training Michal Procházka, Jan Oppolzer CESNET

Agenda FLRS Requirements Preparation of the host Installation of radsecproxy IdP Requirements Preparation of the host Installation of freeRADIUS

Terms ETRLS – eduroam top level RADIUS server FLRS – federation level RADIUS server OT – eduroam operational team

National level RADIUS (FLRS) Proxy requests among IdPs or proxy request to the ETLRS Monitored by the eduroam monitoring infrastructure

Requirements Linux host for national-level RADIUS hosting X.509 certificate + private key (eduroam accredited) certificates/ NTP radsecproxy

Preparation of the host Assign DNS name Generate X.509 certificate for the host Install these components: NTP radsecproxy (>1.6)

radsecproxy to+deploy+eduroam+at+national+level#Howtod eployeduroamatnationallevel-radsecproxy

Install radsecproxy On Debian systems apt-get install radsecproxy Manually get sources from

/etc/radsecproxy.conf # Server listen ports ListenUDP *:1812 ListenTLS *:2083

/etc/radsecproxy.conf # Logging LogLevel 3 LogDestination x-syslog:///LOG_LOCAL0 LoopPrevention On

/etc/radsecproxy.conf # FTIKS FTicksReporting Full FTicksMAC VendorKeyHashed FTicksKey arandomsalt

/etc/rsyslog.d/50-radsecproxy.conf # radsecproxy if ($programname == 'radsecproxy') and ($msg contains 'F-TICKS') \ & stop # Contact OT for syslog IP address

/etc/radsecproxy.conf # TLS configuration tls defaultClient { CACertificatePath /root/ CertificateFile /root/cert.pem CertificateKeyFile /root/key.pem # CertificateKeyPassword __CERT_PASS__ policyOID # CRLCheck On } tls defaultServer { CACertificatePath /root/ CertificateFile /root/cert.pem CertificateKeyFile /root/key.pem # CertificateKeyPassword __CERT_PASS__ policyOID # CRLCheck On }

/etc/radsecproxy.conf # Attribute filtering (remove VLAN definitions) rewrite defaultClient { removeAttribute 64 removeAttribute 65 removeAttribute 81 }

/etc/radsecproxy.conf # For debugging purposes only client { type udp secret testing123 }

/etc/radsecproxy.conf # eduroam monitoring, negotiate with OT client SA3-monitoring-incoming { host a.b.c.d type UDP secret __MONITORING_SECRET__ } server SA3-monitoring-outgoing { host a.b.c.d type UDP secret __MONITORING_SECRET__ }

/etc/radsecproxy.conf # catch-all for RADIUS/TLS client incoming { host /0 type TLS tls defaultClient secret radsec }

/etc/radsecproxy.conf # Request forwarding – RADIUS/TLS server radius.asren.org { type TLS tls defaultServer secret radsec statusserver on }

/etc/radsecproxy.conf # Uplink to eduroam infrastructure server etlr1.eduroam.org { type TLS tls defaultServer secret radsec statusserver on } server etlr2.eduroam.org { type TLS tls defaultServer secret radsec statusserver on }

/etc/radsecproxy.conf # Filter bad realms, should be catched by the SP realm /myabc\.com$ { replymessage "Misconfigured client: default realm of Intel PRO/Wireless supplicant! Rejected by." accountingresponse on } realm /^$/ { replymessage "Misconfigured client: empty realm! Rejected by." accountingresponse on }

/etc/radsecproxy.conf # Filter wrong realms from your TLD (e.g..edu.jo) realm /\.YOUR_TLD$ { replymessage "Misconfigured supplicant or downstream server: uses known- bad realm in federation!" }

/etc/radsecproxy.conf # Realms forwarding logins realm /asren\.org$ { server radius.asren.org server radius2.asren.org }

/etc/radsecproxy.conf # Definition for eduroam monitoring realm /eduroam\.YOUR_TLD { server SA3-monitoring-outgoing }

/etc/radsecproxy.conf # Finally forward other realms upwards realm * { server etlr1.eduroam.org server etlr2.eduroam.org }

Testing and Debugging Run radsecproxy in debug mode: radsecproxy –d5 –f

Get the Testing Certificate Register your RA Request server certificate and-demos/

