1. Configuring Linux Radius Server
Objectives
This chapter will show you how to install and use Radius
Contents
An Overview Of How Radius Works
Configruation of Radius
Testing Radius server
Setting up Aironet Cisco1200 for radius
Client Setup Windows XP with wireless pccard
Practical
Implementing Radius server

2. Introducing the elements
NAS
Network Access Server (NAS) perform authentication, authorization, and accounting for users.
The network access server, is typically a router, switch, or wireless access point
NAS act as a relay that pass or block traffic to and from authenticated clients
RADIUS and AAA
The RADIUS server is usually a daemon process running on a UNIX or Windows 2003 server.
Authentication and authorization plus accounting are combined together in RADIUS
LDAP
The Lightweight Directory Access Protocol (LDAP) is an open standard
It defines a method for accessing and updating information in a X.500-like directory.
LDAP simplifies user administration tasks by managing users in a central directory.
A full-featured RADIUS server can support a variety of mechanisms to authenticate users in addition to LDAP, including
PAP (Password Authentication Protocol, used with PPP in which the password is sent to the client as clear text for comparison);
CHAP (Challenge Handshake Authentication Protocol, more secure than PAP, it uses a username and password);
the local UNIX/Linux system password database (/etc/passwd);
other local databases.

3. Authentication via RADIUS and LDAP
Imagine the following scenario:
The user at home can access his company's intranet by dial-up authentication.
Wireless-enabled laptops can be connected to a campus network by wireless authentication.
Administrators use their workstations to log into network devices via telnet or HTTP via administrative user authentication.
All the these authentication tasks can be done by a RADIUS server against a central LDAP server (see above).

4. Installing FreeRADIUS
Add a testuser
Add a password for your testuser
Building from source
Usally a good idea for best optimized
code
Start radiusd in debug mode
To see if any errors arrives
Modify /etc/shadow permission
Make the first radius auth test
Simulate a user trying to atenticate against the radius server
0 = fake NAS port
testing123 is the mandatory common secret for localhost
NAS clients is found in /etc/raddb/clients.conf
If radtest receives a response, the FreeRADIUS server is working.
# useradd kalle
# passwd kalle
# tar -zxvf freeradius tar.gz
# ./configure
# make
# make install
# radiusd -X
# chmod g+r /etc/shadow
Successful authentication result:
radtest kalle localhost 0 testing123
Sending Access-Request of id 231 to port 1812
User-Name = ”kalle"
User-Password = "123456"
NAS-IP-Address =
NAS-Port = 0
rad_recv: Access-Accept packet from host :1812, id=231, length=20
# radtest kalle localhost 0 testing123

5. Configure FreeRADIUS
FreeRADIUS configuration files are usually stored in the /etc/raddb folder
Modifying radiusd.conf to activate logging
Find and correct
Setup to enable unix account to serve as autentication and add default authentication port’s. Cisco ports can also be used, then change this.
Tell radius where you store the users to authenticate
log_auth = yes
log_auth_badpass = yes
log_auth_goodpass = no
port = 0
Configuring the RADIUS server consists of configuring the server, the client, and the user (both for authentication and authorization). There can be different configurations of the RADIUS server for different needs; fortunately most of the configurations are similar.
Later we will add ldap backend to RADIUS but we start with local autentication.
files {
usersfile = ${confdir}/users
acctusersfile = ${confdir}/acct_users
compat = no }

6. Configure FreeRADIUS for NAS clients
Check that clients.conf is declared in radiusd.conf
Adding the NAS clients in /etc/raddb/clients.conf
Add your access points
Security is sligthly higher if you point out each NAS with IP and have various password for them
Best match is used by radius server
Here is a subnet declaration for NAS
# Cisco Aironet 1235AP
client {
secret = mypass
shortname = ap
nastype = other }
client /24 {
secret = testing123
shortname = office-network
nastype = other }

7. FreeRADIUS MAC authentication setting.
The file /etc/raddb/users contains authentication and configuration information for each user.
Add change thenfollowing links, place after the informative heater text:
We prepare for MAC authentication for users authenticate through the NAS
Authentication will be invisible for the enduser
For more users just add more MAC addresses
This can be used for almost any Cisco Switch or router.
Authentication is invisible, users does not need to enter something.
# user-id (MAC) Authentication type password=MAC
00054e4d3d08 Auth-Type := Local, User-Password == "00054e4d3d08"
00186e8dc079 Auth-Type := Local, User-Password == "00186e8dc079"
Problem can arrive with Windows XP which might not support correct cryptations, there are hacks and workarounds on Microsoft homepage.
The same goes for other adapters and OS.

8. Configuring the Aironet 1200 (1/2)
For No security (open network), login to your AP and goto Express Security
Enter your SSID cisco
No VLAN (you can have VLAN for your different SSID if you like)
No security
Click on APPLY
Activate your WLAN interfaces
Menu Security, check None or a WEP/Chiper if you like. We choose none for best network prestanda Customer is adviced to use cisco VPN client for security or similar.
Menu Security Server Manager
Select RADIUS in Current Server List, list should show <NEW>
Enter your radius server IP address and Shared secret
Standard radius Authentication port 1812 and Accounting port 1813
Click Apply
Goto SSID manager and pick your SSID
Check Open Authentication and chose with MAC Authentication
At server priorities chose Customize and at priority 1 pick your radius server IP address.
Click APPLY
This depends on your users workstations and other CPE devices capability.
At security settings in Aironet you can further granulate authentication protocols for your need.

9. Configuring the Aironet 1200 (2/2)
Next you need to set the AP to use MAC authentication.
Again it is the Security panel, goto local RADIUS settings
Chose general set-up menu and check MAC at Enable Authentication Protocols
Click apply
Last you need to set the authentication order, here we use ONLY the radius server, no local lists.
Select MAC Addresses Authenticated by Authentication Server Only
If you click on security the server based security should look something like this now:
Looking on the SSID on same panel, it should look like this: