindir}/checkrad
security {
max_attributes = 200
reject_delay = 1
status_server = yes
}
proxy_requests = yes
$INCLUDE proxy.conf
$INCLUDE clients.conf
thread pool {
start_servers = 5
max_servers = 32
min_spare_servers = 3
max_spare_servers = 10
max_requests_per_server = 0
}
modules {
$INCLUDE ${confdir}/modules/
}
instantiate {
exec
expr
expiration
logintime
}
$INCLUDE policy.conf
$INCLUDE sites-enabled/
</pre>
=ldap=
<pre>
cat /etc/freeradius/modules/ldap
ldap {
server = "hoor.xmen.de"
port = "636"
basedn = "dc=linuggs,dc=de"
filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
ldap_connections_number = 5
timeout = 4
timelimit = 3
net_timeout = 1
dictionary_mapping = ${confdir}/ldap.attrmap
edir_account_policy_check = no
set_auth_type = yes
}
</pre>

=default=
<pre>
cat /etc/freeradius/sites-enabled/default
authorize {
ldap
}
authenticate {
Auth-Type LDAP {
ldap
}
}
preacct {
}
accounting {
}
session {
radutmp
}
post-auth {
exec
Post-Auth-Type REJECT {
attr_filter.access_reject
}
}
pre-proxy {
}
post-proxy {
}
</pre>

=inner-tunnel=
<pre>
server inner-tunnel {
authorize {
ldap
}
authenticate {
Auth-Type LDAP {
ldap
}
}
session {
radutmp
}
post-auth {
Post-Auth-Type REJECT {
attr_filter.access_reject
}
}
pre-proxy {
}
post-proxy {
}
}
</pre>

=test=
==console 1==
*freeradius -X
<pre>
...
Module: Checking post-auth {...} for more modules to load
} # modules
} # server
radiusd: #### Opening IP addresses and Ports ####
listen {
type = "auth"
ipaddr = *
port = 0
}
listen {
type = "acct"
ipaddr = *
port = 0
}
... adding new socket proxy address * port 40079
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on proxy address * port 1814
Ready to process requests.
</pre>

==console 2==
===postiv===
*radtest badura.vonodinsraben suxer localhost 1812 secretkey
<pre>
Sending Access-Request of id 52 to 127.0.0.1 port 1812
User-Name = "badura.vonodinsraben"
User-Password = "suxer"
NAS-IP-Address = 192.168.244.153
NAS-Port = 1812
Message-Authenticator = 0x00000000000000000000000000000000
rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=52, length=20
</pre>
===negativ===
*radtest badura.vonodinsraben falsch localhost 1812 secretkey
<pre>
Sending Access-Request of id 218 to 127.0.0.1 port 1812
User-Name = "badura.vonodinsraben"
User-Password = "falsch"
NAS-IP-Address = 192.168.244.153
NAS-Port = 1812
Message-Authenticator = 0x00000000000000000000000000000000
rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=218, length=20
</pre>

*https://medium.com/@georgijsr/freeradius-2-1-12-ubuntu-14-04-server-with-ldap-authentication-and-ldap-fail-over-6611624ff2c9

← Nächstältere Version		Version vom 23. Januar 2018, 15:03 Uhr
Zeile 299:		Zeile 299:
	Ready to process requests.		Ready to process requests.
	</pre>		</pre>
−
−	~~===negativ===~~
−	*radtest badura.vonodinsraben falsch localhost 1812 secretkey
−	~~<pre>~~
−	~~Sending Access-Request of id 218 to 127.0.0.1 port 1812~~
−	~~User-Name = "badura.vonodinsraben"~~
−	~~User-Password = "falsch"~~
−	~~NAS-IP-Address = 192.168.244.153~~
−	~~NAS-Port = 1812~~
−	~~Message-Authenticator = 0x00000000000000000000000000000000~~
−	~~rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=218, length=20~~
−	~~</pre>~~
−
−	*https://medium.com/@georgijsr/freeradius-2-1-12-ubuntu-14-04-server-with-ldap-authentication-and-ldap-fail-over-6611624ff2c9

@@ Zeile 248: / Zeile 248: @@
+}
+}
+</pre>
 </pre>

← Nächstältere Version		Version vom 23. Januar 2018, 14:51 Uhr
Zeile 1:		Zeile 1:
		+	=groupofNames=
		+	<pre>
		+	# switch, groups, xinux.net
		+	dn: cn=switch,ou=groups,dc=xinux,dc=net
		+	objectClass: groupOfNames
		+	cn: switch
		+	description: Switch Admins
		+	member: cn=thomas will,ou=users,dc=xinux,dc=net
		+	</pre>
		+
	=clients.conf=		=clients.conf=
	*cat /etc/freeradius/clients.conf		*cat /etc/freeradius/clients.conf

@@ Zeile 287: / Zeile 287: @@
 ==console 2==
 ===postiv===
-*radtest badura.vonodinsraben  suxer localhost  1812 secretkey
+*radtest thomas.will suxer localhost 1812 sysadm
 <pre>
-Sending Access-Request of id 52 to 127.0.0.1 port 1812
+Sending Access-Accept of id 128 to 127.0.0.1 port 41246
-	User-Name = "badura.vonodinsraben"
+	Tunnel-Type:0 = VLAN
-	User-Password = "suxer"
+	Tunnel-Medium-Type:0 = IEEE-802
-	NAS-IP-Address = 192.168.244.153
+	Tunnel-Private-Group-Id:0 = "17"
-	NAS-Port = 1812
+Finished request 2.
-	Message-Authenticator = 0x00000000000000000000000000000000
+Going to the next request
-rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=52, length=20
+Waking up in 4.9 seconds.
 </pre>

@@ Zeile 194: / Zeile 194: @@
 =inner-tunnel=
 <pre>
 server inner-tunnel {
 authorize {
-ldap
+	chap
+}
 authenticate {
-Auth-Type LDAP {
+	Auth-Type PAP {
-ldap
+		pap
-−
+	}
+}
 session {
-radutmp
+	radutmp
+}
 post-auth {
-Post-Auth-Type REJECT {
+	Post-Auth-Type REJECT {
-attr_filter.access_reject
+		attr_filter.access_reject
-−
+	}
+}
 pre-proxy {
+}
 post-proxy {
+}
+}
 </pre>

@@ Zeile 216: / Zeile 216: @@
 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=52, length=20
 </pre>
 ===negativ===
 *radtest badura.vonodinsraben  falsch localhost  1812 secretkey

@@ Zeile 96: / Zeile 96: @@
 =ldap=
 <pre>
 ldap {
-server = "hoor.xmen.de"
+        server = "localhost"
-port = "636"
+        identity = "cn=admin,dc=xinux,dc=net"
-basedn = "dc=linuggs,dc=de"
+        password = sysadm
-filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
+        basedn = "dc=xinux,dc=net"
-ldap_connections_number = 5
+        filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
-timeout = 4
+        ldap_connections_number = 5
-timelimit = 3
+        max_uses = 0
-net_timeout = 1
+        timeout = 4
-dictionary_mapping = ${confdir}/ldap.attrmap
+        timelimit = 3
-edir_account_policy_check = no
+        net_timeout = 1
-set_auth_type = yes
+        dictionary_mapping = ${confdir}/ldap.attrmap
+}
 </pre>

@@ Zeile 22: / Zeile 22: @@
 =radiusd.conf=
 <pre>
 prefix = /usr
 exec_prefix = /usr
@@ Zeile 94: / Zeile 94: @@
 $INCLUDE sites-enabled/
 </pre>
 =ldap=
 <pre>