Squid3和freeradius - basic_radius_auth: RADIUS服务器无响应

Question

我有以下设置-免费设置使用MySQL数据库和日志会计那里也有。我可以看到这一切都是好的-因为当我运行一个radtest时，我得到了预期的结果。所以我相当确定freeradius部分是可以的。

当我配置squid3来使用它时-我得到了以下信息

2021/08/27 12:34:16| Starting new basicauthenticator helpers...
2021/08/27 12:34:16| helperOpenServers: Starting 1/20 'basic_radius_auth' processes
basic_radius_auth: No response from RADIUS server

在freeradius方面，我可以看到：

(2) Received Access-Request Id 6 from 172.17.0.1:59997 to 172.17.0.20:1812 length 87
(2)   User-Name = "me@mine.com"
(2)   User-Password = "password"
(2)   NAS-Port = 111
(2)   NAS-Port-Type = Async
(2)   NAS-IP-Address = 172.17.0.21
(2) # Executing section authorize from file /etc/freeradius/sites-enabled/default
(2)   authorize {
(2)     policy filter_username {
(2)       if (&User-Name) {
(2)       if (&User-Name)  -> TRUE
(2)       if (&User-Name)  {
(2)         if (&User-Name =~ / /) {
(2)         if (&User-Name =~ / /)  -> FALSE
(2)         if (&User-Name =~ /@[^@]*@/ ) {
(2)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(2)         if (&User-Name =~ /\.\./ ) {
(2)         if (&User-Name =~ /\.\./ )  -> FALSE
(2)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(2)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE
(2)         if (&User-Name =~ /\.$/)  {
(2)         if (&User-Name =~ /\.$/)   -> FALSE
(2)         if (&User-Name =~ /@\./)  {
(2)         if (&User-Name =~ /@\./)   -> FALSE
(2)       } # if (&User-Name)  = notfound
(2)     } # policy filter_username = notfound
(2)     [preprocess] = ok
(2)     [chap] = noop
(2)     [mschap] = noop
(2)     [digest] = noop
(2) suffix: Checking for suffix after "@"
(2) suffix: Looking up realm "mine.com" for User-Name = "me@mine.com"
(2) suffix: No such realm "mine.com"
(2)     [suffix] = noop
(2) eap: No EAP-Message, not doing EAP
(2)     [eap] = noop
(2)     [files] = noop
(2) sql: EXPAND %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}
(2) sql:    --> me@mine.com
(2) sql: SQL-User-Name set to 'me@mine.com'
rlm_sql (sql): Reserved connection (6)
(2) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id
(2) sql:    --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'me@mine.com' ORDER BY id
(2) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'me@mine.com' ORDER BY id
(2) sql: User found in radcheck table
(2) sql: Conditional check items matched, merging assignment check items
(2) sql:   Cleartext-Password := "password"
(2) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id
(2) sql:    --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'me@mine.com' ORDER BY id
(2) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'me@mine.com' ORDER BY id
(2) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority
(2) sql:    --> SELECT groupname FROM radusergroup WHERE username = 'me@mine.com' ORDER BY priority
(2) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'me@mine.com' ORDER BY priority
(2) sql: User not found in any groups
rlm_sql (sql): Released connection (6)
Need 1 more connections to reach min connections (3)
rlm_sql (sql): Opening additional connection (7), 1 of 30 pending slots used
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Connected to database 'radius' on 192.168.0.10 via TCP/IP, server version 5.5.5-10.6.4-MariaDB-1:10.6.4+maria~focal, protocol version 10
rlm_sql (sql): You probably need to lower "min"
rlm_sql (sql): Closing expired connection (2) - Hit idle_timeout limit
rlm_sql_mysql: Socket destructor called, closing socket
(2)     [sql] = ok
(2)     [expiration] = noop
(2)     [logintime] = noop
(2)     [pap] = updated
(2)   } # authorize = updated
(2) Found Auth-Type = PAP
(2) # Executing group from file /etc/freeradius/sites-enabled/default
(2)   Auth-Type PAP {
(2) pap: Login attempt with password
(2) pap: Comparing with "known good" Cleartext-Password
(2) pap: User authenticated successfully
(2)     [pap] = ok
(2)   } # Auth-Type PAP = ok
(2) # Executing section post-auth from file /etc/freeradius/sites-enabled/default
(2)   post-auth {
(2)     if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) {
(2)     if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name))  -> FALSE
(2)     update {
(2)       No attributes updated for RHS &session-state:
(2)     } # update = noop
(2) sql: EXPAND .query
(2) sql:    --> .query
(2) sql: Using query template 'query'
rlm_sql (sql): Reserved connection (6)
(2) sql: EXPAND %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}
(2) sql:    --> me@mine.com
(2) sql: SQL-User-Name set to 'me@mine.com'
(2) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M' )
(2) sql:    --> INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'me@mine.com', 'password', 'Access-Accept', '2021-08-27 12:44:12.863002' )
(2) sql: EXPAND /var/log/freeradius/sqllog.sql
(2) sql:    --> /var/log/freeradius/sqllog.sql
(2) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'me@mine.com', 'password', 'Access-Accept', '2021-08-27 12:44:12.863002' )
(2) sql: SQL query returned: success
(2) sql: 1 record(s) updated
rlm_sql (sql): Released connection (6)
(2)     [sql] = ok
(2)     [exec] = noop
(2)     policy remove_reply_message_if_eap {
(2)       if (&reply:EAP-Message && &reply:Reply-Message) {
(2)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(2)       else {
(2)         [noop] = noop
(2)       } # else = noop
(2)     } # policy remove_reply_message_if_eap = noop
(2)     if (EAP-Key-Name && &reply:EAP-Session-Id) {
(2)     if (EAP-Key-Name && &reply:EAP-Session-Id)  -> FALSE
(2)   } # post-auth = ok
(2) Sent Access-Accept Id 6 from 172.17.0.20:1812 to 172.17.0.1:59997 length 0
(2) Finished request
Waking up in 4.9 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 9.0 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 18.0 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 37.0 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 76.0 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 155.0 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 314.0 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 633.0 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 1272.0 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 2118.0 seconds.

