> For the complete documentation index, see [llms.txt](https://ajuda.rnp.br/eduroam/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajuda.rnp.br/eduroam/manual-do-administrador/instalacao-manual/ubuntu-22.04-com-freeradius-3.2.4.md).
# Ubuntu 22.04 com Freeradius 3.2.4
INSTALANDO O IDP NA INSTITUIÇÃO CLIENTE
## Freeradius
### **Instalando FreeRADIUS 3.2.4 no Ubuntu Jammy 22.04.4 LTS**
Adicione a [chave pública NetworkRADIUS PGP](https://packages.networkradius.com/pgp/packages%40networkradius.com) :\
```
install -d -o root -g root -m 0755 /etc/apt/keyrings
curl -s 'https://packages.networkradius.com/pgp/packages%40networkradius.com' | \
sudo tee /etc/apt/keyrings/packages.networkradius.com.asc > /dev/null
```
\
Adicione um arquivo de preferências APT para garantir que todos os pacotes freeradius sejam instalados do repositório Network RADIUS:
```
printf 'Package: /freeradius/\nPin: origin "packages.networkradius.com"\nPin-Priority: 999\n' | \
sudo tee /etc/apt/preferences.d/networkradius > /dev/null
```
Adicione a lista de fontes do APT:
```
echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/packages.networkradius.com.asc] http://packages.networkradius.com/freeradius-3.2/ubuntu/jammy jammy main" | \
sudo tee /etc/apt/sources.list.d/networkradius.list > /dev/null
```
Por fim, atualize o banco de dados APT e instale os pacotes:
```
sudo apt-get update
sudo apt-get install freeradius
```
Comandos úteis:\
systemctl status freeradius.service\
systemctl start freeradius.service\
systemctl stop freeradius.service\
\
Rodar o Freeradius em modo de debug no nível máximo:\
systemctl stop freeradius.service\
freeradius -fxxxxx -lstdout\
systemctl start freeradius.service\
\
Verificar se as configurações do Freeradius estão OK:\
freeradius -CX
### Configurando o Freeradius
#### clients.conf
vim /etc/freeradius/clients.conf
```
# Este bloco libera a consulta em localhost
client localhost {
ipaddr = 127.0.0.1
proto = *
secret = radsec
require_message_authenticator = no
shortname = localhost
nas_type = other # localhost isn't usually a NAS...
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
# Este bloco libera a consulta em localhost usando IPv6
client localhost_ipv6 {
ipv6addr = ::1
secret = radsec
}
# IP da controladora da sua instituicao
client 200.130.66.29 {
ipaddr = 200.130.66.29
shortname = Campus_Campinas
secret = radsec
require_message_authenticator = no
nastype = other
}
```
\#
## proxy.conf
vim /etc/freeradius/proxy.conf
```
proxy server {
default_fallback = no
}
home_server localhost {
type = auth
ipaddr = 127.0.0.1
port = 1812
secret = radsec
response_window = 20
zombie_period = 40
revive_interval = 120
status_check = status-server
check_interval = 30
check_timeout = 4
num_answers_to_alive = 3
max_outstanding = 65536
coa {
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
limit {
max_connections = 16
max_requests = 0
lifetime = 0
idle_timeout = 0
}
}
home_server_pool my_localhost {
type = fail-over
home_server = localhost
}
realm DEFAULT {
}
realm LOCAL {
}
realm NULL {
secret = radsec
}
# Expressao para subdominios de sua instituicao
realm "~(.*\.)*sua_instituicao.br$" {
auth_pool = my_localhost
secret = radsec
}
```
\
### Configurando o arquivo default
vim /etc/freeradius/sites-enabled/default
```
server default {
listen {
type = auth
ipaddr = *
port = 0
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
listen {
ipaddr = *
port = 0
type = acct
limit {
}
}
listen {
type = auth
ipv6addr = :: # any. ::1 == localhost
port = 0
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
listen {
ipv6addr = ::
port = 0
type = acct
limit {
}
}
authorize {
filter_username
preprocess
chap
mschap
digest
suffix
# Expressao para subdominios
if ( Realm =~ /sua_instituicao.br/i ) {
update control {
&Proxy-To-Realm := LOCAL
}
}
eap {
ok = return
}
files
-sql
-ldap
expiration
logintime
pap
}
authenticate {
Auth-Type PAP {
pap
}
Auth-Type CHAP {
chap
}
Auth-Type MS-CHAP {
mschap
}
mschap
digest
eap
}
preacct {
preprocess
acct_unique
files
}
accounting {
linelog
detail
unix
#radutmp
-sql
exec
attr_filter.accounting_response
log_accounting
}
post-auth {
update {
&reply: += &session-state:
}
-sql
-ldap
exec
remove_reply_message_if_eap
Post-Auth-Type REJECT {
-sql
attr_filter.access_reject
eap
remove_reply_message_if_eap
}
}
pre-proxy {
update proxy-request {
Operator-Name = "1sua_instituicao.br"
