From f78c766ee65ecee6623bf911ac1dccd0fcfc7697 Mon Sep 17 00:00:00 2001 From: Alexander Wilke Date: Wed, 21 Dec 2011 22:37:06 +0000 Subject: Added GUI to create certificates for freeradius (CA, server, clients) --- config/freeradius2/freeradius.inc | 342 +++++++++++++++++++++++++- config/freeradius2/freeradius.xml | 15 +- config/freeradius2/freeradius_view_config.php | 17 +- config/freeradius2/freeradiuscerts.xml | 267 ++++++++++++++++++++ config/freeradius2/freeradiusclients.xml | 4 + config/freeradius2/freeradiuseapconf.xml | 7 +- config/freeradius2/freeradiusinterfaces.xml | 4 + config/freeradius2/freeradiussettings.xml | 4 + config/freeradius2/freeradiussqlconf.xml | 4 + 9 files changed, 659 insertions(+), 5 deletions(-) create mode 100644 config/freeradius2/freeradiuscerts.xml (limited to 'config') diff --git a/config/freeradius2/freeradius.inc b/config/freeradius2/freeradius.inc index ad113469..28e209b0 100755 --- a/config/freeradius2/freeradius.inc +++ b/config/freeradius2/freeradius.inc @@ -459,7 +459,8 @@ function freeradius_eapconf_resync() { # check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd" # check_cert_cn = %{User-Name} cipher_list = "DEFAULT" - make_cert_command = "\${certdir}/bootstrap" + ### we make this from Certificate tab on GUI at startup + # make_cert_command = "\${certdir}/bootstrap" ecdh_curve = "prime256v1" cache { enable = no @@ -1256,4 +1257,343 @@ EOD; restart_service('freeradius'); } + +function freeradius_cacertcnf_resync() { + global $config; + $conf = ''; + + $arrcerts = $config['installedpackages']['freeradiuscerts']['config'][0]; + + // General variables: CA, Server, Client + $varcertsdefaultdays = ($arrcerts['varcertsdefaultdays']?$arrcerts['varcertsdefaultdays']:'3650'); + $varcertsdefaultmd = ($arrcerts['varcertsdefaultmd']?$arrcerts['varcertsdefaultmd']:'md5'); + $varcertsdefaultbits = ($arrcerts['varcertsdefaultbits']?$arrcerts['varcertsdefaultbits']:'2048'); + $varcertspassword = ($arrcerts['varcertspassword']?$arrcerts['varcertspassword']:'whatever'); + $varcertscountryname = ($arrcerts['varcertscountryname']?$arrcerts['varcertscountryname']:'US'); + $varcertsstateorprovincename = ($arrcerts['varcertsstateorprovincename']?$arrcerts['varcertsstateorprovincename']:'Texas'); + $varcertslocalityname = ($arrcerts['varcertslocalityname']?$arrcerts['varcertslocalityname']:'Austin'); + $varcertsorganizationname = ($arrcerts['varcertsorganizationname']?$arrcerts['varcertsorganizationname']:'My Company Inc'); + + // Variables: Only for CA + $varcertscaemailaddress = ($arrcerts['varcertscaemailaddress']?$arrcerts['varcertscaemailaddress']:'admin@mycompany.com'); + $varcertscacommonname = ($arrcerts['varcertscacommonname']?$arrcerts['varcertscacommonname']:'internal-ca'); + + + + + $conf .= << \ No newline at end of file diff --git a/config/freeradius2/freeradius.xml b/config/freeradius2/freeradius.xml index 78a0d984..e55720ac 100644 --- a/config/freeradius2/freeradius.xml +++ b/config/freeradius2/freeradius.xml @@ -89,6 +89,10 @@ SQL /pkg_edit.php?xml=freeradiussqlconf.xml&id=0 + + Certificates + /pkg_edit.php?xml=freeradiuscerts.xml&id=0 + View config /freeradius_view_config.php @@ -123,7 +127,12 @@ /usr/local/pkg/ 0755 http://www.pfsense.org/packages/config/freeradius2/freeradiusinterfaces.xml - + + + /usr/local/pkg/ + 0755 + http://www.pfsense.org/packages/config/freeradius2/freeradiuscerts.xml + /usr/local/pkg/ 0755 @@ -302,6 +311,10 @@ freeradius_eapconf_resync(); freeradius_sqlconf_resync(); freeradius_serverdefault_resync(); + freeradius_clientcertcnf_resync(); + freeradius_servercertcnf_resync(); + freeradius_cacertcnf_resync(); + freeradius_allcertcnf_resync(); exec("rm -f /usr/local/etc/raddb/sites-enabled/control-socket"); exec("rm -f /usr/local/etc/raddb/sites-enabled/inner-tunnel"); diff --git a/config/freeradius2/freeradius_view_config.php b/config/freeradius2/freeradius_view_config.php index 9db6a682..7a5c52a4 100644 --- a/config/freeradius2/freeradius_view_config.php +++ b/config/freeradius2/freeradius_view_config.php @@ -35,6 +35,10 @@ function get_file($file){ $files['clients']="/usr/local/etc/raddb/clients.conf"; $files['users']="/usr/local/etc/raddb/users"; $files['virtual-server-default']="/usr/local/etc/raddb/sites-enabled/default"; + $files['ca']="/usr/local/etc/raddb/certs/ca.cnf"; + $files['server']="/usr/local/etc/raddb/certs/server.cnf"; + $files['client']="/usr/local/etc/raddb/certs/client.cnf"; + $files['index']="/usr/local/etc/raddb/certs/index.txt"; if ($files[$file]!