Reverse-Logic wiki

Felhasználói eszközök

Eszközök a webhelyen

Nyomvonal: • samba4
linux:freeradius

Különbségek

A kiválasztott változat és az aktuális verzió közötti különbségek a következők.

Összehasonlító nézet linkje

Következő változat		Előző változat
linux:freeradius [2025/09/08 18:24] – létrehozva riba.zoltanlinux:freeradius [2025/09/10 11:05] (aktuális) – [Kerberos hitelesítés] riba.zoltan
Sor 1: Sor 1:
 ====== Freeradius telepítése RHEL/Almalinux 9 (x86_64) rendszeren ====== ====== Freeradius telepítése RHEL/Almalinux 9 (x86_64) rendszeren ======
 +
 +===== Előkészítés =====
 +
 +Kiindulásként AlmaLinux 9 (x86_64) operációs rendszer telepítését kell elvégezni. A telepítés minimal telepítés.
 +
 +===== Telepítést követő lépések =====
 +
 +Módosítani kell a /etc/dnf/dnf.conf állományt a felesleges gyenge függőségek telepítésének tiltásához:
 +
 +<code>
 +# if [ ! -f /etc/dnf/dnf.conf.orig ] ; then cp -a /etc/dnf/dnf.conf /etc/dnf/dnf.conf.orig && echo 'install_weak_deps=False' >> /etc/dnf/dnf.conf ; fi
 +</code>
 +
 +Érdemes kikapcsolni a kernel üzenetek megjelenítését
 +
 +<code>
 +# grubby --update-kernel=ALL --args=quiet
 +</code>
 +
 +A SElinux-ot átmenetileg megengedő módba kell kapcsolni
 +
 +<code>
 +# sed -i 's/^SELINUX=.*/SELINUX=permissive/' /etc/selinux/config
 +</code>
 +
 +Be kell állítani a rendszer locale-t en_US.UTF-8-ra
 +
 +<code>
 +# localectl
 +</code>
 +
 +Listázzuk az elérhető csomagokat
 +
 +<code>
 +# dnf list freeradius*
 +Last metadata expiration check: 1:14:21 ago on Mon 08 Sep 2025 07:24:49 PM CEST.
 +Available Packages
 +freeradius.x86_64                                                                             3.0.21-44.el9_6                                                                        appstream
 +freeradius-devel.x86_64                                                                       3.0.21-44.el9_6                                                                        appstream
 +freeradius-doc.x86_64                                                                         3.0.21-44.el9_6                                                                        appstream
 +freeradius-krb5.x86_64                                                                        3.0.21-44.el9_6                                                                        appstream
 +freeradius-ldap.x86_64                                                                        3.0.21-44.el9_6                                                                        appstream
 +freeradius-utils.x86_64                                                                       3.0.21-44.el9_6                                                                        appstream
 +</code>
 +
 +Telepítsük a szükséges csomagokat
 +
 +<code>
 +# dnf install freeradius freeradius-utils
 +</code>
 +
 +Futtassuk a radiusd programot debug módban ahol az alábbi hibát kapjuk
 +
 +<code>
 +   tls-config tls-common {
 +    verify_depth = 0
 +    ca_path = "/etc/raddb/certs"
 +    pem_file_type = yes
 +    private_key_file = "/etc/raddb/certs/server.pem"
 +Unable to check file "/etc/raddb/certs/server.pem": No such file or directory
 +/etc/raddb/mods-enabled/eap[183]: Failed parsing configuration item "private_key_file"
 +rlm_eap_tls: Failed initializing SSL context
 +rlm_eap (EAP): Failed to initialise rlm_eap_tls
 +/etc/raddb/mods-enabled/eap[14]: Instantiation failed for module "eap"
 +</code>
 +
 +Inicializáljuk a tanúsítványokat
 +
 +<code>
 +# cd /etc/raddb/certs
 +
 +# make ca.pem
 +make[1]: Entering directory '/etc/raddb/certs'
 +make[1]: Leaving directory '/etc/raddb/certs'
 +make[1]: Entering directory '/etc/raddb/certs'
 +make[1]: Leaving directory '/etc/raddb/certs'
 +openssl req -new -x509 -keyout ca.key -out ca.pem \
 + -days '60' -config ./ca.cnf \
 + -passin pass:'whatever' -passout pass:'whatever' -noenc
