在 Linux 上构建一个 RADIUS 服务器

tar -zxvf freeradius-1.0.2.tar.gz         - extract it with gunzip and tar
./configure
make
make install                              - run this command as root
radiusd or                                - start RADIUS server
radiusd -X                                - start RADIUS server in debug mode
radtest test test localhost 0 testing123  - test RADIUS server

1) Global settings:
log_auth = yes                - log authentication requests to the log file
log_auth_badpass = no         - don't log passwords if request rejected
log_auth_goodpass = no        - don't log passwords if request accepted
2) LDAP Settings:
modules {
ldap {
server = "bluepages.ibm.com"   - the hostname or IP address of the LDAP server
port = 636                     - encrypted communications
basedn = "ou=bluepages,o=ibm.com"   - define the base Distinguished Names (DN),
- under the Organization (O) "ibm.com",
- in the Organization Unit (OU) "bluepages"
filter = "(mail=%u)"                   - specify search criteria
base_filter = "(objectclass=person)"   - specify base search criteria
}
authenticate {                - enable authentication against LDAP
Auth-Type LDAP {
ldap
}

client 192.168.0.0/24 {
secret      = mysecret1   - the "secret" should be the same as configured on NAS
shortname   = mylan       - the "shortname" can be used for logging
nastype      = cisco      - the "nastype" is used for checkrad and is optional
}

client 192.168.0.1 {
secret      = mysecret1
shortname   = myserver
nastype      = other
}

1) Authentication type:
Auth-Type := LDAP       - authenticate against LDAP
Auth-Type := Local, User-Password == "mypasswd"
- authenticate against the
- password set in /etc/raddb/user
Auth-Type := System     - authenticate against the system password file
- /etc/passwd or /etc/shadow
2) Service type:
Service-Type = Login,   - for administrative login

aaa new-model
radius-server host 192.168.0.100
radius-server key mysecret1

aaa authentication login default group radius local
line vty 0 4
login authentication default

aaa authorization exec default group radius if-authenticated

aaa accounting system default start-stop group radius
aaa accounting network default start-stop group radius
aaa accounting connection default start-stop group radius
aaa accounting exec default stop-only group radius
aaa accounting commands 1 default stop-only group radius
aaa accounting commands 15 default wait-start group radius

Thu Mar 3 21:37:32 2005 : Auth: Login OK: [David] (from client
mylan port 1 cli 192.168.0.94)
Mon Mar 7 23:39:53 2005 : Auth: Login incorrect: [John] (from
client mylan port 1 cli 192.168.0.94)

Fri Mar  4 19:40:12 2005
NAS-IP-Address = 192.168.0.1
NAS-Port = 1
NAS-Port-Type = Virtual
User-Name = "David"
Calling-Station-Id = "192.168.0.94"
Acct-Status-Type = Start
Acct-Authentic = RADIUS
Service-Type = NAS-Prompt-User
Acct-Session-Id = "00000026"
Acct-Delay-Time = 0
Client-IP-Address = 192.168.0.1
Acct-Unique-Session-Id = "913029a52dacb116"
Timestamp = 1109936412
Fri Mar  4 19:51:17 2005
NAS-IP-Address = 192.168.0.1
NAS-Port = 1
NAS-Port-Type = Virtual
User-Name = "David"
Calling-Station-Id = "192.168.0.94"
Acct-Status-Type = Stop
Acct-Authentic = RADIUS
Service-Type = NAS-Prompt-User
Acct-Session-Id = "00000026"
Acct-Terminate-Cause = Idle-Timeout
Acct-Session-Time = 665
Acct-Delay-Time = 0
Client-IP-Address = 192.168.0.1
Acct-Unique-Session-Id = "913029a52dacb116"
Timestamp = 1109937077