radius: initial setup

This commit is contained in:
Yohaï-Eliel BERREBY 2020-05-16 21:43:23 +02:00
parent 8355546131
commit 266b0dde6f
10 changed files with 1045 additions and 139 deletions

View file

@ -13,6 +13,7 @@ ldap_nslcd_passwd: "{{ vault_ldap_nslcd_passwd }}"
ldap_matrix_bind_dn: "cn=matrix,ou=service-users,{{ ldap_base }}" ldap_matrix_bind_dn: "cn=matrix,ou=service-users,{{ ldap_base }}"
ldap_matrix_password: "{{ vault_ldap_matrix_password }}" ldap_matrix_password: "{{ vault_ldap_matrix_password }}"
ldap_replica_password: "{{ vault_ldap_replica_password }}" ldap_replica_password: "{{ vault_ldap_replica_password }}"
ldap_admin_password: "{{ vault_ldap_admin_password }}"
ldap_admin_hashed_passwd: "{{ vault_ldap_admin_hashed_passwd }}" ldap_admin_hashed_passwd: "{{ vault_ldap_admin_hashed_passwd }}"
# Databases # Databases
@ -49,7 +50,19 @@ dns_host_suffix_backup: 153
backup_dns_servers: backup_dns_servers:
- "80.67.169.12" # French Data Network (FDN) (ns0.fdn.fr) - "80.67.169.12" # French Data Network (FDN) (ns0.fdn.fr)
# Misc
mtu: 1400 mtu: 1400
# Keepalived
keepalived_password: "{{ vault_keepalived_password[apartment_block] }}" keepalived_password: "{{ vault_keepalived_password[apartment_block] }}"
# Re2o config
re2o_secret_key: "{{ vault_re2o_secret_key }}"
re2o_db_password: "{{ vault_re2o_db_password }}"
re2o_aes_key: "{{ vault_re2o_aes_key }}"
# Radius
radius_secret_wifi: "{{ vault_radius_secrets.wifi }}"
radius_secret_wired: "{{ vault_radius_secrets.wired[apartment_block] }}"

