strongswan整合radius（待续）

最新推荐文章于 2022-08-15 17:22:28 发布
原创 最新推荐文章于 2022-08-15 17:22:28 发布 · 3.3k 阅读 · 0 ·
CC 4.0 BY-SA版权
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。

部署运行你感兴趣的模型镜像

测试系统：centos7.0

下载strongswan源码包编译安装，yum install strongswan出来的默认没有启用eap-radius

yum install openssl-devel
tar -xf strongswsan-5.5.1.tar.gz
./configure  --enable-eap-identity --enable-eap-md5 \
--enable-eap-mschapv2 --enable-eap-tls --enable-eap-ttls --enable-eap-peap  \
--enable-eap-tnc --enable-eap-dynamic --enable-eap-radius --enable-xauth-eap  \
--enable-xauth-pam  --enable-dhcp  --enable-openssl  --enable-addrblock --enable-unity  \
--enable-certexpire --enable-radattr --enable-tools --enable-openssl --disable-gmp --enable-kernel-libipsec

配置/usr/local/etc/strongswan.d/charon/eap-radius.conf

在server区域添加如下选项

    servers {
       radius-for-vpn {
           secret = testing123
           address = radius.exapmle.com
        }

    }

修改strongswan配置/usr/local/etc/strongswan.d/charon/ipsec.conf的rightauth为 

rightauth = eap-radius

在radtest能够成功通过openldap认证的情况下，使用windwos的ikev2拨号，

使用radiusd -X发现，用

radtest username password radius.example.com 4 testing123
radiusd收到了客户端发送的帐号密码 

    Received Access-Request Id 1 from 10.0.0.1:58710 to 10.0.0.1:1812 length 76
            User-Name = 'user1'
            User-Password = 'admin'
            NAS-IP-Address = 10.0.0.1
            NAS-Port = 4
            Message-Authenticator = 0xa6f60b034a0b967b8270705c6be94524
    (8) Received Access-Request packet from host 10.0.0.1 port 58710, id=1, length=76
    (8)     User-Name = 'user1'
    (8)     User-Password = 'admin'
    (8)     NAS-IP-Address = 10.0.0.1
    (8)     NAS-Port = 4
    (8)     Message-Authenticator = 0xa6f60b034a0b967b8270705c6be94524
    (8) # Executing section authorize from file /etc/raddb/sites-enabled/default
    (8)   authorize {
    (8)   filter_username filter_username {
    (8)     if (!&User-Name) 
    (8)     if (!&User-Name)  -> FALSE
    (8)     if (&User-Name =~ / /) 
    (8)     if (&User-Name =~ / /)  -> FALSE
    (8)     if (&User-Name =~ /@.*@/ ) 
    (8)     if (&User-Name =~ /@.*@/ )  -> FALSE
    (8)     if (&User-Name =~ /\\.\\./ ) 
    (8)     if (&User-Name =~ /\\.\\./ )  -> FALSE
    (8)     if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\\.(.+)$/))  
    (8)     if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\\.(.+)$/))   -> FALSE
    (8)     if (&User-Name =~ /\\.$/)  
    (8)     if (&User-Name =~ /\\.$/)   -> FALSE
    (8)     if (&User-Name =~ /@\\./)  
    (8)     if (&User-Name =~ /@\\./)   -> FALSE
    (8)   } # filter_username filter_username = notfound
    (8)   [preprocess] = ok
    (8)   [chap] = noop
    (8)   [mschap] = noop
    (8)   [digest] = noop
    (8)  suffix : Checking for suffix after "@"
    (8)  suffix : No '@' in User-Name = "user1", looking up realm NULL
    (8)  suffix : No such realm "NULL"
    (8)   [suffix] = noop
    (8)  eap : No EAP-Message, not doing EAP
    (8)   [eap] = noop
    (8)   [files] = noop
    rlm_ldap (ldap): Reserved connection (8)
    (8)  ldap : EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}})
    (8)  ldap :    --> (uid=user1)
    (8)  ldap : EXPAND dc=cloudtropy,dc=com
    (8)  ldap :    --> dc=cloudtropy,dc=com
    (8)  ldap : Performing search in 'dc=cloudtropy,dc=com' with filter '(uid=user1)', scope 'sub'
    (8)  ldap : Waiting for search result...
    (8)  ldap : User object found at DN "uid=user1,ou=DevOps,ou=Member,dc=cloudtropy,dc=com"
    (8)  ldap : Processing user attributes
    (8)  ldap :     control:Password-With-Header += '{SSHA}DZH+C/YIGMMZq0e1eFOxjlWGzPs4RlVJ'
    rlm_ldap (ldap): Released connection (8)
    rlm_ldap (ldap): 0 of 4 connections in use.  Need more spares
    rlm_ldap (ldap): Opening additional connection (9)
    rlm_ldap (ldap): Connecting to ldap.cloutropy.com.cn:389
    rlm_ldap (ldap): Waiting for bind result...
    rlm_ldap (ldap): Bind successful
    rlm_ldap (ldap): Closing connection (7): Hit idle_timeout, was idle for 180 seconds
    rlm_ldap (ldap): Closing connection (6): Hit idle_timeout, was idle for 221 seconds
    rlm_ldap (ldap): Closing connection (5): Hit idle_timeout, was idle for 237 seconds
    (8)   [ldap] = ok
    (8)   [expiration] = noop
    (8)   [logintime] = noop
    (8)   [pap] = updated
    (8)  } #  authorize = updated
    (8) Found Auth-Type = PAP
    (8) # Executing group from file /etc/raddb/sites-enabled/default
    (8)  Auth-Type PAP {
    (8)  pap : Login attempt with password
    (8)  pap : Comparing with "known-good" SSHA-Password
    (8)  pap : Normalizing SSHA1-Password from base64 encoding, 32 bytes -> 24 bytes
    (8)  pap : User authenticated successfully
    (8)   [pap] = ok
    (8)  } # Auth-Type PAP = ok
    (8) # Executing section post-auth from file /etc/raddb/sites-enabled/default
    (8)   post-auth {
    (8)   [exec] = noop
    (8)   remove_reply_message_if_eap remove_reply_message_if_eap {
    (8)     if (&reply:EAP-Message && &reply:Reply-Message) 
    (8)     if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
    (8)    else else {
    (8)     [noop] = noop
    (8)    } # else else = noop
    (8)   } # remove_reply_message_if_eap remove_reply_message_if_eap = noop
    (8)  } #  post-auth = noop
    (8) Sending Access-Accept packet to host 10.0.0.1 port 58710, id=1, length=0
    Sending Access-Accept Id 1 from 10.0.0.1:1812 to 10.0.0.1:58710
    (8) Finished request




