Notas adicionales:
Los certificados a modificarse pueden ser generados manualmente ,e aunque es posible descargarlos a partir de el siguiente enlace de un post (descarga pos rapidshare.com) :
Certificados para Suplicantes(Windows ):
Certificados para el el servidor(Linux CentOS 5.4 ):
Aunque a continuación se mostrará la Generación manual de estos certificados.
Configuración Manual del Servidor(Paso a paso)
Protocolos configurados:
WPA1/2 enterprise
EAP/PEAP/TTLS
Procesos involucrados:
1- Instalar OS
2- Instalar openssl
3- Generar certificados digitales
4- Instalar / Configurar freeradius
5- Configurar Access points
6- Configurar clientes wifi finales
Pasos:
1.- Instalar el sistema operativo.
2.- Instalar openssl (si no está instalado ya)
- yum install openssl
3.- Generar los certificados digitales con openssl, estos pueden ser creados en cualquier otra máquina con el sistema operativo y luego ser traspasados o pueden ser creados directamente en el servidor. Lo importante es que la carpeta donde se van a almacenar sea: /etc/radd/certs/
mkdir private
mkdir newcerts
touch index.txt
echo '01' > serial
Luego se edita y se cambia el parámetro:
dir = ../../CA # Where everything is kept
a:
dir = /etc/ssl
openssl req -new -x509 -extensions v3_ca -keyout private/cakey.pem -out cacert.pem -days 3650
Se escoge una clave y luego se tiene la siguiente salida:
[root@ciitwifi ssl]# openssl req -new -x509 -extensions v3_ca -keyout private/cakey.pem -out cacert.pem -days 3650
Generating a 1024 bit RSA private key
..++++++
..++++++
writing new private key to 'private/cakey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:pk
State or Province Name (full name) [Berkshire]:pakhtoonkhwa
Locality Name (eg, city) [abbottabad]:abbottabad
Organization Name (eg, company) [ciit]:ciit
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:ciitwifi
Luego se crea una solicitud de certificado digital:
openssl req -new -nodes -keyout server_key.pem -out server_req.pem -days 730
Cuya salida debería ser:
[root@ciitwifi ssl]# openssl req -new -nodes -keyout server_key.pem -out server_req.pem -days 730
Generating a 1024 bit RSA private key
.......++++++
..................................++++++
writing new private key to 'server_key.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:pk
State or Province Name (full name) [Berkshire]:pakhtoonkhwa
Locality Name (eg, city) [abbottabad]:abbottabad
Organization Name (eg, company) [ciit]:ciit
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:ciitwifi
Email Address []:rnd@peace.not
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:lettheserverin
An optional company name []:
[root@ciitwifi ssl]#
Después se firma la solicitud con la autoridad creada en el certificado anteriormente:
[root@centos5 ssl]# cat xpextensions
[ xpclient_ext]
extendedKeyUsage = 1.3.6.1.5.5.7.3.2
[ xpserver_ext ]
extendedKeyUsage = 1.3.6.1.5.5.7.3.1
openssl ca -policy policy_anything -out server_cert.pem -extensions xpserver_ext -extfile /etc/ssl/xpextensions -infiles /etc/ssl/server_req.pem
La salida debe ser:
[root@ciitwifi ssl]# openssl ca -policy policy_anything -out server_cert.pem -extensions xpserver_ext -extfile /etc/ssl/xpextensions -infiles /etc/ssl/server_req.pem
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/ssl/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Jun 10 03:22:22 2008 GMT
Not After : Jun 10 03:22:22 2009 GMT
Subject:
countryName = pk
stateOrProvinceName = pakhtoonkhwa
localityName = abbottabad
organizationName = ciit
commonName = ciitwifi
emailAddress = rnd@peace.not
X509v3 extensions:
X509v3 Extended Key Usage:
TLS Web Server Authentication
Certificate is to be certified until Jun 10 03:22:22 2009 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@ciitwifi ssl]#
El siguiente paso es crear un archive de servidor que contenga la llave y el certificado:
cat server_key.pem server_cert.pem > server_keycert.pem
Luego se crea una solicitud de certificado del cliente:
openssl req -new -keyout client_key.pem -out client_req.pem -days 730
La respuesta deber ser:
[root@ciitwifi ssl]# openssl req -new -keyout client_key.pem -out client_req.pem -days 730
Generating a 1024 bit RSA private key
.........++++++
..............++++++
writing new private key to 'client_key.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:pk
State or Province Name (full name) [Berkshire]:pakhtoonkhwa
Locality Name (eg, city) [abbottabad]:abbottabad
Organization Name (eg, company) [ciit]:ciit
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:ciitwifi
Email Address []:rnd@peace.not
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:whateverdotwhat
An optional company name []:
[root@ciitwifi ssl]#
Luego se firma el certificado digital con extensiones para XP:
openssl ca -policy policy_anything -out client_cert.pem -extensions xpclient_ext -extfile /etc/ssl/xpextensions -infiles /etc/ssl/client_req.pem
Luego se obtiene una salida con el siguiente formato:
[root@ciitwifi ssl]# openssl ca -policy policy_anything -out client_cert.pem -extensions xpclient_ext -extfile /etc/ssl/xpextensions -infiles /etc/ssl/client_req.pem
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/ssl/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 2 (0x2)
Validity
Not Before: Jun 10 03:49:46 2008 GMT
Not After : Jun 10 03:49:46 2009 GMT
Subject:
countryName = pk
stateOrProvinceName = pakhtoonkhwa
localityName = abbottabad
organizationName = ciit
commonName = ciitwifi
emailAddress = rnd@peace.not
X509v3 extensions:
X509v3 Extended Key Usage:
TLS Web Client Authentication
Certificate is to be certified until Jun 10 03:49:46 2009 GMT (365 days)
Sign the certificate? [y/n]:yes
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@ciitwifi ssl]#
Luego es necesario exportar el certificado del cliente en el formato adecuado (P12) para un cliente XP:
openssl pkcs12 -export -in client_cert.pem -inkey client_key.pem -out client_cert.p12 -clcerts
De donde la salida obtenida puede ser:
[root@ciitwifi ssl]# openssl pkcs12 -export -in client_cert.pem -inkey client_key.pem -out client_cert.p12 -clcerts
Enter pass phrase for client_key.pem:
Enter Export Password:
Verifying - Enter Export Password:
[root@ciitwifi ssl]#
La exportación en el formato adecuado (DER) para un cliente XP se realiza así:
openssl x509 -setalias "ciitwifi@ciit" -outform DER -in cacert.pem -out cacert.der
Por último se pueden exportar los certificados a un directorio para poder importarlos en un cliente.
