User:Sfiggins/RH-TACACS with LDAP Backend - Revision history

Sfiggins: /* Installing a RADIUS Rpoxy Server */

2019-07-05T18:30:09Z

Installing a RADIUS Rpoxy Server

Sfiggins: /* Enabling and starting RADIUS */

2019-07-05T18:27:24Z

Enabling and starting RADIUS

Sfiggins: /* Adding Firewall configuration */

2019-07-05T18:26:34Z

Adding Firewall configuration

Sfiggins: /* Start and Test */

2019-07-05T18:25:12Z

Start and Test

Sfiggins: /* =Edit the RADIUS configuration */

2019-07-05T18:23:20Z

=Edit the RADIUS configuration

Sfiggins: /* Configure for Proxy */

2019-07-05T18:22:39Z

Configure for Proxy

Sfiggins: /* Install new CentOS server */

2019-07-05T17:59:38Z

Install new CentOS server

Sfiggins: /* Monitoring the replication */

2019-07-05T17:53:25Z

Monitoring the replication

Sfiggins: /* Advanced RADIUS Configuration */

2019-07-05T17:50:23Z

Advanced RADIUS Configuration

Sfiggins: /* Enable NSLCD */

2019-06-25T02:24:47Z

Enable NSLCD

← Older revision		Revision as of 18:30, 5 July 2019
Line 3,329:		Line 3,329:

	= Installing a RADIUS Rpoxy Server=		= Installing a RADIUS Rpoxy Server=
		+
		+	This is along the same lines of authentication, but will be done on a separate server. It may be created in conjunction with the overall authentication deployment, or may be done afterwards to add RADIUS proxy to the deployment.

	==Create base Centos 7 server, as documented below==		==Create base Centos 7 server, as documented below==

← Older revision		Revision as of 18:27, 5 July 2019
Line 3,598:		Line 3,598:
	'''!!! If you are deploying a RADIUS proxy to an outside IP address, please secure it further with more granular firewall configuration !!!'''		'''!!! If you are deploying a RADIUS proxy to an outside IP address, please secure it further with more granular firewall configuration !!!'''

−	== Enabling and ~~starting~~ RADIUS ==	+	== Enabling and Starting RADIUS ==
		+
		+	To enable the RADIUS daemon
		+
		+	<pre>
		+	# systemctl enable radiusd
		+	Created symlink from /etc/systemd/system/multi-user.target.wants/radiusd.service to /usr/lib/systemd/system/radiusd.service.
		+	</pre>
		+
		+	To start the RADIUS daemon
		+
		+	<pre>
		+	# systemctl start radiusd
		+	</pre>

@@ Line 3,582: / Line 3,582: @@
 </pre>
-== Adding Firewall configuration ==
+== Adding Firewall Configuration ==
 == Enabling and starting RADIUS ==

@@ Line 3,558: / Line 3,558: @@
 <pre>
+# echo "User-Name=tuser2,User-Password=somepass" > /root/rad-test
 </pre>
@@ Line 3,568: / Line 3,568: @@
 <pre>
 </pre>

@@ Line 2,962: / Line 2,962: @@
 Once complete, restart the directory server and verify that is is running.
-====Edit the RADIUS configuration===
+====Edit the RADIUS configuration====
 Edit /etc/raddb/mods-available/ldap.  Find the below section:

← Older revision		Revision as of 18:22, 5 July 2019
Line 3,394:		Line 3,394:

