CentOS6.5 部署***管理系统（StrongSwan+iKEv2+Freeradiu+Mysql+Daloradius）-原创手记-慕课网

一、环境介绍

Server IP:192.168.30.133

System: CentOS 6.5

Client:Winodows 7

二、编译安装StrongSwan

　　1.下载StrongSwan

# wget http://download.strongswan.org/strongswan.tar.gz

　　2.安装相关库

# yum update -y

# yum install pam-devel openssl-devel make gcc gmp-devel

　　3.编译安装

# ./configure --enable-eap-identity --enable-eap-md5 \

--enable-eap-mschapv2 --enable-eap-tls --enable-eap-ttls --enable-eap-peap \

--enable-eap-tnc --enable-eap-dynamic --enable-eap-radius --enable-xauth-eap \

--enable-xauth-pam --enable-dhcp --enable-openssl --enable-addrblock --enable-unity \

--enable-certexpire --enable-radattr --enable-swanctl --enable-openssl --disable-gmp

make -j 8 && make install && echo OK

　　注：如果出现错误：

configure: WARNING: unrecognized options: --enable-nat-transport

checking for a BSD-compatible install... /usr/bin/install -c

checking whether build environment is sane... configure: error: newly created file

is older than distributed files!Check your system clock

解决方法：（原因：时间不对）

# cp -Rf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime

# cat /etc/sysconfig/clock

# ntpdate 133.100.11.8(或 s2m.time.edu.cn)

# sed -i 's#ZONE="America/New_York"#ZONE="Asia/Shanghai"#g' /etc/sysconfig/clock

# hwclock -w

# date -R

　　4、生成证书

# mkdir key && cd key

#### 生成一个私钥 ####

# ipsec pki --gen --outform pem > ca.pem

# ipsec pki --self --in ca.pem --dn "C=cn, O=***stsck, CN=*** CA" \

--ca --lifetime 3650 --outform pem >ca.cert.pem

# ipsec pki --gen --outform pem > server.pem

# ipsec pki --pub --in server.pem | ipsec pki --issue --lifetime 1200 \

--cacert ca.cert.pem --cakey ca.pem --dn "C=cn, O=***stsck, CN=192.168.30.133" \

--san="192.168.30.133" --flag serverAuth --flag ikeIntermediate --outform pem > server.cert.pem

# ipsec pki --gen --outform pem > client.pem

# ipsec pki --pub --in client.pem | ipsec pki --issue --cacert \

ca.cert.pem --cakey ca.pem --dn "C=cn, O=***stsck, CN=*** Client" --outform pem > client.cert.pem

备注：C 表示国家，O 表示组织名，如***stack CN为通用名保持默认。（在整个部署过程中要保持一致）

CN=192.168.30.133为你的VPS外网地址

　　5、安装证书

cp ca.cert.pem /usr/local/etc/ipsec.d/cacerts/

cp server.cert.pem /usr/local/etc/ipsec.d/certs/

cp server.pem /usr/local/etc/ipsec.d/private/

cp client.cert.pem /usr/local/etc/ipsec.d/certs/

cp client.pem /usr/local/etc/ipsec.d/private/

【卸载证书：非第一次安装时需要此步操作，如果第一次安装不用此步骤】

rm -rf /usr/local/etc/ipsec.d/cacerts/ca.cert.pem

rm -rf /usr/local/etc/ipsec.d/certs/server.cert.pem

rm -rf /usr/local/etc/ipsec.d/private/server.pem

rm -rf /usr/local/etc/ipsec.d/certs/client.cert.pem

rm -rf /usr/local/etc/ipsec.d/private/client.pem

　　6、配置strongswan

　　a、修改/usr/local/etc/ipsec.conf；如下：

# vim /etc/ipsec.conf

config setup strictcrlpolicy=no uniqueids=no #多台设备同时在线 conn iOS_cert

keyexchange=ikev1

fragmentation=yes

left=%defaultroute

leftauth=pubkey

leftsubnet=0.0.0.0/0

leftcert=server.cert.pem

right=%any

rightauth=pubkey

rightauth2=xauth

rightsourceip=10.11.0.0/24

rightcert=client.cert.pem

auto=add

conn android_xauth_psk

keyexchange=ikev1

left=%defaultroute

leftauth=psk

leftsubnet=0.0.0.0/0

right=%any

rightauth=psk

rightauth2=xauth

rightsourceip=10.12.0.0/24

auto=add

conn networkmanager-strongswan

keyexchange=ikev2

left=%defaultroute

leftauth=pubkey

leftsubnet=0.0.0.0/0

leftcert=server.cert.pem

right=%any

rightauth=pubkey

rightsourceip=10.13.0.0/24

rightcert=client.cert.pem

auto=add

conn ios_ikev2

keyexchange=ikev2

ike=aes256-sha256-modp2048,3des-sha1-modp2048,aes256-sha1-modp2048!

