{"id":1289,"date":"2016-06-27T13:51:44","date_gmt":"2016-06-27T11:51:44","guid":{"rendered":"https:\/\/www.nico-maas.de\/?p=1289"},"modified":"2017-01-16T21:38:27","modified_gmt":"2017-01-16T20:38:27","slug":"ubuntu-radsecproy-for-secure-radius-over-wan","status":"publish","type":"post","link":"https:\/\/www.nico-maas.de\/?p=1289","title":{"rendered":"[Ubuntu] Radsecproy for secure Radius over WAN"},"content":{"rendered":"<p>Chances are you going to need an radius Auth over WAN - because your Radius and Identity Mngmnt is hosted in the security of the local datacenter of your corp... but the client (i.e. an network switch) is somewhere over the <del datetime=\"2016-06-27T11:37:38+00:00\">rainbow<\/del> WAN. You *could* just pipe the radius traffic over the internet - but there be dragons: radius communication is unencrypted. So... just no.<\/p>\n<p>Enter radsecproxy: Radsecproxy is - as the name implies, an radius proxy - which needs to be installed on both servers (the local one in your company, now called SERVER, and the remote one with the switch attached, now called CLIENT) - and does encrypt the communication between both server parts (over WAN i.e.) via TLS.<\/p>\n<p>1.) Install radsecproxy on Server ( sudo apt-get install radsecproxy )<br \/>\n2.) Create CA with generate-CA.sh (in \/etc\/radsecproxy\/) [ https:\/\/github.com\/owntracks\/tools\/blob\/master\/TLS\/generate-CA.sh - please change keybits to 4096 bits, thanks! ]<br \/>\n3.) Create Certs (Server, Client) with generate-client.sh (in \/etc\/radsecproxy\/) [ at the end of this post, http:\/\/rockingdlabs.dunmire.org\/exercises-experiments\/ssl-client-certs-to-secure-mqtt - please change keybits to 4096 bits as well! \ud83d\ude42 ]<br \/>\n4.) Configure \/etc\/radsecproxy.conf [UPPERLETTERS are constants which you need to change]<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\"># Master config file for radsecproxy\r\nsourceTLS IPADDR_OF_SERVER\r\nlistenTLS IPADDR_OF_SERVER:2083\r\n\r\nLogLevel 3\r\nLogDestination file:\/\/\/var\/log\/radsecproxy\/radsecproxy.log\r\n\r\nLoopPrevention on\r\n\r\ntls default {\r\nCACertificateFile \/etc\/radsecproxy\/ca.crt\r\nCertificateFile \/etc\/radsecproxy\/SERVER_NAME_FQDN.crt\r\nCertificateKeyFile \/etc\/radsecproxy\/SERVER_NAME_FAQN.key\r\n}\r\n\r\nclient CLIENT_NAME {\r\nhost IPADDR_OF_CLIENT\r\ntype tls\r\ncertificatenamecheck off\r\nsecret PW_OF_CLIENT_RADSEC\r\n}\r\n\r\nserver SERVER_NAME_auth {\r\nhost IPADDR_OF_SERVER:1812\r\ntype udp\r\nStatusServer on\r\nsecret PW_OF_SERVER_FOR_RADIUS\r\n}\r\n\r\nserver SERVER_NAME_acct {\r\nhost IPADDR_OF_SERVER:1813\r\ntype udp\r\nStatusServer on\r\nsecret PW_OF_SERVER_FOR_RADIUS\r\n}\r\n\r\nrealm * {\r\nserver SERVER_NAME_auth\r\naccountingserver SERVER_NAME_acct\r\n}\r\n\r\n# example config for localhost, rejecting all users\r\nclient 127.0.0.1 {\r\ntype udp\r\nsecret TEST_SECRET\r\n}\r\n\r\nrealm * {\r\nreplymessage \"User unknown\"\r\n}<\/pre>\n<p>5.) sudo service radsecproxy restart<\/p>\n<p>6.) Install radsecproxy on Client ( sudo apt-get install radsecproxy )<br \/>\n7.) Copy client cert and ca.crt to Client \/etc\/radsecproxy<br \/>\n8.) Configure \/etc\/radsecproxy.conf [UPPERLETTERS are constants which you need to change]<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\">#sourceUDP 127.0.0.1\r\nsourceUDP IPADDR_OF_CLIENT\r\nlistenUDP *:1812\r\nlistenUDP *:1813\r\n\r\nLogLevel 3\r\nLogDestination file:\/\/\/var\/log\/radsecproxy\/radsecproxy.log\r\n\r\nLoopPrevention on\r\n\r\ntls default {\r\nCACertificateFile \/etc\/radsecproxy\/ca.crt\r\nCertificateFile \/etc\/radsecproxy\/CLIENT_NAME_FQDN.crt\r\nCertificateKeyFile \/etc\/radsecproxy\/CLIENT_NAME_FQDN.key\r\n}\r\n\r\nclient CLIENT_NAME {\r\n#host 127.0.0.1\r\nhost IPADDR_OF_CLIENT\r\ntype udp\r\nsecret CLIENT_RADIUS_SECRET\r\n}\r\n\r\nclient SWITCH_NAME {\r\nhost SWITCH_IP\r\ntype udp\r\nsecret SWITCH_RADIUS_SECRET\r\n}\r\n\r\nserver SERVER_NAME {\r\ncertificatenamecheck off\r\nhost IPADDR_OF_SERVER\r\ntype tls\r\nStatusServer on\r\nsecret PW_OF_CLIENT_RADSEC\r\n}\r\n\r\nrealm * {\r\nserver SERVER_NAME\r\naccountingserver SERVER_NAME\r\n}\r\n\r\n# example config for localhost, rejecting all users\r\nclient 127.0.0.1 {\r\ntype udp\r\nsecret TEST_SECRET\r\n}\r\n\r\nrealm * {\r\nreplymessage \"User unknown\"\r\n}<\/pre>\n<p>9.) sudo service radsecproxy restart<br \/>\n10.) If you now point your switches to the CLIENT_IP with the correct credential, it should go via the radsecproxy to your main radius server and get the connection working. Please pay attention that on your CLIENT site no radiusd daemon is allowed to run, as it would block the ports needed for radsecproxy \/ radius. Make use of the radsecproxy log files to see, wheter the two radsecproxy servers do connect and talk to each other :).<\/p>\n<div class=\"shariff shariff-align-left shariff-widget-align-left\"><ul class=\"shariff-buttons theme-round orientation-horizontal buttonsize-small\"><li class=\"shariff-button printer shariff-nocustomcolor\" style=\"background-color:#a8a8a8\"><a href=\"javascript:window.print()\" title=\"print\" aria-label=\"print\" role=\"button\" rel=\"noopener nofollow\" class=\"shariff-link\" style=\"; background-color:#999; color:#fff\"><span class=\"shariff-icon\" style=\"\"><svg width=\"32px\" height=\"20px\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 30 32\"><path fill=\"#999\" d=\"M6.8 27.4h16v-4.6h-16v4.6zM6.8 16h16v-6.8h-2.8q-0.7 0-1.2-0.5t-0.5-1.2v-2.8h-11.4v11.4zM27.4 17.2q0-0.5-0.3-0.8t-0.8-0.4-0.8 0.4-0.3 0.8 0.3 0.8 0.8 0.3 0.8-0.3 0.3-0.8zM29.7 17.2v7.4q0 0.2-0.2 0.4t-0.4 0.2h-4v2.8q0 0.7-0.5 1.2t-1.2 0.5h-17.2q-0.7 0-1.2-0.5t-0.5-1.2v-2.8h-4q-0.2 0-0.4-0.2t-0.2-0.4v-7.4q0-1.4 1-2.4t2.4-1h1.2v-9.7q0-0.7 0.5-1.2t1.2-0.5h12q0.7 0 1.6 0.4t1.3 0.8l2.7 2.7q0.5 0.5 0.9 1.4t0.4 1.6v4.6h1.1q1.4 0 2.4 1t1 2.4z\"\/><\/svg><\/span><\/a><\/li><li class=\"shariff-button mailto shariff-nocustomcolor\" style=\"background-color:#a8a8a8\"><a href=\"mailto:?body=https%3A%2F%2Fwww.nico-maas.de%2F%3Fp%3D1289&subject=%5BUbuntu%5D%20Radsecproy%20for%20secure%20Radius%20over%20WAN\" title=\"Send by email\" aria-label=\"Send by email\" role=\"button\" rel=\"noopener nofollow\" class=\"shariff-link\" style=\"; background-color:#999; color:#fff\"><span class=\"shariff-icon\" style=\"\"><svg width=\"32px\" height=\"20px\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 