linuxpppoemysqlwebradius认证.doc

【原创】架设PPPOE Server及Radius Server（OpenLDAP+Mysql） Normal 0 false 7.8 磅 0 2 false false false EN-US ZH-CN X-NONE MicrosoftInternetExplorer4 Contents Page目录1 说明. 21.1 所需软件及下载地址. 21.2 实现过程及功能特性. 32 架设服务器. 42.1 准备工作编译内核. 42.2 架设PPPOE服务器. 82.3 架设Raius服务器并挂接PPPOE服务器. 132.5 挂接Radius与PPPOE服务器. 342.6 架设OpenLDAP服务器并挂接Radius服务器. 362.7 实现Radius服务器的Web管理功能. 392.8 实现OpenLDAP服务器的Web管理功能. 511 说明1.1 所需软件及下载地址1.1.1 CentOS 5.2-最稳定的linux服务器1.1.2 linux-2.6.19.tar.gz -2.6.19内核1.1.3 linux-2.6.19-mppe-mppc-1.3.patch.bz2-内核的mppe-mppc补丁1.1.4 ppp-2.4.3.tar.gz-PPP主程序1.1.5 ppp-2.4.3-mppe-mppc-1.1.patch.gz-ppp的mppe-mppc补丁1.1.6 rp-pppoe-3.10.tar.gz-PPPOE主程序1.1.7 freeradius-server-2.1.3.tar-FreeRadius服务器主程序1.1.8 mysql-5.0.67-linux-i686.tar.gz-MySQL数据库主程序1.1.9 MySQL-shared-compat-5.0.67-0.rhel5.i386.rpmMySQL共享库1.1.10 freeradius-mysql-1.1.3-1.2.el5-freeradius与MySQL链接程序1.1.11 httpd-2.2.9.tar.gz-最流行的web服务器1.1.12 php-4.4.9.tar.gz-PHP程序1.1.13 ZendOptimizer-3.3.3-linux-glibc23-i386.tar.gz-优化PHP程序代码的工具1.1.14 phpMyAdmin--all-languages.tar.gz-web方式管理mysql数据库的工具1.1.15 db-4.2.52.tar.gz-伯克利数据库openldap的后台数据库1.1.16 gettext-0.17.tar.gz-OpenLDAP实现web管理方式的后台语言支持工具1.1.17 openldap-2.4.11-stable-20080813.tgz-OpenLDAP主程序1.1.18 phpldapadmin-.tar.gz-OpenLDAP的WEB访问工具1.2 实现过程及功 能特性我们的试验网络拓扑如下图所示：首先编译内核，以加入对mppe和mppc的支持，然后架设PPPOE服务器，实现终结用户PPPOE拨号的功能，此时，对用户的验证以文本文件（存储在PPPOE程序组）的方式进行。然后架设Radius服务器，将用户的PPPOE拨号请求转送到Radius服务器进行验证。Radius服务器分别挂接OpenLDAP服务器和MySQL服务器，其中的OpenLDAP服务器实现对用户名、密码等信息的验证和属性返回，Mysql服务器实现对用户带宽、连接时间、 产生流量等的记录和属性返回。最后实现Radius服务器、MySQL服务器、OpenLDAP服务器的Web管理功能，从而能够批量产生用户，并方便管理用户（新建、删除、修改属性等）。通过以上步骤建立的一 个服务器体系完全能够适应现代网络对拨号快速认证、属性返回等要求，达到物理服务器的水平，如Redback SmartEdge、Juniper ERX。但却拥有更高的性 价比。同时Radius服务器和OpenLDAP服务器同现在各省市正在使用的服务器拥有相近的稳定性和性能，甚至有的省份只采用Radius来管理用户，并没有OpenLDAP服务器，如浙江省。具体步骤不再赘述，主要配置文件如下：1.rootmm modules# cat /etc/ppp/options lockcrtsctsnobsdcompnodeflatenopcomp#require-mppe#mppe-40#mppe-128#mppe-statelessplugin /etc/ppp/plugins/radius.soradius-config-file /etc/ppp/radius/radiusclient.conf2.rootmm modules# cat /etc/ppp/pppoe-server-options # PPP options for the PPPoE server# LIC: GPL#require-pap#login#lcp-echo-interval 10#lcp-echo-failure 2#authrequire-chap#require-mppedefault-mrudefault-asyncmaplcp-echo-interval 60lcp-echo-failure 5ms-dns 5ms-dns 7noipdefaultnoipxnodefaultroutenoproxyarpnoktune0:54netmask 55logfile /var/log/pppd.log3.OpenLDAP的数据库设置如下：dn: cn=radius,ou=profils,dc=mm,dc=comobjectClass: radiusObjectProfileobjectClass: radiusprofilecn: radiusradiusGroupName: radiusradiusServiceType: Framed-UserradiusFramedProtocol: pppradiusFramedIPAddress: 1radiusFramedIPNetmask: uid: ldaptest1radiusFramedCompression: Van-Jacobsen-TCP-IPradiusFramedRouting: Broadcast-ListenradiusFramedMTU: 1500radiusFilterId: std.pppuserPassword: ldaptest1radiusAuthType: chap4.