Chapter 34. Setting up an 802.1x network authentication service for LAN clients by using hostapd with FreeRADIUS backend

Procedure

1. If the bridge interface does not exist, create it:

   # nmcli connection add type bridge con-name br0 ifname br0

   Copy to Clipboard

2. Assign the Ethernet interfaces to the bridge:

   # nmcli connection add type ethernet slave-type bridge con-name br0-port1 ifname enp1s0 master br0
   # nmcli connection add type ethernet slave-type bridge con-name br0-port2 ifname enp7s0 master br0
   # nmcli connection add type ethernet slave-type bridge con-name br0-port3 ifname enp8s0 master br0
   # nmcli connection add type ethernet slave-type bridge con-name br0-port4 ifname enp9s0 master br0

   Copy to Clipboard

3. Enable the bridge to forward extensible authentication protocol over LAN (EAPOL) packets:

   # nmcli connection modify br0 group-forward-mask 8

   Copy to Clipboard

4. Disable the Spanning Tree Protocol (STP) on the bridge device:

   # *nmcli connection modify br0 stp off"

   Copy to Clipboard

5. Configure the connection to automatically activate the ports:

   # nmcli connection modify br0 connection.autoconnect-slaves 1

   Copy to Clipboard

6. Activate the connection:

   # nmcli connection up br0

   Copy to Clipboard

Verification

1. Display the link status of Ethernet devices that are ports of a specific bridge:

   # ip link show master br0
   3: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master br0 state UP mode DEFAULT group default qlen 1000
       link/ether 52:54:00:62:61:0e brd ff:ff:ff:ff:ff:ff
   ...

   Copy to Clipboard

2. Verify if forwarding of EAPOL packets is enabled on the br0 device:

   # cat /sys/class/net/br0/bridge/group_fwd_mask
   0x8

   Copy to Clipboard

   If the command returns 0x8, forwarding is enabled.

Procedure

1. Create a private key and request a certificate from IdM:

   # ipa-getcert request -w -k /etc/pki/tls/private/radius.key -f /etc/pki/tls/certs/radius.pem -o "root:radiusd" -m 640 -O "root:radiusd" -M 640 -T caIPAserviceCert -C 'systemctl restart radiusd.service' -N freeradius.idm.example.com -D freeradius.idm.example.com -K radius/freeradius.idm.example.com

   Copy to Clipboard

   The certmonger service stores the private key in the /etc/pki/tls/private/radius.key file and the certificate in the /etc/pki/tls/certs/radius.pem file, and it sets secure permissions. Additionally, certmonger will monitor the certificate, renew it before it expires, and restart the radiusd service after the certificate was renewed.

2. Verify that the CA successfully issued the certificate:

   # ipa-getcert list -f /etc/pki/tls/certs/radius.pem
   ...
   Number of certificates and requests being tracked: 1.
   Request ID '20240918142211':
           status: MONITORING
           stuck: no
           key pair storage: type=FILE,location='/etc/pki/tls/private/radius.key'
           certificate: type=FILE,location='/etc/pki/tls/certs/radius.crt'
           ...

   Copy to Clipboard

3. Create the /etc/raddb/certs/dh file with Diffie-Hellman (DH) parameters. For example, to create a DH file with a 2048 bits prime, enter:

   # openssl dhparam -out /etc/raddb/certs/dh 2048

   Copy to Clipboard

   For security reasons, do not use a DH file with less than a 2048 bits prime. Depending on the number of bits, the creation of the file can take several minutes.

4. Edit the /etc/raddb/mods-available/eap file:

   1. Configure the TLS-related settings in the tls-config tls-common directive:

      eap {
          ...
          tls-config tls-common {
              ...
      	private_key_file = /etc/pki/tls/private/radius.key
      	certificate_file = /etc/pki/tls/certs/radius.pem
      	ca_file = /etc/ipa/ca.crt
              ...
          }
      }

      Copy to Clipboard

   2. Set the default_eap_type parameter in the eap directive to ttls:

      eap {
          ...
          default_eap_type = ttls
          ...
      }

      Copy to Clipboard

   3. Comment out the md5 directives to disable the insecure EAP-MD5 authentication method:

      eap {
          ...
          # md5 {
          # }
          ...
      }

      Copy to Clipboard

      Note that, in the default configuration file, other insecure EAP authentication methods are commented out by default.

5. Edit the /etc/raddb/sites-available/default file, and comment out all authentication methods other than eap:

   authenticate {
       ...
       # Auth-Type PAP {
       #     pap
       # }
   
       # Auth-Type CHAP {
       #     chap
       # }
   
       # Auth-Type MS-CHAP {
       #     mschap
       # }
   
       # mschap
   
       # digest
       ...
   }

   Copy to Clipboard

   This leaves only EAP enabled for the outer authentication and disables plain-text authentication methods.

