CentOS+FreeRadius认证实现

准备工作搭建CentOS7，地址为：192.168.51.104

1.关闭防火墙

# 192.168.51.104
systemctl stop firewalld                                       //关闭防火墙
systemctl disable firewalld                                    //关闭防火墙自启
sed -i '/SELINUX/s/enforcing/disabled/' /etc/selinux/config    //关闭Selinux
sestatus                                                       //查询Selinux状态（需重启后查询）

2.安装配置MariaDB

#192.168.51.104
yum install -y mariadb-server mariadb              //安装MariaDB数据库
systemctl start mariadb                            //启动MariaDB        
systemctl enable mariadb                           //设置开机自启动
mysql_secure_installation                          //SQL自动配置（除设置密码，其余都回车）

配置MariaDB

# 192.168.51.104
mysql -u root -p                        
MariaDB [(none)]> create database radius;                                              //创建数据库radius
MariaDB [(none)]> grant all on radius.* to radius@localhost identified by 'radius';    //设置radius用户名密码及权限
MariaDB [(none)]> flush privileges;                                                    //刷新权限
MariaDB [(none)]> exit

3.安装配置FreeRadius

# 192.168.51.104
yum install -y freeradius freeradius-utils freeradius-mysql         //安装FreeRadius及组件
systemctl start radiusd.service                                     //启动radius服务
systemctl enable radiusd.service                                    //设置radius服务开机自启动

配置radius

# 192.168.51.104
配置 /etc/raddb/users
文件头添加 user1  Cleartext-Password := "radius"
radiusd -X  #调试模式运行radius
radtest user1 radius localhost 1812 testing123 # 另开启一终端

Sent Access-Request Id 6 from 0.0.0.0:43355 to 127.0.0.1:1812 length 75
        User-Name = "user1"
        User-Password = "radius"
        NAS-IP-Address = 127.0.0.1
        NAS-Port = 1812
        Message-Authenticator = 0x00
        Cleartext-Password = "radius"
Received Access-Accept Id 6 from 127.0.0.1:1812 to 0.0.0.0:0 length 20

4.FreeRadius对接Mariadb

创建raidus数据库和数据表

# 192.168.51.104
mysql -u root -p radius < /etc/raddb/mods-config/sql/main/mysql/schema.sql    /创建FreeRadius在数据库中的数据表

配置sql

#192.168.51.104 配置/etc/raddb/mods-available/sql
sql {
        driver = "rlm_sql_mysql"
        dialect = "mysql"
        server = "localhost"
        port = 3306
        login = "radius"
        password = "radius"
        radius_db = "radius"
        acct_table1 = "radacct"
        acct_table2 = "radacct"
        postauth_table = "radpostauth"
        authcheck_table = "radcheck"
        groupcheck_table = "radgroupcheck"
        authreply_table = "radreply"
        groupreply_table = "radgroupreply"
        usergroup_table = "radusergroup"
        delete_stale_sessions = yes
        pool {
                start = ${thread[pool].start_servers}
                min = ${thread[pool].min_spare_servers}
                max = ${thread[pool].max_servers}
                spare = ${thread[pool].max_spare_servers}
                uses = 0
                retry_delay = 30
                lifetime = 0
                idle_timeout = 60
        }
        client_table = "nas"
        group_attribute = "SQL-Group"
        $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf
}

chgrp -h radiusd /etc/raddb/mods-available/sql
systemctl restart radiusd.service
systemctl status mariadb
cd /etc/raddb/mods-enabled/
ln -s ../mods-available/sql
systemctl restart radiusd.service
systemctl status radiusd.service

4.验证

1.数据库中添加授权用户

mysql -uroot -p
use radius
insert into radcheck(username,attribute,value,op) values ('user2','Cleartext-Password','radius',':=')