View file

@ -1,139 +1,161 @@
$ANSIBLE_VAULT;1.1;AES256 $ANSIBLE_VAULT;1.1;AES256
37633237643762656366393132393038636634373839633762363931353431633834663235356136 33396439643732346636636465616537313231333032616436323166633235663131343961373834
6534646138363864353633323363313032333262383630370a303839306464396439666133383961 6365316236333532313361323063373130643031386131610a343036393035633431656434323466
32333933633933373932313535663464393066303836396136393433623966373565396636356633 30333836636565323163613631386663313934633264373734366438626636313137393233623835
6265323735376234310a383263346434333333366262363538383265626363663338326133396634 3930643831626164330a396233393834623635363864656466393236313837663739303065353437
61386365363663313061303038313862363363356261326366356363316236643236386566333962 38356539306333663062656439333938306433343632633861363430346631386238353462393334
66663864613866313932666362396235373965343833326531653931643061386662393162363763 61366263383062353136363632323330336637616538333866386534656662646639383335653931
35363439636630366337343638393964636235303934666333313330656663353163663561353263 33393166656166343166356334623266373533653938313064393533363331636365343161373665
35653631323835613463366339306663343933393138663032363265336361613162633538346566 62336466386536356637383663333661303135663835623432306231373034373435353562636265
66643436363130366630396539303463366537323465656663333138373039313434313063663633 31326561626665376566633066346366613364333135366363623030613131353833336135306464
34343438363663376530623334353832373564316364613039306133643335386534656565646663 66306133373634393431313866343464616633393165353830373436666136396633396131363763
35303330623137343430613331326530333531303362343433633534316565306462623663653439 39306162666437346138373132323132376237346137643861363235646134616132653235326362
32623834386663623232363237373461366165303039353362656431633463623830643734396236 32626135613530643766333930613164663935356332626232616330373237633835313231373066
30303731343632313066376631373065323730623839333535636662326136356537333837653335 66323431366332663965393239623337646666613566363132383232643235363237316437653261
30633530633733356335393661343265646637393564653535643265626335613134323430356565 63653361663038653764633266356433323234323132336232636337303763323736316662386638
65643933363137646638393530316463396339333461633063633765343938333966313835656137 34326233376465303561643830646635353965623331633934393639313236373236343836366532
36346366386333643631353630343533343839376263366631346566306563366431666434356236 30613964343835353130386533623262633261373831616635643861373133333237663666646334
37376536666638336230303630393364363936616666366561336262393833366538653132363361 64636139323038353265333336626233346266353637343232383930376330643831633030643664
63333161343839383163313566653832386134663430623338636230663736333064306636643138 61356231653135363664363063383331666137336433613966343839623161393135643738333537
63656533343634643737633234373134656665663964333464373264633763346664376139333530 61363164623539353634353932363762336165643961333931316338343036336435356533616433
31633639346538353439623964653661633863373733353837356231373832643831313138643263 30396335643634333366383233623034373164303564643639323030333461323965306638653063
66316461363666363635636361343835346533393431643132653537323535343163363639396335 31383161336531376231626332343436353635663466396134313530383563306566626566643964
38373762613961336530313963653437643032343032626536633638646137646439346362336564 35323465623562346439363036623139303932663539396662356336666362666463616432633162
61353463306238643062623532616539646239313761356434653965343165376134326437623539 31393231323963356538336436653032323462623462366130323963636136666131646636333532
33313164656262386436653537366436333563613731323262323932323839623338303236363935 32613136373162383037646137663230343536336161666132383964666239303663356430303361
35396265656161663339653538383735616264633931326633636264323434623030626434626361 66653963326135643963393931356231666666376466326135353261356265653230633935376235
65393766383434353463636534353332636338353332306237363338373566383636306366613838 32356330383163623132386363623239643531313163373539646166383964663661393663633465
33363639316330346237663031616330366130306231663634353266373735343434626136353730 39346666353062643964316532313363336562373035306635383138666336616239633932383437
61366166333761323535323435336461646461366632353233303639656639313434393133616564 63396138376138636561336539333564393033393466633066303138616136316638373138356161
35616436393863356266303138373765323037663764383731373362373234353866383139613264 39666632666339373836343363653530633130643733386339633536636135373365643363373032
37303138666337303461313065353866313864353834383336613031623866313338376533656265 64633837656235363137633364313662363134306330376537326634353731346463643832396534
33393138363536613930396631666439336535636336633837623739326166363139343434353662 64386361326635663032663464343432626237643365333330613466656163313930343266616139
66613761396266363030333537626637633365653339356534616266353338633163326633333262 36393036353864316661343066653237333737643038396538666139643034396636643765366163
36323962653863663738613536663838613037356662643866363033383963363465663830353361 30646366343636343364336639653436383038353637623131373738306566623033633863333634
61356464656562373036303834336639643937363134396437356130326634336230323562666136 61363861306463353130393130613232643134313765363033646330666662353961343664316438
35616532626235363737633938363362373430643935333133386539326530333061396463333234 36396339376366393236326432663434366634333935386662373538306236343938333563376263
65356663323463303136643035666138636366363961356165653930396534663038613435383731 65346637346433366637336532656337393730303934653835313839656535353731333737656162
31306638303837646464333164353832626637313537653430313465303061353266373563663261 65356531663737663164336338333336613230623836363435326132643131326534393634326261
63393031336362313935393963303431366666366535333238326334373563343634646238373164 32663564646536663338623035653138373835306530316536316664663039383032366465303363
30333132656230326436306131313264653639343531313333303535346433356533383664666239 38626138386164366332613933363434363132383336626430356331376239373031633262366532
61666666373135306536356439643531343031623134303335383132383330646437663135376232 62646435653932636264323164636465366138636631313538346530306163373466393866383266
35623366323630323762633730303330353839356332653435363962383738346636633632346235 30643739316336373462326138313666643263333463373764323832383230366465376539623937
37343336386361653033626638393939383763323065663135653530613461653438653762626466 62363536333238363735306563333731663862653932393565663034636238643434633161626632
35383139363435393863333032393963303638303936616534373639646564363930653539643937 33326164366336343734653234363930616634643933306264656138396631646135343437303462
35653566353262303266303966313062306438653665353464653465373761343135656433666132 39343237663262303933393865346165353934356662376136633636343636626634343666343134
32623438336330306363623666336133656563653837363766316465386138373234656631333338 37346166373963356638666338353438323831613538313961643339663230626565306261376665
62663866363632643236656530656266653033396438636431653361646538623336626563316638 32613438303964656161653535313436643662393032396532303738653662343762323538366133
30323532356634356538653534643535306135393037323632666538393734653063653234396638 32323036393530316630316261323731393865323433383961316664623435363130646239666132
39623363323233333738336364383663653461356362363334343365343432643531376633323061 31623935663637373763356562613964636338343666393833386634356465333866643831393531
65623530376438646564633236393738333635396230666234363062663839366263373431666637 38343261663636333336366539306366636137346131316161383661666431353235313536646538
