Peering two (2) Asterisk servers

In this example, I show you how to peer two Asterisk servers through IAX protocol. Each side have different extension numbers so it is very easy to find out what is the correct dial plan in extensions.conf file.

FreeRadius-2.1.9 + DIRECTORIO ACTIVO (AD) + EAP-TLS

El siguiente tutorial describe la instalación de FreeRadius-2.1.9 en Debian Lenny con integración al Directorio Activo (AD) en Windows 2003 Server.
El objetivo final es autenticar a los usuarios que deseen conectarse a la red inalámbrica 802.11x contra el AD de manera transparente haciendo uso de EAP-TLS. Si no posees AD instalado en la red de datos, entonces la autenticación también podrá ser posible haciendo uso de certificados instalados en los clientes.
Tendremos entonces dos (2) escenarios posibles para hacer funcionar la autenticación de los usuarios a través de FreeRadius: en el primero tenemos un Directorio Activo (AD) ya existente y deseamos autenticar a los usuarios haciendo uso de sus cuentas de red y un certificado pre-instalado en el sistema operativo; en el segundo no tenemos AD, así que autenticaremos a los usuarios haciendo solo uso de los certificados (si este es el caso, ir a INSTALACION DE FREERADIUS CON SOPORTE DE OPENSSL EN DEBIAN LENNY).
En cuanto al sistema operativo donde se instalará FreeRadius, se parte de una instalación limpia de Debian Lenny.

INGRESO DE MAQUINA DEBIAN LENNY AL DOMINIO MIDOMINIO.COM

Lo primero será ingresar la maquina con Debian Lenny en el dominio y luego proceder con la instalación de FreeRadius.
El tutorial sigue las siguientes definiciones:
1.- Nombre del dominio del AD: MIDOMINIO.COM (sustituir con el propio)
2.- Dirección IP del AD (que también funciona como DNS): 10.0.0.5
3.- Nombre del servidor AD: dominiosrv
4.- Servidor proxy para salir a Internet: 10.0.0.10
5.- Nombre de la maquina Debian Lenny: wireless
Aclarado lo anterior, se ejecutan los siguientes comandos (como root) para configurar el servidor proxy en caso que hagamos uso de uno para salir a Internet (de lo contrario omitir este paso).
Configurar el Proxy en la consola mediante:

export ftp_proxy="http://10.0.0.10:80" ; Dirección IP del proxy

export http_proxy="http://10.0.0.10:80"    ; Dirección IP del proxy

Actualizar la lista de repositorios listados en el archivo sourcelist.conf
ubicado en /etc/apt/ usando el comando:

nano /etc/apt/sources.list

luego copiar y pegar como sigue
/etc/apt/sources.list

deb http://security.debian.org/ lenny/updates main contrib non-free

deb-src http://security.debian.org/ lenny/updates main

deb http://volatile.debian.org/debian-volatile lenny/volatile main contrib non-free

deb-src http://volatile.debian.org/debian-volatile lenny/volatile main

#UNESR

deb http://debian.unesr.edu.ve/debian stable main

deb-src http://debian.unesr.edu.ve/debian stable main

Hacer

apt-get update

apt-get upgrade

Después ejecutar

apt-get install samba smbclient winbind krb5-doc krb5-user krb5-config libkrb53 libldap-2.4-2 libldap2-dev libkrb5-dev

Escribir MIDOMINIO.COM cuando la instalación de samba solicite el nombre del dominio. En la siguiente pantalla hacer clic en Sí para modificar el archivo smb.conf para usar la configuración WINS que proviene del DHCP.

Editar /etc/resolv.conf (en algunos casos también resolve.conf) como sigue:
/etc/resolv.conf

domain midominio.com

search midominio.com

nameserver 10.0.0.5

Configurar la hora del servidor:

apt-get install ntpdate

ntpdate 10.0.0.5

touch /etc/init.d/ntpdate

nano /etc/init.d/ntpdate

/etc/init.d/ntpdate

#! /bin/sh

ntpdate 10.0.0.5

Luego

hwclock—systohc

Esto con el fin de sincronizar el reloj del hardware con el del sistema.
Editar /etc/hosts como sigue
/etc/hosts

127.0.0.1    localhost

127.0.0.1    wireless wireless.midominio.com

10.0.0.5     dominiosrv dominiosrv.midominio.com

Respaldar la configuración por defecto de Samba

cp /etc/samba/smb.conf /etc/samba/smb.conf-default

Editar /etc/samba/smb.conf como sigue (pueden eliminar todo el contenido del archivo y pegar el siguiente):

nano /etc/samba/smb.conf

/etc/samba/smb.conf

#

# Sample configuration file for the Samba suite for Debian GNU/Linux.

# This is the main Samba configuration file. You should read the

# smb.conf(5) manual page in order to understand the options listed

# here. Samba has a huge number of configurable options most of which

# are not shown in this example

# Some options that are often worth tuning have been included as

# commented-out examples in this file.

# - When such options are commented with ";", the proposed setting

# differs from the default Samba behaviour

# - When commented with "#", the proposed setting is the default

# behaviour of Samba but the option is considered important

# enough to be mentioned here

# NOTE: Whenever you modify this file you should run the command

# "testparm" to check that you have not made any basic syntactic

# errors.

# A well-established practice is to name the original file

# "smb.conf.master" and create the "real" config file with

# testparm -s smb.conf.master >smb.conf

# This minimizes the size of the really used smb.conf file

# which, according to the Samba Team, impacts performance

# However, use this with caution if your smb.conf file contains nested

# "include" statements. See Debian bug #483187 for a case

# where using a master file is not a good idea.

#======================= Global Settings =======================

[global]

