☰

CentOS 和 Free-Radius（虚拟/测试可用但 ssh 不可用） Cisco-ISR

tag-icon • tag-icon centos7 freeradius
CentOS 和 Free-Radius（虚拟/测试可用但 ssh 不可用） Cisco-ISR

因为我看到一些 deme/dummy 测试，所以我认为 CentOS-7 的自由半径工作正常，但 ISR 2921 上出现了问题。

2921 has IP of 10.20.30.1 on subinterface vlan 888.
Free-Radius has IP of 10.20.30.100 on vlan 888.

仍然无法使用 free-radius 凭证进行 ssh。

我可以看到凭证查询，但是通过自由半径进行的 SSH 身份验证仍然不起作用。

（我可以在其他地方检查思科方面，但我的自由半径配置是否可以与任何供应商一起使用？）。

登录 2921

May 27 21:18:34.799: %RADIUS-4-RADIUS_ALIVE: RADIUS server 10.20.30.100:1812,1813 is being marked alive.
May 27 21:30:42.837: %RADIUS-4-RADIUS_ALIVE: RADIUS server 10.20.30.100:1812,1813 is being marked alive.
ISR-2921#

登录 cent-7

[root@free-radius 10.20.30.1]# cat detail-20170527 
Sat May 27 14:18:34 2017
        User-Name = 'dummy'
        Acct-Status-Type = Interim-Update
        Acct-Session-Id = '00000000'
        Acct-Authentic = RADIUS
        Service-Type = Framed-User
        NAS-IP-Address = 10.20.30.1
        Acct-Delay-Time = 15
        Event-Timestamp = 'May 27 2017 14:18:19 PDT'
        Acct-Unique-Session-Id = '99c501164df6390fd6764fea1dff5aa8'
        Timestamp = 1495919914

Sat May 27 14:30:42 2017
        User-Name = 'freeRADIUS'
        Acct-Status-Type = Interim-Update
        Acct-Session-Id = '00000000'
        Acct-Authentic = RADIUS
        Service-Type = Framed-User
        NAS-IP-Address = 10.20.30.1
        Acct-Delay-Time = 0
        Event-Timestamp = 'May 27 2017 14:30:42 PDT'
        Acct-Unique-Session-Id = 'ba1171226b1950324d13959f95b82db7'
        Timestamp = 1495920642

[root@free-radius 10.20.30.1]# ls
detail-20170527
[root@free-radius 10.20.30.1]#

配置 2921

!
aaa new-model
!
!
aaa group server radius RASERV
 server name RASERV-1
 retransmit 5
 timeout 10
!
aaa authentication login default group radius local-case
aaa authentication login use-radius group radius local
aaa authentication login vty group radius local
aaa authentication ppp user-radius if-needed group radius
aaa authentication dot1x default group RASERV
aaa authorization exec default group radius local 
aaa authorization network default group radius if-authenticated 
aaa accounting dot1x default start-stop group RASERV
aaa accounting exec default start-stop group radius
aaa accounting system default start-stop group radius
!
!
ip radius source-interface GigabitEthernet0/2.888 
!
!
access-list 1 permit any
!
radius server RASERV-1
 address ipv4 10.20.30.100 auth-port 1812 acct-port 1813
 automate-tester username freeRADIUS probe-on
 key 7 110D778223
!
line vty 0 4
 login authentication vty
 transport input ssh
!

在 cent-7 上配置

[root@free-radius 10.20.30.1]# cat /etc/raddb/clients.conf

client 10.20.30.1 {
        ipaddr = 10.20.30.1
        secret = 1ass341
        require_message_authenticator = no
        nas_type = other
}


[root@free-radius 10.20.30.1]# cat /etc/raddb/users
freeCISCO Auth-Type := System
  Service-Type = NAS-Prompt-User,
  cisco-avpair = "shell:priv-lvl=15"

答案1

谢谢 ”赫尔蒂图“

调试提示足以修复服务器。

修改服务器上的“用户”

test Cleartext-Password := "testing"

现在

May 29 17:57:27.039: RADIUS: Received from id 1645/13 10.20.30.100:1812, Access-Accept, len 20

相关内容