Могу ли я использовать RADIUS для strongswan - psk настроен?

Question

Я новичок на сервере strongswan. И я просматривал примеры конфигурации с сайта strongswan.org.

Похоже, сервер strongswan должен быть настроен на использование аутентификации EAP для использования RADIUS. Кто-нибудь может это подтвердить? Или, пожалуйста, дайте мне знать, если это неправильно, понять.

На самом деле я настроил сервер strongswan с аутентификацией PSK и подумывал добавить сервер RADIUS, но понял, что это может быть невозможным вариантом, но все же я не уверен на 100%.

Если у вас есть какие-либо комментарии по этому поводу, это будет полезно для меня. Спасибо,

              Ki

Answer 1

# Install & Configure StrongSwan + FreeRADIUS ( MariaDB Backend ) - CentOS7

# Install Require Packages :
[root@strongswan ~]# yum install -y epel-release
[root@strongswan ~]# yum update && yum install -y gcc gcc-c++ pam-devel zlib-devel systemd-devel openssl-devel
[root@strongswan ~]# yum install -y freeradius freeradius-mysql freeradius-utils mariadb mariadb-server

# Download StrongSwan :
[root@strongswan ~]# wget http://www.strongswan.org/download/strongswan-5.5.0.tar.gz
[root@strongswan ~]# tar zvxf strongswan-5.5.tar.gz
[root@strongswan ~]# cd strongswan-5.5.0

# Compile StrongSwan :
[root@strongswan ~]# ./configure --prefix=/usr --sysconfdir=/etc/strongswan --localstatedir=/var --enable-unity --enable-xauth-eap --enable-eap-identity --enable-eap-md5 --enable-xauth-pam --enable-eap-tls --enable-eap-radius --enable-eap-mschapv2 --enable-dhcp --enable-systemd --enable-eap-dynamic --enable-openssl --enable-addrblock --enable-certexpire --enable-radattr --enable-swanctl --disable-gmp
[root@strongswan ~]# make && make install

# Generate Certificates :
[root@strongswan ~]# cd /etc/strongswan/ipsec.d/
[root@strongswan ipsec.d]# ipsec pki --gen --type rsa --size 2048 --outform pem > private/strongswanKey.pem
[root@strongswan ipsec.d]# ipsec pki --self --ca --lifetime 3650 --in private/strongswanKey.pem --type rsa --dn "C=Ir, O=IT, CN=StrongSwanVPN" --outform pem > cacerts/strongswanCert.pem

[root@strongswan ipsec.d]# ipsec pki --gen --type rsa --size 2048 --outform pem > private/vpnHostKey.pem
[root@strongswan ipsec.d]# chmod 600 private/vpnHostKey.pem

[root@strongswan ipsec.d]# ipsec pki --pub --in private/vpnHostKey.pem --type rsa | ipsec pki --issue --lifetime 730 --cacert cacerts/strongswanCert.pem --cakey private/strongswanKey.pem --dn "C=Ir, O=IT, CN=StrongSwanVPN" --san 192.168.1.1 --flag serverAuth --outform pem > certs/vpnHostCert.pem

# Generate Client Certificate :
[root@strongswan ipsec.d]# ipsec pki --gen --type rsa --size 2048 --outform pem > private/ClientKey.pem
[root@strongswan ipsec.d]# chmod 600 private/ClientKey.pem
[root@strongswan ipsec.d]# ipsec pki --pub --in private/ClientKey.pem --type rsa | ipsec pki --issue --lifetime 730 --cacert cacerts/strongswanCert.pem --cakey private/strongswanKey.pem --dn "C=Ir, O=IT, CN=StrongSwanVPN" --outform pem > certs/ClientCert.pem

# Export CLIENT CERTIFICATE As a PKCS#12 File :
[root@strongswan ipsec.d]# openssl pkcs12 -export -inkey private/ClientKey.pem -in certs/ClientCert.pem -name "Client's VPN Certificate" -certfile cacerts/strongswanCert.pem -caname "strongSwan Root CA" -out Client.p12

