Install the Software

We’re now ready to install the Moonshot software and its required dependencies. Install the software by running the following command:

Configure the Moonshot APC

Next, we need to configure the Moonshot APC.

Configure FreeRADIUS

Certificates

We need to get FreeRADIUS to create some private and public keys to use for its RadSec connections. Create and install the certificates by doing the following (as root).

1. Change into the /etc/freeradius/certs directory

   bash
2. Edit the certificate generation properties in client.cnf, server.cnf, and ca.cnf as following:
   1. In the ca.cnf file:
      1. In the [ req ] section, add encrypt_key = no

      2. In the [CA_default] section, change the default_days from 60 to a higher number (this is how long the certificates you create will be valid for). When the certificates expire, you will have to recreate them.

      3. in the [ certificate_authority ] section, change all of the parameters to match those of your organisation. e.g.

         true

   2. In the server.cnf file:

      1. In the [ req ] section, add encrypt_key = no
      2. In the [CA_default] section, change the default_days from 60 to a higher number (this is how long the certificates you create will be valid for). When the certificates expire, you will have to recreate them.

      3. in the [ server ] section, change all of the parameters to match those of your organisation. e.g.

         true

   3. In the client.cnf file:

      1. In the [ req ] section, add encrypt_key = no
      2. In the [CA_default] section, change the default_days from 60 to a higher number (this is how long the certificates you create will be valid for). When the certificates expire, you will have to recreate them.

      3. in the [ client ] section, change all of the parameters to match those of your organisation. e.g.

         trueAll of the organisation parameters (countryName, localityName, etc) need to match in the three .cnf files but the commonName must be unique in each file)

3. Clear out any old certificates in the directory

   bash

4. Run the bootstrap script to generate the certificates

   bash

5. Create a file that is the concatenation of the certificate and private key of the client.

   1. Create the file

      bash
   2. Cerify that the client.pem file starts with "-----BEGIN CERTIFICATE-----".

RadSec

Next we need to configure RadSec. We do this by creating a file at /etc/radsec.conf with the following:

Realm

We next need to configure your realm in the FreeRADIUS server so that it knows not to send any requests for your own users off to another server.

1. Configure your realm in /etc/freeradius/proxy.conf
   1. Open the file for editing and find the line “realm example.com {“

   2. Above this, add the following, where YOUR_REALM should be substituted for the realm you intend to use for your APC:

      true

EAP Type

1. Set the EAP type in use by Moonshot (EAP-TTLS) by editing /etc/freeradius/mods-enabled/eap. Find the first instance of default_eap_type = md5 and change it to TTLS, i.e.:

Channel Binding Support

We next need to configure your FreeRADIUS server to support channel bindings.

1. Open /etc/freeradius/sites-available/abfab-tls for editing:
   1. Scroll to the client default stanza at the bottom of the file

   2. Edit the stanza to match the below:

   3. If you have any other client definitions here, for example to distinguish between internal and external clients, also apply the change to them.

EAP Type

1. Set the EAP type in use by Moonshot (EAP-TTLS) by editing /etc/freeradius/mods-enabled/eap. Find the first instance of default_eap_type = md5 and change it to TTLS, i.e.

1. :

Resource Provider Authentication

Each Resource Provider needs to authenticate itself to the APC using Moonshot.

During testing, we recommend to define credentials that your Resource Providers can use to authenticate to the APC.

In a production environment, we recommend you use a method that integrates well with your chosen method of managing your Trust Router infrastructure. See for options.

Configure the Trust Router connection

The APC is fundamental to a Trust Router network, so the next step involves configuring the Trust Router client software and configuring its connection to a Trust Router.

Set up the FreeRADIUS and Trust Router users

We need to place the FreeRADIUS user and the Trust Router users into each other's groups to allow them to read each other's shared files.

Configure TIDS

The APC also runs the Temporary ID Server (TIDS).

1. Open the /etc/default/trust_router file for editing. If necessary, create it.

   true

Testing

Now that we have the Moonshot IdP installed and configured, we're now ready to test!

Testing FreeRADIUS locally

The first test is to check whether FreeRADIUS is working in its most basic manner.

1. In window 1, run (as root user)

   bash

2. In window 2, run (as root user)

   bash

   This uses the "radtest" utility which is used in the following way - radtest username password servername port shared-secret

3. If this is working correctly you should see something like the following:

   In window 1 - FreeRADIUS server outputIn window 2 - radtest client output

Testing the Trust Router connection

To test the connection to Trust Router, we need to make sure the Temporary Identity Server (TIDS) software is running, then use the Temporary Identity Client (TIDC) software to simulate a connection to the Trust Router.

Starting the Temporary Identity Server (TIDS)

In window 3 (window 1 should still be still running the FreeRADIUS server and window 2 the radtest command), run the TIDS software:

testuser@YOUR-APC-REALM is the identity that the trust router will use when provisioning keys - this makes it easy to spot in your own log files.
Specifying your server's IP and hostname may seem redundant (and for single server deployments, it is!). You'll need to set the hostname and IP arguments a little differently if you want to enable some more advanced configurations (such as load balancing and key sharing).

Run an APC authentication test

At this point, you must configure your trust router to use testuser@YOUR-APC-REALM as authentication.

1. The trust router configuration must be updated with the test user associated with your trust router's rp_realm filter lines.
2. The trust router configuration must be updated with your new APC designated as the APC for your trust router.
3. The trust router must have its Moonshot credential store updated with the test user and its password.
4. The trust router must be restarted. At this point, the trust router will attempt to authenticate itself to the APC.
5. In the FreeRADIUS console, you should see an Access-Accept response.

Next Steps

At this point, you now have a Moonshot APC that is working. Now for the next steps:

Automatically start the software

FreeRADIUS

To automatically start FreeRADIUS, issue the following command (as root):

If this is working correctly, you should see FreeRADIUS running as a daemon process.

TIDS

To automatically start TIDS, issue the following command (as root):

If this is working correctly, you should see TIDS running as a daemon process.

Configure a real source of Authentication

Your FreeRADIUS server can currently only authenticate a single user - "testuser". At this point, you will want to connect to your management database. The FreeRADIUS site has information and instructions for how to do this.