摘要:本文主要向大家介绍了MySQL数据库之CentOS6.5 部署***管理系统(StrongSwan+iKEv2+Freeradiu+Mysql+Daloradius) ,通过具体的内容向大家展现,希望对大家学习MySQL数据库有所帮助。
本文主要向大家介绍了MySQL数据库之CentOS6.5 部署***管理系统(StrongSwan+iKEv2+Freeradiu+Mysql+Daloradius) ,通过具体的内容向大家展现,希望对大家学习MySQL数据库有所帮助。
一、环境介绍
Server IP:192.168.30.133
System: CentOS 6.5
Client:Winodows 7
二、编译安装StrongSwan
1.下载StrongSwan
# wget //download.strongswan.org/strongswan.tar.gz
2.安装相关库
# yum update -y
# yum install pam-devel openssl-devel make gcc gmp-devel
3.编译安装
# ./configure --enable-eap-identity --enable-eap-md5 \
--enable-eap-mschapv2 --enable-eap-tls --enable-eap-ttls --enable-eap-peap \
--enable-eap-tnc --enable-eap-dynamic --enable-eap-radius --enable-xauth-eap \
--enable-xauth-pam --enable-dhcp --enable-openssl --enable-addrblock --enable-unity \
--enable-certexpire --enable-radattr --enable-swanctl --enable-openssl --disable-gmp
make -j 8 && make install && echo OK
注:如果出现错误:
configure: WARNING: unrecognized options: --enable-nat-transport
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... configure: error: newly created file
is older than distributed files!Check your system clock
解决方法:(原因:时间不对)
# cp -Rf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
# cat /etc/sysconfig/clock
# ntpdate 133.100.11.8(或 s2m.time.edu.cn)
# sed -i 's#ZONE="America/New_York"#ZONE="Asia/Shanghai"#g' /etc/sysconfig/clock
# hwclock -w
# date -R
4、生成证书
# mkdir key && cd key
#### 生成一个私钥 ####
# ipsec pki --gen --outform pem > ca.pem
# ipsec pki --self --in ca.pem --dn "C=cn, O=***stsck, CN=××× CA" \
--ca --lifetime 3650 --outform pem >ca.cert.pem
# ipsec pki --gen --outform pem > server.pem
# ipsec pki --pub --in server.pem | ipsec pki --issue --lifetime 1200 \
--cacert ca.cert.pem --cakey ca.pem --dn "C=cn, O=***stsck, CN=192.168.30.133" \
--san="192.168.30.133" --flag serverAuth --flag ikeIntermediate --outform pem > server.cert.pem
# ipsec pki --gen --outform pem > client.pem
# ipsec pki --pub --in client.pem | ipsec pki --issue --cacert \
ca.cert.pem --cakey ca.pem --dn "C=cn, O=***stsck, CN=××× Client" --outform pem > client.cert.pem
备注:C 表示国家,O 表示组织名,如***stack CN为通用名保持默认。(在整个部署过程中要保持一致)
CN=192.168.30.133为你的VPS外网地址
5、安装证书
cp ca.cert.pem /usr/local/etc/ipsec.d/cacerts/
cp server.cert.pem /usr/local/etc/ipsec.d/certs/
cp server.pem /usr/local/etc/ipsec.d/private/
cp client.cert.pem /usr/local/etc/ipsec.d/certs/
cp client.pem /usr/local/etc/ipsec.d/private/
【卸载证书:非第一次安装时需要此步操作,如果第一次安装不用此步骤】
rm -rf /usr/local/etc/ipsec.d/cacerts/ca.cert.pem
rm -rf /usr/local/etc/ipsec.d/certs/server.cert.pem
rm -rf /usr/local/etc/ipsec.d/private/server.pem
rm -rf /usr/local/etc/ipsec.d/certs/client.cert.pem
rm -rf /usr/local/etc/ipsec.d/private/client.pem
6、配置strongswan
a、修改/usr/local/etc/ipsec.conf;如下:
# vim /etc/ipsec.conf
config setup
strictcrlpolicy=no
uniqueids=no #多台设备同时在线 conn iOS_cert
keyexchange=ikev1
fragmentation=yes
left=%defaultroute
leftauth=pubkey
leftsubnet=0.0.0.0/0
leftcert=server.cert.pem
right=%any
rightauth=pubkey
rightauth2=xauth
rightsourceip=10.11.0.0/24
rightcert=client.cert.pem
auto=add
conn android_xauth_psk
keyexchange=ikev1
left=%defaultroute
leftauth=psk
leftsubnet=0.0.0.0/0
right=%any
rightauth=psk
rightauth2=xauth
rightsourceip=10.12.0.0/24
auto=add
conn networkmanager-strongswan
keyexchange=ikev2
left=%defaultroute
leftauth=pubkey
leftsubnet=0.0.0.0/0
leftcert=server.cert.pem
right=%any
rightauth=pubkey
rightsourceip=10.13.0.0/24
rightcert=client.cert.pem
auto=add
conn ios_ikev2
keyexchange=ikev2
ike=aes256-sha256-modp2048,3des-sha1-modp2048,aes256-sha1-modp2048!
