{"id":688,"date":"2009-10-21T15:21:00","date_gmt":"2009-10-21T07:21:00","guid":{"rendered":"http:\/\/note.systw.net\/note\/?p=688"},"modified":"2023-11-04T15:30:00","modified_gmt":"2023-11-04T07:30:00","slug":"freeradius","status":"publish","type":"post","link":"https:\/\/systw.net\/note\/archives\/688","title":{"rendered":"Freeradius"},"content":{"rendered":"\n

freeradius
(http:\/\/www.freeradius.org)\u5b89\u88dd\u90e8\u4efd <\/strong><\/p>\n\n\n\n

1
\u5b89\u88dd FreeRadius<\/strong>
\u5230freeradius\u76ee\u9304\u4e0b\u57f7\u884c
# configure –prefix=\/usr\/local\/freeradius
# make
# make install<\/p>\n\n\n\n

2
\u7de8\u8f2f\u7d44\u614b<\/strong>
\u5728raddb\/users\u6a94\u4e2d\u8a2d\u5b9a\u8a2d\u5b9a\u4ee5\u4e0b,\u4f7f\u7528\u672c\u6a5f\u5e33\u5bc6\u505a\u8a8d\u8b49
DEFAULT Auth-Type = System<\/p>\n\n\n\n

3
\u7b2c\u4e00\u6b21\u555f\u52d5 FreeRadius<\/strong>
\/usr\/local\/freeradius\/sbin\/radiusd -d \/usr\/local\/freeradius\/etc\/raddb\/
\u82e5Port 1812\u30011813 \u958b\u59cblisten\u8868\u793aOK
ps:
\u53c3\u6578-X \u53ef\u986f\u793a\u5b8c\u6574\u904b\u4f5c\u8a0a\u606f,\u7528\u4f86debug
ps:
\u82e5\u7121\u6cd5\u555f\u52d5\u53ef\u53c3\u8003\/var\/log\/radius.log
ps:
\u8a2d\u5b9a\u958b\u6a5f\u6642\u81ea\u5df1\u555f\u52d5
\u5728\/etc\/rc.conf \u52a0\u5165radiusd_enable=”YES”<\/p>\n\n\n\n

4
\u6e2c\u8a66Radius<\/strong>
#radtest < \u5e33\u865f > < \u5bc6\u78bc > < \u8a8d\u8b49\u4f4d\u5740[:\u8a8d\u8b49\u57e0] > < nas-port-number > < secret><\/strong>
< secret> \u6307\u7684\u662f\u5728clients.conf\u5167\u8a2d\u5b9a\u4e4b\u5141\u8a31\u4f86\u6e90 
ps:nas-port-number\u901a\u5e38\u662f0
ex:radtest raymond key 127.0.0.1 0 test
\u82e5\u6210\u529f\u6703\u51fa\u73ferad_recv: Access-Accept …\u7b49\u8a0a\u606f
\u82e5\u5931\u6557\u6703\u51fa\u73ferad_recv: Access-Reject …\u7b49\u8a0a\u606f
\u82e5radius\u5bc6\u78bc\u932f\u8aa4\u6703\u986f\u793aShared secret is incorrect<\/p>\n\n\n\n

…………………………………………………………………………………………..<\/p>\n\n\n\n

\u57fa\u790e\u6982\u5ff5 <\/strong><\/p>\n\n\n\n

\u904b\u4f5c\u6d41\u7a0b<\/strong>
1
\u7cfb\u7d71\u555f\u52d5,\u8b80\u53d6radiusd.conf,\u4e26\u904b\u4f5c\u65bcUDP port 1812\/1813
2
\u82e5\u6536\u5230Access-Request(\u8a8d\u8b49\u8acb\u6c42)\u5c01\u5305,\u6bd4\u5c0dclients.conf\u7684\u8a8d\u8b49,\u5408\u6cd5client\u57f7\u884c\u7b2c3\u6b65,\u975e\u6cd5client\u5247deny
3
\u8b80\u53d6proxy.conf\u6bd4\u5c0d\u9818\u57df\u540d\u7a31Realm
\u82e5\u6709\u5408\u6cd5\u7684realm\u8a2d\u5b9a,\u63a1\u7528proxy.conf\u4e2d\u6240\u8a2d\u5b9a\u8655\u7406\u65b9\u5f0f
\u82e5\u7121\u5408\u6cd5\u7684realm\u8a2d\u5b9a,\u63a1\u7528users\u4e2d\u6240\u8a2d\u5b9a\u7684\u9810\u8a2d\u8a8d\u8b49\u65b9\u5f0f,\u6bd4\u5c0dusers\u4e2d\u7684\u5e33\u865f,\u57f7\u884c\u7b2c4\u6b65
4
\u6839\u64da\u6a94\u6848users\u9a57\u8b49,\u82e5\u6210\u529f\u5247\u9001\u51faaccess-accept,\u82e5\u5931\u6557\u5247\u9001\u51faaccess-reject<\/p>\n\n\n\n