然后在MYSQL中加入该用户信息（ldaptest1），以便计费：mysql insertintoradcheck(username,attribute,op,value)values(ldaptest1,User-Password,=,ldaptest1);然后把用户加到组里：mysql insertintousergroup(username,groupname)values(ldaptest1,user);5.设置radius的ldap认证模块/usr/local/freeradius/etc/raddb/modules/ldap，修改如下：ldap server = localhost identity = cn=Manager,dc=mm,dc=com password = testing123 basedn = ou=profils,dc=mm,dc=com filter = (uid=%Stripped-User-Name:-%User-Name) ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls start_tls = no password_attribute = userPassword edir_account_policy_check = no set_auth_type = yes 6.修改/usr/local/freeradius/etc/raddb/sites-available/，来指定Radius认证方式，相应部分修改如下：authorize ldapauthenticate Auth-Type LDAP ldap accounting sql 其它的方式全部注释掉即可。通过以上配置，我们就完成了全部服务器的配置：#radiusd -X验证过程如下：（包括认证请求、计费开始请求、计费结束请求三个部分）rad_recv: Access-Request packet from host port 32768, id=10, length=114 Service-Type = Framed-User Framed-Protocol = PPP User-Name = ldaptest1 CHAP-Challenge = 0x7abcb9ac6f368f318969c7351fbdb7b615a49e CHAP-Password = 0x242e7e2035dad2d954264e4eef46c00047 Calling-Station-Id = 00:1C:C4:CD:68:06 NAS-IP-Address = NAS-Port = 0+- entering group authorize .+preprocess returns okchap Setting Auth-Type := CHAP+chap returns ok+mschap returns noopldap performing user authorization for ldaptest1ldap WARNING: Deprecated conditional expansion :-. See man unlang for detailsldap expand: (uid=%Stripped-User-Name:-%User-Name) - (uid=ldaptest1)ldap expand: ou=profils,dc=mm,dc=com - ou=profils,dc=mm,dc=comrlm_ldap: ldap_get_conn: Checking Id: 0rlm_ldap: ldap_get_conn: Got Id: 0rlm_ldap: performing search in ou=profils,dc=mm,dc=com, with filter (uid=ldaptest1)ldap Added User-Password = ldaptest1 in check itemsldap looking for check items in directory.rlm_ldap: userPassword - Cleartext-Password = ldaptest1rlm_ldap: radiusAuthType - Auth-Type = CHAPldap looking for reply items in directory.rlm_ldap: radiusFramedCompression - Framed-Compression = Van-Jacobson-TCP-IPrlm_ldap: radiusFramedMTU - Framed-MTU = 1500rlm_ldap: radiusFilterId - Filter-Id = std.ppprlm_ldap: radiusFramedRouting - Framed-Routing = Broadcast-Listenrlm_ldap: radiusFramedIPNetmask - Framed-IP-Netmask = rlm_ldap: radiusFramedIPAddress - Framed-IP-Address = 1rlm_ldap: radiusFramedProtocol - Framed-Protocol = PPPrlm_ldap: radiusServiceType - Service-Type = Framed-Userldap user ldaptest1 authorized to use remote accessrlm_ldap: ldap_release_conn: Release Id: 0+ldap returns ok+expiration returns noop+logintime returns nooppap Found existing Auth-Type, not changing it.+pap returns noopFound Auth-Type = CHAP+- entering group CHAP .chap login attempt by ldaptest1 with CHAP passwordchap Using clear text password ldaptest1 for user ldaptest1 authentication.chap chap user ldaptest1 authenticated succesfully+chap returns ok+- entering group post-auth .