[Freeradius2.x] installation and learning

[Freeradius2.x] installation and learning

In the virtual machine, centos installation and learning radius2 is 2.2.x usage and other knowledge.

Install

For testing, yum Installation

yum -y install freeradius*

The location of the configuration file is/etc/raddb/compilation and installation may be in/usr/local/etc/raddb

#/Etc/init. d/radiusd usage:/etc/init. d/radiusd {start | stop | status | restart | condrestart | try-restart | reload | force-reload}

Yum will automatically generate a service script, and then you can use radius as a service directly.

Configuration File

[root@orangleliu raddb]# tree -L 1.├── acct_users├── attrs├── attrs.access_challenge├── attrs.access_reject├── attrs.accounting_response├── attrs.pre-proxy├── certs├── clients.conf├── dictionary├── eap.conf├── example.pl├── hints├── huntgroups├── ldap.attrmap├── modules├── panic.gdb├── policy.conf├── policy.txt├── preproxy_users├── proxy.conf├── radiusd.conf├── sites-available├── sites-enabled├── sql├── sql.conf├── sqlippool.conf├── templates.conf└── users5 directories, 23 files

The configuration file structure is like this. Most of the functions are completed through the configuration file. It is very important to be familiar with the configuration file. There are a lot of instructions in each configuration file, read it carefully and you will know how to do it.

Radtest is a tool for testing. It is very useful for checking and testing.

Radiusd. conf main configuration file

Clients. conf is used to configure the NAS device (for example, BRAS) in the client. It comes with a local test client.

Users configures user information and sets authentication rules for some users. Only the pap mode can be used. You can set password encryption.

Which database is used for configuring SQL. conf and SQL rules?

Site-available site-enabled is the directory for storing virtual servers, similar to the Configuration Policy of Apache.

Concept

NAS device: network access device, which is generally a Radius Client

Use UDP port 1812 for authentication and authentication

Use UDP port 1813 for billing

Command

Radiusd freeradius main program. Generally, the debugging mode starts with radiusd-Xx.

Radlast is used to query User Logon Through NAS

Radtest is used to simulate sending requests from NAS devices.

Radwho may be unable to view online users due to configuration compilation or other reasons.

Radrap closes all sessions of a NAS

Function Authentication

Three common authentication protocols, all of which require user names and passwords, are text protocols, so they are easy to observe and test.

PAP

By default, the redtest command uses this protocol, which is the most widely used protocol.

NAS will use the user name and the encrypted password to interact with the Radius server

Password plaintext Storage

Test. Configure user information in the user File

radtest alice passme 127.0.0.1 100 testing123Sending Access-Request of id 41 to 127.0.0.1 port 1812 User-Name = "alice" User-Password = "passme" NAS-IP-Address = 127.0.0.1 NAS-Port = 100 Message-Authenticator = 0x00000000000000000000000000000000rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=41, length=40 Framed-IP-Address = 192.168.59.103 Reply-Message = "Hello, alice"

CHAP

Updated version of PAP

Increase HandShaking

Password plaintext storage password interaction uses ciphertext

MS-CHAP

Microsoft CHAP protocol

EAP extended Protocol

User Storage

Neither of the first two methods is recommended.

Use the configuration file users to store the user and password.

Unix users actually use/etc/shadow to store user information (but pay attention to permission issues, you need to enable unix configuration in site-enable authorize)

The database method is Mysql.

Install mysql plug-in yum install freeradius2-mysql

Create a database and import the initialization input (based on the document)

Edit the comment of line # $ INCLUDE SQL. conf in radius. conf

Edit msql authentication information in SQL. conf

Edit the authorize section in sites-enabled/default to remove the SQL option comment.

Billing process

Billing and authentication are relatively independent, and NAS is required to control the entire process.

It can be used to count the user's Internet access time and traffic data.

Billing starts to send the Accounting-Request, start a session, and assign a session-id

In the billing request, the Status field Acct-Status-Type is Start, Interim-Update, and Stop to operate the session lifecycle.

Problem Configure multiple databases

See freeradius-checking-account-on-multiple

First, edit the database configuration file SQL. conf and add an SQL configuration block. The SQL dbname {} dbname is similar to the alias. Just write the configuration item according to the original configuration.

Then, comment out the original site-enable/default configuration item SQL and add dbname. Then, the database configured in dbname will be used.

Learning Materials

Official documentation

network radius

FreeRadius Beginner’s Guide