\u76f8\u95dc\u76ee\u9304<\/strong>
\/usr\/local\/bin \u6e2c\u8a66\u7a0b\u5f0f
radtest\/usr\/local\/sbin \u4e3b\u7a0b\u5f0f
radiusd\/usr\/local\/etc\/raddb \u8a2d\u5b9a\u6a94\u76ee\u9304
\/usr\/local\/lib \u6a21\u7d44\u6a94
\/usr\/local\/share\/freeradius \u5b57\u5178\u6a94
\/usr\/local\/var\/log\/radius \u8a18\u9304\u6a94
\/usr\/local\/share\/doc\/freeradius-1.0.5 \u8aac\u660e\u6587\u4ef6<\/p>\n\n\n\n

\u76f8\u95dc\u7d44\u614b\u6a94<\/strong>
radiusd.conf \u4e3b\u8a2d\u5b9a\u6a94
clients.conf \u5141\u8a31\u9023\u7dda\u7684client\u8a2d\u5b9a\u6a94
users \u672c\u5730\u4f7f\u7528\u8005\u5e33\u865f,auth-type\u7b49\u8655\u7406\u65b9\u5f0f\u8a2d\u5b9a\u6a94
eap.conf eap\u8a2d\u5b9a\u6a94
attr \u8a2d\u5b9aattribute filter
proxy.conf \u8a8d\u8b49\u8f49\u9001\u8a2d\u5b9a\u6a94,\u5728\u591a\u90e8radius\u904b\u4f5c\u6642\u9700\u8a2d\u5b9a
xxxsql.conf \u8cc7\u6599\u5eab\u5b58\u53d6\u8a2d\u5b9a\u6a94<\/p>\n\n\n\n

……………………………………………………………………………………………………………..
……………………………………………………………………………………………………………..<\/p>\n\n\n\n

radiusd.conf<\/strong>
\u4e3b\u8981\u8a2d\u5b9a\u6a94
\u5167\u5bb9\u67b6\u69cb(\u53ef\u4ee5include\u5176\u4ed6\u6a94\u6848\u7684\u8a2d\u5b9a)<\/p>\n\n\n\n

…<\/p>\n\n\n\n

\u5168\u57df\u53c3\u6578<\/strong>,\u76ee\u9304,\u65e5\u8a8c\u6a94\u4f4d\u7f6e,…\u7b49

#\u8a2d\u5b9a\u4f3a\u670d\u5668\u904b\u4f5c\u7684ip,*\u8868\u793a\u6240\u6709\u7684\u7db2\u8def\u4ecb\u9762
bind_address = *
#\u8a2d\u5b9a\u4f3a\u670d\u5668\u904b\u4f5c\u7684port,0\u8868\u793a\u9810\u8a2d1812,1813
port = 0
#\u8eab\u4efd\u8a8d\u8b49\u6210\u529f\u8207\u5426\u4e4b\u8a18\u9304
log_auth = no
#\u958b\u555fproxy\u529f\u80fd
proxy_requests = yes<\/p>\n\n\n\n

…<\/p>\n\n\n\n

\u6a21\u7d44\u8a2d\u5b9a<\/strong>(radius2\u4e2d\u5c07\u8a2d\u5b9a\u6a94\u653e\u5728module\u76ee\u9304\u5167)<\/p>\n\n\n\n

modules {
\u6a21\u7d441 { … }
\u6a21\u7d442 { … }
… }<\/p>\n\n\n\n

\u5e38\u898b\u6a21\u7d44
unix #\u8a2d\u5b9a\u4f7f\u7528\u7cfb\u7d71\u5bc6\u78bc\u6a94
realm #proxy\u5224\u65b7\uff0c\u898f\u5247\u5728proxy.conf
files #\u4ee5\u6587\u5b57\u6a94\u7ba1\u7406\u5e33\u865f\u3001\u6388\u6b0a
detail #\u4ee5\u6587\u5b57\u6a94\u8a18\u9304log
ldap #ldap\u6a21\u7d44<\/p>\n\n\n\n

