freeradius安装和配置

谁借莪１个温暖的怀抱￠ 2022-09-22 14:00 562阅读 0赞

## freeradius安装和配置 ##

<table> 
 <tbody> 
 <tr> 
 <td>标签： <h3><a href="http://search.sina.com.cn/?c=blog&amp;q=radiusd&amp;by=tag" rel="nofollow">radiusd</a></h3> <h3><a href="http://search.sina.com.cn/?c=blog&amp;q=-x&amp;by=tag" rel="nofollow">-x</a></h3> <h3><a href="http://search.sina.com.cn/?c=blog&amp;q=radtest&amp;by=tag" rel="nofollow">radtest</a></h3> <h3><a href="http://search.sina.com.cn/?c=blog&amp;q=radiusd.conf&amp;by=tag" rel="nofollow">radiusd.conf</a></h3> <h3><a href="http://search.sina.com.cn/?c=blog&amp;q=radius.log&amp;by=tag" rel="nofollow">radius.log</a></h3> <h3><a href="http://search.sina.com.cn/?c=blog&amp;q=clients.conf&amp;by=tag" rel="nofollow">clients.conf</a></h3> </td> 
 <td>分类：<a href="http://blog.sina.com.cn/s/articlelist_1632737354_9_1.html" rel="nofollow">UNIX安全</a></td> 
 </tr> 
 </tbody> 
</table>

**注意：freeradius装完非常大，有几百兆**  
  
      **软件准备**

<table style="width:80%"> 
 <tbody> 
 <tr> 
 <td>[root@nm freeradius-server-2.1.1]# rpm -qa | grep openssl openssl-0.9.7a-43.10 openssl-devel-0.9.7a-43.10 xmlsec1-openssl-1.2.6-3</td> 
 </tr> 
 <tr> 
 <td>[root@vmmac fprobe-1.1]# rpm -qa | grep ldap openldap-2.2.13-6.4E openldap-devel-2.2.13-6.4E openldap-clients-2.2.13-6.4E nss_ldap-226-13 openldap-servers-2.2.13-6.4E</td> 
 </tr> 
 <tr> 
 <td>freeradius-server-2.1.1.tar.gz</td> 
 </tr> 
 </tbody> 
</table>

**freeradius 安装**

<table style="width:100%"> 
 <tbody> 
 <tr> 
 <td>[root@nm freeradius-server-2.1.1]# ./configure configure: creating ./config.status config.status: creating Makefile config.status: creating config.h 会装很长时间，接近1小时</td> 
 </tr> 
 <tr> 
 <td>[root@nm freeradius-server-2.1.1]# make Making all in rfc... gmake[4]: Entering directory`/usr/local/src/freeradius-server-2.1.1/doc/rfc' gmake[4]: Nothing to be done for `all'. gmake[4]: Leaving directory`/usr/local/src/freeradius-server-2.1.1/doc/rfc' gmake[3]: Leaving directory`/usr/local/src/freeradius-server-2.1.1/doc' gmake[2]: Leaving directory`/usr/local/src/freeradius-server-2.1.1/doc' gmake[1]: Leaving directory`/usr/local/src/freeradius-server-2.1.1'</td> 
 </tr> 
 <tr> 
 <td>[root@nm freeradius-server-2.1.1]# make install done gmake[4]: Leaving directory`/usr/local/src/freeradius-server-2.1.1/doc/rfc' gmake[3]: Leaving directory`/usr/local/src/freeradius-server-2.1.1/doc' gmake[2]: Leaving directory`/usr/local/src/freeradius-server-2.1.1/doc' gmake[1]: Leaving directory`/usr/local/src/freeradius-server-2.1.1' Installing dictionary files in /usr/local/share/freeradius /usr/local/src/freeradius-server-2.1.1/libtool --finish/usr/local/lib PATH="$PATH:/sbin" ldconfig -n /usr/local/lib</td> 
 </tr> 
 </tbody> 
</table>

**安装后的第一次运行radiusd -X**  
**安装后可以不进行任何配置，直接起daemon,直接进行loopback测试。**  
因为radius缺省配置就是支持本地daemon,本地client(loopback client)

