cesnet / ansible-freeradius Goto Github PK

cui_hash_key should have non default value

Diky rewrite_calling_station_id lze zjednodusit vylouceni monitoringu z detailnich logu. Az to zaktualizujes v dokumentaci FR3 na eduroam.cz tak to aplikuj i na tuhle roli.

With PKCS#12 we automatically assume that certificate file is named as FQDN.pkcs12

With PEM we need explicit filename name:

radsec:
certificate: certs/semik-dev.cesnet.cz.crt
private_key: certs/semik-dev.cesnet.cz.key
private_key_password: "{{ semik_dev_cesnet_cz.radsec_key_password }}"
EAP:
certificate: certs/semik-dev.cesnet.cz.crt
private_key: certs/semik-dev.cesnet.cz.key
private_key_password: "{{ semik_dev_cesnet_cz.eap_key_password }}"

This is inconsitent :( and produces weird conditions https://github.com/fivaldi/ansible-freeradius/blob/7e9c094a8785a54395d4510a30afefe7eac9fad8/tasks/main.yml#L203

I'm not sure that we need PKCS#12 support at all.

In future /etc/freeradius/3.0 at least for Stretch & Buster.

and on line 103 revert to /etc/freeradios only on Jessie

Originally posted by @semik in #16

Meli bychom mit moznost nainstalovat mezilehly certifikat do souboru s certifikatem serveru.

V soucasnosti se jen vybali z PKCS#12 certifikat a chain se neresi.

https://www.eduroam.cz/cs/spravce/pripojovani/radius/freeradius3#konfigurace_eap_pro_overovani_uzivatelu

Vynutit verzi tls 1.2 jako jedinou funkcni?

Narazim na problem s timto souborem. Pri spusteni radiusu dostanu chybu:
Thu Jul 16 14:53:14 2020 : Error: /usr/local/etc/raddb/policy.d/eduroam-realm-checks[61]: @.+?@
Thu Jul 16 14:53:14 2020 : Error: /usr/local/etc/raddb/policy.d/eduroam-realm-checks[61]: ^ Pattern compilation failed: repetition-operator operand invalid

Nejake objasneni jsem nasel zde:
https://www.tfzx.net/article/257531.html

Je nutne radius zkompilovat s podporou PCRE. To treba ale predpripraveny balik ve FreeBSD nema. Mozna by to stalo za zminku v navodu ... nebo upravit ty regularni vyrazy.

Pokus o ověření:

# rad_eap_test -H 127.0.0.1 -P 1812 -S secret -u [email protected] -p password -m WPA-EAP -e PEAP -t 5
timeout; 5.01 sec |rtt=5010ms;;;0;5000 accept=1;0.5:;0:;0;1

V logu radiusu je pak vidět:

...
(4) eap_peap: Continuing EAP-TLS
(4) eap_peap: [eaptls verify] = ok
(4) eap_peap: Done initial handshake
(4) eap_peap: <<< recv UNKNOWN TLS VERSION ?0304? [length 0001] 
(4) eap_peap: TLS_accept: TLSv1.3 early data
(4) eap_peap: <<< recv UNKNOWN TLS VERSION ?0304? [length 0034] 
(4) eap_peap: TLS_accept: SSLv3/TLS read finished
(4) eap_peap: (other): SSLv3/TLS write session ticket
(4) eap_peap: >>> send UNKNOWN TLS VERSION ?0304? [length 0001] 
(4) eap_peap: >>> send UNKNOWN TLS VERSION ?0304? [length 0039] 
(4) eap_peap: TLS_accept: SSLv3/TLS write session ticket
(4) eap_peap: >>> send UNKNOWN TLS VERSION ?0304? [length 0001] 
(4) eap_peap: >>> send UNKNOWN TLS VERSION ?0304? [length 0039] 
...

Dočasným řešením může být přidání parametru tls_max_version = "1.2" do konfiguračního souboru eap.

diff --git a/ansible-freeradius/templates/eap.j2 b/ansible-freeradius/templates/eap.j2
index 0ad959d..c878c33 100644
--- a/ansible-freeradius/templates/eap.j2
+++ b/ansible-freeradius/templates/eap.j2
@@ -173,6 +173,7 @@ eap {
        #  ANYONE who has a certificate signed by them can
        #  authenticate via EAP-TLS!  This is likely not what you want.
        tls-config tls-common {
+               tls_max_version = "1.2"
 {% if eduroam.EAP is defined %}
 {% if eduroam.EAP.private_key_password is defined %}
                private_key_password = {{ eduroam.EAP.private_key_password }}

ansible_fqdn je ziskavano z DNS, je lepsi pouzvat inventory_hostname ktery mame staticky nadefinovany v inventory (tedy za predpokladu ze si tam pisem plny jmena)

Při použití pomlčky v názvu serveru skončí skript chybou.

Pro radius.moje-domena.cz (chyba):
fatal: [radius.moje-domena.cz]: FAILED! => {"msg": "The conditional check '(eduroam.mode == 'IdPSP') and (ldap is defined)' failed. The error was: error while evaluating conditional ((eduroam.mode == 'IdPSP') and (ldap is defined)): 'domena_cz' is undefined\n\nThe error appears to have been in '/root/instalace_freeradius/roles/freeradius/tasks/main.yml': line 25, column 3, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n\n- name: Install/update FreeRADIUS LDAP module\n ^ here\n"}

Pro radius.mojedomena.cz (vše v pořádku):

...
...
...
PLAY RECAP *******************************************************************
radius.mojedomena.cz          : ok=28   changed=12   unreachable=0    failed=0

Pro správnou funkčnost rad_eap_test je potřeba v Debianu Buster doinstalovat balíčky bc a libnl-genl-3-200

root@radius:~# rad_eap_test -H 127.0.0.1 -P 1812 -S secret -u [email protected] -p password -m WPA-EAP -e PEAP -t 5 2>&1 | head -n 2
bc is required by rad_eap_test, please install if first.

root@radius:~# apt -y install bc
root@radius:~# rad_eap_test -H 127.0.0.1 -P 1812 -S secret -u [email protected] -p password -m WPA-EAP -e PEAP -t 5 2>&1 | head -n 1
eapol_test returned error: /usr/local/bin/eapol_test: error while loading shared libraries: libnl-genl-3.so.200: cannot open shared object file: No such file or directory

root@radius:~# apt -y install libnl-genl-3-200
root@radius:~# rad_eap_test -H 127.0.0.1 -P 1812 -S secret -u [email protected] -p password -m WPA-EAP -e PEAP -t 5
access-accept; 0.53 sec |rtt=533ms;;;0;5000 accept=1;0.5:;0:;0;1