Eduroam-SP-Country = "BR"
}
}
post-proxy {
eap
}
}
```
### Configurando o arquivo inner-tunnel
```
vim /etc/freeradius/sites-enabled/inner-tunnel
```
```
server inner-tunnel {
listen {
type = auth
ipaddr = *
port = 18120
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
authorize {
filter_username
preprocess
chap
mschap
digest
suffix
# Expressao para subdominios
if ( Realm =~ /sua_instituicao/i ) {
update control {
&Proxy-To-Realm := LOCAL
}
}
eap {
ok = return
}
files
-sql
-ldap
expiration
logintime
pap
}
authenticate {
Auth-Type PAP {
pap
}
Auth-Type CHAP {
chap
}
Auth-Type MS-CHAP {
mschap
}
mschap
digest
eap
}
preacct {
preprocess
acct_unique
files
}
accounting {
detail
unix
-sql
exec
attr_filter.accounting_response
}
session {
}
post-auth {
update {
&reply: += &session-state:
}
-sql
-ldap
exec
remove_reply_message_if_eap
Post-Auth-Type REJECT {
-sql
attr_filter.access_reject
eap
remove_reply_message_if_eap
}
}
pre-proxy {
update proxy-request {
Operator-Name = "1sua_instituicao.br"
Eduroam-SP-Country = "BR"
}
}
post-proxy {
eap
}
}
```
\
### Configurando o arquivo radsec
vim /etc/freeradius/sites-enabled/radsec
```
listen {
ipaddr = *
port = 2083
type = auth
proto = tcp
virtual_server = default
clients = radsec
limit {
max_connections = 0
lifetime = 0
idle_timeout = 3600
}
tls {
certdir = ${confdir}/certs
cadir = ${confdir}/certs
private_key_password = whatever
private_key_file = ${certdir}/server.pem
certificate_file = ${certdir}/server.pem
ca_file = ${cadir}/ca.pem
dh_file = ${certdir}/dh
random_file = /dev/urandom
fragment_size = 8192
ca_path = ${cadir}
include_length = yes
cipher_list = "DEFAULT"
cipher_server_preference = no
tls_min_version = "1.2"
tls_max_version = "1.3"
ecdh_curve = ""
cache {
enable = yes
lifetime = 24 # hours
}
require_client_cert = yes
verify {
}
}
}
listen {
ipv6addr = ::
port = 2083
type = auth
proto = tcp
clients = radsec
limit {
max_connections = 0
lifetime = 0
idle_timeout = 600
}
tls {
certdir = ${confdir}/certs
cadir = ${confdir}/certs
private_key_password = whatever
private_key_file = ${certdir}/server.pem
certificate_file = ${certdir}/server.pem
ca_file = ${cadir}/ca.pem
dh_file = ${certdir}/dh
random_file = /dev/urandom
fragment_size = 8192
ca_path = ${cadir}
include_length = yes
cipher_list = "DEFAULT"
cipher_server_preference = no
tls_min_version = "1.2"
tls_max_version = "1.3"
ecdh_curve = ""
cache {
enable = yes
max_entries = 255
}
require_client_cert = yes
verify {
}
}
}
clients radsec {
limit {
max_connections = 0
lifetime = 0
idle_timeout = 3600
}
client 127.0.0.1 {
ipaddr = 127.0.0.1
proto = tls
secret = radsec
}
client rps01 {
ipaddr = rps01.eduroam.org.br
proto = tls
secret = radsec
limit {
max_connections = 0
lifetime = 0
idle_timeout = 3600
}
}
client rps02 {
ipaddr = rps02.eduroam.org.br
proto = tls
secret = radsec
limit {
max_connections = 0
lifetime = 0
idle_timeout = 3600
}
}
}
# local test listener for debug (present by default)
listen {
ipaddr = 127.0.0.1
port = 4000
type = auth
}
home_server rps01 {
ipaddr = rps01.eduroam.org.br
port = 2083
type = auth
secret = radsec
proto = tcp
status_check = none
tls {
certdir = ${confdir}/certs
cadir = ${confdir}/certs
private_key_password = whatever
private_key_file = ${certdir}/server.pem
certificate_file = ${certdir}/server.pem
ca_file = ${cadir}/ca.pem
dh_file = ${certdir}/dh
random_file = /dev/urandom
fragment_size = 8192
ca_path = ${cadir}
include_length = yes
cipher_list = "DEFAULT"
cipher_server_preference = no
tls_min_version = "1.2"
tls_max_version = "1.3"
ecdh_curve = ""
}
}
home_server rps02 {
ipaddr = rps02.eduroam.org.br
port = 2083
type = auth
secret = radsec
proto = tcp
status_check = none
tls {
certdir = ${confdir}/certs
cadir = ${confdir}/certs
private_key_password = whatever
private_key_file = ${certdir}/server.pem
certificate_file = ${certdir}/server.pem
ca_file = ${cadir}/ca.pem
dh_file = ${certdir}/dh
random_file = /dev/urandom
fragment_size = 8192
ca_path = ${cadir}
include_length = yes
cipher_list = "DEFAULT"
cipher_server_preference = no
tls_min_version = "1.2"
tls_max_version = "1.3"
ecdh_curve = ""
}
}
home_server_pool BR {
type = fail-over
home_server = rps01
home_server = rps02
}
realm "~.+$" {
auth_pool = BR
nostrip
}
```
### configurando o arquivo eap
vim /etc/freeradius/mods-enabled/eap
```
eap {
default_eap_type = peap
timer_expire = 60