…<\/p>\n\n\n\n

\u884c\u7a0b\u8655\u7406\u6d41\u7a0b
<\/strong>\u5e38\u7528\u7684\u6709\u4ee5\u4e0b
authorize { #\u6388\u6b0a,\u53d6\u5f97\u4f7f\u7528\u8005\u8cc7\u8a0a
}
authenticate { #\u8a8d\u8b49,\u9a57\u8b49\u4f7f\u7528\u8005\u8acb\u6c42
}
post-auth { #\u8a8d\u8b49\u5b8c\u6210\u5f8c\u8655\u7406
}
preacct { #\u524d\u7f6e\u8655\u7406Accounting\u5c01\u5305
}
accounting { #\u8655\u7406Accounting\u5c01\u5305
radutmp #\u8a18\u9304\u7dda\u4e0a\u4f7f\u7528\u8005
}
ps:
\u5728radius2\u4e2d,authorize,authenticate,preacct,accounting,post-auth,…\u7b49
\u88ab\u653e\u5728${confdir}\/sites-available\/default<\/p>\n\n\n\n

…………………………………………………………………………………………………<\/p>\n\n\n\n

clients.conf<\/strong>
\u8a2d\u5b9a\u5141\u8a31\u9023\u7dda\u7684RADIUS Clients\u53ca\u5176\u5c0d\u61c9\u7684serect
client\u70ba\u4f7f\u7528radius\u5354\u5b9a\u7684client,\u5305\u62ec\u5c0dradius server\u767c\u51fa\u8981\u6c42\u7684\u5ba2\u6236\u7aef\u6216\u662f\u652f\u63f4radius\u7684ap

\u683c\u5f0f\u70ba
client < client ip\/mask >{
secret=client\u4f7f\u7528\u7684radius key
shortname=client\u7684\u5225\u540d
nastype=client\u7684nastype
}
ex:
#\u5141\u8a31\u7576\u5730\u4e3b\u6a5f\u7684\u9023\u7dda\u8acb\u6c42
client 127.0.0.1 {
secret = test
shortname = localhost
}
#\u5141\u8a31192.168.1.1\u9023\u7dda\u8acb\u6c42
client 192.168.1.1 {
secret = test
shortname = ap01
}
#\u5141\u8a31192.168.100.0\/24\u9023\u7dda\u8acb\u6c42
client 192.168.100.0\/24 {
secret = test
shortname = switch
}<\/p>\n\n\n\n


…………………………………………………………………………………………………<\/p>\n\n\n\n

users<\/strong>
\u7528\u9014:\u6388\u6b0a\u5c6c\u6027\u8a2d\u5b9a\u3001\u5e33\u865f\u8a8d\u8b49\u3001\u5c6c\u6027\u8abf\u6574<\/p>\n\n\n\n

\u8a2d\u5b9a\u5e33\u865f\u8a8d\u8b49\u65b9\u5f0f\u7684\u683c\u5f0f
<\/strong>[DEFAULT | account] Auth-Type = < system|local|ldap>
\u53ef\u6307\u5b9a\u4ee5\u4e0b2\u7a2e
\u3000\u55ae\u4e00user\u5e33\u865f
\u3000DEFAULT:\u8868\u793a\u6240\u6709user,\u7576\u6240\u6709\u689d\u4ef6\u90fd\u4e0d\u7b26\u5408\u6642\u624d\u4f7f\u7528,\u901a\u5e38\u8207Fall-Trough=1\u4f75\u7528,\u8a2d\u5b9a\u57fa\u672c\u5c6c\u6027
Auth-Type
\u6307\u5b9a\u7684\u8a8d\u8b49\u65b9\u5f0f\u6709\u4ee5\u4e0b\u4e09\u7a2e
\u3000system \u4f7f\u7528\u7cfb\u7d71\u5e33\u865f
\u3000local \u4f7f\u7528user\u6a94\u6848\u4e2d\u6240\u8a2d\u5b9a\u7684\u5e33\u865f
\u3000ldap \u4f7f\u7528ldap\u6240\u8a2d\u5b9a\u7684\u5e33\u865f<\/p>\n\n\n\n