 +.+.......+...+......+..+++++++++++++++++++++++++++++++++++++++*..+...+.+...+.....+...+...+......+.+...+++++++++++++++++++++++++++++++++++++++*..+...+....++++++
 +...+..........+......+.........+...+...+.....+++++++++++++++++++++++++++++++++++++++*.......+..............+.+.....+.+..+++++++++++++++++++++++++++++++++++++++*........+...+...+............+...+..............+.............+........+...+....+..+.........+............+...+......+...............+.+.....+.............+..+...................+...+...+.....+...+.+.........+......+.....+...+.+.....+.+...........+...+......+.+...+..............+.......+.....+...+.......+.........+......+......++++++
 +-----
 +chmod g+r ca.key
 +chown root:radiusd ca.*
 +chmod 640 ca.*
 +
 +# make server.pem
 +openssl req -new  -out server.csr -keyout server.key -config ./server.cnf -noenc
 +.+......................+......+..+.......+.....+.+.....+.......+.....+.+...........+....+.....+.+.........+.....+......+...+.+.....+.........+......+....+++++++++++++++++++++++++++++++++++++++*.+............+........+.......+..+....+...........+.+++++++++++++++++++++++++++++++++++++++*........+.............+..+...+.......+..+..........+...+..+....+.....++++++
 +.....+...+.....+.............+.....+++++++++++++++++++++++++++++++++++++++*..+......+...........+...............+......+....+......+++++++++++++++++++++++++++++++++++++++*...+..........+...+........+.+.........+............+..............+...+...+...+.+...+...+...+.........+..+..........+.....+....+..+.............+...........+.........+......+.........+......+...+..........+...+...+.........+.....+..................++++++
 +-----
 +chmod g+r server.key
 +openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr  -key 'whatever' -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf
 +Using configuration from ./server.cnf
 +Check that the request matches the signature
 +Signature ok
 +Certificate Details:
 +        Serial Number: 1 (0x1)
 +        Validity
 +            Not Before: Sep  8 19:11:33 2025 GMT
 +            Not After : Nov  7 19:11:33 2025 GMT
 +        Subject:
 +            countryName               = FR
 +            stateOrProvinceName       = Radius
 +            organizationName          = Example Inc.
 +            commonName                = Example Server Certificate
 +            emailAddress              = admin@example.org
 +        X509v3 extensions:
 +            X509v3 Extended Key Usage: 
 +                TLS Web Server Authentication
 +            X509v3 CRL Distribution Points: 
 +                Full Name:
 +                  URI:http://www.example.com/example_ca.crl
 +            X509v3 Certificate Policies: 
 +                Policy: 1.3.6.1.4.1.40808.1.3.2
 +Certificate is to be certified until Nov  7 19:11:33 2025 GMT (60 days)
 +
 +Write out database with 1 new entries
 +Database updated
 +openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12  -passin pass:'whatever' -passout pass:'whatever'
 +chmod g+r server.p12
 +openssl pkcs12 -in server.p12 -out server.pem -passin pass:'whatever' -passout pass:'whatever'
 +chmod g+r server.pem
 +chown root:radiusd server.*
 +chmod 640 server.*
 +</code>
 +
 +Amennyiben szeretnénk az eredeti állaporta állni, akkor az alábbi utasításokat futtassuk
 +
 +<code>
 +# cd /etc/raddb/certs && rm -f *.pem *.der *.csr *.crt *.key *.p12 serial* index.txt*
 +</code>
 +
 +A szerver tesztelését újra futtathatjuk
 +
 +<code>
 +Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel
 +Listening on auth address * port 1812 bound to server default
 +Listening on acct address * port 1813 bound to server default
 +Listening on auth address :: port 1812 bound to server default
 +Listening on acct address :: port 1813 bound to server default
 +Listening on proxy address * port 44473
 +Listening on proxy address :: port 54094
 +Ready to process requests