ignore_unknown_eap_types = no
cisco_accounting_username_bug = no
max_sessions = ${max_requests}
md5 {
}
leap {
}
gtc {
auth_type = PAP
}
tls-config tls-common {
cipher_server_preference = yes
require_client_cert = yes
private_key_password = whatever
private_key_file = ${certdir}/server.pem
certificate_file = ${certdir}/server.pem
ca_file = ${cadir}/ca.pem
cipher_list = "DEFAULT"
cipher_server_preference = no
tls_min_version = "1.2"
tls_max_version = “1.2”
ecdh_curve = ""
cache {
enable = no
lifetime = 24 # hours
}
verify {
}
ocsp {
enable = no
override_cert_url = yes
url = "http://127.0.0.1/ocsp/"
}
}
tls {
tls = tls-common
}
ttls {
tls = tls-common
default_eap_type = mschapv2
copy_request_to_tunnel = yes
use_tunneled_reply = yes
virtual_server = "inner-tunnel"
}
peap {
tls = tls-common
default_eap_type = mschapv2
copy_request_to_tunnel = yes
use_tunneled_reply = yes
virtual_server = "inner-tunnel"
}
mschapv2 {
}
}
```
vim /etc/freeradius/mods-enabled/eap
cd /etc/freeradius/certs
openssl dhparam -out dh -2 2048
cp seu\_certificado\_recebito\_da\_rnp.crt /etc/freeradius/certs/server.pem
cat seu\_certificado\_recebito\_da\_rnp.key /etc/freeradius/certs/server.pem
cat rnp-ca.crt /etc/freeradius/certs/ca.pem
#### Agora precisamos configurar se o servidor da instituição vai se conectar com a base LDAP ou com o AD. Configurando o servidor para autenticar os usuários no LDAP
vim /etc/freeradius/mods-available/ldap
\# -\*- text -\*-\
\#\
\# $Id: 015ae6907b8113771691ae3a3c1d53b05756d143 $
\#\
\# Lightweight Directory Access Protocol (LDAP)\
\#\
ldap {\
\# Note that this needs to match the name(s) in the LDAP server\
\# certificate, if you're using ldaps. See OpenLDAP documentation\
\# for the behavioral semantics of specifying more than one host.\
\#\
\# Depending on the libldap in use, server may be an LDAP URI.\
\# In the case of OpenLDAP this allows additional the following\
\# additional schemes:\
\# - ldaps\:// (LDAP over SSL)\
\# - ldapi:// (LDAP over Unix socket)\
\# - ldapc:// (Connectionless LDAP)\
**server** = 'IP\_ou\_nome\_do\_seu\_servidor\_ldap'
\# Port to connect on, defaults to 389, will be ignored for LDAP URIs.\
**port** = 389
\# Administrator account for searching and possibly modifying.\
\# If using SASL + KRB5 these should be commented out.\
**identity** = 'uid=app.idpeduroam.r,ou=APLICACOES,dc=dominio,dc=local'\
**password** = Xlhtuop0
\# Unless overridden in another section, the dn from which all\
\# searches will start from.\
**base\_dn** = 'dc=seu\_dominio,dc=local'
\#\
\# You can run the 'ldapsearch' command line tool using the\
\# parameters from this module's configuration.\
\#\
\# ldapsearch -D ${identity} -w ${password} -h ${server} -b 'CN=user,${base\_dn}'\
\#\
\# That will give you the LDAP information for 'user'.\
\#\
\# Group membership can be queried by using the above "ldapsearch" string,\
\# and adding "memberof" qualifiers. For ActiveDirectory, use:\
\#\
\# ldapsearch ... '(&(objectClass=user)(sAMAccountName=user)(memberof=CN=group,${base\_dn}))'\
\#\
\# Where 'user' is the user as above, and 'group' is the group you are querying for.\
\#
\#\
\# SASL parameters to use for admin binds\
\#\
\# When we're prompted by the SASL library, these control\
\# the responses given, as well as the identity and password\
\# directives above.\
\#\
\# If any directive is commented out, a NULL response will be\
\# provided to cyrus-sasl.\
\#\
\# Unfortunately the only way to control Keberos here is through\
\# environmental variables, as cyrus-sasl provides no API to\
\# set the krb5 config directly.\
\#\
\# Full documentation for MIT krb5 can be found here:\
\#\
\#
\#\
\# At a minimum you probably want to set KRB5\_CLIENT\_KTNAME.\
\#\
sasl {\
\# SASL mechanism\
\# mech = 'PLAIN'
\# SASL authorisation identity to proxy.\
\# proxy = 'autz\_id'
\# SASL realm. Used for kerberos.\
\# realm = 'example.org'\
}
\#\
\# Generic valuepair attribute\
\#
\# If set, this will attribute will be retrieved in addition to any\
\# mapped attributes.\
\#\
\# Values should be in the format:\
\# \ \ \\
\#\
\# Where:\
\# \: Is the attribute you wish to create\
\# with any valid list and request qualifiers.\
\# \: Is any assignment operator (=, :=, +=, -=).\
\# \: Is the value to parse into the new valuepair.\
\# If the value is wrapped in double quotes it\
\# will be xlat expanded.\