esp=aes256-sha256,3des-sha1,aes256-sha1!

rekey=no

left=%defaultroute

leftid=192.168.30.133

leftsendcert=always

leftsubnet=0.0.0.0/0

leftcert=server.cert.pem

right=%any

rightauth=eap-mschapv2

rightsourceip=10.14.0.0/24

rightsendcert=never

eap_identity=%any

dpdaction=clear

fragmentation=yes

auto=add

conn windows7

keyexchange=ikev2

ike=aes256-sha1-modp1024!

rekey=no

left=%defaultroute

leftauth=pubkey

leftsubnet=0.0.0.0/0

leftcert=server.cert.pem

right=%any

rightauth=eap-mschapv2

rightsourceip=10.15.0.0/24

rightsendcert=never

eap_identity=%any

auto=add

[该配置文件详解请参考：https://zh.opensuse.org/SDB:Setup_Ipsec_***_with_Strongswan]

　　b、修改/usrlocal/etc/strongswan.conf 将内容替换成如下：

# vim /usr/local/etc/strongswan.conf

charon {

load_modular = yes

duplicheck.enable = no

compress = yes

plugins {

include strongswan.d/charon/*.conf

}

dns1 = 8.8.8.8

dns2 = 8.8.4.4

nbns1 = 8.8.8.8

nbns2 = 8.8.4.4

}

include strongswan.d/*.conf

　　c、修改/usr/local/etc/ipsec.secrets（没有此文件请自行创建）

# vim /usr/local/etc/ipsec.secrets

: RSA server.pem

: PSK "myPSKkey"

: XAUTH "myXAUTHPass"

[用户名] %any : EAP "[密码]

【解：】

将上面的myPSKkey单词更改为你需要的PSK认证方式的密钥;

将上面的myXAUTHPass单词更改为你需要的XAUTH认证方式的密码,该认证方式的用户名是随意的;

将上面的[用户名]改为自己想要的登录名,[密码]改为自己想要的密码([]符号去掉),可以添加多行,

得到多个用户,这即是使用IKEv2的用户名+密码认证方式的登录凭据.

　　7、配置网络转发规则转发

　　a、设置iptables规则

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A FORWARD -s 10.10.0.0/24 -j ACCEPT

iptables -A FORWARD -s 10.11.0.0/24 -j ACCEPT

iptables -A FORWARD -s 10.12.0.0/24 -j ACCEPT

iptables -A FORWARD -s 10.13.0.0/24 -j ACCEPT

iptables -A INPUT -p esp -j ACCEPT

iptables -A INPUT -p udp --dport 500 -j ACCEPT

iptables -A INPUT -p tcp --dport 500 -j ACCEPT

iptables -A INPUT -p udp --dport 4500 -j ACCEPT

iptables -A INPUT -p udp --dport 1701 -j ACCEPT

iptables -A INPUT -p tcp --dport 1723 -j ACCEPT

iptables -A FORWARD -j REJECT

iptables -t nat -A POSTROUTING -s 10.10.0.0/24 -j MASQUERADE

# service iptables save

注意iptables规则的顺序。以下做为参考：

# Generated by iptables-save v1.4.7 on Thu Dec 8 12:51:52 2016

*nat

:PREROUTING ACCEPT [2:156]

:POSTROUTING ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

-A POSTROUTING -s 10.10.0.0/24 -j MASQUERADE

-A POSTROUTING -s 10.11.0.0/24 -j MASQUERADE

-A POSTROUTING -s 10.12.0.0/24 -j MASQUERADE

-A POSTROUTING -s 10.13.0.0/24 -j MASQUERADE

COMMIT

# Completed on Thu Dec 8 12:51:52 2016

# Generated by iptables-save v1.4.7 on Thu Dec 8 12:51:52 2016

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [39:3992]

