MARWAN docs NOC knowledge base1. Install openldap module and tools and test access to your LDAP server#
’’‘ yum -y install freeradius-ldap openldap-clients ldapsearch -H ldap://ldap.university.ac.ma -D “cn=manager,dc=uni,dc=ac,dc=ma” -W -b “dc=uni,dc=ac,dc=ma” dn ’’‘ Modify the command accordinly. If you get correct results, you can proceed with the configuration.
2. Configure ldap module#
Modify the file according to your settings vi /etc/raddb/mods-available/ldap
##################
ldap {
server = 'ldap.university.ac.ma'
identity = 'cn=manager,dc=university,dc=ac,dc=ma'
password = yourpasswordhere
base_dn= 'ou=people,dc=university,dc=ac,dc=ma'
sasl {
}
tls {
# Set this to 'yes' to use TLS encrypted connections
# start_tls = yes
# ca_file = ${certdir}/cacert.pem
# ca_path = ${certdir}
# certificate_file = /path/to/radius.crt
# private_key_file = /path/to/radius.key
# random_file = /dev/urandom
# require_cert = 'demand'
}
###################
Then create a soft link in mods-enabled: ’’‘ cd /etc/raddb/mods-enabled ln -s ../mods-available/ldap ldap chown -ch radiusd:radiusd ldap ’’‘
3. Configure the inner tunnel to use ldap authentication#
’’‘ vi /etc/raddb/sites-enabled/inner-tunnel ’’‘
####################
server inner-tunnel {
listen {
type = auth
ipaddr = 127.0.0.1
port = 18120 # Used for testing only. Requests proxied internally.
}
authorize {
chap
mschap
suffix
update control {
Proxy-To-Realm := LOCAL
}
eap {
ok = return
}
files
ldap
expiration
logintime
pap
}
authenticate {
Auth-Type PAP {
pap
}
Auth-Type CHAP {
chap
}
Auth-Type MS-CHAP {
mschap
}
Auth-Type LDAP {
ldap
}
eap
}
session {
}
post-auth {
reply_log
Post-Auth-Type REJECT {
attr_filter.access_reject
reply_log
update outer.session-state {
&Module-Failure-Message := &request:Module-Failure-Message
}
}
}
pre-proxy {
}
post-proxy {
eap
}
}
######################
4. Make sure you have ldap authentication configured in your eduroam site#
’’‘ vi /etc/raddb/sites-enabled/eduroam ’’‘