CentOS7.4+FreeRadius+ldap（Windows AD）认证搭建radius服务-天翼云

CentOS7.4+FreeRadius+ldap（Windows AD）认证搭建radius服务

2023-05-31 08:41:18 阅读次数：516

（一）简介 freeradius一般用来进行账户认证管理，记账管理，常见的电信运营商的宽带账户，上网账户管理，记账，都是使用的radius服务器进行鉴权记账的。Freeradius包含一个radius服务器和radius-client，可以对支持radius协议的网络设备进行鉴权记账。 ------百度百科

（二）安装配置服务

[root@localhost ~]# yum install freeradius freeradius-ldap freeradius-utils -y
[root@localhost ~]# systemctl enable radiusd.service
[root@localhost ~]# systemctl start radiusd.service

（三）修改相关配置文件

3.1，修改/etc/raddb/mods-available/ldap文件，主要是ldap部分，其他的都是默认


[root@localhost raddb]#  cat /etc/raddb/mods-available/ldap | grep -v '#' | grep -v ^$
ldap {
server = 'x.x.x.x'   #服务器
port = 389   #端口
identity = 'CN=opsldap,CN=Users,DC=txxxdxx,DC=me'  #连接LDAP帐号
password =xxxxxxxx   #连接LDAP密码
base_dn = 'DC=txxxdxx,DC=me'   #dn
sasl {
}
update {
control:Password-With-Header    += 'userPassword'
control:                        += 'radiusControlAttribute'
request:                        += 'radiusRequestAttribute'
reply:                          += 'radiusReplyAttribute'
}
edir = no   #修改
user {
base_dn = "${..base_dn}"
filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})"     #修改成sAM
以下用默认
sasl {
}
}
group {
base_dn = "${..base_dn}"
filter = '(objectClass=posixGroup)'
membership_attribute = 'memberOf'
}
profile {
}
client {
base_dn = "${..base_dn}"
filter = '(objectClass=radiusClient)'
template {
}
attribute {
ipaddr                          = 'radiusClientIdentifier'
secret                          = 'radiusClientSecret'
}
}
accounting {
reference = "%{tolower:type.%{Acct-Status-Type}}"
type {
start {
update {
description := "Online at %S"
}
}
interim-update {
update {
description := "Last seen at %S"
}
}
stop {
update {
description := "Offline at %S"
}
}
}
}
post-auth {
update {
description := "Authenticated at %S"
}
}
options {
chase_referrals = yes
rebind = yes
res_timeout = 10
srv_timelimit = 3
net_timeout = 1
idle = 60
probes = 3
interval = 3
ldap_debug = 0x0028
}
tls {
}
pool {
start = ${thread[pool].start_servers}
min = ${thread[pool].min_spare_servers}
max = ${thread[pool].max_servers}
spare = ${thread[pool].max_spare_servers}
uses = 0
retry_delay = 30
lifetime = 0
idle_timeout = 60
}

3.2，创建软连接在mods-enable/模块下

[root@localhost raddb]# ln -s /etc/raddb/mods-available/ldap /etc/raddb/mods-enabled/
[root@localhost raddb]# ll /etc/raddb/mods-enabled/ldap 
lrwxrwxrwx 1 root root 30 Jul 17 18:19 /etc/raddb/mods-enabled/ldap -> /etc/raddb/mods-available/ldap