## Browsing/Identification ###

# Change this to the workgroup/NT-domain name your Samba server will part of

workgroup = MIDOMINIO.COM

# server string is the equivalent of the NT Description field

server string = %h server

# Windows Internet Name Serving Support Section:

# WINS Support - Tells the NMBD component of Samba to enable its WINS Server

# wins support = no

# WINS Server - Tells the NMBD components of Samba to be a WINS Client

# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both

; wins server = w.x.y.z

# If we receive WINS server info from DHCP, override the options above.

include = /etc/samba/dhcp.conf

# This will prevent nmbd to search for NetBIOS names through DNS.

dns proxy = no

# What naming service and in what order should we use to resolve host names

# to IP addresses

; name resolve order = lmhosts host wins bcast

#### Networking ####

# The specific set of interfaces / networks to bind to

# This can be either the interface name or an IP address/netmask;

# interface names are normally preferred

; interfaces = 127.0.0.0/8 eth0

# Only bind to the named interfaces and/or networks; you must use the

# 'interfaces' option above to use this.

# It is recommended that you enable this feature if your Samba machine is

# not protected by a firewall or is a firewall itself. However, this

# option cannot handle dynamic or non-broadcast interfaces correctly.

; bind interfaces only = yes

#### Debugging/Accounting ####

# This tells Samba to use a separate log file for each machine

# that connects

log file = /var/log/samba/log.%m

# Cap the size of the individual log files (in KiB).

max log size = 1000

# If you want Samba to only log through syslog then set the following

# parameter to 'yes'.

# syslog only = no

# We want Samba to log a minimum amount of information to syslog. Everything

# should go to /var/log/samba/log.{smbd,nmbd} instead. If you want to log

# through syslog you should set the following parameter to something higher.

syslog = 0

# Do something sensible when Samba crashes: mail the admin a backtrace

panic action = /usr/share/samba/panic-action %d

####### Authentication #######

# "security = user" is always a good idea. This will require a Unix account

# in this server for every user accessing the server. See

# /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/ServerType.html

# in the samba-doc package for details.

security = ADS

# You may wish to use password encryption. See the section on

# 'encrypt passwords' in the smb.conf(5) manpage before enabling.

encrypt passwords = true

# If you are using encrypted passwords, Samba will need to know what

# password database type you are using.

passdb backend = tdbsam

obey pam restrictions = yes

# This boolean parameter controls whether Samba attempts to sync the Unix

# password with the SMB password when the encrypted SMB password in the

# passdb is changed.

unix password sync = yes

# For Unix password sync to work on a Debian GNU/Linux system, the following

# parameters must be set (thanks to Ian Kahan <<kahan@informatik.tu-muenchen.de> for

# sending the correct chat script for the passwd program in Debian Sarge).

passwd program = /usr/bin/passwd %u

passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n password\supdated\ssuccessfully .

# This boolean controls whether PAM will be used for password changes

# when requested by an SMB client instead of the program listed in

# 'passwd program'. The default is 'no'.

pam password change = yes

########## Domains ###########

# Is this machine able to authenticate users. Both PDC and BDC

# must have this setting enabled. If you are the BDC you must

# change the 'domain master' setting to no

#

; domain logons = yes

#

# The following setting only takes effect if 'domain logons' is set

# It specifies the location of the user's profile directory

# from the client point of view)

# The following required a [profiles] share to be setup on the

# samba server (see below)

; logon path = \\%N\profiles\%U

# Another common choice is storing the profile in the user's home directory

# (this is Samba's default)

# logon path = \\%N\%U\profile

# The following setting only takes effect if 'domain logons' is set

# It specifies the location of a user's home directory (from the client

# point of view)

; logon drive = H:

# logon home = \\%N\%U

# The following setting only takes effect if 'domain logons' is set

# It specifies the script to run during logon. The script must be stored

# in the [netlogon] share

# NOTE: Must be store in 'DOS' file format convention

; logon script = logon.cmd

# This allows Unix users to be created on the domain controller via the SAMR

# RPC pipe. The example command creates a user account with a disabled Unix

# password; please adapt to your needs

; add user script = /usr/sbin/adduser—quiet—disabled-password—gecos "" %u

# This allows machine accounts to be created on the domain controller via the

# SAMR RPC pipe.

# The following assumes a "machines" group exists on the system

; add machine script = /usr/sbin/useradd -g machines -c "%u machine account" -d /var/lib/samba -s /bin/false %u

# This allows Unix groups to be created on the domain controller via the SAMR

# RPC pipe.

; add group script = /usr/sbin/addgroup—force-badname %g

########## Printing ##########

# If you want to automatically load your printer list rather

# than setting them up individually then you'll need this

# load printers = yes

# lpr(ng) printing. You may wish to override the location of the

# printcap file

; printing = bsd

; printcap name = /etc/printcap

# CUPS printing. See also the cupsaddsmb(8) manpage in the

# cupsys-client package.

; printing = cups

; printcap name = cups

############ Misc ############

# Using the following line enables you to customise your configuration

# on a per machine basis. The %m gets replaced with the netbios name

# of the machine that is connecting

; include = /home/samba/etc/smb.conf.%m

# Most people will find that this option gives better performance.

#Seesmb.conf(5)and /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/speed.html