<table style="width:80%"> 
 <tbody> 
 <tr> 
 <td>The first time after installation, you should run the serveras "root".&nbsp; Thiswill cause the server to create the certificatesit needs for EAP. &nbsp;第一次启动，应该在root下运行radiusd-X这将使server建立EAP所需的 certificates $ radiusd –X&nbsp; 注意是大写X</td> 
 </tr> 
 <tr> 
 <td>Once that is done, the server can be run from an unpriviledgeduser account. &nbsp;&nbsp;这个步骤做完后，server就能从非特权用户启动了</td> 
 </tr> 
 </tbody> 
</table>

<table style="width:100%"> 
 <tbody> 
 <tr> 
 <td>[root@nm local]# radiusd -X FreeRADIUS Version 2.1.1, for host i686-pc-linux-gnu, built on Oct29 2008 at 10:27:47 Copyright (C) 1999-2008 The FreeRADIUS server project andcontributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FORA PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms ofthe GNU General Public License v2. Starting - reading configuration files ... including configuration file/usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file/usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ 。。。 Listening on authenticationaddress * port 1812 Listening on accounting address *port 1813 Listening on proxy address * port1814 Ready to processrequests.</td> 
 </tr> 
 <tr> 
 <td>从另一个窗口 看log [root@nm ~]# cat /usr/local/var/log/radius/radius.log Wed Oct 29 11:23:25 2008 : Error: rlm_eap: SSL errorerror:02001002:system library:fopen:No such file or directory Wed Oct 29 11:23:25 2008 : Error: rlm_eap_tls: Error readingcertificate file /usr/local/etc/raddb/certs/server.pem Wed Oct 29 11:23:25 2008 : Error: rlm_eap: Failed to initializetype tls Wed Oct 29 11:23:25 2008 : Error:/usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module"eap" Wed Oct 29 11:23:25 2008 : Error:/usr/local/etc/raddb/sites-enabled/inner-tunnel[223]: Failed tofind module "eap". Wed Oct 29 11:23:25 2008 : Error:/usr/local/etc/raddb/sites-enabled/inner-tunnel[176]: Errorsparsing authenticate section. Wed Oct 29 11:23:25 2008 : Error: Errors initializing modules 初次起动会出eap error</td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top">随后再重起一次radiusd，不加-X [root@nm local]# radiusd &amp; [1] 2419</td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top">从另一个窗口看log [root@nm ~]# cat /usr/local/var/log/radius/radius.log 再次启动就只有一条新log,没有error了 Wed Oct 29 13:09:48 2008 : Info: Ready to process requests.</td> 
 </tr> 
 </tbody> 
</table>

**  radius 启动的特征**

<table style="width:100%"> 
 <tbody> 
 <tr> 
 <td>[root@nm ~]# ps -ef | grep radiusd root&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;2420&nbsp;&nbsp;&nbsp;&nbsp;1&nbsp; 0 13:10?&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;00:00:00 radiusd</td> 
 </tr> 
 <tr> 
 <td>[root@nm ~]# netstat -an Active Internet connections (servers and established) Proto Recv-Q Send-Q LocalAddress&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ForeignAddress&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;State&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;00.0.0.0:21&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0.0.0.0:*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;LISTEN&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;00.0.0.0:23&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0.0.0.0:*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;LISTEN&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;010.4.3.117:23&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;10.4.3.119:1058&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ESTABLISHED tcp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;&nbsp;&nbsp; 14610.4.3.117:23&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;10.4.3.119:4471&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ESTABLISHED tcp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0:::80&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:::*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;LISTEN&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0:::22&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:::*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;LISTEN&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0:::443&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:::*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;LISTEN&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0::ffff:10.4.3.117:22&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;::ffff:10.4.3.119:4488&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ESTABLISHED udp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;00.0.0.0:1812&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0.0.0.0:*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; udp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;00.0.0.0:1813&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0.0.0.0:*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; udp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;00.0.0.0:1814&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0.0.0.0:*&nbsp;&nbsp;</td> 
 </tr> 
 </tbody> 
</table>

