wpa howto.htm

802.1x认证的认证服务器freeradius的howto文档

</p><p>My client is a Hewlett-Packard Pavilion zx5000-series notebook running Windows XP SP1 with a Broadcom 54g MaxPerformance 802.11g wireless ethernet adapter. In contrast, this has a 2.8&nbsp;GHz Pentium 4 CPU with 512 Mb RAM, and still doesn't even know it's born.
</p><p><br />
</p>
<div class="editsection" style="float:right;margin-left:5px;">[<a href="/index.php?title=WPA_HOWTO&amp;action=edit&amp;section=13" title="Edit section: Wireless Access Point">edit</a>]</div><a name="Wireless_Access_Point"></a><h4>Wireless Access Point</h4>
<p>I use a <a href="http://www.usrobotics.com/" class="external text" title="http://www.usrobotics.com/" rel="nofollow">U.S. Robotics</a> SureConnect 9106 ADSL Wireless Gateway as a AP. It turns out that this is actually three separate devices rolled into one. Firstly, the DSL modem; secondly, an Ethernet switch. Finally, there is a computer in its own right in the unit running BusyBox Linux 0.60.4 (2.4 series kernel), complete with tools like IPTables for firewalling, etc. This computer has two physical network interfaces, <tt>eth0</tt>, hard-wired onto the switch, and <tt>wl0</tt>, the wireless interface. A bridge device <tt>br0</tt> sits across these two, facilitating wireless access.
</p>
<div class="editsection" style="float:right;margin-left:5px;">[<a href="/index.php?title=WPA_HOWTO&amp;action=edit&amp;section=14" title="Edit section: Network Topology">edit</a>]</div><a name="Network_Topology"></a><h4>Network Topology</h4>
<p>My RADIUS authentication server also acts as the local DNS server and DHCP server. It has two Ethernet cards in it: <tt>eth0</tt> is connected to the wired network, and <tt>eth1</tt> goes into the back of the AP, both on different Class C subnets. The machine has a number of IPTables rules configured to negotiate traffic between these two subnets.
</p>
<div class="editsection" style="float:right;margin-left:5px;">[<a href="/index.php?title=WPA_HOWTO&amp;action=edit&amp;section=15" title="Edit section: HOWTO Do It: An Outline">edit</a>]</div><a name="HOWTO_Do_It:_An_Outline"></a><h2>HOWTO Do It: An Outline</h2>
<p>OK, here's what we'll do get our WPA Authentication working:
</p>
<ol><li> <b>Make certificates.</b>&nbsp;&nbsp;&nbsp;Certificates are a digital means of ensuring the identity of a machine or individual and providing keys for encryption. We'll need certificates for the client(s) and RADIUS server. These certificates also need to be certified by a root certification authority (CA), and we'll make one of these as well.
</li><li> <b>Configure FreeRADIUS.</b>&nbsp;&nbsp;&nbsp;FreeRADIUS checks the certificate and tells the wireless access point whether or not to accept the connection request.
</li><li> <b>Configure the AP.</b>&nbsp;&nbsp;&nbsp;Many modern APs can be configured as a NAS that refers to a RADIUS server for authentication.
</li><li> <b>Configure the Client.</b>
</li></ol>
<div class="editsection" style="float:right;margin-left:5px;">[<a href="/index.php?title=WPA_HOWTO&amp;action=edit&amp;section=16" title="Edit section: Step 1: Make Certificates">edit</a>]</div><a name="Step_1:_Make_Certificates"></a><h2>Step 1: Make Certificates</h2>
<p>Here, we create and install the digital certificates used to authenticate clients on the wireless network.
</p>
<blockquote><span class="label">Reminder</span>&nbsp;&nbsp;&nbsp;You will need the OpenSSL script <span class="filename">CA.pl</span> in order to complete this step. This may have come when you built OpenSSL, or as part of your distribution. In Fedora Core 1, this means installing the <tt>openssl-perl</tt> package.</blockquote>
<div class="editsection" style="float:right;margin-left:5px;">[<a href="/index.php?title=WPA_HOWTO&amp;action=edit&amp;section=17" title="Edit section: Certificate Generation Scripts">edit</a>]</div><a name="Certificate_Generation_Scripts"></a><h3>Certificate Generation Scripts</h3>
<p>The following shell scripts may be copied and pasted into the named files. Note that in all three, you will need to set some of the following parameters by hand. <i>These scripts are derived from those in Raymond McKay's HOWTO (see Acknowledgments) with slight modifications.</i>
</p>
<blockquote><span class="label">Note</span>&nbsp;&nbsp;&nbsp;These scripts are <i>not</i> in a ready-to-run state, and you will have to provide substitutions for the <span class="hl">highlighted</span> sections appropriate to your site. Also, please read the note on shell script variables in <a href="/WPA_HOWTO#Notes_on_the_Shell_Script_Variables" title="WPA HOWTO">&sect;&sect;3.1.2</a>, as some of the paths and program names may not be appropriate to your system.</blockquote>
<div class="editsection" style="float:right;margin-left:5px;">[<a href="/index.php?title=WPA_HOWTO&amp;action=edit&amp;section=18" title="Edit section: Script Listings">edit</a>]</div><a name="Script_Listings"></a><h4>Script Listings</h4>
<p>First, the script to generate the root CA certificate.
</p>
<div class="listing">
<p>Listing 3.1&nbsp;&nbsp;&nbsp;CA.root
</p>
<pre class="listing">
#!/bin/sh

