WiKID + OpenLDAP + Freeradius Howto-系统运维-优客志

WiKID + OpenLDAP + Freeradius Howto

我将Openldap和freeradius安装在一个（虚拟）服务器上，另一个则安装了WiKID。我们认为这种职责分离是良好的安全政策。在某种程度上，它也使得设置更容易，因为WiKID和Freeradius都会监听本地主机的端口1812。两个服务器都在运行Centos5。

yum install openldap* yum install freeradius* yum install freedradius-ldap

配置OpenLDAP

要将测试用户添加到OpenLDAP，我创建了一个ldif文件test.ldif 。我以前已经添加过用户，所以我先评论了前3行。

#dn: ou=People,dc=wikidsystems,dc=com
#ou: People
#objectClass: organizationalUnit

dn: uid=test,ou=People,dc=wikidsystems,dc=com
uid: test
cn: Test Guy
displayName: Test Guy
givenName: Test
sn: Own
objectClass: inetOrgPerson
userPassword: mypassword
mail: test@wikidsystems.com
dialupAccess: yes

注意拨号访问的最后一行。 Freeradius将使用此字段来确定用户是否被允许登录。

这是slapd.conf文件的内容：

include		/etc/openldap/schema/core.schema
include		/etc/openldap/schema/cosine.schema
include		/etc/openldap/schema/inetorgperson.schema
include		/etc/openldap/schema/nis.schema
include		/etc/openldap/schema/misc.schema

allow bind_v2

pidfile		/var/run/openldap/slapd.pid
argsfile	/var/run/openldap/slapd.args

database	bdb
suffix		"dc=wikidsystems,dc=com"
rootdn		"cn=root,dc=wikidsystems,dc=com"
rootpw          {SSHA}mM7fsBarApAwbnMKXxNh+fXQ1OYppFY9
password-hash   {SSHA}

directory	/var/lib/ldap

index objectClass                       eq,pres
index ou,cn,mail,surname,givenname,displayName eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub
index default                           sub

将网络客户端添加到/etc/raddb/clients.conf 。此条目将用于您的VPN或网站或用户正在验证的任何服务。

client 192.168.0.120 {
#       # secret and password are mapped through the "secrets" file.
        secret      = testing_secret
#       shortname   = liv1
#       # the following three fields are optional, but may be used by
cw#       # checkrad.pl for simultaneous usage checks
#       nastype     = livingston
#       login       = !root
#       password    = someadminpas
}

Freeradius将代理拨号访问用户到WiKID服务器的身份验证请求。在/etc/raddb/proxies.conf中创建一个条目：

Proxy - the WiKID server:
realm NULL {
        type            = radius
        authhost        = 192.168.0.100:1812
        accthost        = localhost
        secret          = testing_secret
}

配置Freeradius

在/etc/radius.conf中添加以下内容以允许代理请求，启用ldap授权和pap身份验证。

首先配置ldap：

        # Lightweight Directory Access Protocol (LDAP)
        #
        #  This module definition allows you to use LDAP for
        #  authorization and authentication.
        #

	ldap {
		server = "localhost"
		basedn = "dc=wikidsystems,dc=com"
		filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"

		start_tls = no


      access_attr = "dialupAccess"

		dictionary_mapping = ${raddbdir}/ldap.attrmap

		ldap_connections_number = 5

		edir_account_policy_check=no
		timeout = 4
		timelimit = 3
		net_timeout = 1

	}

注意使用access_attr =“dialupAccess” 。接下来添加ldap授权：

authorize {
	preprocess
	chap
	mschap
	suffix
	eap
	files
	ldap
	pap
}

确保PAP是受支持的身份验证类型：

authenticate {
	Auth-Type PAP {
		pap
	}

	Auth-Type CHAP {
		chap
	}

	Auth-Type MS-CHAP {
		mschap
	}

	unix
	eap
}

WiKID + OpenLDAP + Freeradius Howto