esp=aes256-sha256,3des-sha1,aes256-sha1!
rekey=no
left=%defaultroute
leftid=192.168.30.133
leftsendcert=always
leftsubnet=0.0.0.0/0
leftcert=server.cert.pem
right=%any
rightauth=eap-mschapv2
rightsourceip=10.14.0.0/24
rightsendcert=never
eap_identity=%any
dpdaction=clear
fragmentation=yes
auto=add
conn windows7
keyexchange=ikev2
ike=aes256-sha1-modp1024!
rekey=no
left=%defaultroute
leftauth=pubkey
leftsubnet=0.0.0.0/0
leftcert=server.cert.pem
right=%any
rightauth=eap-mschapv2
rightsourceip=10.15.0.0/24
rightsendcert=never
eap_identity=%any
auto=add
[该配置文件详解请参考:https://zh.opensuse.org/SDB:Setup_Ipsec_×××_with_Strongswan]
b、修改/usrlocal/etc/strongswan.conf 将内容替换成如下:
# vim /usr/local/etc/strongswan.conf
charon {
load_modular = yes
duplicheck.enable = no
compress = yes
plugins {
include strongswan.d/charon/*.conf
}
dns1 = 8.8.8.8
dns2 = 8.8.4.4
nbns1 = 8.8.8.8
nbns2 = 8.8.4.4
}
include strongswan.d/*.conf
c、修改/usr/local/etc/ipsec.secrets(没有此文件请自行创建)
# vim /usr/local/etc/ipsec.secrets
: RSA server.pem
: PSK "myPSKkey"
: XAUTH "myXAUTHPass"
[用户名] %any : EAP "[密码]
【解:】
将上面的myPSKkey单词更改为你需要的PSK认证方式的密钥;
将上面的myXAUTHPass单词更改为你需要的XAUTH认证方式的密码,该认证方式的用户名是随意的;
将上面的[用户名]改为自己想要的登录名,[密码]改为自己想要的密码([]符号去掉),可以添加多行,
得到多个用户,这即是使用IKEv2的用户名+密码认证方式的登录凭据.
