freeRADIUS + openLDAP 安装和配置

说明：这篇文章只是记录小弟我在学习freeRADIUS的过程，由于我是刚刚学习到这方面的知识，大部分都是在网上网友的博客日志中找到的，看得实在太多了，我实在是不知道到底是从谁的博客中学习来的，所以，引用也不知道从哪位大哥记起，干脆就不写了，还望海涵。

 

 

 

 

##################   INSTALL openLDAP#########################

 

对于下面的参数 我都简写了，<openssl>代表相应版本的全称

1. install openssl

 

#tar xzvf <openssl.tar>

#cd <openssl>

#./config shared zlib

#make

 

#make test

 

#make install

 

 

首先将原来的openssl失效

#mv /usr/bin/openssl /usr/bin/openssl.OFF

 

#mv /usr/include/openssl /usr/include/openssl.OFF

 

使新安装的openssl生效

#ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl

 

#ln -s /usr/local/ssl/include/openssl /usr/include/openssl

 

setup path for searching

 

# echo "/usr/local/ssl/lib" >> /esc/ld.so.conf

 

#ldconfig -v

 

 

2 install SASL

 

 

#tar  xzvf  <>

 

#cd <>

 

#./configure --prefix=/usr/local/sasl2 --enable-login --with-openssl=/usr/local/ssl

 

#make ; make install

 

#echo "/usr/local/sasl2/lib" >> /etc/ld.so.conf

 

#echo "/usr/local/sasl2/lib/sasl2" >> /etc/ld.so.conf

 

#ldconfig -v 

 

 

#rm -rf /usr/lib/libsasl*

 

#ln -s /usr/local/sasl2/lib/* /usr/lib

一定要新建目录这是sasl运行中需要的设置

 

#mkdir -pv /var/state/saslauthd

 

#saslauthd -a shadow

 

#testsaslauthd -u root -p rootPWD

验证你的本地帐户

<should see OK SUCCESS>

 

 

 

3. install BerkeleyDB <4.6>

 

#tar <>

#cd db<>/build_unix

 

#..dist/configure  --prefix=/usr/local/BerkeleyDB

 

#make&&make install

 

 

在安装openLDAP模块化的功能时需要这个东西libtool

* install libtool

 

first install the *.rpm from CD;

 

#cd /usr/share/libtool/libltdl

 

#./configure

 

#make && make install

 

 

 

4.install openLDAP

 

#tar <>

 

#cd <>

# env CPPFLAGS="-I/usr/local/BerkeleyDB/include -I/usr/local/sasl2/include" LDFLAGS="-L/usr/local/BerkeleyDB/lib -L/usrllocal/sasl2/lib -L/usr/local/sasl2/lib/sasl2" ./configure --

 

prefix=/usr/local/openldap --sysconfdir=/etc/openldap --enable-passwd --disable-ipv6 --enable-spasswd --enable-crypt --enable-modules --enable-accesslog=yes  --enable-ldap=mod --

 

enable-meta=mod --enable-rewrite=yes --with-proxycache=yes --enable-rwm=yes --enable-dynamic

 

#make depend

#make

#make test

#make install

 

说明：小弟在test的过程中一直发现有一个问题：second site1 not backend to the central master 什么的，但是也不影响后面的使用，也可能是我现在还没有使用到这个

 

功能。如有人知道一定告诉小弟。

 

 

 

 

 

 

 

 

######################################install freeRADIUS#############################

 

 

 

这个安装比较简单，就不说了。

 

################## configure for openLDAP + freeRADIUS #################

 

# cp /usr/local/share/doc/freeradius/examples/openldap.schema  /etc/openldap/openldap/schema/radius.schema

 

 

#gedit /etc/openldap/openldap/slapd.conf

 

 

一下是包含一定的schema文件，我的理解是：包含一定的定义结构体的文件。

include/etc/openldap/openldap/schema/core.schema

include/etc/openldap/openldap/schema/cosine.schema

include/etc/openldap/openldap/schema/ppolicy.schema

include/etc/openldap/openldap/schema/misc.schema

include/etc/openldap/openldap/schema/corba.schema

include/etc/openldap/openldap/schema/collective.schema

include/etc/openldap/openldap/schema/radius.schema

 

 

定义数据库

 

 

 

 

 

 

 

databasebdb

 

suffix"dc=example,dc=com"

 

rootdn"cn=Manager,dc=example,dc=com"

 

# Cleartext passwords, especially for the rootdn, should

 

# be avoid.  See slappasswd(8) and slapd.conf(5) for details.

 

# Use of strong authentication encouraged.

 

rootpwsecret

 

# The database directory MUST exist prior to running slapd AND 

 

# should only be accessible by the slapd and slap tools.

 

# Mode 700 recommended.

 

directory/usr/local/openldap/var/openldap-data

 

# Indices to maintain

 

indexobjectClasseq

 

index   uid  eq

 

 

 

2. add entry

 

 

 

start slapd

 

 

#/usr/local/openldap/libexec/slapd 

 

 

 

 

 

addentry.ldif

 

-------------------------------------

 

dn:dc=example,dc=com

 

objectclass:dcObject

 

objectclass:organization

 

o: example_O

 

dc:example

 

 

 

dn:cn=Manager,dc=example,dc=com

 

objectclass:organizationalRole

 

cn:Manager

 

--------------------------------------

 

 

 

 

#ldapadd -x -D "cn=Manager,dc=intel,dc=com" -W -f addentry.ldif

 

 

 

 

users

 

adduser.ldif

 

-------------------------------------

 

dn:uid=test,dc=example,dc=com

 

objectclass:account

 

objectclass:simpleSecurityObject

 

objectclass:radiusprofile

 

uid:test

 

userPassword:test

 

cn:test

 

 

 

dn:uid=hello,dc=example,dc=com

 

objectclass:account

 

objectclass:simpleSecurityObject

 

objectclass:radiusprofile

 

uid:hello

 

userPassword:hello

 

cn:hello

 

-------------------------------------

 

 

 

#ldapadd -x -D "cn=Manager,dc=example,dc=com" -W -f adduser.ldif

 

 

 

 

#ldapsearch -x -b "dc=example,dc=com" '(objectclass=*)'

 

 

 

 

 

 

#################################configure  freeRadius ###########################

 

#gedit /usr/local/etc/raddb/modules/ldap 

 

 

 

 

 

ldap{

 

server = "127.0.0.1"

identity = "cn=Manager,dc=example,dc=com"

password = secret

basedn = "dc=example,dc=com"

filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"

password_attribute = userPassword

}

 

 

 

 

 

 

# gedit /usr/local/etc/raddb/sites-enabled/default 

 

 

 

authorize{

 

 

#insert the item

 

ldap

 

}

 

 

 

authenticate{

 

 

#insert this item

Auth-Type LDAP {

ldap

}

 

}

 

 

 

 

#gedit /usr/local/etc/raddb/clients.conf 

 

 

#insert the item

 

client 192.168.0.0/24 {

secret= testing123-1

shortname= private-network-1

 

}

 

 

 

 

#gedit /usr/local/etc/raddb/proxy.conf 

 

 

 

insert the following

 

 

 

realm NULL{

 

type = radius

authhost = LOCAL

accthost = LOCAL

nostrip

}

 

 

 

realm example.com{

 

type = radius

authhost = LOCAL

accthost = LOCAL

}

 

 

 

 

#radiusd -X

 

 

 

#radtest hello hello localhost 0 testing123