Project Primary Goal:
To install freeradius 2.1.3 on a Fedora 10 system and authenticate users from a Cisco 2950 switch 

Secondary Goal(s):
Join the Fedora system to an active directory.
Authenticate users via radius passing credentials thru to active directory server

Alot of the commands below require root privileges. I usually just start my terminal session by “su –login” to make things simplier for test lab configuration.

Steps Taken:
1.) Install Fedora 10 on a fresh box – I went with desktop standard install as it’s quick but for production I would recommend a more hardened minimized server install.

2.) As with pretty much any project involving Fedora 10 (and other older versions as well) fix the network. Assign the static route by either disabling network manager and setting it in conf files or disable selinux use network manager and double check your interfaces are coming up correctly and netmask is correct after a reboot.

3.) I went ahead and joined the Fedora system to active directory here. This has gotten way simplier in the new version. Go to system | adminsitration | authentication and then check the winbind option “enable winbind support”. Click configure winbind. Use the pre-windows 2000 name for you winbind domain. Security model set to ads, winbind ads real = your actual domain name (for my test that was GWNET.LOCAL), enter a valid fqdn of an active directory server for winbind domain controllers (more than one if you like), template shell as /bin/sh, and check the “allow offline login” – Click “Join Domain” – Assuming you don’t have firewall or network issues that should work pretty well with no additional effort. This was gonna be necessary for a secondary project goal so I figured I’d knock it out early. Easy secondary checkmark that used to seem way more complicated before the new interface.

4.) Install a c compiler and make (i.e. “yum install make”)

5.) Download and compile / install freeradius. I recommend the built in packages from the add/remove software for easiest implementation and maintanence.

6.) There’s probably gonna be a permission problem with your /etc/raddb/certs folder and it’s contents. “chmod 744 /etc/raddb/certs” takes care of that issue.

7.) Ensure firewall allows ports 1812 and 1813 – assuming you want to use the default radius authentication and accounting ports.

8.) Modify clients.conf to include the device you want to use with radius (i.e. Cisco Switch) For me that would be something like adding the following to the beginning or somewhere within the conf file:
client 10.1.1.3 {
secret = somesecretpassword
shortname = 10.1.1.3
nastype = cisco
login = someusername
login = someusername2
}
That’s just an example and this is for clear text authentication. Later I’ll work on verifying AD authentication.

9.) Modify /etc/raddb/users file. Add something like the following to the top of the file:
$enable15$ Cleartext-Password := “enablepasswordhere”
Service-Type = NAS-Prompt-User,
gw Cleartext-Password := “gwpasswordhere”
Service-Type = NAS-Prompt-User,
cisco-avpair = “shell:priv-lvl=15″
someusername2 Cleartext-Password := “someusers2passwordhere”
Service-Type = NAS-Prompt-User,

Basically you are just setting enable level 15 password, gw with enable level 15 at login and someusername2 with non-privileged login. You could set other enable level passwords as well and it’s probably not a bad idea for different support levels.

10.) Ok at this point I had made a lot of changes I wanted to make sure they stuck (especially related to services starting, domain status and networking being correct) so I went ahead and rebooted and checked everything was working as expected before continuing.

11.) Stop the radiusd server “service radiusd stop”.

12.) Configure the switch. Here’s an example to go with the above config.
enable
config t
aaa new-model
aaa authentication login gwlist group radius local
radius-server host 192.168.7.2
radius-server key somesecretpassword
line vty 0 4
login authentication gwlist
end
write mem

If you run your radius server on non-default ports just change the “radius-server host 192.168.7.2″ to something like “radius-server host 192.168.7.2 auth-port 2812 acct-port 2813″. But the default will be port 1812 and 1813 as mentiooned above.
I would also recommend enabling network time sync with the same server as the radius server.

13.) I went ahead and started the radiusd service in debug mode here so I could watch the traffic. “radiusd -X”. Then from a seperate admin laptop that was allowed access to the router I started telnet (testing only in production I would recommend disable telnet and enable ssh only). It asks for username (choose one you put in the users file) and password (associated users password). You should see information about the login attempt on your Fedora system where you started radiusd with the debug option “radiusd -X”. If you see it work and were authenticated on the switch to the correct enable level go ahead and ctrl-c your radiusd -X terminal and issue “service radiusd start”

I never got the active directory authentication working but I plan to come back to this soon. Especially since I have the fedora already set up on the domain and I verified I could use “ntlm_auth” to get tokens. I know the next step is to modify the /etc/raddb/mschap file. At the bottom of the file add or modify the existing ntlm_auth section.
ntlm_auth = “/usr/bin/ntlm_auth –request-nt-key –username=%{mschap:User-Name:-None} –domain=%{mschap:NT-Domain:-GWNET.LOCAL} –challenge=%{mschap:Challenge:-00} –nt-response=%{mschap:NT-Response:-00}”
If you know the remaining steps please leave a comment or send me an email and I’ll finish the project and this document.

As with most of my projects I do in GWLab I include a network diagram.

Freeradius 2.1.3 on Fedora 10