MARWAN docs NOC knowledge base1. Synchronize the system clock#
Clock synchronization is very important when dealing with authentication and authorization requests. It ensure accurate timestamping and facilitates effective log analysis. Make sure ntpd or chronyd is ruuning & enabled:
systemctl status chronyd
If it’s not running install ntp and start/enable it. Then check the date for correct time zone:
datetimectl set-timezone Africa/Casablanca
2. Update and reboot#
dnf -y update
reboot
3. Install freeradius#
dnf -y install epel-release
dnf -y install freeradius freeradius-utils
The default config in /etc/raddb/radiusd.conf should be fine, but you can tune to your liking.
4. Configure clients and proxies:#
In this section we’ll configuring the files clients.conf and proxy.conf which are both crucial in any RADIUS deployment.
4.1 configure clients#
FreeRADIUS uses the clients.conffile to establish which devices are authorised to interact with the RADIUS server. For this, it uses a set of IP addresses and corresponding shared secrets to controll access to the RADIUS server.
You’ll find that the existing clients.conf is bloated. For simplicity’s sake, we’ll rename it clients.conf.og, and create a new one with the following configuration.
/etc/raddb/clients.conf#############
client localhost_ipv4 {
ipaddr = 127.0.0.1
secret = testing123
require_message_authenticator = no
nas_type = other
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client localhost_ipv6 {
ipv6addr = ::1
secret = testing123
require_message_authenticator = no
nas_type = other
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client eduroam-morocco-flr1-ipv4 {
ipaddr = 196.200.131.17
secret = skdubFcqAsSPm8e12G-Vcv
nastype = 'eduroam_flr'
}
client eduroam-morocco-flr1-ipv6 {
ipaddr = 2001:4310:f6:d::17
secret = skdubFcqAsSPm8e12G-Vcv
nastype = 'eduroam_flr'
}
client eduroam-morocco-flr2-ipv4 {
ipaddr = 196.200.160.18
secret = skdubFcqAsSPm8e12G-Vcv
nastype = 'eduroam_flr'
}
client eduroam-morocco-flr2-ipv6 {
ipaddr = 2001:4310:f1::18
secret = skdubFcqAsSPm8e12G-Vcv
nastype = 'eduroam_flr'
}
#############
5.2 configure proxy#
The proxy.conf file in FreeRADIUS manages RADIUS requests proxying between servers. It basically routes authentication and authorization requests across network infrastructure.
Same as before, the existing proxy.conf is quite big. To simplify, we rename it proxy.conf.og, and create a new one with the following configuration.
/etc/raddb/proxy.confproxy server {
default_fallback = no
}
home_server localhost {
type = auth
ipaddr = ::1
port = 1812
secret = testing123
response_window = 20
zombie_period = 40
revive_interval = 120
status_check = status-server
check_interval = 30
check_timeout = 4
num_answers_to_alive = 3
max_outstanding = 65536
coa {
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
limit {
max_connections = 16
max_requests = 0
lifetime = 0
idle_timeout = 0
}
}
# Please modify this with your university's domain
realm marwan.ma {
type = radius
authhost = LOCAL
accthost = LOCAL
}
# Please modify this with your university's domain
realm "~(.*\.)marwan\.ma$" {
type = radius
authhost = LOCAL
accthost = LOCAL
}
realm LOCAL {
type = radius
authhost = LOCAL
accthost = LOCAL
}
realm NULL {
type = radius
authhost = LOCAL
accthost = LOCAL
}
home_server eduroam_morocco_flr1_ipv4 {
type = auth+acct
ipaddr = 196.200.131.17
port = 1812
secret = skdubFcqAsSPm8e12G-Vcv
response_window = 20
zombie_period = 40
status_check = status-server
revive_interval = 60
check_interval = 30
num_answers_to_alive = 3
}
home_server eduroam_morocco_flr1_ipv6 {
type = auth+acct
ipaddr = 2001:4310:f6:d::17
