CentOS7.4+FreeRadius+ldap（Windows AD）认证 搭建radius服务

CentOS 前端之家
前端之家收集整理的这篇文章主要介绍了CentOS7.4+FreeRadius+ldap（Windows AD）认证 搭建radius服务，前端之家小编觉得挺不错的，现在分享给大家，也给大家做个参考。

（一）简介
freeradius一般用来进行账户认证管理，记账管理，常见的电信运营商的宽带账户，上网账户管理，记账，都是使用的radius服务器进行鉴权记账的。Freeradius包含一个radius服务器和radius-client，可以对支持radius协议的网络设备进行鉴权记账。 ------百度百科

（二）安装配置服务

[root@localhost ~]# yum install freeradius freeradius-ldap freeradius-utils -y
[root@localhost ~]# systemctl enable radiusd.service
[root@localhost ~]# systemctl start radiusd.service

（三）修改相关配置文件

3.1，修改/etc/raddb/mods-available/ldap文件，主要是ldap部分，其他的都是默认

[root@localhost raddb]#  cat /etc/raddb/mods-available/ldap | grep -v '#' | grep -v ^$
ldap {
server = 'x.x.x.x'   #服务器
port = 389   #端口
identity = 'CN=opsldap,CN=Users,DC=txxxdxx,DC=me'  #连接LDAP帐号
password =xxxxxxxx   #连接LDAP密码
base_dn = 'DC=txxxdxx,DC=me'   #dn
sasl {
}
update {
control:Password-With-Header    += 'userPassword'
control:                        += 'radiusControlAttribute'
request:                        += 'radiusRequestAttribute'
reply:                          += 'radiusReplyAttribute'
}
edir = no   #修改
user {
base_dn = "${..base_dn}"
filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})"     #修改成sAM
以下用默认
sasl {
}
}
group {
base_dn = "${..base_dn}"
filter = '(objectClass=posixGroup)'
membership_attribute = 'memberOf'
}
profile {
}
client {
base_dn = "${..base_dn}"
filter = '(objectClass=radiusClient)'
template {
}
attribute {
ipaddr                          = 'radiusClientIdentifier'
secret                          = 'radiusClientSecret'
}
}
accounting {
reference = "%{tolower:type.%{Acct-Status-Type}}"
type {
start {
update {
description := "Online at %S"
}
}
interim-update {
update {
description := "Last seen at %S"
}
}
stop {
update {
description := "Offline at %S"
}
}
}
}
post-auth {
update {
description := "Authenticated at %S"
}
}
options {
chase_referrals = yes
rebind = yes
res_timeout = 10
srv_timelimit = 3
net_timeout = 1
idle = 60
probes = 3
interval = 3
ldap_debug = 0x0028
}
tls {
}
pool {
start = ${thread[pool].start_servers}
min = ${thread[pool].min_spare_servers}
max = ${thread[pool].max_servers}
spare = ${thread[pool].max_spare_servers}
uses = 0
retry_delay = 30
lifetime = 0
idle_timeout = 60
}

3.2，创建软连接在mods-enable/模块下

[root@localhost raddb]# ln -s /etc/raddb/mods-available/ldap /etc/raddb/mods-enabled/
[root@localhost raddb]# ll /etc/raddb/mods-enabled/ldap 
lrwxrwxrwx 1 root root 30 Jul 17 18:19 /etc/raddb/mods-enabled/ldap -> /etc/raddb/mods-available/ldap