 +</code>
 +
 +==== File alapú hitelesítés ====
 +
 +Mentsük le a felhasználókat tartalmazó adatbázist
 +
 +<code>
 +# cp -a /etc/raddb/mods-config/files/authorize /etc/raddb/mods-config/files/authorize.orig
 +</code>
 +
 +Hozzunk létre teszt felhasználót
 +
 +<code>
 +# cat > /etc/raddb/mods-config/files/authorize <<EOF
 +testing Cleartext-Password := "password"
 +EOF
 +</code>
 +
 +Újraindítás nélkül teszteljük a hozzáférést
 +
 +<code>
 +# radtest testing password 127.0.0.1 0 testing123
 +Sent Access-Request Id 146 from 0.0.0.0:59541 to 127.0.0.1:1812 length 77
 + User-Name = "testing"
 + User-Password = "password"
 + NAS-IP-Address = 192.168.110.11
 + NAS-Port = 0
 + Cleartext-Password = "password"
 +Received Access-Reject Id 146 from 127.0.0.1:1812 to 127.0.0.1:59541 length 38
 + Message-Authenticator = 0x6fdf89ab2cd775d9cbecc980edf715f3
 +(0) -: Expected Access-Accept got Access-Reject
 +</code>
 +
 +Töltsük újra a szerver konfigurációt
 +
 +<code>
 +# systemctl restart radiusd
 +</code>
 +
 +Teszteljük a módosítást
 +
 +<code>
 +# radtest testing password 127.0.0.1 0 testing123
 +Sent Access-Request Id 161 from 0.0.0.0:44720 to 127.0.0.1:1812 length 77
 + User-Name = "testing"
 + User-Password = "password"
 + NAS-IP-Address = 192.168.110.11
 + NAS-Port = 0
 + Cleartext-Password = "password"
 +Received Access-Accept Id 161 from 127.0.0.1:1812 to 127.0.0.1:44720 length 38
 + Message-Authenticator = 0x88d891160ee4e45002497ff6e3ca4b59
 +</code>
 +
 +Teljes teszt
 +
 +<code>
 +# radtest --help
 +Usage: radtest [OPTIONS] user passwd radius-server[:port] nas-port-number secret [ppphint] [nasname]
 +        -d RADIUS_DIR       Set radius directory
 +        -t <type>           Set authentication method
 +                            type can be pap, chap, mschap, or eap-md5
 +        -P protocol         Select udp (default) or tcp
 +        -x                  Enable debug output
 +        -4                  Use IPv4 for the NAS address (default)
 +        -6                  Use IPv6 for the NAS address
 +        -6                  Mandate checks for Blast RADIUS (this is not set by default).
 +
 +# radtest -t pap testing password 127.0.0.1 0 testing123
 +Sent Access-Request Id 146 from 0.0.0.0:59648 to 127.0.0.1:1812 length 77
 + User-Name = "testing"
 + User-Password = "password"
 + NAS-IP-Address = 192.168.110.11
 + NAS-Port = 0
 + Cleartext-Password = "password"
 +Received Access-Accept Id 146 from 127.0.0.1:1812 to 127.0.0.1:59648 length 38
 + Message-Authenticator = 0x29c262c37719c7b5490dade0eba018a2
 +
 +# radtest -t chap testing password 127.0.0.1 0 testing123
 +Sent Access-Request Id 46 from 0.0.0.0:46131 to 127.0.0.1:1812 length 78
 + User-Name = "testing"
 + CHAP-Password = 0xcaf4ca1ab5cbd80cfd255c0a20b5d0d7a3
 + NAS-IP-Address = 192.168.110.11
 + NAS-Port = 0
 + Cleartext-Password = "password"
 +Received Access-Accept Id 46 from 127.0.0.1:1812 to 127.0.0.1:46131 length 38
 + Message-Authenticator = 0x915bad7c2a2c26cb4e25f95b0f606158
 +
 +# radtest -t mschap testing password 127.0.0.1 0 testing123
 +Sent Access-Request Id 133 from 0.0.0.0:36775 to 127.0.0.1:1812 length 133
 + User-Name = "testing"
 + MS-CHAP-Password = "password"
 + NAS-IP-Address = 192.168.110.11
 + NAS-Port = 0
 + Cleartext-Password = "password"
 + MS-CHAP-Challenge = 0x776d71a43a29e5e0
 + MS-CHAP-Response = 0x00010000000000000000000000000000000000000000000000006469e4d8f3d977bba821d6c987ab8dc82dd22b42e70009ec
 +Received Access-Accept Id 133 from 127.0.0.1:1812 to 127.0.0.1:36775 length 102
 + Message-Authenticator = 0xc1115e503566db3209038dbe5f119649
 + MS-CHAP-MPPE-Keys = 0x0000000000000000166a9e32f11580c1c0b62f9cd0bda633
 + MS-MPPE-Encryption-Policy = Encryption-Allowed
 + MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed
 +
 +# radtest -t eap-md5 testing password 127.0.0.1 0 testing123
 +Loading input data...
