[原创翻译]How to FreeRadius and MySQL（二）
这是翻译的第二部分~~
英文原文
You should get an 'Access Accept' response. If you don't, do not pass Go, do not collect £200. Go back and check
everything
. Read the docs,
READ THE DEBUG!!
Personally, I used NTradPing (downloadable from
MasterSoft
) on a desktop Windows PC to send test packets towards the radius server - very handy tool. If you do this, or test from any other machine, remember your PC (or other machine) needs to be in your NAS list in clients.conf too!
OK, so at this point you should have text-file authentication working in FreeRadius...
Setting up the RADIUS database in MySQL
First, you should a new empty 'radius' database in MySQL and login user with permissions to that database. You could of course call the database and the user anything you like but we'll stick to 'radius' for both for the purposes of this discussion
Next up, you need to create the schema for the database. There is a file which describes this and is actually a SQL script file. It can be found at /src/modules/rlm_sql/drivers/rlm_sql_mysql/db_mysql.sql where you untar'd FreeRadius. This is the bit that, at least at the time I originally wrote these notes, wasn't really documented anywhere and was the thing most people seemed to be asking.
How you run that script is up to you and how you like to admin MySQL. The easiest way is to:
mysql -uroot -prootpass radius < db_mysql.sql
...where 'root' and 'rootpass' are your mysql root name and password respectively.
I happened to run it using
MacSQL 2.0
on my
Powerbook G4/OS X
machine (Cool...). You could do it on the server, or use a MySQL admin tool from a Windows PC (e.g.
MySQL CC
,
SQLion
,
dbtools
etc) or whatever.
Now you have the database running, albeit empty.
Configuring FreeRadius to use MySQL
Edit /usr/local/etc/raddb/sql.conf and enter the server, name and password details to connect to your MySQL server and the RADIUS database. The database and table names should be left at the defaults if you used the default schema. For testing/debug purposes, switch on sqltrace if you wish - FreeRadius will dump all SQL commands to the debug output with this on.
If you're stripping all realm names (i.e. you want user
[email protected]
to authenticate as just 'joe'), then in sql.conf, under the 'query config: username' section, you MAY need to adjust the line(s) referring to sql_user_name. I needed to do this originally because we want to dump all realms, but you probably won't need to do this with the latest FreeRadius. For example, in our case I needed to uncomment the line:
sql_user_name = '%{Stripped-User-Name}'
...and comment out the following line referring to just User-Name. If you want to see what's happening here, switch on all the logging options in radiusd.conf and run radiusd in debug mode (-X) to see what's happening : you'll see " user@domain" being passed to MySQL when using User-Name, but just "user" when using Stripped-User-Name. Using the latter, realms worked for me (basically, I strip everything, as all user names are unique on the server anyway). Of course, set all your other SQL options as needed (database login details, etc)
Edit /usr/local/etc/raddb/radiusd.conf and add a line saying 'sql' to the authorize{} section (which is towards the end of the file). The best place to put it is just before the 'files' entry. Indeed, if you'll
just
be using MySQL, and not falling back to text files, you could comment out or lose the 'files' entry altogether.
Also add a line saying 'sql' to the accounting{} section too between 'unix' and 'radutmp'. FreeRadius will now do accounting to MySQL as well.
The end of your radiusd.conf should then look something like this:
authorise {
preprocess
chap
mschap
#counter
#attr_filter
#eap
suffix
sql
#files
#etc_smbpasswd
}
authenticate {
authtype PAP {
pap
}
authtype CHAP {
chap
}
authtype MS-CHAP{
mschap
}
#pam
#unix
#authtype LDAP {
# ldap
#}
}
preacct {
preprocess
suffix
#files
}
accounting {
acct_unique
detail
#counter
unix
sql
radutmp
#sradutmp
}
session {
radutmp
}
译文：
你应该可以收到一个“Access Accept”的回复。如果你并没有收到，就不要继续，不要收别人的200英镑，返回并检查所有的步骤。阅读文档，并阅读DEBUG文档！
对我个人而言，我使用NTradPing(可以从MasterSoft上下载)在Windows桌面PC上向radius服务器发送测试包-这是一个很方便的小工具。如果你这样做了，或者从其他机器上测试，记得你的PC（或其他的机器）也需要在你的clients.conf中的NAS列表中！
好的，现在你已经会用文本文件配置FreeRadius并使其进行认证工作了...
