Freeradius on Nico Maas

[Ubuntu] Radsecproy for secure Radius over WAN

Mon, 27 Jun 2016 11:51:44 +0000

Chances are you going to need an radius Auth over WAN - because your Radius and Identity Mngmnt is hosted in the security of the local datacenter of your corp… but the client (i.e. an network switch) is somewhere over the ~~rainbow~~ WAN. You could just pipe the radius traffic over the internet - but there be dragons: radius communication is unencrypted. So… just no.

Enter radsecproxy: Radsecproxy is - as the name implies, an radius proxy - which needs to be installed on both servers (the local one in your company, now called SERVER, and the remote one with the switch attached, now called CLIENT) - and does encrypt the communication between both server parts (over WAN i.e.) via TLS.

[Ubuntu] Freeradius: Improve Uptime

Fri, 20 May 2016 08:00:43 +0000

As a network admin, you’re going to have at least one Freeradius running, mostly for 802.1x authentication. At my place the problem arised, that the service was down too often - for different reasons.

1.) Logrotate
If you’re using logrotate, you should check out /etc/logrotate.d/freeradius:

/var/log/freeradius/*.log {
weekly
rotate 52
compress
delaycompress
notifempty
missingok
postrotate
invoke-rc.d freeradius reload &gt;/dev/null 2&gt;&1 || true
endscript
}

Logrotate does restart freeradius after it swapped the logs with reload, which often results in a crash or race condition (freeradius does not shutdown fast enough, and the restarting process thinks it already got one running process - and both terminate). So to change that, you should stop the process, wait, and start again.

[Ubuntu] Letsencrypt with Apache and Freeradius

Mon, 16 May 2016 08:00:53 +0000

This little tutorial describes how to use Letsencrypt with Apache, Freeradius and Auto-Renewal of the Certificates.

Install Letsencrypt

sudo apt-get update  
sudo apt-get install git  
cd /opt  
sudo git clone https://github.com/letsencrypt/letsencrypt /opt/letsencrypt  
cd /opt/letsencrypt

# Become root  
sudo su

# "Order" certificates (replace SERVERDOMAIN.COM with the DNS of your Server!)  
./letsencrypt-auto --apache -d SERVERDOMAIN.COM --rsa-key-size 4096  
Enter Contact Mail: mail@SERVERDOMAIN.COM  
Configuration Type: Secure #is best, as it does redirect insecure http to https)

# Read PATH variable  
echo $PATH

# Cronjob for certificate renewal  
#you should under all circumstances replace the string following PATH= with your own, as read with the command above.  
#Seperate with ; from the rest of the command like shown in the example  
crontab -e

# letsencrypt
30 2 * * 1 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games;/opt/letsencrypt/letsencrypt-auto renew &gt;&gt; /var/log/le-renew.log
35 2 * * 1 /etc/init.d/freeradius restart
35 2 * * 1 /etc/init.d/apache2 restart

Configure Freeradius

cp -r /etc/freeradius/certs/ /etc/freeradius/certs_bkp  
rm /etc/freeradius/certs/*.pem  
cp /etc/freeradius/eap.conf /etc/freeradius/eap.conf_bkp

vi /etc/freeradius/eap.conf

#certdir = ${confdir}/certs
#cadir = ${confdir}/certs
certdir = /etc/letsencrypt/live/SERVERDOMAIN.COM
cadir = /etc/letsencrypt/live/SERVERDOMAIN.COM
#dh_file = ${certdir}/dh
dh_file = ${confdir}/certs/dh
#private_key_password = whatever
private_key_file = ${certdir}/privkey.pem
certificate_file = ${certdir}/cert.pem
CA_file = ${cadir}/fullchain.pem

# Configure access rights on /etc/letsencrypt  
cd /etc/letsencrypt/  
chgrp -R ssl-cert archive csr keys live options-ssl-apache.conf renewal # set group of cert/key dirs to ssl-cert  
find . -type d -exec chmod g+xs {} \; # directories executable and setguid (set group ssl-cert for new files/dirs)  
find . -type f -exec chmod g+r {} \; # files readable

# Restart Freeradius  
service freeradius stop  
service freeradius start

Additional infos: https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-14-04