Difference between revisions of "FreeRADIUS"
Jump to navigation
Jump to search
Michael.mast (talk | contribs) (→sssd) |
Michael.mast (talk | contribs) (→sssd) |
||
| Line 34: | Line 34: | ||
</pre> | </pre> | ||
====sssd==== | ====sssd==== | ||
| + | *I precreated a group called wifiaccess. Members of this account will be allowed to access the wifi. | ||
<pre> | <pre> | ||
sudo yum -y install sssd realmd adcli samba-common-tools | sudo yum -y install sssd realmd adcli samba-common-tools | ||
| − | sudo realm join -U | + | sudo realm join -U domain_admin yourdomain.net |
| + | sudo realm permit -g wifiaccess | ||
</pre> | </pre> | ||
Revision as of 12:16, 2 July 2021
Contents
Purpose
RADIUS server for WPA Enterprise authentication
Install
Amazon Linux 2
- Set DNS servers to DCs to be used
- Set Chrony sources to use the DCs, comment out the Amazon pools.
- Set static IP, add to Windows DNS.
- Install FreeRadius packages.
sudo yum -y install freeradius freeradius-utils
- Update /etc/raddb/radiusd.conf user and group from radiusd to root. Though I have done this with another radius server running google auth, I think there should be a better option. More research should be done.
- Uncomment pam module from /etc/raddb/sites-enabled/default
- Create symlink for pam module
sudo ln -s /etc/raddb/mods-available/pam /etc/raddb/mods-enabled/pam
- Update /etc/raddb/users by adding the default auth type to PAM. It is also common practice to uncomment the disabled group.
DEFAULT Group == "disabled", Auth-Type := Reject
Reply-Message = "Your account has been disabled."
DEFAULT Auth-Type := PAM
- Add your client, in this case I added a subnet where the access points reside.
client wifi {
ipaddr = 192.168.1.0/24
secret = somesecret
require_message_authenticator = no
nas_type = other
}
sssd
- I precreated a group called wifiaccess. Members of this account will be allowed to access the wifi.
sudo yum -y install sssd realmd adcli samba-common-tools sudo realm join -U domain_admin yourdomain.net sudo realm permit -g wifiaccess
