在 FreeBSD 上安装 FreeRADIUS

本文目标

在 FreeBSD 上安装 FreeRADIUS 并使用 PostgreSQL 作为后端存储,并做一些常用的修改以便给 strongSwan 使用。

本文测试环境

  • FreeBSD 11.0-RELEASE-p8
  • FreeRADIUS 2.2.9

安装

$ cd /usr/ports/net/freeradius2 && make config

将 PGSQL(PostgreSQL database support)打勾。

$ make install clean

修改配置文件

/usr/local/etc/raddb/clients.conf

在最后添加,以便允许 strongSwan 访问该 FreeRADIUS:

# strongswan
client vpn.example.net {
        ipaddr = 1.2.3.4
        secret = mySecret
}

/usr/local/etc/raddb/dictionary

在最后添加:

ATTRIBUTE       Max-Monthly-Traffic     3003    integer
ATTRIBUTE       Monthly-Traffic-Limit   3004    integer

/usr/local/etc/raddb/eap.conf

修改 eap 节点下来的 default_eap_type,从 md5 修改为 mschapv2:

default_eap_type = mschapv2

/usr/local/etc/raddb/radiusd.conf

把 $INCLUDE sql.conf 前的注释去掉:

        #  Include another file that has the SQL-related configuration.
        #  This is another file only because it tends to be big.
        #
        $INCLUDE sql.conf

把 $INCLUDE sql/postgresql/counter.conf 前的注释去掉:

        #
        #  This module is an SQL enabled version of the counter module.
        #
        #  Rather than maintaining seperate (GDBM) databases of
        #  accounting info for each counter, this module uses the data
        #  stored in the raddacct table by the sql modules. This
        #  module NEVER does any database INSERTs or UPDATEs.  It is
        #  totally dependent on the SQL module to process Accounting
        #  packets.
        #
        $INCLUDE sql/postgresql/counter.conf

/usr/local/etc/raddb/sites-available/default

启用基于 SQL 数据库的授权和审计,即将节点 authorize、accounting、session、post-auth 中的 sql 前的注释去掉,并注释掉 session 节点中的 radutmp:

authorize {
...
        #
        #  Look in an SQL database.  The schema of the database
        #  is meant to mirror the "users" file.
        #
        #  See "Authorization Queries" in sql.conf
        sql
...
}
...
accounting {
...
        #
        #  Log traffic to an SQL database.
        #
        #  See "Accounting queries" in sql.conf
        sql
...
}
...
#  Session database, used for checking Simultaneous-Use. Either the radutmp
#  or rlm_sql module can handle this.
#  The rlm_sql module is *much* faster
session {
#       radutmp

        #
        #  See "Simultaneous Use Checking Queries" in sql.conf
        sql
}
...
post-auth {
...
        #
        #  After authenticating the user, do another SQL query.
        #
        #  See "Authentication Logging Queries" in sql.conf
        sql
...
        Post-Auth-Type REJECT {
                # log failed authentications in SQL, too.
                sql

...
        }
...
}

在节点 authorize 中最后增加:

authorize {
...
        monthlytrafficcounter
}

/usr/local/etc/raddb/sql/postgresql/counter.conf

在最后添加:

sqlcounter monthlytrafficcounter {
        counter-name = Monthly-Traffic
        check-name = Max-Monthly-Traffic
        reply-name = Monthly-Traffic-Limit
        sqlmod-inst = sql
        key = User-Name
        reset = monthly
        # 1048576 bytes = 1MiB
        query = "SELECT SUM(acctinputoctets + acctoutputoctets)/1048576 \
                FROM radacct \
                WHERE UserName='%{%k}' AND \
                AcctStartTime::ABSTIME::INT4 + AcctSessionTime > '%b'"
}

/usr/local/etc/raddb/sql/postgresql/dialup.conf

讲这两行前的注释去掉,以便启用并发会话个数检查:

# Uncomment simul_count_query to enable simultaneous use checking
simul_count_query = "SELECT COUNT(*) FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctStopTime IS NULL"
simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctSt
opTime IS NULL"

/usr/local/etc/raddb/sql.conf

将数据库从 mysql 修改为 postgresql,并配置数据库服务器登录信息:

sql {
        #
        #  Set the database to one of:
        #
        #       mysql, mssql, oracle, postgresql
        #
        database = "postgresql"
...
        # Connection info:
        server = "pgsql.example.net"
...
        login = "radius"
        password = "yourPassword"

        # Database table configuration for everything except Oracle
        radius_db = "radius"
...
        # Set to 'yes' to read radius clients from the database ('nas' table)
        # Clients will ONLY be read on server startup.  For performance
        # and security reasons, finding clients via SQL queries CANNOT
        # be done "live" while the server is running.
        # 
        readclients = yes
...
}

数据库的初始化

上面用到了 PostgreSQL 数据库服务器 pgsql.example.net 上的 radius 数据库,我们需要相应地初始化该数据库。
关于 PostgreSQL 数据库服务器的安装可以参考:在 FreeBSD 上安装 PostgreSQL

下面的命令示意了数据库用户 radius 和数据库 radius 的创建,以及表结构的初始化。
表结构相关的 SQL 语句可以在 FreeRADIUS 的配置文件目录中找到,位于 /usr/local/etc/raddb/sql/postgresql/schema.sql。

$ su - postgres
$ createuser -D -l -P -R -S radius
$ createdb -O radius radius
$ exit
$ psql -U radius -d radius < /usr/local/etc/raddb/sql/postgresql/schema.sql

设置为开机时自动启动

$ /usr/local/etc/rc.d/radiusd rcvar | sed s/NO/YES/ >> /etc/rc.conf

如果需要手动启动、重启或者查看运行状态可以分别使用如下命令:

$ /usr/local/etc/rc.d/radiusd start
$ /usr/local/etc/rc.d/radiusd restart
$ /usr/local/etc/rc.d/radiusd status

诊断

日志文件位于: /var/log/radius.log

Advertisements

#freebsd, #freeradius, #postgresql