Squid3 and basic_radius_auth: No response from RADIUS server

Question

我有以下设置- freeradius设置使用MySQL数据库和日志会计到那里了。我可以看到这一切都很好，因为当我运行一个radtest时，我得到了预期的结果。所以我很确定自由半径部分都没问题

当我配置squid3使用这个-我得到以下

2021/08/27 12:34:16| Starting new basicauthenticator helpers...
2021/08/27 12:34:16| helperOpenServers: Starting 1/20 'basic_radius_auth' processes
basic_radius_auth: No response from RADIUS server

在自由半径一侧我可以看到:

(2) Received Access-Request Id 6 from 172.17.0.1:59997 to 172.17.0.20:1812 length 87
(2)   User-Name = "[e-mail]"
(2)   User-Password = "password"
(2)   NAS-Port = 111
(2)   NAS-Port-Type = Async
(2)   NAS-IP-Address = 172.17.0.21
(2) # Executing section authorize from file /etc/freeradius/sites-enabled/default
(2)   authorize {
(2)     policy filter_username {
(2)       if (&User-Name) {
(2)       if (&User-Name)  -> TRUE
(2)       if (&User-Name)  {
(2)         if (&User-Name =~ / /) {
(2)         if (&User-Name =~ / /)  -> FALSE
(2)         if (&User-Name =~ /@[^@]*@/ ) {
(2)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(2)         if (&User-Name =~ /../ ) {
(2)         if (&User-Name =~ /../ )  -> FALSE
(2)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+).(.+)$/))  {
(2)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+).(.+)$/))   -> FALSE
(2)         if (&User-Name =~ /.$/)  {
(2)         if (&User-Name =~ /.$/)   -> FALSE
(2)         if (&User-Name =~ /@./)  {
(2)         if (&User-Name =~ /@./)   -> FALSE
(2)       } # if (&User-Name)  = notfound
(2)     } # policy filter_username = notfound
(2)     [preprocess] = ok
(2)     [chap] = noop
(2)     [mschap] = noop
(2)     [digest] = noop
(2) suffix: Checking for suffix after "@"
(2) suffix: Looking up realm "mine.com" for User-Name = "[e-mail]"
(2) suffix: No such realm "mine.com"
(2)     [suffix] = noop
(2) eap: No EAP-Message, not doing EAP
(2)     [eap] = noop
(2)     [files] = noop
(2) sql: EXPAND %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}
(2) sql:    --> [e-mail]
(2) sql: SQL-User-Name set to '[e-mail]'
rlm_sql (sql): Reserved connection (6)
(2) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id
(2) sql:    --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '[e-mail]' ORDER BY id
(2) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '[e-mail]' ORDER BY id
(2) sql: User found in radcheck table
(2) sql: Conditional check items matched, merging assignment check items
(2) sql:   Cleartext-Password := "password"
(2) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id
(2) sql:    --> SELECT id, username, attribute, value, op FROM radreply WHERE username = '[e-mail]' ORDER BY id
(2) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = '[e-mail]' ORDER BY id
(2) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority
(2) sql:    --> SELECT groupname FROM radusergroup WHERE username = '[e-mail]' ORDER BY priority
(2) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = '[e-mail]' ORDER BY priority
(2) sql: User not found in any groups
rlm_sql (sql): Released connection (6)
Need 1 more connections to reach min connections (3)
rlm_sql (sql): Opening additional connection (7), 1 of 30 pending slots used
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Connected to database 'radius' on 192.168.0.10 via TCP/IP, server version 5.5.5-10.6.4-MariaDB-1:10.6.4+maria~focal, protocol version 10
rlm_sql (sql): You probably need to lower "min"
rlm_sql (sql): Closing expired connection (2) - Hit idle_timeout limit
rlm_sql_mysql: Socket destructor called, closing socket
(2)     [sql] = ok
(2)     [expiration] = noop
(2)     [logintime] = noop
(2)     [pap] = updated
(2)   } # authorize = updated
(2) Found Auth-Type = PAP
(2) # Executing group from file /etc/freeradius/sites-enabled/default
(2)   Auth-Type PAP {
(2) pap: Login attempt with password
(2) pap: Comparing with "known good" Cleartext-Password
(2) pap: User authenticated successfully
(2)     [pap] = ok
(2)   } # Auth-Type PAP = ok
(2) # Executing section post-auth from file /etc/freeradius/sites-enabled/default
(2)   post-auth {
(2)     if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) {
(2)     if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name))  -> FALSE
(2)     update {
(2)       No attributes updated for RHS &session-state:
(2)     } # update = noop
(2) sql: EXPAND .query
(2) sql:    --> .query
(2) sql: Using query template 'query'
rlm_sql (sql): Reserved connection (6)
(2) sql: EXPAND %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}
(2) sql:    --> [e-mail]
(2) sql: SQL-User-Name set to '[e-mail]'
(2) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M' )
(2) sql:    --> INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( '[e-mail]', 'password', 'Access-Accept', '2021-08-27 12:44:12.863002' )
(2) sql: EXPAND /var/log/freeradius/sqllog.sql
(2) sql:    --> /var/log/freeradius/sqllog.sql
(2) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( '[e-mail]', 'password', 'Access-Accept', '2021-08-27 12:44:12.863002' )
(2) sql: SQL query returned: success
(2) sql: 1 record(s) updated
rlm_sql (sql): Released connection (6)
(2)     [sql] = ok
(2)     [exec] = noop
(2)     policy remove_reply_message_if_eap {
(2)       if (&reply:EAP-Message && &reply:Reply-Message) {
(2)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(2)       else {
(2)         [noop] = noop
(2)       } # else = noop
(2)     } # policy remove_reply_message_if_eap = noop
(2)     if (EAP-Key-Name && &reply:EAP-Session-Id) {
(2)     if (EAP-Key-Name && &reply:EAP-Session-Id)  -> FALSE
(2)   } # post-auth = ok
(2) Sent Access-Accept Id 6 from 172.17.0.20:1812 to 172.17.0.1:59997 length 0
(2) Finished request
Waking up in 4.9 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 9.0 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 18.0 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 37.0 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 76.0 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 155.0 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 314.0 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 633.0 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 1272.0 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 2118.0 seconds.

