安装 FreeRADIUS

1. 转到 FreeRADIUS 站点 http://www.freeradius.org/，并下载最新版本。

   # cd /usr/local/src # wget ftp://ftp.freeradius.org/pub/radius/freeradius-1.0.0.tar.gz # tar zxfv freeradius-1.0.0.tar.gz # cd freeradius-1.0.0

2. 配置、make 和 install

   # ./configure # make # make install

   您可以将选项传递给 configure。使用 ./configure --help 或阅读 README 文件，以获取更多信息。

配置 FreeRADIUS

1. 配置文件可以在/usr/local/etc/raddb/

   # cd /usr/local/etc/raddb/

2. 下找到打开主配置文件radiusd.conf

   1. ，并阅读注释！在加密的 PEAP 隧道内，使用了 MS-CHAPv2 身份验证机制。

      # under MODULES, make sure mschap is uncommented! mschap { # authtype value, if present, will be used # to overwrite (or add) Auth-Type during # authorization. Normally, should be MS-CHAP authtype = MS-CHAP # if use_mppe is not set to no, mschap will # add MS-CHAP-MPPE-Keys for MS-CHAPv1 and # MS-MPPE-Recv-Key/MS-MPPE-Send-Key for MS-CHAPv2 # use_mppe = yes # if mppe is enabled, require_encryption makes # encryption moderate # require_encryption = yes # require_strong always requires 128 bit key # encryption # require_strong = yes authtype = MS-CHAP # The module can perform authentication itself, OR # use a Windows Domain Controller. See the radius.conf file # for how to do this. }

   2. MPPE [RFC3078] 负责将 PMK 发送到 AP。确保设置以下设置

      authorize { preprocess mschap suffix eap files } authenticate { # # MSCHAP authentication. Auth-Type MS-CHAP { mschap } # # Allow EAP authentication. eap }

3. 还要确保 “authorize” 和 “authenticate” 包含然后，更改clients.conf

   # Here, we specify which network we're serving client 192.168.0.0/16 { # This is the shared secret between the Authenticator (the # access point) and the Authentication Server (RADIUS). secret = SharedSecret99 shortname = testnet }

4. 文件以指定它所服务的网络eap.conf也应该非常简单。

   1. 将 “default_eap_type” 设置为 “peap”

      default_eap_type = peap

   2. 由于 PEAP 使用 TLS，因此 TLS 部分必须包含

      tls { # The private key password private_key_password = SecretKeyPass77 # The private key private_key_file = ${raddbdir}/certs/cert-srv.pem # Trusted Root CA list CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = /dev/urandom }

   3. 找到 “peap” 部分，并确保它包含以下内容

      peap { # The tunneled EAP session needs a default # EAP type, which is separate from the one for # the non-tunneled EAP module. Inside of the # PEAP tunnel, we recommend using MS-CHAPv2, # as that is the default type supported by # Windows clients. default_eap_type = mschapv2 }

5. 用户信息存储在纯文本文件users中。可能首选更复杂的解决方案来存储用户信息（SQL、LDAP、PDC 等）。

   确保users文件包含以下条目

   "testuser" User-Password == "Secret149"

安装 Xsupplicant

1. 从 http://www.open1x.org/ 下载最新源代码

   # cd /usr/local/src # wget http://belnet.dl.sourceforge.net/sourceforge/open1x/xsupplicant-1.0.tar.gz # tar zxfv xsupplicant-1.0.tar.gz # cd xsupplicant

2. 配置、make 和 install

   # ./configure # make # make install

3. 如果配置文件未安装（复制）到“etc”文件夹中，请手动执行

   # mkdir -p /usr/local/etc/1x # cp etc/tls-example.conf /usr/local/etc/1x

配置 Xsupplicant

1. Supplicant 必须有权访问根证书。

   如果 Supplicant 需要针对身份验证服务器进行身份验证（双向身份验证），则 Supplicant 也必须具有证书。

   创建一个证书文件夹，并将证书移动到其中

   # mkdir -p /usr/local/etc/1x/certs # cp root.pem /usr/local/etc/1x/certs/ # (copy optional client certificate(s) into the same folder)

2. 打开并编辑配置文件

   # startup_command: the command to run when Xsupplicant is first started. # This command can do things such as configure the card to associate with # the network properly. startup_command = <BEGIN_COMMAND>/usr/local/etc/1x/startup.sh<END_COMMAND>

   文件以指定它所服务的网络startup.sh将很快创建。

3. 客户端通过身份验证后，它将传输 DHCP 请求或手动设置 IP 地址。在这里，Supplicant 在startup2.sh:

   # first_auth_command: the command to run when Xsupplicant authenticates to # a wireless network for the first time. This will usually be used to # start a DHCP client process. #first_auth_command = <BEGIN_COMMAND>dhclient %i<END_COMMAND> first_auth_command = <BEGIN_COMMAND>/usr/local/etc/1x/startup2.sh<END_COMMAND>