 +Read 1 element(s) from input: stdin
 +Loaded: 1 input element(s).
 +Adding new socket: src: 0.0.0.0:0, dst: 127.0.0.1:1812
 +Added new socket: 5 (num sockets: 1)
 +Sent Access-Request Id 6 from 0.0.0.0:57235 to 127.0.0.1:1812 length 73
 + User-Name = "testing"
 + Cleartext-Password = "password"
 + NAS-IP-Address = 192.168.110.11
 + NAS-Port = 0
 + EAP-Code = Response
 + EAP-Type-Identity = 0x74657374696e67
 + EAP-Message = 0x02f4000c0174657374696e67
 + Message-Authenticator = 0x00000000000000000000000000000000
 +Received Access-Challenge Id 6 from 127.0.0.1:1812 to 0.0.0.0:57235 length 80
 + Message-Authenticator = 0x413491aa17d3a3649ef3e4aa585cda21
 + EAP-Message = 0x01f500160410412e576008f0de2a5122f16c9d908981
 + State = 0x1d2d846a1dd8802f3111415ec636f0a3
 + EAP-Id = 245
 + EAP-Code = Request
 + EAP-Type-MD5-Challenge = 0x10412e576008f0de2a5122f16c9d908981
 +Sent Access-Request Id 38 from 0.0.0.0:57235 to 127.0.0.1:1812 length 101
 + User-Name = "testing"
 + Cleartext-Password = "password"
 + NAS-IP-Address = 192.168.110.11
 + NAS-Port = 0
 + EAP-Code = Response
 + Message-Authenticator = 0x00000000000000000000000000000000
 + EAP-Type-MD5-Challenge = 0x1070cf2ce2eb2e0cf2b1283d43583ae23b
 + EAP-Id = 245
 + State = 0x1d2d846a1dd8802f3111415ec636f0a3
 + EAP-Message = 0x02f50016041070cf2ce2eb2e0cf2b1283d43583ae23b
 +Received Access-Accept Id 38 from 127.0.0.1:1812 to 0.0.0.0:57235 length 53
 + Message-Authenticator = 0x8d94e8b9207f6f19bc078121280292f6
 + EAP-Message = 0x03f50004
 + User-Name = "testing"
 + EAP-Id = 245
 + EAP-Code = Success
 +</code>
 +
 +==== LDAP hitelesítés ====
 +
 +Szükséges csomagok telepítése
 +
 +<code>
 +# dnf install freeradius freeradius-utils freeradius-ldap
 +</code>
 +
 +Létre kell hozni az ldap szimbolikus linket
 +
 +<code>
 +# ln -s ../mods-available/ldap /etc/raddb/mods-enabled/ldap
 +</code>
 +
 +Menteni kell a /etc/raddb/mods-available/ldap állományt majd módosítani a tartalmát
 +
 +<code>
 +# [ ! -e /etc/raddb/mods-available/ldap.orig ] && cp -a /etc/raddb/mods-available/ldap /etc/raddb/mods-available/ldap.orig
 +
 +cat > /etc/raddb/mods-available/ldap <<'EOF'
 +ldap {
 + server = 'ldaps://dc1.adomain.lan'
 + identity = 'cn=radiusbind,cn=users,dc=adomain,dc=lan'
 + password = 12345678
 + base_dn = 'dc=adomain,dc=lan'
 +
 + update {
 + control:Password-With-Header += 'userPassword'
 + control: += 'radiusControlAttribute'
 + request: += 'radiusRequestAttribute'
 + reply: += 'radiusReplyAttribute'
 + }
 +
 + user {
 + base_dn = "${..base_dn}"
 + filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})"
 + }
 +
 + group {
 + base_dn = "${..base_dn}"
 + filter = '(objectClass=posixGroup)'
 + membership_attribute = 'memberOf'
 + }
 +
 + client {
 + base_dn = "${..base_dn}"
 + filter = '(objectClass=radiusClient)'
 + attribute {
 + ipaddr = 'radiusClientIdentifier'
 + secret = 'radiusClientSecret'
 + }
 + }
 +
 + accounting {
 + reference = "%{tolower:type.%{Acct-Status-Type}}"
 +
 + type {
 + start {
 + update {
 + description := "Online at %S"
 + }
 + }
 +
 + interim-update {
 + update {