**  loopback测试——radtest**

<table style="width:100%"> 
 <tbody> 
 <tr> 
 <td>radtest [-d raddb_directory] user password radius-servernas-port-number secrect</td> 
 </tr> 
 <tr> 
 <td>nas-port-number:用不到，就为0即可 secret:就是在client.conf里的对应client的口令（radius安装完后，本地client127.0.0.1的口令缺省就是testing123）</td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top">[root@nm ~]# radtest test testlocalhost 0 testing123 Sending Access-Request ofid 48 to 127.0.0.1 port 1812 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;User-Name = "test" &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;User-Password = "test" &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;NAS-IP-Address = 127.0.0.1 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;NAS-Port = 0 rad_recv: Access-Rejectpacket from host 127.0.0.1 port 1812, id=48, length=20 尽管user,passwd都是假的，但只要收到Access-Reject，也证明FreeRADIUS服务器已经正常启动</td> 
 </tr> 
 </tbody> 
</table>

**freeradius自带system V 启动文档**

<table style="width:100%"> 
 <tbody> 
 <tr> 
 <td>[root@vm ~]# cp /usr/local/sbin/rc.radiusd/etc/init.d/radius</td> 
 </tr> 
 <tr> 
 <td>[root@vm ~]# /etc/init.d/radius Usage: /etc/init.d/ {start|stop|reload|restart|check} [root@vm ~]# /etc/init.d/radius start Starting FreeRADIUS:radiusd</td> 
 </tr> 
 <tr> 
 <td>[root@vm rc3.d]# ln -s../init.d/radius S96radius [root@vm rc3.d]# ls -l lrwxrwxrwx&nbsp; 1 root root 14 Feb 23 13:32 S39ldap-&gt; ../init.d/ldap* lrwxrwxrwx&nbsp; 1 root root 16 Feb 27 09:06 S96radius-&gt; ../init.d/radius*</td> 
 </tr> 
 </tbody> 
</table>

**RADIUS 服务器的配置包括：**

*     radiusd.conf    服务器端配置
 *     clients.conf     存储radius客户端（NAS,ROUTER）的验证信息，**主要是配KEY**
 *     ./modules/      主要是针对LDAP，MYSQL、数字证书等的配置

<table style="width:100%"> 
 <tbody> 
 <tr> 
 <td>1．radiusd.conf 没什么可改的，都是系统的一些属性配置（目录啊、PID啊、LOG啊等等） [root@vmmac ~]# vi /usr/local/etc/raddb/radiusd.conf prefix = /usr/local exec_prefix = ${prefix} sysconfdir =${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir =${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct #user = radius #group = radius 缺省此两句被注释掉，是root启动daemon 如果radius认证不采用本地认证（/etc/passwd）的话，强烈建议采用radius 用户启动daemon max_requests = 1024 缺省1024，此值太小会造成大量认证时的busy,此值太大会耗内存 listen { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;type =auth&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Listen认证 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ipaddr = * &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;port =0&nbsp;&nbsp;&nbsp;&nbsp; Port 0表示会listen在/etc/service下的端口定义（1812） } listen { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;type =acct&nbsp;&nbsp;&nbsp;&nbsp;Listen记帐 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ipaddr = * &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;port = 0 } log { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp; Destination for log messages： &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;files - log to "file", as definedbelow. &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;syslog - to syslog (see also the"syslog_facility", below. &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;stdout - standard output &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;stderr - standard error. &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;destination = files &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;file = ${logdir}/radius.log &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp; Which syslog facility to use, if ${destination}== "syslog" &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;syslog_facility = daemon &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp; Log authentication requests to the logfile. &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;auth = yes &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;auth_badpass = yes &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;auth_goodpass = yes $INCLUDE clients.conf 实际clients.conf也是radiusd.conf的一部分，只不过分出去了。 modules { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$INCLUDE ${confdir}/modules/ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$INCLUDE eap.conf &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$INCLUDE sql.conf &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$INCLUDE sql/mysql/counter.conf }</td> 
 </tr> 
 <tr> 
 <td>2. clients.conf ，定义NAS，主要是设KEY，主要是改clients.conf [root@vmmac ~]# vi /usr/local/etc/raddb/clients.conf client 10.4.193.26{ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;secret=admin123 Secret的意思：Radiusaaa与NAS之间的key传送是密文，而且传的不是口令，而是MD5计算结果 } client 10.4.3.150{ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;secret=admin123 } client localhost { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ipaddr = 127.0.0.1 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;secret&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=testing123 } #client 192.168.0.0/24{ 设网段，这样可以方便多台NAS，且NAS填加的时候不用反复改clients.conf #&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;secret&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;= testing123-1 #&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;shortname&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;= private-network-1 #} # #client 192.168.0.0/16 { #&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;secret&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;= testing123-2 #&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;shortname&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;= private-network-2 #}&nbsp;&nbsp;&nbsp; &nbsp;</td> 
 </tr> 
 </tbody> 
</table>

