FreeRADIUS 連接LDAP 認證(Ubuntu16.04)

邊做邊學，順便留個筆記，若有錯誤請不吝指教。

本次實作系統環境為Ubuntu16.04版本

FreeRADIUS版本為2.2.8

本次實作著重FreeRADIUS之設置

1.      修改/etc/freeradius/modules/ldap文件中關於LDAP伺服器資訊

sudo vim /etc/freeradius/modules/ldap

修改內容如下：

ldap {

server = "servr-ip"

identity = "cn=admin, dc=example,dc=org"

password = "password"

basedn = "dc=example,dc=org"

filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"

access_attr = "uidNumber"

}

紅字部分請依實際LDAP server進行配置

2.      修改/etc/freeradius/sites-enabled/default

sudo vim /etc/freeradius/sites-enabled/default

將以下內容取消註解(#)：

Auth-Type LDAP {

ldap

}

及

ldap  (ldap有兩個，都要取消註解)

3.      修改/etc/freeradius/sites-enabled/inner-tunnel

sudo vim /etc/freeradius/sites-enabled/inner-tunnel

將以下內容取消註解(#)：

Auth-Type LDAP {

ldap

}

及

ldap (ldap有兩個，都要取消註解)

4.      以除錯模式運行FreeRADIUS進行測試

sudo freeradius –X

另開一命令視窗使用LDAP帳號進行認證測試

sudo radtest "User-name" "password" <ip-address> 0 "secret"

這時可以在除錯模式的視窗看到認證過程如下：

[ldap] login attempt by " User-name " with password " password "

[ldap]      expand: %{Stripped-User-Name} -> User-name

[ldap]      expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid= User-name)

[ldap]      expand: dc= example,dc=org -> dc= example,dc=org

  [ldap] ldap_get_conn: Checking Id: 0

  [ldap] ldap_get_conn: Got Id: 0

  [ldap] attempting LDAP reconnection

  [ldap] (re)connect to servr-ip:389, authentication 0

  [ldap] bind as cn=admin,dc= example,dc=org/ password to servr-ip:389

  [ldap] waiting for bind result ...

  [ldap] Bind was successful

  [ldap] performing search in dc= example,dc=org, with filter (uid= User-name)

  [ldap] ldap_release_conn: Release Id: 0

[ldap] user DN: cn= User-name,dc= example,dc=org

  [ldap] (re)connect to servr-ip:389, authentication 1

  [ldap] bind as cn= User-name,dc= example,dc=org/ password to servr-ip:389

  [ldap] waiting for bind result ...

  [ldap] Bind was successful

[ldap] user User-name authenticated succesfully

++[ldap] = ok

若不成功，也可依據鄉乖錯誤訊息進行除錯

參考資料：

[1] 資訊雜記 ,  “freeradius 和 LDAP” ,  http://host7.sdjh.tn.edu.tw/blog/wordpress305/misinfomation/2013/10/12/freeradius-%E5%92%8C-ldap/

[2] blog.moatazthenervous.com , “Installing freeradius on Ubuntu 14.04” , http://blog.moatazthenervous.com/installing-radius-on-ubuntu-14-04/