 + description := "Last seen at %S"
 + }
 + }
 +
 + stop {
 + update {
 + description := "Offline at %S"
 + }
 + }
 + }
 + }
 +
 + post-auth {
 + update {
 + description := "Authenticated at %S"
 + }
 + }
 +
 + options {
 + chase_referrals = yes
 + rebind = yes
 + res_timeout = 10
 + srv_timelimit = 3
 + net_timeout = 1
 + idle = 60
 + probes = 3
 + interval = 3
 + ldap_debug = 0x0028
 + }
 +
 + tls {
 + start_tls = no
 + require_cert = 'allow'
 + }
 +
 + pool {
 + start = ${thread[pool].start_servers}
 + min = ${thread[pool].min_spare_servers}
 + max = ${thread[pool].max_servers}
 + spare = ${thread[pool].max_spare_servers}
 + uses = 0
 + retry_delay = 30
 + lifetime = 0
 + idle_timeout = 60
 + }
 +}
 +EOF
 +</core>
 +
 +Menteni kell a /etc/raddb/sites-available/default állományt majd módosítani a tartalmát
 +
 +<code>
 +# [ ! -e /etc/raddb/sites-available/default.orig ] && cp -a /etc/raddb/sites-available/default /etc/raddb/sites-available/default.orig
 +
 +cat > /etc/raddb/sites-available/default <<'EOF'
 +server default {
 + listen {
 + type = auth
 + ipaddr = *
 + port = 0
 + limit {
 + max_connections = 16
 + lifetime = 0
 + idle_timeout = 30
 + }
 + }
 +
 + listen {
 + ipaddr = *
 + port = 0
 + type = acct
 + limit {
 + }
 + }
 +
 + listen {
 + type = auth
 + ipv6addr = :: # any.  ::1 == localhost
 + port = 0
 + limit {
 + max_connections = 16
 + lifetime = 0
 + idle_timeout = 30
 + }
 + }
 +
 + listen {
 + ipv6addr = ::
 + port = 0
 + type = acct
 + limit {
 + }
 + }
 +
 + authorize {
 + filter_username
 + preprocess
 + chap
 + mschap
 + digest
 + suffix
 +
 + eap {
 + ok = return
 + }
 +
 + files
 + -sql
 +
 + ldap
 +
 + if ((ok || updated) && User-Password && !control:Auth-Type) {
 + update {
 + control:Auth-Type := ldap
 + }
 + }
 +
 + expiration
 + logintime
 + pap
 + }
 +
 + authenticate {
 + Auth-Type PAP {
 + pap
 + }
 +
 + Auth-Type CHAP {
 + chap
 + }
 +
 + Auth-Type MS-CHAP {
 + mschap
 + }
 +
 + mschap
 +
 + digest
 +
 + Auth-Type LDAP {
 + ldap
 + }
 +
 + eap
 + }
 +
 + preacct {
 + preprocess
 + acct_unique
 + suffix
 + files
 + }
 +
 + accounting {
 + detail
 + unix
 + -sql
 + exec
 + attr_filter.accounting_response
 + }
 +
 + session {
 + }
 +
 +post-auth {
 + if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) {
 + update reply {
 + &User-Name !* ANY
 + }
 + }
 +
 + update {
 + &reply: += &session-state:
 + }
 +
 + -sql
 + exec
 + remove_reply_message_if_eap
 +
 + Post-Auth-Type REJECT {
 + -sql
 + attr_filter.access_reject
 + eap
 + remove_reply_message_if_eap
 + }
 +
 + Post-Auth-Type Challenge {
 + }
 + }
 +
 + pre-proxy {
 + }
 +
 + post-proxy {
 + eap
 + }
 +}
 +EOF
 +</code>
 +
 +Menteni kell a /etc/raddb/sites-available/inner-tunnel állományt majd módosítani a tartalmát
 +
 +<code>
 +# [ ! -e /etc/raddb/sites-available/inner-tunnel.orig ] && cp -a /etc/raddb/sites-available/inner-tunnel /etc/raddb/sites-available/inner-tunnel.orig
 +
 +cat > /etc/raddb/sites-available/inner-tunnel <<'EOF'
 +server inner-tunnel {
 + listen {
 + ipaddr = 127.0.0.1
 + port = 18120
 + type = auth
 + }
 +
 + authorize {
 + filter_username
