victoryan

[原创翻译]How to FreeRadius and MySQL（一）

因毕业设计需要，需翻译一篇外文文献，我选择的一篇与我毕业设计课题相关的文献，现将小弟对它翻译发表出来。由于小弟水平有限，错误之处还希望各位博友多多指证。

前半部分是英文原文，后半部分是译文，因时间关系，未能一次性翻译完，持续更新中，敬请关注。。。

How to FreeRadius and MySQL

Scott Bartlett ( contact ).

In September 2001 I started playing around with FreeRadius (then at version 0.2!) and storing user authorisation details in a MySQL database. I had previously been using a proprietary RADIUS solution and wanted rid of it. Lots of people seemed to be posting to the freeradius-users list that they were trying to do the same and found it tricky due to the lack of documentation. Thus, to help anyone out there who needed it, I wrote down all the snippets of info, tips I'd received, and steps I'd used to make it work. This is the result.

This document assumes that you are familiar with:

*nix system admin and networking

What RADIUS is and should do

MySQL administration

The basics of how to compile and install open source software.

I'm not going to describe any of the above stuff, especially the latter as I'm far from an expert on it. This document focuses on getting FreeRadius running with MySQL. It does NOT describe a basic FreeRadius installation in detail (e.g. getting it up and running with a 'users' text file or other FreeRadius configurations), nor does it cover using multiple authentication methods, fall-through's or any of that stuff. Just plain-old-MySQL-only. If you don't know about RADIUS itself, go do some background reading... the O'Reilly book ('RADIUS') is pretty good and covers FreeRadius too.

Please note: This isn't official documentation. It's not even UNofficial documentation. It's not documentation of any type by any stretch of the imagination. So far, it's just my own personal notes, written on the fly. Little editing, little detail. You takes your chances. I will try to improve when I can, or have additional information - don't hold your breath though, as life can get busy around here. The notes focus on the SQL element, NOT generally on getting FreeRadius installed and configured and operational with text files (maybe later!) although there is a little bit on that.

Also note: I'm not a programmer - editing low-level code and compiling stuff is not something I'm particularly familiar with. Ask me to read C code and I'll probably panic. My background and experience on Linux (and other stuff) puts me in the system admin/networking bracket (I'm a network builder and web app developer by day), so please bear that in mind here. Feel free to mail me, especially with suggestions and any info useful to add here, but please don't ask me 'how to I compile' stuff. Thanks.

Lastly for this bit : a big thank you to all those that helped, emailed and generally contributed to me getting this up and going, and thus to the creation of these notes.

System

I did my original testing on SuSe Linux 7.0 on Intel with FreeRadius 0.2 and MySQL 3.23.42 using a Cisco 3640 acting as a test NAS unit. The final deployment was to RedHat 7.1. Today I'm running FreeRadius 0.8.1. If you're running an older version you are strongly recommended to upgrade.

Before You Start

Before starting with FreeRadius, make sure your box is up and configured on your network, that you have MySQL installed and running, and that your NAS is configured to point to your server.

If you're using Cisco kit as your NAS, here's a quick example snippet of how to configure IOS to authenticate PPP (e.g. dial, DSL etc) users to a RADIUS server:

aaa new-model

aaa authentication ppp default if-needed group radius local

aaa authorization network default group radius

aaa accounting update newinfo

aaa accounting exec default start-stop group radius

aaa accounting network default wait-start group radius

aaa accounting connection default start-stop group radius

radius-server host a.b.c.d auth-port 1645 acct-port 1646

radius-server host e.f.g.h auth-port 1645 acct-port 1646

radius-server key YOUR-RADIUS-KEY

[a.b.c.d and e.f.g.h are the IP's of your primary and secondary RADIUS servers. YOUR-RADIUS-KEY is your RADIUS secret key as defined in clients.conf (see below). ]

Make SURE you have included the development headers in your MySQL installation otherwise the FreeRadius installation/compilation will barf. To make my own life easy, I just installed MySQL to the default location.

Just to clarify: ABSOLUTELY MAKE SURE you have the mysql-devel (headers and libraries) package installed with your MySQL, otherwise freeradius won't compile with MySQL support properly. Many people seem to miss having this.

Oh yep, did I mention about having the MySQL development headers installed? No? Make sure you do... ;-)

Getting Started

First off, you should get FreeRadius compiled, installed and running in a basic text file configuration (e.g. using the 'users' file) on your box. This I'm not going to describe in details (read the stuff in /docs, etc), but it should basically be the following:

1 - Get the latest FreeRadius source code tarball from [url]ftp://ftp.freeradius.org/pub/radius/freeradius.tar.gz[/url] . If you're so minded, get the latest CVS instead.

