Page tree

Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Numbered Headings

Include Page
TEM:_SystemPrep_DEB8
TEM:_SystemPrep_DEB8

Install the Moonshot RP Proxy

We’re now ready to install the Moonshot software and its required dependencies. Install the software by running the following command:

Code Block
languagebash
$ apt-get install freeradius-abfab freeradius-utils moonshot-gss-eap moonshot-ui moonshot-trust-router dbus-x11
Info
If you try to start FreeRADIUS at this point, it will not currently start successfully as the certificates it requires have not been generated - they are created in step 4.1 below.

 

Configure the Moonshot RP Proxy

Next, we need to configure the Moonshot RP.

Configure FreeRADIUS

Include Page
TEM:_CertPrep_DEB
TEM:_CertPrep_DEB

Moonshot UI credential store

We need to enable the freeradius user to use the Moonshot UI flatstore:

Code Block
languagebash
$ echo "freerad" >> /etc/moonshot/flatstore-users

Set up the FreeRADIUS and Trust Router users

To allow FreeRADIUS to read a key database for dynamic realm support, we need to place the FreeRADIUS user and the Trust Router users into each other's groups to allow them to read shared files of each other.

Code Block
languagebash
$ adduser freerad trustrouter
$ adduser trustrouter freerad

RadSec

Next we need to configure RadSec. We do this by creating a file at /etc/radsec.conf with the following:

Code Block
linenumberstrue
realm gss-eap {
	type = "TLS"
	cacertfile = "/etc/freeradius/certs/ca.pem"
	certfile = "/etc/freeradius/certs/client.pem"
	certkeyfile = "/etc/freeradius/certs/client.key"
	disable_hostname_check = yes
	server {
		hostname = "127.0.0.1"
		service = "2083"
		secret = "radsec"
	}
}

Dynamic Realm supprt

We next need to tell your FreeRADIUS server to support dynamic lookup of realms.

  1. Open /etc/freeradius/proxy.conf for editing:
    1. Towards the top of the file is a stanza beginning "proxy server {". Find this.
    2. Below this, add dynamic = yes, like so:

      Code Block
      linenumberstrue
      proxy server {
              dynamic = yes

Channel Binding Support

We next need to configure your FreeRADIUS server to support channel bindings.

  1. Open /etc/freeradius/sites-available/abfab-tls for editing:
    1. Scroll to the client default stanza at the bottom of the file
    2. Edit the stanza to match the below:

      Code Block
      client default {
              ipaddr = 0.0.0.0/0
              proto = tls
              gss_acceptor_realm_name = "your RP realm here"
              trust_router_coi = ov-apc.moonshot.ja.net
      }
      Note
      titlegss_acceptor_realm_name

      For simple deployments, you can simply specify the same RP realm as in the rp_realm option in Section 4.1 below. This For simple deployments, this usually matches your IDP Realm. For extended pilots or production environments, you should specify a realm value that will match all the hosts you will be connecting to your RP Proxy.

      Additionally, you must add a domain wildcard constraint in the Jisc Assent Portal that will match this realm value.

    3. If you have any other client definitions here, for example to distinguish between internal and external clients, also apply the change to them.

Configure the Trust Router Client

If you are going to connect your Moonshot RP Proxy to a Trust Router network, then the next step involves configuring the Trust Router client software and configuring its connection to a Trust Router.

Include Page
TEM:_TIDC_FR_Prep_DEB
TEM:_TIDC_FR_Prep_DEB

Testing

Now that we have the Moonshot RP Proxy installed and configured, we're now ready to test!

Tip
titleTip

At this point you probably want two consoles open on the server, so that you can manually run various components separately.

Testing FreeRADIUS locally

The first test is to check whether FreeRADIUS is working in its most basic manner.

  1. In window 1, run (as the freerad user)

    Code Block
    languagebash
    $ su --shell /bin/bash freerad
    $ unset DISPLAY
    $ freeradius -fxx -l stdout
  2. Check that no errors are output.

Testing the Trust Router connection

To test the connection to Trust Router, we need to make sure the Temporary Identity Server (TIDS) software is running, then use the Temporary Identity Client (TIDC) software to simulate a connection to the Trust Router.

Testing using the Temporary Identity Client (TIDC)

  1. In window 2, (as the freerad user) run the tidc command:

    Code Block
    languagebash
    $ su --shell /bin/bash freerad
    $ unset DISPLAY
    $ tidc tr.moonshot.ja.net [your rp-realm] ov-apc.moonshot.ja.net ov-apc.moonshot.ja.net
    Info

    This uses the "tidc" binary which is used in the following way - tidc [hostname-of-trust-router] [rp-realm] [hostname-of-apc-server] [apc-name]

  2. If the Trust Router connection was successful, you should see something like the following:

    Code Block
    titleIn window 2 - TIDC output
    TIDC Client:
    Server = tr.moonshot.ja.net, rp_realm = moonshot-rp.camford.ac.uk, target_realm = ov-apc.moonshot.ja.net, community = ov-apc.moonshot.ja.net
    connecting to host 'tr.moonshot.ja.net' on port 12309
    CTRL-EVENT-EAP-STARTED EAP authentication started
    CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=21
    CTRL-EVENT-EAP-METHOD EAP vendor 0 method 21 (TTLS) selected
    CTRL-EVENT-EAP-PEER-CERT [...]
    CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully
    tidc_fwd_request: Sending TID request:
    
    [...]
    
    tr_msg_decode_tidresp(): Success! result = success.
    tr_msg_decode_servers(): Number of servers = 1.
    Response received! Realm = ov-apc.moonshot.ja.net, Community = ov-apc.moonshot.ja.net.
    Client Key Generated (len = 256):
    
    [...]

Next Steps

At this point, you now have a Moonshot RP that is working and registered with a Trust Router. Now for the next steps:

Automatically start the software

FreeRADIUS

To automatically start FreeRADIUS, issue the following command (as root):

Code Block
$ sudo update-rc.d freeradius defaults

 

Configure clients

The next step is to configure the Moonshot RP Proxy to Talk to Applications/Services.

 

...