在squid.conf中，我有以下内容

auth_param basic program /usr/lib/squid/basic_radius_auth -f /etc/squid/radius_config
auth_param basic realm proxy
acl authenticated proxy_auth REQUIRED
http_access allow authenticated

我不明白为什么radius服务器一切正常--报告

(2) pap: User authenticated successfully
(2)     [pap] = ok
(2)   } # Auth-Type PAP = ok

然后

(2) Sent Access-Accept Id 6 from 172.17.0.20:1812 to 172.17.0.1:59997 length 0
(2) Finished request

以及“发送重复回复”的错误？

有人知道我哪里错了吗？

Answer 1

Squid使用RADIUS "squid_radius_auth“身份验证

确保squid是使用--enable-basic-auth-helpers="squid_radius_auth“选项编译的，该选项仅在Squid-2.6.STABLE17或更高版本中可用。

创建radius配置文件

配置指定RADIUS的连接类型。该文件包含一个指令列表(每行一个)。以"#“开头的行将被忽略为注释。

模板radius配置

server radiusserver: specifies the name or address of the RADIUS server

secret somesecretstring: specifies the shared RADIUS secret.

identifier nameofserver: specifies what the proxy should identify itself as to the RADIUS server.  This directive is optional (optional)

port port-number: Specifies the port number or service name (default:1812)

radius配置示例: /etc/radius_config

server 192.168.10.20
secret someSecret

带有配置的测试身份验证squid_radius_auth命令行

/usr/local/squid/libexec/squid_radius_auth -f /etc/radius_config

不带配置的测试身份验证squid_radius_auth命令行

/usr/local/squid/libexec/squid_radius_auth -h 192.168.10.20 -w someSecret

在同一行键入您的radius用户名和密码，并用空格分隔，如果成功，则应返回"OK“作为响应。

经测试的squid.conf Configuration

auth_param basic program /usr/local/squid/libexec/squid_radius_auth -f /etc/radius_config
auth_param basic children 5
auth_param basic realm Web-Proxy
auth_param basic credentialsttl 5 minute
auth_param basic casesensitive off

acl radius-auth proxy_auth REQUIRED
http_access allow radius-auth
http_access allow localhost
http_access deny all