用windows的ikev2的客户端认证没有帐号密码

    (7) Received Access-Request packet from host 10.0.0.1 port 38517, id=142, length=226
    (7)     User-Name = 'user1'
    (7)     NAS-Port-Type = Virtual
    (7)     Service-Type = Framed-User
    (7)     NAS-Port = 4
    (7)     NAS-Port-Id = 'ikev2-eap-mschapv2'
    (7)     NAS-IP-Address = 10.0.0.1
    (7)     Called-Station-Id = '10.0.0.1[4500]'
    (7)     Calling-Station-Id = '1.1.1.1[2193]'
    (7)     EAP-Message = 0x020100411a0201003c318c14d6d2bc07227b4e81356f5a6009cf0000000000000000c656f6467d35e4ae098c85aebc2d1b015103d1c4408e79cc0068756e746572
    (7)     NAS-Identifier = 'strongSwan'
    (7)     State = 0x874ed917874fc3a3903d900194a65936
    (7)     Message-Authenticator = 0x4276fade8578cf5c9634bfe0ef5b137d
    (7) # Executing section authorize from file /etc/raddb/sites-enabled/default
    (7)   authorize {
    (7)   filter_username filter_username {
    (7)     if (!&User-Name) 
    (7)     if (!&User-Name)  -> FALSE
    (7)     if (&User-Name =~ / /) 
    (7)     if (&User-Name =~ / /)  -> FALSE
    (7)     if (&User-Name =~ /@.*@/ ) 
    (7)     if (&User-Name =~ /@.*@/ )  -> FALSE
    (7)     if (&User-Name =~ /\\.\\./ ) 
    (7)     if (&User-Name =~ /\\.\\./ )  -> FALSE
    (7)     if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\\.(.+)$/))  
    (7)     if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\\.(.+)$/))   -> FALSE
    (7)     if (&User-Name =~ /\\.$/)  
    (7)     if (&User-Name =~ /\\.$/)   -> FALSE
    (7)     if (&User-Name =~ /@\\./)  
    (7)     if (&User-Name =~ /@\\./)   -> FALSE
    (7)   } # filter_username filter_username = notfound
    (7)   [preprocess] = ok
    (7)   [chap] = noop
    (7)   [mschap] = noop
    (7)   [digest] = noop
    (7)  suffix : Checking for suffix after "@"
    (7)  suffix : No '@' in User-Name = "user1", looking up realm NULL
    (7)  suffix : No such realm "NULL"
    (7)   [suffix] = noop
    (7)  eap : Peer sent code Response (2) ID 1 length 65
    (7)  eap : No EAP Start, assuming it's an on-going EAP conversation
    (7)   [eap] = updated
    (7)   [files] = noop
    rlm_ldap (ldap): Reserved connection (7)
    (7)  ldap : EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}})
    (7)  ldap :    --> (uid=user1)
    (7)  ldap : EXPAND dc=example,dc=com
    (7)  ldap :    --> dc=example,dc=com
    (7)  ldap : Performing search in 'dc=example,dc=com' with filter '(uid=user1)', scope 'sub'
    (7)  ldap : Waiting for search result...
    (7)  ldap : User object found at DN "uid=user1,ou=DevOps,ou=Member,dc=example,dc=com"
    (7)  ldap : Processing user attributes
    (7)  ldap :     control:Password-With-Header += '{SSHA}DZH+C/YIGMMZq0e1eFOxjlWGzPs4RlVJ'
    rlm_ldap (ldap): Released connection (7)
    rlm_ldap (ldap): 0 of 4 connections in use.  Need more spares
    rlm_ldap (ldap): Opening additional connection (8)
    rlm_ldap (ldap): Connecting to ldap.cloutropy.com.cn:389
    rlm_ldap (ldap): Waiting for bind result...
    rlm_ldap (ldap): Bind successful
    rlm_ldap (ldap): Closing connection (4): Hit idle_timeout, was idle for 62 seconds