**发觉radius.conf中没有设认证方式的地方**  
**缺省就是local**  
**访问radius就是自动读/etc/passwd or/etc/shadow**  
然后读ldap,mysql等,这些 conf也都事先include了,就看你设没设了.  
  
      **如果radius.conf和ldap合作,有把握不读local(/etc/passwd),那么daemon可以直接用radius用户启动，而不是root启动**

<table style="width:80%"> 
 <tbody> 
 <tr> 
 <td>[root@vmmac ~]# vi /usr/local/etc/raddb/radiusd.conf user = radius group = radius</td> 
 </tr> 
 </tbody> 
</table>

启动报错问题：  
\[root@szwlan1 freeradius-server-2.2.0\]\# radiusd -X  
。。。。。  
Could not link driver rlm\_sql\_mysql: rlm\_sql\_mysql.so: cannot open shared object file: No such file or directory  
Make sure it (and all its dependent libraries!) are in the search path of your system's ld.  
/usr/local/etc/raddb/sql.conf\[22\]: Instantiation failed for module "sql"  
/usr/local/etc/raddb/sites-enabled/default\[177\]: Failed to find "sql" in the "modules" section.  
/usr/local/etc/raddb/sites-enabled/default\[69\]: Errors parsing authorize section.  
  
解决

先找到/usr/local/etc/raddb/radiusd.conf，看看$INCLUDEsql.conf前的注释是否去掉，若去掉还不行就按一下方法做。

1.如果你是使用mysql源码编辑方式安装的mysql，应该不会出现这个问题，如果你是用类似rpm模式安装的mysql，那么默认是不会安装rlm\_sql\_mysql.so的，如果需要这个文件就要补充安装mysql-devel-\*\*\*\*.rpm

2.上网址：[http://dev.mysql.com/doc/refman/5.1/en/linux-rpm.html][http_dev.mysql.com_doc_refman_5.1_en_linux-rpm.html]下载该包。

3.到源代码树：freeradius-server\*\*\*\*/src/modules/rlm\_sql/drivers/rlm\_sql\_mysql里再进行编译,之后会在freeradius-server-2.1.1/src/modules/rlm\_sql/drivers/lib中生成rlm\_sql\_mysql.so，把它拷贝到/usr/lib下即可”

rlm\_sql\_mysql-2.2.0.la  
rlm\_sql\_mysql-2.2.0.so  
rlm\_sql\_mysql.a  
rlm\_sql\_mysql.la  
rlm\_sql\_mysql.so  
到  
/usr/local/lib  
  
  
  
Could not link driver rlm\_sql\_mysql: libperconaserverclient.so.18: cannot open shared object file: No such file or directory  
Make sure it (and all its dependent libraries!) are in the search path of your system's ld.  
/usr/local/etc/raddb/sql.conf\[22\]: Instantiation failed for module "sql"  
/usr/local/etc/raddb/sites-enabled/default\[177\]: Failed to find "sql" in the "modules" section.  
/usr/local/etc/raddb/sites-enabled/default\[69\]: Errors parsing authorize section.  
  
拷贝libperconaserverclient.so.18 到/usr/lib64/下

[http_dev.mysql.com_doc_refman_5.1_en_linux-rpm.html]: http://dev.mysql.com/doc/refman/5.1/en/linux-rpm.html