+exec returns noopSending Access-Accept of id 10 to port 32768 Framed-Compression = Van-Jacobson-TCP-IP Framed-MTU = 1500 Filter-Id = std.ppp Framed-Routing = Broadcast-Listen Framed-IP-Netmask = Framed-IP-Address = 1 Framed-Protocol = PPP Service-Type = Framed-UserFinished request 3.Going to the next requestWaking up in 4.9 seconds.rad_recv: Accounting-Request packet from host port 32768, id=11, length=120 Acct-Session-Id = 49631DF90A6E00 User-Name = ldaptest1 Acct-Status-Type = Start Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = 00:1C:C4:CD:68:06 Acct-Authentic = RADIUS NAS-Port-Type = Async Framed-IP-Address = 1 NAS-IP-Address = NAS-Port = 0 Acct-Delay-Time = 0+- entering group preacct .+preprocess returns okacct_unique Hashing NAS-Port = 0,Client-IP-Address = ,NAS-IP-Address = ,Acct-Session-Id = 49631DF90A6E00,User-Name = ldaptest1acct_unique Acct-Unique-Session-ID = b4f40c620cbc699b.+acct_unique returns oksuffix No in User-Name = ldaptest1, looking up realm NULLsuffix No such realm NULL+suffix returns noop+files returns noop+- entering group accounting .detail expand: /usr/local/freeradius/var/log/radius/radacct/%Client-IP-Address/detail-%Y%m%d -/usr/local/freeradius/var/log/radius/radacct//detail-20090106detail /usr/local/freeradius/var/log/radius/radacct/%Client-IP-Address/detail-%Y%m%d expands to /usr/local/freeradius/var/log/radius/radacct//detail-20090106detail expand: %t - Tue Jan 6 17:01:45 2009+detail returns ok+unix returns okradutmp expand: /usr/local/freeradius/var/log/radius/radutmp - /usr/local/freeradius/var/log/radius/radutmpradutmp expand: %User-Name - ldaptest1+radutmp returns oksql expand: %User-Name - ldaptest1sql sql_set_user escaped user - ldaptest1sql expand: %Acct-Delay-Time - 0sql expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES (%Acct-Session-Id, %Acct-Unique-Session-Id, %SQL-User-Name, %Realm, %NAS-IP-Address, %NAS-Port, %NAS-Port-Type, %S, NULL, 0, %Acct-Authentic, %Connect-Info, , 0, 0, %Called-Station-Id, %Calling-Station-Id, , %Service-Type, %Framed-Protocol, %Framed-IP-Address, rlm_sql (sql): Reserving sql socket id: 2rlm_sql_mysql: MYSQL check_error: 1054 receivedsql Couldnt insert SQL accounting START record - Unknown column xascendsessionsvrkey in field listsql expand: %Acct-Delay-Time - 0sql expand: UPDATE radacct SET acctstarttime = %S, acctstartdelay = %Acct-Delay-Time:-0, connectinfo_start = %Connect-Info WHERE acctsessionid = %Acct-Session-Id AND username = %SQL-User-Name AND nasipaddress = %NAS-IP-Address - UPDATE radacct SET acctstarttime = 2009-01-06 17:01:45, acctstartdelay = 0, connectinfo_start = WHERE acctsessionid = 49631DF90A6E00 