32 32\"><path fill=\"#999\" d=\"M32 12.7v14.2q0 1.2-0.8 2t-2 0.9h-26.3q-1.2 0-2-0.9t-0.8-2v-14.2q0.8 0.9 1.8 1.6 6.5 4.4 8.9 6.1 1 0.8 1.6 1.2t1.7 0.9 2 0.4h0.1q0.9 0 2-0.4t1.7-0.9 1.6-1.2q3-2.2 8.9-6.1 1-0.7 1.8-1.6zM32 7.4q0 1.4-0.9 2.7t-2.2 2.2q-6.7 4.7-8.4 5.8-0.2 0.1-0.7 0.5t-1 0.7-0.9 0.6-1.1 0.5-0.9 0.2h-0.1q-0.4 0-0.9-0.2t-1.1-0.5-0.9-0.6-1-0.7-0.7-0.5q-1.6-1.1-4.7-3.2t-3.6-2.6q-1.1-0.7-2.1-2t-1-2.5q0-1.4 0.7-2.3t2.1-0.9h26.3q1.2 0 2 0.8t0.9 2z\"\/><\/svg><\/span><\/a><\/li><li class=\"shariff-button twitter shariff-nocustomcolor\" style=\"background-color:#595959\"><a href=\"https:\/\/twitter.com\/share?url=https%3A%2F%2Fwww.nico-maas.de%2F%3Fp%3D1289&text=%5BUbuntu%5D%20Radsecproy%20for%20secure%20Radius%20over%20WAN\" title=\"Share on X\" aria-label=\"Share on X\" role=\"button\" rel=\"noopener nofollow\" class=\"shariff-link\" style=\"; background-color:#000; color:#fff\" target=\"_blank\"><span class=\"shariff-icon\" style=\"\"><svg width=\"32px\" height=\"20px\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 24 24\"><path fill=\"#000\" d=\"M14.258 10.152L23.176 0h-2.113l-7.747 8.813L7.133 0H0l9.352 13.328L0 23.973h2.113l8.176-9.309 6.531 9.309h7.133zm-2.895 3.293l-.949-1.328L2.875 1.56h3.246l6.086 8.523.945 1.328 7.91 11.078h-3.246zm0 0\"\/><\/svg><\/span><\/a><\/li><li class=\"shariff-button facebook shariff-nocustomcolor\" style=\"background-color:#4273c8\"><a href=\"https:\/\/www.facebook.com\/sharer\/sharer.php?u=https%3A%2F%2Fwww.nico-maas.de%2F%3Fp%3D1289\" title=\"Share on Facebook\" aria-label=\"Share on Facebook\" role=\"button\" rel=\"nofollow\" class=\"shariff-link\" style=\"; background-color:#3b5998; color:#fff\" target=\"_blank\"><span class=\"shariff-icon\" style=\"\"><svg width=\"32px\" height=\"20px\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 18 32\"><path fill=\"#3b5998\" d=\"M17.1 0.2v4.7h-2.8q-1.5 0-2.1 0.6t-0.5 1.9v3.4h5.2l-0.7 5.3h-4.5v13.6h-5.5v-13.6h-4.5v-5.3h4.5v-3.9q0-3.3 1.9-5.2t5-1.8q2.6 0 4.1 0.2z\"\/><\/svg><\/span><\/a><\/li><li class=\"shariff-button linkedin shariff-nocustomcolor\" style=\"background-color:#1488bf\"><a href=\"https:\/\/www.linkedin.com\/sharing\/share-offsite\/?url=https%3A%2F%2Fwww.nico-maas.de%2F%3Fp%3D1289\" title=\"Share on LinkedIn\" aria-label=\"Share on LinkedIn\" role=\"button\" rel=\"noopener nofollow\" class=\"shariff-link\" style=\"; background-color:#0077b5; color:#fff\" target=\"_blank\"><span class=\"shariff-icon\" style=\"\"><svg width=\"32px\" height=\"20px\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 27 32\"><path fill=\"#0077b5\" d=\"M6.2 11.2v17.7h-5.9v-17.7h5.9zM6.6 5.7q0 1.3-0.9 2.2t-2.4 0.9h0q-1.5 0-2.4-0.9t-0.9-2.2 0.9-2.2 2.4-0.9 2.4 0.9 0.9 2.2zM27.4 18.7v10.1h-5.9v-9.5q0-1.9-0.7-2.9t-2.3-1.1q-1.1 0-1.9 0.6t-1.2 1.5q-0.2 0.5-0.2 1.4v9.9h-5.9q0-7.1 0-11.6t0-5.3l0-0.9h5.9v2.6h0q0.4-0.6 0.7-1t1-0.9 1.6-0.8 2-0.3q3 0 4.9 2t1.9 6z\"\/><\/svg><\/span><\/a><\/li><li class=\"shariff-button reddit shariff-nocustomcolor\" style=\"background-color:#ff5700\"><a href=\"https:\/\/www.reddit.com\/submit?url=https%3A%2F%2Fwww.nico-maas.de%2F%3Fp%3D1289\" title=\"Share on Reddit\" aria-label=\"Share on Reddit\" role=\"button\" rel=\"noopener