2 - Unpack the tarball and install it. On my own system the basic steps were all that was needed, and everything got dumped in the standard places:

tar xvf freeradius.tar.gz

cd freeradius

./configure

make

make install

Note that you might need to add options to ./configure if you installed MySQL to a non-standard place, or want FreeRadius to a non-standard place, or want or need any other odd bits and pieces. I was keeping it simple and didn't need to.

Then you should configure FreeRadius appropriately. It's best to start with a simple config using the standard text files, if at least only to test that FreeRadius installed OK and will work. To very briefly summarise getting the text files configured :

1 - Edit /usr/local/etc/raddb/clients.conf and enter the details of your NAS unit(s). There are examples here, so it should be easy. Tip: You'll also want to enter 'localhost' here for testing purposes (i.e. so you can use radtest).

2 - Edit /usr/local/etc/raddb/users and create an example user account. The file is commented on how to do this. I'm not going to repeat that here. If you've previously used another RADIUS server with text-file configuration (e.g. Livingston, Cistron) you'll know what goes here...

3 - Edit /usr/local/etc/raddb/realms. I just put a single line 'DEFAULT LOCAL' and that was sufficient to strip any suffix domain names in given user names - if you're using realms or proxing you'll doubtless need to do something else here, but I recommend you start with this then come back to setting up realms/ proxying when you know MySQL is working. If you're not using realms, just ignore this.

4 - Edit /usr/local/etc/raddb/radiusd.conf and change as needed. For my own installation I changed the default port to run on 1645 (old port) to match what our existing boxes use (but otherwise make sure your NAS and FreeRadius are using the same) and said 'yes' to all the logging options (I'd strongly recommend you do switch on all the logging to start with). At this point I also said 'no' to using proxy to keep stuff simple. I then told it to run under the 'radius' user and group (I'd initially installed FreeRadius as root and didn't want to run it as such, so I created a user account called 'radius' in a group called 'radius' and then just blanket chown'd and chgrp'd the various radius directories to that user just to be sure the account can access all the right stuff. A bit of a sledgehammer there, but it was quick! I'm sure there's a better and/or more elegant way of doing this!). The rest of the radiusd.conf file was left alone.

At this point you should be able to manually fired up /usr/local/sbin/radiusd. You should do this with the debug turned on so you can see what happens:

/usr/local/sbin/radiusd -X

Lots of stuff will scroll to the screen, and it should tell you it's ready to accept requests. If you get an error, READ THE DEBUG, then check the docs, check the above and try again.

You should now be able to use FreeRadius. You can use radtest to test an account from the command line:

radtest username password servername port secret

So, if your example user is 'fred' with password 'wilma', your server is called 'radius.domain.com', is using port 1645, and you put localhost (or your localhost's IP) in clients.conf with a secret of 'mysecret', you should use:

radtest fred wilma radius.domain.com 1645 mysecret

And you should get back something like:

Sending Access-Request of id 226 to 127.0.0.1:1645

User-Name = 'fred'

User-Password = '\304\2323\326B\017\376\322?K\332\350Z;}'

NAS-IP-Address = radius.domain.com

NAS-Port = 1645

rad_recv : Access-Accept packet from host 127.0.0.1:1645,id=226, length=56

Framed-IP-Address = 80.84.161.1

Framed-Protocol = PPP

Service-Type = Framed-User

Framed-Compression = Van-Jacobson-TCP-IP

Framed-IP- Netmask = 255.255.255.255

翻译如下：

介绍

在2001年9月我开始研究 FreeRadius （当时是0.2版本）并且把用户的认证详细情况存储在了一个Mysql数据库。我之前使用过一种私有的RADIUS软件（指未开源的RADIUS服务器软件），并且希望能换个软件。现在有很多人都开始使用freeradius但是他们都发现使用起来很棘手，原因是缺乏这方面的文档。因此，为了帮助所有需要帮助文档的人，我写下了所有我所收集到的零星的信息和资料，以及我配置它的步骤。这个文档就是成果。

学习这个文档的前提是你熟悉：

* nix 系统管理及网络配置

什么是RADIUS以及它可以做什么

Mysql数据库管理

如何编译、安装开放源码软件的基本知识

我将不会针对上述的任何内容进行具体的详述，尤其是后面部分的内容我不甚深入。这个文档关注的是让 FreeRadius 和 Myql 数据库共同工作，它并不是基础的描述安装FreeRadius的细节（比如让按照一个users文本文件或其他FreeRadius配置文件它运行起来），它也不是讲述使用多用户认证方法以及认证失败的文档。它只是清楚的讲述Mysql的，如果你对RADIUS本身毫无了解，你需要先返回去读O'Reilly的书《RADIUS》，这本书相当好并且涵盖了Freeradius的知识。

