Freeradius, OpenLDAP, Freebsd documentation
Dusty Doris
dusty at doris dot cc
01-09-2003
This document describes how to setup Freeradius on a Freebsd machine
using LDAP as a backend. This is by no means complete and your
mileage may vary. If you are having any problems with the setup of
your freeradius installation, please read the documentation that comes
with Freeradius first as that is where all the information for this
project came from. If you find any bugs, typos, alternative ideas, or
just plain wrong information, please let me know by sending an email
to the address above.
The radius servers in this document are built on Freebsd 4.8, using
Freeradius .81 with OpenLDAP 2.0.27 as the backend. The servers are
designed to support customers for multiple services. In this document
we will use regular dialup and dialup ISDN as examples of two
different services using the same radius server for authentication.
OVERVIEW
The radius servers are to be provisioned by a some sort of system we
will call Billing. Billing could simply be a script, a web front-end,
or an actual integration into a billing system. Billing will provision
to the master LDAP server. The master LDAP server is running slurpd,
which will replicate all changes to the other radius servers. Each
radius server will run a local instance of LDAP.
The radius servers will be accepting Radius auth packets and Radius
acct packets. The accounting packets will be stored locally on each
radius server and then forwarded to the Accounting radius server,
using radrelay. The Accounting radius server will store all the
radius information in some sort of database such as MySQL, Postgres,
or Oracle. The configuration of the actual Accounting radius server
is outside the scope of this document. Please refer to the freeradius
documentation for setting up that server.
The Accounting radius server will help to provide a searchable
interface to the accounting data for billing and usage purposes and
could allow a web front-end to be built for helpdesk/customer service
usage. If that is not needed for your purposes, then disregard all
details about the Accounting radius server.
In order to make sure no data is lost in the event of the Accounting
radius server going down, the replication of data will take place
using radrelay. Radrelay will do the equivalent of a tail on the
detail file and will continually attempt to duplicate each radius
packet that is stored in the detail file and send it off to the
recipient(s) specified. Upon receipt of an accounting_response packet
radrelay will consider that packet completed and continue working on
the others. Each radius server will also be storing its own copy of
all accounting packets that are sent to it.
Each NAS will be setup with a primary radius server and a failover
radius server. We will spread the load among the group of radius
servers that we have so some are acting as a primary to some NAS's and
acting as a secondary to others. In the event of a radius failure,
the NAS should failover to the backup radius server. How to configure
this is dependent on the particular NAS being used.
Will use Radius acct data Billing will provision
for real-time billing out to the Master LDAP
server over LDAP
+------------+
| Accounting | +---------+
| Radius | | Billing |
+------------+ +----+----+
/|\ |
| |
| |
| |
| Provisioning
| Message
| |
Duplicate |
Acct |
| |
| \|/
| +------------+
| +------------------| LDAP Master|
| | +------------+
| | |
| Slurpd Slurpd Replication
| Replication |
| | |
| | \|/
| | +------------+
| | | Radius2 |
The Radius servers | | | LDAP Slave |
will create a local | \|/ +------------+
copy of all acct +-------------+
packets and then | Radius1 |
fwd a copy back | LDAP Slave | All Radius servers run a
to accounting +-------------+ local copy of LDAP for
/|\ /|\ Authorization and Authentication
| |
| |
| |
| |
Auth Acct
| |
| |
| |
| |
| |
\|/ \|/
+-----------+
| |
| |
| NAS |
| |
+-----------+
The NAS will be setup to
use one of the Radius servers
as primary and the others as failover
LDAP
The LDAP directory is designed to start with the top level of
dc=mydomain,dc=com. The next level of the tree contains the different
services that will be stored within the ldap server. For the radius
users, it will be specified as ou=radius. Below ou=radius, will be
the different types of accounts. For example, ou=users will store the
users and ou=profiles will store the default radius profiles. The
profiles are entries that will be used to store group-wide radius
profiles. The group ou=admins will be a place to enter the users for
Billing, Freeradius, and any other administrative accounts that are
needed.
+---------------------+
| |
| Dc=mydomain,dc=com |Objectclass:organizationalUnit
| |Objectclass:dcObject
+---------------------+
|
|
\|/
+---------------+
| |
| Ou=radius | Objectclass:organizationalUnit
| |
+---------------+
|
+-----------------------+-------------------------|
| | |
\|/ \|/ \|/
+---------+ +---------------+ +-------------+
| | | | | |
|Ou=users | | Ou=profiles | | Ou=admins |
| | | | | |
+---------+ +---------------+ +------|------+
| | |
| | |
\|/ | \|/
----- Objectclass: | ----- Objectclass:
// \\ radiusprofile | // \\ person
| | | | |
\\ // | \\ //
----- \|/ ----- Dn:cn=freeradius
Dn: uid=example,ou=users, ----- ObjectClass: ou=admins,ou=radius
dc=mydomain,dc=com // \\ radiusprofile dc=mydomain,dc=com
| |
| |
\\ //
-----
Dn: uid=dial,ou=profiles,ou=radius,dc=mydomain,dc=com
An example LDIF file is below.