30616261313830383962633034376136336432623333663164396335613932656135613830653366 39663866376336633739356337633461613261316435393063653633336636333738656631313032
33633464356366653837386432613037376532373264633737363263613835376536633530663735 62323130396164636431343961643237646533396639373863396333653936663964623337363063
63336636613937623435303830663231353364313435363366666332623339303934643830363835 32366162343635333132636239363039326565383262633163336436613430323039356439613964
38363666633435323732646265343630646531326333653838366531663037383665636632333539 39376563353663373637313035393839646633343963356433316333323732613035303432646338
38613235656566326666363566356130616335643361623262353934646630326430373733386132 62306639316139306531393236656265383836653436646136326666336137623936366630346332
64366165306664383337353837653363313661616463346132333536613232313761666235643663 33303465623537653461363437373036343439656134333930393862306339653161633365333335
36383764336435316138383161353666383530633039373935613665316130353665393334666633 63643937393761363463333637623039643265366462356632343263393434326435346634613736
66363339393266376364306137303335376231396264643231396361366663383335623737636263 38323561613134363330636562336264633465363762393736333934353237633162393238353961
34333464396434343263383938376433393963646337363665623364343065323638666663353462 65303634333331333537356134616539653462363035316330303338663430303536643230313133
31633134326566303930383831366364616365663363666564666532393561303231383063353665 64653739656233616131653731343733616661626662636139393039633636666132346230333966
32333862313531316135363034653137636265653530373761366239366136346236353238323331 34353831383036313663396339326237323038633231306230663563643562363030613332633362
38393834666139666331343166623261393264373330326264636363346564313333316564396530 38383463393961373635356539633839646337666132393034343264333739346432326333383432
37656635666239323439373239396635366661326139623031626130643834663834383765303630 32663030663739666237333435643734333663383238636130636135666561343961613861323666
65646661653030613237663137643639366337313261356231323536346632633961613333336236 33623637366232316430643331643863666261636266383030653263383766353861306631343934
35343033616536306430383533656232343635666234653331373638306264353733663064626137 62663761663366353763623966313035343330316563623238626537396439373235663862626565
63396235653830326438623131316663376266373738383130383536383637343035386532373739 35356234383534653231396632306137373037643531303434393433353134326532313332326538
33323333663164613437323637323333643864353630623361363631386166353737313835643937 66343236396636356231353234346438613866353763303136366137616338326532353039306639
30336234363639666635633931383238646532313864326439656662636432646563316563313337 34613234356664333339363134646532666631623132663462316562326266316365623738623663
33313432333636343161306139323565653434333663613639373834316432643438373936636461 32363562376234313038616530373335363935313135636466336237356632336537623538346433
38616263313335333339346239613464373336616337323766643337633936653031346462353932 33643563343936623836356238613139623730343236663464626262323330653362616238356137
64303865363164663533343464663838313364316664346539623961656630333464633236333135 64343563653863326638643834623665393333313262353732626638373634643633613836623164
33643966343234666138363930363436373433643730616134653361363738316662373136303562 63396136643066616133346131313833303064343534353963386638363462316435646637623232
63646662643132353236643161626331343636623164376532353734363861663865666262376232 32633332356263383533626635316231393865336636353430383365333131316633666164306138
32323533383435386464376134643066653533366430626662343238633432326363393061643466 33363330303464386563353436646562623337656633333963333431353837313362653931613033
38343265626366656638386634636637346366316430636530646334303938653062376236366462 37383330643730616432333538356430626462303730343430336465623938613732383138646330
61346436303032363933366137663863353638363564643231353030303264336132653332623164 39363161323665643333383461333730323734613134386461636339653431323033663434643364
65316165316435326631313763616530656265333735613039343939333134663234633732316265 38383762306139313465613461323436306137336463383439633230353266333137656330633237
36303133303639383738636365393935323562343135633232366637303935663166303335643539 62306230363031353361333462393136396234663231356434393438326533363434376537376266
37353030323466633834363137353233663433623831336161323365376330323839666263306135 66323364313934616232393931616234666166616532663865316538346536326266326133613635
30313762663537393936626361623031623961313932656666313062303462613331643463313863 62373839343639313861316539643461663161386435323161613436353433616230633734316239
61333834313633356233306565366136643832626639663138353865316134653462663331653431 35373332353539666636303934396661663831313935616262323639633561636433663135626633
32336237353663303231346137366239366362313863386131363139346661363331336235336132 61313730356664316262353832336334616330393431346363373265626661336332313135666639
36393636353362616263663830363239643261303334626138353233666338633062646239396363 31646134613635643765353833633231623034316163663031376366353430373230666466633536
34643763663031613365303561376462646262386534386536666532343361366136623132393035 34393132313738336163363035663435666262633161373336343932383366633765646366313132
35383561653864326230316436393334306133353937633363313365336564393234633334383232 66623933343362636633376339303363383165373336313134613330386530616335363263643166
36626133626130326663646162363238316461373034646634346135353337343737393936373438 32333162633035376562303332633732636530616432326234636236323434366164656437666464
33373931383638376632626633626666396536386237376331646131633566613464663762663933 63666536663261373565366437326636333232623934363033653837626230323934666138626462
36313964393461323839366562313537373533366561396130313731623831313638303664333634 66663639316630326662336263343365303630366234383530646139363936653866373162323435
39313364663432313130376163306166363162623163636437633934346662383337396164363239 35333139353831643232666533333065386130666137653931336638623137616639653533656562
37643536363531653236396539306663303265373537376334656635303162383239303262316431 32386431373865393561353537396632653239623839306234643938643261383730346431376234
33313433663038306666383738313630366235323936656562376338366332653366363665623936 32643030353537333665363232383562646662656131346433653065613763613532313461636663
39356237303563623634666335616436376638373464333338643666376563353033356562366566 37363565633864626136646663363334633239376537353066373466306431366132633931346464
38303333306430386539306664666234633433383935396635396534646465336438616431653438 66653164356134323834366364643637343833396666373039383861663435343238353462396438
62616465343161376464663065343930646435643137376331323637363566613736333664643936 33386131393839346663653433633333653564663665343265363831343937396436646262653738
65323363323565343761613865316432643537323661633732326230626435646363613635313161 33633761343362343762376239333963306264326333366437636661616233383737636234346538
31303836336234663834633137343533653438386362623236333864663563646365653036626561 35383861646332656664353339386331646236663036383033663262353336323634323365623661
32333261383435363763656238303438363035656538383037643339353131636162303762363039 36376561643864303832386634623032356563306138333532623434633166646130313239343539
37363864653665313861663235353963383938353065306561313536646562396430636363623132 66663566366636323835633661636331383066303131626132306332323430333333323734626433
36646562663436343331656236383031363764336638323263646562663634343932303431376465 66303839346261386364316530373736373362323339376462363130643964666638383935346330
34336636613836386238373764343030363163366232356536313966643938316533353338323464 33313830343965353338643139663834373863336636383730323662363836653536366433666166