    (7)   [ldap] = ok
    (7)   [expiration] = noop
    (7)   [logintime] = noop
    (7)  WARNING: pap : Auth-Type already set.  Not setting to PAP
    (7)   [pap] = noop
    (7)  } #  authorize = updated
    (7) Found Auth-Type = EAP
    (7) # Executing group from file /etc/raddb/sites-enabled/default
    (7)   authenticate {
    (7)  eap : Expiring EAP session with state 0x874ed917874fc3a3
    (7)  eap : Finished EAP session with state 0x874ed917874fc3a3
    (7)  eap : Previous EAP request found for state 0x874ed917874fc3a3, released from the list
    (7)  eap : Peer sent method MSCHAPv2 (26)
    (7)  eap : EAP MSCHAPv2 (26)
    (7)  eap : Calling eap_mschapv2 to process EAP data
    (7)  eap_mschapv2 : # Executing group from file /etc/raddb/sites-enabled/default
    (7)  eap_mschapv2 :  Auth-Type MS-CHAP {
    (7)   WARNING: mschap : No Cleartext-Password configured.  Cannot create LM-Password
    (7)   WARNING: mschap : No Cleartext-Password configured.  Cannot create NT-Password
    (7)   mschap : Creating challenge hash with username: user1
    (7)   mschap : Client is using MS-CHAPv2
    (7)   ERROR: mschap : FAILED: No NT/LM-Password.  Cannot perform authentication
    (7)   ERROR: mschap : MS-CHAP2-Response is incorrect
    (7)    [mschap] = reject
    (7)   } # Auth-Type MS-CHAP = reject
    (7)  eap : Freeing handler
    (7)   [eap] = reject
    (7)  } #  authenticate = reject
    (7) Failed to authenticate the user
    (7) Using Post-Auth-Type Reject
    (7) # Executing group from file /etc/raddb/sites-enabled/default
    (7)  Post-Auth-Type REJECT {
    (7)  attr_filter.access_reject : EXPAND %{User-Name}
    (7)  attr_filter.access_reject :    --> user1
    (7)  attr_filter.access_reject : Matched entry DEFAULT at line 11
    (7)   [attr_filter.access_reject] = updated
    (7)  eap : Reply already contained an EAP-Message, not inserting EAP-Failure
    (7)   [eap] = noop
    (7)   remove_reply_message_if_eap remove_reply_message_if_eap {
    (7)     if (&reply:EAP-Message && &reply:Reply-Message) 
    (7)     if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
    (7)    else else {
    (7)     [noop] = noop
    (7)    } # else else = noop
    (7)   } # remove_reply_message_if_eap remove_reply_message_if_eap = noop
    (7)  } # Post-Auth-Type REJECT = updated
    (7) Delaying response for 1 seconds
    Waking up in 0.3 seconds.
    Waking up in 0.6 seconds.
    (7) Sending delayed response
    (7) Sending Access-Reject packet to host 10.0.0.1 port 38517, id=142, length=0
    (7)     MS-CHAP-Error = '\001E=691 R=1'
    (7)     EAP-Message = 0x04010004
    (7)     Message-Authenticator = 0x00000000000000000000000000000000
    Sending Access-Reject Id 142 from 10.0.0.1:1812 to 10.0.0.1:38517
            MS-CHAP-Error = '\001E=691 R=1'
            EAP-Message = 0x04010004
            Message-Authenticator = 0x00000000000000000000000000000000
    Waking up in 3.9 seconds.
    (6) Cleaning up request packet ID 141 with timestamp +111
    (7) Cleaning up request packet ID 142 with timestamp +111




