FreeRadius+Windows AD实现802.1X认证（20220405记录）

FreeRadius+Windows AD实现802.1X认证（20220405记录）

---

前言

使用开源radius对接AD域，无线AC控制器对接radius，实现用户通过AD账号密码验证，连接wifi。

FrReRADIUS介绍：

FrReRADIUS通过基于端口的访问控制提供身份验证。只有当认证服务器验证了证书时，用户才能连接到网络。用户证书通过使用802.1x标准的特殊认证协议来验证。（FreeRADIUS offers authentication via port based access control. A user can connect to the network only if its credentials have been validated by the authentication server. User credentials are verified by using special authentication protocols which belong to the 802.1X standard.—官方文档）

---

一、实验环境

1、CentOS 7.8（阿里yum源）
2、FreeRadius
3、AD域（现有AD域：域名abc.com，域服务器ads.abc.com）

二、配置步骤

2.1 Linux服务器的配置

关闭Selinux

vim /etc/selinux/config 
SELINUX=disabled
SELINUXTYPE=targeted

防火墙开启对应端口

firewall-cmd --add-port=1812/udp
firewall-cmd --add-port=1812/udp --permanent
firewall-cmd --add-port=1813/udp
firewall-cmd --add-port=1813/udp --permanent
firewall-cmd --add-port=139/tcp
firewall-cmd --add-port=139/tcp --permanent
firewall-cmd --add-port=445/tcp
firewall-cmd --add-port=445/tcp --permanent
firewall-cmd --reload
firewall-cmd --list-all

配置DNS

vim /etc/resolv.conf
nameserver x.x.x.x   #这里填写dns服务器地址，我这AD同时是DNS

2.2 freeradius/samba/krb5安装

yum install freeradius freeradius-ldap freeradius-utils -y
yum install libtalloc-devel -y
yum install openssl openssl-devel -y
yum install samba samba-client samba-winbind* samba-common krb5-server krb5-workstation -y

2.3 samba配置

vim /etc/samba/smb.conf
[global]
workgroup = ABC
security = ads
winbind use default domain = no
password server = ADS.ABC.COM
realm = ABC.COM

[home]
comment = Home Directories
browseable = no
writable = yes

systemctl restart smb
systemctl enable smb
systemctl status smb

2.4 krb5配置

vim  /etc/krb5.conf
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = ABC.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false

[realms]
# EXAMPLE.COM = {
#  kdc = kerberos.example.com
#  admin_server = kerberos.example.com
# }

ABC.COM = {
 kdc = 192.168.2.243:88
 admin_server = 192.168.2.243:749
 default_domain = ABC.COM
 }

[domain_realm]
# .example.com = EXAMPLE.COM
# example.com = EXAMPLE.COM
.abc.com = ABC.COM
abc.com = ABC.COM

[kdc]
  profile =/var/kerberos/krb5kdc/kdc.conf

[appdefaults]
 pam = {
  debug = false
  ticket_lifetime = 36000
  renew_lifetime = 36000
  forwardable = true
  krb4_convert = false
 }

vim /var/kerberos/krb5kdc/kdc.conf

[kdcdefaults]
 kdc_ports = 88
 kdc_tcp_ports = 88

[realms]
 EXAMPLE.COM = {
  #master_key_type = aes256-cts
  acl_file = /var/kerberos/krb5kdc/kadm5.acl
  dict_file = /usr/share/dict/words
  admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
  supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
 }

 ABC.COM = {
  #master_key_type = aes256-cts
  acl_file = /var/kerberos/krb5kdc/kadm5.acl
  dict_file = /usr/share/dict/words
  admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
  supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
 }

2.5 编辑/etc/nsswich.conf，在下列行末添加winbind，其他的不变

vim /etc/nsswitch.conf
passwd:     files winbind
shadow:     files winbind
group:      files winbind

protocols:  files winbind

services:   files winbind

netgroup:   files winbind

automount:  files winbind

将/usr/lib/systemd/system 下的service copy 到 /etc/systemd/system/， smb.service， krb5kdc.service winbind.service

cd /usr/lib/systemd/system
cp smb.service krb5kdc.service winbind.service /etc/systemd/system/

重新启动机器。

reboot

2.6 linux服务器加域

net join -U  administrator

如果不行就ping下域名再加

启动smaba和winbind服务

systemctl enable winbind
systemctl enable smb
systemctl start winbind
systemctl start smb
systemctl status winbind

2.7 加域后测试

通过wbinfo进行账号拉取测试。wbinfo –a user%password

wbinfo -a lirui%lirui@123

提示
challenge/response password authentication succeeded

让我们试着和NTLM验证,这对使用Active Directory的FreeRADIUS是必要的

ntlm_auth --request-nt-key --domain=abc.com --username=lirui
Password: 
NT_STATUS_OK: The operation completed successfully. (0x0)

修改/var/lib/samba/winbindd_privileged权限

usermod -G wbpriv radiusd
chown -R root.radiusd /var/lib/samba/winbindd_privileged

2.8 FreeRadius的配置

vim /etc/raddb/clients.conf
client 10.145.0.0/16 {
        secret = testing123
        showtanme = 10.145.0.0
        }
client 192.168.0.0/16 {
        secret = testing123
        showtanme = 192.168.0.0
        }

vim /etc/raddb/mods-available/mschap
	with_ntdomain_hack = yes
	ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{mschap:User-Name}:-00} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00} --domain=%{%{mschap:NT-Domain}:-ABC.COM}"

vim /etc/raddb/mods-enabled/ntlm_auth
exec ntlm_auth {
        wait = yes
        program = "/usr/bin/ntlm_auth --request-nt-key --domain=ABC.COM --username=%{mschap:User-Name} --password=%{User-Password}"
}

vim /etc/raddb/mods-available/eap
eap {
	default_eap_type = peap

tls-config tls-common {
	random_file = /dev/urandom

/etc/raddb/sites-available/default 和 raddb/sites-enabled/inner-tunnel
authorize 中加入 ntdomain
authenticate 中 加入 ntlm_auth

vim /etc/raddb/mods-config/files/authorize
DEFAULT Auth-Type = ntlm_auth

重启radius 服务之后，我们run 下面的命令

[root@localhost ~]# radtest lirui lirui@123 10.145.8.5:1812 0 testing123
Sent Access-Request Id 183 from 0.0.0.0:45154 to 10.145.8.5:1812 length 75
	User-Name = "lirui"
	User-Password = "lirui@123"
	NAS-IP-Address = 127.0.0.1
	NAS-Port = 0
	Message-Authenticator = 0x00
	Cleartext-Password = "lirui@123"
Received Access-Accept Id 183 from 10.145.8.5:1812 to 0.0.0.0:0 length 20

Access-Accept 验证成功。

---

总结

域控服务器可能和DNS服务器不是同一台，不过应该可以写本地host文件解决。

参考文章：

https://blog.51cto.com/liqingbiao/2152850
https://wiki.freeradius.org/guide/freeradius-active-directory-integration-howto
https://www.freesion.com/article/6304659593/