61353033396334633536373834613735396665383861313064626239336439376166633066636664 61623265656431303661346664646135373438386335303437333734613761663031353235623062
37306235386632343835666264653165656164373031653337333533656531353936396339613066 36656432666266333161346238356532373464353835336561366138653031623264616563353836
63366131356131313736613762626235656565373537646566313438393833643234666238383330 61353731396361343939616437313532303766333962363536666139663064626636306239313962
66313038386566356632613833623734616233343732333431316666376636386262666336323936 65306336333739346435353636303534366635303362363631383264306435383662323930393230
38636134353261666666623466313330303834646362336134656163313766376432636437623237 30623134356439613436643861343036363366336332623665306239623234386435346337323930
32376264363361613163306439623965363763356161363030363262386565386438646564613533 61343061393961663133333764333362346137636132636532396135643839633863386638346330
33356331333137663935326338313336653233303235353339363164666639623234613165616166 34653131656332376538613039333066366232663432353666633334613331393863333236656662
35656235356634653638646134356230646236656264333134656138323662623363363565343035 34646630616263356363613162646533623336623164643561333934343565373936326135323230
30326563313566346335393738623237316431326538363434353436356139653965663762613437 38366335336562653861643732653930623461616366343239303862313339383031346630656538
39346232333938303065393561303134626333393666306134326636353430353736383739643539 65363865623666306436303165373734646464303637333939666262363163343230376161373734
63373063316633383765663236366235353035656639326638346661313136613530666461633764 37636433663139616261386534386466633862373739636262386631333334336238333862636335
33646262393733316263633064396139656661343634326336653932373335306331303938633935 33386530393762626161303331633735363039373636346432626236336635323232313661623234
31623661633231633265656166363662396133666231623230393761313966353932326135396134 66366637316439393465373066383864336638326533346438343162336161663436323031643235
34663636353535623963666463386431376166633130343834393934323461303934363066386565 65633735613538666133353962646134353430633037663761353464313230336332323035386539
37386563396335363430383135656437316635623764386631333665646563373735666333613633 39323363633863383861356162333137643433653135323433366636383966363137376339383131
32303430663066336334383533643434326566343861323932326131313032316636643135363166 63356230333434643738383938396535313561356236656532376435623933343236636136353666
66386361623266616536363365663131326537333762373538653238646334303138333636326530 37376434393664386438626661663431396430343431633435343436636665366138623632613665
32643833333331633435646331363764633835666537356665663130656138613661383762323630 35373433613065666436313266373332313731633534386161383437386432353138636265346563
39366531333964656633313130373733373631313936663961386162333564343866616238383863 39643862623936623636326664636365313765653666393433386631373162623332653139313133
63326134336534346233316134643136393564363431373563323233393938653063383131303561 61376534313835666165313762653061633236353832633161313533376630636131666465313338
39383733306566646563363137373662653935623366666363383837373031613036306637313330 39356530346332623633343536333130346230363233386435346239353535316561623331613533
31366434303432373432646333326462336133343762393730346534633934363565323766363234 34623235336563613939333739643331343832353631333436653361623934626234343464613232
66653836663832316632613436313030393161303031363932353562623437336335393463643335 36303263363530396334373438653166343661346531363764353233366464666263646161653432
63636435323034373637323235663665346166346235356662626465383538616166653138653933 64313236653735323664323965366563316166623362393032396262636339306562643964653932
65633065613938623234363362336332376366336236313731656462643531366634663664333939 36643534346235383066326331313338333366343335393038633137663836313831313632386464
39313730313365363332613532623762303330386632303136383961616438616237386432653234 36626136666665623262373762643233653036383839666130623866313236393265306534343562
32636463303235323930306463316234343262393363383430373961646264643930386131623930 38346261353663383730346666626131313766643233323865626437643633326438303735353663
64613430303236393830666531303430653638363838396464373863383766386365653435366564 31373665343363666236326661336534333534363666396665396437656266386331303563323666
35626462613533323735323537373236666233663935343763623465393039386664333561623363 37326336663562353835313062646538323735336466626461333836366435313835636462356163
66383866326331613136303864333339393134613563613664633039316535636531363339396439 64636437346562343463643338353730303932623732396232396133366130626539663738313361
38653732336139313235333932383337313838653934663563613966633634313538653262393130 62373133396233366636653032306637303735373838346432653637303663616631323162373361
35383866326463636634393062376633316363613338656663323336616538383938646166323333 36623565306364343330376538336534323964633034383765616666636438316466663662623263
39643739663232363631653637306266653939363835366637613261613837313664643731373063 65666636666236353630633037393038373338373536336165623264306135656635383464353938
64613561366663386566656230306139386265633238383230613966376265383136663039356365 32343131316330616139663864383938386437333662323463626636383964623264343737363738
30383963373663323430633036616164306639306134306632656137663065666364626435613034 38613232663539656266343561653465356431393765643062336236653664626133353234383163
63623534326562336262393036336432653566306234663762633232383365353936646236383430 35346235343935386130376135363535316539313164613732643631623439653962313839386637
62303331343635616131623065353465396534653439303535623165373461343464643734643565 32613532666265346633336435346464656666346335656235373962633965626264343035633961
36356133306434346461616462343139616533386266653932613762303835636663326265323863 66666231383164313239373033373361343038373436346537353536303338613035366330393039
3561656265306635653232343032396139336135373232616637 31613638353037616338376630356630306230376564306532343838323236316137356130386665
62353166633038643032393530373461386465663935666430386238656637633265356362393237
63356464373734623561643863386431643266313139353033663162386361626133303064663563
64623537323734666665393537343963613036383331363262663933313365613866316366663730
62613466303836383861323563356362333333653564303938366235626362623965336438313932
38383164303232323166643533393738663536336666656433313537316264643930303634333637
30636231326462376562646636363136393761383665626663303133313336613766613366626436
64333466353461356631326433366634653338303362363230613863623735363934623133666430
64376637336635613838396235633164343933333237323133313632656464343039323763353663
37343133646633663762656331396362346635343463646236656330346363633533316531636566
37303662393034386263643563363564363663356635636236396638656136306664366363616165
62333366626433336461623032353831346662643934346430636535306439363839356132316466
36393164633030386538653135323461663632646266653663613366353339363437663537373931
63393135646539353162376635663833653462653964356135623138653137343431643339316239
64653734353631646661373833353436636134383038623539666662666439343039663230643133
31303262396164383439613063306462666662346464663235343637363565393238663138613862
63313064376336363637663832343134333236323466323662666334356232323537663734623466
32323766616663356435613737396639366635636663346535653534666431323966623463333039
64353365353031653136383561353439383266323365353361653530313933383130646539326337
32383266346433613264643939396364656633313766383333336132393936666433346263386264
38613034396430323235366564636365346563383935626330626130326236623361326161396363
65323635323361623864643864346633343239626438306131303039393362363764646432366332
34333931623535633439

