Almost work and disable EAP
This commit is contained in:
@@ -37,4 +37,9 @@ openssl req -new -key privkey.pem -out sstp-csr.csr
|
||||
### Create a server certificate
|
||||
```bash
|
||||
openssl x509 -req -in sstp-csr.csr -CA ca.pem -CAkey rootCA.key -CAcreateserial -out cert.pem -days 365
|
||||
```
|
||||
```
|
||||
|
||||
### Convert cert from PEM to CERT format (if it's needed)
|
||||
```bash
|
||||
openssl x509 -outform der -in your-cert.pem -out your-cert.crt
|
||||
```
|
||||
|
||||
+1
-1
@@ -60,7 +60,7 @@ pv6-pool-delegate=v6pool-delegate
|
||||
[radius]
|
||||
verbose=1
|
||||
interim-verbose=1
|
||||
server=radius,secret,auth-port=1812,acct-port=1813,req-limit=0,fail-time=0
|
||||
server=fc00:b10c:4::eeee,secret123,auth-port=1812,acct-port=1813,req-limit=0,fail-time=0
|
||||
|
||||
[dns]
|
||||
dns1=8.8.8.8
|
||||
|
||||
+14
-1
@@ -22,14 +22,21 @@ services:
|
||||
networks:
|
||||
proxy-tier:
|
||||
ipv6_address: "fc00:b10c:3::ffff"
|
||||
radius-net:
|
||||
ipv6_address: "fc00:b10c:4::ffff"
|
||||
radius:
|
||||
build: ./radius
|
||||
|
||||
networks:
|
||||
radius-net:
|
||||
ipv6_address: "fc00:b10c:4::eeee"
|
||||
|
||||
ldap:
|
||||
build: ./ldap
|
||||
volumes:
|
||||
- ldap:/var/lib/ldap
|
||||
- ldap-cfg:/etc/ldap/slapd.d
|
||||
networks:
|
||||
radius-net:
|
||||
|
||||
stream:
|
||||
build: ./nginx-stream
|
||||
@@ -62,9 +69,15 @@ networks:
|
||||
ipam:
|
||||
config:
|
||||
- subnet: fc00:b10c:3::/64
|
||||
radius-net:
|
||||
enable_ipv6: true
|
||||
ipam:
|
||||
config:
|
||||
- subnet: fc00:b10c:4::/64
|
||||
|
||||
volumes:
|
||||
certs:
|
||||
vhost.d:
|
||||
html:
|
||||
ldap:
|
||||
ldap-cfg:
|
||||
|
||||
+8
-2
@@ -18,15 +18,21 @@ RUN install -d -o root -g root -m 0755 /etc/apt/keyrings \
|
||||
#
|
||||
# Install from reposittory
|
||||
#
|
||||
RUN apt-get install -y freeradius \
|
||||
RUN apt-get install -y freeradius freeradius-ldap \
|
||||
&& apt-get clean \
|
||||
&& rm -r /var/lib/apt/lists/* \
|
||||
&& ln -s /etc/freeradius /etc/raddb
|
||||
|
||||
ADD ./raddb/* /etc/raddb/3.0/
|
||||
COPY --chown=freerad:freerad ./raddb* /etc/raddb/3.0/
|
||||
|
||||
#Disable EAP
|
||||
RUN rm -f /etc/raddb/3.0/mods-enabled/eap & \
|
||||
rm -f /etc/raddb/3.0/sites-enabled/inner-tunnel
|
||||
|
||||
WORKDIR /
|
||||
|
||||
USER freerad:freerad
|
||||
|
||||
EXPOSE 1812/udp 1813/udp
|
||||
ENTRYPOINT ["freeradius"]
|
||||
CMD ["-X"]