3.3，在site-avaiable/下创建site_ldap文件

[root@localhost raddb]# cat /etc/raddb/sites-available/site_ldap 

ldap {
        server = 'x.x.8.55'   #服务器
        port = 389   #端口
        identity = 'CN=opsldap,CN=Users,DC=txxxdxx,DC=me'  #连接LDAP帐号
        password =xxxxxxxx   #连接LDAP密码
        base_dn = 'DC=txxxdxx,DC=me'   #dn
        sasl {
        }
        update {
                control:Password-With-Header    += 'userPassword'
                control:                        += 'radiusControlAttribute'
                request:                        += 'radiusRequestAttribute'
                reply:                          += 'radiusReplyAttribute'
        }
        edir = no   #修改
        user {
                base_dn = "${..base_dn}"
                filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})"     #修改成sAM
#以下用默认
                sasl {
                }
        }
        group {
                base_dn = "${..base_dn}"
                filter = '(objectClass=posixGroup)'
                membership_attribute = 'memberOf'
        }
        profile {
        }
        client {
                base_dn = "${..base_dn}"
                filter = '(objectClass=radiusClient)'
                template {
                }
                attribute {
                        ipaddr                          = 'radiusClientIdentifier'
                        secret                          = 'radiusClientSecret'
                }
        }
        accounting {
                reference = "%{tolower:type.%{Acct-Status-Type}}"
                type {
                        start {
                                update {
                                        description := "Online at %S"
                                }
                        }
                        interim-update {
                                update {
                                        description := "Last seen at %S"
                                }
                        }
                        stop {
                                update {
                                        description := "Offline at %S"
                                }
                        }
                }
        }
        post-auth {
                update {
                        description := "Authenticated at %S"
                }
        }
        options {
                chase_referrals = yes
                rebind = yes
                res_timeout = 10
                srv_timelimit = 3
                net_timeout = 1
                idle = 60
                probes = 3
                interval = 3
                ldap_debug = 0x0028
        }
        tls {
        }
        pool {
                start = ${thread[pool].start_servers}
                min = ${thread[pool].min_spare_servers}
                max = ${thread[pool].max_servers}
                spare = ${thread[pool].max_spare_servers}
                uses = 0
                retry_delay = 30
                lifetime = 0
                idle_timeout = 60
        }
}

3.4，在site-enabled下创建软连接

[root@localhost raddb]# ln -s /etc/raddb/sites-available/site_ldap /etc/raddb/sites-enabled/
[root@localhost raddb]# ll /etc/raddb/sites-enabled/site_ldap 
lrwxrwxrwx 1 root root 36 Jul 17 18:21 /etc/raddb/sites-enabled/site_ldap -> /etc/raddb/sites-available/site_ldap

（四），队radius进行相关的测试，可以通过重启服务器或者radiusd -X 进行测试设置

[root@localhost mods-available]# systemctl restart radiusd
或者
[root@localhost mods-available]# radiusd  -X

4.1,修改 /etc/raddb/clients.conf 文件，客户端认证的网段和密钥。（修改服务器端记录客户端的配置文件 /etc/raddb/clients.conf 文件，该文件默认值提供了本机测试的 local 配置，即：安装完后默认只允许本机的client客户端访问radius服务器）

[root@localhost raddb]#  cat /etc/raddb/clients.conf | grep -v '#' | grep -v ^$
client localhost {        ###认证的网段
	ipaddr = 127.0.0.1   ###被认证可以访问的ip地址
	proto = *
	secret = testing123      ###密钥
	require_message_authenticator = no
	limit {
		max_connections = 16
		lifetime = 0
		idle_timeout = 30
	}
}
client localhost_ipv6 {
	ipv6addr	= ::1
	secret		= testing123
}

4.2，修改测试用户文件/etc/raddb/users，添加测试账号bob，密钥：hello

[root@localhost raddb]#  cat /etc/raddb/users | grep -v '#' | grep -v ^$
bob	Cleartext-Password := "hello"
Reply-Message := "Hello, %{User-Name}"
DEFAULT	Framed-Protocol == PPP
Framed-Protocol = PPP,
Framed-Compression = Van-Jacobson-TCP-IP
DEFAULT	Hint == "CSLIP"
Framed-Protocol = SLIP,
Framed-Compression = Van-Jacobson-TCP-IP
DEFAULT	Hint == "SLIP"
Framed-Protocol = SLIP