View file

@ -27,6 +27,12 @@
- router - router
# Radius (backup only for now)
- hosts: radius-edc-backup.adm.auro.re
roles:
- radius
# WIP: Deploy authoritative DNS servers # WIP: Deploy authoritative DNS servers
# - hosts: authoritative_dns # - hosts: authoritative_dns
# vars: # vars:

View file

@ -0,0 +1,80 @@
- name: Add backports repositories
apt_repository:
repo: "{{ item }} http://deb.debian.org/debian buster-backports main contrib non-free"
loop:
- "deb"
- "deb-src"
- name: Ensure /var/www exists
file:
name: "/var/www"
state: directory
- name: Clone re2o repo
git:
repo: "https://gitlab.federez.net/re2o/re2o.git"
dest: "/var/www/re2o"
version: "master_freeradius_python3"
force: true
- name: Template local settings
template:
src: settings_local.py.j2
dest: "/var/www/re2o/re2o/settings_local.py"
# What follows is a hideous abomination.
# Blame freeradius-python3 on backports.
- name: try to install freeradius-python3 (this will fail on post-install)
apt:
name: freeradius-python3
ignore_errors: yes
no_log: yes
- name: fix freeradius-python3 postinstall script
template:
src: freeradius-python3.postinst.j2
dest: /var/lib/dpkg/info/freeradius-python3.postinst
- name: Setup radius symlinks
file:
src: "/var/www/re2o/freeradius_utils/{{ item.local_prefix }}{{ item.filename }}"
dest: "/etc/freeradius/3.0/{{ item.filename }}"
state: link
force: yes
loop:
- local_prefix: ""
filename: auth.py
- local_prefix: freeradius3/
filename: radiusd.conf
- local_prefix: freeradius3/
filename: mods-enabled/python
- local_prefix: freeradius3/
filename: mods-enabled/eap
- name: Configure radius clients.conf
template:
src: "{{ item }}.j2"
dest: "/etc/freeradius/3.0/{{ item }}"
loop:
- clients.conf
- sites-enabled/default
- sites-enabled/inner-tunnel
- name: reinstall broken backpage
apt:
name: freeradius-python3
force: yes
- name: Install radius requirements (except freeradius-python3)
shell:
cmd: "{{ item }}"
chdir: /var/www/re2o/
loop:
- "cat apt_requirements_radius.txt | grep -v freeradius-python3 | xargs apt-get -y install"
- "pip3 install -r pip_requirements.txt"
# End of hideousness (hopefully).

View file

@ -0,0 +1,18 @@
client radius-filaire {
ipaddr = 10.130.{{ apartment_block_id }}.0
netmask = 24
secret = {{ radius_secret_wired }}
require_message_authenticator = no
nastype = other
virtual_server = radius-filaire
}
client aurore-wifi {
ipaddr = 10.{{ subnet_ids.ap }}.0.0
netmask = 16
secret = {{ radius_secret_wifi }}
require_message_authenticator = no
nastype = other
virtual_server = radius-wifi
}

View file

@ -0,0 +1,14 @@
#!/bin/sh
# vim:ts=2:sw=2:et
set -e
case "$1" in
configure)
invoke-rc.d freeradius restart
;;
esac
exit 0

View file

@ -0,0 +1,53 @@
# -*- mode: conf-unix; coding: utf-8 -*-
proxy server {
default_fallback = no
}
realm LOCAL {
}
realm NULL {
}
#Proxy FedeRez #####
realm AUROREFEDEREZ {
auth_pool = aurore_central_radius_servers
# nostrip
}
home_server radius_aurore_v4 {
type = auth
ipaddr = 10.128.0.251
port = 1812
secret = aaVVvNUYD/MgE
require_message_authenticator =yes
response_window = 20
zombie_period = 40
revive_interval = 120
status_check = status-server
check_interval = 30
num_answers_to_alive = 3
}
#home_server _v6 {
# type = auth
# ipaddr =
# port = 1812
# secret =
# require_message_authenticator =yes
# response_window = 20
# zombie_period = 40
# revive_interval = 120
# status_check = status-server
# check_interval = 30
# num_answers_to_alive = 3
#}
home_server_pool aurore_central_radius_servers {
type = fail-over
home_server = radius_aurore_v4
}