\# valuepair\_attribute = 'radiusAttribute'
\#\
\# Mapping of LDAP directory attributes to RADIUS dictionary attributes.\
\#
\# WARNING: Although this format is almost identical to the unlang\
\# update section format, it does \*NOT\* mean that you can use other\
\# unlang constructs in module configuration files.\
\#\
\# Configuration items are in the format:\
\# \ \ \\
\#\
\# Where:\
\# \: Is the destination RADIUS attribute\
\# with any valid list and request qualifiers.\
\# \: Is any assignment attribute (=, :=, +=, -=).\
\# \: Is the attribute associated with user or\
\# profile objects in the LDAP directory.\
\# If the attribute name is wrapped in double\
\# quotes it will be xlat expanded.\
\#\
\# Request and list qualifiers may also be placed after the 'update'\
\# section name to set defaults destination requests/lists\
\# for unqualified RADIUS attributes.\
\#\
\# Note: LDAP attribute names should be single quoted unless you want\
\# the name value to be derived from an xlat expansion, or an\
\# attribute ref.\
update {\
control:Password-With-Header += 'userPassword'\
\# control:NT-Password := 'ntPassword'\
control:NT-Password := 'sambaNTPassword'\
reply:Reply-Message := 'radiusReplyMessage'\
reply:Tunnel-Type := 'radiusTunnelType'\
reply:Tunnel-Medium-Type := 'radiusTunnelMediumType'\
reply:Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId'
\# Where only a list is specified as the RADIUS attribute,\
\# the value of the LDAP attribute is parsed as a valuepair\
\# in the same format as the 'valuepair\_attribute' (above).\
control: += 'radiusControlAttribute'\
request: += 'radiusRequestAttribute'\
reply: += 'radiusReplyAttribute'\
}
\# Set to yes if you have eDirectory and want to use the universal\
\# password mechanism.\
\# edir = no
\# Set to yes if you want to bind as the user after retrieving the\
\# Cleartext-Password. This will consume the login grace, and\
\# verify user authorization.\
\# edir\_autz = no
\# Note: set\_auth\_type was removed in v3.x.x\
\#\
\# Equivalent functionality can be achieved by adding the\
\# following "if" statement to the authorize {} section of\
\# the virtual server, after the "ldap" module. For example:\
\#\
\# ...\
\# ldap\
\# if ((ok || updated) && User-Password && !control:Auth-Type) {\
\# update {\
\# control:Auth-Type := ldap\
\# }\
\# }\
\# ...\
\#\
\# You will also need to uncomment the "Auth-Type LDAP" block in the\
\# "authenticate" section.\
\#
\#\
\# Name of the attribute that contains the user DN.\
\# The default name is LDAP-UserDn.\
\#\
\# If you have multiple LDAP instances, you should\
\#\
\# ${.:instance}-LDAP-UserDn\
\#\
\# That change allows the modules to set their own\
\# User DN, and to not conflict with each other.\
\#\
user\_dn = "LDAP-UserDn"
\#\
\# User object identification.\
\#\
user {\
\# Where to start searching in the tree for users\
base\_dn = "${..base\_dn}"
\# Filter for user objects, should be specific enough\
\# to identify a single user object.\
\#\
\# For Active Directory, you should use\
\# "samaccountname=" instead of "uid="\
\#\
\# filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})"\
\# filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
\# Exemplo abaixo para instituicao utilizando OR para autenticar somente pelo uid ou pelo email\
\# filter = "(|(uid=%{%{Stripped-User-Name}:-%{User-Name}})(mail=%{User-Name}))"\
\#\
filter = "(mail=%{User-Name})"
\# For Active Directory nested group, you should comment out the previous 'filter = ...'\
\# and use the below. Where 'group' is the group you are querying for.\
\#\
\# NOTE: The string '1.2.840.113556.1.4.1941' specifies LDAP\_MATCHING\_RULE\_IN\_CHAIN.\
\# This applies only to DN attributes. This is an extended match operator that walks\
\# the chain of ancestry in objects all the way to the root until it finds a match.\
\# This reveals group nesting. It is available only on domain controllers with\
\# Windows Server 2003 SP2 or Windows Server 2008 (or above).\
\#\
\# See:
\#\
\# filter = "(&(objectClass=user)(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf:1.2.840.113556.1.4.1941:=cn=group,${..base\_dn}))"
\# SASL parameters to use for user binds\
\#\
\# When we're prompted by the SASL library, these control\
\# the responses given.\
\#\
\# Any of the config items below may be an attribute ref\
\# or and expansion, so different SASL mechs, proxy IDs\