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -p icmp -j ACCEPT

-A INPUT -i lo -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

-A INPUT -p esp -j ACCEPT

-A INPUT -p udp -m udp --dport 500 -j ACCEPT

-A INPUT -p tcp -m tcp --dport 500 -j ACCEPT

-A INPUT -p udp -m udp --dport 4500 -j ACCEPT

-A INPUT -p udp -m udp --dport 1701 -j ACCEPT

-A INPUT -p tcp -m tcp --dport 1723 -j ACCEPT

-A INPUT -j REJECT --reject-with icmp-host-prohibited

-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

-A FORWARD -s 10.10.0.0/24 -j ACCEPT

-A FORWARD -s 10.11.0.0/24 -j ACCEPT

-A FORWARD -s 10.12.0.0/24 -j ACCEPT

-A FORWARD -s 10.13.0.0/24 -j ACCEPT

-A FORWARD -j REJECT --reject-with icmp-port-unreachable

COMMIT

# Completed on Thu Dec 8 12:51:52 2016

# service iptables restart

　　　b、设置ip_forward转发

# vim /etc/sysctl.conf

net.ipv4.ip_forward = 0

改为：

net.ipv4.ip_forward = 1

sysctl -p

c、下载ca.cert.pem证书导入windows客户端或苹果Mac系统：证书的具体导入方法：

Windows 7测试拨号：http://zlyang.blog.51cto.com/1196234/1881212

# yum -y install lrzsz

# cd /soft/strongswan-5.5.1/key

# sz ca.cert.pem

二、部署Freeradius+mysql+daloradius

　　1、安装Freeradius和Mysql

# yum -y install freeradius freeradius-mysql freeradius-utils mysql-server

　　2、启动Mysql及设置密码

# service mysqld start

# chkconfig mysqld on

# mysql_secure_installation

　　3、导入Freeradius库数据

# mysql -uroot -p

mysql> CREATE DATABASE radius;

mysql> GRANT ALL PRIVILEGES ON radius.* TO radius@'localhost' IDENTIFIED BY "radpass";

mysql> GRANT ALL PRIVILEGES ON radius.* TO radius@'%' IDENTIFIED BY "radpass";

mysql> flush privileges;

mysql> use radius;

mysql> SOURCE /etc/raddb/sql/mysql/schema.sql

mysql> SOURCE /etc/raddb/sql/mysql/cui.sql

mysql> SOURCE /etc/raddb/sql/mysql/ippool.sql

mysql> SOURCE /etc/raddb/sql/mysql/nas.sql

mysql> SOURCE /etc/raddb/sql/mysql/wimax.sql

　　4、配置Freeradius连接Mysql

# vim /etc/raddb/sql.conf

# Connection info:

server = "localhost"

#port = 3306

password = "radpass"

# Database table configuration for everything except Oracle

radius_db = "radius"

#第108行

readclients = yes

　　5、使用sql数据库里的nas表读取客户端信息

# vim /etc/raddb/radiusd.conf

#$INCLUDE sql.conf

修改后：

$INCLUDE sql.conf

# vim /etc/raddb/sites-available/default

需要修改的行数及修改后的结果：例：#001行 line001

#170行 #files

#177 sql

#396 #radutmp

#397 sradutmp

#406 sql

#450 #radutmp

#454 sql

#475 sql

#577 sql

# vim /etc/raddb/sites-available/inner-tunnel

#125 #file

#132 sql

#252 #radutmp

#256 sql

#278 sql

#302 sql

　　修改密钥：

# vim /etc/raddb/clients.conf

secret = testing123

　　6、添加测试用户：

# mysql -uroot -p

mysql> use radius;

mysql> insert into radcheck (username,attribute,op,value) \

values ('test','User-Password',':=','test');

mysql> flush privileges;

mysql> exit；

　　测试Freeradius+Mysql

　　以Debug模式启动Freeradius：

# radiusd -X

　　另启一个窗口测试下：

# radtest test test . testing123

Sending Access-Request of id 71 to 127.0.0.1 port 1812

User-Name = "yzl"

User-Password = "yzl"

NAS-IP-Address = 127.0.0.1

NAS-Port = 0

Message-Authenticator = 0x00000000000000000000000000000000

rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=71, length=55

Reply-Message = "Hello yzl !"