FLRS server Implements F-ticks monitoring Host properly monitored (e.g. Nagios) Synchronized time with GPS/NTP Must answer ICMP Ping requests

Summary Installed FLRS Configured to be connected to the ETLRS FLRS ready to be monitored

Homework Failover configuration Maintenance support Monitoring of the FLRS Backup (logs for 6 months)

Organization level RADIUS Provides authentication of the users Connected to the organizational IdM Usually works as a SP

Requirements Linux/Windows host for IdP RADIUS X.509 certificate NTP freeRADIUS

Preparation of the host Assign DNS name Generate X.509 certificate for the host Install these components: NTP freeRADIUS (>3)

Installation of freeRADIUS Complete instructions on: -Debian-packages

Installation of freeRADIUS on Debian 8 cd /usr/src/ wget ftp://ftp.freeradius.org/pub/freeradius/freeradius-server tar.gzftp://ftp.freeradius.org/pub/freeradius/freeradius-server tar.gz tar xvzf freeradius-server tar.gz apt-get install dpkg-dev fakeroot build-essential debhelper quilt autotools-dev libpam0g-dev libmysqlclient-dev libgdbm-dev libldap2-dev libsasl2-dev libiodbc2- dev libkrb5-dev libperl-dev libpcap-dev python-dev libreadline-dev libsnmp-dev libpq-dev libssl-dev libtalloc-dev libyubikey-dev libsqlite3-dev libcurl4-openssl-dev libcap-dev libjson-c-dev libwbclient-dev ssl-cert cd freeradius-server fakeroot dpkg-buildpackage -b -uc cd /opt/src/ dpkg -i freeradius_3.0.9+git_amd64.deb freeradius-common_3.0.9+git_all.deb freeradius-utils_3.0.9+git_amd64.deb libfreeradius3_3.0.9+git_amd64.deb freeradius-ldap_3.0.9+git_amd64.deb freeradius-config_3.0.9+git_amd64.deb

/etc/freeradius/proxy.conf # Setup proper proxying of the requests … realm LOCAL { … } realm asren.org { } …

Certificates Store/use X.509 certificates in /etc/freeradius/certs/ Setup proper owner chown freerad:freerad server.key chmod 0640 server.key

/etc/freeradius/mods-available/eap # Setup TLS eap { … tls-config tls-common { # Private key private_key_file = ${certdir}/radius.key … # Certificate certificate_file = ${certdir}/radius.crt … }

/etc/freeradius/clients.conf # Client definitions client ap_network { secret = shortname = aps ipaddr = /24 }

Enable radsec ln -s /etc/freeradius/sites-available/tls /etc/freeradius/sites-enables/tls

/etc/freeradius/sites-available/tls # For listen and home_server section private_key_file = radius.key certificate_file = radius.pem

/etc/freeradius/sites-available/tls # Connection to the FLRS clients radsec { client radius1.asren.org { ipaddr = a.b.c.d proto = tls secret = radsec } … } home_server tls { ipaddr = radius1.asren.org secret = radsec … } … realm DEFAULT { auth_pool = tls nostrip }

Additional steps Disable dhcp module rm /etc/freeradius/mods-enable/dhcp

Testing and debugging freeradius -fxx -l stdout eapol_test test/eduroam-test.cgi

Create local test account Edit /etc/freeradius/users Cleartext-Password := „abc123“ Fall-Through = Yes

Integration with LDAP Users login/password will be checked against LDAP Passwords must be stored in clear-text form in the LDAP

sites-enabled/inner-tunnel # Enable LDAP authentication authorize { … ldap … } … authenticate { … Auth-Type LDAP { ldap } … }

mods-available/ldap server = ‘ldaps://ldaphost.org’ # user with rights to read the passwords identity = ‘uid=,ou=Special Users,dc=asren,dc=org“ password = # Base DN, where to search the user base_dn = „ou=People,dc=asren,dc=org“ update { # LDAP atribute containing the password control:Cleartext-Password := 'radiusPassword’ } … tls { … ca_file = require_cert = ‘demand’ }

Activate LDAP module cd /etc/freeradius/mods-enabled ln -s../mods-available/ldap

Integration with AD Active-Directory-Integration-HOWTO

Sources Automatic installer from CAF Slides and configuration files from the workshop