# for details

# You may want to add the following on a Linux system:

# SO_RCVBUF=8192 SO_SNDBUF=8192

# socket options = TCP_NODELAY

# The following parameter is useful only if you have the linpopup package

# installed. The samba maintainer and the linpopup maintainer are

# working to ease installation and configuration of linpopup and samba.

; message command = /bin/sh -c '/usr/bin/linpopup "%f" "%m" %s; rm %s' &

# Domain Master specifies Samba to be the Domain Master Browser. If this

# machine will be configured as a BDC (a secondary logon server), you

# must set this to 'no'; otherwise, the default behavior is recommended.

# domain master = auto

# Some defaults for winbind (make sure you're not using the ranges

# for something else.)

idmap uid = 16777216-33554431

idmap gid = 16777216-33554431

template shell = /bin/bash

winbind use default domain = yes

password server = dominiosrv.MIDOMINIO.COM

realm = MIDOMINIO.COM

# The following was the default behaviour in sarge,

# but samba upstream reverted the default because it might induce

# performance issues in large organizations.

# See Debian bug #368251 for some of the consequences of not

# having this setting and smb.conf(5) for details.

; winbind enum groups = yes

; winbind enum users = yes

# Setup usershare options to enable non-root users to share folders

# with the net usershare command.

# Maximum number of usershare. 0 (default) means that usershare is disabled.

; usershare max shares = 100

#======================= Share Definitions =======================

[homes]

comment = Home Directories

browseable = no

# By default, the home directories are exported read-only. Change the

# next parameter to 'no' if you want to be able to write to them.

read only = no

writable = yes

# File creation mask is set to 0700 for security reasons. If you want to

# create files with group=rw permissions, set next parameter to 0775.

create mask = 0700

# Directory creation mask is set to 0700 for security reasons. If you want to

# create dirs. with group=rw permissions, set next parameter to 0775.

directory mask = 0700

# By default, file://server/username shares can be connected to by anyone

# with access to the samba server.

# The following parameter makes sure that only "username" can connect

# to file://server/username

# This might need tweaking when using external authentication schemes

valid users = %S

# Un-comment the following and create the netlogon directory for Domain Logons

# (you need to configure Samba to act as a domain controller too.)

;[netlogon]

; comment = Network Logon Service

; path = /home/samba/netlogon

; guest ok = yes

; read only = yes

; share modes = no

# Un-comment the following and create the profiles directory to store

# users profiles (see the "logon path" option above)

# (you need to configure Samba to act as a domain controller too.)

# The path below should be writable by all users so that their

# profile directory may be created the first time they log on

;[profiles]

; comment = Users profiles

; path = /home/samba/profiles

; guest ok = no

; browseable = no

; create mask = 0600

; directory mask = 0700

[printers]

comment = All Printers

browseable = no

path = /var/spool/samba

printable = yes

guest ok = no

read only = yes

create mask = 0700

# Windows clients look for this share name as a source of downloadable

# printer drivers

[print$]

comment = Printer Drivers

path = /var/lib/samba/printers

browseable = yes

read only = yes

guest ok = no

# Uncomment to allow remote administration of Windows print drivers.

# You may need to replace 'lpadmin' with the name of the group your

# admin users are members of.

# Please note that you also need to set appropriate Unix permissions

# to the drivers directory for these users to have write rights in it

; write list = root, @lpadmin

# A sample share for sharing your CD-ROM with others.

;[cdrom]

; comment = Samba server's CD-ROM

; read only = yes

; locking = no

; path = /cdrom

; guest ok = yes

# The next two parameters show how to auto-mount a CD-ROM when the

#    cdrom share is accesed. For this to work /etc/fstab must contain

#    an entry like this:

#

# /dev/scd0 /cdrom iso9660 defaults,noauto,ro,user 0 0

#

# The CD-ROM gets unmounted automatically after the connection to the

#

# If you don't want to use auto-mounting/unmounting make sure the CD

#    is mounted on /cdrom

#

; preexec = /bin/mount /cdrom

; postexec = /bin/umount /cdrom

Respaldar la configuración por defecto de Kerberos

cp /etc/krb5.conf /etc/krb5.conf-default

Editar (o crear archivo de texto si no existe) /etc/krb5.conf como sigue:

nano /etc/krb5.conf

/etc/krb5.conf

[logging]

default = FILE:/var/log/krb5libs.log

kdc = FILE:/var/log/krb5kdc.log

admin_server = FILE:/var/log/kadmind.log

[libdefaults]

default_realm = MIDOMINIO.COM

dns_lookup_realm = false

dns_lookup_kdc = false

[realms]

MIDOMINIO.COM = {

kdc = dominiosrv.MIDOMINIO.COM

admin_server = dominiosrv.MIDOMINIO.COM

default_domain = MIDOMINIO.COM

}

[domain_realm]

.MIDOMINIO.COM = MIDOMINIO.COM

MIDOMINIO.COM = MIDOMINIO.COM

[kdc]

profile = /etc/krb5kdc/kdc.conf

[appdefaults]

pam = {

debug = false

ticket_lifetime = 36000

renew_lifetime = 36000

forwardable = true

krb4_convert = false

}

Respaldar la configuración por defecto de nsswitch

cp /etc/nsswitch.conf /etc/nsswitch.conf-default

Editar /etc/nsswitch.conf como sigue:

nano /etc/nsswitch.conf

/etc/nsswitch.conf

# /etc/nsswitch.conf

#

# Example configuration of GNU Name Service Switch functionality.

# If you have the 'glibc-doc-reference' and 'info' packages installed, try:

# 'info libc "Name Service Switch"' for information about this file.

#passwd: compat

#group: compat

#shadow: compat

hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4

networks: files

#protocols: db files

#services: db files

ethers: db files

rpc: db files

netgroup: nis

passwd: files winbind

shadow: files winbind

group: files winbind

protocols: files winbind

services: files winbind

netgroup: files winbind

automount: files winbind

group_compat: winbind

passwd_compat: winbind

Luego

mkdir /etc/krb5kdc

cd krb5kdc

touch kdc.conf

Editar /etc/krb5kdc/kdc.conf como sigue

nano /etc/krb5kdc/kdc.conf

/etc/krb5kdc/kdc.conf

[kdcdefaults]

kdc_ports = 750,88

[realms]