待续。。。。。

您可能感兴趣的与本文相关的镜像

Stable-Diffusion-3.5

Stable-Diffusion-3.5

图片生成
Stable-Diffusion

Stable Diffusion 3.5 (SD 3.5) 是由 Stability AI 推出的新一代文本到图像生成模型，相比 3.0 版本，它提升了图像质量、运行速度和硬件效率

cikenerd
关注
Strongswan app 使用IKEv2 EAP 通过 Freeradius EAP认证 连接 Strongswan
taylorgogo
06-11 5559
索引环境安装链接Ubuntu 安装 Strongswan配置 Strongswang配置 Freeradius配置Strongswan VPN APPDebug应用 环境 @Linux uname -a Linux szqsm 4.15.0-73-generic #82-Ubuntu SMP Tue Dec 3 00:04:14 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux @Strongswan ipsec --version Linux strongSwan U5
centOS 编译strongswan
kingwan560的专栏
03-04 914
编译 strongswan
strongswan + freeradius 配置 for windows
sonflower123的博客
03-28 5580
一.Strongswan 安装 1.centos 安装依赖：yum  install  -y  gmp-devel  2.下载编译   wget http://download.strongswan.org/strongswan.tar.gz   tar xzf strongswan.tar.gz   cd strongswan-*    ./configure  --
Strongswan+freeradius+daloradius+ad认证实现ikev2接入服务四
weixin_33888907的博客
08-15 782
strongswan openswan freeradius讨论QQ群：892427461Strongswan+freeradius+daloradius+ad认证实现ikev2接入服务第四部分 安装mysql、daloradius实现freeradius的web管理实验时间：2018年8月14日-2018年8月15日拓扑图：环境：防火墙1：FW1U...
strongswan简单介绍
kernelfish的专栏
04-13 1万+
    strongswan是linux平台下的一款ipsec开源工具，和openswan一样都是基于freeswan项目。不过strongswan更侧重于ikev2协议的实现。ikev2（RFC 4306）是ike的第二个版本，它在安全性和功能上都有很大的增强，简化了协议。   strongswan绝大部分代码是用c实现的，支持klips和netkey两种ipsec方式。在ikev2协议中使
strongswan介绍
热门推荐
wq897387的专栏
03-12 2万+
strongswan介绍文档翻译
strongSwan Linux内核安全框架
cnbird's blog
10-06 3212
strongSwan是一个完整的2.4和2.6的Linux内核下的IPsec和IKEv1 的实施。它也完全支持新的IKEv2协议的Linux 2.6内核。它互均IKEv1和IKEv2模式与大多数其他基于IPSec的VPN产品。的重点项目是strongSwan强认证机制，使用X.509公 开密钥证书和可选的安全储存私钥对智能卡通过一个标准化的PKCS ＃ 11接口。一个特点是使用的X.509属性证书
linux基于Pam_radius整合身份认证说明_v1.0.pdf
10-28
Linux基于Pam_radius整合身份认证说明 在Linux系统中，身份认证是非常重要的一环。Pam_radius是一种基于Radius协议的身份认证方式，通过与Freeradius和Jradius集成，可以提供强大且灵活的身份认证机制。本文将详细...
freeradius-3.0.22-For Windows x64
01-03
freeradius-3.0.22 Windows版，64位