|
||||
@@ -0,0 +1,296 @@
|
||||
# -*- text -*-
|
||||
##
|
||||
## clients.conf -- client configuration directives
|
||||
##
|
||||
## $Id: 60f9f4bf8a32804182e4516ac69ac510d25215d1 $
|
||||
|
||||
#######################################################################
|
||||
#
|
||||
# Define RADIUS clients (usually a NAS, Access Point, etc.).
|
||||
|
||||
#
|
||||
# Defines a RADIUS client.
|
||||
#
|
||||
# '127.0.0.1' is another name for 'localhost'. It is enabled by default,
|
||||
# to allow testing of the server after an initial installation. If you
|
||||
# are not going to be permitting RADIUS queries from localhost, we suggest
|
||||
# that you delete, or comment out, this entry.
|
||||
#
|
||||
#
|
||||
|
||||
#
|
||||
# Each client has a "short name" that is used to distinguish it from
|
||||
# other clients.
|
||||
#
|
||||
# In version 1.x, the string after the word "client" was the IP
|
||||
# address of the client. In 2.0, the IP address is configured via
|
||||
# the "ipaddr" or "ipv6addr" fields. For compatibility, the 1.x
|
||||
# format is still accepted.
|
||||
#
|
||||
client localhost {
|
||||
# Only *one* of ipaddr, ipv4addr, ipv6addr may be specified for
|
||||
# a client.
|
||||
#
|
||||
# ipaddr will accept IPv4 or IPv6 addresses with optional CIDR
|
||||
# notation '/<mask>' to specify ranges.
|
||||
#
|
||||
# ipaddr will accept domain names e.g. example.org resolving
|
||||
# them via DNS.
|
||||
#
|
||||
# If both A and AAAA records are found, A records will be
|
||||
# used in preference to AAAA.
|
||||
ipaddr = 127.0.0.1
|
||||
|
||||
# Same as ipaddr but allows v4 addresses only. Requires A
|
||||
# record for domain names.
|
||||
# ipv4addr = * # any. 127.0.0.1 == localhost
|
||||
|
||||
# Same as ipaddr but allows v6 addresses only. Requires AAAA
|
||||
# record for domain names.
|
||||
# ipv6addr = :: # any. ::1 == localhost
|
||||
|
||||
#
|
||||
# A note on DNS: We STRONGLY recommend using IP addresses
|
||||
# rather than host names. Using host names means that the
|
||||
# server will do DNS lookups when it starts, making it
|
||||
# dependent on DNS. i.e. If anything goes wrong with DNS,
|
||||
# the server won't start!
|
||||
#
|
||||
# The server also looks up the IP address from DNS once, and
|
||||
# only once, when it starts. If the DNS record is later
|
||||
# updated, the server WILL NOT see that update.
|
||||
#
|
||||
|
||||
#
|
||||
# The transport protocol.
|
||||
#
|
||||
# If unspecified, defaults to "udp", which is the traditional
|
||||
# RADIUS transport. It may also be "tcp", in which case the
|
||||
# server will accept connections from this client ONLY over TCP.
|
||||
#
|
||||
proto = *
|
||||
|
||||
#
|
||||
# The shared secret use to "encrypt" and "sign" packets between
|
||||
# the NAS and FreeRADIUS. You MUST change this secret from the
|
||||
# default, otherwise it's not a secret any more!
|
||||
#
|
||||
# The secret can be any string, up to 8k characters in length.
|
||||
#
|
||||
# Control codes can be entered vi octal encoding,
|
||||
# e.g. "\101\102" == "AB"
|
||||
# Quotation marks can be entered by escaping them,
|
||||
# e.g. "foo\"bar"
|
||||
#
|
||||
# A note on security: The security of the RADIUS protocol
|
||||
# depends COMPLETELY on this secret! We recommend using a
|
||||
# shared secret that is composed of:
|
||||
#
|
||||
# upper case letters
|
||||
# lower case letters
|
||||
# numbers
|
||||
#
|
||||
# And is at LEAST 8 characters long, preferably 16 characters in
|
||||
# length. The secret MUST be random, and should not be words,
|
||||
# phrase, or anything else that is recognisable.
|
||||
#
|
||||
# The default secret below is only for testing, and should
|
||||
# not be used in any real environment.
|
||||
#
|
||||
secret = testing123
|
||||
|
||||
#
|
||||
# Old-style clients do not send a Message-Authenticator
|
||||
# in an Access-Request. RFC 5080 suggests that all clients
|
||||
# SHOULD include it in an Access-Request. The configuration
|
||||
# item below allows the server to require it. If a client
|
||||
# is required to include a Message-Authenticator and it does
|
||||
# not, then the packet will be silently discarded.
|
||||
#
|
||||
# allowed values: yes, no
|
||||
require_message_authenticator = no
|
||||
|
||||
#
|
||||
# The short name is used as an alias for the fully qualified
|
||||
# domain name, or the IP address.
|
||||
#
|
||||
# It is accepted for compatibility with 1.x, but it is no
|
||||
# longer necessary in >= 2.0
|
||||
#
|
||||
# shortname = localhost
|
||||
|
||||
#
|
||||
# the following three fields are optional, but may be used by
|
||||
# checkrad.pl for simultaneous use checks
|
||||
#
|
||||
|
||||
#
|
||||
# The nas_type tells 'checkrad.pl' which NAS-specific method to
|
||||
# use to query the NAS for simultaneous use.
|
||||
#
|
||||
# Permitted NAS types are:
|
||||
#
|
||||
# cisco
|
||||
# computone
|
||||
# livingston
|
||||
# juniper
|
||||
# max40xx
|
||||
# multitech
|
||||
# netserver
|
||||
# pathras
|
||||
# patton
|
||||
# portslave
|
||||
# tc
|
||||
# usrhiper
|
||||
# other # for all other types
|
||||
|
||||
#
|
||||
nas_type = other # localhost isn't usually a NAS...
