...
| Code Block |
|---|
root@debian9-base:/etc/shorewall# for i in `ls`; do echo "========= $i ========="; cat $i | grep -v "^#" | grep -v "^$"; echo "========= $i ========="; echo ""; done ========= hosts ========= ========= hosts ========= ========= interfaces ========= net enp0s3 detect tcpflags,dhcp,nosmurfs,routefilter,logmartians wifi enp0s8 detect tcpflags,nosmurfs,routefilter,logmartians ========= interfaces ========= ========= masq ========= enp0s3 192.168.9.0/24 ========= masq ========= ========= policy ========= $FW net REJECT INFO(uid) $FW wifi ACCEPT INFO(uid) wifi all REJECT net all DROP INFO all all REJECT info ========= policy ========= ========= routestopped ========= ========= routestopped ========= ========= rules ========= Invalid(DROP) net all ACCEPT:INFO(uid) net $FW $FW tcp 22 ACCEPT:INFO(uid) net $FW $FW udp 123 ACCEPT:INFO(uid) net $FW icmp ACCEPT:INFO(uid) $FW net net tcp 465,587,995,993 ACCEPT:INFO(uid) $FW net net udp 53,123 ACCEPT:INFO(uid) $FW net icmp ACCEPT:INFO(uid) $FW net tcp - net - tcp - - - - root ACCEPT:INFO(uid) $FW net udp - - root ACCEPT:INFO(uid) $FW - net - udp - root ACCEPT:INFO(uid) -$FW net icmp - - - root ACCEPT:INFO(uid)- $FW root ACCEPT:INFO(uid) net $FW net tcp icmp - - - - root_apt ACCEPT:INFO(uid) $FW net net udp tcp - - - - _apt ACCEPT:INFO(uid) $FW net udp net icmp - - - - _apt ACCEPT:INFO(uid) $FW net icmp - - - - _apt ============ rules ========= ========= shorewall.conf ========= .... STARTUP_ENABLED=Yes .... IP_FORWARDING=On .... ========= shorewall.conf ========= ========= zones ========= fw firewall net ipv4 wifi ipv4 ========= zones ========= |
In /etc/default/shorewall, set
...
| Code Block |
|---|
root@debian9-base:~# cat /etc/rsyslog.d/40-shorewall.conf
:msg, contains, "Shorewall:" /var/log/shorewall
& stop
root@debian9-base:~# cat /etc/logrotate.d/shorewall
/var/log/shorewall-init.log {
weekly
rotate 108
compress
nomissingok
create 0640 root adm
}
/var/log/shorewall
{
rotate 731
daily
nomissingok
notifempty
delaycompress
compress
dateext
postrotate
reload rsyslog >/dev/null 2>&1 || true
endscript
}
root@debian9-base:~# cat /etc/logrotate.d/rsyslog
/var/log/syslog
/var/log/auth.log
{
rotate 731
daily
dateext
nomissingok
notifempty
delaycompress
compress
postrotate
invoke-rc.d rsyslog rotate > /dev/null
endscript
}
/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
{
rotate 4
weekly
missingok
notifempty
compress
delaycompress
sharedscripts
postrotate
invoke-rc.d rsyslog rotate > /dev/null
endscript
}
root@debian9-base:~# cat /etc/logrotate.conf
# see "man logrotate" for details
# rotate log files weekly
weekly
# keep 4 weeks worth of backlogs
rotate 4
# create new (empty) log files after rotating old ones
create
# uncomment this if you want your log files compressed
#compress
# packages drop log rotation information into this directory
include /etc/logrotate.d
# no packages own wtmp, or btmp -- we'll rotate them here
/var/log/wtmp {
nomissingok
monthly
create 0664 root utmp
rotate 24
}
/var/log/btmp {
nomissingok
monthly
create 0660 root utmp
rotate 24
}
# system-specific logs may be configured here
|
...