NOTE: There are unique radius attribute types and objectclasses, these will be
explained in the configuration section.
dn: dc=mydomain,dc=com
objectClass: dcObject
objectClass: organizationUnit
ou: Mydomain.com Radius
dc: mydomain
dn: ou=radius,dc=mydomain,dc=com
objectclass: organizationalunit
ou: radius
dn: ou=profiles,ou=radius,dc=mydomain,dc=com
objectclass: organizationalunit
ou: profiles
dn: ou=users,ou=radius,dc=mydomain,dc=com
objectclass: organizationalunit
ou: users
dn: ou=admins,ou=radius,dc=mydomain,dc=com
objectclass: organizationalunit
ou: admins
dn: uid=dial,ou=profiles,ou=radius,dc=mydomain,dc=com
objectclass: radiusprofile
uid: dial
radiusServiceType: Framed-User
radiusFramedProtocol: PPP
radiusFramedIPNetmask: 255.255.255.0
radiusFramedRouting: None
dn: uid=isdn,ou=profiles,ou=radius,dc=mydomain,dc=com
objectclass: radiusprofile
uid: isdn
radiusServiceType: Framed-User
radiusFramedProtocol: PPP
radiusFramedIPNetmask: 255.255.255.0
radiusFramedRouting: None
dn: uid=example,ou=users,ou=radius,dc=mydomain,dc=com
objectclass: radiusProfile
uid: example
userPassword: test
radiusGroupName: dial
radiusGroupName: isdn
dn: cn=freeradius,ou=admins,ou=radius,dc=mydomain,dc=com
objectclass: person
sn: freeradius
cn: freeradius
userPassword: freeradius
dn: cn=billing,ou=admins,ou=radius,dc=mydomain,dc=com
objectclass: person
sn: freeradius
cn: freeradius
userPassword: billing
dn: cn=replica,ou=admins,ou=radius,dc=mydomain,dc=com
objectclass: person
sn: replica
cn: replica
userPassword: replica
In order to configure the ldap server to understand the radius schema that we
are using, the attribute types and objectclasses must be defined in slapd.conf.
The file is included with the following line in slapd.conf:
include /usr/local/etc/openldap/schema/RADIUS-LDAPv3.schema
Below is the complete Schema
----Begin RADIUS-LDAPv3.schema----
#################################################
##### custom radius attributes ##################
objectIdentifier myOID 1.1
objectIdentifier mySNMP myOID:1
objectIdentifier myLDAP myOID:2
objectIdentifier myRadiusFlag myLDAP:1
objectIdentifier myObjectClass myLDAP:2
attributetype
( myRadiusFlag:1
NAME 'radiusAscendRouteIP'
DESC 'Ascend VSA Route IP'
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
(myRadiusFlag:2
NAME 'radiusAscendIdleLimit'
DESC 'Ascend VSA Idle Limit'
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
(myRadiusFlag:3
NAME 'radiusAscendLinkCompression'
DESC 'Ascend VSA Link Compression'
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
(myRadiusFlag:4
NAME 'radiusAscendAssignIPPool'
DESC 'Ascend VSA AssignIPPool'
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
(myRadiusFlag:5
NAME 'radiusAscendMetric'
DESC 'Ascend VSA Metric'
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
#################################################
attributetype
( 1.3.6.1.4.1.3317.4.3.1.1
NAME 'radiusArapFeatures'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.2
NAME 'radiusArapSecurity'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.3
NAME 'radiusArapZoneAccess'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.44
NAME 'radiusAuthType'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.4
NAME 'radiusCallbackId'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.5
NAME 'radiusCallbackNumber'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.6
NAME 'radiusCalledStationId'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.7
NAME 'radiusCallingStationId'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.8
NAME 'radiusClass'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.45
NAME 'radiusClientIPAddress'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.9
NAME 'radiusFilterId'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.10
NAME 'radiusFramedAppleTalkLink'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.11
NAME 'radiusFramedAppleTalkNetwork'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.12
NAME 'radiusFramedAppleTalkZone'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.13
NAME 'radiusFramedCompression'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.14
NAME 'radiusFramedIPAddress'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.15
NAME 'radiusFramedIPNetmask'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.16
NAME 'radiusFramedIPXNetwork'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.17
NAME 'radiusFramedMTU'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.18
NAME 'radiusFramedProtocol'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.19
NAME 'radiusFramedRoute'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.20
NAME 'radiusFramedRouting'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.46
NAME 'radiusGroupName'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.47
NAME 'radiusHint'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.48
NAME 'radiusHuntgroupName'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.21
NAME 'radiusIdleTimeout'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.22
NAME 'radiusLoginIPHost'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.23
NAME 'radiusLoginLATGroup'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.24
NAME 'radiusLoginLATNode'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.25
NAME 'radiusLoginLATPort'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.26
NAME 'radiusLoginLATService'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.27
NAME 'radiusLoginService'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.28
NAME 'radiusLoginTCPPort'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.29
NAME 'radiusPasswordRetry'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.30
NAME 'radiusPortLimit'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.49
NAME 'radiusProfileDn'
DESC ''
EQUALITY distinguishedNameMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.31