OPENSSL=openssl
CAPL=&lt;span class=&quot;comment hl&quot;&gt;(path to your &lt;span class=&quot;filename&quot;&gt;CA.pl&lt;/span&gt;)&lt;/span&gt;
KEYGEN=&lt;span class=&quot;comment hl&quot;&gt;(your choice of key/password generator)&lt;/span&gt;
PASSDIR=pass
DERDIR=der
P12DIR=p12
PEMDIR=pem
VALIDFOR=365
PASSWD=$1

mkdir -p $PEMDIR $P12DIR $DERDIR $PASSDIR

if [ -z &quot;${PASSWD}&quot; ]; then
        echo &quot;No root password specified, trying $PASSDIR/root.pass.&quot;
        if [ -a $PASSDIR/root.pass ]; then
                PASSWD=`cat $PASSDIR/root.pass`
        else
                echo &quot;Not found. Generating password, see $PASSDIR/root.pass for contents.&quot;
                PASSWD=`$KEYGEN | head -c 32`
                cat /dev/null &gt; $PASSDIR/root.pass
                echo $PASSWD &gt;&gt; $PASSDIR/root.pass
        fi
fi

rm -rf demoCA

$OPENSSL req -new -x509 -days $VALIDFOR -keyout $PEMDIR/newreq.pem -out \
    $PEMDIR/newreq.pem -passin pass:$PASSWD -passout pass:$PASSWD
echo &quot;${PEMDIR}/newreq.pem&quot; | $CAPL -newca &gt;/dev/null
$OPENSSL pkcs12 -export -in demoCA/cacert.pem -inkey $PEMDIR/newreq.pem -out \
    $P12DIR/root.p12 -cacerts -passin pass:$PASSWD -passout pass:$PASSWD
$OPENSSL pkcs12 -in $P12DIR/root.p12 -out $PEMDIR/root.pem -passin \
    pass:$PASSWD -passout pass:$PASSWD
$OPENSSL x509 -inform PEM -outform DER -days $VALIDFOR -in $PEMDIR/root.pem \
    -out $DERDIR/root.der -passin pass:$PASSWD

rm -rf $PEMDIR/newreq.pem
</pre>
<p><br />
Next, the script to generate the server certificate.
</p>
<div class="listing">
<p>Listing 3.2&nbsp;&nbsp;&nbsp;CA.server
</p>
<pre class="listing">
#!/bin/sh

OPENSSL=openssl
KEYGEN=&lt;span class=&quot;comment hl&quot;&gt;(your choice of key/password generator)&lt;/span&gt;
PASSDIR=pass
DERDIR=der
P12DIR=p12
PEMDIR=pem
VALIDFOR=365