# Configure StrongSwan :
[root@strongswan ~]# vim /etc/strongswan/ipsec.conf
------------------------
config setup
   uniqueids=no

conn    standard_ikev2
        keyexchange=ikev2
        ike=aes256-sha256-modp1024,3des-sha1-modp1024,aes256-sha1-modp1024!
        esp=aes256-sha256,3des-sha1,aes256-sha1!
        fragmentation=no
        rekey=no
        left=192.168.1.1
        leftsendcert=always
        leftfirewall=yes
        leftsubnet=0.0.0.0/0
        leftcert=vpnHostCert.pem
        right=%any
        rightauth=eap-radius
        rightsourceip=10.0.0.0/24
        eap_identity=%any
        dpdaction=clear
        auto=add
------------------------
[root@strongswan ~]# vim /etc/strongswan/ipsec.secrets
: RSA vpnHostKey.pem

[root@strongswan ~]# vim /etc/strongswan/strongswan.conf
------------------------
charon {
      load_modular = yes  
      compress = yes
         plugins {
            include strongswan.d/charon/*.conf
               eap-radius {
                    servers {
                        server-a {
                            accounting = yes
                            secret = 123456
                            address = 192.168.1.1
                            auth_port = 1812
                            acct_port = 1813
                        }
                    }
                }
        }

    include strongswan.d/*.conf
}
------------------------
[root@strongswan ~]# vim /etc/sysctl.conf
net.ipv4.ip_forward = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

# start strongswan service :
[root@strongswan ~]# systemctl start strongswan && systemctl enable strongswan

# Configure FreeRADIUS :
[root@strongswan ~]# vim /etc/raddb/mods-available/sql
------------------------
database = "mysql"
driver = "rlm_sql_mysql"
server = "localhost"
port = 3306
login = "radius"
password = "radius-password"
radius_db = "radius"
read_clients = yes
------------------------

# Enable sql Module :
[root@strongswan ~]# ln -s /etc/raddb/mods-available/sql /etc/raddb/mods-enabled/sql

# Comment "files" and Uncomment "sql" :
[root@strongswan ~]# vim /etc/raddb/sites-available/default

# Comment -> "files" and Uncomment -> "sql" :
[root@strongswan ~]# vim /etc/raddb/sites-available/inner-tunnel

[root@strongswan ~]# vim /etc/raddb/client.conf
------------------------
client 0.0.0.0 {
        secret          = 123456
        nas_type        = other
        shortname       = 0.0.0.0
        require_message_authenticator = no
}
------------------------
[root@strongswan ~]# cat /etc/strongswan/ipsec.d/cacerts/strongswanCert.pem > /etc/raddb/certs/ca.pem
[root@strongswan ~]# cat /etc/strongswan/ipsec.d/certs/vpnHostCert.pem > /etc/raddb/certs/server.pem
[root@strongswan ~]# cat /etc/strongswan/ipsec.d/private/vpnHostKey.pem > /etc/raddb/certs/server.key
[root@strongswan ~]# cat /etc/raddb/certs/server.key >> /etc/raddb/certs/server.pem

# start radiusd service :
[root@strongswan ~]# systemctl start radiusd && systemctl enable radiusd

## Configure MariaDB :
[root@strongswan ~]# systemctl start mariadb && systemctl enable mariadb
[root@strongswan ~]# mysql_secure_installation

[root@strongswan ~]# mysql -u root -p
Enter Password: ******

MariaDB> create database radius;
MariaDB> grant all privileges on radius.* to radius@localhost identified by "radius-password";
MariaDB> flush privileges;
MariaDB> use radius;
MariaDB> source /etc/raddb/mods-config/sql/main/mysql/schema.sql;

# add username|password :
MariaDB> INSERT INTO radcheck (username,attribute,op,VALUE) VALUES ('ehsan','Cleartext-Password',':=','eh@12345');
MariaDB> INSERT INTO radcheck (username,attribute,op,VALUE) VALUES ('alireza','Cleartext-Password',':=','abc123');