|
||||
|
||||
#
|
||||
# The following two configurations are for future use.
|
||||
# The 'naspasswd' file is currently used to store the NAS
|
||||
# login name and password, which is used by checkrad.pl
|
||||
# when querying the NAS for simultaneous use.
|
||||
#
|
||||
# login = !root
|
||||
# password = someadminpas
|
||||
|
||||
#
|
||||
# As of 2.0, clients can also be tied to a virtual server.
|
||||
# This is done by setting the "virtual_server" configuration
|
||||
# item, as in the example below.
|
||||
#
|
||||
# virtual_server = home1
|
||||
|
||||
#
|
||||
# A pointer to the "home_server_pool" OR a "home_server"
|
||||
# section that contains the CoA configuration for this
|
||||
# client. For an example of a coa home server or pool,
|
||||
# see raddb/sites-available/originate-coa
|
||||
# coa_server = coa
|
||||
|
||||
#
|
||||
# Response window for proxied packets. If non-zero,
|
||||
# then the lower of (home, client) response_window
|
||||
# will be used.
|
||||
#
|
||||
# i.e. it can be used to lower the response_window
|
||||
# packets from one client to a home server. It cannot
|
||||
# be used to raise the response_window.
|
||||
#
|
||||
# response_window = 10.0
|
||||
|
||||
#
|
||||
# Connection limiting for clients using "proto = tcp".
|
||||
#
|
||||
# This section is ignored for clients sending UDP traffic
|
||||
#
|
||||
limit {
|
||||
#
|
||||
# Limit the number of simultaneous TCP connections from a client
|
||||
#
|
||||
# The default is 16.
|
||||
# Setting this to 0 means "no limit"
|
||||
max_connections = 16
|
||||
|
||||
# The per-socket "max_requests" option does not exist.
|
||||
|
||||
#
|
||||
# The lifetime, in seconds, of a TCP connection. After
|
||||
# this lifetime, the connection will be closed.
|
||||
#
|
||||
# Setting this to 0 means "forever".
|
||||
lifetime = 0
|
||||
|
||||
#
|
||||
# The idle timeout, in seconds, of a TCP connection.
|
||||
# If no packets have been received over the connection for
|
||||
# this time, the connection will be closed.
|
||||
#
|
||||
# Setting this to 0 means "no timeout".
|
||||
#
|
||||
# We STRONGLY RECOMMEND that you set an idle timeout.
|
||||
#
|
||||
idle_timeout = 30
|
||||
}
|
||||
}
|
||||
|
||||
# IPv6 Client
|
||||
client localhost_ipv6 {
|
||||
ipv6addr = ::1
|
||||
secret = testing123
|
||||
}
|
||||
|
||||
# All IPv6 Site-local clients
|
||||
#client sitelocal_ipv6 {
|
||||
# ipv6addr = fe80::/16
|
||||
# secret = testing123
|
||||
#}
|
||||
|
||||
#client example.org {
|
||||
# ipaddr = radius.example.org
|
||||
# secret = testing123
|
||||
#}
|
||||
|
||||
#
|
||||
# You can now specify one secret for a network of clients.
|
||||
# When a client request comes in, the BEST match is chosen.
|
||||
# i.e. The entry from the smallest possible network.
|
||||
#
|
||||
#client private-network-1 {
|
||||
# ipaddr = 192.0.2.0/24
|
||||
# secret = testing123-1
|
||||
#}
|
||||
|
||||
#client private-network-2 {
|
||||
# ipaddr = 198.51.100.0/24
|
||||
# secret = testing123-2
|
||||
#}
|
||||
|
||||
#######################################################################
|
||||
#
|
||||
# Per-socket client lists. The configuration entries are exactly
|
||||
# the same as above, but they are nested inside of a section.
|
||||
#
|
||||
# You can have as many per-socket client lists as you have "listen"
|
||||
# sections, or you can re-use a list among multiple "listen" sections.
|
||||
#
|
||||
# Un-comment this section, and edit a "listen" section to add:
|
||||
