Freeradius peap - Versionsgeschichte

Thomas: /* pre */

2015-02-05T16:39:20Z

pre

Thomas: /* mschap */

2015-02-05T16:39:03Z

mschap

Thomas am 5. Februar 2015 um 16:37 Uhr

2015-02-05T16:37:09Z

Thomas: /* mschap */

2015-02-05T16:26:23Z

mschap

Thomas: /* ldap */

2015-02-05T16:25:57Z

ldap

Thomas: Die Seite wurde neu angelegt: „=clients.conf=

 cat /etc/freeradius/clients.conf  client localhost { ipaddr = 127.0.0.1 secret = secretkey nastype     = other } client 192.168.0.0/16 {…“

2015-02-05T16:23:31Z

Die Seite wurde neu angelegt: „=clients.conf= <pre> cat /etc/freeradius/clients.conf client localhost { ipaddr = 127.0.0.1 secret = secretkey nastype = other } client 192.168.0.0/16 {…“

Neue Seite

=clients.conf=
<pre>
cat /etc/freeradius/clients.conf
client localhost {
ipaddr = 127.0.0.1
secret = secretkey
nastype = other
}
client 192.168.0.0/16 {
secret = secretkey
nastype = other
}
client 10.0.0.0/8 {
secret = secretkey
nastype = other
}
</pre>

=radiusd.conf=
<pre>
cat /etc/freeradius/radiusd.conf
prefix = /usr
exec_prefix = /usr
sysconfdir = /etc
localstatedir = /var
sbindir = ${exec_prefix}/sbin
logdir = /var/log/freeradius
raddbdir = /etc/freeradius
radacctdir = ${logdir}/radacct
name = freeradius
confdir = ${raddbdir}
run_dir = ${localstatedir}/run/${name}
db_dir = ${raddbdir}
libdir = /usr/lib/freeradius
pidfile = ${run_dir}/${name}.pid
user = freerad
group = freerad
max_request_time = 30
cleanup_delay = 5
max_requests = 1024
listen {
type = auth
ipaddr = *
port = 0
}
listen {
ipaddr = *
port = 0
type = acct
}
hostname_lookups = no
allow_core_dumps = no
regular_expressions = yes
extended_expressions = yes
log {
destination = files
file = ${logdir}/radius.log
syslog_facility = daemon
stripped_names = no
auth = no
auth_badpass = no
auth_goodpass = no
}
checkrad = ${sbindir}/checkrad
security {
max_attributes = 200
reject_delay = 1
status_server = yes
}
proxy_requests = yes
$INCLUDE proxy.conf
$INCLUDE clients.conf
thread pool {
start_servers = 5
max_servers = 32
min_spare_servers = 3
max_spare_servers = 10
max_requests_per_server = 0
}
modules {
$INCLUDE ${confdir}/modules/
}
instantiate {
exec
expr
expiration
logintime
}
$INCLUDE policy.conf
$INCLUDE sites-enabled/
</pre>
=ldap=
<pre>
cat /etc/freeradius/modules/ldap
ldap {
server = "hoor.xmen.de"
port = "636"
basedn = "dc=linuggs,dc=de"
filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
ldap_connections_number = 5
timeout = 4
timelimit = 3
net_timeout = 1
dictionary_mapping = ${confdir}/ldap.attrmap
edir_account_policy_check = no
set_auth_type = yes
}
</pre>

=default und inner tunnel=
<pre>
cat /etc/freeradius/sites-enabled/default
authorize {
#digest
mschap
eap {
ok = return
}
ldap
files
}
authenticate {
Auth-Type LDAP {
ldap
}
Auth-Type MS-CHAP {
mschap
}
eap
files
}
preacct {
}
accounting {
}
session {
radutmp
}
post-auth {
exec
Post-Auth-Type REJECT {
attr_filter.access_reject
}
}
pre-proxy {
}
post-proxy {
}
</pre>

=test=
==console 1==
*freeradius -X
<pre>
...
Module: Checking post-auth {...} for more modules to load
} # modules
} # server
radiusd: #### Opening IP addresses and Ports ####
listen {
type = "auth"
ipaddr = *
port = 0
}
listen {
type = "acct"
ipaddr = *
port = 0
}
... adding new socket proxy address * port 40079
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on proxy address * port 1814
Ready to process requests.
</pre>

==console 2==
===postiv===
*radtest badura.vonodinsraben suxer localhost 1812 secretkey
<pre>
Sending Access-Request of id 52 to 127.0.0.1 port 1812
User-Name = "badura.vonodinsraben"
User-Password = "suxer"
NAS-IP-Address = 192.168.244.153
NAS-Port = 1812
Message-Authenticator = 0x00000000000000000000000000000000
rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=52, length=20
</pre>
===negativ===
*radtest badura.vonodinsraben falsch localhost 1812 secretkey
<pre>
Sending Access-Request of id 218 to 127.0.0.1 port 1812
User-Name = "badura.vonodinsraben"
User-Password = "falsch"
NAS-IP-Address = 192.168.244.153
NAS-Port = 1812
Message-Authenticator = 0x00000000000000000000000000000000
rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=218, length=20
</pre>

@@ Zeile 90: / Zeile 90: @@
 $INCLUDE sites-enabled/
 </pre>
-=pre=
+=eap=
 <pre>
 cat /etc/freeradius/eap.conf
@@ Zeile 141: / Zeile 141: @@
+}
 </pre>
 =mschap=
 <pre>

← Nächstältere Version		Version vom 5. Februar 2015, 16:37 Uhr
Zeile 208:		Zeile 208:
	rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=218, length=20		rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=218, length=20
	</pre>		</pre>
		+
		+	*http://www.tldp.org/HOWTO/8021X-HOWTO/freeradius.html

@@ Zeile 92: / Zeile 92: @@
 =mschap=
 <pre>
 mschap {
 use_mppe = yes
@@ Zeile 98: / Zeile 99: @@
+}
 </pre>
 =ldap=