="" && file_exists($files[$file])){ @@ -78,6 +82,7 @@ else{ $tab_array[] = array(gettext("Settings"), false, "/pkg_edit.php?xml=freeradiussettings.xml&id=0"); $tab_array[] = array(gettext("EAP"), false, "/pkg_edit.php?xml=freeradiuseapconf.xml&id=0"); $tab_array[] = array(gettext("SQL"), false, "/pkg_edit.php?xml=freeradiussqlconf.xml&id=0"); + $tab_array[] = array(gettext("Certificates"), false, "/pkg_edit.php?xml=freeradiuscerts.xml&id=0"); $tab_array[] = array(gettext("View config"), true, "/freeradius_view_config.php"); display_top_tabs($tab_array); ?> @@ -97,7 +102,11 @@ else{       -   +   +   +   +   +   @@ -132,7 +141,11 @@ else{ $('btn_sql').value="sql.conf"; $('btn_clients').value="clients.conf"; $('btn_users').value="users"; - $('btn_virtual').value="default"; + $('btn_virtual').value="virtual-server-default"; + $('btn_ca').value="ca.cnf"; + $('btn_server').value="server.cnf"; + $('btn_client').value="client.cnf"; + $('btn_index').value="index.txt"; scroll(0,0); } diff --git a/config/freeradius2/freeradiuscerts.xml b/config/freeradius2/freeradiuscerts.xml new file mode 100644 index 00000000..7503fe49 --- /dev/null +++ b/config/freeradius2/freeradiuscerts.xml @@ -0,0 +1,267 @@ + + + + + + . + All rights reserved. + */ +/* ========================================================================== */ +/* + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + */ +/* ========================================================================== */ + ]]> + + + Describe your package requirements here + Currently there are no FAQ items provided. + freeradiuscerts + none + FreeRADIUS: Certificates + pkg_edit.php?xml=freeradiuscerts.xml&id=0 + /usr/local/pkg/freeradius.inc + + + Users + /pkg.php?xml=freeradius.xml + + + NAS / Clients + /pkg.php?xml=freeradiusclients.xml + + + Interfaces + /pkg.php?xml=freeradiusinterfaces.xml + + + Settings + /pkg_edit.php?xml=freeradiussettings.xml&id=0 + + + EAP + /pkg_edit.php?xml=freeradiuseapconf.xml&id=0 + + + SQL + /pkg_edit.php?xml=freeradiussqlconf.xml&id=0 + + + Certificates + /pkg_edit.php?xml=freeradiuscerts.xml&id=0 + + + + View config + /freeradius_view_config.php + + + + + GENERAL CONFIGURATION + listtopic + + + Delete ALL existing Certificates ? + varcertsdeleteall + ALL existing CAs, Server-Certs and Client-Certs in freeradius certs folder!
+ You must delete all existing if you want to create new ones. (Default: Yes)
+ Important:
+ If you like to use certs created on another PC just disable this and click save.]]> + select + yes + + + + + + + Distinguished Name for CA, Server and Client + listtopic + + + Country Code + varcertscountryname + + input + US + + + State or Province + varcertsstateorprovincename + + input + Texas + + + City + varcertslocalityname + + input + Austin + + + Organization + varcertsorganizationname + + input + My Company Inc + + + Lifetime + varcertsdefaultdays + + input + 3650 + + + Key Length + varcertsdefaultbits + + select + 2048 + + + + + + + + + Key Creation Algorithm + varcertsdefaultmd + + There seems to be some OS do not support all algorithms. (Default: md5)]]> + select + md5 + + + + + + + Certificate Password (CA, Server and Client) + varcertspassword + + This is the password you need to enter in eap.conf so that freeradius can read the cert. (Default: whatever)]]> + password + whatever + + + CA specific Configuration + listtopic + + + E-Mail Address + varcertscaemailaddress + + input + admin@mycompany.com + + + Common Name + varcertscacommonname + + input + internal-ca + + + Server specific Configuration + listtopic + + + E-Mail Address + varcertsserveremailaddress + + input + webadmin@mycompany.com + + + Common Name + varcertsservercommonname + + input + server-cert + + + Client specific Configuration + listtopic + + + Create a further Client-Certificate + varcertscreateclient + Client-Certs in freeradius certs folder!
