☰

RADIUS 忽略对身份验证地址的请求

tag-icon • tag-icon networking authentication radius
RADIUS 忽略对身份验证地址的请求

仅当我使用本地主机时，RADIUS 才有效。我无法使用它的 IP 地址。

输出radtest user password localhost 1812 testing123：：

Sending Access-Request of id 251 to 127.0.0.1 port 1812
    User-Name = "user"
    User-Password = "password"
    NAS-IP-Address = 127.0.1.1
    NAS-Port = 1812
    Message-Authenticator = 0x00000000000000000000000000000000
rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=251, length=33
    Reply-Message = "Hello, user"

但如果我想使用它的 IP 地址

输出radtest user password 192.168.2.218 1812 testing123：

Sending Access-Request of id 28 to 192.168.2.218 port 1812
    User-Name = "user"
    User-Password = "password"
    NAS-IP-Address = 127.0.1.1
    NAS-Port = 1812
    Message-Authenticator = 0x00000000000000000000000000000000
Sending Access-Request of id 28 to 192.168.2.218 port 1812
    User-Name = "user"
    User-Password = "password"
    NAS-IP-Address = 127.0.1.1
    NAS-Port = 1812
    Message-Authenticator = 0x00000000000000000000000000000000
Sending Access-Request of id 28 to 192.168.2.218 port 1812
    User-Name = "user"
    User-Password = "password"
    NAS-IP-Address = 127.0.1.1
    NAS-Port = 1812
    Message-Authenticator = 0x00000000000000000000000000000000
radclient: no response from server for ID 28 socket 3

输出sudo freeradius -X：

Ignoring request to authentication address * port 1812 from unknown client 192.168.2.218 port 46554
Ready to process requests.
Ignoring request to authentication address * port 1812 from unknown client 192.168.2.218 port 46554
Ready to process requests.

用户输入/etc/freeradius/users：

"user"          Cleartext-Password := "password"
                Reply-Message = "Hello, %{User-Name}"

中的条目clients.conf：

client 192.168.2.218 {
    ipaddr = 192.168.2.218
    secret = testing123
}

答案1

为了修复该问题，我必须注释掉client localhost {并ipaddr = 127.0.0.1添加/etc/freeradius/clients.conf。

注释掉以下内容

#client localhost {

        #  Allowed values are:
        #       dotted quad (1.2.3.4)
        #       hostname    (radius.example.com)
#       ipaddr = 127.0.0.1

        #  OR, you can use an IPv6 address, but not both
        #  at the same time.
#       ipv6addr = ::   # any.  ::1 == localhost

然后添加

client openwrt {
        ipaddr = 192.168.2.1
        secret = testing123
        require_message_authenticator = yes

允许端口1812和1813

sudo ufw allow 1812

sudo ufw allow 1813

现在我的路由器使用半径。 在此处输入图片描述

答案2

我认为上述问题都与防火墙有关。在禁用 iptables 的 Ubuntu 16.04 上，我没有遇到任何问题。我只需添加网络，重新启动守护程序，它就可以正常工作。

client 192.168.0.0/16 {
   secret          = your_pw_here
   shortname       = reserved192
}

输出sudo freeradius -X 相当长，但很有趣。

底线： Sending Access-Accept of id blah to ip-blah port blah

相关内容