NAME 'radiusPrompt'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.50
NAME 'radiusProxyToRealm'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.51
NAME 'radiusReplicateToRealm'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.52
NAME 'radiusRealm'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.32
NAME 'radiusServiceType'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.33
NAME 'radiusSessionTimeout'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.34
NAME 'radiusTerminationAction'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.35
NAME 'radiusTunnelAssignmentId'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.36
NAME 'radiusTunnelMediumType'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.37
NAME 'radiusTunnelPassword'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.38
NAME 'radiusTunnelPreference'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.39
NAME 'radiusTunnelPrivateGroupId'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.40
NAME 'radiusTunnelServerEndpoint'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.41
NAME 'radiusTunnelType'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.42
NAME 'radiusVSA'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.43
NAME 'radiusTunnelClientEndpoint'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
)
#need to change asn1.id
attributetype
( 1.3.6.1.4.1.3317.4.3.1.53
NAME 'radiusSimultaneousUse'
DESC ''
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.54
NAME 'radiusLoginTime'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.55
NAME 'radiusUserCategory'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.56
NAME 'radiusStripUserName'
DESC ''
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.57
NAME 'dialupAccess'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.58
NAME 'radiusExpiration'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.59
NAME 'radiusCheckItem'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
)
attributetype
( 1.3.6.1.4.1.3317.4.3.1.60
NAME 'radiusReplyItem'
DESC ''
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
)
objectclass
( 1.3.6.1.4.1.3317.4.3.2.1
NAME 'radiusprofile'
SUP top STRUCTURAL
DESC ''
MUST ( uid )
MAY ( userPassword $
radiusArapFeatures $ radiusArapSecurity $ radiusArapZoneAccess $
radiusAuthType $ radiusCallbackId $ radiusCallbackNumber $
radiusCalledStationId $ radiusCallingStationId $ radiusClass $
radiusClientIPAddress $ radiusFilterId $ radiusFramedAppleTalkLink $
radiusFramedAppleTalkNetwork $ radiusFramedAppleTalkZone $
radiusFramedCompression $ radiusFramedIPAddress $
radiusFramedIPNetmask $ radiusFramedIPXNetwork $
radiusFramedMTU $ radiusFramedProtocol $
radiusCheckItem $ radiusReplyItem $
radiusFramedRoute $ radiusFramedRouting $ radiusIdleTimeout $
radiusGroupName $ radiusHint $ radiusHuntgroupName $
radiusLoginIPHost $ radiusLoginLATGroup $ radiusLoginLATNode $
radiusLoginLATPort $ radiusLoginLATService $ radiusLoginService $
radiusLoginTCPPort $ radiusLoginTime $ radiusPasswordRetry $
radiusPortLimit $ radiusPrompt $ radiusProxyToRealm $
radiusRealm $ radiusReplicateToRealm $ radiusServiceType $
radiusSessionTimeout $ radiusStripUserName $
radiusTerminationAction $ radiusTunnelAssignmentId $
radiusTunnelClientEndpoint $ radiusIdleTimeout $
radiusLoginIPHost $ radiusLoginLATGroup $ radiusLoginLATNode $
radiusLoginLATPort $ radiusLoginLATService $ radiusLoginService $
radiusLoginTCPPort $ radiusPasswordRetry $ radiusPortLimit $
radiusPrompt $ radiusProfileDn $ radiusServiceType $
radiusSessionTimeout $ radiusSimultaneousUse $
radiusTerminationAction $ radiusTunnelAssignmentId $
radiusTunnelClientEndpoint $ radiusTunnelMediumType $
radiusTunnelPassword $ radiusTunnelPreference $
radiusTunnelPrivateGroupId $ radiusTunnelServerEndpoint $
radiusTunnelType $ radiusUserCategory $ radiusVSA $
radiusExpiration $ dialupAccess $
radiusAscendRouteIP $ radiusAscendIdleLimit $
radiusAscendLinkCompression $
radiusAscendAssignIPPool $ radiusAscendMetric )
)
----End RADIUS-LDAPv3.schema----
Now we need to setup the permissions on the ldap server. Notice above we
created three users in the admin ou. These users will be specific for billing,
freeradius, and replication.
On the master ldap server, we will set the following permissions.
access to attr=userPassword
by self write
by dn="cn=billing,ou=admins,ou=radius,dc=mydomain,dc=com" write
by anonymous auth
by * none
access to *
by self write
by dn="cn=billing,ou=admins,ou=radius,dc=mydomain,dc=com" write
by anonymous auth
by * none
This will give the billing user write access to add/delete users. For security
we will not give read access to any other users. You can easily add another
read-only user to this setup if you want to build some sort of web interface to
do only reads.
Now on the slave ldap servers (aka the radius servers) we will setup the
following permissions.
access to attr=userPassword
by self write
by dn="cn=replica,ou=admins,ou=radius,dc=mydomain,dc=com" write
by anonymous auth
by * none
access to dn="ou=users,ou=radius,dc=mydomain,dc=com"
by dn="cn=replica,ou=admins,ou=radius,dc=mydomain,dc=com" write
by dn="cn=freeradius,ou=admins,ou=radius,dc=mydomain,dc=com" read
by anonymous auth
by * none
access to *
by self write
by dn="cn=replica,ou=admins,ou=radius,dc=mydomain,dc=com" write
by anonymous auth
by * none
This will give the replica user write access. This user will be discussed
below and it is involved in the process of replicating the master server to the
slaves. The freeradius user only needs read access to do the lookups for
authorization.
Now we will want to setup indexes to speed up searches. At the minimum, below
will work. Since all radius lookups are currently using the uid, we will want
to index that. It is also a good idea to index the objectclass attribute.