jradius+freeRadius 搭建AAA认证服务
01-22
因为freeradius是c写的，而需求是需要java搭建radius服务器，jradius正好是java写的，在freeradius3.0以下把jradius的模块映射出去，这样就可以用java代码来操作java端的服务器。 本资源好几个人搭建1个周，过程很...
strongswan5.6.3
07-03
基于IPSec协议的源代码的实现，如果想好好学习了解IPsec的原理，strongswan是个很好的选择
五、IPSec开源项目strongSwan
小脑斧的博客
08-15 9731
strongSwan是一套完整的IPsec开源实现方案，用来提供服务端和客户端之间的加密和认证。
从零开始搭建strongswan
B★R★S的博客
12-21 1万+
转眼一年就这么过去了，补下之前说到的手动搭建strongswan，免得拖到明年。 准备工作 一台linux服务器，这里以Debian10为例 strognswan安装包，官网下载，我用的是5.9.1 一.安装strongswan 1) 更新，添加依赖： apt update -y apt install libpam0g-dev libssl-dev make gcc curl tcpdump -y 2) 解压： 将strongswan安装包上传到linux服务器，解压后进入安装目录 t
Centos 7.6 Strongswan的搭建及使用
小人物也有大梦想
04-17 1万+
一、服务器准备 这个不用我说了吧，我在阿里云购买的香港的服务器。 二、软件安装以及证书生成 1、安装必要的软件（如果你也是在阿里购买的yum源不用配置） yum -y install gpm-devel pam-devel openssl-devel make gcc epel-release strongswan 设置别名 alias ipsec='strongswan' 进入软件目录 cd...
strongSwan报文交互过程
衡水铁头哥的博客
07-28 2223
Connections可以理解为对等体信息，其中前3行是IKE对等体信息，有本端和对端的身份标识以及认证方式；最后一行child就是IPsec连接，模式为TUNNEL隧道模式，因为IPsec SA是基于IKE SA创建的，所以用child来表示也是比较合理的。...
strongSwan：软件安装简介
hhd1988的专栏
05-18 1万+
在ubuntu20.04上 ，strongSwan安装有两种途径： 1、下载源码编译安装 2、图形界面安装
FreeRadius 2.1.6的安装
Hansel的专栏
08-17 1万+
FreeRadius 2.1.6的安装hansel@163.com2008-9-7Linux: RedHat Enterprise Linux AS 5红帽子企业版安装了freeradius-1.1.3-1.2.el5，先卸载：# rpm -ev freeradius 1.       下载http://freeradius.org/download.html目前的版本
Windows下strongswan-5.5.3源码安装
qq_42045349的博客
04-15 5406
Windows 下strongswan源码安装 网上没有一个完整版本的安装教程，只能看官方英文文档，折腾数周，成功编译。现附上安装历程供大家参考。有问题可以互相讨论。 windows支持strongswan5.2.0以上版本。本次用5.5.3版本。该文档中英文部分摘抄自官方文档（作为解释）： Windows下编译strongswan pki的用法 准备工作 1、下载strongswan源码5.2.0以上版本：strongswan5.5.3较好。 strongswan-5.5.3下载地址 2、安装MinGW6
strongswan编译、配置
weixin_42548573的博客
06-23 5622
想知道怎么配置StrongSwan，首先要知道自己想搭建一个什么样的场景 在StrongSwan的官网上，我们可以在左侧找到TestScenarios，这里有许多场景，我们需要决定我们到底要再现哪一个。 进去之后点开strongSWan test suits： ...
评论 1
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值