FreeRADIUS Server 架設 for Rocky Linux 8.6
廢話不多說，此版本完全照著做，就可以透過802.1x 進行無線網路驗證，只是驗證的是user這個檔案的帳號清單，有點雞肋，有空再來補一篇 Join AD Domain 文章。
# dnf -y install httpd php
# dnf -y install php-{cli,curl,mysqlnd,devel,gd,pear,mbstring,xml,pear}
# pear install DB
# pear install MDB2
# yum install mariadb-server
# systemctl start mariadb
# systemctl status mariadb
# systemctl enable mariadb.service
# mysql -u root
設定root密碼
MariaDB [(none)]> update mysql.user set password=password('123456') where User="root" and Host="localhost";
MariaDB [(none)]> flush privileges;
MariaDB [(none)]> CREATE DATABASE radius;
MariaDB [(none)]> GRANT ALL ON radius.* TO radius@localhost IDENTIFIED BY "StrongradIusPass";
MariaDB [(none)]> FLUSH PRIVILEGES;
MariaDB [(none)]> quit
安裝 FreeRADIUS 套件
# dnf install -y freeradius freeradius-utils freeradius-mysql
# systemctl enable --now radiusd.service
# systemctl status radiusd.service
# firewall-cmd --add-service=radius --permanent
# firewall-cmd --reload
# mysql -u root -p radius < /etc/raddb/mods-config/sql/main/mysql/schema.sql
# ln -s /etc/raddb/mods-available/sql /etc/raddb/mods-enabled/
# vim /etc/raddb/mods-available/sql
把內容全部清空後，複製貼上如下內容
---------------------------------------------------------------------------------------------------------
sql {
driver = "rlm_sql_mysql"
dialect = "mysql"
# Connection info:
server = "localhost"
port = 3306
login = "radius"
password = "StrongradIusPass"
# Database table configuration for everything except Oracle
radius_db = "radius"
}
# Set to ‘yes’ to read radius clients from the database (‘nas’ table)
# Clients will ONLY be read on server startup.
read_clients = yes
# Table to keep radius client info
client_table = "nas"
---------------------------------------------------------------------------------------------------------
# chgrp -h radiusd /etc/raddb/mods-enabled/sql
查看 FreeRADIUS 版本
# radiusd -v
檢查設定檔是否有 Bug 錯誤
# radiusd -X
重新啟動服務
# systemctl restart radiusd
修改 clients.conf: (這個檔案主要是限制哪些client可以使用FreeRADIUS server)
# vi /etc/raddb/clients.conf
client private-network {
ipaddr = 10.1.0.0/16
secret = testing123
}
建立使用者帳號：
# vi /etc/raddb/users
user01 Cleartext-Password := "123456"
Reply-Message := "Hello, %{User-Name}"
---------------------------------------------------------------------------------------------------------
紀錄身分驗證登入成功及失敗 Log
# vi /etc/raddb/radiusd.conf
auth = yes
重啟服務
# systemctl restart radiusd.service
---------------------------------------------------------------------------------------------------------
從本機驗證
# radtest user01 123456 localhost 1812 testing123
從遠端機器驗證：
# radtest user01 123456 10.1.0.111 1812 testing123
查看 Log
# vi /var/log/radius/radius.log
---------------------------------------------------------------------------------------------------------
接下來就可以找台AP，設定 WPA-Enterprise 模式、RAIDUS Server 伺服器位址、輸入密文 testing123
然後使用 NB 開啟無線網路連線到此SSID ，輸入完成帳密，就可以透過DHCP派發IP下來了
留言