# Indices to maintain
index objectClass eq
index uid eq
Now we need to setup the replication from the master to the slave servers. To
do this, we will add the following to the slapd.conf file on the master:
On the master LDAP server:
replica host=radius1.mydomain.com
binddn=cn=replica,ou=admins,ou=radius,dc=mydomain,dc=com
bindmethod=simple credentials=replica
replica host=radius2.mydomain.com
binddn=cn=replica,ou=admins,ou=radius,dc=mydomain,dc=com
bindmethod=simple credentials=replica
We will need to add a replica for each slave LDAP server. The binddn is the
name that is used to bind to the slave server, and the credentials is the
secret for that user.
On the slave LDAP servers:
updatedn cn=replica,ou=admins,ou=radius,dc=mydomain,dc=com
updateref ldap://ldapmaster.mydomain.com
Those will determine what name is allowed to update the LDAP server and if an
update is attempted directly, what server to refer the update to.
RADIUS
The radius server is setup to use LDAP for both Authorization and
Authentication. This section will describe what events will take place during
an AAA session with a NAS. When the NAS sends a access_request to the radius
server, the radius server will perform authorization and authentication based
on a series of modules that are defined in radiusd.conf. For example, the
module defined as ldap, will be used to make connections to the LDAP directory.
An example is listed below.
ldap {
server = localhost
identity = cn=freeradius,ou=admins,ou=radius,dc=mydomain,dc=com
password = example
#this is the basedn to do searches on a user
basedn = ou=users,ou=radius,dc=mydomain,dc=com
#notice the username is the stripped user-name or user-name
filter = (uid=%{Stripped-User-Name:-{User-Name}})
start_tls = no
tls_mode = no
#this maps ldap attributetypes to radius attributes
dictionary_mapping = ${raddbdir}/ldap.attrmap
ldap_cache_timeout = 120
ldap_cache_size = 0
ldap_connections_number = 10
#password_header = {clear}
#While integrating FreeRADIUS with Novell eDirectory, set
#'password_attribute = nspmpassword' in order to use the universal password
#of the eDirectory users for RADIUS authentication. This will work only if
#FreeRADIUS is configured to build with --with-edir option.
password_attribute = userPassword
#Comment out the following to disable the eDirectory account policy check and
#intruder detection. This will work only if FreeRADIUS is configured to build
#with --with-edir option.
#edir_account_policy_check=no
groupname_attribute = radiusGroupName
groupmembership_filter = (&(uid=%{Stripped-User-Name:-%{User-Name}})
(objectclass=radiusprofile))
groupmembership_attribute = radiusGroupName
timeout = 3
timelimit = 5
net_timeout = 1
compare_check_items = no
#access_attr_used_for_allow = yes
}
The first thing that is done is authorization of the user. The radius server
will process the modules in the order specified in the authorization section of
radiusd.conf. Currently, they are in the following order.
preprocess
suffix
files
ldap
The first module will be preprocess. This will first check the huntgroups of
the user coming in. The huntgroups are defined in the file huntgroups and they
are a group listing of the NAS-IP-Addresses that make the access_request. This
is useful in creating specific actions based on the NAS-IP that the request is
made from. An example, is below:
isdncombo NAS-IP-Address == 10.10.10.1
dialup NAS-IP-Address == 10.10.10.2
dialup NAS-IP-Address == 10.10.10.3
We will have one NAS that is used for both ISDN and regular dialup customers,
the other NAS's will be only used for dialup.
The preprocess module may also use the hints file, to load hints to the radius
server, and add additional hacks that are based on the type of request that
comes in. This is to help with certain NAS's that don't conform to radius
RFC's. Check the comments in radiusd.conf for an explanation on those.
The second module is suffix. This event will determine which realm the user is
in, based on the User-Name attribute. It is currently setup to split the
username at the occurence of the @symbol. For example, the username of
example@mydomain.com, will be split into example and mydomain.com. The realm
is then checked against the file proxy.conf, which will determine what actions
should be taken for that realm. Certain realms can be setup to be proxied to a
different radius server or set to authenticate locally. Also, the username can
be setup to be stripped from the realm or left intact. An example of
proxy.conf, is listed below. If the realm is to be proxied, then a secret is
needed, which is the secret of the radius server it is to be proxied to.
By default the User-Name will be stripped, unless the nostrip option is set.
Currently we will not be using realms with our users, but adding this ability
in the future will be much easier with already incorporating proxy.conf into the
setup.
proxy server {
synchronous = no
retry_delay = 5
retry_count = 3
dead_time = 120
servers_per_realm = 15
default_fallback = yes
}
realm NULL {
type = radius
authhost = LOCAL
accthost = LOCAL
#secret = testing123
}
realm DEFAULT {
type = radius
authhost = LOCAL
accthost = LOCAL
#secret = testing123
}
The next module is files, which is commonly know as the users file. The users
file will start with either a username to determine how to authorize a specific
user, or a DEFAULT setting. In each line it will define what items must be
present for there to be a match in the form of attribute == value. If all the
required attributes are matched, then attributes specified with attribute :=
value will be set for that user. If no match is found the users file will
continue to be processed until there is a match. The last DEFAULT setting will
be set as a catch-all, in case there is no previous match. If a match is made,
the statement of Fall-Through determines if the users file should continue to
be processed or if it should stop right there.
