Difference between revisions of "FreeRADIUS"
Jump to navigation
Jump to search
Michael.mast (talk | contribs) (→sssd) |
Michael.mast (talk | contribs) |
||
| Line 9: | Line 9: | ||
*Install FreeRadius packages. | *Install FreeRadius packages. | ||
<pre> | <pre> | ||
| − | sudo yum -y install freeradius freeradius-utils | + | sudo yum -y install freeradius freeradius-utils samba-winbind-clients |
</pre> | </pre> | ||
*Update /etc/raddb/radiusd.conf user and group from radiusd to root. Though I have done this with another radius server running google auth, I think there should be a better option. More research should be done. | *Update /etc/raddb/radiusd.conf user and group from radiusd to root. Though I have done this with another radius server running google auth, I think there should be a better option. More research should be done. | ||
| Line 32: | Line 32: | ||
nas_type = other | nas_type = other | ||
} | } | ||
| + | </pre> | ||
| + | *Start Winbind | ||
| + | <pre> | ||
| + | sudo systemctl status winbind.service | ||
</pre> | </pre> | ||
====sssd==== | ====sssd==== | ||
Revision as of 14:46, 6 July 2021
Contents
Purpose
RADIUS server for WPA Enterprise authentication
Install
Amazon Linux 2
- Set DNS servers to DCs to be used
- Set Chrony sources to use the DCs, comment out the Amazon pools.
- Set static IP, add to Windows DNS.
- Install FreeRadius packages.
sudo yum -y install freeradius freeradius-utils samba-winbind-clients
- Update /etc/raddb/radiusd.conf user and group from radiusd to root. Though I have done this with another radius server running google auth, I think there should be a better option. More research should be done.
- Uncomment pam module from /etc/raddb/sites-enabled/default
- Create symlink for pam module
sudo ln -s /etc/raddb/mods-available/pam /etc/raddb/mods-enabled/pam
- Update /etc/raddb/users by adding the default auth type to PAM. It is also common practice to uncomment the disabled group.
DEFAULT Group == "disabled", Auth-Type := Reject
Reply-Message = "Your account has been disabled."
DEFAULT Auth-Type := PAM
- Add your client, in this case I added a subnet where the access points reside.
client wifi {
ipaddr = 192.168.1.0/24
secret = somesecret
require_message_authenticator = no
nas_type = other
}
- Start Winbind
sudo systemctl status winbind.service
sssd
- I precreated a group called wifiaccess. Members of this account will be allowed to access the wifi.
sudo yum -y install sssd realmd adcli samba-common-tools sudo realm join -U domain_admin yourdomain.net sudo realm permit -g wifiaccess