| Code Block |
|---|
root@debian9-base:~# cat /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
auto lo
iface lo inet loopback
# The external interface
auto enp0s3
iface enp0s3 inet static
address 192.168.10.52
network 192.168.10.0
netmask 255.255.255.0
broadcast 192.168.10.255
gateway 192.168.10.1
# The wifi interface
auto enp0s8
iface enp0s8 inet static
address 192.168.9.1
netmask 255.255.255.0
broadcast 192.168.9.255
root@debian9-base:~# cat /etc/dhcp/dhcpd.conf | grep -v "^#" | grep -v "^$"
# Some of the following lines are there by default and are probably not required
ddns-update-style none;
option domain-name "example.org";
option domain-name-servers ns1.example.org, ns2.example.org;
default-lease-time 600;
max-lease-time 7200;
log-facility local7;
include "/etc/ltsp/dhcpd.conf";
root@debian9-base:~# cat /etc/ltsp/dhcpd.conf
#
# Default LTSP dhcpd.conf config file.
#
authoritative;
subnet 192.168.9.0 netmask 255.255.255.0 {
range 192.168.9.40 192.168.9.250;
option domain-name "test.av";
option domain-name-servers 192.168.9.1;
option broadcast-address 192.168.9.255;
option routers 192.168.9.1;
option subnet-mask 255.255.255.0;
option root-path "/opt/ltsp/amd64";
if substring( option vendor-class-identifier, 0, 9 ) = "PXEClient" {
filename "/ltsp/amd64/pxelinux.0";
} else {
filename "/ltsp/amd64/nbi.img";
}
} |
| Code Block |
|---|
apt-get install isc-dhcp-server |
...
| Code Block |
|---|
# Just after: wifi all REJECT # Added: wifi1 net ACCEPT INFO wifi1 $FW ACCEPT INFO(uid) $FW wifi1 ACCEPT INFO(uid) # Before: net all DROP INFO |
...
| Code Block |
|---|
... [ CA_default ] ... default_days = 732 ... crlDistributionPoints = URI:http://server.test.av/test_ca.crl # This URL will not actually be implemented at the moment, but choose a URL where it is possible to in future make the file available [ req ] ... input_password = password # Replace with an actual password, different from the one in server.cnf output_password = password # Replace with an actual password, should be same as input_password [server] countryName = IN stateOrProvinceName = Tamil Nadu localityName = Auroville organizationName = Test emailAddress = admin@test.av commonName = "Test Server Certificate" [v3_ca] ... crlDistributionPoints = URI:http://server.test.av/test_ca.crl "Test Server Certificate" [v3_ca] ... crlDistributionPoints = URI:http://server.test.av/test_ca.crl ... |
Modify /etc/freeradius/3.0/certs/xpextensions, set the following settings:
| Code Block |
|---|
...
[ xpclient_ext]
...
crlDistributionPoints = URI:http://server.test.av/test_ca.crl # This URL will not actually be implemented at the moment, but choose a URL where it is possible to in future make the file available
...
[ xpserver_ext]
...
crlDistributionPoints = URI:http://server.test.av/test_ca.crl # This URL will not actually be implemented at the moment, but choose a URL where it is possible to in future make the file available
... |
| Code Block |
|---|
cd /etc/freeradius/3.0/certs rm -f *.pem *.der *.csr *.crt *.key *.p12 serial* index.txt* # This step is probably not needed, make ca.pem make ca.der make server.pem make server.csr chown freerad:freerad * chmod o-rwx * rm bootstrap rm passwords.mk # Delete all other files in the folder except: server.cnf, ca.cnf, xpextensions, Makefile, README, dh, ca.pem, server.pem, server.key |
...
On Mac OS, iPhone and Windows 10 supplicants, when connecting to the SSID for the first time, the server certificate's details are presented to the user and the user is asked if they want to trust the server. In case the identity presented by the RADIUS server changes at any point, the user will be prompted with a message, not containing any reasonable warning, sadly, that looks identical to the one displayed when connecting for the first time, where a user is extremely likely to press Trust/Connect once again (on Windows 10, the message also advises the user to connect if they are in a location where said SSID is expected to be present). On Windows 10, in case the user does press Connect again, the supplicant stores both identities and thereon connects without further warning to any server presenting any of those identities, on Mac OS and iPhone this has not been tested. On Mac OS and Windows 10, it is also possible to copy the ca.pem file and install it like with the Linux supplicant, on iPhone, this did not seem to have any effect. This avoids the prompt on first connect and protects against a rogue RADIUS server intercepting the connection at that time, when, it would, otherwise, be still impossible to verify its authenticityOn Windows 10, this does not change the behavior in case the server's identity changes, on Mac OS this has not been tested, presumably the same. It seems to be possible, but greatly complicated (involving installing a software from the App Store, and using it to create a configuration profile which then needs to be saved to a file, copied and imported onto the supplicant device) on Mac OS and iPhone to configure the supplicant to not send the real user name in the unencrypted outer tunnel. On Windows 10 this is somewhat easier. '@@@' to verify. '@@@'