The Ldap-Group corresponds to the LDAP attribute of radiusGroupName (see ldap
configuration above). The user may be assigned multiple radiusGroupNames, one
for each of the services that the user is authorized for. If the user does
belong to the correct group, then the user will be authorized for that type of
access. If the user does not belong to that group, then there will not be a
match and the users file will continue to be processed. If a match is made and
there is a User-Profile set, then the radius server will lookup the attributes
that exist in that User-Profile in the LDAP directory. These are radius
attributes that will be sent to the NAS as a reply-item.
An example users file is below.
DEFAULT Ldap-Group == disabled, Auth-Type := Reject
Reply-Message = "Account disabled. Please call the helpdesk."
DEFAULT Huntgroup-Name == isdncombo, NAS-Port-Type == Async, Ldap-Group == dial,
User-Profile := "uid=dial,ou=profiles,ou=radius,dc=mydomain,dc=com"
Fall-Through = no
DEFAULT Huntgroup-Name == isdncombo, NAS-Port-Type == ISDN, Ldap-Group == isdn,
User-Profile := "uid=isdn,ou=profiles,ou=radius,dc=mydomain,dc=com"
Fall-Through = no
DEFAULT Huntgroup-Name == dial, Ldap-Group == dial, User-Profile := "uid=dial,ou
=profiles,ou=radius,dc=mydomain,dc=com"
Fall-Through = no
DEFAULT Auth-Type := Reject
Reply-Message = "Please call the helpdesk."
Notice that the catchall DEFAULT is set to Reject the user. This will stop the
authorization and immediately send back an access_reject message. Because
business rules are applied above to each scenario where the user will be
authorized for access, if no match is found, then we will want to stop the
process immediately to save resources.
By using the Ldap-Group feature we can limit user logins to only the services
they are subscribed to. Some examples of possible user setups are below.
#user with access to dial-up
dn: uid=user1,ou=users,ou=radius,dc=mydomain,dc=com
objectclass: radiusprofile
uid: user1
userPassword: whatever
radiusgroupname: dial
#user with access to ISDN and dial
dn: uid=user2,ou=users,ou=radius,dc=mydomain,dc=com
objectclass: radiusprofile
uid: user2
userPassword: whatever
radiusgroupname: dial
radiusgroupname: isdn
#same user as above that was suspended for not paying
dn: uid=user2,ou=users,ou=radius,dc=mydomain,dc=com
objectclass: radiusprofile
uid: user2
userPassword: whatever
radiusgroupname: dial
radiusgroupname: isdn
radiusgroupname: disabled
Now that we have authorized the user, the final piece is to authenticate the
user. Authentication is currently done by checking if the password sent in the
access_request packet is correct. This action will be done with an attempted
bind to the LDAP server using the User-Name and User-Password attributes
passed to it from the access_request. If the user is successfully authorized,
then an access_accept message will be sent back to the NAS, with any reply
items that were defined in the authorization section. If the user did not
supply the correct password, then an access_reject message will be sent to the
user.
If the NAS is sent an access_accept packet then the user will be given access
to the service and the NAS will then send an acct_request packet. This will be
a request packet to start a radius accounting session. The way the server will
log the accounting packets is determined in the detail module in the
radiusd.conf file. Since we will be storing a local copy and forwarding on all
accounting to the Accounting radius server, we will store two local copies on
the machine. The first one is done in a regular detail file as defined in the
following:
detail detail1 {
detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d
detailperm = 0600
dirperm = 0755
}
The second detail file will be used by the program radrelay to relay a copy of
all accounting packets to the Accounting radius server. This file is stored as
a catchall for all accounting packets. The radrelay program will basically do
a tail on that file and will then attempt to send a copy of each addition to it
to the Accounting server. If the copy is successfully sent, then it will be
deleted from this file. If the Accounting server were to go down, then this
file will continue to build up entries. As soon as the Accounting server is
back online, an attempt to re-send the packets to the Accounting server will
made. This file is defined in the following section of
radiusd.conf:
detail detail2 {
detailfile= ${radacctdir}/detail-combined
detailperm = 0600
dirperm = 0755
locking = yes
}
INSTALLATION
The new radius servers are currently built on Freebsd 4.8. As the version may
eventually change, these instructions may no longer apply. The steps for
building the server are the following:
Install FreeBSD
Install other FreeBSD items
Install OpenLDAP *NOTE: this must be done before installing Freeradius
Install FreeRadius
Under the assumption that FreeBSD is already installed and the kernel rebuilt
to the specifications needed for the machine, there are several other things
that may be needed at this time and the purpose of this is just as a reminder.
install cvsup-without-gui from the ports collection
-run cvsup on all to update the ports to the most recent versions
might be a good idea to upgrade the src
-edit and run cvsup on /usr/share/examples/cvsup/standard-supfile
-cd /usr/src - vi Makefile and follow instructions
install sendmail from ports to keep up to date with the most recent versions.