7、配置网络转发规则转发
a、设置iptables规则
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.10.0.0/24 -j ACCEPT
iptables -A FORWARD -s 10.11.0.0/24 -j ACCEPT
iptables -A FORWARD -s 10.12.0.0/24 -j ACCEPT
iptables -A FORWARD -s 10.13.0.0/24 -j ACCEPT
iptables -A INPUT -p esp -j ACCEPT
iptables -A INPUT -p udp --dport 500 -j ACCEPT
iptables -A INPUT -p tcp --dport 500 -j ACCEPT
iptables -A INPUT -p udp --dport 4500 -j ACCEPT
iptables -A INPUT -p udp --dport 1701 -j ACCEPT
iptables -A INPUT -p tcp --dport 1723 -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s 10.10.0.0/24 -j MASQUERADE
# service iptables save
注意iptables规则的顺序。以下做为参考:
# Generated by iptables-save v1.4.7 on Thu Dec 8 12:51:52 2016
*nat
:PREROUTING ACCEPT [2:156]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -s 10.10.0.0/24 -j MASQUERADE
-A POSTROUTING -s 10.11.0.0/24 -j MASQUERADE
-A POSTROUTING -s 10.12.0.0/24 -j MASQUERADE
-A POSTROUTING -s 10.13.0.0/24 -j MASQUERADE
COMMIT
# Completed on Thu Dec 8 12:51:52 2016
# Generated by iptables-save v1.4.7 on Thu Dec 8 12:51:52 2016
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [39:3992]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p esp -j ACCEPT
-A INPUT -p udp -m udp --dport 500 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 500 -j ACCEPT
-A INPUT -p udp -m udp --dport 4500 -j ACCEPT
-A INPUT -p udp -m udp --dport 1701 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 1723 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.10.0.0/24 -j ACCEPT
-A FORWARD -s 10.11.0.0/24 -j ACCEPT
-A FORWARD -s 10.12.0.0/24 -j ACCEPT
-A FORWARD -s 10.13.0.0/24 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-port-unreachable
COMMIT
# Completed on Thu Dec 8 12:51:52 2016
# service iptables restart
b、设置ip_forward转发
# vim /etc/sysctl.conf
net.ipv4.ip_forward = 0
改为:
net.ipv4.ip_forward = 1
sysctl -p
c、下载ca.cert.pem证书导入windows客户端或苹果Mac系统:证书的具体导入方法:
# yum -y install lrzsz
# cd /soft/strongswan-5.5.1/key
# sz ca.cert.pem
二、部署Freeradius+mysql+daloradius
1、安装Freeradius和Mysql
# yum -y install freeradius freeradius-mysql freeradius-utils mysql-server
2、启动Mysql及设置密码
# service mysqld start
# chkconfig mysqld on
# mysql_secure_installation
3、导入Freeradius库数据
# mysql -uroot -p
mysql> CREATE DATABASE radius;
mysql> GRANT ALL PRIVILEGES ON radius.* TO radius@'localhost' IDENTIFIED BY "radpass";
mysql> GRANT ALL PRIVILEGES ON radius.* TO radius@'%' IDENTIFIED BY "radpass";
mysql> flush privileges;
mysql> use radius;
mysql> SOURCE /etc/raddb/sql/mysql/schema.sql
mysql> SOURCE /etc/raddb/sql/mysql/cui.sql
mysql> SOURCE /etc/raddb/sql/mysql/ippool.sql
mysql> SOURCE /etc/raddb/sql/mysql/nas.sql
mysql> SOURCE /etc/raddb/sql/mysql/wimax.sql
4、配置Freeradius连接Mysql
# vim /etc/raddb/sql.conf
# Connection info:
server = "localhost"
#port = 3306
login = "radius"
password = "radpass"
# Database table configuration for everything except Oracle
radius_db = "radius"
#第108行
readclients = yes
5、使用sql数据库里的nas表读取客户端信息
# vim /etc/raddb/radiusd.conf
#$INCLUDE sql.conf
修改后:
$INCLUDE sql.conf
# vim /etc/raddb/sites-available/default
需要修改的行数及修改后的结果:例:#001行 line001
#170行 #files
#177 sql
#396 #radutmp
#397 sradutmp
#406 sql
#450 #radutmp
#454 sql
#475 sql
#577 sql
# vim /etc/raddb/sites-available/inner-tunnel
#125 #file
#132 sql
#252 #radutmp
#256 sql
#278 sql
#302 sql
修改密钥:
# vim /etc/raddb/clients.conf
secret = testing123
6、添加测试用户:
# mysql -uroot -p
mysql> use radius;
mysql> insert into radcheck (username,attribute,op,value) \
values ('test','User-Password',':=','test');
mysql> flush privileges;
mysql> exit;
测试Freeradius+Mysql
以Debug模式启动Freeradius:
# radiusd -X
另启一个窗口测试下:
# radtest test test . testing123
Sending Access-Request of id 71 to 127.0.0.1 port 1812
User-Name = "yzl"
User-Password = "yzl"
NAS-IP-Address = 127.0.0.1
NAS-Port = 0
Message-Authenticator = 0x00000000000000000000000000000000
rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=71, length=55
Reply-Message = "Hello yzl !"