 + chap
 + mschap
 + suffix
 + update control {
 + &Proxy-To-Realm := LOCAL
 + }
 + eap {
 + ok = return
 + }
 +
 + files
 +
 + -sql
 +
 + ldap
 +
 + if ((ok || updated) && User-Password && !control:Auth-Type) {
 + update {
 + control:Auth-Type := ldap
 + }
 + }
 +
 + expiration
 + logintime
 +
 + pap
 + }
 +
 +
 + authenticate {
 + Auth-Type PAP {
 + pap
 + }
 +
 + Auth-Type CHAP {
 + chap
 + }
 +
 + Auth-Type MS-CHAP {
 + mschap
 + }
 +
 + mschap
 +
 + Auth-Type LDAP {
 + ldap
 + }
 +
 + eap
 + }
 +
 + session {
 + radutmp
 + }
 +
 + post-auth {
 + -sql
 + if (0) {
 + update reply {
 + User-Name !* ANY
 + Message-Authenticator !* ANY
 + EAP-Message !* ANY
 + Proxy-State !* ANY
 + MS-MPPE-Encryption-Types !* ANY
 + MS-MPPE-Encryption-Policy !* ANY
 + MS-MPPE-Send-Key !* ANY
 + MS-MPPE-Recv-Key !* ANY
 + }
 +
 + update {
 + &outer.session-state: += &reply:
 + }
 + }
 +
 + Post-Auth-Type REJECT {
 + -sql
 + attr_filter.access_reject
 + update outer.session-state {
 + &Module-Failure-Message := &request:Module-Failure-Message
 + }
 + }
 + }
 +
 + pre-proxy {
 + }
 +
 + post-proxy {
 + eap
 + }
 +}
 +EOF
 +</code>
 +
 +Újra kell indítani a radiusd szolgáltatást
 +
 +<code>
 +# systemctl restart radiusd
 +</code>
 +
 +Létre kell hozni a DC-n a radiusbind felhasználót akinek a jelszava nem jár le
 +
 +<code>
 +# samba-tool user create radiusbind 12345678
 +
 +# samba-tool user setexpiry radiusbind --noexpiry
 +</code>
 +
 +Tesztelhető a szolgáltatás
 +
 +<code>
 +# radtest teszt.elek 12345678 127.0.0.1 0 testing123
 +Sent Access-Request Id 158 from 0.0.0.0:39864 to 127.0.0.1:1812 length 80
 + User-Name = "teszt.elek"
 + User-Password = "12345678"
 + NAS-IP-Address = 192.168.110.11
 + NAS-Port = 0
 + Cleartext-Password = "12345678"
 +Received Access-Accept Id 158 from 127.0.0.1:1812 to 127.0.0.1:39864 length 38
 + Message-Authenticator = 0xf111666b349fe1dcc5ea191026805f2d
 +</code>
 +
 +==== Kerberos hitelesítés ====
 +
 +Szükséges csomagok telepítése
 +
 +<code>
 +# dnf install freeradius freeradius-utils freeradius-krb5 krb5-workstation
 +</code>
 +
 +Hozzunk létre egy felhasználót a DC.n
 +
 +<code>
 +# samba-tool user add radius-svc --random-password
 +User 'radius-svc' added successfully
 +</code>
 +
 +Hozzunk létre SPN-t a radius szervernek
 +
 +<code>
 +# samba-tool spn add radius/dc1.adomain.lan radius-svc
 +</code>
 +
 +Ellenőrizzük az SPN-t
 +
 +<code>
 +# ldbsearch -H ldap://localhost -U administrator '(servicePrincipalName=radius/dc1.adomain.lan)' sAMAccountName servicePrincipalName
 +Password for [ADOMAIN\administrator]:
 +# record 1
 +dn: CN=radius-svc,CN=Users,DC=adomain,DC=lan
 +sAMAccountName: radius-svc
 +servicePrincipalName: radius/dc1.adomain.lan
 +
 +# Referral
 +ref: ldap://adomain.lan/CN=Configuration,DC=adomain,DC=lan
 +
 +# Referral
 +ref: ldap://adomain.lan/DC=DomainDnsZones,DC=adomain,DC=lan
 +
 +# Referral
 +ref: ldap://adomain.lan/DC=ForestDnsZones,DC=adomain,DC=lan
 +
 +# returned 4 records
 +# 1 entries
 +# 3 referrals
 +</code>
 +
 +Ez a lépés nem kötelező . Beállíthatjuk a titkosítást a felhasználói fiók esetében.
