Différences

Ci-dessous, les différences entre deux révisions de la page.

--- brouillon_1130ag [2009/05/11 15:57] – thierry
+++ brouillon_1130ag [2010/02/18 22:35] (Version actuelle) – thierry
@@ Ligne 3: / Ligne 3: @@
 Liens:
   -http://www.cisco.com/en/US/docs/wireless/access_point/12.4_10b_JA/configuration/guide/scg12410b.html
+  -http://www.nantes-wireless.org/actu/
 Trouvé dans une poubelle (enfin presque), un Cisco 1130AG...
@@ Ligne 234: / Ligne 235: @@
 Desactive cette polution:
   ap01(config)#no logging console
@@ Ligne 281: / Ligne 283: @@
   AP(config)# end
+=== disabling http ===
+  #no ip http server
+et/ou:
+  #no ip http secure-server
 ==== DHCP ====
@@ Ligne 885: / Ligne 891: @@
 Donc, on abandonne cette pseudo simplicité.
-==== certs =====
-  # openssl pkcs12 -export -in demoCA/cacert.pem -inkey demoCA/private/cakey.pem -out root.p12 -cacerts
-  Enter pass phrase for demoCA/private/cakey.pem:
-Je bloque !!!!!!!
-http://web.archive.org/web/20031206113912/http://www.impossiblereflex.com/8021x/eap-tls-HOWTO.htm
@@ Ligne 898: / Ligne 899: @@
 ===== LEAP =====
 Je n'y arrive pas.
 ===== PEAP =====
+Lien: http://web.archive.org/web/20031206113912/http://www.impossiblereflex.com/8021x/eap-tls-HOWTO.htm
 Une manière trés compliqué de rendre un reseau super securisé...
@@ Ligne 911: / Ligne 916: @@
 On créé ensuite les certificat pour les clients.
@@ Ligne 939: / Ligne 949: @@
 === scriptes ===
+Il y a plein de methodes pour procéder, mais on va s'aider de scripts pompé sur le net.
+On retrouve un script proche de ce qui suit dans "Radiator" , avec le nom **''"mkcertificate.sh"''**...
+== CA.root ==
+  #!/bin/sh
+  #SSL=/usr/local/openssl-certgen
+  #export PATH=${SSL}/bin/:${SSL}/ssl/misc:${PATH}
+  #export LD_LIBRARY_PATH=${SSL}/lib
+  export PATH=/usr/bin/:/usr/lib/ssl/misc:${PATH}
+  export LD_LIBRARY_PATH=/usr/lib/ssl
+  # needed if you need to start from scratch otherwise the CA.pl -newca command doesn't copy the new
+  # private key into the CA directories
+  rm -rf demoCA
+  echo "*********************************************************************************"
+  echo "Creating self-signed private key and certificate"
+  echo "When prompted override the default value for the Common Name field"
+  echo "*********************************************************************************"
+  echo
+  # Generate a new self-signed certificate.
+  # After invocation, newreq.pem will contain a private key and certificate
+  # newreq.pem will be used in the next step
+  openssl req -new -x509 -keyout newreq.pem -out newreq.pem -passin pass:whatever -passout pass:whatever
+  echo "*********************************************************************************"
+  echo "Creating a new CA hierarchy (used later by the "ca" command) with the certificate"
+  echo "and private key created in the last step"
+  echo "*********************************************************************************"
+  echo
+  echo "newreq.pem" | CA.pl -newca >/dev/null
+  echo "*********************************************************************************"
+  echo "Creating ROOT CA"
+  echo "*********************************************************************************"
+  echo
+  # Create a PKCS#12 file, using the previously created CA certificate/key
+  # The certificate in demoCA/cacert.pem is the same as in newreq.pem. Instead of
+  # using "-in demoCA/cacert.pem" we could have used "-in newreq.pem" and then omitted
+  # the "-inkey newreq.pem" because newreq.pem contains both the private key and certificate
+  openssl pkcs12 -export -in demoCA/cacert.pem -inkey newreq.pem -out root.p12 -cacerts -passin pass:whatever -passout pass:whatever
+  # parse the PKCS#12 file just created and produce a PEM format certificate and key in root.pem
+  openssl pkcs12 -in root.p12 -out root.pem -passin pass:whatever -passout pass:whatever
+  # Convert root certificate from PEM format to DER format
+  openssl x509 -inform PEM -outform DER -in root.pem -out root.der
+  #Clean Up
+  rm -rf newreq.pem
+  # TJ ------
+  echo "01" > demoCA/serial
+  # ---------
+Par rapport a l'original, j'ai modifié les lignes du debut et à la fin (car le fichier "serial" n'est pas créé).