6. Edit the /etc/raddb/sites-available/inner-tunnel file, and make the following changes:

   1. Comment out the -ldap entry and add the ldap module configuration to the authorize directive:

      authorize {
          ...
      
          #-ldap
          ldap
          if ((ok || updated) && User-Password) {
              update {
                  control:Auth-Type := ldap
              }
          }
      
          ...
      }

      Copy to Clipboard

   2. Uncomment the LDAP authentication type in the authenticate directive:

      authenticate {
          Auth-Type LDAP {
              ldap
          }
      }

      Copy to Clipboard

7. Enable the ldap module:

   # ln -s /etc/raddb/mods-available/ldap /etc/raddb/mods-enabled/ldap

   Copy to Clipboard

8. Edit the /etc/raddb/mods-available/ldap file, and make the following changes:

   1. In the ldap directive, set the IdM LDAP server URL and the base distinguished name (DN):

      ldap {
          ...
          server = 'ldaps://idm_server.idm.example.com'
          base_dn = 'cn=users,cn=accounts,dc=idm,dc=example,dc=com'
          ...
      }

      Copy to Clipboard

      Specify the ldaps protocol in the server URL to use TLS-encrypted connections between the FreeRADIUS host and the IdM server.

   2. In the ldap directive, enable TLS certificate validation of the IdM LDAP server:

      tls {
          ...
              require_cert = 'demand'
          ...
      }

      Copy to Clipboard

9. Edit the /etc/raddb/clients.conf file:

   1. Set a secure password in the localhost and localhost_ipv6 client directives:

      client localhost {
          ipaddr = 127.0.0.1
          ...
          secret = localhost_client_password
          ...
      }
      
      client localhost_ipv6 {
          ipv6addr = ::1
          secret = localhost_client_password
      }

      Copy to Clipboard

   2. Add a client directive for the network authenticator:

      client hostapd.example.org {
          ipaddr = 192.0.2.2/32
          secret = hostapd_client_password
      }

      Copy to Clipboard

   3. Optional: If other hosts should also be able to access the FreeRADIUS service, add client directives for them as well, for example:

      client <hostname_or_description> {
          ipaddr = <IP_address_or_range>
          secret = <client_password>
      }

      Copy to Clipboard

      The ipaddr parameter accepts IPv4 and IPv6 addresses, and you can use the optional classless inter-domain routing (CIDR) notation to specify ranges. However, you can set only one value in this parameter. For example, to grant access to both an IPv4 and IPv6 address, you must add two client directives.

      Use a descriptive name for the client directive, such as a hostname or a word that describes where the IP range is used.

10. Verify the configuration files:

    # radiusd -XC
    ...
    Configuration appears to be OK

    Copy to Clipboard

11. Open the RADIUS ports in the firewalld service:

    # firewall-cmd --permanent --add-service=radius
    # firewall-cmd --reload

    Copy to Clipboard

12. Enable and start the radiusd service:

    # systemctl enable --now radiusd

    Copy to Clipboard

Procedure

1. Create the /etc/hostapd/hostapd.conf file with the following content:

   # General settings of hostapd
   # ===========================
   
   # Control interface settings
   ctrl_interface=/var/run/hostapd
   ctrl_interface_group=wheel
   
   # Enable logging for all modules
   logger_syslog=-1
   logger_stdout=-1
   
   # Log level
   logger_syslog_level=2
   logger_stdout_level=2
   
   
   # Wired 802.1X authentication
   # ===========================
   
   # Driver interface type
   driver=wired
   
   # Enable IEEE 802.1X authorization
   ieee8021x=1
   
   # Use port access entry (PAE) group address
   # (01:80:c2:00:00:03) when sending EAPOL frames
   use_pae_group_addr=1
   
   
   # Network interface for authentication requests
   interface=br0
   
   
   # RADIUS client configuration
   # ===========================
   
   # Local IP address used as NAS-IP-Address
   own_ip_addr=192.0.2.2
   
   # Unique NAS-Identifier within scope of RADIUS server
   nas_identifier=hostapd.example.org
   
   # RADIUS authentication server
   auth_server_addr=192.0.2.1
   auth_server_port=1812
   auth_server_shared_secret=hostapd_client_password
   
   # RADIUS accounting server
   acct_server_addr=192.0.2.1
   acct_server_port=1813
   acct_server_shared_secret=hostapd_client_password

   Copy to Clipboard

   For further details about the parameters used in this configuration, see their descriptions in the /usr/share/doc/hostapd/hostapd.conf example configuration file.

