ubuntu 18.04 radius 服务安装配置

环境信息：

$ cat /etc/os-release 
NAME="Ubuntu"
VERSION="18.04.6 LTS (Bionic Beaver)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 18.04.6 LTS"
VERSION_ID="18.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=bionic
UBUNTU_CODENAME=bionic

安装软件

sudo apt-get install freeradius freeradius-utils freeradius-ldap freeradius-mysql

服务端配置

用户配置：

# vim /etc/freeradius/3.0/users

#steve    Cleartext-Password := "testing"
#        Service-Type = Framed-User,
#        Framed-Protocol = PPP,
#        Framed-IP-Address = 172.16.3.33,
#        Framed-IP-Netmask = 255.255.255.0,
#        Framed-Routing = Broadcast-Listen,
#        Framed-Filter-Id = "std.ppp",
#        Framed-MTU = 1500,
#        Framed-Compression = Van-Jacobsen-TCP-IP
改为：
# test为新用户名，123456为新密码        
test    Cleartext-Password := "123456"
        Service-Type = Framed-User,
        Framed-Protocol = PPP,
        Framed-IP-Address = 172.16.3.33,
        Framed-IP-Netmask = 255.255.255.0,
        Framed-Routing = Broadcast-Listen,
        Framed-Filter-Id = "std.ppp",
        Framed-MTU = 1500,
        Framed-Compression = Van-Jacobsen-TCP-IP

key配置：

# vim /etc/freeradius/3.0/clients.conf

client localhost {
        #       hostname    (radius.example.com)
        ipaddr = 127.0.0.1
		...
        #  OR, you can use an IPv6 address, but not both
		#       ipv6addr = ::   # any.  ::1 == localhost

        secret          = testing123

重启服务使配置生效：

sudo /etc/init.d/freeradius restart
sudo service freeradius restart

基本功能测试：

1 服务端运行：

sudo service freeradius stop
sudo freeradius -X            #前台运行, 开启调试模式
sudo freeradius                #后台运行模式

2 客户端测试：

radtest Username Password ServerIP Port Secret
radtest 用户名 密码 地址 端口 key

客户端测试1:

$ radtest test 123456 localhost 1812 testing123
Sent Access-Request Id 42 from 0.0.0.0:54282 to 127.0.0.1:1812 length 74
	User-Name = "test"
	User-Password = "123456"
	NAS-IP-Address = 192.168.1.120
	NAS-Port = 1812
	Message-Authenticator = 0x00
	Cleartext-Password = "123456"
Received Access-Accept Id 42 from 127.0.0.1:1812 to 0.0.0.0:0 length 71
	Service-Type = Framed-User
	Framed-Protocol = PPP
	Framed-IP-Address = 172.16.3.33
	Framed-IP-Netmask = 255.255.255.0
	Framed-Routing = Broadcast-Listen
	Filter-Id = "std.ppp"
	Framed-MTU = 1500
	Framed-Compression = Van-Jacobson-TCP-IP

添加新测试用户：

新增用户（test2: 1111111）

# vim /etc/freeradius/3.0/users

test    Cleartext-Password := "123456"
test2   Cleartext-Password := "111111"   #新增
        Service-Type = Framed-User,
        Framed-Protocol = PPP,
        Framed-IP-Address = 172.16.3.33,
        Framed-IP-Netmask = 255.255.255.0,
        Framed-Routing = Broadcast-Listen,
        Framed-Filter-Id = "std.ppp",
        Framed-MTU = 1500,
        Framed-Compression = Van-Jacobsen-TCP-IP

注：注意tab对齐。

服务端重新运行：

sudo freeradius -X

客户端测试：

$ radtest test 123456 localhost 1812 testing123
Sent Access-Request Id 171 from 0.0.0.0:56737 to 127.0.0.1:1812 length 74
	User-Name = "test"
	User-Password = "123456"
	NAS-IP-Address = 192.168.1.120
	NAS-Port = 1812
	Message-Authenticator = 0x00
	Cleartext-Password = "123456"
Received Access-Accept Id 171 from 127.0.0.1:1812 to 0.0.0.0:0 length 20
$ radtest test2 111111 localhost 1812 testing123
Sent Access-Request Id 99 from 0.0.0.0:50440 to 127.0.0.1:1812 length 75
	User-Name = "test2"
	User-Password = "111111"
	NAS-IP-Address = 192.168.1.120
	NAS-Port = 1812
	Message-Authenticator = 0x00
	Cleartext-Password = "111111"
Received Access-Accept Id 99 from 127.0.0.1:1812 to 0.0.0.0:0 length 71
	Service-Type = Framed-User
	Framed-Protocol = PPP
	Framed-IP-Address = 172.16.3.33
	Framed-IP-Netmask = 255.255.255.0
	Framed-Routing = Broadcast-Listen
	Filter-Id = "std.ppp"
	Framed-MTU = 1500
	Framed-Compression = Van-Jacobson-TCP-IP

配置客户端访问控制

服务端配置：

新增配置

# vim /etc/freeradius/3.0/clients.conf
#新增配置
client 192.168.1.0/24 {
        secret = testing456
        shortname = access-network-1
}

服务端重新运行

sudo freeradius -X

客户端测试：

$ radtest test 123456 192.168.1.120 1812 testing456
Sent Access-Request Id 89 from 0.0.0.0:55729 to 192.168.1.120:1812 length 74
	User-Name = "test"
	User-Password = "123456"
	NAS-IP-Address = 192.168.1.120
	NAS-Port = 1812
	Message-Authenticator = 0x00
	Cleartext-Password = "123456"
Received Access-Accept Id 89 from 192.168.1.120:1812 to 0.0.0.0:0 length 20
ubuntu@ubuntu-dev-machine:~$ radtest test2 111111 192.168.1.120 1812 testing456
Sent Access-Request Id 2 from 0.0.0.0:50689 to 192.168.1.120:1812 length 75
	User-Name = "test2"
	User-Password = "111111"
	NAS-IP-Address = 192.168.1.120
	NAS-Port = 1812
	Message-Authenticator = 0x00
	Cleartext-Password = "111111"
Received Access-Accept Id 2 from 192.168.1.120:1812 to 0.0.0.0:0 length 71
	Service-Type = Framed-User
	Framed-Protocol = PPP
	Framed-IP-Address = 172.16.3.33
	Framed-IP-Netmask = 255.255.255.0
	Framed-Routing = Broadcast-Listen
	Filter-Id = "std.ppp"
	Framed-MTU = 1500
	Framed-Compression = Van-Jacobson-TCP-IP

缺点：每次新增用户都需要重启服务端服务，且用户新增用户方式不友好，需要修改/etc/freeradius/3.0/users文件。
解决方案：radius + 数据库