LMS知識社群各系上網率圖資處首頁登入
位置: 洪瑞展 > 000_伺服器管理 > 認證服務架設
CentOS 7 FreeRADIUS + daloRadius
by 洪瑞展 2017-09-26 10:12:35, 回應(0), 人氣(3499)
# SELinux設定
# "暫時"關閉SELinux
 sudo setenforce 0
# "直接"關閉SELinux
 sudo vi /etc/sysconfig/selinux
# 將SELINUX由enforcing改為disabled儲存
 SELINUX=disabled
# 修改後重新啟動
 reboot


1. 安裝http

# 更新並安裝http
 yum -y update
 yum groupinstall "Development Tools" -y
 yum -y install httpd httpd-devel epel-release
 rpm -Uvh http://rpms.famillecollet.com/enterprise/remi-release-7.rpm

# 設定開機自動執行與啟用服務
 systemctl enable httpd
 systemctl start httpd

# 確認服務狀態為Active: active (running) 
 systemctl status httpd

2. 安裝MariaDB

# 安裝MariaDB
yum install -y mariadb-server mariadb

# 設定開機自動執行與啟用服務
 systemctl start mariadb
 systemctl enable mariadb

# 確認服務狀態為Active: active (running) 
 systemctl status mariadb

# 設定MariaDB
[root@Radius ~]# mysql_secure_installation

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we'll need the current
password for the root user.  If you've just installed MariaDB, and
you haven't set the root password yet, the password will be blank,
so you should just press enter here.

Enter current password for root (enter for none): (按Enter)
OK, successfully used password, moving on...

Setting the root password ensures that nobody can log into the MariaDB
root user without the proper authorisation.

Set root password? [Y/n] Y
New password: 輸入要設定的Mariadb root密碼
Re-enter new password: 輸入要設定的Mariadb root密碼
Password updated successfully!
Reloading privilege tables..
 ... Success!


By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n] Y
 ... Success!

Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n] Y
 ... Success!

By default, MariaDB comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n] Y
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n] Y
 ... Success!

Cleaning up...

All done!  If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!

#設定MariaDB安全性
#由於是Radius Server 所以我們可以設定MariaDB只允許本機連線
vim /etc/my.cnf 
#在[mysqld]下方加入下方項目：
 bind-address=127.0.0.1

3. 新增FreeRADIUS資料庫，名稱為radius
 mysql -u root -p -e " CREATE DATABASE radius"
 mysql -u root -p -e "show databases"
 mysql -u root -p 
 MariaDB [(none)]> GRANT ALL ON radius.* TO radius@localhost IDENTIFIED BY "radius資料庫密碼";
 MariaDB [(none)]> FLUSH PRIVILEGES;
 MariaDB [(none)]> exit

4. 安裝PHP 7

#安裝PHP 7
 cd ~
 curl 'https://setup.ius.io/' -o setup-ius.sh
 sudo bash setup-ius.sh
 sudo yum remove php-cli mod_php php-common
 yum --enablerepo=remi-php74 install mod_php php-cli php-mysqlnd php-devel php-gd php-mcrypt php-mbstring php-xml php-pear php-pear-DB -y
 sudo apachectl restart

#查詢PHP版本
 php -v

5. 安裝FreeRADIUS

#安裝FreeRADIUS
 yum -y install freeradius freeradius-utils freeradius-mysql

# 設定開機自動執行與啟用服務
 systemctl start radiusd
 systemctl enable radiusd

# 確認服務狀態為Active: active (running) 
 systemctl status radiusd

6. 設定防火牆

# 設定開機自動執行與啟用服務
 systemctl enable firewalld
 systemctl start firewalld

# 設定http、https、radius可以通過防火牆
 firewall-cmd --add-service={http,https,radius} --permanent

# 重新讀取設定 
 firewall-cmd --reload

# 檢查防火牆設定是否正確
[root@Radius ~]# firewall-cmd --list-services --zone=public 
ssh dhcpv6-client http https radius

7. 設定FreeRADIUS

# 停止radiusd服務
 systemctl stop radiusd

# 將radiusd資料庫導入MariaDB
 mysql -u root -p radius < /etc/raddb/mods-config/sql/main/mysql/schema.sql

# 建立資料庫連結
 ln -s /etc/raddb/mods-available/sql /etc/raddb/mods-enabled/

# 修改設定
 vim /etc/raddb/mods-available/sql

=============================

sql {
  driver = "rlm_sql_mysql"
  dialect = "mysql"
  # Connection info:
  server = "localhost" 
  port = 3306
  login = "radius"
  password = "資料庫密碼"
# Database table configuration for everything except Oracle
  radius_db = "radius"
}

# Set to ‘yes’ to read radius clients from the database (‘nas’ table)
# Clients will ONLY be read on server startup.
  read_clients = yes

# Table to keep radius client info
  client_table = “nas”

=============================

# 變更檔案群組 
 chgrp -h radiusd /etc/raddb/mods-enabled/sql

# 設定允許接收認證\的來源
 vim /etc/raddb/clients.conf

# 新增來源格式如下：
#client 來源名稱 {
#        ipaddr          = 來源IP或網段
#        secret          = 密碼
#        shortname    = 名稱
#}

client ArubaSW {
        ipaddr          = 10.5.5.5
        secret          = iPass
        shortname    = SwtichSW
}

8. 安裝daloradius

# 下載檔案與解壓縮
 wget https://github.com/lirantal/daloradius/archive/master.zip
 unzip master.zip
 mv daloradius-master/ daloradius
 cd daloradius

# 將daloRadius資料庫導入MariaDB
 mysql -u root -p radius < contrib/db/fr2-mysql-daloradius-and-freeradius.sql
 mysql -u root -p radius < contrib/db/mysql-daloradius.sql

# 複製目錄至/var/www/html/並設定權限
 cd ..
 mv daloradius /var/www/html/
 chown -R apache:apache /var/www/html/daloradius/
 chcon -R -t httpd_sys_content_t /var/www/html/daloradius/
 chmod 664 /var/www/html/daloradius/library/daloradius.conf.php
 chmod 755 /var/log/radius
 chmod 755 /var/log/radius/radius.log

# 設定daloRadius
 vim /var/www/html/daloradius/library/daloradius.conf.php

$configValues['CONFIG_DB_HOST'] = 'localhost';
$configValues['CONFIG_DB_PORT'] = '3306';
$configValues['CONFIG_DB_USER'] = 'radius';
$configValues['CONFIG_DB_PASS'] = '資料庫密碼';
$configValues['CONFIG_DB_NAME'] = 'radius';

9. 重新啟動服務
 systemctl restart radiusd.service 
 systemctl restart mariadb.service 
 systemctl restart httpd

10. 測試
 http://IP/daloradius/login.php

 Username: administrator
 Password: radius



#P.S 變更紀錄
#2020/01/07
#安裝PHP 7
# sudo yum -y install mod_php*u php*u-cli php*u-mysqlnd php74u-devel php*-gd php*-mcrypt php*-mbstring php74u-xml php74u-pear php-pear-DB
# sudo yum -y install mod_php php-cli php-mysqlnd php-devel php-gd php-mcrypt php-mbstring php-xml php-pear php-pear-DB