在squid.conf中有如下

auth_param basic program /usr/lib/squid/basic_radius_auth -f /etc/squid/radius_config
auth_param basic realm proxy
acl authenticated proxy_auth REQUIRED
http_access allow authenticated

我不明白为什么radius服务器一切正常-报告

(2) pap: User authenticated successfully
(2)     [pap] = ok
(2)   } # Auth-Type PAP = ok

和

(2) Sent Access-Accept Id 6 from 172.17.0.20:1812 to 172.17.0.1:59997 length 0
(2) Finished request

和发送重复回复"错误吗?

有谁知道我哪里错了吗?

Answer 1

Squid使用RADIUS ';squid_radius_auth"身份验证

确保squid是通过——enable-basic-auth-helpers="squid_radius_auth"选项，该选项仅在Squid-2.6中可用。STABLE17或更高版本

创建radius配置文件

配置指定连接类型为RADIUS。该文件包含一个指令列表(每行一个)。以"#"开头的行作为注释被忽略。

模板半径配置

server radiusserver: specifies the name or address of the RADIUS server
secret somesecretstring: specifies the shared RADIUS secret.
identifier nameofserver: specifies what the proxy should identify itself as to the RADIUS server.  This directive is optional (optional)
port port-number: Specifies the port number or service name (default:1812)

示例radius配置:/etc/radius_config

server 192.168.10.20
secret someSecret

测试认证squid_radius_auth命令行配置

/usr/local/squid/libexec/squid_radius_auth -f /etc/radius_config

测试认证squid_radius_auth命令行不配置

/usr/local/squid/libexec/squid_radius_auth -h 192.168.10.20 -w someSecret

在同一行输入您的radius用户名和密码，用空格分隔，它应该返回"OK"作为成功时的响应。

已测试squid.conf Configuration

auth_param basic program /usr/local/squid/libexec/squid_radius_auth -f /etc/radius_config
auth_param basic children 5
auth_param basic realm Web-Proxy
auth_param basic credentialsttl 5 minute
auth_param basic casesensitive off
acl radius-auth proxy_auth REQUIRED
http_access allow radius-auth
http_access allow localhost
http_access deny all