Freeradius+mpd5+mysq на одной машине

FreeBSD 7.3, FreeRADIUS 2.1.10, mysql-server-5.5.7

Настраиваем работу freeradius и mpd на одной машине

Редактируем mpd.conf

startup:
 # configure mpd users
 set user foo bar admin
 set user foo1 bar1
 # configure the console
 set console self 77.*.*.53 5005 #интерфейс на котором висит mpd и к нему же 
                                        #будим  подключаться
 set console open

default:
 load pptp
 
pptp:
# Create clonable bundle template named B
 create bundle template pptp
 set iface enable proxy-arp
 set iface idle 1800
 set iface enable tcpmssfix
 set ipcp yes vjcomp
# Specify IP address pool for dynamic assigment.
 set ipcp ranges 77.*.*.53/32  172.16.1.100/28
 set ipcp dns 77.*.*.1
# The five lines below enable Microsoft Point-to-Point encryption
# (MPPE) using the ng_mppc(8) netgraph node type.
 set bundle enable compression
 set ccp yes mppc
 set mppc yes e40
 set mppc yes e128
 set mppc yes stateless

# Create clonable link template named L
 create link template pptp-link pptp
# Set bundle template to use
 set link action bundle pptp
# Multilink adds some overhead, but gives full 1500 MTU.
 set link enable multilink
 set link yes acfcomp protocomp
 set link enable chap
# We can use use RADIUS authentication/accounting by including
# another config section with label 'radius'.
 load radius
 set link keep-alive 10 60
# We reducing link mtu to avoid GRE packet fragmentation.
 set link mtu 1460
# Allow to accept calls
        set link enable incoming

radius:
 set radius server localhost testing123 1812 1813  # настройки для radius                                                                     # адрес /secret/порты(auth, acct) set radius retries 3
 set radius timeout 3
# send the given IP in the RAD_NAS_IP_ADDRESS attribute to the server.
 set radius me localhost
# send accounting updates every 5 minutes
 set auth acct-update 300
# enable RADIUS, and fallback to mpd.secret, if RADIUS auth failed
 set auth enable radius-auth
# enable RADIUS accounting
 set auth enable radius-acct
# protect our requests with the message-authenticator
 set radius enable message-authentic

MPD чувствителен к пробелам, все отступы делать табом.

radiusd.conf

prefix = /usr/local
exec_prefix = ${prefix}
sysconfdir = ${prefix}/etc
localstatedir = /var
sbindir = ${exec_prefix}/sbin
logdir = /var/log
raddbdir = ${sysconfdir}/raddb
radacctdir = ${logdir}/radacct

#  name of the running server.  See also the "-n" command-line option.
name = radiusd

#  Location of config and logfiles.
confdir = ${raddbdir}
run_dir = ${localstatedir}/run/${name}

# Should likely be ${localstatedir}/lib/radiusd
db_dir = ${raddbdir}

libdir = /usr/local/lib/freeradius-2.1.10

pidfile = ${run_dir}/${name}.pid

user = freeradius
group = freeradius
max_request_time = 30
cleanup_delay = 5
max_requests = 1024
listen {
 type = auth
 ipaddr = localhost #адрес, которой будим слушать
 port = 0
}


listen {
 ipaddr = localhost #адрес, которой будим слушать
 port = 0
 type = acct
}

hostname_lookups = no


allow_core_dumps = no
regular_expressions = yes
extended_expressions = yes

log {
 destination = files
 file = ${logdir}/radius.log
 syslog_facility = daemon
 stripped_names = no
 auth = no
 auth_badpass = yes
 auth_goodpass = no
}

checkrad = ${sbindir}/checkrad


security {
 max_attributes = 200
 reject_delay = 1
 status_server = yes
}

proxy_requests  = yes
$INCLUDE proxy.conf

$INCLUDE clients.conf



thread pool {
 start_servers = 5
 max_servers = 32
 min_spare_servers = 3
 max_spare_servers = 10
 max_requests_per_server = 0
}

modules {
 $INCLUDE ${confdir}/modules/
 session {
  radutmp
 }
 $INCLUDE eap.conf

 $INCLUDE sql.conf

 $INCLUDE sql/mysql/counter.conf

 $INCLUDE sqlippool.conf

 chap {
  authtype = CHAP
 }
 pap {
  encryption_scheme = clear
 }
 radutmp {
 }
}

chap mschap 
 authorize {
  chap
  mschap
  files
  sql
  pap
 auth_log
 files
 }

 authenticate {
  Auth-Type PAP {
   pap
   }
  Auth-Type CHAP {
   chap
  }
  Auth-Type MS-CHAP {
   mschap
  }
}
accounting {
  detail
  sql
  radutmp
}



instantiate {
 exec
 expr
 expiration
 logintime
}

$INCLUDE sites-enabled/

clients.conf

client localhost {
 secret  = testing123
 shortname = 127.0.0.1
}

У меня сначала не хотело работать. В логах mpd была ошибка

AUTH: Trying RADIUS
RADIUS: Authenticating user 'test'
RADIUS: rad_config: /usr/local/etc/raddb/radiusd.conf:54: invalid timeout
AUTH: RADIUS returned error
UTH: Trying INTERNAL
AUTH: User "test" not found in secret file
AUTH: INTERNAL returned: failed
AUTH: ran out of backends

Необходимо из файла mpd.conf убрать сточку
set radius config /usr/local/etc/raddb/radiusd.conf. Также был затык, подключение происходит, но клиент ничего не пингует. В правилах фаервола неправильно была маска указана.

Мои правила фаервола

#NAT
/sbin/ipfw -q add divert natd ip from 172.16.1.0/24 to 10.0.0.0/8
/sbin/ipfw -q add divert natd ip from 172.16.1.0/24 to any out via rl0
/sbin/ipfw -q add divert natd ip from any to 77.*.*.53

# lan <--> lan
/sbin/ipfw -q add  allow all from 10.0.0.0/8,192.168.1.254/24 to 10.0.0.0/8,172.16.1.0/24,192.168.1.254/24

# internet for  vpn clients
/sbin/ipfw -q add allow all from any to 172.16.1.0/24
/sbin/ipfw -q add allow all from 172.16.1.0/24 to any

#pptp
/sbin/ipfw -q add allow tcp from any 1723 to any via rl0
/sbin/ipfw -q add allow tcp from any to me dst-port 1723
/sbin/ipfw -q add allow gre from any to any

Полезные ссылки MPD - настройка собственного VPN-сервера