\# and realms may be used for different users.\
sasl {\
\# SASL mechanism\
\# mech = 'PLAIN'
\# SASL authorisation identity to proxy.\
\# proxy = \&User-Name
\# SASL realm. Used for kerberos.\
\# realm = 'example.org'\
}
\# Search scope, may be 'base', 'one', sub' or 'children'\
\# scope = 'sub'
\# Server side result sorting\
\#\
\# A list of space delimited attributes to order the result\
\# set by, if the filter matches multiple objects.\
\# Only the first result in the set will be processed.\
\#\
\# If the attribute name is prefixed with a hyphen '-' the\
\# sorting order will be reversed for that attribute.\
\#\
\# If sort\_by is set, and the server does not support sorting\
\# the search will fail.\
\# sort\_by = '-uid'
\# If this is undefined, anyone is authorised.\
\# If it is defined, the contents of this attribute\
\# determine whether or not the user is authorised\
\# access\_attribute = 'dialupAccess'
\# Control whether the presence of 'access\_attribute'\
\# allows access, or denys access.\
\#\
\# If 'yes', and the access\_attribute is present, or\
\# 'no' and the access\_attribute is absent then access\
\# will be allowed.\
\#\
\# If 'yes', and the access\_attribute is absent, or\
\# 'no' and the access\_attribute is present, then\
\# access will not be allowed.\
\#\
\# If the value of the access\_attribute is 'false', it\
\# will negate the result.\
\#\
\# e.g.\
\# access\_positive = yes\
\# access\_attribute = userAccessAllowed\
\#\
\# With an LDAP object containing:\
\# userAccessAllowed: false\
\#\
\# Will result in the user being locked out.\
\# access\_positive = yes\
}
\#\
\# User membership checking.\
\#\
group {\
\# Where to start searching in the tree for groups\
base\_dn = "${..base\_dn}"
\# Filter for group objects, should match all available\
\# group objects a user might be a member of.\
\#\
\# If using Active Directory you are likely to need "group"\
\# instead of "posixGroup".\
filter = '(objectClass=posixGroup)'
\# Search scope, may be 'base', 'one', sub' or 'children'\
\# scope = 'sub'
\# Attribute that uniquely identifies a group.\
\# Is used when converting group DNs to group\
\# names.\
\# name\_attribute = cn
\# Filter to find all group objects a user is a member of.\
\# That is, group objects with attributes that\
\# identify members (the inverse of membership\_attribute).\
\#\
\# Note that this configuration references the "user\_dn"\
\# configuration defined above.\
\#\
\# membership\_filter = "(|(member=%{control:${..user\_dn}})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))"
\# The attribute, in user objects, which contain the names\
\# or DNs of groups a user is a member of.\
\#\
\# Unless a conversion between group name and group DN is\
\# needed, there's no requirement for the group objects\
\# referenced to actually exist.\
\#\
\# If the LDAP server does not support the "memberOf"\
\# attribute (or equivalent), then you will need to use the\
\# membership\_filter option above instead. If you can't see\
\# the memberOf attribute then it is also possible that the\
\# LDAP bind user does not have the correct permissions to\
\# view it.\
membership\_attribute = 'memberOf'
\# If cacheable\_name or cacheable\_dn are enabled,\
\# all group information for the user will be\
\# retrieved from the directory and written to LDAP-Group\
\# attributes appropriate for the instance of rlm\_ldap.\
\#\
\# For group comparisons these attributes will be checked\
\# instead of querying the LDAP directory directly.\
\#\
\# This feature is intended to be used with rlm\_cache.\
\#\
\# If you wish to use this feature, you should enable\
\# the type that matches the format of your check items\
\# i.e. if your groups are specified as DNs then enable\
\# cacheable\_dn else enable cacheable\_name.\
\# cacheable\_name = 'no'\
\# cacheable\_dn = 'no'
\# Override the normal cache attribute (\-LDAP-Group or\
\# LDAP-Group if using the default instance) and create a\
\# custom attribute. This can help if multiple module instances\
\# are used in fail-over.\
\# cache\_attribute = 'LDAP-Cached-Membership'
\# If the group being checked is specified as a name, but\
\# the user's groups are referenced by DN, and one of those\
\# group DNs is invalid, the whole group check is treated as\
\# invalid, and a negative result will be returned.\