+| :!: la pass phrase par defaut est "whatever" => on pourrait la changer, non ?|
+== CA.svr ==
+  #!/bin/sh
+  #SSL=/usr/local/openssl-certgen
+  #export PATH=${SSL}/bin/:${SSL}/ssl/misc:${PATH}
+  #export LD_LIBRARY_PATH=${SSL}/lib
+  export PATH=/usr/bin/:/usr/lib/ssl/misc:${PATH}
+  export LD_LIBRARY_PATH=/usr/lib/ssl
+  echo "*********************************************************************************"
+  echo "Creating server private key and certificate"
+  echo "When prompted enter the server name in the Common Name field."
+  echo "*********************************************************************************"
+  echo
+  # Request a new PKCS#10 certificate.
+  # First, newreq.pem will be overwritten with the new certificate request
+  openssl req -new -keyout newreq.pem -out newreq.pem -passin pass:whatever -passout pass:whatever
+  # Sign the certificate request. The policy is defined in the openssl.cnf file.
+  # The request generated in the previous step is specified with the -infiles option and
+  # the output is in newcert.pem
+  # The -extensions option is necessary to add the OID for the extended key for server authentication
+  openssl ca -policy policy_anything -out newcert.pem -passin pass:whatever -key whatever -extensions xpserver_ext -extfile xpextensions -infiles newreq.pem
+  # Create a PKCS#12 file from the new certificate and its private key found in newreq.pem
+  # and place in file specified on the command line
+  openssl pkcs12 -export -in newcert.pem -inkey newreq.pem -out $1.p12 -clcerts -passin pass:whatever -passout pass:whatever
+  # parse the PKCS#12 file just created and produce a PEM format certificate and key in certsrv.pem
+  openssl pkcs12 -in $1.p12 -out $1.pem -passin pass:whatever -passout pass:whatever
+  # Convert certificate from PEM format to DER format
+  openssl x509 -inform PEM -outform DER -in $1.pem -out $1.der
+  # Clean Up
+  rm -rf newert.pem newreq.pem
+Même remarque que pour "CA.root".
+== CA.clt ==
+  #!/bin/sh
+  #SSL=/usr/local/openssl-certgen
+  #export PATH=${SSL}/bin/:${SSL}/ssl/misc:${PATH}
+  #export LD_LIBRARY_PATH=${SSL}/lib
+  export PATH=/usr/bin/:/usr/lib/ssl/misc:${PATH}
+  export LD_LIBRARY_PATH=/usr/lib/ssl
+  echo "*********************************************************************************"
+  echo "Creating client private key and certificate"
+  echo "When prompted enter the client name in the Common Name field. This is the same"
+  echo " used as the Username in FreeRADIUS"
+  echo "*********************************************************************************"
+  echo
+  # Request a new PKCS#10 certificate.
+  # First, newreq.pem will be overwritten with the new certificate request
+  openssl req -new -keyout newreq.pem -out newreq.pem -passin pass:whatever -passout pass:whatever
+  # Sign the certificate request. The policy is defined in the openssl.cnf file.
+  # The request generated in the previous step is specified with the -infiles option and
+  # the output is in newcert.pem
+  # The -extensions option is necessary to add the OID for the extended key for client authentication
+  openssl ca -policy policy_anything -out newcert.pem -passin pass:whatever -key whatever -extensions xpclient_ext -extfile xpextensions -infiles newreq.pem
+  # Create a PKCS#12 file from the new certificate and its private key found in newreq.pem
+  # and place in file specified on the command line
+  openssl pkcs12 -export -in newcert.pem -inkey newreq.pem -out $1.p12 -clcerts -passin pass:whatever -passout pass:whatever
+  # parse the PKCS#12 file just created and produce a PEM format certificate and key in certclt.pem
+  openssl pkcs12 -in $1.p12 -out $1.pem -passin pass:whatever -passout pass:whatever
+  # Convert certificate from PEM format to DER format
+  openssl x509 -inform PEM -outform DER -in $1.pem -out $1.der
+  # clean up
+  rm -rf newcert newreq.pem
+Même remarque que pour "CA.root".
+== executable ==
+rendre les scripts executable:
+  # chmod a+x CA.*
+== xpextensions ==
+Encore un fichier nommé "xpentensions" dont le contenu doit être:
+  [ xpclient_ext]
+  extendedKeyUsage = 1.3.6.1.5.5.7.3.2
+  [ xpserver_ext ]
+  extendedKeyUsage = 1.3.6.1.5.5.7.3.1
+== Au final ==
+  # ls -lrt
+  -rwxr-xr-x 1 root root 1769 2009-05-11 14:25 CA.svr
+  -rwxr-xr-x 1 root root 1826 2009-05-11 14:26 CA.clt
+  -rw-r--r-- 1 root root  111 2009-05-11 14:26 xpextensions
+  -rwxr-xr-x 1 root root 2350 2009-05-11 14:45 CA.root
+==== En pratique ====
+=== repertoire ===
+Choisir un répertoire de travail, par exemple:
+  # mkdir /etc/ssl/radius
+  # cd /etc/ssl/radius
+Y copier les fichiers vu ci-dessus, c'est a dire:
+  CA.root
+  CA.svr
+  CA.clt
+  xpextensions
+=== Root ===
+| :!: a ne faire que la 1er fois ! |
+Générer le certificat d'authorité:
+  # ./CA.root
+Verifier le "Common Name", par exemple: TJ-RADIUS-CA .
