freeradius教程

FTeeRADlUs Beginner'sGuide CopyrightC2011PacktPublishing Allrightsreserved.Nopartofthisbookmaybereproducedstoredinaretrievalsystem ortransmittedinanyformorbyanymeans,withoutthepriorwrittenpermissionofthe publisher,exceptinthecaseofbriefquotationsembeddedincriticalarticlesorreviews. Everyefforthasbeenmadeinthepreparationofthisbooktoensuretheaccuracyofthe informationpresentedHowevertheinformationcontainedinthisbookissoldwithout warranty,eitherexpressorimplied.Neithertheauthor,norPacktPublishinganditsdealers anddistributorswillbeheldliableforanydamagescausedorallegedtobecauseddirectl orindirectlybythisbook PacktPublishinghasendeavoredtoprovidetrademarkinformationaboutallofthe companiesandproductsmentionedinthisbookbytheappropriateuseofcapitals However,PacktPublishingcannotguaranteetheaccuracyofthisinformation Firstpublished:September2011 Productionreference:1260811 PublishedbypacktPublishingLtd Liverylace 35Liverystreet BirminghamB32PB,UK SBN978-1-849514-08-8 www.packtpub.com CoverImagebyasherWishkerman(a.wishkermanampicde Credits Author ProjectCoordinate Dirkvanderwalt SrimoyeeGhoshal viewers Proofreader Antegula Chrissmith AtifRazzaq Indexers AcquisitionEd HemanginiB nyaApte Tejaldaruwale DevelopmentEditors Graphics KartikeyPandey Nileshmohite Alinalet Productioncoordinator Technicaleditor AdlineswethaJesuthas Vanjeetd'souza CoverWork CopyEditor Adlineswethajesuthas Nehashett Abouttheauthor DirkvanderWaltisanopensourcesoftwarespecialistfromPretoria,SouthAfrica.He isafirmbelieverinthepotentialofopensourcesoftware.beingaLinuxuserforalmost tenyears,itwasloveatfirstboot.FromthenonDirkspenthisavailabletimesharinghis knowledgewithothersequallypassionateaboutthefreedomandaffordabilityopensource softwaregivestothecommunity In2003,DirkstartedcodingwithPerlashislanguageofchoiceandgavehisfullattentionto functionalandaestheticuserinterfacedesignhealsocompiledanonlinegtk2-Perlstudy guidetopromotetheadvancementofperlonthedesktop AsRichInternetApplications(ria)becamemorepopular,Dirkaddedthedojotoolkitand CakephptohisskillssettocreateanAJAX-stylefront-endtoaFreeradiUsMySQldatabase HislatestworkisYFiHotspotManager.TodayyFiHotspotmanagerisusedinmanylocalities aroundtheglobe.Withmanycontributorstotheprojectitprovesjusthowwelltheopen sourcesoftwaremodelcanwork IdliketothankthelordJesusforlifeandlight,mywifepetraanddaughter Danielleforalltheirsupportandunderstanding,mybrotherKarelforhis interestandhelpIwouldalsoliketothankthepeopleinvolvedwiththe FreeRADIUSproject,fromthecoderstothecommenters.lastlyi'dliketo thankPacktPublishingforsupportingopenSourcesoftwarethewaytheydo Aboutthereviewers AnteGulamisa26-year-oldsoftwareandsystemengineerwithmorethansevenyearsof workingexperienceinvarioussegmentsoftheiTindustryhehasworkedasaconsultant andsystemengineeronPoSIX-compliantsystems(Linux,BSD,SCO,andothers),andlately hasfocusedmainlyonsecuritydesignandadministrationofMicrosoft-basedenterprise solutions.Anteiscurrentlyworkingasasystemengineerandsoftwaredeveloperprimarily onMSplatforms(.NET)inRi-ingd.o.o.,amedium-sizedsoftwaredevelopmentcompany Beinginvolvedinsecurityforseveralyearsantegainedexperienceinthedevelopment ofvarioussecuritytoolsbasedonmanydifferenttechnologiesandhaswrittenarticlesand co-editedPhearlessSecurityEzineactivelyforthelastfouryears.Presently,heisworkingon