nofollow\" class=\"shariff-link\" style=\"; background-color:#ff4500; color:#fff\" target=\"_blank\"><span class=\"shariff-icon\" style=\"\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 512 512\"><path fill=\"#ff4500\" d=\"M440.3 203.5c-15 0-28.2 6.2-37.9 15.9-35.7-24.7-83.8-40.6-137.1-42.3L293 52.3l88.2 19.8c0 21.6 17.6 39.2 39.2 39.2 22 0 39.7-18.1 39.7-39.7s-17.6-39.7-39.7-39.7c-15.4 0-28.7 9.3-35.3 22l-97.4-21.6c-4.9-1.3-9.7 2.2-11 7.1L246.3 177c-52.9 2.2-100.5 18.1-136.3 42.8-9.7-10.1-23.4-16.3-38.4-16.3-55.6 0-73.8 74.6-22.9 100.1-1.8 7.9-2.6 16.3-2.6 24.7 0 83.8 94.4 151.7 210.3 151.7 116.4 0 210.8-67.9 210.8-151.7 0-8.4-.9-17.2-3.1-25.1 49.9-25.6 31.5-99.7-23.8-99.7zM129.4 308.9c0-22 17.6-39.7 39.7-39.7 21.6 0 39.2 17.6 39.2 39.7 0 21.6-17.6 39.2-39.2 39.2-22 .1-39.7-17.6-39.7-39.2zm214.3 93.5c-36.4 36.4-139.1 36.4-175.5 0-4-3.5-4-9.7 0-13.7 3.5-3.5 9.7-3.5 13.2 0 27.8 28.5 120 29 149 0 3.5-3.5 9.7-3.5 13.2 0 4.1 4 4.1 10.2.1 13.7zm-.8-54.2c-21.6 0-39.2-17.6-39.2-39.2 0-22 17.6-39.7 39.2-39.7 22 0 39.7 17.6 39.7 39.7-.1 21.5-17.7 39.2-39.7 39.2z\"\/><\/svg><\/span><\/a><\/li><li class=\"shariff-button pinterest shariff-nocustomcolor\" style=\"background-color:#e70f18\"><a href=\"https:\/\/www.pinterest.com\/pin\/create\/link\/?url=https%3A%2F%2Fwww.nico-maas.de%2F%3Fp%3D1289&media=https%3A%2F%2Fwww.nico-maas.de%2Fwordpress%2Fwp-content%2Fplugins%2Fshariff%2Fimages%2FdefaultHint.png&description=%5BUbuntu%5D%20Radsecproy%20for%20secure%20Radius%20over%20WAN\" title=\"Pin it on Pinterest\" aria-label=\"Pin it on Pinterest\" role=\"button\" rel=\"noopener nofollow\" class=\"shariff-link\" style=\"; background-color:#cb2027; color:#fff\" target=\"_blank\"><span class=\"shariff-icon\" style=\"\"><svg width=\"32px\" height=\"20px\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 27 32\"><path fill=\"#cb2027\" d=\"M27.4 16q0 3.7-1.8 6.9t-5 5-6.9 1.9q-2 0-3.9-0.6 1.1-1.7 1.4-2.9 0.2-0.6 1-3.8 0.4 0.7 1.3 1.2t2 0.5q2.1 0 3.8-1.2t2.7-3.4 0.9-4.8q0-2-1.1-3.8t-3.1-2.9-4.5-1.2q-1.9 0-3.5 0.5t-2.8 1.4-2 2-1.2 2.3-0.4 2.4q0 1.9 0.7 3.3t2.1 2q0.5 0.2 0.7-0.4 0-0.1 0.1-0.5t0.2-0.5q0.1-0.4-0.2-0.8-0.9-1.1-0.9-2.7 0-2.7 1.9-4.6t4.9-2q2.7 0 4.2 1.5t1.5 3.8q0 3-1.2 5.2t-3.1 2.1q-1.1 0-1.7-0.8t-0.4-1.9q0.1-0.6 0.5-1.7t0.5-1.8 0.2-1.4q0-0.9-0.5-1.5t-1.4-0.6q-1.1 0-1.9 1t-0.8 2.6q0 1.3 0.4 2.2l-1.8 7.5q-0.3 1.2-0.2 3.2-3.7-1.6-6-5t-2.3-7.6q0-3.7 1.9-6.9t5-5 6.9-1.9 6.9 1.9 5 5 1.8 6.9z\"\/><\/svg><\/span><\/a><\/li><\/ul><\/div>","protected":false},"excerpt":{"rendered":"<p>Chances are you going to need an radius Auth over WAN - because your Radius and Identity Mngmnt is hosted in the security of the local datacenter of your corp... but the client (i.e. an network switch) is somewhere over the rainbow WAN. You *could* just pipe the radius traffic over the internet - but &hellip; <a href=\"https:\/\/www.nico-maas.de\/?p=1289\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">[Ubuntu] Radsecproy for secure Radius over WAN<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n<div class=\"shariff shariff-align-left shariff-widget-align-left\"><ul class=\"shariff-buttons theme-round orientation-horizontal buttonsize-small\"><li