View file

@ -0,0 +1,116 @@
# coding: utf-8
# Re2o est un logiciel d'administration développé initiallement au rezometz. Il
# se veut agnostique au réseau considéré, de manière à être installable en
# quelques clics.
#
# Copyright © 2017 Gabriel Détraz
# Copyright © 2017 Goulven Kermarec
# Copyright © 2017 Augustin Lemesle
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with this program; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
"""re2o.settings_locale
The file with all the available options for a locale configuration of re2o
"""
from __future__ import unicode_literals
# A secret key used by the server.
SECRET_KEY = "{{ re2o_secret_key }}"
# The password to access the project database
DB_PASSWORD = "{{ re2o_db_password }}"
# AES key for secret key encryption.
# The length must be a multiple of 16
AES_KEY = "{{ re2o_aes_key }}"
# Should the server run in debug mode ?
# SECURITY WARNING: don't run with debug turned on in production!
DEBUG = False
# A list of admins of the services. Receive mails when an error occurs
ADMINS = [('AURORE', 'monitoring.aurore@lists.crans.org'), ('Gabriel Detraz', 'detraz@crans.org')]
# The list of hostname the server will respond to.
ALLOWED_HOSTS = ['radius-pacaterie.adm.auro.re']
# The time zone the server is runned in
TIME_ZONE = 'Europe/Paris'
# The storage systems parameters to use
DATABASES = {
'default': { # The DB
'ENGINE': 'django.db.backends.postgresql_psycopg2',
'NAME': 're2o',
'USER': 're2o',
'PASSWORD': DB_PASSWORD,
'HOST': 're2o-db.adm.auro.re',
'TEST': {
'CHARSET': 'utf8',
'COLLATION': 'utf8_general_ci'
}
},
'ldap': { # The LDAP
'ENGINE': 'ldapdb.backends.ldap',
'NAME': 'ldap://10.128.0.11/',
'USER': 'cn=admin,dc=auro,dc=re',
'TLS': False,
'PASSWORD': '{{ ldap_admin_password }}',
}
}
# Security settings for secure https
# Activate once https is correctly configured
SECURE_CONTENT_TYPE_NOSNIFF = False
SECURE_BROWSER_XSS_FILTER = False
SESSION_COOKIE_SECURE = False
CSRF_COOKIE_SECURE = False
CSRF_COOKIE_HTTPONLY = False
X_FRAME_OPTIONS = 'DENY'
SESSION_COOKIE_AGE = 60 * 60 * 3
# The path where your organization logo is stored
LOGO_PATH = "static_files/logo.png"
# The mail configuration for Re2o to send mails
SERVER_EMAIL = 'no-reply@auro.re' # The mail address to use
EMAIL_HOST = 'localhost' # The host to use
EMAIL_PORT = 25 # The port to use
# Settings of the LDAP structure
LDAP = {
'base_user_dn': 'cn=Utilisateurs,dc=auro,dc=re',
'base_userservice_dn': 'ou=service-users,dc=auro,dc=re',
'base_usergroup_dn': 'ou=posix,ou=groups,dc=auro,dc=re',
'base_userservicegroup_dn': 'ou=services,ou=groups,dc=auro,dc=re',
'user_gid': 100,
}
# A range of UID to use. Used in linux environement
UID_RANGES = {
'users': [21001, 30000],
'service-users': [20000, 21000],
}
# A range of GID to use. Used in linux environement
GID_RANGES = {
'posix': [501, 600],
}
# Some optionnal Re2o Apps
OPTIONNAL_APPS_RE2O = ()
# Some Django apps you want to add in you local project
OPTIONNAL_APPS = OPTIONNAL_APPS_RE2O + ()

