Ubuntu中使用freeradius配置RADIUS，并在RADIUS中配置LDAP 并实现AP认证

执行 sudo apt-get install freeradius freeradius-ldap freeradius-mysql进行安装freeradius

安装完成之后，他会自己启动，需要手动关闭，不然后面会报错，或者直接简单粗暴从任务管理器中kill相关进程也行

service freeradius stop

修改/etc/freeradius/3.0/sites-enabled/default的配置信息，找到如下内容，如果你的ldap是注释状态，你需要把注释去掉，保存退出。

随后修改文件/etc/freeradius/3.0/mods-available/ldap

ldap {
        server = '192.168.9.9'    #ldap服务器
        port = 389  #端口
        identity = 'cn=admin,dc=isyscore,dc=com'
        password = lululu
        base_dn = 'ou=People,dc=isyscore,dc=com'
        sasl {
        }
        update {
                control:Password-With-Header    += 'userPassword'
                control:NT-Password             := 'sambaNTPassword'  #必须要加 不然AP 无法通过认证
                control:                        += 'radiusControlAttribute'
                request:                        += 'radiusRequestAttribute'
                reply:                          += 'radiusReplyAttribute'
        }
        user {
                base_dn = "${..base_dn}"
                filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
                sasl {
                }
        }
        group {
                base_dn = "${..base_dn}"
                filter = '(objectClass=posixGroup)'
                membership_attribute = 'memberOf'
        }
        profile {
        }
        client {
                base_dn = "${..base_dn}"
                filter = '(objectClass=radiusClient)'
                template {
                }
                attribute {
                        ipaddr                          = 'radiusClientIdentifier'
                        secret                          = 'radiusClientSecret'
                }
        }
        accounting {
                reference = "%{tolower:type.%{Acct-Status-Type}}"
                type {
                        start {
                                update {
                                        description := "Online at %S"
                                }
                        }
                        interim-update {
                                update {
                                        description := "Last seen at %S"
                                }
                        }
                        stop {
                                update {
                                        description := "Offline at %S"
                                }
                        }
                }
        }
        post-auth {
                update {
                        description := "Authenticated at %S"
                }
        }
        options {
                chase_referrals = yes
                rebind = yes
                res_timeout = 10
                srv_timelimit = 3
                net_timeout = 1
                idle = 60
                probes = 3
                interval = 3
                ldap_debug = 0x0028
        }
        tls {
        }
        pool {
                start = ${thread[pool].start_servers}
                min = ${thread[pool].min_spare_servers}
                max = ${thread[pool].max_servers}
                spare = ${thread[pool].max_spare_servers}
                uses = 0
                retry_delay = 30
                lifetime = 0
                idle_timeout = 60
        }
}

新建文件/etc/freeradius/3.0/sites-available/site_ldap

server site_ldap{
        listen{
                ipaddr=0.0.0.0
                port=1833
                type=auth
        }
        authorize{
                update{
                        control:Auth-Type := ldap
                }
        }
        authenticate{
                Auth-Type ldap{
                        ldap
                }
        }
        post-auth{
                Post-Auth-Type Reject{
                }
        }
}

之后进行软连接

sudo ln -s /etc/freeradius/3.0/sites-available/site_ldap /etc/freeradius/3.0/sites-enabled/

然后启动RADIUS服务，sudo freeradius x

如果有问题可以开启debug模式查看freeradius -X

接入AP

接入AP 需要共享密钥，该值在clients.conf里设置

/etc/freeradius/3.0/clients.conf

secret = lululu

并允许所有ipv4接入

ipv4addr = *

之后再AP web控制台创建无线网络 选择加密方式 wpa 企业级

选择radius配置

之后通过wifi登录即可