+Cela créé divers fichiers (et répertoires).
+=== Serveur ===
+Générer le certificat du "serveur".
+  # ./CA.svr virgin-mobile
+Le "Common Name" doit être: virgin-mobile
+(Je crois qu'il y a une vérification de correspondance du "Common Name" avec le ssid)
+=== Client ===
+Générer le certificat d'un client. (ou d'un "__pool__" de clients ?)
+  # ./CA.clt tjaouen
+:!: le "Common Name" n'a aucune importance par la suite, notamment pour l'authentification.\\
+Le "username"/password final, demandé par Windoz, est independant du "Common Name".
+=== au final ===
+  root.pem
+  root.der
+  <servername>.pem
+  <clientusername>.p12
+On ignore le reste? ok....
+==== Radius ====
+Un extrait de la configuration de radius:
+  AutoMPPEKeys    yes
+  EAPType PEAP,MSCHAP-V2
+  #EAPType PEAP,MSCHAP-V2, TTLS
+  #EAPType PEAP
+  EAPTLS_CAFile %D/ssl2/root.pem
+  EAPTLS_CertificateFile %D/ssl2/virgin-mobile.pem
+  EAPTLS_CertificateType PEM
+  EAPTLS_PrivateKeyFile %D/ssl2/virgin-mobile.pem
+  EAPTLS_PrivateKeyPassword whatever
+  EAPTLS_MaxFragmentSize 1000
+Dans ce cas, les fichiers ont été déposé dans le sous répertoire ".../ssl2/", mais peu importe?
+:!:
+  -la pass-phrase est en clair...
+  -la clé publique et privé sont dans le même fichier (virgin-mobile.pem)
+==== Windows XP ====
+Transferer les fichiers suivant sur le client:
+  root.der
+  <username>.p12
+Comment ? on s'en fout.
+=== installer certificats ===
+D'abord "root.der"
+Puis <username>.p12
+Au moment du montage "wifi" c'est plus compliquer:
+Propriété reseau > Wifi > "virgin-mobile" > Propriété > Authentification
+  EAP protégé (PEAP)
+  [x] Authentifier en tant qu'ordinateur ....
+Propriété PEAP ...
+  [ ] Valider le certificat du serveur
+Mot de passe (EAP-MSCHAP v2) > Configurer
+  [ ] Utiliser automatiquement mon nom ...
+Aprés avoir fait tout cela, vous vous rendrez compte qu'il faudra recommencer a chaque fois ! dumoins sous Windoz XP SP3 HOME.
+En plus, il faut faire ça au bon moment !!! ggrrrrrrrrrrr
+==== Cisco Conf ====
+  ...
+  !
+  aaa new-model
+  !
+  !
+  aaa group server radius rad_eap
+   server 192.168.0.10 auth-port 1812 acct-port 1813
+  !
+  aaa authentication login default local
+  aaa authentication login eap_methods group rad_eap
+  aaa authorization exec default local
+  !
+  aaa session-id common
+  ...
+  !
+  dot11 ssid virgin-mobile
+     vlan 1
+     authentication open eap eap_methods
+     authentication network-eap eap_methods
+     authentication key-management wpa
+     mbssid guest-mode
+  !
+  ...
+  interface Dot11Radio0
+   no ip address
+   no ip route-cache
+   !
+   encryption vlan 1 mode ciphers aes-ccm
+   !
+   encryption vlan 2 mode ciphers aes-ccm tkip
+   !
+   ssid virgin-mobile
+   !
+   ssid test2
+   !
+   mbssid
+   station-role root access-point
+   no dot11 extension aironet
+  !
+  ...
+  !
+  ip default-gateway 192.168.0.254
+  no ip http server
+  ip http authentication aaa
+  ip http secure-server
+  ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
+  radius-server host 192.168.0.10 auth-port 1812 acct-port 1813 key 7 15110E0F0D672E373C7E382D1D4A0506C
+  bridge 1 route ip
+  !
+  ...
+===== Tips =====
+==== redirection ====
+Redirection d'un SSID
+  ap01#configure terminal
+  ap01(config)#dot11 ssid virgin-mobile
+  ap01(config-ssid)#ip redirection host 192.168.166.2
+| :!: mais c'est du DNAT !!!! pas du routing ! |
+grrrr
+====== Test ======
+Liens:
+  *http://itknowledgeexchange.techtarget.com/itanswers/need-help-with-multiple-dhcp-pools-on-a-cisco-aironet-ap/
+  *http://www.cisco.com/en/US/docs/wireless/access_point/12.3_2_JA/configuration/guide/s32adm.html#wpmkr1060653