Configuring Linux Radius Server Objectives This chapter will

Configuring Linux Radius Server • Objectives – This chapter will show you how to install and use Radius • Contents – – – An Overview Of How Radius Works Configruation of Radius Testing Radius server Setting up Aironet Cisco 1200 for radius Client Setup Windows XP with wireless pccard • Practical – Implementing Radius server

Introducing the elements • NAS – Network Access Server (NAS) perform authentication, authorization, and accounting for users. – The network access server, is typically a router, switch, or wireless access point – NAS act as a relay that pass or block traffic to and from authenticated clients • RADIUS and AAA – The RADIUS server is usually a daemon process running on a UNIX or Windows 2003 server. – Authentication and authorization plus accounting are combined together in RADIUS • LDAP – The Lightweight Directory Access Protocol (LDAP) is an open standard – It defines a method for accessing and updating information in a X. 500 -like directory. – LDAP simplifies user administration tasks by managing users in a central directory.

Authentication via RADIUS and LDAP

Installing Free. RADIUS • Add a testuser # useradd kalle # passwd kalle – Add a password for your testuser • Building from source – Usally a good idea for best optimized code • Start radiusd in debug mode # tar -zxvf freeradius-1. 0. 2. tar. gz #. /configure # make install # radiusd -X – To see if any errors arrives • Modify /etc/shadow permission • Make the first radius auth test # chmod g+r /etc/shadow – Simulate a user trying to atenticate against the radius server # radtest kalle 123456 localhost 0 testing 123 0 = fake NAS port testing 123 is the mandatory common secret for localhost NAS clients is found in /etc/raddb/clients. conf • If radtest receives a response, the Free. RADIUS server is working.

Configure Free. RADIUS • Free. RADIUS configuration files are usually stored in the /etc/raddb folder • Modifying radiusd. conf to activate logging – Find and correct log_auth = yes log_auth_badpass = yes log_auth_goodpass = no • Setup to enable unix account to serve as autentication and add default authentication port’s. Cisco ports can also be used, then change this. port = 0 • Tell radius where you store the users to authenticate files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users compat = no }

Configure Free. RADIUS for NAS clients • Check that clients. conf is declared in radiusd. conf • Adding the NAS clients in /etc/raddb/clients. conf – Add your access points # Cisco Aironet 1235 AP client 192. 168. 1. 253 { secret = mypass shortname = ap nastype = other } • Security is sligthly higher if you point out each NAS with IP and have various password for them • Best match is used by radius server • Here is a subnet declaration for NAS client 192. 168. 1. 0/24 { secret = testing 123 shortname = office-network nastype = other }

Free. RADIUS MAC authentication setting. • The file /etc/raddb/users contains authentication and configuration information for each user. – Add change thenfollowing links, place after the informative heater text: # user-id (MAC) Authentication type password=MAC 00054 e 4 d 3 d 08 Auth-Type : = Local, User-Password == "00054 e 4 d 3 d 08" 00186 e 8 dc 079 Auth-Type : = Local, User-Password == "00186 e 8 dc 079" – We prepare for MAC authentication for users authenticate through the NAS – Authentication will be invisible for the enduser • For more users just add more MAC addresses • This can be used for almost any Cisco Switch or router. • Authentication is invisible, users does not need to enter something.

Configuring the Aironet 1200 (1/2) • For No security (open network), login to your AP and goto Express Security 1. Enter your SSID cisco 2. No VLAN (you can have VLAN for your different SSID if you like) 3. No security Click on APPLY • • • Activate your WLAN interfaces Menu Security, check None or a WEP/Chiper if you like. We choose none for best network prestanda Customer is adviced to use cisco VPN client for security or similar. Menu Security Server Manager – – • Select RADIUS in Current Server List, list should show <NEW> Enter your radius server IP address and Shared secret Standard radius Authentication port 1812 and Accounting port 1813 Click Apply Goto SSID manager and pick your SSID – Check Open Authentication and chose with MAC Authentication – At server priorities chose Customize and at priority 1 pick your radius server IP address. – Click APPLY

Configuring the Aironet 1200 (2/2) • Next you need to set the AP to use MAC authentication. – Again it is the Security panel, goto local RADIUS settings – Chose general set-up menu and check MAC at Enable Authentication Protocols – Click apply • Last you need to set the authentication order, here we use ONLY the radius server, no local lists. – Select MAC Addresses Authenticated by Authentication Server Only • If you click on security the server based security should look something like this now: • Looking on the SSID on same panel, it should look like this: