FreeRadius3 + Dhcp (Linux)

Установка FreeRaius версии 3

apt install freeradius

Конфигурирование Radius

Создаем конфиг dhcp:

ee /usr/local/etc/raddb/sites-enabled/dhcp

server dhcp {
        listen {
            type = dhcp
            ipaddr = 0.0.0.0
            port = 67
            broadcast = yes
        }
        dhcp DHCP-Discover {
            update reply {
                DHCP-Message-Type = DHCP-Offer
            }

            update reply {
                DHCP-Domain-Name-Server = 0.0.0.0
                DHCP-IP-Address-Lease-Time = 7200
                DHCP-DHCP-Server-Identifier = 10.0.1.1
            }

            sql.authorize
            ok
        }

        dhcp DHCP-Request {
            update reply {
                DHCP-Message-Type = DHCP-Ack
            }

            update reply {
                DHCP-Domain-Name-Server = 0.0.0.0
                DHCP-IP-Address-Lease-Time = 7200
                DHCP-DHCP-Server-Identifier = 10.0.1.1
            }

            sql.authorize
            sql.post-auth
            ok
        }

        dhcp {
            reject
        }
    }

Здесь 10.0.1.1 - это ip интерфейса, на котором нам нужно dhcp.

Создаем конфиг sql:

ee /usr/local/etc/raddb/mods-enabled/sql

sql {
        database = "mysql"
        driver = "rlm_sql_mysql"
        server = "localhost"
        port = 3306
        login = "nodeny"
        password = "hardpass"
        radius_db = "nodeny"

        delete_stale_sessions = yes

        sqltrace = no
        sqltracefile = ${logdir}/sqltrace.sql

        num_sql_socks = 5

        connect_failure_retry_delay = 60

        lifetime = 0

        max_queries = 0

        authorize_check_query = "call radcheck('%{DHCP-Client-Hardware-Address}')"
        authorize_reply_query = "call radreply('%{DHCP-Client-Hardware-Address}')"
        postauth_query = "call radupdate('%{DHCP-Client-Hardware-Address}','%{reply:Framed-IP-Address}',\
                'user=%{Calling-Station-Id};nas=%{NAS-IP-Address}')"
        accounting_update_query = "call radupdate('%{DHCP-Client-Hardware-Address}','%{Framed-IP-Address}',\
                'user=%{Calling-Station-Id};nas=%{NAS-IP-Address}')"
}

Mysql процедуры

ALTER DATABASE nodeny CHARACTER SET utf8 COLLATE utf8_general_ci;

DROP PROCEDURE IF EXISTS `radcheck`;
DELIMITER $$
CREATE PROCEDURE `radcheck` (IN login VARCHAR(64))
BEGIN
  SELECT Null, login, 'Cleartext-Password' AS Attribute, '' AS Value,':=';
END$$
DELIMITER ;

DROP PROCEDURE IF EXISTS `radreply`;
DELIMITER $$
CREATE PROCEDURE `radreply`(IN login VARCHAR(64))
BEGIN
    DECLARE usr_mac VARCHAR(12);
    DECLARE usr_ip VARCHAR(15);
    DECLARE usr_id INT;
    SELECT REPLACE(login, ':', '') INTO usr_mac;
    SELECT uid INTO usr_id FROM mac_uid WHERE mac=usr_mac;
    IF usr_id IS NOT NULL AND usr_id>0 THEN
        SELECT get_ip(usr_id) INTO usr_ip;
        UPDATE mac_uid SET ip=0 WHERE ip=INET_ATON(usr_ip) AND uid<>usr_id;
        UPDATE mac_uid SET ip=INET_ATON(usr_ip), time=UNIX_TIMESTAMP() WHERE uid=usr_id;
    ELSE
        START TRANSACTION;
        SELECT INET_NTOA(ip) INTO usr_ip FROM ip_pool
            WHERE uid=0 AND type='dynamic' AND `release` < UNIX_TIMESTAMP()
            ORDER BY RAND() LIMIT 1 FOR UPDATE;
        INSERT INTO mac_uid VALUES(
            NULL, usr_mac, INET_ATON(usr_ip), 0, UNIX_TIMESTAMP(), 0, 0, 0, '')
        ON DUPLICATE KEY
            UPDATE ip=IF(ip>0,ip,INET_ATON(usr_ip)), time=UNIX_TIMESTAMP();
        COMMIT;
        SELECT INET_NTOA(ip) INTO usr_ip FROM mac_uid WHERE mac=usr_mac;
        UPDATE ip_pool SET `release` = UNIX_TIMESTAMP() + 3600
            WHERE ip = INET_ATON(usr_ip);
    END IF;
    SELECT NULL, login, 'DHCP-Client-IP-Address', usr_ip, '=';
    SELECT NULL, login, 'Session-Timeout', '600', '=';
END$$
DELIMITER ;

DROP PROCEDURE IF EXISTS `radupdate`;
DELIMITER $$
CREATE PROCEDURE `radupdate`(
    IN login VARCHAR(64), IN ipa VARCHAR(16), IN properties VARCHAR(255))
BEGIN
    DECLARE usr_mac VARCHAR(16);
    SELECT REPLACE(login, ':', '') INTO usr_mac;
    CALL set_auth(ipa, CONCAT('mod=dhcp;user=', usr_mac, ';', REPLACE(properties,';','')));
    UPDATE mac_uid SET time=UNIX_TIMESTAMP() WHERE ip=INET_ATON(ipa) LIMIT 1;
END$$
DELIMITER ;

Проверим:

CALL radreply('00:11:22:33:44:55');