largenetworkingprojectsandenterpriseenvironments;adoptingthemforstandardslike PCl-DSSenableshimtostayintouchwithsecurityontheenterpriselevel Iwouldliketothankmyfamily,myfriendsandmygirlfriendforthetheir patience.Alsoalltheguysfromthegn0obz"teamforallthehoursfullof funandknowledgewhileplayingctfforthepastcoupleofyears AtifRazzaqholdsanmscdegreefromStrathclydeUniversityGlasgow,UKin Communication,Control,andDigitalSignalProcessing,andabscdegreeincomputer SciencefromNUCES,Pakistan.AfterhismScdegree,hestartedhiscareerasasoftware engineerintheareaofMobileapplicationDevelopmentinJ2MEinTricastmedia,Glasgow, UK.DuringthisperiodhealsopublishedanarticleatJava.nettitledGettingStartedwith BlackBerry2MEDevelopment. HeiscurrentlyworkingasthedevelopmentmanageratterminusTechnologieswho specializesintelecombillingsoftwaredevelopment.Hisresponsibilitiesincludethe developmentofthebillingsystemanditsintegrationwithotherapplicationsboth proprietaryandopensource(asteriskfreeSwitchfreeraDiUSandotherspriortojoining TerminusTechnologies,heworkedontelecombillingatComcerto,Bahrainhehasbeen workingontelecombillingandVolP/SiPTelephonyforaboutthreeyears InhisfreetimehewriteshisownblogondifferentIcTtopicsavailableathttp://atif razzaqblogspot.com.Hecanbecontactedatatif.razagagooglemail.com. Ithasbeenagreatexperienceworkingonthisproject.I'dliketothank thewholete yorkingonthisproject:theauthorandallmembersfro PacktPublishing.Idliketothankmyfamilyforgivinguptheirshareoftime whichigavetothisproject.FinallyI'dthankthegreatlordforeverything andthenmyparentswhotaughtmeandmademewhatIam www.packtpuB.com Supportfilles,eBooks,discountoffers,andmore Youmightwanttovisitwww.Packtpub.conforsupportfilesanddownloadsrelatedtoyour book DidyouknowthatpacktoffersebookversionsofeverybookpublishedwithPDFandepub filesavailableYoucanupgradetotheebookversionatwww.Packtpub.comandasaprint bookcustomer,youareentitledtoadiscountontheebookcopyGetintouchwithusat service@packtpubcomformoredetails Atwww.Packtpub.comyoucanalsoreadacollectionoffreetechnicalarticlessignupfor arangeoffreenewslettersandreceiveexclusivediscountsandoffersonpacktbooksand eBooks PACKTLIB° http://packtlib.Packtpub.com DoyouneedinstantsolutionstoyouriTquestions?PacktLibisPackt'sonlinedigitalbook library.Here,youcanaccess,readandsearchacrossPackt'sentirelibraryofbooks WhySubscribe? Fullysearchableacrosseverybookpublishedbypackt Copyandpasteprintandbookmarkcontent eOndemandandaccessibleviawebbrowser FreeAccessforPacktaccountholders IfyouhaveanaccountwithPacktatwww.Packtpub.comyoucanusethistoaccess PacktLibtodayandviewnineentirelyfreebookssimplyuseyourlogincredentialsfor immediateaccess Tableofcontents Preface Chapter1:Introductiontoaaaandradius Authentication,Authorization,andAccounting Authentication 8 Authorization Accounting RADIUS 10 RADIUSprotocol(RFC2865) 11 Thedatapacket AVPs 15 Vendor-SpecificAttributes(vSas) 16 Proxyingandreal 17 RADIUSServer RADIUSClient 17 RADIUSaccounting(RFC2866) 18 Operati 18 Packetforma 18 Acct-Status-Type(Type40) 19 Acct-Input-Octets(type42) Acct-Output-Octets(Type43) Acct-Session-Time(Type46) Acct-Terminate-Cause(Type49) 21 Conclusion RADIUSextensions 21 DynamicAuthorizationextension(RFC5176) 21 RADIUSsupportforEAP(RFC3579 22 Freeradius 23 History 23 Strengths 23