cesnet / ansible-freeradius Goto Github PK
View Code? Open in Web Editor NEWAnsible role to install FreeRADIUS v3 for eduroam.cz
Ansible role to install FreeRADIUS v3 for eduroam.cz
cui_hash_key should have non default value
Diky rewrite_calling_station_id lze zjednodusit vylouceni monitoringu z detailnich logu. Az to zaktualizujes v dokumentaci FR3 na eduroam.cz tak to aplikuj i na tuhle roli.
With PKCS#12 we automatically assume that certificate file is named as FQDN.pkcs12
With PEM we need explicit filename name:
radsec:
certificate: certs/semik-dev.cesnet.cz.crt
private_key: certs/semik-dev.cesnet.cz.key
private_key_password: "{{ semik_dev_cesnet_cz.radsec_key_password }}"
EAP:
certificate: certs/semik-dev.cesnet.cz.crt
private_key: certs/semik-dev.cesnet.cz.key
private_key_password: "{{ semik_dev_cesnet_cz.eap_key_password }}"
This is inconsitent :( and produces weird conditions https://github.com/fivaldi/ansible-freeradius/blob/7e9c094a8785a54395d4510a30afefe7eac9fad8/tasks/main.yml#L203
I'm not sure that we need PKCS#12 support at all.
Meli bychom mit moznost nainstalovat mezilehly certifikat do souboru s certifikatem serveru.
V soucasnosti se jen vybali z PKCS#12 certifikat a chain se neresi.
Vynutit verzi tls 1.2 jako jedinou funkcni?
Narazim na problem s timto souborem. Pri spusteni radiusu dostanu chybu:
Thu Jul 16 14:53:14 2020 : Error: /usr/local/etc/raddb/policy.d/eduroam-realm-checks[61]: @.+?@
Thu Jul 16 14:53:14 2020 : Error: /usr/local/etc/raddb/policy.d/eduroam-realm-checks[61]: ^ Pattern compilation failed: repetition-operator operand invalid
Nejake objasneni jsem nasel zde:
https://www.tfzx.net/article/257531.html
Je nutne radius zkompilovat s podporou PCRE. To treba ale predpripraveny balik ve FreeBSD nema. Mozna by to stalo za zminku v navodu ... nebo upravit ty regularni vyrazy.
Pokus o ověření:
# rad_eap_test -H 127.0.0.1 -P 1812 -S secret -u [email protected] -p password -m WPA-EAP -e PEAP -t 5
timeout; 5.01 sec |rtt=5010ms;;;0;5000 accept=1;0.5:;0:;0;1
V logu radiusu je pak vidět:
...
(4) eap_peap: Continuing EAP-TLS
(4) eap_peap: [eaptls verify] = ok
(4) eap_peap: Done initial handshake
(4) eap_peap: <<< recv UNKNOWN TLS VERSION ?0304? [length 0001]
(4) eap_peap: TLS_accept: TLSv1.3 early data
(4) eap_peap: <<< recv UNKNOWN TLS VERSION ?0304? [length 0034]
(4) eap_peap: TLS_accept: SSLv3/TLS read finished
(4) eap_peap: (other): SSLv3/TLS write session ticket
(4) eap_peap: >>> send UNKNOWN TLS VERSION ?0304? [length 0001]
(4) eap_peap: >>> send UNKNOWN TLS VERSION ?0304? [length 0039]
(4) eap_peap: TLS_accept: SSLv3/TLS write session ticket
(4) eap_peap: >>> send UNKNOWN TLS VERSION ?0304? [length 0001]
(4) eap_peap: >>> send UNKNOWN TLS VERSION ?0304? [length 0039]
...
Dočasným řešením může být přidání parametru tls_max_version = "1.2" do konfiguračního souboru eap.
diff --git a/ansible-freeradius/templates/eap.j2 b/ansible-freeradius/templates/eap.j2
index 0ad959d..c878c33 100644
--- a/ansible-freeradius/templates/eap.j2
+++ b/ansible-freeradius/templates/eap.j2
@@ -173,6 +173,7 @@ eap {
# ANYONE who has a certificate signed by them can
# authenticate via EAP-TLS! This is likely not what you want.
tls-config tls-common {
+ tls_max_version = "1.2"
{% if eduroam.EAP is defined %}
{% if eduroam.EAP.private_key_password is defined %}
private_key_password = {{ eduroam.EAP.private_key_password }}
ansible_fqdn je ziskavano z DNS, je lepsi pouzvat inventory_hostname ktery mame staticky nadefinovany v inventory (tedy za predpokladu ze si tam pisem plny jmena)
Při použití pomlčky v názvu serveru skončí skript chybou.
Pro radius.moje-domena.cz (chyba):
fatal: [radius.moje-domena.cz]: FAILED! => {"msg": "The conditional check '(eduroam.mode == 'IdPSP') and (ldap is defined)' failed. The error was: error while evaluating conditional ((eduroam.mode == 'IdPSP') and (ldap is defined)): 'domena_cz' is undefined\n\nThe error appears to have been in '/root/instalace_freeradius/roles/freeradius/tasks/main.yml': line 25, column 3, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n\n- name: Install/update FreeRADIUS LDAP module\n ^ here\n"}
Pro radius.mojedomena.cz (vše v pořádku):
...
...
...
PLAY RECAP *******************************************************************
radius.mojedomena.cz : ok=28 changed=12 unreachable=0 failed=0
Pro správnou funkčnost rad_eap_test je potřeba v Debianu Buster doinstalovat balíčky bc a libnl-genl-3-200
root@radius:~# rad_eap_test -H 127.0.0.1 -P 1812 -S secret -u [email protected] -p password -m WPA-EAP -e PEAP -t 5 2>&1 | head -n 2
bc is required by rad_eap_test, please install if first.
root@radius:~# apt -y install bc
root@radius:~# rad_eap_test -H 127.0.0.1 -P 1812 -S secret -u [email protected] -p password -m WPA-EAP -e PEAP -t 5 2>&1 | head -n 1
eapol_test returned error: /usr/local/bin/eapol_test: error while loading shared libraries: libnl-genl-3.so.200: cannot open shared object file: No such file or directory
root@radius:~# apt -y install libnl-genl-3-200
root@radius:~# rad_eap_test -H 127.0.0.1 -P 1812 -S secret -u [email protected] -p password -m WPA-EAP -e PEAP -t 5
access-accept; 0.53 sec |rtt=533ms;;;0;5000 accept=1;0.5:;0:;0;1
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.