\u9650\u5236\u9023\u7ddaip
Client-IP-Address == “ip”<\/p>\n\n\n\n

\u8a2d\u5b9a\u5bc6\u78bc
User-Password == “password”<\/p>\n\n\n\n

\u8a2d\u5b9a\u6bd4\u5c0d\u7b26\u5408\u5f8c,\u4ecd\u7e7c\u7e8c\u5f80\u4e0b\u6bd4\u5c0d
Fall-Trough = 1<\/p>\n\n\n\n


\u5e38\u7528\u904b\u7b97\u5b50<\/strong>
\u5c6c\u6027 = \u8cc7\u6599 \u5728\u8a72\u5c6c\u6027\u6c92\u6709\u88ab\u8a2d\u7f6e\u7684\u524d\u63d0\u4e0b\u65b0\u589e\u8a72\u5c6c\u6027\u8cc7\u6599
\u5c6c\u6027 := \u8cc7\u6599 \u76f4\u63a5\u8a2d\u5b9a\u8a72\u5c6c\u6027\u8cc7\u6599
\u5c6c\u6027 == \u8cc7\u6599 \u5224\u65b7\u8a72\u5c6c\u6027\u7684\u5167\u5bb9\u662f\u5426\u8207\u8cc7\u6599\u5167\u5bb9\u76f8\u7b26
\u5c6c\u6027 != \u8cc7\u6599 \u5224\u65b7\u8a72\u5c6c\u6027\u7684\u5167\u5bb9\u662f\u5426\u8207\u8cc7\u6599\u5167\u5bb9\u4e0d\u76f8\u7b26
\u5c6c\u6027 =~ \u6b63\u898f\u8868\u793a\u5f0f \u5224\u65b7\u5c6c\u6027\u7684\u5167\u5bb9\u662f\u5426\u7b26\u5408\u6b63\u898f\u8868\u793a\u5f0f\u7684\u898f\u5247
\u5c6c\u6027 !~ \u6b63\u898f\u8868\u793a\u5f0f \u5224\u65b7\u5c6c\u6027\u7684\u5167\u5bb9\u662f\u5426\u4e0d\u7b26\u5408\u6b63\u898f\u8868\u793a\u5f0f\u7684\u898f\u5247<\/p>\n\n\n\n

\u8655\u7406\u898f\u5247<\/strong>
1\u7531\u4e0a\u800c\u4e0b\u6bd4\u5c0d\u81f3\u7b2c\u4e00\u7d44\u5b8c\u5168\u7b26\u5408\u8005\uff0c\u5373\u544a\u5b8c\u6210\u3002
2\u5404\u7d44\u9593\u4ee5\u7a7a\u767d\u884c\u9593\u9694\u3002
3\u4ee5\u5c6c\u6027 user-name \u70ba\u7b2c\u4e00\u500b\u6bd4\u5c0d\u9805(\u4e0d\u5206\u5927\u5c0f\u5beb)\u3002
ex:
DEFAULT Auth-Type = System
Fall-Through = 1
user01 User-Password == “123456”
ex:
\u4f7f\u7528auth-type\u70balocal\u7684\u65b9\u5f0f,\u8a2d\u5b9a\u4f7f\u7528\u8005\u5e33\u865fraymond,\u9023\u7dda\u4f86\u6e90\u9650\u5236\u70ba127.0.0.1,\u4e26\u8a2d\u5bc6\u78bc\u70ba12345
raymond Auth-Type := Local, Client-IP-Address == “127.0.0.1”, User-Password == “12345”<\/p>\n\n\n\n


………………………………………………………………………………………………………<\/p>\n\n\n\n

proxy.conf<\/strong>
\u4e3b\u8981\u4ee5realm\u4f86\u6c7a\u5b9a\u662f\u5426\u9032\u884cproxy<\/p>\n\n\n\n

