FreeRadius配置与验证测试_v3.0

Freeradius配置与验证测试［摘要］本文主要介绍FreeRadius安装和基本测试。

增加介绍配置FreeRadius支持IPv6地址方式认证的内容。

在CentOS5.5系统安装和配置FreeRadius服务器，进行简单的认证测试。

在安装FreeRadius服务器前，预先需要在服务器上安装Gcc编译器和openssl。

1环境检查1、查看openssl版本# openssl version -aOpenSSL 0.9.8e-fips-rhel5 01 Jul 20082、查看gcc版本#gcc –vgcc 版本4.1.2 20080704 (Red Hat 4.1.2-52)3、系统进行一次升级#yum –y update2FreeRadius安装到官网下载FreeRadius安装包/在此下载的是Version 2.2.0. tar.gz(PGP Signature)版本freeradius-server-2.2.0.tar.gz1、上传到CentOS服务器，注意要使用二进制方式，建议放到根目录下。

2、修改文件属性#chmod 777 freeradius-server-2.2.0.tar.gz3、解压文件#tar xvf freeradius-server-2.2.0.tar.gz4、进入解压目录# cd freeradius-server-2.2.05、编译服务器#./configurechecking for gcc... gccchecking for C compiler default output file name... a.out checking whether the C compiler works... yeschecking whether we are cross compiling... nochecking for suffix of executables...checking for suffix of object files... ochecking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yeschecking for gcc option to accept ISO C89... none needed checking for g++... g++checking whether we are using the GNU C++ compiler... yes checking whether g++ accepts -g... yeschecking how to run the C preprocessor... gcc -Echecking for grep that handles long lines and -e... /usr/bin/grep checking for egrep... /usr/bin/grep -Echecking for AIX... nochecking whether gcc needs -traditional... nochecking whether we are using SUNPro C... nochecking for ranlib... ranlibchecking for special C compiler options needed for large files... no checking for _FILE_OFFSET_BITS value needed for large files... no checking for ANSI C header files... yeschecking for sys/types.h... yeschecking for sys/stat.h... yeschecking for stdlib.h... yeschecking for string.h... yeschecking for memory.h... yeschecking for strings.h... yeschecking for inttypes.h... yeschecking for stdint.h... yeschecking for unistd.h... yeschecking whether byte ordering is bigendian... nochecking for gmake... nochecking for make... /usr/bin/makeconfigure: error: GNU Make is not installed. Please download and install it from ftp:///pub/gnu/make/ before continuing.#make && make install此过程需要编译和安装，可能需要几分钟。

请耐心等待。

6、查看服务器安装位置#cd /usr/local/etc/raddb查看该目录，如果存在证明服务器安装完成。

7、启动FreeRadius服务器。

Debug模式运行。

#radiusd –X终端会提示：... adding new socket proxy address * port 59867Listening on authentication address * port 1812Listening on accounting address * port 1813Listening on command file /usr/local/var/run/radiusd/radiusd.sockListening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814Ready to process requests.证明服务器已经启动。

注意：在2.0以前版本为-AXf X为Debug模式无参数正常模式-X debug模式-f 不运行在deamon状态下服务启动后，该终端会显示下列内容：Listening on authentication address * port 1812Listening on accounting address * port 1813Listening on command file /usr/local/var/run/radiusd/radiusd.sockListening on authentication address 127.0.0.1 port 18120 as server inner-tunnelListening on proxy address * port 1814Ready to process requests.表示服务端处于监听状态，等待客户端发送信息。

如果要停止FreeRadius服务，直接Ctrl+C中断。

8、测试FreeRadius服务器，重新打开一个终端#radtest steve testing 127.0.0.1 1812 testing123服务端返回信息如下说明测试成功，Sending Access-Request of id 81 to 127.0.0.1 port 1812User-Name = "steve"User-Password = "testing"NAS-IP-Address = 192.168.0.7NAS-Port = 1812Message-Authenticator = 0x00000000000000000000000000000000rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=81, length=20 此步非常重要，此步骤可以证明FreeRadius服务器安装正常。

Steve这个用户验证成功。

注意：可能细心的读者发现，用户名随便输入，都能验证通过，这个是因为用户配置文件没有进行配置。

增加用户是修改users文件，进阶操作中有说明。

3基本配置操作1、添加用户编辑文件users#vi users在文件末尾添加用户，格式如下：steve Cleartext-Password := "testing"……admin Cleartext-Password := "testing"charles Cleartext-Password := "testing"2、添加代理主机编辑文件clients.conf#vi clinets.conf在文件末尾添加客户端，格式如下：clinet ice7 {secret = testing123ipaddr = 192.168.0.7}到此FreeRadius配置已经全部完成。

4采用IPv6地址进行认证FreeRadius配置IPv6地址支持认证，测试观察发现IPv4和IPv6不能同时启动，所以要保证服务器认证，只能将地址模式二者选其一。

假设基本的IPv4地址方式，已经认证成功。

添加测试用户为testuser密码为testpw。

设定FreeRadius服务器的IPv6地址为2013::3配置支持IPv6地址方式认证，需要在配置的时候，禁用IPv4地址配置，启用IPv6地址配置1，编辑/usr/local/etc/raddb/radius.conf文件，将listen中的IPv4禁用，启用IPv6……listen {# Type of packets to listen for.# Allowed values are:# auth listen for authentication packets# acct listen for accounting packets# proxy IP to use for sending proxied packets# detail Read from the detail file. For examples, see# raddb/sites-available/copy-acct-to-home-server# status listen for Status-Server packets. For examples,# see raddb/sites-available/status# coa listen for CoA-Request and Disconnect-Request# packets. For examples, see the file# raddb/sites-available/coa-server#type = auth# Note: "type = proxy" lets you control the source IP used for# proxying packets, with some limitations:## * A proxy listener CANNOT be used in a virtual server section.# * You should probably set "port = 0".# * Any "clients" configuration will be ignored.## See also proxy.conf, and the "src_ipaddr" configuration entry# in the sample "home_server" section. When you specify the# source IP address for packets sent to a home server, the# proxy listeners are automatically created.# IP address on which to listen.# Allowed values are:# dotted quad (1.2.3.4)# hostname ()# wildcard (*)# ipaddr = * #此处注释掉# OR, you can use an IPv6 address, but not both# at the same time.ipv6addr = :: # any. ::1 == localhost #此处开启# Port on which to listen.# Allowed values are:# integer port number (1812)# 0 means "use /etc/services for the proper port"port = 0# Some systems support binding to an interface, in addition# to the IP address. This feature isn't strictly necessary,# but for sites with many IP addresses on one interface,# it's useful to say "listen on all addresses for eth0".## If your system does not support this feature, you will# get an error if you try to use it.## interface = eth0# Per-socket lists of clients. This is a very useful feature.## The name here is a reference to a section elsewhere in# radiusd.conf, or clients.conf. Having the name as# a reference allows multiple sockets to use the same# set of clients.## If this configuration is used, then the global list of clients # is IGNORED for this "listen" section. Take care configuring # this feature, to ensure you don't accidentally disable a# client you need.## See clients.conf for the configuration of "per_socket_clients".## clients = per_socket_clients}# This second "listen" section is for listening on the accounting# port, too.#listen {# ipaddr = * #此处注释掉ipv6addr = :: #此处开启port = 0type = acct# interface = eth0# clients = per_socket_clients}2，编辑/usr/local/etc/raddb/client.conf文件，将localhost里边的IPv4配置禁用，启用IPv6配置。