Freeradius + mysql en debian squeeze

Hoy toca instalar un freeradius en un cliente, para authenticar los accesos de unos hotspots Mikrotik.
Para la parte gráfica, usaremos el DaloRadius… de esta manera, no tendremos que andar con los ficheros de texto.
Suponemos que tenemos instalado ya nuestro Debian Squeeze y, vamos a instalar unos paquetes:

# aptitude install mysql-server php5 php5-mysql php5-gd php-pear php-db freeradius freeradius-mysql subversion

Creamos usuario para mysql y la bbdd para radius:

# mysql -u root -ppassword
mysql> GRANT ALL PRIVILEGES ON *.* TO 'radius'@'%' IDENTIFIED BY 'radius' WITH GRANT OPTION;
FLUSH PRIVILEGES;
mysql> create database radius;

Ahora bajamos el DaloRadius, en la carpeta /usr/src:

# cd /usr/src
# svn co httpss://daloradius.svn.sourceforge.net/svnroot/daloradius/trunk daloradius

Ahora movemos los directorios:

# cp daloradius/ /var/www -R
# chown www-data:www-data /var/www/daloradius -R
# chmod 644 /var/www/daloradius/library/daloradius.conf.php

Creamos la estructura de la BBDD de radius:

root@radius:/var/www/daloradius/contrib/db# mysql -u radius -pradius radius < fr2-mysql-daloradius-and-freeradius.sql
Editamos el fichero de configuración de daloRadius, para que se conecte a mysql:

# nano /var/www/daloradius/library/daloradius.conf.php
$configValues['CONFIG_DB_ENGINE'] = 'mysql';
$configValues['CONFIG_DB_HOST'] = 'localhost';
$configValues['CONFIG_DB_PORT'] = '3306';
$configValues['CONFIG_DB_USER'] = 'radius';
$configValues['CONFIG_DB_PASS'] = 'radius';
$configValues['CONFIG_DB_NAME'] = 'radius';

Ahora vamos modificando los ficheros de freeradius, para que se conecte a mysql.
En el directorio /etc/freeradius, editamos sql.conf y lo dejamos tal que:

sql {
#
# Set the database to one of:
#
# mysql, mssql, oracle, postgresql
#
database = "mysql"
#
# Which FreeRADIUS driver to use.
#
driver = "rlm_sql_${database}"
# Connection info:
server = "localhost"
#port = 3306
login = "radius"
password = "radius"

El siguiente paso, es que las consultas de usuarios, en vez de mirar en los ficheros locales, haga las consultas en las tablas de mysql. Para ello, modificaremos el fichero:

root@radius:/etc/freeradius/sites-enabled# nano default

Y modificamos:

### authorization Section
#
# Look in an SQL database. The schema of the database
# is meant to mirror the "users" file.
#
# See "Authorization Queries" in sql.conf
sql
### accounting section
#
# Log traffic to an SQL database.
#
# See "Accounting queries" in sql.conf
sql

Y en el fichero /etc/freeradius/radiusd.conf, habilitamos la parte de sql:

# Include another file that has the SQL-related configuration.
# This is another file only because it tends to be big.
#
$INCLUDE sql.conf

Por último, modificamos el fichero clients.conf, con el NAS localhost y una pass para probar .... (nas := network access server 😉 ) y lo dejamos tal que:

# -*- text -*-
##
## clients.conf -- client configuration directives
##
## $Id$
#######################################################################
#
# Define RADIUS clients (usually a NAS, Access Point, etc.).
client localhost {
ipaddr = 127.0.0.1
secret = testing123
nastype = other # localhost isn't usually a NAS...
}

Creamos ahora, desde la interfaz daloRadius, un usuario, para ello, accedemos al daloradius wí­a web:
https://ip.del.servidor.radius/daloradius
Y nos aparecerá algo tal que:

Usuario: administrator
pass: radius
En el apartado Management / Users , hacemos click en New User

Creamos un usuario, con su password y lo probaremos en la consola.
Paramos el servicio freeradius

# /etc/init.d/freeradius stop

Lanzamos el servicio en modo debug:

# freeradius -X
............
Module: Checking session {...} for more modules to load
Module: Checking post-proxy {...} for more modules to load
Module: Checking post-auth {...} for more modules to load
} # modules
} # server
radiusd: #### Opening IP addresses and Ports ####
listen {
type = "auth"
ipaddr = *
port = 0
}
listen {
type = "acct"
ipaddr = *
port = 0
}
listen {
type = "auth"
ipaddr = 127.0.0.1
port = 18120
}
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel
Listening on proxy address * port 1814
Ready to process requests.

Y ahora desde otra consola, hacemos una prueba con la utilidad radtest :

root@radius:~# radtest pruebas pruebas01 localhost:1812 0 testing123
Sending Access-Request of id 49 to 127.0.0.1 port 1812
User-Name = "pruebas"
User-Password = "pruebas01"
NAS-IP-Address = 127.0.1.1
NAS-Port = 0
rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=49, length=20
root@radius:~#

Nuestros datos:
Username: pruebas
pass:pruebas01
NasKey:testing123 (lo hemos puesto en el apartado nas, anteriormente, en localhost
Puerto Radius: 1812
Y el freeradius, nos responde con:

Ready to process requests.
rad_recv: Access-Request packet from host 127.0.0.1 port 37927, id=49, length=59
User-Name = "process"
User-Password = "control10"
NAS-IP-Address = 127.0.1.1
NAS-Port = 0
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "pruebas", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
++[files] returns noop
[sql] expand: %{User-Name} -> pruebas
[sql] sql_set_user escaped user --> 'pruebas'
rlm_sql (sql): Reserving sql socket id: 4
[sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'pruebas' ORDER BY id
[sql] User found in radcheck table
[sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'pruebas' ORDER BY id
[sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'pruebas' ORDER BY priority
rlm_sql (sql): Released sql socket id: 4
++[sql] returns ok
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns updated
Found Auth-Type = PAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group PAP {...}
[pap] login attempt with password "pruebas01"
[pap] Using clear text password "pruebas01"
[pap] User authenticated successfully
++[pap] returns ok
# Executing section post-auth from file /etc/freeradius/sites-enabled/default
+- entering group post-auth {...}
++[exec] returns noop
Sending Access-Accept of id 49 to 127.0.0.1 port 37927
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 0 ID 49 with timestamp +177
Ready to process requests.

Y vemos como hace la consulta en mysql.
Enjoy your radius 😉