danny 2007-9-15 07:28
安裝 FreeRADIUS + Files + MySQL 認證
我是參考下列資料
架設freeradius+mysql 的radius服務器
[url]http://www.yesky.com/20030306/1655467.shtml[/url]
想玩無線網路認證值得先看的文件
[url]http://phorum.study-area.org/viewtopic.php?t=31918&highlight=radius[/url]
及其他網路上利用 google 查到的資料作的說明
安裝 FreeRADIUS + Files + MySQL 認證
1. 下載 FreeRADIUS
wget [url]ftp://ftp.freeradius.org/pub/radius/freeradius-1.0.4.tar.gz[/url]
2. 解壓縮
tar zxvf freeradius-1.0.4.tar.gz
3. 安裝 FreeRADIUS
cd freeradius-1.0.4
./configure --localstatedir=/var --sysconfdir=/etc
make
make install
註: 有時候會報找不到文件rlm_sql_mysql這個時候只要把庫文件加入系統搜索的目錄裡
比如：
cp /usr/local/lib/* /usr/lib
4. 建立mysql的數據庫raius的表
MySQL root 登入
mysql -uroot -p密碼
建立 radius 資料庫
create database radius;
建立 radius 使用者
匯入 radius 資料表
cd src/modules/rlm_sql/drivers/rlm_sql_mysql
mysql -uroot -p密碼 radius < db_mysql.sql
建立相關資料
加入群組資料[code][root@www ~]# mysql -uroot -p密碼 radius
insert into radgroupreply (groupname,attribute,op,value) values ('user','Auth-Type',':=','Local');
insert into radgroupreply (groupname,attribute,op,value) values ('user','Service-Type',':=','Framed-User');
insert into radgroupreply (groupname,attribute,op,value) values ('user','Framed-IP-Address',':=','255.255.255.254');
insert into radgroupreply (groupname,attribute,op,value) values ('user','Framed-IP-Netmask',':=','255.255.255.0');[/code][code]insert into radcheck (username,attribute,op,value) values ('test','User-Password',':=','test');[/code]測試賬號加入群組[code]insert into usergroup (username,groupname) values ('test','user');[/code]以後新增人員時只要使用下列命令[code]insert into radcheck (username,attribute,op,value) values ('帳號','User-Password',':=','密碼');
insert into usergroup (username,groupname) values ('帳號','user');[/code]4. 設定 RADIUS
更改freeradius的設置
cd /etc/raddb
備份原始設定檔[code]cp /etc/raddb/radiusd.conf /etc/raddb/radiusd.conf-def
cp /etc/raddb/clients.conf /etc/raddb/clients.conf-def
cp /etc/raddb/sql.conf /etc/raddb/sql.conf-def
cp /etc/raddb/eap.conf /etc/raddb/eap.conf-def
cp /etc/raddb/users /etc/raddb/users-def[/code]更改 radiusd.conf 部份設定 如下列[code]user = root
group = root
hostname_lookups = yes
allow_core_dumps = no
regular_expressions = yes
extended_expressions = yes
log_stripped_names = yes
log_auth = yes
log_auth_badpass = yes
log_auth_goodpass = yes
usercollide = no
lower_user = yes
lower_pass = no
nospace_user = no
nospace_pass = no
files {
usersfile = ${confdir}/users
acctusersfile = ${confdir}/acct_users
preproxy_usersfile = ${confdir}/preproxy_users
compat = no
}
detail {
detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d
detailperm = 0600
}
detail auth_log {
detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d
detailperm = 0600
}
detail reply_log {
detailfile = ${radacctdir}/%{Client-IP-Address}/reply-detail-%Y%m%d
detailperm = 0600
}
acct_unique {
key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
}
attr_filter {
attrsfile = ${confdir}/attrs
}
authorize {
preprocess
auth_log
attr_filter
chap
mschap
suffix
eap
files
sql
}
authenticate {
Auth-Type PAP {
pap
}
Auth-Type CHAP {
chap
}
Auth-Type MS-CHAP {
mschap
}
eap
}
preacct {
preprocess
acct_unique
suffix
files
}
accounting {
detail
radutmp
sql
}
session {
radutmp
sql
}
post-auth {
reply_log
sql
}[/code][code]在 clients.conf 增加下列設定
client 192.168.1.1 {
secret = testing123
shortname = test
}
[/code]更改 sql.conf 部份設定如下列[code]sql {
driver = "rlm_sql_mysql"
server = "localhost" # MySQL 主機位置
login = "radius" # MySQL 帳號
password = "radius" # MySQL 密碼
radius_db = "radius" # MySQL 資料庫名稱
acct_table1 = "radacct"
acct_table2 = "radacct"
postauth_table = "radpostauth"
authcheck_table = "radcheck"
authreply_table = "radreply"
groupcheck_table = "radgroupcheck"
groupreply_table = "radgroupreply"
usergroup_table = "usergroup"
deletestalesessions = yes
sqltrace = yes
sqltracefile = ${logdir}/sqltrace.sql
num_sql_socks = 5
connect_failure_retry_delay = 60
sql_user_name = "%{User-Name}"[/code]更改 eap.conf 部份設定如下列[code]eap {
第 22 行 原 default_eap_type = md5
改為 default_eap_type = peap
timer_expire = 60
ignore_unknown_eap_types = no
cisco_accounting_username_bug = no
md5 {
}
leap {
}
gtc {
auth_type = PAP
}
# 取消下列幾行的註解
tls {
private_key_password = whatever
private_key_file = ${raddbdir}/certs/cert-srv.pem
certificate_file = ${raddbdir}/certs/cert-srv.pem
CA_file = ${raddbdir}/certs/demoCA/cacert.pem
dh_file = ${raddbdir}/certs/dh
random_file = ${raddbdir}/certs/random
}
peap {
default_eap_type = mschapv2
}
mschapv2 {
}
}[/code]更改 users 如下列
在第96行增加[code]"testf" Auth-Type := Local, User-Password == "testf"
Reply-Message = "Hello, %u"
註解 第 154 ,155 行
#DEFAULT Auth-Type = System
# Fall-Through = 1[/code]測試 flies 認證[code]radtest testf testf localhost 0 testing123[/code]測試 MySQL 認證[code]radtest test test localhost 0 testing123 [/code]結果如下[code][root@UI-linux raddb]# radtest testf testf localhost 0 testing123
Sending Access-Request of id 188 to 127.0.0.1:1812
User-Name = "testf"
User-Password = "testf"
NAS-IP-Address = UI-linux
NAS-Port = 0
rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=188, length=34
Reply-Message = "Hello, testf"
[root@UI-linux raddb]# radtest test test localhost 0 testing123
Sending Access-Request of id 192 to 127.0.0.1:1812
User-Name = "test"
User-Password = "test"
NAS-IP-Address = UI-linux
NAS-Port = 0
rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=192, length=38
Service-Type = Framed-User
Framed-IP-Address = 255.255.255.254
Framed-IP-Netmask = 255.255.255.0
[root@UI-linux raddb]#[/code]