freeRADIUS + openLDAP 安装和配置

说明：这篇文章只是记录小弟我在学习freeRADIUS的过程，由于我是刚刚学习到这方面的知识，大部分都是在网上网友的博客日志中找到的，看得实在太多了，我实在是不知道到底是从谁的博客中学习来的，所以，引用也不知道从哪位大哥记起，干脆就不写了，还望海涵。

################## INSTALL openLDAP#########################

对于下面的参数 我都简写了，<openssl>代表相应版本的全称

1. install openssl

#tar xzvf <openssl.tar>

#cd <openssl>

#./config shared zlib

#make

#make test

#make install

首先将原来的openssl失效

#mv /usr/bin/openssl /usr/bin/openssl.OFF

#mv /usr/include/openssl /usr/include/openssl.OFF

使新安装的openssl生效

#ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl

#ln -s /usr/local/ssl/include/openssl /usr/include/openssl

setup path for searching

# echo "/usr/local/ssl/lib" >> /esc/ld.so.conf

#ldconfig -v

2 install SASL

#tar xzvf <>

#cd <>

#./configure --prefix=/usr/local/sasl2 --enable-login --with-openssl=/usr/local/ssl

#make ; make install

#echo "/usr/local/sasl2/lib" >> /etc/ld.so.conf

#echo "/usr/local/sasl2/lib/sasl2" >> /etc/ld.so.conf

#ldconfig -v

#rm -rf /usr/lib/libsasl*

#ln -s /usr/local/sasl2/lib/* /usr/lib

一定要新建目录这是sasl运行中需要的设置

#mkdir -pv /var/state/saslauthd

#saslauthd -a shadow

#testsaslauthd -u root -p rootPWD

验证你的本地帐户

<should see OK SUCCESS>

3. install BerkeleyDB <4.6>

#tar <>

#cd db<>/build_unix

#..dist/configure --prefix=/usr/local/BerkeleyDB

#make&&make install

在安装openLDAP模块化的功能时需要这个东西libtool

* install libtool

first install the *.rpm from CD;

#cd /usr/share/libtool/libltdl

#./configure

#make && make install

4.install openLDAP

#tar <>

#cd <>

# env CPPFLAGS="-I/usr/local/BerkeleyDB/include -I/usr/local/sasl2/include" LDFLAGS="-L/usr/local/BerkeleyDB/lib -L/usrllocal/sasl2/lib -L/usr/local/sasl2/lib/sasl2" ./configure --

prefix=/usr/local/openldap --sysconfdir=/etc/openldap --enable-passwd --disable-ipv6 --enable-spasswd --enable-crypt --enable-modules --enable-accesslog=yes --enable-ldap=mod --

enable-meta=mod --enable-rewrite=yes --with-proxycache=yes --enable-rwm=yes --enable-dynamic

#make depend

#make

#make test

#make install

说明：小弟在test的过程中一直发现有一个问题：second site1 not backend to the central master 什么的，但是也不影响后面的使用，也可能是我现在还没有使用到这个

功能。如有人知道一定告诉小弟。

######################################install freeRADIUS#############################

这个安装比较简单，就不说了。

################## configure for openLDAP + freeRADIUS #################

# cp /usr/local/share/doc/freeradius/examples/openldap.schema /etc/openldap/openldap/schema/radius.schema

#gedit /etc/openldap/openldap/slapd.conf

一下是包含一定的schema文件，我的理解是：包含一定的定义结构体的文件。

include /etc/openldap/openldap/schema/core.schema

include /etc/openldap/openldap/schema/cosine.schema

include /etc/openldap/openldap/schema/ppolicy.schema

include /etc/openldap/openldap/schema/misc.schema

include /etc/openldap/openldap/schema/corba.schema

include /etc/openldap/openldap/schema/collective.schema

include /etc/openldap/openldap/schema/radius.schema

定义数据库

database bdb

suffix "dc=example,dc=com"

rootdn "cn=Manager,dc=example,dc=com"

# Cleartext passwords, especially for the rootdn, should

# be avoid. See slappasswd(8) and slapd.conf(5) for details.

# Use of strong authentication encouraged.

rootpw secret

# The database directory MUST exist prior to running slapd AND

# should only be accessible by the slapd and slap tools.

# Mode 700 recommended.

directory /usr/local/openldap/var/openldap-data

# Indices to maintain

index objectClass eq

index uid eq

2. add entry

start slapd

#/usr/local/openldap/libexec/slapd

addentry.ldif

-------------------------------------

dn:dc=example,dc=com

objectclass:dcObject

objectclass:organization

o: example_O

dc:example

dn:cn=Manager,dc=example,dc=com

objectclass:organizationalRole

cn:Manager

--------------------------------------

#ldapadd -x -D "cn=Manager,dc=intel,dc=com" -W -f addentry.ldif

users

adduser.ldif

-------------------------------------

dn:uid=test,dc=example,dc=com

objectclass:account

objectclass:simpleSecurityObject

objectclass:radiusprofile

uid:test

userPassword:test

cn:test

dn:uid=hello,dc=example,dc=com

objectclass:account

objectclass:simpleSecurityObject

objectclass:radiusprofile

uid:hello

userPassword:hello

cn:hello

-------------------------------------

#ldapadd -x -D "cn=Manager,dc=example,dc=com" -W -f adduser.ldif

#ldapsearch -x -b "dc=example,dc=com" '(objectclass=*)'

#################################configure freeRadius ###########################

#gedit /usr/local/etc/raddb/modules/ldap

ldap{

server = "127.0.0.1"

identity = "cn=Manager,dc=example,dc=com"

password = secret

basedn = "dc=example,dc=com"

filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"

password_attribute = userPassword

}

# gedit /usr/local/etc/raddb/sites-enabled/default

authorize{

#insert the item

ldap

}

authenticate{

#insert this item

Auth-Type LDAP {

ldap

}

}

#gedit /usr/local/etc/raddb/clients.conf

#insert the item

client 192.168.0.0/24 {

secret = testing123-1

shortname = private-network-1

}

#gedit /usr/local/etc/raddb/proxy.conf

insert the following

realm NULL{

type = radius

authhost = LOCAL

accthost = LOCAL

nostrip

}

realm example.com{

type = radius

authhost = LOCAL

accthost = LOCAL

}

#radiusd -X

#radtest hello hello localhost 0 testing123