\# When set to 'yes', this option ignores invalid DN\
\# references.\
\# allow\_dangling\_group\_ref = 'no'\
}
\#\
\# User profiles. RADIUS profile objects contain sets of attributes\
\# to insert into the request. These attributes are mapped using\
\# the same mapping scheme applied to user objects (the update section above).\
\#\
profile {\
\# Filter for RADIUS profile objects\
\# filter = '(objectclass=radiusprofile)'
\# The default profile. This may be a DN or an attribute\
\# reference.\
\# To get old v2.2.x style behaviour, or to use the\
\# \&User-Profile attribute to specify the default profile,\
\# set this to \&control:User-Profile.\
\# default = 'cn=radprofile,dc=example,dc=org'
\# The LDAP attribute containing profile DNs to apply\
\# in addition to the default profile above. These are\
\# retrieved from the user object, at the same time as the\
\# attributes from the update section, are are applied\
\# if authorization is successful.\
\# attribute = 'radiusProfileDn'\
}
\#\
\# Bulk load clients from the directory\
\#\
client {\
\# Where to start searching in the tree for clients\
base\_dn = "${..base\_dn}"
\#\
\# Filter to match client objects\
\#\
filter = '(objectClass=radiusClient)'
\# Search scope, may be 'base', 'one', 'sub' or 'children'\
\# scope = 'sub'
\#\
\# Sets default values (not obtained from LDAP) for new client entries\
\#\
template {\
\# login = 'test'\
\# password = 'test'\
\# proto = tcp\
\# require\_message\_authenticator = yes
\# Uncomment to add a home\_server with the same\
\# attributes as the client.\
\# coa\_server {\
\# response\_window = 2.0\
\# }\
}
\#\
\# Client attribute mappings are in the format:\
\# \ = \\
\#\
\# The following attributes are required:\
\# \* ipaddr | ipv4addr | ipv6addr - Client IP Address.\
\# \* secret - RADIUS shared secret.\
\#\
\# All other attributes usually supported in a client\
\# definition are also supported here.\
\#\
\# Schemas are available in doc/schemas/ldap for openldap and eDirectory\
\#\
attribute {\
ipaddr = 'radiusClientIdentifier'\
secret = 'radiusClientSecret'\
\# shortname = 'radiusClientShortname'\
\# nas\_type = 'radiusClientType'\
\# virtual\_server = 'radiusClientVirtualServer'\
\# require\_message\_authenticator = 'radiusClientRequireMa'\
}\
}
\# Load clients on startup\
\# read\_clients = no
\#\
\# Modify user object on receiving Accounting-Request\
\#
\# Useful for recording things like the last time the user logged\
\# in, or the Acct-Session-ID for CoA/DM.\
\#\
\# LDAP modification items are in the format:\
\# \ \ \\
\#\
\# Where:\
\# \: The LDAP attribute to add modify or delete.\
\# \: One of the assignment operators:\
\# (:=, +=, -=, ++).\
\# Note: '=' is \*not\* supported.\
\# \: The value to add modify or delete.\
\#\
\# WARNING: If using the ':=' operator with a multi-valued LDAP\
\# attribute, all instances of the attribute will be removed and\
\# replaced with a single attribute.\
\# NAO PRECISA COMENTAR AS LINHAS ABAIXO PARA LDAP OU AD\
accounting {\
reference = "%{tolower:type.%{Acct-Status-Type}}"
type {\
start {\
update {\
description := "Online at %S"\
}\
}
interim-update {\
update {\
description := "Last seen at %S"\
}\
}
stop {\
update {\
description := "Offline at %S"\
}\
}\
}\
}
\#\
\# Post-Auth can modify LDAP objects too\
\#
post-auth {\
\# COMENTAR O BLOCO ABAIXO POIS ELE TENTA GRAVAR NO AD/LDAP O HORARIO DE AUTENTICACAO\
\#update {\
\# description := "Authenticated at %S"\
\# }\
}
\#\
\# LDAP connection-specific options.\
\#\
\# These options set timeouts, keep-alives, etc. for the connections.\
\#\
options {\
\# Control under which situations aliases are followed.\
\# May be one of 'never', 'searching', 'finding' or 'always'\
\# default: libldap's default which is usually 'never'.\
\#\
\# LDAP\_OPT\_DEREF is set to this value.\
\# dereference = 'always'
\#\
\# The following two configuration items control whether the\
\# server follows references returned by LDAP directory.\
\# They are mostly for Active Directory compatibility.\
\# If you set these to 'no', then searches will likely return\
\# 'operations error', instead of a useful result.\
\#\
chase\_referrals = yes\
rebind = yes
\# SASL Security Properties (see SASL\_SECPROPS in ldap.conf man page).\
\# Note - uncomment when using GSS-API sasl mechanism along with TLS\
\# encryption against Active-Directory LDAP servers (this disables\