3.3，在site-avaiable/下创建site_ldap文件

[root@localhost raddb]# cat /etc/raddb/sites-available/site_ldap 

ldap {
        server = 'x.x.8.55'   #服务器
        port = 389   #端口
        identity = 'CN=opsldap,DC=me'  #连接LDAP帐号
        password =xxxxxxxx   #连接LDAP密码
        base_dn = 'DC=txxxdxx,DC=me'   #dn
        sasl {
        }
        update {
                control:Password-With-Header    += 'userPassword'
                control:                        += 'radiusControlAttribute'
                request:                        += 'radiusRequestAttribute'
                reply:                          += 'radiusReplyAttribute'
        }
        edir = no   #修改
        user {
                base_dn = "${..base_dn}"
                filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})"     #修改成sAM
#以下用默认
                sasl {
                }
        }
        group {
                base_dn = "${..base_dn}"
                filter = '(objectClass=posixGroup)'
                membership_attribute = 'memberOf'
        }
        profile {
        }
        client {
                base_dn = "${..base_dn}"
                filter = '(objectClass=radiusClient)'
                template {
                }
                attribute {
                        ipaddr                          = 'radiusClientIdentifier'
                        secret                          = 'radiusClientSecret'
                }
        }
        accounting {
                reference = "%{tolower:type.%{Acct-Status-Type}}"
                type {
                        start {
                                update {
                                        description := "Online at %S"
                                }
                        }
                        interim-update {
                                update {
                                        description := "Last seen at %S"
                                }
                        }
                        stop {
                                update {
                                        description := "Offline at %S"
                                }
                        }
                }
        }
        post-auth {
                update {
                        description := "Authenticated at %S"
                }
        }
        options {
                chase_referrals = yes
                rebind = yes
                res_timeout = 10
                srv_timelimit = 3
                net_timeout = 1
                idle = 60
                probes = 3
                interval = 3
                ldap_debug = 0x0028
        }
        tls {
        }
        pool {
                start = ${thread[pool].start_servers}
                min = ${thread[pool].min_spare_servers}
                max = ${thread[pool].max_servers}
                spare = ${thread[pool].max_spare_servers}
                uses = 0
                retry_delay = 30
                lifetime = 0
                idle_timeout = 60
        }
}

3.4，在site-enabled下创建软连接

[root@localhost raddb]# ln -s /etc/raddb/sites-available/site_ldap /etc/raddb/sites-enabled/
[root@localhost raddb]# ll /etc/raddb/sites-enabled/site_ldap 
lrwxrwxrwx 1 root root 36 Jul 17 18:21 /etc/raddb/sites-enabled/site_ldap -> /etc/raddb/sites-available/site_ldap

（四），队radius进行相关的测试，可以通过重启服务器或者radiusd -X 进行测试设置

[root@localhost mods-available]# systemctl restart radiusd
或者
[root@localhost mods-available]# radiusd  -X

4.1,修改 /etc/raddb/clients.conf 文件，客户端认证的网段和密钥。（修改服务器端记录客户端的配置文件 /etc/raddb/clients.conf 文件，该文件默认值提供了本机测试的 local 配置，即：安装完后默认只允许本机的client客户端访问radius服务器）

[root@localhost raddb]#  cat /etc/raddb/clients.conf | grep -v '#' | grep -v ^$
client localhost {        ###认证的网段
    ipaddr = 127.0.0.1   ###被认证可以访问的ip地址
    proto = *
    secret = testing123      ###密钥
    require_message_authenticator = no
    limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
    }
}
client localhost_ipv6 {
    ipv6addr    = ::1
    secret      = testing123
}

4.2，修改测试用户文件/etc/raddb/users，添加测试账号bob，密钥：hello

[root@localhost raddb]#  cat /etc/raddb/users | grep -v '#' | grep -v ^$
bob Cleartext-Password := "hello"
Reply-Message := "Hello,%{User-Name}"
DEFAULT Framed-Protocol == PPP
Framed-Protocol = PPP,Framed-Compression = Van-Jacobson-TCP-IP
DEFAULT Hint == "CSLIP"
Framed-Protocol = SLIP,Framed-Compression = Van-Jacobson-TCP-IP
DEFAULT Hint == "SLIP"
Framed-Protocol = SLIP