class=\"shariff-button printer shariff-nocustomcolor\" style=\"background-color:#a8a8a8\"><a href=\"javascript:window.print()\" title=\"print\" aria-label=\"print\" role=\"button\" rel=\"noopener nofollow\" class=\"shariff-link\" style=\"; background-color:#999; color:#fff\"><span class=\"shariff-icon\" style=\"\"><svg width=\"32px\" height=\"20px\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 30 32\"><path fill=\"#999\" d=\"M6.8 27.4h16v-4.6h-16v4.6zM6.8 16h16v-6.8h-2.8q-0.7 0-1.2-0.5t-0.5-1.2v-2.8h-11.4v11.4zM27.4 17.2q0-0.5-0.3-0.8t-0.8-0.4-0.8 0.4-0.3 0.8 0.3 0.8 0.8 0.3 0.8-0.3 0.3-0.8zM29.7 17.2v7.4q0 0.2-0.2 0.4t-0.4 0.2h-4v2.8q0 0.7-0.5 1.2t-1.2 0.5h-17.2q-0.7 0-1.2-0.5t-0.5-1.2v-2.8h-4q-0.2 0-0.4-0.2t-0.2-0.4v-7.4q0-1.4 1-2.4t2.4-1h1.2v-9.7q0-0.7 0.5-1.2t1.2-0.5h12q0.7 0 1.6 0.4t1.3 0.8l2.7 2.7q0.5 0.5 0.9 1.4t0.4 1.6v4.6h1.1q1.4 0 2.4 1t1 2.4z\"\/><\/svg><\/span><\/a><\/li><li class=\"shariff-button mailto shariff-nocustomcolor\" style=\"background-color:#a8a8a8\"><a href=\"mailto:?body=https%3A%2F%2Fwww.nico-maas.de%2F%3Fp%3D1289&subject=%5BUbuntu%5D%20Radsecproy%20for%20secure%20Radius%20over%20WAN\" title=\"Send by email\" aria-label=\"Send by email\" role=\"button\" rel=\"noopener nofollow\" class=\"shariff-link\" style=\"; background-color:#999; color:#fff\"><span class=\"shariff-icon\" style=\"\"><svg width=\"32px\" height=\"20px\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 32 32\"><path fill=\"#999\" d=\"M32 12.7v14.2q0 1.2-0.8 2t-2 0.9h-26.3q-1.2 0-2-0.9t-0.8-2v-14.2q0.8 0.9 1.8 1.6 6.5 4.4 8.9 6.1 1 0.8 1.6 1.2t1.7 0.9 2 0.4h0.1q0.9 0 2-0.4t1.7-0.9 1.6-1.2q3-2.2 8.9-6.1 1-0.7 1.8-1.6zM32 7.4q0 1.4-0.9 2.7t-2.2 2.2q-6.7 4.7-8.4 5.8-0.2 0.1-0.7 0.5t-1 0.7-0.9 0.6-1.1 0.5-0.9 0.2h-0.1q-0.4 0-0.9-0.2t-1.1-0.5-0.9-0.6-1-0.7-0.7-0.5q-1.6-1.1-4.7-3.2t-3.6-2.6q-1.1-0.7-2.1-2t-1-2.5q0-1.4 0.7-2.3t2.1-0.9h26.3q1.2 0 2 0.8t0.9 2z\"\/><\/svg><\/span><\/a><\/li><li class=\"shariff-button twitter shariff-nocustomcolor\" style=\"background-color:#595959\"><a href=\"https:\/\/twitter.com\/share?url=https%3A%2F%2Fwww.nico-maas.de%2F%3Fp%3D1289&text=%5BUbuntu%5D%20Radsecproy%20for%20secure%20Radius%20over%20WAN\" title=\"Share on X\" aria-label=\"Share on X\" role=\"button\" rel=\"noopener nofollow\" class=\"shariff-link\" style=\"; background-color:#000; color:#fff\" target=\"_blank\"><span class=\"shariff-icon\" style=\"\"><svg width=\"32px\" height=\"20px\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 24 24\"><path fill=\"#000\" d=\"M14.258 10.152L23.176 0h-2.113l-7.747 8.813L7.133 0H0l9.352 13.328L0 23.973h2.113l8.176-9.309 6.531 9.309h7.133zm-2.895 3.293l-.949-1.328L2.875 1.56h3.246l6.086 8.523.945 1.328 7.91 11.078h-3.246zm0 0\"\/><\/svg><\/span><\/a><\/li><li class=\"shariff-button facebook shariff-nocustomcolor\" style=\"background-color:#4273c8\"><a href=\"https:\/\/www.facebook.com\/sharer\/sharer.php?u=https%3A%2F%2Fwww.nico-maas.de%2F%3Fp%3D1289\" title=\"Share on Facebook\" aria-label=\"Share on Facebook\" role=\"button\" rel=\"nofollow\" class=\"shariff-link\" style=\"; background-color:#3b5998; color:#fff\" target=\"_blank\"><span class=\"shariff-icon\" style=\"\"><svg