MIDOMINIO.COM = {

database_name = /var/lib/krb5kdc/principal

admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab

acl_file = /etc/krb5kdc/kadm5.acl

key_stash_file = /etc/krb5kdc/stash

kdc_ports = 750,88

max_life = 10h 0m 0s

max_renewable_life = 7d 0h 0m 0s

master_key_type = des3-hmac-sha1

supported_enctypes = aes256-cts:normal arcfour-hmac:normal des3-hmac-sha1:normal des-cbc-crc:normal des:normal des:v4 des:norealm des:onlyrealm des:afs3

default_principal_flags = +preauth

}

Entonces

/etc/init.d/samba restart

/etc/init.d/winbind restart

Para probar la configuración de Kerberos hacemos (sustituir user con nombre de usuario valido en el dominio):

kinit user@MIDOMINIO.COM

Password for user@MIDOMINIO.COM:

Warning: Your password will expire in 5 days.

Luego de haber editados los archivos anteriores, reiniciamos la maquina y abrimos nuevamente una consola (como root). Para unirnos al dominio escribimos:

net ads join -W MIDOMINIO.COM -S dominiosrv -U user

dándonos como resultado

net ads join -W MIDOMINIO.COM -S dominiosrv -U user

Enter user's password:

Using short domain name—MIDOMINIO.COM

Joined 'WIRELESS' to realm 'MIDOMINIO.COM'

No DNS domain configured for wireless. Unable to perform DNS Update.

DNS update failed!

wireless:/home/user#

Alguna veces puede dar el siguiente error

Failed to join domain: failed to set machine spn: Out of memory

Sin embargo, omitir y proseguir con los siguientes pasos. Para verificar que estamos inscritos en el dominio hacemos:

wbinfo -m

BUILTIN

WIRELESS

MIDOMINIO.COM

ó

net ads info

LDAP server: 10.0.0.5

LDAP server name: dominiosrv.MIDOMINIO.COM

Realm: MIDOMINIO.COM

Bind Path: dc=MIDOMINIO,dc=COM

LDAP port: 389

Server time: mar, 09 mar 2010 10:26:22 VET

KDC server: 10.0.0.5

Server time offset: 17

wireless:/home/user#

Finalmente, se comprueba que un usuario individual se puede autenticar contra el directorio activo de MIDOMINIO. En este caso, el indicador usado es user; el comando es como sigue (sustituir la palabra en negrita por correspondiente):http://www.wains.be/index.php/2009/09/13/wpa2-freeradius-eap-tls/

ntlm_auth --request-nt-key—domain=MIDOMINIO.COM --username=user --password=mypassword

INSTALACION DE FREERADIUS CON SOPORTE DE OPENSSL EN DEBIAN LENNY

RADIUS (acrónimo en inglés de Remote Authentication Dial-In User Server), es un protocolo de autenticación y autorización para aplicaciones de acceso a la red o movilidad IP.
Lo anterior, sera posible mediante la instalacion y configuración de la aplicación de codigo abierto FreeRadius la cual servirá como medio de autenticación entre los dispositivos terminales (computadoras portatiles, telefonos inteligentes, etc.) y el directorio activo (en adelante, AD) basado en Active Directory - Windows 2003 Server. Una vez que el usuario se haya autenticado de manera exitosa contra AD, el servidor DHCP le asignara direccion IP valida dentro del dominio permitiendo finalmente la conexión del dispositivo a los servicios de red existentes; por ejemplo, correo electronico, telefonia IP, Internet, entre otros.
Prerrequisitos:
El sistema operativo anfitrión donde se instalará FreeRadius debe estar obligatoriamente inscrito dentro del dominio de la empresa (MIDOMINIO.COM) y para ello se debió haber seguido el tutorial descrito en la seccion anterior (INGRESAR MAQUINA LINUX AL DOMINIO MIDOMINIO.COM).
Verificado el paso anterior, procedemos a seguir los siguientes pasos los cuales fueron posibles gracias al tutorial descrito en:
El metodo de autenticación a usar con FreeRadius (EAP-TLS) hará uso del cifrado de los paquetes para la autentcacion entre el cliente y el servidor de AD. Por tanto es necesario el soporte de las librerias Open SSL, aplicación no soportada de manera nativa por FreeRadius cuando se instala en Debian (tema de licenciamiento), para lo cual se deben seguir los siguientes pasos:
Instalacion de los paquetes necesarios (como root):

apt-get install dpkg-dev fakeroot x-window-system-core gnome-core synaptic

Se descarga la fuente de FreeRadius en http://freeradius.org/download.html (nuestro caso, freeradius-server-2.1.9.tar.gz) y se ubica en la carpeta freeradius-tls (sustituir usuario en negrita por correspondiente):

cd /home/user

mkdir freeradius-tls

cd freeradius-tls

tar xzvf freeradius-server-2.1.9.tar.gz

Se edita el archivo rules según

nano /home/user/freeradius-tls/freeradius-server-2.1.9/debian/rules

cambiando la sección que empieza con ./configure $(confflags) \ según como aparece a continuación
/home/user/freeradius-tls/freeradius-server-2.1.9/debian/rules