系统

我第一次测试是在基于 Intel 平台下的SUSE Linux7.0系统，使用FreeRadius 0.2版本及Mysql3.23.42,还使用了cisco 3640作为一台测试NAS（网络准入服务器）单元。我最后一次部署是在RedHat 7.1上。今天我运行的是FreeRadius 0.8.1版本。如果你运行的是之前的版本，我强烈建议你先对它进行升级。

开始之前的准备

在我们开始 FreeRadius 之前，你要确定你盒子（各种需要的软件）已经准备齐全并且网络已经正确配置,你的Mysql已经安装好并且在运行中了，并且你的NAS已经对你的服务器做好相应的配置了。

如果你使用的是Cisco套件作为你的NAS，这儿有一个案例，讲如何配置IOS使得它对PPP（比如拨号，DSL等）用户在RADIUS服务器上进行验证。

aaa new-model

aaa authentication ppp default if-needed group radius local

aaa authorization network default group radius

aaa accounting update newinfo

aaa accounting exec default start-stop group radius

aaa accounting network default wait-start group radius

aaa accounting connection default start-stop group radius

radius-server host a.b.c.d auth-port 1645 acct-port 1646

radius-server host e.f.g.h auth-port 1645 acct-port 1646

radius-server key YOUR-RADIUS-KEY

[a.b.c.d and e.f.g.h是你的主、从RADIUS服务器的IP地址。你的RADIUS-KEY是你在clients.conf文件中定义的RADIUS密码（见下文）]。

确保你在Mysql安装时包含了开发头文件，否则FreeRadius的安装和编译会出错并中断。为了让我自己方便，我在安装Mysql的时候装在了默认的地方。

需要明白的是：确定你把mysql-devel包（头文件和库）和你的Mysql一块安装了，否则freeradius编译后将不能很好的支持Mysql。很多人都会忘掉这点。

嗯，我在之前有提过要安装Mysql 开发头文件的吧？没有？一定要确保你已经安装了的:).

开始

第一步，你需要编译 FreeRadius ，安装并且按你的文件夹中的一个基本文本配置文件运行（比如使用users这个文件）。我不打算具体描述这个（你可以参见/docs下面的资料等等），但是这是下面要进行的步骤的基础：

1.从[url]ftp://ftp.freeradius.org/pub/radius/freeradius.tar.gz[/url]获取最新的FreeRadius源码包。如果你很在意的话，那就使用最新的CVS（Concurrent Versions System，并发版本系统）来代替。

2.把tar包解压并安装它。在我自己的系统上基本步骤是全部必需的，并且所有的东西都被存储在标准的文件夹下。

tar xvf freeradius.tar.gz

cd freeradius

./configure

make

make install

需要注意的是如果你并非把Mysql安装在标准的地方，或者你希望把FreeRadius安装在一个不标准的地方，或者你还有其他的想法的话，那么你在./configure的时候可能还需要一些附加的操作。我自己并非这样做而是让它保持了简单。

接下来你需要合理的配置FreeRadius了。我们最好用一个标准的文本文件来开始配置，它至少可以用来测试FreeRadius安装OK并且可以正常工作。配置文本文件的简要总结如下：

1.编辑/usr/local/etc/raddb/clients.conf并且输入你的NAS单元的详细情况。这里有一些例子，所以它应该很简单。tip：你可能还需要在这儿输入"locolhost"作测试用（这样你才能用radtest）。

2.编辑/usr/local/etc/raddb/users并且创建一个示例用户。这个文件讲述了如何做这个操作。我将不在这儿继续重复了。如果你之前用文本文件配置过其他的RADIUS服务器（如Livingston，Cistron）你就会知道接下来该如何做...

3.编辑/usr/local/etc/raddb/realms，我只需要在'DEFAULT LOCAL'处添加一行就可以除去任何所给的用户名前的域名前缀-如果你使用域或者代理那么在这儿你一定会需要其他操作，但是我建议你以这个开始并且当你知道Mysql如何运行了之后然后再转回去设置你的域和代理。如果你没有使用域，那么忽略掉这部分。

4.编辑/usr/local/etc/raddb/radiusd.conf并且按需要改变设置。对我自己的安装而言，我改变了默认的之前的1645端口来与我们存在的软件匹配（但是无论如何也要确保你的NAS和FreeRadius使用的同一端口）并且对所有的日志操作说“yes”（我强烈推荐你在开始的时候进行日志记录）。在这点上我对使用代理来保持简单也说“no”，我接下来要告诉它在radius用户和组下运行（我初始安装FreeRadius是以root用户并且之后我也赋予了所属用户和所属组对radius各个目录的权限以确保这个用户可以对文件具有所有权限。虽然有点小麻烦，但是却很快！我肯定还有一些更好的方式来完成这个操作！）。radiusd.conf剩下的部分就不用管了。

现在你应该可以手动操作/usr/local/sbin/radiusd了。你应该在debug模式下进行这一操作以便你可以看见发生了什么：