4.- Instalar Free Radius
Primero se corre el paquete rpm para instalar el paquete.
rpm -Uvh freeradius....
En caso de que se pida instancias se debe escribir lo siguiente:
yum install net-snmp-utils perl-DBI libtool-ltdl -y
FreeRadius al instalarse tiene certificados por defecto, los cuales deben removerse:
rm -Rf /etc/raddb/demoCA
Luego se deben crear los directorios adecuados en el directorio /etc/raddb para mantener ahí la información.
mkdir /etc/raddb/certs
Se debe mover los certificados del root y del servidor a la carpeta donde esté instalado radius.
cp /etc/ssl/cacert.pem /etc/raddb/certs/ -v
cp /etc/ssl/server_keycert.pem /etc/raddb/certs/ -v
Se crean los parámetros de Diffie-Hellman para TLS.
openssl dhparam -check -text -5 512 -out dh
La salida debe ser:
[root@ciitwifi ssl]# pwd
/etc/ssl
[root@ciitwifi ssl]# openssl dhparam -check -text -5 512 -out dh
Generating DH parameters, 512 bit long safe prime, generator 5
This is going to take a long time
.+.........................................................................+
................+......+.............................+...........+.........+.............
..........+..............................................................................
......+........................................+...........................+.............
.................+........................+..............................................
...+...........................+..........................+..........+.+.......+.........
....................................+...+...........................................+....
...............................+.....................+.........+.........................
.......+.......+.........+.....+......................+............................+.....
.........+.........+............................................................++*++*++*
++*++*++*
DH parameters appear to be ok.
[root@ciitwifi ssl]#
Luego se copia ese archive “dh” a la ubicación /etc/raddb/certs.
cp /etc/ssl/dh /etc/raddb/certs –v
Luego se crea el stream de bits randómico para el TLS y se cambia la propiedad del certificado freeradius de manera que el servidor pueda usarlo:
dd if=/dev/urandom of=random count=2
Salida (en /etc/raddb/certs folder i.e.):
===========================================================================
[root@ciitwifi certs]# dd if=/dev/urandom of=random count=2
2+0 records in
2+0 records out
1024 bytes (1.0 kB) copied, 0.000545195 seconds, 1.9 MB/s
chown -R radiusd /etc/raddb/certs
Luego se modifica /etc/raddb/eap.conf
eap {
default_eap_type = ttls
timer_expire = 60
ignore_unknown_eap_types = no
cisco_accounting_username_bug = no
md5 {
}
leap {
}
gtc {
auth_type = PAP
}
tls {
private_key_password = lettheserverin
private_key_file = ${raddbdir}/certs/server_keycert.pem
certificate_file = ${raddbdir}/certs/server_keycert.pem
CA_file = ${raddbdir}/certs/cacert.pem
dh_file = ${raddbdir}/certs/dh
random_file = ${raddbdir}/certs/random
}
ttls {
default_eap_type = mschapv2
use_tunneled_reply = yes
}
peap {
default_eap_type = mschapv2
}
mschapv2 {
}
Luego se agrega un cliente radius para el Access point.
client 192.168.0.53 {
secret =
shortname = AP3200
nastype = other
}
Luego se modifica /etc/raddb/radiusd.conf
log_auth = yes
authorize {
preprocess
chap
mschap
suffix
pap
eap
files
}
authenticate{
Auth-Type PAP {
pap
}
Auth-Type CHAP {
chap
}
Auth-Type MS-CHAP {
mschap
}
# unix
Eap
}
Luego se modifica /etc/raddb/users y se corre el servidor:
faheem Cleartext-Password := "khan"
Para iniciar el servidor se utiliza:
/etc/init.d/radiusd start
5. Configurar el Access Point
...
No hay comentarios:
Publicar un comentario