4. 中手动设置其 IP 地址。由于 “-i” 仅用于调试目的（并且可能会根据开发人员的说法而消失），因此必须设置 “allow_interfaces”

   allow_interfaces = eth0 deny_interfaces = eth1

5. 接下来，在 “NETWORK SECTION” 下，我们将配置 PEAP

   # We'll be using PEAP allow_types = eap_peap # Don't want any eavesdropper to learn the username during the # first phase (which is unencrypted), so 'identity hiding' is # used (using a bogus username). identity = <BEGIN_ID>anonymous<END_ID> eap-peap { # As in tls, define either a root certificate or a directory # containing root certificates. root_cert = /usr/local/etc/1x/certs/root.pem #root_dir = /path/to/root/certificate/dir #crl_dir = /path/to/dir/with/crl chunk_size = 1398 random_file = /dev/urandom #cncheck = myradius.radius.com # Verify that the server certificate # has this value in its CN field. #cnexact = yes # Should it be an exact match? session_resume = yes # Currently 'all' is just mschapv2. # If no allow_types is defined, all is assumed. #allow_types = all # where all = MSCHAPv2, MD5, OTP, GTC, SIM allow_types = eap_mschapv2 # Right now, you can do any of these methods in PEAP: eap-mschapv2 { username = <BEGIN_UNAME>testuser<END_UNAME> password = <BEGIN_PASS>Secret149<END_PASS> } }

6. Supplicant 必须首先与接入点关联。脚本startup.sh执行该任务。它也是 Xsupplicant 执行的第一个命令。

   请注意我们给 iwconfig 的虚假密钥（enc 000000000）！此密钥用于告诉驱动程序以加密模式运行。密钥在成功身份验证后被替换。只有在 AP 中禁用加密（用于测试目的）时，才能将其设置为 enc off。

   两者startup.sh和startup2.sh必须保存在/usr/local/etc/1x/.

   #!/bin/bash echo "Starting startup.sh" # Take down interface (if it's up) /sbin/ifconfig eth0 down # To make sure the routes are flushed sleep 1 # Configuring the interface with a bogus key /sbin/iwconfig eth0 mode managed essid testnet enc 000000000 # Bring the interface up and make sure it listens to multicast packets /sbin/ifconfig eth0 allmulti up echo "Finished startup.sh"

7. 下。如果 DHCP 服务器存在（通常在许多接入点中都存在），则可以省略下一个文件，该文件用于静态设置 IP 地址。

   #!/bin/bash echo "Starting startup2.sh" # Assigning an IP address /sbin/ifconfig eth0 192.168.1.5 netmask 255.255.255.0 echo "Finished startup2.sh"

运行一些测试

1. RADIUS 服务器在调试模式下启动。这将产生大量调试信息。重要的片段如下

   # radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf ...... Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) ...... Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "SecretKeyPass77" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) ...... Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" ...... Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests.

   

   默认 EAP 类型设置为 PEAP。

   

   RADIUS 的 TLS 设置在此处启动。此处列出了证书类型、位置和密码。

   

   在 PEAP 隧道内，使用了 MS-CHAPv2。

   

   用户名/密码信息在users文件中。

   

   RADIUS 服务器成功启动。等待传入请求。

   radius 服务器现在已准备好处理请求！

   上面包含最有趣的输出。如果您收到任何错误消息而不是最后一行，请仔细检查配置（上面）。

2. 现在 Supplicant 已准备好进行身份验证。在调试模式下启动 Xsupplicant。请注意，我们将看到两个启动脚本产生的输出startup.sh和startup2.sh.

   # xsupplicant -c /usr/local/etc/1x/1x.conf -i eth0 -d 6 Starting /etc/1x/startup.sh Finished /etc/1x/startup.sh Starting /etc/1x/startup2.sh Finished /etc/1x/startup2.sh

3. 同时，RADIUS 服务器正在产生大量输出。下面显示了关键片段

   ...... rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 8 modcall: group authenticate returns ok for request 8 Login OK: [testuser/<no User-Password attribute>] (from client testnet port 37 cli 0002a56fa08a) Sending Access-Accept of id 8 to 192.168.2.1:1032 MS-MPPE-Recv-Key = 0xf21757b96f52ddaefe084c343778d0082c2c8e12ce18ae10a79c550ae61a5206 MS-MPPE-Send-Key = 0x5e1321e06a45f7ac9f78fb9d398cab5556bff6c9d003cdf8161683bfb7e7af18 EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "testuser"

   

   TLS 会话启动。正在执行 TLS 握手。

   

   TLS 会话（PEAP 加密隧道）已建立。

   

   Supplicant 已通过 RADIUS 服务器成功验证。“Access-Accept” 消息已发送。

   

   MS-MPPE-Recv-Key [RFC2548 第 2.4.3 节] 包含目标 Authenticator（接入点）的成对主密钥 (PMK)，该密钥使用 MPPE 协议 [RFC3078] 加密，并使用 Authenticator 和身份验证服务器之间的共享密钥作为密钥。Supplicant 从 MK 派生出相同的 PMK，如 密钥管理 中所述。

4. Authenticator（接入点）也可能在其日志中显示如下内容

   00:02:16 (Info): Station 0002a56fa08a Associated 00:02:17 (Info): Station=0002a56fa08a User="testuser" EAP-Authenticated