Reply-Message = "Regexp match for PAP"

看到”Access-Accept“说明成功。

　　7、部署Daloradius

　　a、安装LAMP环境：

# yum -y install php-mysql php php-gd php-pear-DB httpd

　　b、下载Daloradius

下载地址：

http://jaist.dl.sourceforge.net/project/daloradius/daloradius/daloradius0.9-9/daloradius-0.9-9.tar.gz

汉化版地址：http://pan.baidu.com/s/1c2h2h2K

# cd /soft

# wget \

http://jaist.dl.sourceforge.net/project/daloradius/daloradius/daloradius0.9-9/daloradius-0.9-9.tar.gz

# tar xf daloradius-0.9-9.tar.gz

　　c、导入daloradius库文件

# mysql -uroot -p

mysql> use radius;

mysql> SOURCE /soft/daloradius-0.9-9/contrib/db/fr2-mysql-daloradius-and-freeradius.sql

　　d、修改daloradius连接库文件：

# vim /soft/daloradius-0.9-9/library/daloradius.conf.php

$configValues['DALORADIUS_VERSION'] = '0.9-9';

$configValues['FREERADIUS_VERSION'] = '2';

$configValues['CONFIG_DB_ENGINE'] = 'mysql';

$configValues['CONFIG_DB_HOST'] = 'localhost';

$configValues['CONFIG_DB_USER'] = 'radius';

$configValues['CONFIG_DB_PASS'] = 'radpass';

$configValues['CONFIG_DB_NAME'] = 'radius';

$configValues['CONFIG_FILE_RADIUS_PROXY'] = '/etc/raddb/proxy.conf';

$configValues['CONFIG_PATH_RADIUS_DICT'] = '/etc/raddb';

$configValues['CONFIG_PATH_DALO_VARIABLE_DATA'] = '/var/www/html/daloradius/var';

$configValues['CONFIG_LOG_FILE'] = '/var/www/html/daloradius/var/daloradius.log';

　　e、拷备文件至apache工作目录：/var/www/html

# mv /soft/daloradius-0.9-9 /var/www/html/daloradius

　　f、创建日志文件:

# touch /var/www/html/daloradius/var/daloradius.log

　　g、赋权给apache:

# chown -R apache:apache /var/www/html/daloradius

　　h、修改redius日志文件：

# vim /etc/raddb/radiusd.conf

#file = ${logdir}/radius.log

file = /var/log/radius.log

# chmod 644 /var/log/messages

# vim /var/www/html/daloradius/library/exten-radius_log.php

$logfile_loc = array();

$logfile_loc[1] = '/var/log/freeradius/radius.log';

$logfile_loc[2] = '/usr/local/var/log/radius/radius.log';

$logfile_loc[3] = '/var/log/radius/radius.log';

$logfile_loc[4] = '/var/log/radius.log';

　　i、将用户的同步会话限制为只有一个，新用户必须添加到用户组

# vim /etc/raddb/sql/mysql/dialup.conf

查找simul_count_query将290-293行注释去掉

# mysql -uroot -p

mysql> use radius;

mysql> INSERT INTO radgroupcheck ( id , GroupName , Attribute , op , Value ) \

VALUES (NULL , 'users', 'Simultaneous-Use', ':=', '1');

　　j、修改apache配置文件

# vim /etc/httpd/conf/httpd.conf

# ServerName x.x.x.x:80

注：x.x.x.x为你的本机ip或域名

　　k、启动apache

# service httpd start

# chkconfig httpd on

# service radiusd start

# chkconfig radiusd on

# iptables -I INPUT 5 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT /etc/init.d/iptables save /etc/init.d/iptables restart

# chmod 644 /var/log/radius.log

可以使用web登录：

http://ip-address-or-hostname/daloradiusUsername: administrator

Password: radius

三、StrongSwan和Freeradius整合：

　　a、修改：/usr/local/etc/strongswan.d/charon/eap-radius.conf

# vim /usr/local/etc/strongswan.d/charon/eap-radius.conf

#开启在线人数查询

#第4行

accounting = yes

#第8行

accounting_close_on_timeout = yes

#查找server{}在这里添加以下内容

#93行

***server {

secret = testing123

address = 127.0.0.1

}

　　b、修改/usr/local/etc/ipsec.conf

　　c、配置ikev2支苹果Mac系统：/etc/raddb/eap.conf

　　d、重启服务

# service radiusd restart

# ipsec stop

# ipsec start --nofork

测试下看是否成功拨号

四、Daloradius优化及设置计费

　　1、Web汉化

下载Daloradius汉化版:http://pan.baidu.com/s/1c2h2h2K　

将其中的main.conf、config-lang.conf做相应的替换；把zh-cn.conf上传到/var/www/html/daloradius/lang/ service httpd restart 然后在daloradius的管理页面中选择：config--language settings----Chinese---apply