 +
 +<code>
 +# cat > ~/encryption-mod.ldif <<'EOF'
 +dn: CN=radius-svc,CN=Users,DC=adomain,DC=lan
 +changetype: modify
 +replace: msDS-SupportedEncryptionTypes
 +msDS-SupportedEncryptionTypes: 24
 +EOF
 +
 +# ldbmodify -H ldap://localhost -U administrator ~/encryption-mod.ldif 
 +Password for [ADOMAIN\administrator]:
 +Modified 1 records successfully
 +</code>
 +
 +Exportáljuk a keytab-ot
 +
 +<code>
 +# samba-tool domain exportkeytab /root/radius.keytab --principal=radius/dc1.adomain.lan
 +Export one principal to /root/radius.keytab
 +</code>
 +
 +Ellenőrizzük a keytab tartalmát
 +
 +<code>
 +# klist -k -e /root/radius.keytab
 +Keytab name: FILE:/root/radius.keytab
 +KVNO Principal
 +---- --------------------------------------------------------------------------
 +   2 radius/dc1.adomain.lan@ADOMAIN.LAN (aes256-cts-hmac-sha1-96) 
 +   2 radius/dc1.adomain.lan@ADOMAIN.LAN (aes128-cts-hmac-sha1-96) 
 +</code>
 +
 +Másoljuk be a keytabot a megfelelő helyre és állítsuk be a jogosultságot
 +
 +<code>
 +# cp -a /root/radius.keytab /var/lib/radiusd/keytab
 +
 +# chown radiusd:radiusd /var/lib/radiusd/keytab
 +
 +# chmod 0600 /var/lib/radiusd/keytab
 +</code>
 +
 +Mentsük le az eredeti kerberos konfigurációt
 +
 +<code>
 +# [ ! -f /etc/raddb/mods-available/krb5.orig ] && cp -a /etc/raddb/mods-available/krb5 /etc/raddb/mods-available/krb5.orig
 +</code>
 +
 +Módosítsuk a konfigurációt
 +
 +<code>
 +# cat > /etc/raddb/mods-available/krb5 <<'EOF'
 +krb5 {
 + keytab = ${localstatedir}/lib/radiusd/keytab
 + service_principal = radius/dc1.adomain.lan
 + pool {
 + start = ${thread[pool].start_servers}
 + min = ${thread[pool].min_spare_servers}
 + max = ${thread[pool].max_servers}
 + spare = ${thread[pool].max_spare_servers}
 + uses = 0
 + lifetime = 0
 + idle_timeout = 0
 + }
 +}
 +EOF
 +</code>
 +
 +Engedélyezzük a konfigurációt
 +
 +<code>
 +# ln -s ../mods-available/krb5 /etc/raddb/mods-enabled/krb5
 +</code>
 +
 +Indítsuk újra a szolgáltatást
 +
 +<code>
 +# systemctl restart radiusd
 +</code>
 +
 +Teszteljük a kapcsolatot
 +
 +<code>
 +# radtest -t pap teszt.elek '12345678' localhost 0 testing123
 +Sent Access-Request Id 176 from 0.0.0.0:36009 to 127.0.0.1:1812 length 80
 + User-Name = "teszt.elek"
 + User-Password = "12345678"
 + NAS-IP-Address = 192.168.110.11
 + NAS-Port = 0
 + Cleartext-Password = "12345678"
 +Received Access-Accept Id 176 from 127.0.0.1:1812 to 127.0.0.1:36009 length 38
 + Message-Authenticator = 0x662c8de328ec1703342d74ece4225877
 +</code>
  
linux/freeradius.1757355879.txt.gz · Utolsó módosítás: szerkesztette: riba.zoltan