Installation des paquets :

# aptitude install freeradius-ldap ca-certificates

Tous les fichiers suivant à éditer se trouve dans : /etc/freeradius

Editer le fichier clients.conf

## clients.conf -- client configuration directives
##
client 127.0.0.1 {
        secret          = monsecret_nasradius 
}

client 192.168.0.1 {
        secret          = monsecret_nasradius 
        shortname       = WIFI-BORNE1
        nastype = DLINK
}

client 192.168.0.2 {
        secret          = monsecret_nasradius 
        shortname       = WIFI-BORNE2
        nastype = DLINK
}

Editer le fichier radiusd.conf

prefix = /usr
exec_prefix = /usr
sysconfdir = /etc
localstatedir = /var
sbindir = ${exec_prefix}/sbin
logdir = /var/log/freeradius
raddbdir = /etc/freeradius
radacctdir = ${logdir}/radacct
name = freeradius
confdir = ${raddbdir}
run_dir = ${localstatedir}/run/${name}
db_dir = ${raddbdir}
libdir = /usr/lib/freeradius
pidfile = ${run_dir}/${name}.pid
max_request_time = 30
cleanup_delay = 5
max_requests = 1024
listen {
        type = auth
        ipaddr = *
        port = 0
}
listen {
        ipaddr = *
        port = 0
        type = acct
}
hostname_lookups = no
allow_core_dumps = no
regular_expressions     = yes
extended_expressions    = yes
log {
        destination = files
        file = ${logdir}/radius.log
        syslog_facility = daemon
        stripped_names = no
        auth = yes
        auth_badpass = yes
        auth_goodpass = yes
        msg_goodpass = "[* * * GOOD LOGIN * * *]"
        msg_badpass = "[* * * BAD LOGIN * * *]"
}
checkrad = ${sbindir}/checkrad
security {
        max_attributes = 200
        reject_delay = 1
        status_server = yes
}
proxy_requests  = yes
$INCLUDE proxy.conf
$INCLUDE clients.conf
thread pool {
        start_servers = 5
        max_servers = 32
        min_spare_servers = 3
        max_spare_servers = 10
        max_requests_per_server = 0
}
modules {
        $INCLUDE ${confdir}/modules/
        $INCLUDE eap.conf
}
instantiate {
        exec
        expr
        expiration
        logintime
}
$INCLUDE policy.conf
$INCLUDE sites-enabled/

Editer le fichier eap.conf pour valider le TTLS

eap {

        default_eap_type = ttls 
        timer_expire     = 60
        ignore_unknown_eap_types = yes 
        cisco_accounting_username_bug = no
        max_sessions = 4096

        md5 {
        }

        leap {
        }

        gtc {
                auth_type = PAP
        }

        tls {

                certdir = ${confdir}/certs
                cadir = ${confdir}/certs

                private_key_password = whatever
                private_key_file = ${certdir}/server.key

                certificate_file = ${certdir}/server.pem

                dh_file = ${certdir}/dh
                random_file = ${certdir}/random

                cipher_list = "DEFAULT"
                make_cert_command = "${certdir}/bootstrap"

                cache {

                      enable = no
                      lifetime = 24 # hours
                      max_entries = 255
                }
        }

        ttls {

                default_eap_type = gtc 
                copy_request_to_tunnel = no
                use_tunneled_reply = no
                virtual_server = "inner-tunnel"

        }

        peap {
                default_eap_type = mschapv2 
                copy_request_to_tunnel = yes 
                use_tunneled_reply = yes 

                virtual_server = "inner-tunnel"
        }
        mschapv2 {
        }
}

Intégrer l'authentification LDAP dans /etc/freeradius/modules/ldap.

La variable access_attr active la restriction aux utilisateurs pour l'accès au wifi (à rajouter dans la fiche ldap de l'utilisateur ainsi que objectclass radiusprofile) via le champs dialupAccess dans la fiche de l'utilisateur (valeur TRUE or FALSE)

ldap ldap1 {
        server = "ldap1.jerome.colombet.fr"
        basedn = "ou=users,dc=jerome.colombet,dc=fr"
        filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
        ldap_connections_number = 5
        timeout = 4
        timelimit = 3
        net_timeout = 1
        tls {
                start_tls = no
        }
        access_attr = "dialupAccess"
        dictionary_mapping = ${confdir}/ldap.attrmap
        password_attribute = userPassword
        edir_account_policy_check = no
        access_attr_used_for_allow = yes
}

ldap ldap2{
        server = "ldap2.jerome.colombet.fr"
        basedn = "ou=users,dc=jerome.colombet,dc=fr"
        filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
        ldap_connections_number = 5
        timeout = 4
        timelimit = 3
        net_timeout = 1
        tls {
                start_tls = no
        }
        access_attr = "dialupAccess"
        dictionary_mapping = ${confdir}/ldap.attrmap
        password_attribute = userPassword
        edir_account_policy_check = no
        access_attr_used_for_allow = yes
}

Activer le hashage des mots de passe dans /etc/freeradius/modules/pap

pap {
        auto_header = yes 
}

Lancer freeradius en mode console pour voir les messages de debug :

# /etc/init.d/freeradius stop
# freeradius -X
[...]
Debug: Listening on authentication address * port 1812
Debug: Listening on accounting address * port 1813
Debug: Listening on proxy address * port 1814
Debug: Ready to process requests.

Ajout d'un utilisateur local pour les tests avant d'intégrer l'annuaire LDAP. Dans le fichier /etc/freeradius/users rajouter au début du fichier la ligne suivante. J'active un utilisateur radius avec le mdp radius:

radius	User-Password := "mdpradius"

Ensuite je teste en mode console mon utilisateur radius:

$ radtest radius mdpradius 127.0.0.1 0 monsecret_nasradius
Sending Access-Request of id 95 to 127.0.0.1:1812
       User-Name = "radius"
       User-Password = "mdpradius"
       NAS-IP-Address = localhost
       NAS-Port = 0
rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=95, length=20