Ubuntu中使用freeradius配置RADIUS，并在RADIUS中配置LDAP 并实现AP认证

小灰灰 2023-06-06 08:23 12阅读 0赞

执行 sudo apt-get install freeradius freeradius-ldap freeradius-mysql进行安装freeradius

安装完成之后，他会自己启动，需要手动关闭，不然后面会报错，或者直接简单粗暴从任务管理器中kill相关进程也行

service freeradius stop

修改/etc/freeradius/3.0/sites-enabled/default的配置信息，找到如下内容，如果你的ldap是注释状态，你需要把注释去掉，保存退出。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzIyNTQzOTkx_size_16_color_FFFFFF_t_70][]

随后修改文件/etc/freeradius/3.0/mods-available/ldap

ldap {
            server = '192.168.9.9'    #ldap服务器
            port = 389  #端口
            identity = 'cn=admin,dc=isyscore,dc=com'
            password = lululu
            base_dn = 'ou=People,dc=isyscore,dc=com'
            sasl {
            }
            update {
                    control:Password-With-Header    += 'userPassword'
                    control:NT-Password             := 'sambaNTPassword'  #必须要加 不然AP 无法通过认证
                    control:                        += 'radiusControlAttribute'
                    request:                        += 'radiusRequestAttribute'
                    reply:                          += 'radiusReplyAttribute'
            }
            user {
                    base_dn = "${..base_dn}"
                    filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
                    sasl {
                    }
            }
            group {
                    base_dn = "${..base_dn}"
                    filter = '(objectClass=posixGroup)'
                    membership_attribute = 'memberOf'
            }
            profile {
            }
            client {
                    base_dn = "${..base_dn}"
                    filter = '(objectClass=radiusClient)'
                    template {
                    }
                    attribute {
                            ipaddr                          = 'radiusClientIdentifier'
                            secret                          = 'radiusClientSecret'
                    }
            }
            accounting {
                    reference = "%{tolower:type.%{Acct-Status-Type}}"
                    type {
                            start {
                                    update {
                                            description := "Online at %S"
                                    }
                            }
                            interim-update {
                                    update {
                                            description := "Last seen at %S"
                                    }
                            }
                            stop {
                                    update {
                                            description := "Offline at %S"
                                    }
                            }
                    }
            }
            post-auth {
                    update {
                            description := "Authenticated at %S"
                    }
            }
            options {
                    chase_referrals = yes
                    rebind = yes
                    res_timeout = 10
                    srv_timelimit = 3
                    net_timeout = 1
                    idle = 60
                    probes = 3
                    interval = 3
                    ldap_debug = 0x0028
            }
            tls {
            }
            pool {
                    start = ${thread[pool].start_servers}
                    min = ${thread[pool].min_spare_servers}
                    max = ${thread[pool].max_servers}
                    spare = ${thread[pool].max_spare_servers}
                    uses = 0
                    retry_delay = 30
                    lifetime = 0
                    idle_timeout = 60
            }
    }

新建文件/etc/freeradius/3.0/sites-available/site\_ldap

server site_ldap{
            listen{
                    ipaddr=0.0.0.0
                    port=1833
                    type=auth
            }
            authorize{
                    update{
                            control:Auth-Type := ldap
                    }
            }
            authenticate{
                    Auth-Type ldap{
                            ldap
                    }
            }
            post-auth{
                    Post-Auth-Type Reject{
                    }
            }
    }

之后进行软连接

sudo ln -s /etc/freeradius/3.0/sites-available/site\_ldap /etc/freeradius/3.0/sites-enabled/

然后启动RADIUS服务，sudo freeradius x

如果有问题可以开启debug模式查看freeradius -X

接入AP

接入AP 需要共享密钥，该值在clients.conf里设置

/etc/freeradius/3.0/clients.conf

secret = lululu

并允许所有ipv4接入

ipv4addr = \*

之后再AP web控制台创建无线网络 选择加密方式 wpa 企业级

选择radius配置

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzIyNTQzOTkx_size_16_color_FFFFFF_t_70 1][]

之后通过wifi登录即可

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzIyNTQzOTkx_size_16_color_FFFFFF_t_70]: /images/20230601/2f5a2f4dc1324489b71361ff30459cbc.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzIyNTQzOTkx_size_16_color_FFFFFF_t_70 1]: /images/20230601/31747e1ea66a450eb079c05be6927d0a.png