\# sealing and signing at the GSS level as required by AD).\
\#sasl\_secprops = 'noanonymous,noplain,maxssf=0'
\# Seconds to wait for LDAP query to finish. default: 20\
res\_timeout = 10
\# Seconds LDAP server has to process the query (server-side\
\# time limit). default: 20\
\#\
\# LDAP\_OPT\_TIMELIMIT is set to this value.\
srv\_timelimit = 3
\# Seconds to wait for response of the server. (network\
\# failures) default: 10\
\#\
\# LDAP\_OPT\_NETWORK\_TIMEOUT is set to this value.\
net\_timeout = 1
\# LDAP\_OPT\_X\_KEEPALIVE\_IDLE\
idle = 60
\# LDAP\_OPT\_X\_KEEPALIVE\_PROBES\
probes = 3
\# LDAP\_OPT\_X\_KEEPALIVE\_INTERVAL\
interval = 3
\# ldap\_debug: debug flag for LDAP SDK\
\# (see OpenLDAP documentation). Set this to enable\
\# huge amounts of LDAP debugging on the screen.\
\# You should only use this if you are an LDAP expert.\
\#\
\# default: 0x0000 (no debugging messages)\
\# Example:(LDAP\_DEBUG\_FILTER+LDAP\_DEBUG\_CONNS)\
ldap\_debug = 0x0028\
}
\#\
\# This subsection configures the tls related items\
\# that control how FreeRADIUS connects to an LDAP\
\# server. It contains all of the 'tls\_\*' configuration\
\# entries used in older versions of FreeRADIUS. Those\
\# configuration entries can still be used, but we recommend\
\# using these.\
\#\
tls {\
\# Set this to 'yes' to use TLS encrypted connections\
\# to the LDAP database by using the StartTLS extended\
\# operation.\
\#\
\# The StartTLS operation is supposed to be\
\# used with normal ldap connections instead of\
\# using ldaps (port 636) connections\
\# start\_tls = yes
\# ca\_file = ${certdir}/cacert.pem
\# ca\_path = ${certdir}\
\# certificate\_file = /path/to/radius.crt\
\# private\_key\_file = /path/to/radius.key\
\# random\_file = /dev/urandom
\# Certificate Verification requirements. Can be:\
\# 'never' (do not even bother trying)\
\# 'allow' (try, but don't fail if the certificate\
\# cannot be verified)\
\# 'demand' (fail if the certificate does not verify)\
\# 'hard' (similar to 'demand' but fails if TLS\
\# cannot negotiate)\
\#\
\# The default is libldap's default, which varies based\
\# on the contents of ldap.conf.
\# require\_cert = 'demand'
\#\
\# Minimum TLS version to accept. We STRONGLY recommend\
\# setting this to "1.2"\
\#\
\# tls\_min\_version = "1.2"\
}
\# As of version 3.0, the 'pool' section has replaced the\
\# following configuration items:\
\#\
\# ldap\_connections\_number
\# The connection pool is new for 3.0, and will be used in many\
\# modules, for all kinds of connection-related activity.\
\#\
\# When the server is not threaded, the connection pool\
\# limits are ignored, and only one connection is used.\
pool {\
\# Connections to create during module instantiation.\
\# If the server cannot create specified number of\
\# connections during instantiation it will exit.\
\# Set to 0 to allow the server to start without the\
\# directory being available.\
start = ${thread\[pool].start\_servers}
\# Minimum number of connections to keep open\
min = ${thread\[pool].min\_spare\_servers}
\# Maximum number of connections\
\#\
\# If these connections are all in use and a new one\
\# is requested, the request will NOT get a connection.\
\#\
\# Setting 'max' to LESS than the number of threads means\
\# that some threads may starve, and you will see errors\
\# like 'No connections available and at max connection limit'\
\#\
\# Setting 'max' to MORE than the number of threads means\
\# that there are more connections than necessary.\
max = ${thread\[pool].max\_servers}
\# Spare connections to be left idle\
\#\
\# NOTE: Idle connections WILL be closed if "idle\_timeout"\
\# is set. This should be less than or equal to "max" above.\
spare = ${thread\[pool].max\_spare\_servers}
\# Number of uses before the connection is closed\
\#\
\# 0 means "infinite"\
uses = 0
\# The number of seconds to wait after the server tries\
\# to open a connection, and fails. During this time,\
\# no new connections will be opened.\
retry\_delay = 30
\# The lifetime (in seconds) of the connection\
lifetime = 0
\# Idle timeout (in seconds). A connection which is\
\# unused for this length of time will be closed.\
idle\_timeout = 60
\# NOTE: All configuration settings are enforced. If a\
\# connection is closed because of 'idle\_timeout',\
\# 'uses', or 'lifetime', then the total number of\
\# connections MAY fall below 'min'. When that\
