h3c S3100使用radius认证
1.1 运行setup，关闭防火墙
1.2 安装gcc
1.3 freedius 安装过程
1.4 mysql安装
yum groupinstall MySQL Database安装MySQL数据库。
service mysqld start 启动数据库。
chkconfig mysqld on 设置为自启动
**netstat -anx查看3306端口是否在使用，从而确定安装是否成功。**
mysqladmin -u root password 'password' 修改root的密码
mysql -u root -p
Enter password:
创建数据库：creat database radius;
1.5 mysql和freeradius联动设置
1.5.1 表结构建立
mysql -u root -p radius < /usr/local/etc/raddb/sql/mysql/schema.sql
mysql -u root -p radius < /usr/local/etc/raddb/sql/mysql/nas.sql
use radius
show tabels;看到数据库表：
1.5.2 启用sql认证
修改usr/local/etc/raddb/site_enabled下的defoult文件（2.1.1与1.1.7不同，radius.conf被分成了几个部分，authorize 被放在
了defoult文件下，请注意），把authorize{} 、accounting {}中的sql前面的#去掉，并把authorize{} 中的files前加#；
1.5.3 修改与mysql数据库连接的配置文件
/usr/local/etc/raddb/sql.conf，
server = "localhost"
login = "root"
password = "数据库root的登陆密码"
radius_db = "radius" //radius为数据库名
1.5.4修改客户端信息配置文件
/usr/local/etc/raddb/clients.conf
client 127.0.0.1 {
secret = testing123
shortname = localhost
nastype = other
}
1.5.5 修改radius的配置文件
/usr/local/etc/raddb/radiusd.conf
modules {}
一定要取消这一行的注释： $INCLUDE sql.conf
重新运行radiusd -X会出现如下问题。
Could not link driver rlm_sql_mysql: rlm_sql_mysql.so: cannot open shared object file: No such file or directory
Make sure it (and all its dependent libraries!) are in the search path of your system's ld.
/usr/local/etc/raddb/sql.conf[22]: Instantiation failed for module "sql"
/usr/local/etc/raddb/sites-enabled/default[166]: Failed to load module "sql".
/usr/local/etc/raddb/sites-enabled/default[69]: Errors parsing authorize section.
安装 yum install mysql-devel
在对应模块那，要去编译安装一下，sql的目录是在安装目录/src/modules/rlm_sql/drivers/rlm_sql_mysql。
1.5.6 在数据库中加入测试帐号
mysql> use radius;
mysql> insert into radgroupreply (groupname,attribute,op,value) values ('user','Auth-Type',':=','Local');
mysql> insert into radgroupreply (groupname,attribute,op,value) values ('user','Service-Type',':=','Framed-User');
mysql> insert into radgroupreply (groupname,attribute,op,value) values ('user','Framed-IP-
Address',':=','255.255.255.255');
mysql> insert into radgroupreply (groupname,attribute,op,value) values ('user','Framed-IP-
Netmask',':=','255.255.255.0');
建立用户信息：
mysql> insert into radcheck (username,attribute,op,value) values ('lwp','User-Password',':=','*****');
将用户加入组中：
mysql> insert into radusergroup (username,groupname) values ('lwp','user');
1.5.6 测试radius
#radiusd -X
要重新开一个shell终端来执行下面的命令
#radtest test test localhost 0 testing123
2.1 S3100的配置
public-key local create rsa
public-key local create dsa
super password level 3 cipher ******
#
local-server nas-ip 127.0.0.1 key expert---启动本地radius
radius scheme ssh
server-type standard
primary authentication 192.168.4.202-----启动副radius
secondary authentication 127.0.0.1 1645
accounting optional
key authentication expert
user-name-format without-domain
radius scheme telnet
server-type standard
primary authentication 192.168.4.202
secondary authentication 127.0.0.1 1645
accounting optional
key authentication expert
user-name-format without-domain
#
domain system
scheme radius-scheme ssh
authentication radius-scheme ssh
authorization none
domain test
scheme radius-scheme telnet
authentication radius-scheme telnet
authorization none
#
local-user lwp
password cipher ******
service-type ssh telnet
level 3
#
ssh server authentication-retries 5
ssh user lwp authentication-type password
ssh user lwp service-type stelnet
user-interface vty 0 4
authentication-mode scheme
user privilege level 3