Installing FreeRadius on SLES10 configured for eDirectory

• http://www.linuxjournal.com/article/8151

I also had some minor problems with permissions on the cert.b64 file (make sure radiusd user and group can see the file)

Copy this file (with your specific modifications) and export your eDirectory Self-Signed CA (without private key) as Base64 to /etc/raddb/certs/cert.b64

	secret = companysecret
	shortname = company

ldap_identity = "cn=RadiusAdmin,ou=RemoteAccess,o=tree" ldap_password = thisisnottherealpassword ldap_basedn = "o=tree"

		server = "ldap1.domain.name"

		server = "ldap2.domain.name"

• http://www.novell.com/coolsolutions/tip/15922.html
• http://www.novell.com/documentation/edir_radius/index.html
• http://en.opensuse.org/RadiusServerHOWTO

If you run into any problems just run the following command to see all the necessary troubleshooting output:

You might also want to create a link to the init.d script.

1. #
2. /etc/raddb/radiusd.conf #
3. #
4. Author: Bob Brandt (projects@brandt.ie) #
5. #
6. FreeRADIUS Redundant LDAP Configuration #
7. #

2. radiusd.conf -- FreeRADIUS server configuration file.
4. Author: Bob Brandt (projects@brandt.ie)
6. Redundant LDAP Configuration

You might also want to create a link ln -s /etc/init.d/radiusd /usr/sbin/rcradiusd

2. radiusd.conf -- FreeRADIUS server configuration file.
4. Redundant LDAP Configuration
6. http://www.freeradius.org/
7. http://www.novell.com/documentation/edir_radius/index.html
8. http://en.opensuse.org/RadiusServerHOWTO

prefix = /usr exec_prefix = ${prefix} sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct

1. Location of config and logfiles.

confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = /usr/lib/freeradius pidfile = ${run_dir}/radiusd.pid

user = radiusd group = radiusd

max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024

bind_address = * port = 0

hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = yes log_auth = yes log_auth_badpass = yes log_auth_goodpass = yes usercollide = no lower_user = after lower_pass = no nospace_user = after nospace_pass = no

checkrad = ${sbindir}/checkrad

1. SECURITY CONFIGURATION

security {

	max_attributes = 200
	reject_delay = 1
	status_server = yes

}

1. CLIENTS CONFIGURATION

client 0.0.0.0/0 {

	secret = opwradius
	shortname = opw

}

1. THREAD POOL CONFIGURATION

thread pool {

	start_servers = 5
	max_servers = 32
	min_spare_servers = 3
	max_spare_servers = 10
	max_requests_per_server = 0

}

1. LDAP Information

ldap_identity = "cn=RadiusAdmin, ou=RemoteAccess , o=opw" ldap_password = R@d1us@dmin ldap_basedn = "o=opw" ldap_tls_cacertfile = "/etc/raddb/certs/cert.b64"

1. MODULE CONFIGURATION

modules {

	ldap ldap1 {	
		server = "nds1.opw.ie"
		identity = ${ldap_identity}
		password = ${ldap_password}
		basedn = ${ldap_basedn}
		filter = "(&(objectClass=inetOrgPerson)(cn=%{Stripped-User-Name:-%{User-Name}}))" 
		base_filter = "(objectclass=inetOrgPerson)" 

		start_tls = yes 
		tls_cacertfile	= ${ldap_tls_cacertfile}
		tls_require_cert = "demand" 
		access_attr = "dialupAccess" 
		dictionary_mapping = ${raddbdir}/ldap.attrmap 
		ldap_connections_number = 5 
		password_attribute = nspmPassword
		timeout = 4 
		timelimit = 3 
		net_timeout = 1 
		edir_account_policy_check = yes 
	}	

	ldap ldap2 {	
		server = "nds2.opw.ie"
		identity = ${ldap_identity}
		password = ${ldap_password}
		basedn = ${ldap_basedn}
		filter = "(&(objectClass=inetOrgPerson)(cn=%{Stripped-User-Name:-%{User-Name}}))" 
		base_filter = "(objectclass=inetOrgPerson)" 

		start_tls = yes 
		tls_cacertfile	= ${ldap_tls_cacertfile}
		tls_require_cert = "demand" 
		access_attr = "dialupAccess" 
		dictionary_mapping = ${raddbdir}/ldap.attrmap 
		ldap_connections_number = 5 
		password_attribute = nspmPassword
		timeout = 4 
		timelimit = 3 
		net_timeout = 1 
		edir_account_policy_check = yes 
	}	

}

authorize {

	ldap1
	ldap2

}

authenticate {

	Auth-Type LDAP {
		ldap1
		ldap2
	}

}

post-auth {

	Post-Auth-Type REJECT {
		ldap1
		ldap2
	}

}

FreeRadius is a very versatile, powerful application for network RADIUS authentication. Perhaps too powerful! The problem is that is can seem to have too many options, and unless your a RADIUS expert, your screwed!

What I needed for a customer was way to "proxy" LDAP/eDirectory authentication through RADIUS, and perhaps define redundant LDAP servers. That's all!

Through a great deal of research, trial and error; I can up with the following slimmed down configuration file. Simple, Secure and Functional!

Copy this file (with your specific modifications) and export your eDirectory Organizational CA (without private key) as Base64 to /etc/raddb/certs/cert.b64

You might also want to create a link ln -s

(:div style="border-style:ridge; border-width:2px; background-color:#ffffcc; margin-left:50px; overflow:auto; width:650px; height:300px;":)

(:divend:)

(:title Installing FreeRadius on SLES10 configured for eDirectory:)

References:

• http://www.novell.com/coolsolutions/tip/15922.html
• http://www.novell.com/documentation/edir_radius/index.html?page=/documentation/edir_radius/radadmin/data/btuadmy.html
• http://wiki.novell.com/index.php/Recreating_Server_Certificates_on_OES_Linux