\u683c\u5f0f\u70ba
realm {
type = radius
authhost= <\u8a8d\u8b49\u4f3a\u670d\u5668 IP>:
accthost = <\u8a08\u8cbb\u4f3a\u670d\u5668 IP>:
secret = #\u82e5host\u90fd\u8a2d\u70baLOCAL\u6642,secret\u56e0\u7528\u4e0d\u5230\u53ef\u7701\u7565
ldflag =
nostrip #\u6536\u5230\u5e33\u865f\u6642\u4e0d\u8981\u628arealm\u540d\u7a31\u6e05\u9664,\u9810\u8a2d\u70bastrip,\u4e5f\u5c31\u662f\u6703\u6e05\u9664realm
fail_over #\u8a2d\u5b9a\u81ea\u52d5\u5099\u63f4,\u9810\u8a2d\u70bafail_over
round_robin #\u8a2d\u5b9a\u8ca0\u8f09\u5e73\u8861
}
ps:\u82e5\u4f7f\u7528\u8005\u5e33\u865f\u70baraymond@study.net,\u5247realm\u70bastudy.net
ps:\u82e5\u4f7f\u7528\u8005\u5e33\u865f\u53ea\u6709raymond,\u5247\u6b64\u5e33\u865f\u6c92\u4f7f\u7528realm
ps:realm\u540d\u7a31\u7121\u5927\u5c0f\u5beb\u5206\u5225,\u7531\u7ba1\u7406\u8005\u6307\u5b9a\u5373\u53ef,\u8207domain name\u7121\u76f4\u63a5\u95dc\u4fc2
ex:
\u5c07\u6c92\u6709realm\u7684\u5e33\u865f\u4ee5\u9810\u8a2d\u7684\u8a8d\u8b49\u65b9\u5f0f\u9a57\u8b49
realm NULL {
\u3000type = radius
\u3000authhost = LOCAL
\u3000accthost = LOCAL
}
ex:
\u5c07\u6c92\u6709realm\u7684\u5e33\u865f\u8f49\u9001\u5230192.168.0.10:1645\u53bb\u9a57\u8b49
realm NULL {
type = radius
authhost = 192.168.0.10:1645
accthost = 192.168.0.10:1646
secret = dontshowit
}
ex:
\u5c07realm\u70bawifi.nchc.org.tw\u7684\u5e33\u865f\u4ee5\u9810\u8a2d\u7684\u5e33\u865f\u8655\u7406
\u65b9\u5f0f\u8655\u7406
realm wifi.nchc.org.tw {
type = radius
authhost = LOCAL
accthost = LOCAL
}
ex:
\u5c07realm\u70bawifi.nchc.org.tw \u7684\u5e33\u865f\u8f49\u9001\u5230192.168.0.7:1812\u53bb\u8655\u7406
realm wifi.nchc.org.tw {
type = radius
authhost = 192.168.0.7:1812
accthost = 192.168.0.7:1813
secret = donttellanyone
}
ex:
\u6240\u6709\u4e0d\u7b26\u5408\u5176\u4ed6realm\u8a2d\u5b9a\u7684\u5e33\u865f\uff0c\u8f49\u9001\u5230192.168.0.99:1812 \u53bb\u8655\u7406\uff0c\u4e14\u4e0d\u6ffe\u9664realm\u540d\u7a31
realm DEFAULT {
type = radius
authhost = 192.168.0.99:1812
accthost = 192.168.0.99:1813
secret = aloha3
nostrip
}

\u8a2d\u5b9a\u81ea\u52d5\u5099\u63f4
ex:
\u82e5isp1.com\u5224\u5b9a\u7121\u56de\u61c9,\u5247\u6539\u7531isp2.com\u8655\u7406
realm wifi.home {
\u3000type = radius
\u3000authhost = isp1.com:1812
\u3000accthost = isp1.com:1813
\u3000secret = sweetheart
}
realm wifi.home {
\u3000type = radius
\u3000authhost = isp2.com:1812
\u3000accthost = isp2.com:1813
\u3000secret = heartsweet
\u3000fail_over
}

\u8a2d\u5b9a\u8ca0\u8f09\u5e73\u8861
ex:
\u82e5isp1.com\u548cisp2.com\u505a\u8ca0\u8f09\u5e73\u8861
realm wifi.home {
\u3000type = radius
\u3000authhost = isp1.com:1812
\u3000accthost = isp1.com:1813
\u3000secret = sweetheart
round_robin
}
realm wifi.home {
\u3000type = radius
\u3000authhost = isp2.com:1812
\u3000accthost = isp2.com:1813
\u3000secret = heartsweet
\u3000round_robin
}<\/p>\n","protected":false},"excerpt":{"rendered":"

freeradius(http:\/\/www.freeradi …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"","fifu_image_alt":"","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[21],"tags":[],"class_list":["post-688","post","type-post","status-publish","format-standard","hentry","category-linuxservice"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/688","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/comments?post=688"}],"version-history":[{"count":0,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/688\/revisions"}],"wp:attachment":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/media?parent=688"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/categories?post=688"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/tags?post=688"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}