Reply-Message = "Regexp match for PAP"
看到”Access-Accept“说明成功。
7、部署Daloradius
a、安装LAMP环境:
# yum -y install php-mysql php php-gd php-pear-DB httpd
b、下载Daloradius
下载地址:
//jaist.dl.sourceforge.net/project/daloradius/daloradius/daloradius0.9-9/daloradius-0.9-9.tar.gz
汉化版地址://pan.baidu.com/s/1c2h2h2K
# cd /soft
# wget \
//jaist.dl.sourceforge.net/project/daloradius/daloradius/daloradius0.9-9/daloradius-0.9-9.tar.gz
# tar xf daloradius-0.9-9.tar.gz
c、导入daloradius库文件
# mysql -uroot -p
mysql> use radius;
mysql> SOURCE /soft/daloradius-0.9-9/contrib/db/fr2-mysql-daloradius-and-freeradius.sql
d、修改daloradius连接库文件:
# vim /soft/daloradius-0.9-9/library/daloradius.conf.php
$configValues['DALORADIUS_VERSION'] = '0.9-9';
$configValues['FREERADIUS_VERSION'] = '2';
$configValues['CONFIG_DB_ENGINE'] = 'mysql';
$configValues['CONFIG_DB_HOST'] = 'localhost';
$configValues['CONFIG_DB_USER'] = 'radius';
$configValues['CONFIG_DB_PASS'] = 'radpass';
$configValues['CONFIG_DB_NAME'] = 'radius';
$configValues['CONFIG_FILE_RADIUS_PROXY'] = '/etc/raddb/proxy.conf';
$configValues['CONFIG_PATH_RADIUS_DICT'] = '/etc/raddb';
$configValues['CONFIG_PATH_DALO_VARIABLE_DATA'] = '/var/www/html/daloradius/var';
$configValues['CONFIG_LOG_FILE'] = '/var/www/html/daloradius/var/daloradius.log';
e、拷备文件至apache工作目录:/var/www/html
# mv /soft/daloradius-0.9-9 /var/www/html/daloradius
f、创建日志文件:
# touch /var/www/html/daloradius/var/daloradius.log
g、赋权给apache:
# chown -R apache:apache /var/www/html/daloradius
h、修改redius日志文件:
# vim /etc/raddb/radiusd.conf
#file = ${logdir}/radius.log
file = /var/log/radius.log
# chmod 644 /var/log/messages
# vim /var/www/html/daloradius/library/exten-radius_log.php
$logfile_loc = array();
$logfile_loc[1] = '/var/log/freeradius/radius.log';
$logfile_loc[2] = '/usr/local/var/log/radius/radius.log';
$logfile_loc[3] = '/var/log/radius/radius.log';
$logfile_loc[4] = '/var/log/radius.log';
i、将用户的同步会话限制为只有一个,新用户必须添加到用户组
# vim /etc/raddb/sql/mysql/dialup.conf
查找simul_count_query将290-293行注释去掉
# mysql -uroot -p
mysql> use radius;
mysql> INSERT INTO radgroupcheck ( id , GroupName , Attribute , op , Value ) \
VALUES (NULL , 'users', 'Simultaneous-Use', ':=', '1');
j、修改apache配置文件
本文由职坐标整理并发布,希望对同学们学习MySQL有所帮助,更多内容请关注职坐标数据库MySQL数据库频道!
您输入的评论内容中包含违禁敏感词
我知道了
请输入正确的手机号码
请输入正确的验证码
您今天的短信下发次数太多了,明天再试试吧!
我们会在第一时间安排职业规划师联系您!
您也可以联系我们的职业规划师咨询:
版权所有 职坐标-一站式IT培训就业服务领导者 沪ICP备13042190号-4
上海海同信息科技有限公司 Copyright ©2015 www.zhizuobiao.com,All Rights Reserved.
沪公网安备 31011502005948号