Configuring Linux Radius Server Objectives –This chapter will show you how to install and use Radius Contents –An Overview Of How Radius Works –Configruation of Radius –Testing Radius server –Setting up Aironet Cisco1200 for radius –Client Setup Windows XP with wireless pccard Practical –Implementing Radius server

Introducing the elements NAS –Network Access Server (NAS) perform authentication, authorization, and accounting for users. –The network access server, is typically a router, switch, or wireless access point –NAS act as a relay that pass or block traffic to and from authenticated clients RADIUS and AAA –The RADIUS server is usually a daemon process running on a UNIX or Windows 2003 server. –Authentication and authorization plus accounting are combined together in RADIUS LDAP –The Lightweight Directory Access Protocol (LDAP) is an open standard –It defines a method for accessing and updating information in a X.500-like directory. –LDAP simplifies user administration tasks by managing users in a central directory.

Authentication via RADIUS and LDAP

Installing RADIUS Add a testuser –Add a password for your testuser Building from source –Usally a good idea for best optimized code Start radiusd in debug mode –To see if any errors arrives Modify /etc/shadow permission Make the first radius auth test –Simulate a user trying to atenticate against the radius server 0 = fake NAS port testing123 is the mandatory common secret for localhost NAS clients is found in /etc/raddb/clients.conf If radtest receives a response, the FreeRADIUS server is working. # tar -zxvf freeradius tar.gz #./configure # make # make install # tar -zxvf freeradius tar.gz #./configure # make # make install # radiusd -X # radtest kalle localhost 0 testing123 # useradd kalle # passwd kalle # useradd kalle # passwd kalle # chmod g+r /etc/shadow

Configure FreeRADIUS FreeRADIUS configuration files are usually stored in the /etc/raddb folder Modifying radiusd.conf to activate logging –Find and correct Setup to enable unix account to serve as autentication and add cisco authentication port log_auth = yes log_auth_badpass = yes log_auth_goodpass = no log_auth = yes log_auth_badpass = yes log_auth_goodpass = no port = 1645 passwd = /etc/passwd shadow = /etc/shadow group = /etc/group port = 1645 passwd = /etc/passwd shadow = /etc/shadow group = /etc/group

Configure FreeRADIUS for NAS clients Adding the NAS clients in /etc/raddb/clients.conf –You can add single clients or subnets if your like Security is sligthly higher if you point out each NAS with IP and have various password for them Here is a subnet declaration for NAS client /24 { secret = mysecret1 shortname = ap1200 nastype = cisco } client /24 { secret = mysecret1 shortname = ap1200 nastype = cisco } client /24 { secret = mysecret1 shortname = myserver nastype = other } client /24 { secret = mysecret1 shortname = myserver nastype = other }

Configuring the user for authentication The file /etc/raddb/users contains authentication and configuration information for each user. –Add change thenfollowing links, place after the informative heater text: –We prepare for LDAP and LOCAL authentication for users authenticate through the NAS The file /etc/raddb/eap.conf sets the user cryptation methodes (there are many) –Change/add the following: Auth-Type := LDAP Auth-Type := Local, User-Password == "mypasswd" Auth-Type := System Service-Type = Login Auth-Type := LDAP Auth-Type := Local, User-Password == "mypasswd" Auth-Type := System Service-Type = Login default_eap_type = md5 auth_type = PAP md5 { } leap{ } default_eap_type = md5 auth_type = PAP md5 { } leap{ }

Configuring the Aironet 1200 For EAP security, login to your AP and goto express security 1.Enter your SSID cisco 2.No VLAN 3.Security EAP Enter IP address of your Radius server: Enter the Server Secret: mysecret1 Click on APPLY For WPA security, login to your AP and goto express security 1.Enter your SSID cisco 2.No VLAN 3.Security WPA Enter IP address of your Radius server: Enter the Server Secret: mysecret1 Click on APPLY

Configuring the user CPE equipment In this particular case we have windows xp as CPE –Install your