在Mysql中设置RADIUS数据库
第一步，你应该在Mysql中新建一个名为'radius'的新的空数据库并且以一个授权用户登录进去。你当然可以把这个数据库命名为你喜欢的任何名字但是我们在这个文档中还是坚持使用'radius'。下一步，你需要为这个数据库创建表。这里有一个SQL脚本文件描述了如何创建表。你可以在你解压FreeRadius的文件夹下的/src/modules/rlm_sql/drivers/rlm_sql_mysql/db_mysql.sql找到它。虽然这只是一小部分，但至少我这是我的原创，虽然它不是很多人询问的真正的官方文档。
你如何运行这个脚本文件取决于你想如何管理Mysql。最简单的方式是：
mysql -uroot -prootpass radius < db_mysql.sql
"
root
"
和
"
rootpass
"
分别是你的mysql管理员帐号和密码。我希望在我的Powerbook G4/OS X用MacSQL2.0来运行它（cool..）。你可以在服务器上运行它，或者用一个基于Windows PC的Mysql管理工具（比如说MySQL CC, SQLion, dbtools等等）或者其他工具。
现在你已经让你的数据库开始运行了，即使它是空的。
配置你的FreeRadius可以使用MySQL
编辑/usr/local/etc/raddb/sql.conf并输入连接到你的MySQL服务器和RADIUS数据库的服务器、用户名及密码的详细情况。如果你使用了默认的表那么数据库和表名应该保持默认。为了测试和debug，你可以按你需要的调节路径-FreeRadius会存储下所有debug时使用的SQL命令。
如果你去掉了所有的域名（比如你想使用户[email protected]使用用户名joe进行认证），在sql.conf文件里，位于'query config: username'部分的下面，你可能需要参考sql_user_name对这些行进行调整。
我需要亲自做这些因为我想存储所有的域，但是你在最新的FreeRadius版本相爱并不需要这些操作。举个例子，在我的这个案例里我需要对该行取消引用:
sql_user_name = '%{Stripped-User-Name}'
并且你还需要参考用户名取消接下来几行的引用。如果你想看看这里发生了什么，那么在radiusd.conf文件中打开所有的日志操作并且在debug模式下（-x）运行radiusd：你将会看见当你使用user的时候user@domain用户名通过了Mysql数据库。当然按需设置你的其他SQL选项（比如数据库登录详情等）
编辑/usr/local/etc/raddb/radiusd.conf并添加'sql'这行到authorize{} 部分（在这个文件的最后部分）。最好是把它放在'files'入口之前。事实上，如果你正在使用MySQL，并且对文本文件不了解，你可能会把引用取消掉或者吧'files'的入口一块丢失了。
你还需要在accounting{}部分的unix和radutmp之间添加一行'sql'，现在FreeRadius可以很好的和MySQL一块工作了。
你的radiusd.conf文件的最后部分应该像下面这样：
authorise {
preprocess
chap
mschap
#counter
#attr_filter
#eap
suffix
sql
#files
#etc_smbpasswd
}
authenticate {
authtype PAP {
pap
}
authtype CHAP {
chap
}
authtype MS-CHAP{
mschap
}
#pam
#unix
#authtype LDAP {
# ldap
#}
}
preacct {
preprocess
suffix
#files
}
accounting {
acct_unique
detail
#counter
unix
sql
radutmp
#sradutmp
}
session {
radutmp
}