port = 1812
secret = skdubFcqAsSPm8e12G-Vcv
response_window = 20
zombie_period = 40
status_check = status-server
revive_interval = 60
check_interval = 30
num_answers_to_alive = 3
}
home_server eduroam_flr2_ipv4 {
type = auth+acct
ipaddr = 196.200.160.18
port = 1812
secret = skdubFcqAsSPm8e12G-Vcv
response_window = 20
zombie_period = 40
status_check = status-server
revive_interval = 60
check_interval = 30
num_answers_to_alive = 3
}
home_server eduroam_flr2_ipv6 {
type = auth+acct
ipaddr = 2001:4310:f1::18
port = 1812
secret = skdubFcqAsSPm8e12G-Vcv
response_window = 20
zombie_period = 40
status_check = status-server
revive_interval = 60
check_interval = 30
num_answers_to_alive = 3
}
home_server_pool eduroam_morocco_pool {
type = keyed-balance
home_server = eduroam_morocco_flr2_ipv4
home_server = eduroam_morocco_flr1_ipv4
}
realm "~.+$" {
auth_pool = eduroam_morocco_pool
nostrip
}
#############
Don’t forget to modify the file configuration with your own parameters, especially the university/institute’s domain and shared secret.
5. Configure eduroam site:#
unlink /etc/raddb/sites-enabled/default
vi /etc/raddb/sites-available/eduroam
/etc/raddb/sites-available/eduroam##############
# The domain users will add to their username to have their credentials
# routed to your institution. You will also need to register this
# and your RADIUS server addresses with your NRO.
operator_name = "university.ac.ma"
server eduroam {
listen {
type = auth
ipaddr = *
port = 0
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
listen {
ipaddr = *
port = 0
type = acct
limit {
}
}
listen {
type = auth
ipv6addr = ::
port = 0
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
listen {
ipv6addr = ::
port = 0
type = acct
limit {
}
}
authorize {
eap
}
authenticate {
eap
}
preacct {
suffix
}
accounting {
}
session {
}
post-auth {
update {
&reply: += &session-state:
}
reply_log
remove_reply_message_if_eap Post-Auth-Type REJECT {
attr_filter.access_reject
eap
remove_reply_message_if_eap
}
}
##############
chgrp radiusd /etc/raddb/sites-available/eduroam
chmod 640 /etc/raddb/sites-available/eduroam
chcon system_u:object_r:radiusd_etc_t:s0 /etc/raddb/sites-available/eduroam
cd /etc/raddb/sites-enabled/
ln -s ../sites-available/eduroam eduroam
chgrp -ch radiusd eduroam
Same for eduroam-inner-tunnel: ############### server eduroam-inner-tunnel { authorize { filter_username auth-log eap files mschap pap }
authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } mschap eap }
session { }
post-auth { reply_log Post-Auth-Type REJECT { attr_filter.access_reject reply_log update outer.session-state { &Module-Failure-Message := &request:Module-Failure-Message } } } #############
-
Configure certificates for the eap module: Copy your certificates to /etc/raddb/certs/ Then change the cert files accordingly in /etc/raddb/mods-enabled/eap (NB: the key file should have 600 in permissions)
-
(For IdPs only) Configure your internal authentication method: We are currently supporting 2 ways of configuring user authentication with freeradius:
- For openldap, go to eduroam-idp-openldap-rocky-8.txt
- For active directory, go to eduroam-idp-ad-rocky-8.txt
-
Finally test your radius server:
[root@eduroam ~]# radtest edutest edutest localhost 1812 testing123 Sent Access-Request Id 77 from 0.0.0.0:37126 to 127.0.0.1:1812 length 77 User-Name = “edutest” User-Password = “edutest” NAS-IP-Address = 196.200.160.149 NAS-Port = 1812 Message-Authenticator = 0x00 Cleartext-Password = “edutest” Received Access-Accept Id 77 from 127.0.0.1:1812 to 127.0.0.1:37126 length 36 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = “14”