…

./configure $(confflags) \

    prefix=/usr \

    exec-prefix=/usr \

    mandir=$(mandir) \

    sysconfdir=/etc \

    libdir=$(libdir) \

    datadir=/usr/share \

    localstatedir=/var \

    with-raddbdir=$(raddbdir) \

    with-logdir=/var/log/$(package) \

    enable-ltdl-install=no—enable-strict-dependencies \

    with-large-files—with-udpfromto—with-edir \

    enable-developer \

    config-cache \

    with-rlm_eap_tls \

    with-rlm_eap_ttls \

    with-rlm_eap_peap \

    without-rlm_eap_tnc \

    without-rlm_otp \

    with-rlm_sql_postgresql_lib_dir='pg_config—libdir'\

    with-rlm_sql_postgresql_include_dir='pg_config—includedir' \

    with-openssl \

    without-rlm_eap_ikev2 \

    without-rlm_sql_oracle \

    without-rlm_sql_unixodbc \

    with-rlm_sql_postgresql_lib_dir='pg_config—libdir' \

    with-rlm_sql_postgresql_include_dir='pg_config—includedir' \

    without-rlm_eap_ikev2 \

    without-rlm_sql_oracle \

    without-rlm_sql_unixodbc \

    with-system-libtool

…

Despues se edita el archivo control también ubicado en la carpeta Debian así que:

nano /home/user/freeradius-tls/freeradius-server-2.1.9/debian/control

y se agrega libssl-dev al final de la seccion Build-Depends quedando como sigue
/home/user/freeradius-tls/freeradius-server-2.1.9/debian/control

…

Source: freeradius

Build-Depends: debhelper (>= 6.0.7),

quilt,

dpkg-dev (>= 1.13.19),

autotools-dev,

libtool,

libltdl3-dev,

libpam0g-dev,

libmysqlclient-dev,

libgdbm-dev,

libldap2-dev,

libsasl2-dev,

libiodbc2-dev,

libkrb5-dev,

libperl-dev,

libpcap-dev,

python-dev,

libsnmp-dev,

libpq-dev,

libssl-dev

Section: net

Priority: optional

...

Luego hacemos:

cd /home/user/freeradius-tls

apt-get install libssl-dev debhelper libgdbm-dev libiodbc2-dev libkrb5-dev libldap2-dev libltdl3-dev libmysqlclient15-dev libpam0g-dev libpcap-dev libperl-dev libpq-dev libsasl2-dev libsnmp-dev python-dev

Finalmente:

dpkg-buildpackage -rfakeroot

Si todo va bien, se crearan aproximadamente quince (15) archivos.

Para evitar que nuevos paquetes de FreeRadius que no soportan EAP-TLS se instalen modificando los actuales, colocamos los paquetes instalados en estado hold. Entonces:

echo "freeradius hold" | dpkg—set-selections

echo "libfreeradius2 hold" | dpkg—set-selections

echo "freeradius-common hold" | dpkg—set-selections

El siguiente paso es instalar FreeRadius, asi que ejecutamos los siguientes comandos en el orden que aparecen

cd /home/user/freeradius-tls

dpkg -i freeradius-common_2.1.9+git_all.deb

dpkg -i libfreeradius2_2.1.9+git_i386.deb

dpkg -i freeradius_2.1.9+git_i386.deb

CREACION DE CERTIFICADOS

Se debe generar al menos un certificado para establecer la conexión cifrada entre el servidor FreeRadius y los clientes que haran uso de la red inalambrica en la autenticacion. No se considera un certificado por cliente sino uno común para todos. Para ello se deben seguir los siguientes pasos:
NOTA: Generar los ceritificados en una maquina con Debian Lenny distinta a donde fué o será instalado FreeRadius.
Instalar OpenSSL desde los repositorios. Para ello:

cd /home/user/

apt-get install openssl

OpenSSL se instalara automaticamente en /etc/ssl
Luego se editan los valores por defecto de los certificados haciendo (previo respaldar el archivo openssl.cnf):

cd /etc/ssl

cp /etc/ssl/openssl.cnf /etc/ssl/default-openssl.cnf

nano /etc/ssl/openssl.cnf

Por ejemplo se puede editar la siguiente información dejando todo lo demas por defecto (sustituir la información en negrita por la propia)

/etc/ssl/openssl.cnf

…

[ CA_default ]

dir = ./demoCA # Where everything is kept

[ req_distinguished_name ]

countryName = Country Name (2 letter code)

countryName_default = VE

countryName_min = 2

countryName_max = 2

stateOrProvinceName = State or Province Name (full name)

stateOrProvinceName_default = Miranda

localityName = Locality Name (eg, city)

localityName_default = Los Teques

0.organizationName = Organization Name (eg, company)

0.organizationName_default = MiOrg

# we can do this but it is not needed normally :-)

#1.organizationName = Second Organization Name (eg, company)

#1.organizationName_default = World Wide Web Pty Ltd

organizationalUnitName = Organizational Unit Name (eg, section)

organizationalUnitName_default = IT

commonName = wireless_int

commonName_max = 64

emailAddress = user@MIDOMINIO.COM

emailAddress_max = 64

[ req_attributes ]

challengePassword                = micontraseña

challengePassword_min             = 4

challengePassword_max             = 20

# SET-ex3     = SET extension number 3

[ req_attributes ]

challengePassword     = micontraseña

challengePassword_min     = 4

challengePassword_max     = 20

unstructuredName     = MiOrg

…

De igual forma se puede dejar la información del certificado tal como viene, solo tener en cuenta que el campo challengePassword sdebe ser editado por una contraseña conocida y el campo commonName será el nombre final del certificado al momento de la importación en las maquinas con Windows XP.
Desde /etc/ssl ejecutar como sigue para crear el CA.