　　2、限制用户的每日总使用时间和登录时间：

# vim /etc/raddb/radiusd.conf

#将747行取消注释

$INCLUDE sql/mysql/counter.conf

# vim /etc/raddb/sql/mysql/counter.conf

#将60-63行加注释，然后添加以下

60 # query = "SELECT SUM(acctsessiontime - \

61 # GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)) \

62 # FROM radacct WHERE username = '%{%k}' AND \

63 # UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'"

65 query = "SELECT IFNULL(SUM(acctsessiontime - \

66 GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)),0) \

67 FROM radacct WHERE username = '%{%k}' AND \

68 UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'"

# vim /etc/raddb/dictionary

#在最后添加以下：

ATTRIBUTE Daily-Session-Time 3000 integer

ATTRIBUTE Max-Daily-Session 3001 integer

　　在mysql库创建相应的字段：

# mysql -uradius -p

mysql> use radius;

mysql> delete from radacct;

mysql> INSERT INTO radgroupcheck ( id , GroupName , Attribute , op , Value ) \

VALUES (NULL , 'users', 'Max-Daily-Session', ':=', '28800'); # 28800 is seconds = 8h

mysql> INSERT INTO radgroupcheck ( id , GroupName , Attribute , op , Value ) \

VALUES (NULL , 'users', 'Login-Time', ':=', 'Al0001-2359');

　　3、限制用户的每日和每月的数据使用和帐户到期

# vim /etc/raddb/sql/mysql/counter.conf

#在最后添加以下：

sqlcounter dailytrafficcounter {

counter-name = Daily-Traffic

check-name = Max-Daily-Traffic

reply-name = Daily-Traffic-Limit

sqlmod-inst = sql

key = User-Name

reset = daily

query = "SELECT (SUM(AcctInputOctets + AcctOutputOctets)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) > '%b'"

}

sqlcounter monthlytrafficcounter {

counter-name = Monthly-Traffic

check-name = Max-Monthly-Traffic

reply-name = Monthly-Traffic-Limit

sqlmod-inst = sql

key = User-Name

reset = monthly

query = "SELECT (SUM(AcctInputOctets + AcctOutputOctets)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) > '%b'"

}

# vim /etc/raddb/dictionary

#在最后添加以下：

ATTRIBUTE Max-Daily-Traffic 3002 integer

ATTRIBUTE Daily-Traffic-Limit 3003 integer

ATTRIBUTE Max-Monthly-Traffic 3004 integer

ATTRIBUTE Monthly-Traffic-Limit 3005 integer

# vim /etc/raddb/sites-available/default

#在193行之后添加

dailytrafficcounter

monthlytrafficcounter

　　在mysql库创建相应的字段：

# mysql -uroot -p

mysql> use radius;

mysql> delete from radacct;

mysql> INSERT INTO radgroupcheck ( id , GroupName , Attribute , op , Value ) \

VALUES (NULL , 'users', 'Max-Monthly-Traffic', ':=', '1073741824');

# 1073741824 bytes=1024*1024*1024 bytes=1 Gbyte, 填写时以byte为单位每月最大流量1G

mysql> INSERT INTO radgroupcheck ( id , GroupName , Attribute , op , Value ) \

VALUES (NULL , 'users', 'Max-Daily-Traffic', ':=', '104857600');

# 104857600 bytes=100*1024*1024=100 Mbyte 每天最大流量为100M

mysql> INSERT INTO radgroupcheck ( id , GroupName , Attribute , op , Value ) \

VALUES (NULL , 'users', 'Expiration', ':=', '1 Oct 2017'); # 设定账号过期

mysql> exit

# service radiusd restart

到此，所有的都已经部署完毕了！祝你成功！

如有问题可在下方回复！

mysqlCentOSpptpLinux