	== Configure for Proxy ==		== Configure for Proxy ==
		+
		+	In /etc/raddb/proxy.conf file, configure as follows:
		+
		+	<pre>
		+	# Proxy server configuration
		+	#
		+	# This entry controls the servers behaviour towards ALL other servers
		+	# to which it sends proxy requests.
		+	#
		+	proxy server {
		+
		+	# Setting this to "yes" may have issues for authentication.
		+	# i.e. If you are proxying for two different ISP's, and then
		+	# act as a general dial-up for Gric. If one of the first two
		+	# ISP's has their RADIUS server go down, you do NOT want to
		+	# proxy those requests to GRIC. Instead, you probably want
		+	# to just drop the requests on the floor. In that case, set
		+	# this value to 'no'.
		+	#
		+	# allowed values: {yes, no}
		+	#
		+	default_fallback = no
		+
		+	}
		+
		+	home_server den1-radius1 {
		+	type = auth
		+	ipaddr = 199.26.60.50
		+	port = 1812
		+	secret = motoPMP320
		+	require_message_authenticator = yes
		+	response_window = 20
		+	zombie_period = 40
		+	status_check = status-server
		+	check_interval = 30
		+	num_answers_to_alive = 3
		+	max_outstanding = 65536
		+	}
		+
		+	home_server dal1-radius1 {
		+	type = auth
		+	ipaddr = 199.26.61.50
		+	port = 1812
		+	secret = motoPMP320
		+	require_message_authenticator = yes
		+	response_window = 20
		+	zombie_period = 40
		+	status_check = status-server
		+	check_interval = 30
		+	num_answers_to_alive = 3
		+	max_outstanding = 65536
		+	}
		+
		+	home_server den1-radius1-acct {
		+	type = acct
		+	ipaddr = 199.26.60.50
		+	port = 1813
		+	secret = motoPMP320
		+	require_message_authenticator = yes
		+	response_window = 20
		+	zombie_period = 40
		+	status_check = status-server
		+	check_interval = 30
		+	num_answers_to_alive = 3
		+	max_outstanding = 65536
		+	}
		+
		+	home_server dal1-radius1-acct {
		+	type = acct
		+	ipaddr = 199.26.61.50
		+	port = 1813
		+	secret = motoPMP320
		+	require_message_authenticator = yes
		+	response_window = 20
		+	zombie_period = 40
		+	status_check = status-server
		+	check_interval = 30
		+	num_answers_to_alive = 3
		+	max_outstanding = 65536
		+	}
		+
		+	home_server_pool freeradius_auth_loadbalance {
		+	#
		+	# The type of this pool controls how home servers are chosen.
		+	#
		+	type = load-balance
		+
		+	# Next, a list of one or more home servers. The names
		+	# of the home servers are NOT the hostnames, but the names
		+	# of the sections. (e.g. home_server foo {...} has name "foo".
		+	#
		+	home_server = den1-radius1
		+	home_server = dal1-radius1
		+
		+	# If ALL home servers are dead, then this "fallback" home server
		+	# is used. If set, it takes precedence over any realm-based
		+	# fallback, such as the DEFAULT realm.
		+	#
		+	#fallback = virtual.example.com
		+	}
		+
		+	home_server_pool freeradius_acct_loadbalance {
		+	#
		+	# The type of this pool controls how home servers are chosen.
		+	#
		+	type = load-balance
		+
		+	# Next, a list of one or more home servers. The names
		+	# of the home servers are NOT the hostnames, but the names
		+	# of the sections. (e.g. home_server foo {...} has name "foo".
		+	#
		+	home_server = den1-radius1-acct
		+	home_server = dal1-radius1-acct
		+
		+	# If ALL home servers are dead, then this "fallback" home server
		+	# is used. If set, it takes precedence over any realm-based
		+	# fallback, such as the DEFAULT realm.
		+	#
		+	#fallback = virtual.example.com
		+	}
		+
		+	#
		+	# This realm is for requests which don't have an explicit realm
		+	# prefix or suffix. User names like "bob" will match this one.
		+	#
		+	realm NULL {
		+	auth_pool = freeradius_auth_loadbalance
		+	acct_pool = freeradius_acct_loadbalance
		+	nostrip
		+	}
		+
		+	</pre>
		+
		+	Configure the /etc/raddb/clients.conf file.
		+
		+	<pre>
		+	client remote-node-1 {
		+	ipaddr = 10.1.2.3/32
		+	secret = some-shared-secret
		+	}
		+	</pre>
		+
		+	Add any VSAs and RADIUS extensions.
		+
		+	Copy any dictionary files to /etc/raddb:
		+
		+	<pre>
		+	# cp /tmp/dictionary.vendor1 /etc/raddb/
		+	# echo '$INCLUDE /etc/raddb/dictionary.vendor1' >> /etc/raddb/dictionary
		+	</pre>
		+
		+	Also, add and RADIUS extensions (as detailed in an above section) to the /etc/raddb/dictionary file.
		+
		+	== Start and Test ==
		+
		+	Start the RADIUS server in debug mode:
		+
		+	<pre>
		+	# radiusd -d /etc/raddb/ -X
		+	</pre>
		+
		+	In another window, run the following commands:
		+
		+	<pre>
		+
		+	</pre>
		+
		+	<pre>
		+	# cat /root/rad-test \| radclient 127.0.0.1:1812 auth testing123
		+	</pre>
		+
		+	If successful, we will see the following.
		+
		+	<pre>
		+	</pre>
		+
		+	== Adding Firewall configuration ==
		+
		+	== Enabling and starting RADIUS ==