+ Choose this option if you need multiple Client-Certs.
+ Important: You must backup your old Client-Cert before enabling this option. The new Client-Cert must not have any Common Name as other certificates your created before. (Default: No)

+ + This is what you should do the very first time when creating certs here:
+ 1. Check "Delete ALL Certs...", fill out all fields and create a new CA, new Server and Client Cert
+ 2. If you need more than one Client-Cert than backup your first cert using DIAGNOSTICS->COMMAND PROMPT->Download
+ /usr/local/etc/raddb/certs/client.tar
+ 3. Disable "Delete ALL Certs..." and enable "Create a further Client-Certificate" and fill out the Client fields
+ 4. Repeat step 2. as long as you need.

+ + + Limitations:
+ There is no CRL at the moment. Deleting of existing certs from the database (../certs/index.txt) isn't possible from GUI.
+ If you choose a Common Name which already exists in the database (check view config) the .crt will be zero bytes.
+ Choose other Common Name and create a new Client-Cert. + ]]> + select + no + + + + + + + E-Mail Address + varcertsclientemailaddress + + input + user@mycompany.com + + + Common Name + varcertsclientcommonname + + input + client-cert + + + + freeradius_allcertcnf_resync(); + + + freeradius_allcertcnf_resync(); + + \ No newline at end of file diff --git a/config/freeradius2/freeradiusclients.xml b/config/freeradius2/freeradiusclients.xml index b88eccf8..1e72cf2b 100644 --- a/config/freeradius2/freeradiusclients.xml +++ b/config/freeradius2/freeradiusclients.xml @@ -75,6 +75,10 @@ SQL /pkg_edit.php?xml=freeradiussqlconf.xml&id=0 + + Certificates + /pkg_edit.php?xml=freeradiuscerts.xml&id=0 + View config /freeradius_view_config.php diff --git a/config/freeradius2/freeradiuseapconf.xml b/config/freeradius2/freeradiuseapconf.xml index f427ab84..504e9bed 100644 --- a/config/freeradius2/freeradiuseapconf.xml +++ b/config/freeradius2/freeradiuseapconf.xml @@ -76,6 +76,10 @@ SQL /pkg_edit.php?xml=freeradiussqlconf.xml&id=0 + + Certificates + /pkg_edit.php?xml=freeradiuscerts.xml&id=0 + View config /freeradius_view_config.php @@ -141,7 +145,8 @@ Private Key Password vareapconfprivatekeypassword - + + This is the password which you chose in "Certificates" tab. (Default: whatever)]]> password whatever diff --git a/config/freeradius2/freeradiusinterfaces.xml b/config/freeradius2/freeradiusinterfaces.xml index a50cf8b1..0bebf057 100644 --- a/config/freeradius2/freeradiusinterfaces.xml +++ b/config/freeradius2/freeradiusinterfaces.xml @@ -75,6 +75,10 @@ SQL /pkg_edit.php?xml=freeradiussqlconf.xml&id=0 + + Certificates + /pkg_edit.php?xml=freeradiuscerts.xml&id=0 + View config /freeradius_view_config.php diff --git a/config/freeradius2/freeradiussettings.xml b/config/freeradius2/freeradiussettings.xml index 25a9a2dd..689e4b16 100644 --- a/config/freeradius2/freeradiussettings.xml +++ b/config/freeradius2/freeradiussettings.xml @@ -76,6 +76,10 @@ SQL /pkg_edit.php?xml=freeradiussqlconf.xml&id=0 + + Certificates + /pkg_edit.php?xml=freeradiuscerts.xml&id=0 + View config /freeradius_view_config.php diff --git a/config/freeradius2/freeradiussqlconf.xml b/config/freeradius2/freeradiussqlconf.xml index 15e9ee76..fa4f99e0 100644 --- a/config/freeradius2/freeradiussqlconf.xml +++ b/config/freeradius2/freeradiussqlconf.xml @@ -76,6 +76,10 @@ /pkg_edit.php?xml=freeradiussqlconf.xml&id=0 + + Certificates + /pkg_edit.php?xml=freeradiuscerts.xml&id=0 + View config /freeradius_view_config.php -- cgit v1.2.3