In the ports collection /ports/mail/sendmail run make; make install; make
mailer.conf. Then edit rc.conf and change to sendmail_enable=NO
-radius servers only need the local interface to send daily reports
edit rc.conf to make sure inetd_enable=NO
-no reason to have extra services running
if you rebuilt the kernel to add support for IPFIREWALL, then remember to add a
firewall rule to rc.conf
-firewall_enable=YES
-firewall_type=OPEN (or actually create a real firewall rule)
add crontab to keep date accurate for accounting
15 03 * * * /usr/sbin/ntpdate -s thetimeserver.mydomain.com
install openldap from ports
download the freeradius source as the ports collection is often outdated
-the default settings are /usr/local/etc/raddb, /var/log/radius.log,
/var/log/radacct
-since openldap was installed first, you should not need any special flags to
add ldap support
Now its time to configure openlap and freeradius. First we will be looking at
configuring OpenLDAP
-copy RADIUS-LDAPv3.schema to /usr/local/etc/openldap/schema
-edit /usr/local/etc/openldap/slapd.conf
----Begin slapd.conf----
# $OpenLDAP: pkg/ldap/servers/slapd/slapd.conf,v 1.23.2.7 2003/03/24 03:54:12
#kurt Exp $
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include /usr/local/etc/openldap/schema/core.schema
include /usr/local/etc/openldap/schema/RADIUS-LDAPv3.schema
# Define global ACLs to disable default read access.
# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral ldap://root.openldap.org
loglevel 296
pidfile /var/run/slapd.pid
argsfile /var/run/slapd.args
# Load dynamic backend modules:
# modulepath /usr/local/libexec/openldap
# moduleload back_bdb.la
# moduleload back_ldap.la
# moduleload back_ldbm.la
# moduleload back_passwd.la
# moduleload back_shell.la
password-hash {SSHA}
access to attr=userPassword
by self write
by dn="cn=replica,ou=admins,ou=radius,dc=mydomain,dc=com" write
by anonymous auth
by * none
access to dn="ou=users,ou=radius,dc=mydomain,dc=com"
by dn="cn=replica,ou=admins,ou=radius,dc=mydomain,dc=com" write
by dn="cn=freeradius,ou=admins,ou=radius,dc=mydomain,dc=com" read
by anonymous auth
by * none
access to *
by self write
by dn="cn=replica,ou=admins,ou=radius,dc=mydomain,dc=com" write
by anonymous auth
by * none
#######################################################################
# ldbm database definitions
#######################################################################
database bdb
suffix "dc=mydomain,dc=com"
rootdn "cn=root,dc=mydomain,dc=com"
# Cleartext passwords, especially for the rootdn, should
# be avoid. See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
rootpw {SSHA}Eu5EwPxTrwhEGrXQ9SaQZyfpu4iHt3NP
# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory /var/db/openldap-data
# Indices to maintain
index objectClass eq
index uid eq
mode 0600
cachesize 2000
# replica one for each
#replica host=radius1.mydomain.com
# binddn="cn=replica,ou=admins,ou=radius,dc=mydomain,dc=com"
# bindmethod=simple credentials=secret
replogfile /var/db/openldap-slurp/replog
## REMEMBER TO ADD THIS TO THE SLAVES
updatedn "cn=freeradius,ou=admins,ou=radius,dc=mydomain,dc=com"
updateref ldap://ldapmaster.mydomain.com
----End slapd.conf----
To create a rootdn that is not stored in plain text, enter the following
command.
$ slappasswd
it will ask for password and verification
New password:
Re-enter new password::
-while in the shell create the directory for the ldap database, this must be
created before slapd can start
$ mkdir /var/db/openldap-data
-move the slapd.sh.sample file to slapd.sh in /usr/local/etc/rc.d
$ mv /usr/local/etc/rc.d/slapd.sh.sample slapd.sh
-enable logging in /etc/syslog.conf by adding the following:
local4.* /var/log/ldap.log
restart syslogd
-start it up on both the master and slave ldap servers
$ /usr/local/etc/rc.d/slapd start
-create the structural ldif, schema.ldif
----Begin schema.ldif----
dn: dc=mydomain,dc=com
objectClass: dcObject
objectClass: organizationUnit
ou: Mydomain.com Radius
dc: mydomain
dn: ou=radius,dc=mydomain,dc=com
objectclass: organizationalunit
ou: radius
dn: ou=profiles,ou=radius,dc=mydomain,dc=com
objectclass: organizationalunit
ou: profiles
dn: ou=users,ou=radius,dc=mydomain,dc=com
objectclass: organizationalunit
ou: users
dn: ou=admins,ou=radius,dc=mydomain,dc=com
objectclass: organizationalunit
ou: admins
dn: uid=dial,ou=profiles,ou=radius,dc=mydomain,dc=com
objectclass: radiusprofile
uid: dial
radiusServiceType: Framed-User
radiusFramedProtocol: PPP
radiusFramedIPNetmask: 255.255.255.0
radiusFramedRouting: None
dn: uid=isdn,ou=profiles,ou=radius,dc=mydomain,dc=com
objectclass: radiusprofile
uid: isdn
radiusServiceType: Framed-User
radiusFramedProtocol: PPP
radiusFramedIPNetmask: 255.255.255.0
radiusFramedRouting: None
dn: uid=example,ou=users,ou=radius,dc=mydomain,dc=com
objectclass: radiusProfile
uid: example
userPassword: test
radiusGroupName: dial
radiusGroupName: isdn
dn: cn=freeradius,ou=admins,ou=radius,dc=mydomain,dc=com
objectclass: person
sn: freeradius
cn: freeradius
userPassword: freeradius
dn: cn=billing,ou=admins,ou=radius,dc=mydomain,dc=com
objectclass: person
sn: freeradius
cn: freeradius
userPassword: billing
dn: cn=replica,ou=admins,ou=radius,dc=mydomain,dc=com
objectclass: person
sn: replica
cn: replica
userPassword: replica
----End schema.ldif----
-add the organizational structure to the master ldap database
$ ldapadd -D uid=billing,ou=admins,ou=radius,dc=mydomain,dc=com -w billing -f
schema.ldif -h ldapmaster.mydomain.com
-run slapcat to see what the directory looks like
$ slapcat
If all went well the LDAP directory should be up and running and propagated to
the slaves. Now you can add your users to the master.