AND username = ldaptest1 AND nasipaddress = rlm_sql (sql): Released sql socket id: 2+sql returns okattr_filter.accounting_response expand: %User-Name - ldaptest1attr_filter: Matched entry DEFAULT at line 12+attr_filter.accounting_response returns updatedSending Accounting-Response of id 11 to port 32768Finished request 4.Cleaning up request 4 ID 11 with timestamp +224Going to the next requestWaking up in 4.9 seconds.rad_recv: Accounting-Request packet from host port 32768, id=12, length=156 Acct-Session-Id = 49631DF90A6E00 User-Name = ldaptest1 Acct-Status-Type = Stop Service-Type = Framed-User Framed-Protocol = PPP Acct-Authentic = RADIUS Acct-Session-Time = 3 Acct-Output-Octets = 0 Acct-Input-Octets = 56882 Acct-Output-Packets = 0 Acct-Input-Packets = 233 Calling-Station-Id = 00:1C:C4:CD:68:06 NAS-Port-Type = Async Acct-Terminate-Cause = User-Request Framed-IP-Address = 1 NAS-IP-Address = NAS-Port = 0 Acct-Delay-Time = 0+- entering group preacct .+preprocess returns okacct_unique Hashing NAS-Port = 0,Client-IP-Address = ,NAS-IP-Address = ,Acct-Session-Id = 49631DF90A6E00,User-Name = ldaptest1acct_unique Acct-Unique-Session-ID = b4f40c620cbc699b.+acct_unique returns oksuffix No in User-Name = ldaptest1, looking up realm NULLsuffix No such realm NULL+suffix returns noop+files returns noop+- entering group accounting .detail expand: /usr/local/freeradius/var/log/radius/radacct/%Client-IP-Address/detail-%Y%m%d -/usr/local/freeradius/var/log/radius/radacct//detail-20090106detail /usr/local/freeradius/var/log/radius/radacct/%Client-IP-Address/detail-%Y%m%d expands to /usr/local/freeradius/var/log/radius/radacct//detail-20090106detail expand: %t - Tue Jan 6 17:01:48 2009+detail returns ok+unix returns okradutmp expand: /usr/local/freeradius/var/log/radius/radutmp - /usr/local/freeradius/var/log/radius/radutmpradutmp expand: %User-Name - ldaptest1+radutmp returns oksql expand: %User-Name - ldaptest1sql sql_set_user escaped user - ldaptest1sql expand: %Acct-Input-Gigawords - sql expand: %Acct-Input-Octets - 56882sql expand: %Acct-Output-Gigawords - sql expand: %Acct-Output-Octets - 0sql expand: %Acct-Delay-Time - 0sql expand: UPDATE radacct SET acctstoptime = %S, acctsessiontime = %Acct-Session-Time, acctinputoctets = %Acct-Input-Gigawords:-0 32 | %Acct-Input-Octets:-0, acctoutputoctets = %Acct-Output-Gigawords:-0 UPDATE radacct SET acctstoptime = 2009-01-06 17:01:48, acctsessiontime = 3, acctinputoctets = 0 32 | 56882, acctoutputoctets = 0 3sql expand: %Acct-Delay-Time - 0sql expand: %Acct-Input-Gigawords - sql expand: %Acct-Input-Octets - 56882sql expand: %Acct-Output-Gigawords - sql expand: %Acct-Output-Octets - 0sql expand: %Acct-Delay-Time - 0sql expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, frame