width=\"32px\" height=\"20px\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 18 32\"><path fill=\"#3b5998\" d=\"M17.1 0.2v4.7h-2.8q-1.5 0-2.1 0.6t-0.5 1.9v3.4h5.2l-0.7 5.3h-4.5v13.6h-5.5v-13.6h-4.5v-5.3h4.5v-3.9q0-3.3 1.9-5.2t5-1.8q2.6 0 4.1 0.2z\"\/><\/svg><\/span><\/a><\/li><li class=\"shariff-button linkedin shariff-nocustomcolor\" style=\"background-color:#1488bf\"><a href=\"https:\/\/www.linkedin.com\/sharing\/share-offsite\/?url=https%3A%2F%2Fwww.nico-maas.de%2F%3Fp%3D1289\" title=\"Share on LinkedIn\" aria-label=\"Share on LinkedIn\" role=\"button\" rel=\"noopener nofollow\" class=\"shariff-link\" style=\"; background-color:#0077b5; color:#fff\" target=\"_blank\"><span class=\"shariff-icon\" style=\"\"><svg width=\"32px\" height=\"20px\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 27 32\"><path fill=\"#0077b5\" d=\"M6.2 11.2v17.7h-5.9v-17.7h5.9zM6.6 5.7q0 1.3-0.9 2.2t-2.4 0.9h0q-1.5 0-2.4-0.9t-0.9-2.2 0.9-2.2 2.4-0.9 2.4 0.9 0.9 2.2zM27.4 18.7v10.1h-5.9v-9.5q0-1.9-0.7-2.9t-2.3-1.1q-1.1 0-1.9 0.6t-1.2 1.5q-0.2 0.5-0.2 1.4v9.9h-5.9q0-7.1 0-11.6t0-5.3l0-0.9h5.9v2.6h0q0.4-0.6 0.7-1t1-0.9 1.6-0.8 2-0.3q3 0 4.9 2t1.9 6z\"\/><\/svg><\/span><\/a><\/li><li class=\"shariff-button reddit shariff-nocustomcolor\" style=\"background-color:#ff5700\"><a href=\"https:\/\/www.reddit.com\/submit?url=https%3A%2F%2Fwww.nico-maas.de%2F%3Fp%3D1289\" title=\"Share on Reddit\" aria-label=\"Share on Reddit\" role=\"button\" rel=\"noopener nofollow\" class=\"shariff-link\" style=\"; background-color:#ff4500; color:#fff\" target=\"_blank\"><span class=\"shariff-icon\" style=\"\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 512 512\"><path fill=\"#ff4500\" d=\"M440.3 203.5c-15 0-28.2 6.2-37.9 15.9-35.7-24.7-83.8-40.6-137.1-42.3L293 52.3l88.2 19.8c0 21.6 17.6 39.2 39.2 39.2 22 0 39.7-18.1 39.7-39.7s-17.6-39.7-39.7-39.7c-15.4 0-28.7 9.3-35.3 22l-97.4-21.6c-4.9-1.3-9.7 2.2-11 7.1L246.3 177c-52.9 2.2-100.5 18.1-136.3 42.8-9.7-10.1-23.4-16.3-38.4-16.3-55.6 0-73.8 74.6-22.9 100.1-1.8 7.9-2.6 16.3-2.6 24.7 0 83.8 94.4 151.7 210.3 151.7 116.4 0 210.8-67.9 210.8-151.7 0-8.4-.9-17.2-3.1-25.1 49.9-25.6 31.5-99.7-23.8-99.7zM129.4 308.9c0-22 17.6-39.7 39.7-39.7 21.6 0 39.2 17.6 39.2 39.7 0 21.6-17.6 39.2-39.2 39.2-22 .1-39.7-17.6-39.7-39.2zm214.3 93.5c-36.4 36.4-139.1 36.4-175.5 0-4-3.5-4-9.7 0-13.7 3.5-3.5 9.7-3.5 13.2 0 27.8 28.5 120 29 149 0 3.5-3.5 9.7-3.5 13.2 0 4.1 4 4.1 10.2.1 13.7zm-.8-54.2c-21.6 0-39.2-17.6-39.2-39.2 0-22 17.6-39.7 39.2-39.7 22 0 39.7 17.6 39.7 39.7-.1 21.5-17.7 39.2-39.7 39.2z\"\/><\/svg><\/span><\/a><\/li><li class=\"shariff-button pinterest shariff-nocustomcolor\" style=\"background-color:#e70f18\"><a href=\"https:\/\/www.pinterest.com\/pin\/create\/link\/?url=https%3A%2F%2Fwww.nico-maas.de%2F%3Fp%3D1289&media=https%3A%2F%2Fwww.nico-maas.de%2Fwordpress%2Fwp-content%2Fplugins%2Fshariff%2Fimages%2FdefaultHint.png&description=%5BUbuntu%5D%20Radsecproy%20for%20secure%20Radius%20over%20WAN\" title=\"Pin it on Pinterest\" aria-label=\"Pin it on Pinterest\" role=\"button\" rel=\"noopener nofollow\" class=\"shariff-link\" style=\"; background-color:#cb2027; color:#fff\" target=\"_blank\"><span class=\"shariff-icon\" style=\"\"><svg