/usr/lib/ssl/misc/CA.sh -newca

CA certificate filename (or enter to create)

Making CA certificate ...
Generating a 1024 bit RSA private key
...............................++++++
...++++++
writing new private key to './demoCA/private/./cakey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [VE]:
State or Province Name (full name) [Miranda]:
Locality Name (eg, city) [Los Teques]:
Organization Name (eg, company) [MiOrg]:
Organizational Unit Name (eg, section) [IT]:
wireless_int []:wireless_int
user@MIDOMINIO.COM []:user@MIDOMINIO.COM

Please enter the following 'extra' attributes
to be sent with your certificate request
alejandro []:
An optional company name []:

Using configuration from /usr/lib/ssl/openssl.cnf
Enter pass phrase for ./demoCA/private/./cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 0 (0x0)
Validity
Not Before: Jul 6 15:39:34 2010 GMT
Not After : Jul 5 15:39:34 2013 GMT
Subject:
countryName = VE
stateOrProvinceName = Miranda
organizationName = MiOrg
organizationalUnitName = IT
commonName = wireless_int
emailAddress = user@MIDOMINIO.COM
X509v3 extensions:
X509v3 Subject Key Identifier:
8C:BE:BB:50:F2:74:DE:31:6C:20:8E:08:4B:C6:CB:F4:B7:B2:63:94
X509v3 Authority Key Identifier:
keyid:8C:BE:BB:50:F2:74:DE:31:6C:20:8E:08:4B:C6:CB:F4:B7:B2:63:94
DirName:/C=VE/ST=Miranda/O=MiOrg/OU=IT/CN=wireless_int/emailAddress=user@MIDOMINIO.COM
serial:00

X509v3 Basic Constraints:
CA:TRUE
Certificate is to be certified until Jul 5 15:39:34 2013 GMT (1095 days)

Write out database with 1 new entries
Data Base Updated

Notar que se creó la carpeta demoCA en cuyo contenido deben estar los siguientes archivos:

cacert.pem

careq.pem

certs crl

index.txt

index.txt.attr

index.txt.old

newcerts

private    

serial    

serial.old

wireless:/etc/ssl# lscerts default-openssl.cnf demoCA openssl.cnf private
wireless:/etc/ssl#

wireless:/etc/ssl/demoCA# lscacert.pem careq.pem certs crl index.txt index.txt.attr index.txt.old newcerts private    serial    serial.old

Crear el archivo de texto xpextensions dentro de la carpeta /etc/ssl/demoCA como sigue

cd /etc/ssl/demoCA/

touch xpextensions

nano xpextensions

Luego copiar y pegar el siguiente contenido
/etc/ssl/demoCA/xpextensions

[xpclient_ext]

extendedKeyUsage=1.3.6.1.5.5.7.3.2

[xpserver_ext]

extendedKeyUsage=1.3.6.1.5.5.7.3.1

Luego generar los certificados del servidor FreeRadius

cd /etc/ssl/

openssl req -new -nodes -keyout demoCA/server_key.pem -out demoCA/server_req.pem -days 730 -config openssl.cnf

Generating a 1024 bit RSA private key
................................................++++++
...........................................................................++++++
writing new private key to 'demoCA/server_key.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [VE]:
State or Province Name (full name) [Miranda]:
Locality Name (eg, city) [Los Teques]:
Organization Name (eg, company) [MiOrg]:
Organizational Unit Name (eg, section) [IT]:
wireless_int []:wireless_int
user@MIDOMINIO.COM []:user@MIDOMINIO.COM

Please enter the following 'extra' attributes
to be sent with your certificate request
alejandro []:
An optional company name []:
wireless:/etc/ssl#
wireless:/etc/ssl/demoCA# lscacert.pem certs index.txt     index.txt.old private serial.old     server_req.pem
careq.pem crl index.txt.attr newcerts     serial server_key.pem xpextensions

Productos:

server_key.pem

server_req.pem

Despues se firman los certificados del servidor para compatibilidad con los clientes de Windows XP.

cd /etc/ssl/

openssl ca -config openssl.cnf -policy policy_anything -out demoCA/server_cert.pem -extensions xpserver_ext -extfile demoCA/xpextensions -infiles demoCA/server_req.pem

Using configuration from openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Jul 6 15:58:51 2010 GMT
Not After : Jul 6 15:58:51 2011 GMT
Subject:
countryName = VE
stateOrProvinceName = Miranda
localityName = Los Teques
organizationName = MiOrg
organizationalUnitName = IT
commonName = wireless_int
emailAddress = user@MIDOMINIO.COM
X509v3 extensions:
X509v3 Extended Key Usage:
TLS Web Server Authentication
Certificate is to be certified until Jul 6 15:58:51 2011 GMT (365 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

Productos:
server_cert.pem
Se hace un respaldo del certificado recien creado

cp /etc/ssl/server_cert.pem /etc/ssl/default-server_cert.pem

se edita y se elimina todas la líneas antes de la palabra

--BEGIN CERTIFICATE--

Luego se unen el certificado con la llave mediante

cat server_key.pem server_cert.pem > server_keycert.pem

Producto:
server_keycert.pem
Después se crean los certificados del cliente:

cd /etc/ssl/

openssl ca -config openssl.cnf -policy policy_anything -out demoCA/client_cert.pem -extensions xpclient_ext -extfile demoCA/xpextensions -infiles demoCA/client_req.pem

