freeradius + oracle 无限认证

Radius安装配置维护文档

一、下载软件包

freeradius-server-3.0.9.tar.gz和talloc-2.1.3.tar.gz

二、配置/root目录下的.bash_profile文件，添加如下内容

export ORACLE_BASE=/u01/app/oracle

export ORACLE_HOME=$ORACLE_BASE/product/11.2.4

export ORACLE_SID=radiusdb

export PATH=$PATH:$HOME/bin:$ORACLE_HOME/bin

export LD_LIBRARY_PATH=$ORACLE_HOME/lib:/lib:/usr/lib

三、编译安装

1、  安装talloc

./configure --prefix=/usr/local/talloc

make;make install

2、  安装freeradius

1)       进入freeradius-server-3.0.9/src/modules/rlm_sql/drivers/rlm_sql_oracle目录

2)       执行./configure --with-oracle-include-dir=/u01/app/oracle/product/11.2.4/rdbms/public --with-oracle-lib-dir=/u01/app/oracle/product/11.2.4/lib，编译oracle连接驱动库文件

3)       在freeradius-server-3.0.9目录下执行

./configure --with-oracle-include-dir=/u01/app/oracle/product/11.2.4/rdbms/public --with-oracle-lib-dir=/u01/app/oracle/product/11.2.4/lib --with-talloc-lib-dir=/usr/local/talloc/lib/ --with-talloc-include-dir=/usr/local/talloc/include --with-openssl=no

make;make install

3、  freeradius配置

1）  进入/usr/local/etc/raddb，编辑文件clients.conf，sites-available/default，mods-available/sql

2）  Client.conf文件

添加如下内容：

client test {

ipaddr          = 10.55.0.0/16

secret          = testing

}

定义可接入radius的客户端ip

3）  sites-available/default

将该文件中authorize、eap、accounting、session、post-auth模块中sql前的注释全部去掉，让radius使用数据库进行验证。

4）  mods-available/sql（配置文件中的红字部分需做修改）

sql {

driver = "rlm_sql_oracle"  #数据库驱动使用oracle

dialect = "oracle"

server = "10.55.1.3"

#       port = 3306

login = "radius"

password = "123456"

# Database table configuration for everything except Oracle

#       radius_db = "radius"  #这行注释掉

# If you are using Oracle then use this instead

radius_db = "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=10.55.1.3)(PORT=1521))(CONNECT_DATA=(SID=radiusdb)))"

#       radius_db = "dbname=radius host=localhost user=radius password=raddpass"

acct_table1 = "radacct"

acct_table2 = "radacct"

# Allow for storing data after authentication

postauth_table = "radpostauth"

# Tables containing 'check' items

authcheck_table = "radcheck"

groupcheck_table = "radgroupcheck"

# Tables containing 'reply' items

authreply_table = "radreply"

groupreply_table = "radgroupreply"

# Table to keep group info

usergroup_table = "radusergroup"

#       read_groups = yes

#       read_profiles = yes

# Remove stale session if checkrad does not see a double login

delete_stale_sessions = yes

# Write SQL queries to a logfile. This is potentially useful for tracing

# issues with authorization queries.

#       logfile = ${logdir}/sqllog.sql

#       sql1 {

#           ...

#           pool {

#                ...

#           }

#       }

#

#       # sql2 will use the connection pool from sql1

#       sql2 {

#            ...

#            pool = sql1

#       }

#

pool {

start = ${thread[pool].start_servers}

min = ${thread[pool].min_spare_servers}

max = ${thread[pool].max_servers}

spare = ${thread[pool].max_spare_servers}

uses = 0

retry_delay = 30

lifetime = 0

idle_timeout = 60

}

#       read_clients = yes

client_table = "nas"

#       group_attribute = "${.:instance}-SQL-Group"

group_attribute = "SQL-Group"

$INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf

}

4)       在mods-enabled文件夹中做mods-available/sql的软连接

sql -> ../mods-available/sql

5)       切换到oracle用户，进入到mods-config/sql/main/oracle目录下，运行schema.sql脚本，创建应用表。

四、radius维护

1、  停机重启

1）  重启数据库

切换到oracle账户

#su - oracle

$sqlplus / as sysdba

SQL>startup

启动监听

$lsnrctl start

检查监听状态，有显示红字部分即为正常。

$lsnrctl status

LSNRCTL for Linux: Version 11.2.0.4.0 - Production on 20-AUG-2015 10:27:27

Copyright (c) 1991, 2013, Oracle.  All rights reserved.

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=Radius)(PORT=1521)))

STATUS of the LISTENER

------------------------

Alias                     LISTENER

Version                   TNSLSNR for Linux: Version 11.2.0.4.0 - Production

Start Date                20-AUG-2015 10:20:15

Uptime                    0 days 0 hr. 7 min. 12 sec

Trace Level               off

Security                  ON: Local OS Authentication

SNMP                      OFF

Listener Parameter File   /u01/app/oracle/product/11.2.4/network/admin/listener.ora

Listener Log File         /u01/app/oracle/diag/tnslsnr/Radius/listener/alert/log.xml

Listening Endpoints Summary...

(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=Radius)(PORT=1521)))

(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521)))

Services Summary...

Service "radiusdb" has 1 instance(s).

Instance "radiusdb", status READY, has 1 handler(s) for this service...

Service "radiusdbXDB" has 1 instance(s).

Instance "radiusdb", status READY, has 1 handler(s) for this service...

The command completed successfully

切换为root账户，执行radiusd启动radius服务

#radiusd

检查1812、1813端口是否存在

#netstat –lntup|grep 1812

如果存在即为正常，如果失败检查/usr/local/var/log/radius/radius.log日志文件