SNAME=$1
PASSWD=$2
ROOTPASSWD=$3

mkdir -p $PEMDIR $P12DIR $DERDIR $PASSDIR

if [ -z &quot;${SNAME}&quot; ]; then
        echo &quot;WARNING: server name not specified. Using \&quot;server\&quot;.&quot;
        SNAME=server
fi

if [ -z &quot;${PASSWD}&quot; ]; then
        echo &quot;No password specified, trying $PASSDIR/$SNAME.pass.&quot;
        if [ -a $PASSDIR/$SNAME.pass ]; then
                PASSWD=`cat $PASSDIR/$SNAME.pass`
        else
                echo &quot;Not found. Generating password, see $PASSDIR/$SNAME.pass for contents.&quot;
                PASSWD=`$KEYGEN | head -c 32`
                cat /dev/null &gt; $PASSDIR/$SNAME.pass
                echo $PASSWD &gt;&gt; $PASSDIR/$SNAME.pass
        fi
fi

if [ -z &quot;${ROOTPASSWD}&quot; ]; then
        echo &quot;No root password specified, trying $PASSDIR/root.pass.&quot;
        if [ -a $PASSDIR/root.pass ]; then
                ROOTPASSWD=`cat $PASSDIR/root.pass`
        else
                echo &quot;FATAL: No root certification password.&quot;
                exit
        fi
fi

$OPENSSL req -new -keyout $PEMDIR/newreq.pem -out $PEMDIR/newreq.pem -passin \
    pass:$PASSWD -passout pass:$PASSWD
$OPENSSL ca -policy policy_anything -out $PEMDIR/newcert.pem  -key $ROOTPASSWD \
    -extensions xpserver_ext -extfile xpextensions -days $VALIDFOR -infiles $PEMDIR/newreq.pem
$OPENSSL pkcs12 -export -in $PEMDIR/newcert.pem -inkey $PEMDIR/newreq.pem -out \
    $P12DIR/$1.p12 -clcerts -passin pass:$PASSWD -passout pass:$PASSWD
$OPENSSL pkcs12 -in $P12DIR/$SNAME.p12 -out $PEMDIR/$SNAME.pem -passin \
    pass:$PASSWD -passout pass:$PASSWD
$OPENSSL x509 -inform PEM -outform DER -in $PEMDIR/$SNAME.pem -out $DERDIR/$SNAME.der

rm -rf $PEMDIR/newcert.pem $PEMDIR/newreq.pem
</pre>
<p><br />
Finally, the client certificate.
</p>
<div class="listing">
<p>Listing 3.3&nbsp;&nbsp;&nbsp;CA.client
</p>
<pre class="listing">
#!/bin/sh

OPENSSL=openssl
KEYGEN=&lt;span class=&quot;comment hl&quot;&gt;(your choice of key/password generator)&lt;/span&gt;
PASSDIR=pass
DERDIR=der
P12DIR=p12
PEMDIR=pem
VALIDFOR=365

CLNAME=$1
PASSWD=$2
ROOTPASSWD=$3

mkdir -p $PEMDIR $P12DIR $DERDIR $PASSDIR

if [ -z &quot;${CLNAME}&quot; ]; then
        echo &quot;WARNING: client name not specified. Using \&quot;client\&quot;.&quot;
        CLNAME=client
fi

if [ -z &quot;${PASSWD}&quot; ]; then
        echo &quot;No password specified, trying $PASSDIR/$CLNAME.pass.&quot;
        if [ -a $PASSDIR/$CLNAME.pass ]; then
                PASSWD=`cat $PASSDIR/$CLNAME.pass`
        else
                echo &quot;Not found. Generating password, see $PASSDIR/$CLNAME.pass for contents.&quot;
                PASSWD=`$KEYGEN | head -c 16`
                cat /dev/null &gt; $PASSDIR/$CLNAME.pass
                echo $PASSWD &gt;&gt; $PASSDIR/$CLNAME.pass
        fi
fi

if [ -z &quot;${ROOTPASSWD}&quot; ]; then
        echo &quot;No root password specified, trying $PASSDIR/root.pass.&quot;
        if [ -a $PASSDIR/root.pass ]; then
                ROOTPASSWD=`cat $PASSDIR/root.pass`
        else
                echo &quot;FATAL: No root certification password.&quot;
                exit
        fi
fi

$OPENSSL req -new -keyout $PEMDIR/newreq.pem -out $PEMDIR/newreq.pem -passin \
    pass:$PASSWD -passout pass:$PASSWD
$OPENSSL ca -policy policy_anything -out $PEMDIR/newcert.pem -passin \
    pass:$PASSWD -key $ROOTPASSWD -extensions xpclient_ext -days $VALIDFOR \