View file

@ -0,0 +1,239 @@
######################################################################
#
# As of 2.0.0, FreeRADIUS supports virtual hosts using the
# "server" section, and configuration directives.
#
# Virtual hosts should be put into the "sites-available"
# directory. Soft links should be created in the "sites-enabled"
# directory to these files. This is done in a normal installation.
#
# If you are using 802.1X (EAP) authentication, please see also
# the "inner-tunnel" virtual server. You will likely have to edit
# that, too, for authentication to work.
#
# $Id: 083407596aa5074d665adac9606e7de655b634aa $
#
######################################################################
#
# Read "man radiusd" before editing this file. See the section
# titled DEBUGGING. It outlines a method where you can quickly
# obtain the configuration you want, without running into
# trouble. See also "man unlang", which documents the format
# of this file.
#
# This configuration is designed to work in the widest possible
# set of circumstances, with the widest possible number of
# authentication methods. This means that in general, you should
# need to make very few changes to this file.
#
# The best way to configure the server for your local system
# is to CAREFULLY edit this file. Most attempts to make large
# edits to this file will BREAK THE SERVER. Any edits should
# be small, and tested by running the server with "radiusd -X".
# Once the edits have been verified to work, save a copy of these
# configuration files somewhere. (e.g. as a "tar" file). Then,
# make more edits, and test, as above.
#
# There are many "commented out" references to modules such
# as ldap, sql, etc. These references serve as place-holders.
# If you need the functionality of that module, then configure
# it in radiusd.conf, and un-comment the references to it in
# this file. In most cases, those small changes will result
# in the server being able to connect to the DB, and to
# authenticate users.
#
######################################################################
server default {
listen {
type = auth
ipaddr = *
port = 0
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
listen {
ipaddr = *
port = 0
type = acct
limit {
}
}
# IPv6 versions of the above - read their full config to understand options
listen {
type = auth
ipv6addr = :: # any. ::1 == localhost
port = 0
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
listen {
ipv6addr = ::
port = 0
type = acct
limit {
}
}
}
server radius-wifi {
authorize {
rewrite_calling_station_id
if (User-Name =~ /^(.*)@(.*)/){
if (User-Name !~ /^(.*)@(.*)auro(.*)/){
update control{
Proxy-To-Realm := 'AUROREFEDEREZ'
}
}
if ("%{request:User-Name}" =~ /^(.*)@(.*)auro(.*)/){
update request{
Stripped-User-Name := "%{1}"
}
}
}
filter_username
preprocess
suffix
eap {
ok = return
}
expiration
logintime
pap
}
authenticate {
Auth-Type PAP {
pap
}
Auth-Type CHAP {
chap
}
Auth-Type MS-CHAP {
mschap
}
mschap
digest
eap
}
preacct {
preprocess
acct_unique
suffix
files
}
accounting {
detail
unix
exec
}
session {
}
post-auth {
update {
&reply: += &session-state:
}
exec
remove_reply_message_if_eap
Post-Auth-Type REJECT {
-sql
attr_filter.access_reject
eap
remove_reply_message_if_eap
}
}
pre-proxy {
}
post-proxy {
eap
}
}
server radius-filaire{
authorize{
re2o
expiration
logintime
pap
}
authenticate{
Auth-Type PAP{
pap
}
Auth-Type CHAP{
chap
}
Auth-Type MS-CHAP{
mschap
}
digest
eap
}
preacct{
preprocess
acct_unique
suffix
files
}
accounting{
}
session{
}
post-auth{
re2o
exec
}
pre-proxy{
}
post-proxy{
eap
}
}