Using configuration from openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 2 (0x2)
Validity
Not Before: Jul 6 16:05:45 2010 GMT
Not After : Jul 6 16:05:45 2011 GMT
Subject:
countryName = VE
stateOrProvinceName = Miranda
localityName = Los Teques
organizationName = MiOrg
organizationalUnitName = IT
commonName = wireless_int
emailAddress = user@MIDOMINIO.COM
X509v3 extensions:
X509v3 Extended Key Usage:
TLS Web Client Authentication
Certificate is to be certified until Jul 6 16:05:45 2011 GMT (365 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

Productos:
client_req.pem
client_cert.pem
Finalmente se exportan los certificados del cliente al formato tipo PKCS12 que será usado en maquina con Sistema Operativo Windows:

cd /etc/ssl/

/etc/ssl/demoCA# openssl pkcs12 -export -in client_cert.pem -inkey client_key.pem -out client_cert.p12 -clcerts

Enter pass phrase for client_key.pem:
Enter Export Password:
Verifying - Enter Export Password:
wireless:/etc/ssl/demoCA# ls
cacert.pem client_cert.p12 client_req.pem index.txt.attr     newcerts serial.old         server_keycert.pem xpextensions
careq.pem client_cert.pem crl     index.txt.attr.old private server_cert.pem     server_key.pem
certs     client_key.pem index.txt     index.txt.old     serial server_cert.pem-backup server_req.pem

Producto:
client_cert.p12
El paso final es copiar los certificados server_keycert.pem y cacert.pem al servidor FreeRadius en /etc/freeradius/certs/
Estando en el servidor FreeRadius hacer

cd /etc/freeradius/certs
openssl dhparam -check -text -5 512 -out dh
dd if=/dev/urandom of=random count=2
chown freerad dh
chmod o-w dh

Terminados los pasos anteriores se configura la aplicación FreeRadius tal y como se describe en la siguiente seccion.

CONFIGURACION DEL SERVIDOR FREERADIUS

El siguiente paso el copiar los certificados creados en la carpeta de instalacion de FreeRadius, por lo cual:

cd /etc/ssl/

cp /etc/ssl/cacert.pem /etc/freeradius/certs/cacert.pem

cd private/

cp cakey.pem /etc/freeradius/certs/cakey.pem

Lo siguiente es editar el archivo eap.conf el cual indica a FreeRadius como negociara la autenticación EAP-TLS, por lo que hacemos:

cp /etc/freeradius/eap.conf /etc/freeradius/eap.conf-default

cd /etc/freeradius

nano eap.conf

/etc/freeradius/eap.conf

…

eap {

default_eap_type = peap

timer_expire = 60

ignore_unknown_eap_types = no

cisco_accounting_username_bug = no

max_sessions = 4096

md5 {

}

leap {

}

gtc {

auth_type = PAP

}

tls {

certdir = ${confdir}/certs

cadir = ${confdir}/certs

private_key_password = micontraseña

private_key_file = ${certdir}/server_keycert.pem

certificate_file = ${certdir}/server_keycert.pem

CA_file = ${cadir}/cacert.pem

dh_file = ${certdir}/dh

random_file = ${certdir}/random

fragment_size = 1024

include_length = yes

check_cert_cn = %{User-Name}

cipher_list = "DEFAULT"

dh_file = ${certdir}/dh

random_file = ${certdir}/random

…

Despues

cp /etc/freeradius/clients.conf /etc/freeradius/clients.conf-default

cd /etc/freeradius

nano clients.conf

/etc/freeradius/clients.conf

…

client localhost {

ipaddr = 127.0.0.1

secret = testing123

require_message_authenticator = no

nastype = other # localhost isn't usually a NAS...

}

client 10.0.0.15 {        #Direccion IP del Punto de Acceso de prueba

secret = alejandro

shortname = cisco1100

nastype = cisco

}

client 10.0.0.0 {        #Sub-red de acceso para usuarios

secret = alejandro

nastype = cisco

}

Seguimos editando como sigue

cp /etc/freeradius/sites-enabled/default /etc/freeradius/sites-enabled/default-default

cp /etc/freeradius/sites-enabled/inner-tunnel /etc/freeradius/sites-enabled/inner-tunnel-default

cd /etc/freeradius/sites-enabled

nano default

/etc/freeradius/sites-enabled/default

…

authorize {

#    ntlm_auth

    preprocess

#    auth_log

    chap

    mschap

#    digest

#    wimax

#    IPASS

    suffix

#    ntdomain

    eap {

        ok = return

    }

    unix

    files

#    sql

#    etc_smbpasswd

#    ldap

#    daily

#    checkval

    expiration

    logintime

    #pap

#    Autz-Type Status-Server {

#

#    }

}

authenticate {

ntlm_auth

Auth-Type PAP {

pap

    }

Auth-Type CHAP {

chap

    }

Auth-Type MS-CHAP {

mschap

    }

#    digest

#    pam

    unix

#    Auth-Type LDAP {

#        ldap

#    }

    eap

#    Auth-Type eap {

#        eap {

#            handled = 1

#        }

}

…

Editar la seccion authorize y authenticate del archivo inner-tunnel igual que el anterior.
El siguiente paso es editar el archivo ntlm_auth ubicado en /etc/freeradius/modules, para ello hacemos:

cp /etc/freeradius/modules/ntlm_auth /etc/freeradius/modules/ntlm_auth-default

cd /etc/freeradius/modules

nano ntlm_auth

/etc/freeradius/modules/ntlm_auth

#

# For testing ntlm_auth authentication with PAP.

#

# If you have problems with authentication failing, even when the

# password is good, it may be a bug in Samba:

#

#    https://bugzilla.samba.org/show_bug.cgi?id=6563

#

exec ntlm_auth {

wait = yes

program = "/usr/bin/ntlm_auth—request-nt-key --    username=%{mschap:User-Name} --domain=%{%{mschap:NT-Domain}:-    MIDOMINIO.COM} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-    Response}"