Now its time to setup FreeRadius. First cd into /usr/local/etc/raddb and take
a look at all the configuration files, they are heavily documented so you may
wish to read through them all before making and changes.
-edit radiusd.conf
----Begin radiusd.conf----
##
## radiusd.conf -- FreeRADIUS server configuration file.
##
prefix = /usr/local
exec_prefix = ${prefix}
sysconfdir = /usr/local/etc/raddb
localstatedir = ${prefix}/var
sbindir = ${exec_prefix}/sbin
logdir = /var/log
raddbdir = /usr/local/etc/raddb
radacctdir = /var/log/radacct
# Location of config and logfiles.
confdir = ${raddbdir}
run_dir = ${localstatedir}/run/radiusd
log_file = ${logdir}/radius.log
libdir = ${exec_prefix}/lib
pidfile = ${run_dir}/radiusd.pid
#user = nobody
#group = nobody
max_request_time = 30
delete_blocked_requests = no
cleanup_delay = 5
max_requests = 0
bind_address = *
port = 0
hostname_lookups = no
allow_core_dumps = no
regular_expressions = yes
extended_expressions = yes
log_stripped_names = no
log_auth = no
log_auth_badpass = no
log_auth_goodpass = no
# The program to execute to do concurrency checks.
#checkrad = ${sbindir}/checkrad
security {
max_attributes = 200
reject_delay = 0
status_server = no
}
proxy_requests = yes
$INCLUDE ${confdir}/proxy.conf
$INCLUDE ${confdir}/clients.conf
thread pool {
start_servers = 5
max_servers = 32
min_spare_servers = 3
max_spare_servers = 10
max_requests_per_server = 0
}
modules {
ldap {
server = "localhost"
identity = "uid=freeradius,ou=admins,ou=radius,dc=mydomain,dc=com"
password = example
basedn = "ou=users,ou=radius,dc=mydomain,dc=com"
filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})
(objectclass=radiusprofile)"
start_tls = no
tls_mode = no
#default_profile = "uid=dial,ou=profiles,ou=radius,dc=mydomain,dc=com"
#profile_attribute = "radiusProfileDn"
dictionary_mapping = ${raddbdir}/ldap.attrmap
ldap_cache_timeout = 120
ldap_cache_size = 0
ldap_connections_number = 10
#password_header = "{clear}"
password_attribute = userPassword
groupname_attribute = radiusGroupName
groupmembership_filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}}))
(objectclass=radiusProfile)"
groupmembership_attribute = radiusGroupName
timeout = 3
timelimit = 5
net_timeout = 1
compare_check_items = no
#access_attr_used_for_allow = yes
}
realm suffix {
format = suffix
delimiter = "@"
}
preprocess {
huntgroups = ${confdir}/huntgroups
#hints = ${confdir}/hints
with_ascend_hack = no
ascend_channels_per_line = 23
with_ntdomain_hack = no
with_specialix_jetstream_hack = no
with_cisco_vsa_hack = no
}
files {
usersfile = ${confdir}/users
#acctusersfile = ${confdir}/acct_users
compat = no
#use old style users
}
# regular detail files
detail detail1 {
detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d
detailperm = 0600
dirperm = 0755
}
# temp detail file to replicate to accountrad
detail detail2 {
detailfile= ${radacctdir}/detail-combined
detailperm = 0600
dirperm = 0755
locking = yes
}
acct_unique {
key = "User-Name, Acct-Session-Id, NAS-IP-Address,
Client-IP-Address, NAS-Port-Id"