width=\"32px\" height=\"20px\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 27 32\"><path fill=\"#cb2027\" d=\"M27.4 16q0 3.7-1.8 6.9t-5 5-6.9 1.9q-2 0-3.9-0.6 1.1-1.7 1.4-2.9 0.2-0.6 1-3.8 0.4 0.7 1.3 1.2t2 0.5q2.1 0 3.8-1.2t2.7-3.4 0.9-4.8q0-2-1.1-3.8t-3.1-2.9-4.5-1.2q-1.9 0-3.5 0.5t-2.8 1.4-2 2-1.2 2.3-0.4 2.4q0 1.9 0.7 3.3t2.1 2q0.5 0.2 0.7-0.4 0-0.1 0.1-0.5t0.2-0.5q0.1-0.4-0.2-0.8-0.9-1.1-0.9-2.7 0-2.7 1.9-4.6t4.9-2q2.7 0 4.2 1.5t1.5 3.8q0 3-1.2 5.2t-3.1 2.1q-1.1 0-1.7-0.8t-0.4-1.9q0.1-0.6 0.5-1.7t0.5-1.8 0.2-1.4q0-0.9-0.5-1.5t-1.4-0.6q-1.1 0-1.9 1t-0.8 2.6q0 1.3 0.4 2.2l-1.8 7.5q-0.3 1.2-0.2 3.2-3.7-1.6-6-5t-2.3-7.6q0-3.7 1.9-6.9t5-5 6.9-1.9 6.9 1.9 5 5 1.8 6.9z\"\/><\/svg><\/span><\/a><\/li><\/ul><\/div>","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_crdt_document":"","jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[32,415,18],"tags":[537,538,569],"class_list":["post-1289","post","type-post","status-publish","format-standard","hentry","category-network","category-security","category-unix-linux","tag-freeradius","tag-radius","tag-radsecproxy"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/piXYf-kN","jetpack-related-posts":[{"id":1212,"url":"https:\/\/www.nico-maas.de\/?p=1212","url_meta":{"origin":1289,"position":0},"title":"[Ubuntu] Freeradius: Improve Uptime","author":"Nico Maas","date":"20. May 2016","format":false,"excerpt":"As a network admin, you're going to have at least one Freeradius running, mostly for 802.1x authentication. At my place the problem arised, that the service was down too often - for different reasons. 1.) Logrotate If you're using logrotate, you should check out \/etc\/logrotate.d\/freeradius: \/var\/log\/freeradius\/*.log { weekly rotate 52\u2026","rel":"","context":"In &quot;Network&quot;","block_context":{"text":"Network","link":"https:\/\/www.nico-maas.de\/?cat=32"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1215,"url":"https:\/\/www.nico-maas.de\/?p=1215","url_meta":{"origin":1289,"position":1},"title":"[Ubuntu] Networked UPS with apcupsd, APC 750 and Windows","author":"Nico Maas","date":"10. May 2016","format":false,"excerpt":"Due to some serious power outages, I had to install an UPS at the Office of one client. It is an rather small setup: One low-power Ubuntu Server, one Laptop with one TFT Screen, one i3 Desktop with two TFT Screens, one network switch. All in all, about 400VA. I\u2026","rel":"","context":"In &quot;Network&quot;","block_context":{"text":"Network","link":"https:\/\/www.nico-maas.de\/?cat=32"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":337,"url":"https:\/\/www.nico-maas.de\/?p=337","url_meta":{"origin":1289,"position":2},"title":"Remote Desktop with XDMCP on Ubuntu 9.10","author":"Nico Maas","date":"7. January 2010","format":false,"excerpt":"To access the unsecured(!) Remote Desktop of an Ubuntu 9.10 installation, you need following: First, install the openssh-server: sudo apt-get install openssh-server Then, you need to enable the XDMCP Server. That became a bit tricky on that Installation, as the \"Point 'n Click\" enabling has been removed. Dunno why. So,\u2026","rel":"","context":"In &quot;Network&quot;","block_context":{"text":"Network","link":"https:\/\/www.nico-maas.de\/?cat=32"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":216,"url":"https:\/\/www.nico-maas.de\/?p=216","url_meta":{"origin":1289,"position":3},"title":"Install SunRay Server Software 4.1 on Ubuntu JeOS Server 9.04 i386 (running under ESXi 4.0)","author":"Nico Maas","date":"24. July 2009","format":false,"excerpt":"Hi Guys, this Guide did cost me a lot of nerves and time, but its finally complete! The most of this stuff is ripped from this nearly perfect guide. But problem is, I did had some difficulties setting it up and got into serious troubles about dhcp (not working), dpkg\u2026","rel":"","context":"In &quot;Hardware&quot;","block_context":{"text":"Hardware","link":"https:\/\/www.nico-maas.de\/?cat=11"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":334,"url":"https:\/\/www.nico-maas.de\/?p=334","url_meta":{"origin":1289,"position":4},"title":"SSH Tunneling","author":"Nico Maas","date":"6. January 2010","format":false,"excerpt":"One of the most important things by working in \"dangerous\" Networking Enviroments is protection. And by that I don't mean the usual (and important!) Anti Virus, Anti Malware and Firewall Software, but Traffic Tunneling, meaning VPN or SSH. SSH is the secure equivalent to the good old (and Plaintext transmitted)\u2026","rel":"","context":"In &quot;Network&quot;","block_context":{"text":"Network","link":"https:\/\/www.nico-maas.de\/?cat=32"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1330,"url":"https:\/\/www.nico-maas.de\/?p=1330","url_meta":{"origin":1289,"position":5},"title":"[Ubuntu \/ Proxmox] Hosting NFSv3 Server on Ubuntu for Proxmox Server","author":"Nico Maas","date":"24. November 2016","format":false,"excerpt":"So, yesterday evening y0sh came to me with following problem: \"I got an real nice proxmox server with loads of CPU and RAM - and nearly no storage left. And I got an small little Atom Server with loads of Storage - but not very useful as VM Host -\u2026","rel":"","context":"In &quot;Network&quot;","block_context":{"text":"Network","link":"https:\/\/www.nico-maas.de\/?cat=32"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.nico-maas.de\/index.php?rest_route=\/wp\/v2\/posts\/1289","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.nico-maas.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.nico-maas.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.nico-maas.de\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.nico-maas.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1289"}],"version-history":[{"count":3,"href":"https:\/\/www.nico-maas.de\/index.php?rest_route=\/wp\/v2\/posts\/1289\/revisions"}],"predecessor-version":[{"id":1474,"href":"https:\/\/www.nico-maas.de\/index.php?rest_route=\/wp\/v2\/posts\/1289\/revisions\/1474"}],"wp:attachment":[{"href":"https:\/\/www.nico-maas.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1289"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.nico-maas.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1289"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.nico-maas.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1289"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}