}

Luego,

cp /etc/freeradius/modules/mschap /etc/freeradius/modules/mschap-default

cd /etc/freeradius/modules

nano mschap

/etc/freeradius/modules/mschap

# -*- text -*-

#

# $Id$

# Microsoft CHAP authentication

#

# This module supports MS-CHAP and MS-CHAPv2 authentication.

# It also enforces the SMB-Account-Ctrl attribute.

#

mschap {

    #

# If you are using /etc/smbpasswd, see the 'passwd'

# module for an example of how to use /etc/smbpasswd

# if use_mppe is not set to no mschap will

# add MS-CHAP-MPPE-Keys for MS-CHAPv1 and

# MS-MPPE-Recv-Key/MS-MPPE-Send-Key for MS-CHAPv2

    #

use_mppe = yes

# if mppe is enabled require_encryption makes

# encryption moderate

    #

#require_encryption = yes

# require_strong always requires 128 bit key

# encryption

    #

#require_strong = yes

# Windows sends us a username in the form of

# DOMAIN\user, but sends the challenge response

# based on only the user portion. This hack

# corrects for that incorrect behavior.

    #

with_ntdomain_hack = yes

# The module can perform authentication itself, OR

# use a Windows Domain Controller. This configuration

# directive tells the module to call the ntlm_auth

# program, which will do the authentication, and return

# the NT-Key. Note that you MUST have "winbindd" and

# "nmbd" running on the local machine for ntlm_auth

# to work. See the ntlm_auth program documentation

# for details.

    #

# If ntlm_auth is configured below, then the mschap

# module will call ntlm_auth for every MS-CHAP

# authentication request. If there is a cleartext

# or NT hashed password available, you can set

# "MS-CHAP-Use-NTLM-Auth := No" in the control items,

# and the mschap module will do the authentication itself,

# without calling ntlm_auth.

    #

# Be VERY careful when editing the following line!

    #

# You can also try setting the user name as:

    #

#    ...—username=%{mschap:User-Name} ...

    #

# In that case, the mschap module will look at the User-Name

# attribute, and do prefix/suffix checks in order to obtain

# the "best" user name for the request.

    #

ntlm_auth = "/usr/bin/ntlm_auth—request-nt-key --    username=%{mschap:User-Name} --domain=%{%{mschap:NT-Domain}:-    MIDOMINIO.COM} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-    Response}"

}

Una vez configurado los archivos anteriores se procede a la prueba de la aplicación usando un punto de acceso Cisco 1100 y una portátil inscrita en el dominio MIDOMINIO con OS Windows XP.

CONFIGURACION DEL PUNTO DE ACCESO

Nota: Punto de acceso usado Cisco 1100.
La direccion IP del punto de acceso Cisco 1100 de pruebas asi como la sub-red de las direcciones IP correspondiente a la VLAN Inalambrica debe estar reportada en el archivo clients.conf de FreeRadius (punto cubierto anteriormente). Retomando esto tendremos que:
/etc/freeradius/clients.conf

…

client 10.0.0.15 {        #Direccion IP del Punto de Acceso de prueba

secret = alejandro

shortname = cisco1100

nastype = cisco

}

client 10.0.0.0 {        #Sub-red de acceso para usuarios

secret = alejandro

nastype = cisco

}

Luego procedemos a configurar el punto de acceso Cisco 1100 segun los siguientes pasos.
1.- Clic en EXPRESS-SECURITY.
2.- SSID: freeradius
3.- Chequear la casilla "Broadcast SSID in Beacon"
4.- Enabled VLAN ID: 10 (no chequear la casilla native VLAN si la IP administrative no esta en la misma VLAN)
5.- EAP Authentication. Luego se ingresa la direccion IP del servidor FreeRadius y el secreto que fue declarado en el archivo clients.conf
6.- Clic en Aplicar.

CONFIGURACION DEL CLIENTE

Nota: Computador portátil con OS Windows XP.
Se copia el certificado cacert.p12 ubicado en /etc/ssl/ en el escritorio del PC con Windows XP. Luego se instala el mismo haciendo doble clic sobre éste.

Se inserta la clave la cual debe coincidir con la insertada en el archivo openssl.conf en el campo challengePassword. 

Se hace clic en Colocar todos los certificados en el siguiente almacén y se elige Entidades emisoras. Raíz de confianza., luego clic en Siguiente.

Finalmente hace clic en aceptar y se termina de instalar el certificado.

El siguiente paso es indicarle a Windows como autenticara al usuario que intente conectarse a la red inalámbrica. Por tanto se buscan las propiedades de la interfaz inalámbrica y se configura PEAP y luego clic en configuración. Para ello:

PROBANDO FREERADIUS

Llegado a este punto arrancamos FreeRadius desde la consola tal y como sigue

freeradius -X

e intentamos conectar los clientes.


Suerte!