View file

@ -0,0 +1,345 @@
# -*- text -*-
######################################################################
#
# This is a virtual server that handles *only* inner tunnel
# requests for EAP-TTLS and PEAP types.
#
# $Id: 2c6f9611bfc7b4b782aeb9764e47e832690739c4 $
#
######################################################################
server inner-tunnel {
#
# This next section is here to allow testing of the "inner-tunnel"
# authentication methods, independently from the "default" server.
# It is listening on "localhost", so that it can only be used from
# the same machine.
#
# $ radtest USER PASSWORD 127.0.0.1:18120 0 testing123
#
# If it works, you have configured the inner tunnel correctly. To check
# if PEAP will work, use:
#
# $ radtest -t mschap USER PASSWORD 127.0.0.1:18120 0 testing123
#
# If that works, PEAP should work. If that command doesn't work, then
#
# FIX THE INNER TUNNEL CONFIGURATION SO THAT IT WORKS.
#
# Do NOT do any PEAP tests. It won't help. Instead, concentrate
# on fixing the inner tunnel configuration. DO NOTHING ELSE.
#
listen {
ipaddr = 127.0.0.1
port = 18120
type = auth
}
# Authorization. First preprocess (hints and huntgroups files),
# then realms, and finally look in the "users" file.
#
# The order of the realm modules will determine the order that
# we try to find a matching realm.
#
# Make *sure* that 'preprocess' comes before any realm if you
# need to setup hints for the remote radius server
authorize {
if ("%{request:User-Name}" =~ /^(.*)@auro(.*)/){
update request{
Stripped-User-Name := "%{1}"
}
}
#
# Take a User-Name, and perform some checks on it, for spaces and other
# invalid characters. If the User-Name appears invalid, reject the
# request.
#
# See policy.d/filter for the definition of the filter_username policy.
#
filter_username
re2o
#
# Do checks on outer / inner User-Name, so that users
# can't spoof us by using incompatible identities
#
# filter_inner_identity
#
# The chap module will set 'Auth-Type := CHAP' if we are
# handling a CHAP request and Auth-Type has not already been set
chap
#
# If the users are logging in with an MS-CHAP-Challenge
# attribute for authentication, the mschap module will find
# the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP'
# to the request, which will cause the server to then use
# the mschap module for authentication.
mschap
#
# Pull crypt'd passwords from /etc/passwd or /etc/shadow,
# using the system API's to get the password. If you want
# to read /etc/passwd or /etc/shadow directly, see the
# passwd module, above.
#
# unix
#
# Look for IPASS style 'realm/', and if not found, look for
# '@realm', and decide whether or not to proxy, based on
# that.
# IPASS
#
# If you are using multiple kinds of realms, you probably
# want to set "ignore_null = yes" for all of them.
# Otherwise, when the first style of realm doesn't match,
# the other styles won't be checked.
#
# Note that proxying the inner tunnel authentication means
# that the user MAY use one identity in the outer session
# (e.g. "anonymous", and a different one here
# (e.g. "user@example.com"). The inner session will then be
# proxied elsewhere for authentication. If you are not
# careful, this means that the user can cause you to forward
# the authentication to another RADIUS server, and have the
# accounting logs *not* sent to the other server. This makes
# it difficult to bill people for their network activity.
#
suffix
# ntdomain
#
# The "suffix" module takes care of stripping the domain
# (e.g. "@example.com") from the User-Name attribute, and the
# next few lines ensure that the request is not proxied.
#
# If you want the inner tunnel request to be proxied, delete
# the next few lines.
#
update control {
&Proxy-To-Realm := LOCAL
}
#
# This module takes care of EAP-MSCHAPv2 authentication.
#
# It also sets the EAP-Type attribute in the request
# attribute list to the EAP type from the packet.
#
# The example below uses module failover to avoid querying all
# of the following modules if the EAP module returns "ok".
# Therefore, your LDAP and/or SQL servers will not be queried
# for the many packets that go back and forth to set up TTLS
# or PEAP. The load on those servers will therefore be reduced.
#
eap {
ok = return
}
#
# Read the 'users' file
#files
#
# Look in an SQL database. The schema of the database
# is meant to mirror the "users" file.
#
# See "Authorization Queries" in sql.conf
#-sql
#
# If you are using /etc/smbpasswd, and are also doing
# mschap authentication, the un-comment this line, and
# enable the "smbpasswd" module.
# smbpasswd
#
# The ldap module reads passwords from the LDAP database.
#-ldap
#
# Enforce daily limits on time spent logged in.
# daily
expiration
logintime
#
# If no other module has claimed responsibility for
# authentication, then try to use PAP. This allows the
# other modules listed above to add a "known good" password
# to the request, and to do nothing else. The PAP module
# will then see that password, and use it to do PAP
# authentication.
#
# This module should be listed last, so that the other modules
# get a chance to set Auth-Type for themselves.
#
pap
}
# Authentication.
#
#
# This section lists which modules are available for authentication.
# Note that it does NOT mean 'try each module in order'. It means
# that a module from the 'authorize' section adds a configuration
# attribute 'Auth-Type := FOO'. That authentication type is then
# used to pick the appropriate module from the list below.
#
# In general, you SHOULD NOT set the Auth-Type attribute. The server
# will figure it out on its own, and will do the right thing. The
# most common side effect of erroneously setting the Auth-Type
# attribute is that one authentication method will work, but the
# others will not.
#
# The common reasons to set the Auth-Type attribute by hand
# is to either forcibly reject the user, or forcibly accept him.
#
authenticate {
#
# PAP authentication, when a back-end database listed
# in the 'authorize' section supplies a password. The
# password can be clear-text, or encrypted.
Auth-Type PAP {
pap
}
#
# Most people want CHAP authentication
# A back-end database listed in the 'authorize' section
# MUST supply a CLEAR TEXT password. Encrypted passwords
# won't work.
Auth-Type CHAP {
chap
}
#
# MSCHAP authentication.
Auth-Type MS-CHAP {
mschap
}
#
# For old names, too.
#
mschap
#
# Allow EAP authentication.
eap
}
######################################################################
#
# There are no accounting requests inside of EAP-TTLS or PEAP
# tunnels.
#
######################################################################
# Session database, used for checking Simultaneous-Use. Either the radutmp
# or rlm_sql module can handle this.
# The rlm_sql module is *much* faster
session {
radutmp
#
# See "Simultaneous Use Checking Queries" in sql.conf
# sql
}
# Post-Authentication
# Once we KNOW that the user has been authenticated, there are
# additional steps we can take.
#
# Note that the last packet of the inner-tunnel authentication
# MAY NOT BE the last packet of the outer session. So updating
# the outer reply MIGHT work, and sometimes MIGHT NOT. The
# exact functionality depends on both the inner and outer
# authentication methods.
#
# If you need to send a reply attribute in the outer session,
# the ONLY safe way is to set "use_tunneled_reply = yes", and
# then update the inner-tunnel reply.
post-auth {
re2o
Post-Auth-Type REJECT {
# log failed authentications in SQL, too.
-sql
attr_filter.access_reject
#
# Let the outer session know which module failed, and why.
#
update outer.session-state {
&Module-Failure-Message := &request:Module-Failure-Message
}
}
}
#
# When the server decides to proxy a request to a home server,
# the proxied request is first passed through the pre-proxy
# stage. This stage can re-write the request, or decide to
# cancel the proxy.
#
# Only a few modules currently have this method.
#
pre-proxy {
# Uncomment the following line if you want to change attributes
# as defined in the preproxy_users file.
# files
# Uncomment the following line if you want to filter requests
# sent to remote servers based on the rules defined in the
# 'attrs.pre-proxy' file.
# attr_filter.pre-proxy
# If you want to have a log of packets proxied to a home
# server, un-comment the following line, and the
# 'detail pre_proxy_log' section, above.
# pre_proxy_log
}
#
# When the server receives a reply to a request it proxied
# to a home server, the request may be massaged here, in the
# post-proxy stage.
#
post-proxy {
# If you want to have a log of replies from a home server,
# un-comment the following line, and the 'detail post_proxy_log'
# section, above.
# post_proxy_log
# Uncomment the following line if you want to filter replies from
# remote proxies based on the rules defined in the 'attrs' file.
# attr_filter.post-proxy
#
# If you are proxying LEAP, you MUST configure the EAP
# module, and you MUST list it here, in the post-proxy
# stage.
#
# You MUST also use the 'nostrip' option in the 'realm'
# configuration. Otherwise, the User-Name attribute
# in the proxied request will not match the user name
# hidden inside of the EAP packet, and the end server will
# reject the EAP request.
#
eap
}
} # inner-tunnel server block