4.3，测试是否正常

[root@localhost raddb]# radtest bob hello localhost 0 testing123
Sent Access-Request Id 151 from 0.0.0.0:52757 to 127.0.0.1:1812 length 73
    User-Name = "bob"
    User-Password = "hello"
    NAS-IP-Address = 127.0.0.1
    NAS-Port = 0
    Message-Authenticator = 0x00
    Cleartext-Password = "hello"
  Received Access-Accept Id 151 from 127.0.0.1:1812 to 0.0.0.0:0 length 32
    Reply-Message = "Hello,bob"

（五）Freeradius添加其他网段的测试
1，服务器端配置：修改vim /etc/raddb/clients.conf 文件，增加一个client并配置共享密钥 secret = tdops,shortname可以任意。clientIP可以是一个地址也可以是一个网段。
，添加如下格式的认证

[root@localhost raddb]# vim /etc/raddb/clients.conf 
client 172.20.66.0/24 {
        secret = testing123
        showtanme = CE-SW
        }

2，在规定网段的主机做测试。

[root@localhost ~]#  radtest lqb xxx 172.20.66.127:1833 0 testing123
Sent Access-Request Id 186 from 0.0.0.0:39032 to 172.20.66.127:1833 length 80
    User-Name = "lqb"
    User-Password = "xxx"
    NAS-IP-Address = 127.0.0.1
    NAS-Port = 0
    Message-Authenticator = 0x00
    Cleartext-Password = "xxx"
Received Access-Accept Id 186 from 172.20.66.127:1833 to 0.0.0.0:0 length 20

3,服务端的日志为：

Wed Jul 18 16:18:31 2018 : Info: Need 5 more connections to reach 10 spares
Wed Jul 18 16:18:31 2018 : Info: rlm_ldap (ldap): opening additional connection (5),1 of 27 pending slots used
Wed Jul 18 16:18:31 2018 : Auth: (0) Login OK: [lqb (from client 172.20.66.0/24 port 0)

至此通过Windows的AD域认证完成。

猜你在找的CentOS相关文章

Centos7离线安装gcc4.8
有时候CentOS工作在无互联网的环境下，需要在离线环境下安装一些组件，这次实现的是模拟在...
CentOS7离线安装devtoolset-9并编译redis6.0.5
首先参照https://www.cnblogs.com/wdw984/p/13330074.html，来进行如何安装Centos和离线下...
使用Nginx在80端口上代理多个.NET CORE网站
有两个.NET CORE3.1网站部署在CentOS7上（内网IP是192.168.2.32），现在想实现访问http://...
CentOS7中配置vsftpd
1、yum -y install vsftpd 安装vsftpd 2、配置vsftpd的配置文件（/etc/vsftpd/vsftpd.conf...
CentOS7离线安装Mysql8.0
首先去mysql官网下载mysql的离线rpm安装包（https://downloads.mysql.com/archives/commun...
CentOS中增加网络连接数的方法
CentOS默认对外访问，发起的TCP链接总数小于28232个。 可以通过以下命令的结果计算出来 $ ...
VMware安装Centos7虚拟机
首先安装虚拟机很简单，所以呢，具体的安装过程就引用别人的博客，这篇文字很详细，引用之...
[Linux] 解决CentOS下Requires: libjson-c.so错误
当安装某些rpm包的时候 , 会爆出这个错误 Requires: libjson-c.so json-c是c语言下的json库...
阿里云centos7安装mysql8数据库
linux系统安装mysql8
centos安装mysql
一、安装 二、修改密码 三、修改远程连接权限(为了使用navicat)
LinuxWindowsCentOSUbuntuNginxWebServiceScalaMemcacheApacheRedisDockerBashAzureTomcatLNMPShell数据结构服务器运维网络安全
xebugnodemondocker-copydcoselasticsearcwindows-contdocker-windodocker-awsamazon-cloudenvoyproxyhashicorp-vaswisscomdevkafka-pythonzscalerphoton-osdocker-swarmkamongoogle-cloudconcoursewso2-ampersistent-vapi-managerprocess-manamanjarojenkins-workhypriotremoteapikeystonejsbitcoindbitcoin-test