4.3，测试是否正常


[root@localhost raddb]# radtest bob hello localhost 0 testing123
Sent Access-Request Id 151 from 0.0.0.0:52757 to 127.0.0.1:1812 length 73
	User-Name = "bob"
	User-Password = "hello"
	NAS-IP-Address = 127.0.0.1
	NAS-Port = 0
	Message-Authenticator = 0x00
	Cleartext-Password = "hello"
  Received Access-Accept Id 151 from 127.0.0.1:1812 to 0.0.0.0:0 length 32
	Reply-Message = "Hello, bob"

（五）Freeradius添加其他网段的测试 1，服务器端配置：修改vim /etc/raddb/clients.conf 文件，增加一个client并配置共享密钥 secret = tdops,shortname可以任意。clientIP可以是一个地址也可以是一个网段。，添加如下格式的认证

[root@localhost raddb]# vim /etc/raddb/clients.conf 
client 172.20.66.0/24 {
        secret = testing123
        showtanme = CE-SW
        }

2，在规定网段的主机做测试。

[root@localhost ~]#  radtest lqb xxx 172.20.66.127:1833 0 testing123
Sent Access-Request Id 186 from 0.0.0.0:39032 to 172.20.66.127:1833 length 80
	User-Name = "lqb"
	User-Password = "xxx"
	NAS-IP-Address = 127.0.0.1
	NAS-Port = 0
	Message-Authenticator = 0x00
	Cleartext-Password = "xxx"
Received Access-Accept Id 186 from 172.20.66.127:1833 to 0.0.0.0:0 length 20

3,服务端的日志为：

Wed Jul 18 16:18:31 2018 : Info: Need 5 more connections to reach 10 spares
Wed Jul 18 16:18:31 2018 : Info: rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used
Wed Jul 18 16:18:31 2018 : Auth: (0) Login OK: [lqb (from client 172.20.66.0/24 port 0)

至此通过Windows的AD域认证完成。

活动

智算服务

应用商城

合作伙伴

开发者

支持与服务

了解天翼云

CentOS7.4+FreeRadius+ldap（Windows AD）认证 搭建radius服务

CentOS7.4+FreeRadius+ldap（Windows AD）认证 搭建radius服务

相关文章

【Linux 从基础到进阶】使用 Crontab 进行任务调度

【Linux 从基础到进阶】 QEMU 虚拟化配置与优化

【Linux 从基础到进阶】Apache服务器搭建与优化

【Linux 从基础到进阶】PostgreSQL数据库安装与调优

【Linux】CentOS、CentOS Stream、RedHat 和Fedora 之间的关系

CentOS 入门必备基础知识

CentOS本地源

CentOS 系统版本查看方法

golang ldap 学习

CentOS7.6 安装ifconfig

作者介绍

最新文章

【Linux 从基础到进阶】使用 Crontab 进行任务调度

【Linux】CentOS、CentOS Stream、RedHat 和Fedora 之间的关系

CentOS 入门必备基础知识

CentOS本地源

golang ldap 学习

CentOS7.6 安装ifconfig

热门文章

golang ldap 学习

CentOS本地源

CentOS7安装samba,实现Windows与Linux之间文件共享

CentOS设置防火墙开放端口

Linux-CentOS-指令修改网络自动获取IP

CentOS7 之iptables防火墙相关命令详解

热门标签

相关产品

弹性云主机

天翼云电脑（公众版）

对象存储

云硬盘

随机文章

CentOS 把用户添加到sudoer

CentOS7.6 安装ifconfig

CentOS 入门必备基础知识

CentOS.ks删除SELinux导致的问题

CentOS7 之iptables防火墙相关命令详解

CentOS7安装vncserver（启动失败及连接黑屏解决办法）

CentOS7.4+FreeRadius+ldap（Windows AD）认证搭建radius服务

CentOS7.4+FreeRadius+ldap（Windows AD）认证搭建radius服务