@@ Line 3,330: / Line 3,330: @@
 = Installing a RADIUS Rpoxy Server=
-== Install new CentOS server ==
+==Create base Centos 7 server, as documented below==
-Install per the above commands.
+[[New CentOS 7 Server Setup Commands]]
 == Install RADIUS from yum ==

← Older revision		Revision as of 17:53, 5 July 2019
Line 3,327:		Line 3,327:

	The '''''nsds5replicaLastUpdateStart''''' and '''''nsds5replicaLastUpdateEnd''''' dates should be updating.		The '''''nsds5replicaLastUpdateStart''''' and '''''nsds5replicaLastUpdateEnd''''' dates should be updating.
		+
		+	= Installing a RADIUS Rpoxy Server=
		+
		+	== Install new CentOS server ==
		+
		+	Install per the above commands.
		+
		+	== Install RADIUS from yum ==
		+
		+	<pre>
		+	# yum install freeradius freeradius-ldap freeradius-utils
		+	Loaded plugins: fastestmirror
		+	Loading mirror speeds from cached hostfile
		+	* base: mirror.team-cymru.com
		+	* epel: d2lzkl7pfhq30w.cloudfront.net
		+	* extras: mirror.team-cymru.com
		+	* updates: mirror.dal10.us.leaseweb.net
		+	Resolving Dependencies
		+	--> Running transaction check
		+	---> Package freeradius.x86_64 0:3.0.13-9.el7_5 will be installed
		+	---> Package freeradius-ldap.x86_64 0:3.0.13-9.el7_5 will be installed
		+	---> Package freeradius-utils.x86_64 0:3.0.13-9.el7_5 will be installed
		+	--> Finished Dependency Resolution
		+
		+	Dependencies Resolved
		+
		+	================================================================================
		+	Package Arch Version Repository Size
		+	================================================================================
		+	Installing:
		+	freeradius x86_64 3.0.13-9.el7_5 base 1.1 M
		+	freeradius-ldap x86_64 3.0.13-9.el7_5 base 109 k
		+	freeradius-utils x86_64 3.0.13-9.el7_5 base 221 k
		+
		+	Transaction Summary
		+	================================================================================
		+	Install 3 Packages
		+
		+	Total download size: 1.4 M
		+	Installed size: 4.0 M
		+	Is this ok [y/d/N]: y
		+	Downloading packages:
		+	(1/3): freeradius-ldap-3.0.13-9.el7_5.x86_64.rpm \| 109 kB 00:00
		+	(2/3): freeradius-utils-3.0.13-9.el7_5.x86_64.rpm \| 221 kB 00:00
		+	(3/3): freeradius-3.0.13-9.el7_5.x86_64.rpm \| 1.1 MB 00:00
		+	--------------------------------------------------------------------------------
		+	Total 2.4 MB/s \| 1.4 MB 00:00
		+	Running transaction check
		+	Running transaction test
		+	Transaction test succeeded
		+	Running transaction
		+	Installing : freeradius-3.0.13-9.el7_5.x86_64 1/3
		+	Installing : freeradius-ldap-3.0.13-9.el7_5.x86_64 2/3
		+	Installing : freeradius-utils-3.0.13-9.el7_5.x86_64 3/3
		+	Verifying : freeradius-ldap-3.0.13-9.el7_5.x86_64 1/3
		+	Verifying : freeradius-3.0.13-9.el7_5.x86_64 2/3
		+	Verifying : freeradius-utils-3.0.13-9.el7_5.x86_64 3/3
		+
		+	Installed:
		+	freeradius.x86_64 0:3.0.13-9.el7_5
		+	freeradius-ldap.x86_64 0:3.0.13-9.el7_5
		+	freeradius-utils.x86_64 0:3.0.13-9.el7_5
		+
		+	Complete!
		+	</pre>
		+
		+	== Configure for Proxy ==

@@ Line 2,932: / Line 2,932: @@
                  attribute = 'radiusProfileDn'
+         }
 </pre>

@@ Line 2,236: / Line 2,236: @@
 <pre>
-# systemctl enable nslcd
+# systemctl enable nscd
-Created symlink from /etc/systemd/system/multi-user.target.wants/nslcd.service to /usr/lib/systemd/system/nslcd.service.
+Created symlink from /etc/systemd/system/multi-user.target.wants/nscd.service to /usr/lib/systemd/system/nscd.service.
 </pre>