2.本地测试

[root@work1 ~]# radtest user2 radius localhost 1812 testing123
Sent Access-Request Id 190 from 0.0.0.0:39209 to 127.0.0.1:1812 length 75
        User-Name = "user2"
        User-Password = "radius"
        NAS-IP-Address = 127.0.0.1
        NAS-Port = 1812
        Message-Authenticator = 0x00
        Cleartext-Password = "radius"
Received Access-Accept Id 190 from 127.0.0.1:1812 to 0.0.0.0:0 length 20

3.配置其他机器访问

[root@work1 ~]# cat /etc/raddb/clients.conf
client localhost {
        ipaddr = 127.0.0.1
        proto = *
        secret = testing123
        require_message_authenticator = no
        limit {
                max_connections = 16
                lifetime = 0
                idle_timeout = 30
        }
}

client localhost_ipv6 {
        ipv6addr        = ::1
        secret          = testing123
}

client 0.0.0.0/0 {
        secret          = testing123
}

4.使用pyrad进行验证

from __future__ import print_function
from pyrad.client import Client
from pyrad.dictionary import Dictionary
import pyrad.packet

srv = Client(server="192.168.51.104", secret=b"testing123",
             dict=Dictionary("dictionary.rfc2865"))

# create request
req = srv.CreateAuthPacket(code=pyrad.packet.AccessRequest,
                           User_Name="user2", NAS_Identifier="localhost")
req["User-Password"] = req.PwCrypt("radius")

# send request
reply = srv.SendPacket(req)

if reply.code == pyrad.packet.AccessAccept:
    print("access accepted")
else:
    print("access denied")

print("Attributes returned by server:")
for i in reply.keys():
    print("%s: %s" % (i, reply[i]))
    
# 输出内容
access accepted
Attributes returned by server:

5.其他

dictionary.rfc2865内容如下

ATTRIBUTE   User-Name       1   string
ATTRIBUTE   User-Password       2   string
ATTRIBUTE   CHAP-Password       3   octets
ATTRIBUTE   NAS-IP-Address      4   ipaddr
ATTRIBUTE   NAS-Port        5   integer
ATTRIBUTE   Service-Type        6   integer
ATTRIBUTE   Framed-Protocol     7   integer
ATTRIBUTE   Framed-IP-Address   8   ipaddr
ATTRIBUTE   Framed-IP-Netmask   9   ipaddr
ATTRIBUTE   Framed-Routing      10  integer
ATTRIBUTE   Filter-Id       11  string
ATTRIBUTE   Framed-MTU      12  integer
ATTRIBUTE   Framed-Compression  13  integer
ATTRIBUTE   Login-IP-Host       14  ipaddr
ATTRIBUTE   Login-Service       15  integer
ATTRIBUTE   Login-TCP-Port      16  integer
ATTRIBUTE   Reply-Message       18  string
ATTRIBUTE   Callback-Number     19  string
ATTRIBUTE   Callback-Id     20  string
ATTRIBUTE   Framed-Route        22  string
ATTRIBUTE   Framed-IPX-Network  23  ipaddr
ATTRIBUTE   State           24  octets
ATTRIBUTE   Class           25  octets
ATTRIBUTE   Vendor-Specific     26  octets
ATTRIBUTE   Session-Timeout     27  integer
ATTRIBUTE   Idle-Timeout        28  integer
ATTRIBUTE   Termination-Action  29  integer
ATTRIBUTE   Called-Station-Id   30  string
ATTRIBUTE   Calling-Station-Id  31  string
ATTRIBUTE   NAS-Identifier      32  string
ATTRIBUTE   Proxy-State     33  octets
ATTRIBUTE   Login-LAT-Service   34  string
ATTRIBUTE   Login-LAT-Node      35  string
ATTRIBUTE   Login-LAT-Group     36  octets
ATTRIBUTE   Framed-AppleTalk-Link   37  integer
ATTRIBUTE   Framed-AppleTalk-Network 38 integer
ATTRIBUTE   Framed-AppleTalk-Zone   39  string