# "clients = per_socket_clients". That IP address/port combination
|
||||
# will then accept ONLY the clients listed in this section.
|
||||
#
|
||||
# There are additional considerations when using clients from SQL.
|
||||
#
|
||||
# A client can be link to a virtual server via modules such as SQL.
|
||||
# This link is done via the following process:
|
||||
#
|
||||
# If there is no listener in a virtual server, SQL clients are added
|
||||
# to the global list for that virtual server.
|
||||
#
|
||||
# If there is a listener, and the first listener does not have a
|
||||
# "clients=..." configuration item, SQL clients are added to the
|
||||
# global list.
|
||||
#
|
||||
# If there is a listener, and the first one does have a "clients=..."
|
||||
# configuration item, SQL clients are added to that list. The client
|
||||
# { ...} ` configured in that list are also added for that listener.
|
||||
#
|
||||
# The only issue is if you have multiple listeners in a virtual
|
||||
# server, each with a different client list, then the SQL clients are
|
||||
# added only to the first listener.
|
||||
#
|
||||
#clients per_socket_clients {
|
||||
# client socket_client {
|
||||
# ipaddr = 192.0.2.4
|
||||
# secret = testing123
|
||||
# }
|
||||
#}
|
||||
client sstp {
|
||||
# ipaddr = *
|
||||
# ipv4addr = *
|
||||
ipv6addr = fc00:b10c:4::ffff
|
||||
proto = udp
|
||||
secret = secret123
|
||||
require_message_authenticator = no
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -25,7 +25,7 @@ ldap {
|
||||
|
||||
# Administrator account for searching and possibly modifying.
|
||||
# If using SASL + KRB5 these should be commented out.
|
||||
# identity = 'cn=admin,dc=example,dc=org'
|
||||
identity = 'cn=readonly,dc=bearns,dc=me'
|
||||
password = readonly
|
||||
|
||||
# Unless overridden in another section, the dn from which all
|
||||
|
||||
@@ -45,7 +45,7 @@
|
||||
#
|
||||
|
||||
# Ldap auth
|
||||
DEFAULT Auth-Type = ldap
|
||||
DEFAULT Auth-Type := ldap
|
||||
|
||||
#
|
||||
# Deny access for a specific user. Note that this entry MUST
|
||||
|
||||
@@ -402,10 +402,10 @@ authorize {
|
||||
# uncomment it as well; this will further reduce the number of
|
||||
# LDAP and/or SQL queries for TTLS or PEAP.
|
||||
#
|
||||
eap {
|
||||
ok = return
|
||||
# updated = return
|
||||
}
|
||||
# eap {
|
||||
# ok = return
|
||||
## updated = return
|
||||
# }
|
||||
|
||||
#
|
||||
# Pull crypt'd passwords from /etc/passwd or /etc/shadow,
|
||||
@@ -435,7 +435,7 @@ authorize {
|
||||
|
||||
#
|
||||
# The ldap module reads passwords from the LDAP database.
|
||||
ldap
|
||||
-ldap
|
||||
|
||||
#
|
||||
# If you're using Active Directory and PAP, then uncomment
|
||||
@@ -584,7 +584,7 @@ authenticate {
|
||||
|
||||
#
|
||||
# Allow EAP authentication.
|
||||
eap
|
||||
# eap
|
||||
|
||||
#
|
||||
# The older configurations sent a number of attributes in
|
||||
@@ -963,7 +963,7 @@ post-auth {
|
||||
# Insert EAP-Failure message if the request was
|
||||
# rejected by policy instead of because of an
|
||||
# authentication failure
|
||||
eap
|
||||
# eap
|
||||
|
||||
# Remove reply message if the response contains an EAP-Message
|
||||
remove_reply_message_if_eap
|
||||
@@ -1120,7 +1120,7 @@ post-proxy {
|
||||
# hidden inside of the EAP packet, and the end server will
|
||||
# reject the EAP request.
|
||||
#
|
||||
eap
|
||||
# eap
|
||||
|
||||
#
|
||||
# If the server tries to proxy a request and fails, then the
|
||||
|
||||
Reference in New Issue
Block a user