2. Enable and start the hostapd service:

   # systemctl enable --now hostapd

   Copy to Clipboard

Procedure

1. Optional: Create a user in Identity Management (IdM):

   # ipa user-add --first "Test" --last "User" idm_user --password

   Copy to Clipboard

2. Create the /etc/wpa_supplicant/wpa_supplicant-TTLS.conf file with the following content:

   ap_scan=0
   
   network={
       eap=TTLS
       eapol_flags=0
       key_mgmt=IEEE8021X
   
       # Anonymous identity (sent in unencrypted phase 1)
       # Can be any string
       anonymous_identity="anonymous"
   
       # Inner authentication (sent in TLS-encrypted phase 2)
       phase2="auth=PAP"
       identity="idm_user"
       password="idm_user_password"
   
       # CA certificate to validate the RADIUS server's identity
       ca_cert="/etc/ipa/ca.crt"
   }

   Copy to Clipboard

3. To authenticate to:

   • A FreeRADIUS server, enter:

     # eapol_test -c /etc/wpa_supplicant/wpa_supplicant-TTLS.conf -a 192.0.2.1 -s <client_password>
     ...
     EAP: Status notification: remote certificate verification (param=success)
     ...
     CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully
     ...
     SUCCESS

     Copy to Clipboard

     The -a option defines the IP address of the FreeRADIUS server, and the -s option specifies the password for the host on which you run the command in the FreeRADIUS server’s client configuration.

   • An authenticator, enter:

     # wpa_supplicant -c /etc/wpa_supplicant/wpa_supplicant-TTLS.conf -D wired -i enp0s31f6
     ...
     enp0s31f6: CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully
     ...

     Copy to Clipboard

     The -i option specifies the network interface name on which wpa_supplicant sends out extended authentication protocol over LAN (EAPOL) packets.

     For more debugging information, pass the -d option to the command.

Procedure

1. Create the /usr/local/bin/802-1x-tr-mgmt file with the following content:

   #!/bin/sh
   
   TABLE="tr-mgmt-${1}"
   read -r -d '' TABLE_DEF << EOF
   table bridge ${TABLE} {
       set allowed_macs {
           type ether_addr
       }
   
       chain accesscontrol {
           ether saddr @allowed_macs accept
           ether daddr @allowed_macs accept
           drop
       }
   
       chain forward {
           type filter hook forward priority 0; policy accept;
           meta ibrname "$1" jump accesscontrol
       }
   }
   EOF
   
   case ${2:-NOTANEVENT} in
       block_all)
           nft destroy table bridge "$TABLE"
           printf "$TABLE_DEF" | nft -f -
           echo "$1: All the bridge traffic blocked. Traffic for a client with a given MAC will be allowed after 802.1x authentication"
           ;;
   
       AP-STA-CONNECTED | CTRL-EVENT-EAP-SUCCESS | CTRL-EVENT-EAP-SUCCESS2)
           nft add element bridge tr-mgmt-br0 allowed_macs { $3 }
           echo "$1: Allowed traffic from $3"
           ;;
   
       AP-STA-DISCONNECTED | CTRL-EVENT-EAP-FAILURE)
           nft delete element bridge tr-mgmt-br0 allowed_macs { $3 }
           echo "$1: Denied traffic from $3"
           ;;
   
       allow_all)
           nft destroy table bridge "$TABLE"
           echo "$1: Allowed all bridge traffice again"
           ;;
   
       NOTANEVENT)
           echo "$0 was called incorrectly, usage: $0 interface event [mac_address]"
           ;;
   esac

   Copy to Clipboard

2. Create the /etc/systemd/system/802-1x-tr-mgmt@.service systemd service file with the following content:

   [Unit]
   Description=Example 802.1x traffic management for hostapd
   After=hostapd.service
   After=sys-devices-virtual-net-%i.device
   
   [Service]
   Type=simple
   ExecStartPre=bash -c '/usr/sbin/hostapd_cli ping | grep PONG'
   ExecStartPre=/usr/local/bin/802-1x-tr-mgmt %i block_all
   ExecStart=/usr/sbin/hostapd_cli -i %i -a /usr/local/bin/802-1x-tr-mgmt
   ExecStopPost=/usr/local/bin/802-1x-tr-mgmt %i allow_all
   
   [Install]
   WantedBy=multi-user.target

   Copy to Clipboard

3. Reload systemd:

   # systemctl daemon-reload

   Copy to Clipboard

4. Enable and start the 802-1x-tr-mgmt service with the interface name hostapd is listening on:

   # systemctl enable --now 802-1x-tr-mgmt@br0.service

   Copy to Clipboard