}
#radutmp {
# filename = ${logdir}/radutmp
# perm = 0600
# callerid = "yes"
#}
#radutmp sradutmp {
# filename = ${logdir}/sradutmp
# perm = 0644
# callerid = "no"
#}
#attr_filter {
# attrsfile = ${confdir}/attrs
#}
# The "always" module is here for debugging purposes. Each
# instance simply returns the same result, always, without
# doing anything.
always fail {
rcode = fail
}
always reject {
rcode = reject
}
always ok {
rcode = ok
simulcount = 0
mpp = no
}
#
# The 'expression' module current has no configuration.
expr {
}
}
instantiate {
expr
}
authorize {
preprocess
suffix
files
ldap
}
authenticate {
authtype LDAP {
ldap
}
}
preacct {
preprocess
suffix
files
}
accounting {
acct_unique
detail1
detail2
#radutmp
#sradutmp
}
#session {
#radutmp
#}
#post-auth {
# Get an address from the IP Pool.
#main_pool
#}
----End radiusd.conf----
-edit huntgroups to specify a NAS to a huntgroup
----Begin huntgroups----
# dialup and isdn
isdncombo NAS-IP-Address == 10.10.10.1
# just dialup
dialup NAS-IP-Address == 10.10.10.2
dialup NAS-IP-Address == 10.10.10.3
----End huntgroups----
-edit proxy.conf to setup the different realms
----Begin proxy.conf----
proxy server {
synchronous = no
retry_delay = 5
retry_count = 3
dead_time = 120
servers_per_realm = 15
default_fallback = yes
}
realm NULL {
type = radius
authhost = LOCAL
accthost = LOCAL
#secret = testing123
}
realm DEFAULT {
type = radius
authhost = LOCAL
accthost = LOCAL
#secret = testing123
}
----End proxy.conf----
-edit clients.conf to setup the NAS's that can talk to it
----Begin clients.conf----
client 127.0.0.1 {
secret = example
shortname = localhost
nastype = other
}
# isdn and dialup nas
client 10.10.10.1 {
secret = example
shortname = isdn
nastype = cisco
}
#dialup only
client 10.10.10.2 {
secret = example
shortname = dialup1
nastype = cisco
}
client 10.10.10.3 {
secret = example
shortname = dialup2
nastype = cisco
}
----End clients.conf----
You may wish to look at the other files, but they should all be OK by default.
-create startup files in /usr/local/etc/rc.d
-radiusd.sh - the radiusd startup file
----Begin radiusd.sh----
#!/bin/sh
case "$1" in
start)
/usr/local/sbin/radiusd
echo -n ' radiusd'
;;
stop)
if [ -f /usr/local/var/run/radiusd/radiusd.pid ]; then
kill -TERM `cat /usr/local/var/run/radiusd/radiusd.pid`
rm -f /usr/local/var/run/radiusd/radiusd.pid
echo -n ' radiusd'
fi
;;
restart)
if [ -f /usr/local/var/run/radiusd/radiusd.pid ]; then
kill -HUP `cat /usr/local/var/run/radiusd/radiusd.pid`
echo 'radiusd restarted'
fi
;;
*)
echo "Usage: ${0##*/}: { start | stop | restart }" 2>&1
exit 65
;;
esac
----End radiusd.sh----
-radrelay.sh - the radrelay startup file
----Begin radrelay.sh----
#!/bin/sh
case "$1" in
start)
/usr/local/bin/radrelay -a /var/log/radacct -d /usr/local/etc/raddb \
-S /usr/local/etc/raddb/radrelay_secret -f -r accounting.mydomain.com:1813 \
detail-combined
echo -n ' radrelay started'
;;
stop)
/usr/bin/killall radrelay
echo ' radrelay stopped'
;;
*)
echo "Usage: $[0##*/}: { start | stop }" 2>&1
exit 65
;;
esac
----End radrelay.sh----
-create radrelay_secret in /usr/local/etc/radddb
This file will contain the secret to connect to the Accounting radius server
----Begin radrelay_secret----
example
----End radrelay_secret----
Now fire them up
$ /usr/local/etc/rc.d/radiusd.sh start
$ /usr/local/etc/rc.d/radrelay.sh start
You should be all set to start testing now.
OTHER RANDOM NOTES AND THOUGHTS
The client programs used to connect to the ldap directory are:
-ldapadd to add a record
-ldapmodify to modify a record
-ldapdelete to delete a record
-ldapsearch to search for a record
-slapcat to show the entire directory
-slappaswd to generate a crypted password
Read the man pages on those commands, they tell you everything you
need to know.
They all follow this basic syntax.
$ ldapwhatever -D "uid=someone,ou=admins,ou=radius,dc=mydomain,dc=com" -w
thesecret -andthenotherstuff
Finally, if you are having trouble with LDAP, run it in debug mode by
changing the following in slapd.sh:
slapd_args=
to
slapd_args= '-d 3'
There is a program included with freeradius to test the radius server,
its called radclient. Typing it alone will tell you all the options.
You will need to create a file that contains radius attributes, such
as:
User-Name = example
User-Password = test
Service-Type = Framed-User
NAS-IP-Address = 10.10.10.1
NAS-Port-Type = Async
Then you fire that radius packet at the server by issuing:
$ radclient -f testradiusfile localhost auth thesecret
-f = filename
localhost is the server you are hitting
auth or acct depending on the type of packet
thesecret to connect to that server
Finally, if you are having trouble you can run radius in debug mode
and it will output everything that happens to the screen. To do that,
kill the current process and run:
$ radiusd -X
LINKS
FREERADIUS:
Main Site:
-http://www.freeradius.org
Documentation:
-http://www.freeradius.org/radiusd/doc
OPENLDAP:
Main Site
-http://www.openldap.org
Documentation: Administrator's Guide
-http://www.openldap.org/doc/admin21
RFCs:
RFC2865: RADIUS Authentication
-http://www.freeradius.org/radiusd/doc/rfc/rfc2865.txt
RFC2866: RADIUS Accounting
-http://www.freeradius.org/radiusd/doc/rfc/rfc2866.txt
RFC2869: RADIUS Extentions
-http://www.freeradius.org/radiusd/doc/rfc/rfc2869.txt
RFC2251: LDAP v3
-http://www.ietf.org/rfc/rfc2251.txt
RFC2252: LDAP v3 Attribute Syntax Definitions
-http://www.ietf.org/rfc/rfc2252.txt
RFC2253: LDAP UTF-8 String Representation of Distinguishe d Names (DNs)
-http://www.ietf.org/rfc/rfc2252.txt
RFC2849: LDAP Data Interchange Fromat (LDIFs)
-http://www.ietf.org/rfc/rfc2849.txt
RFC3377: LDAP v3 Technical Specs
-http://www.ietf.org/rfc/rfc3377.txt