\# happens, it will open a new connection. It will\
\# also log a WARNING message.\
\#\
\# The solution is to either lower the 'min' connections,\
\# or increase lifetime/idle\_timeout.\
}\
}\
Agora precisamos criar o link para a ativação de autenticação via LDAP\
ln -s /etc/freeradius/mods-available/ldap /etc/freeradius/mods-enabled/ldap
Agora você pode executar o comando freeradius -CX para verificar se a configuração está OK
**Utilizando o Freeradius para autenticar os usuários no AD**\
Será necessário instalar os pacotes do samba
--------------------------------------------
Se ao instalar os pacotes, se aparecer alguma tela perguntando por alguma informação, você pode pressionar Enter, não precisa responder.\
*apt install krb5-user libpam-krb5 krb5-config libkrb5-3 libkadm5clnt-mit12 winbind systemd-timesyncd ntpdate samba samba-common samba-common-bin samba-dsdb-modules samba-libs samba-vfs-modules cifs-utils smbclient*
### krb5.conf
Configuração do arquivo krb5.conf \
vim /etc/krb5.conf
\[libdefaults]\
default\_realm = SEU\_DOMINIO.LOCAL\
dns\_lookup\_realm = true\
dns\_lookup\_kdc = true\
ticket\_lifetime = 24h\
renew\_lifetime = 7d\
forwardable = true\
rdns = false
\[realms]\
SEU\_DOMINIO.LOCAL = {\
kdc = 200.130.35.164\
kdc = 200.143.193.71\
admin\_server = 200.130.35.164\
default\_domain = seu\_dominio.local\
master\_kdc = 200.130.35.164 \
}
\[domain\_realm]\
seu\_dominio.local = SEU\_DOMINIO.LOCAL\
.seu\_dominio.local = SEU\_DOMINIO.LOCAL
\[login]\
krb4\_convert = true\
krb4\_get\_tickets = false
\[logging]\
libkrb5 = 0-/SYSLOG:\
default = FILE:/var/log/krb5libs.log\
kdc = FILE:/var/log/krb5kdc.log\
admin\_server = FILE:/var/log/kadmind.log\
Para testar se a configuração acima está funcionando, voce pode utilizar o seguinte comando:\
kinit
Para ver se você se autenticou pode utilizar o comando:\
klist
#### Configurando o arquivo do Samba
vim /etc/samba/smb.conf
\[global]\
netbios name = idp1\
security = ads\
realm = SEU\_DOMINIO.LOCAL\
workgroup = SEU\_DOMINIO\
server role = standalone server\
server string = EDUROAM RADIUS server\
invalid users = root\
socket options = TCP\_NODELAY\
idmap config \* : rangesize = 1000000\
idmap config \* : range = 1000000-19999999\
idmap config \* : backend = autorid\
winbind enum users = yes\
winbind enum groups = yes\
template homedir = /home/%D/%U\
template shell = /bin/bash\
client use spnego = yes\
client ntlmv2 auth = yes\
encrypt passwords = yes\
winbind use default domain = yes\
restrict anonymous = 2\
domain master = no\
local master = no\
preferred master = no\
os level = 0\
logging = syslog\@1 file\
log level = 1 smb:4 acls:4 locking:4\
log file = /var/log/samba/%m.log\
smbd profiling level = on\
pam password change = yes\
password server = \*
\#log level = 10\
\#debug pid = true\
\#max log size = 0
\# adicionado em 14-06-2023\
kerberos method = secrets and keytab\
client signing = yes
winbind offline logon = yes\
winbind request timeout = 10\
#### Vamos remover o arquivo resolv.conf e criar um novo
cp /etc/resolv.conf /etc/resolv.conf.bak
rm /etc/resolv.conf
vim /etc/resolv.conf
nameserver 200.130.35.164\
nameserver 18.229.209.221\
search SEU\_DOMINIO.LOCAL\
domain SEU\_DOMINIO.LOCAL
\
Ingressando a máquina no dominio do local \
net ads join -I ip\_ad -U user\_ad \
Para saber se a maquina ingressou com sucesso:\
net ads testjoin
Verificar o conteúdo do arquivo mschap\
vim /etc/freeradius/mods-enabled/mschap\
mschap {\
use\_mppe = yes\
require\_encryption = yes\
require\_strong = yes\
with\_ntdomain\_hack = yes\
ntlm\_auth = "/usr/bin/ntlm\_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}"\
}
\
Configurando o arquivo ntlm\_auth\
vim /etc/freeradius/mods-enabled/ntlm\_auth\
exec ntlm\_auth {\
wait = yes\
program = "/usr/bin/ntlm\_auth --request-nt-key --domain=SEU\_COMINIO.LOCAL --username=%{mschap:User-Name} --password=%{User-Password}"\
}
#### Agora reiniciar todos os serviços com stop e start
/etc/init.d/freeradius stop ; /etc/init.d/smbd stop ; /etc/init.d/nmbd stop ; /etc/init.d/winbind stop\
/etc/init.d/smbd start ; /etc/init.d/nmbd start ; /etc/init.d/winbind start ; /etc/init.d/freeradius start\
#### Agora você ja pode testar a autenticação com o comando radtest
radtest [login\_do\_usuario\_do\_ad@](mailto:login_do_usuario_do_ad@unicamp.br)seu\_dominio.br senha\_do\_usuario 127.0.0.1 0 radsec