FreeRadius
1.安装
官网wiki地址：https://wiki.freeradius.org/guide/Getting%20Started
安装命令：apt-get install freeradius
service freeradius restart
freeradius -X 可以实时监听freeradius运行状况
测试服务是否成功radtest tiger hello 127.0.0.1 0 testing123
2.配置文件路径
/etc/freeradius
配置users："test" Cleartext-Password := "hello" #用户和密码
Reply-Message = "Hello, %{User-Name}"
配置clients.conf：
client 192.168.3.0/24 {secret = test123 //约定秘钥require_message_authenticator = nonastype = other
}
client 192.168.3.10 {ipaddr=192.168.3.10secret = 123require_message_authenticator = nonastype = other
}//上面的生效
3.client
python扩展https://github.com/pyradius/pyrad
python3 setup.py install
Example:
####
#!/usr/bin/python
from __future__ import print_function
from pyrad.client import Client
from pyrad.dictionary import Dictionary
import socket
import sys
import pyrad.packet
srv = Client(server="192.168.3.10", secret=b"test123", dict=Dictionary("dictionary"))
print(srv)
req = srv.CreateAuthPacket(code=pyrad.packet.AccessRequest, User_Name="test")
print(req)
req["NAS-IP-Address"] = "192.168.3.10"
req["NAS-Port"] = 0
req["Service-Type"] = "Login-User"
req["NAS-Identifier"] = "hello"
req["Called-Station-Id"] = "00-04-5F-00-0F-D1"
req["Calling-Station-Id"] = "00-01-24-80-B3-9C"
req["Framed-IP-Address"] = "127.0.0.1"try:print("Sending authentication request")reply = srv.SendPacket(req)
except pyrad.client.Timeout:print("RADIUS server does not reply")sys.exit(1)
except socket.error as error:print("Network error: " + error[1])sys.exit(1)if reply.code == pyrad.packet.AccessAccept:print("Access accepted")
else:print("Access denied")print("Attributes returned by server:")
for i in reply.keys():print("%s: %s" % (i, reply[i]))
~
~
#####
Tacacs
1.Tacacs安装
apt-get install tacacs+
创建配置文件，/etc/tacacs+/tac_plus.conf ，内容如下：
#Make this a strong key,共享密钥
key = 12345678
#*************************
#*** GROUPS HERE ***
#*************************
group = Network_Engineers {default service = permit #这个选项是授权(Author)使用的login = file /etc/passwd #使用系统的用户名和密码验证机制enable = file /etc/passwd
}
user = test{member = Network_Engineers
}
user = test {member = Network_Engineers
}
user = alice {default service = permitlogin = des "9XmWlJh.hMoLM"
#1:使用命令tac_pwd 2:输入密码：test 3:生成密码
}
2.运行
sudo tac_plus -C /etc/tacacs+/tac_plus.conf -t -d 1
实时查看log
tail -f /var/log/tac_plus.log
3.Client
python使用扩展
pip3 install tacacs_plus
Example:
#####
#!/usr/bin/env python
from __future__ import print_functionfrom tacacs_plus.client import TACACSClient
from tacacs_plus.flags import TAC_PLUS_ACCT_FLAG_START, TAC_PLUS_ACCT_FLAG_WATCHDOG, TAC_PLUS_ACCT_FLAG_STOP
import socket# For IPv6, use `family=socket.AF_INET6`
cli = TACACSClient('192.168.3.10', 49, 'tackey', timeout=10, family=socket.AF_INET)# authenticate user and pass
authen = cli.authenticate('alice', 'pass1')
#s=authen.server_msg
#print(authen)
#print(s)
#ss = s.decode('utf-8')
#print(ss)
#sss = ss.encode()
print(authen.valid)
print("PASS!" if authen.valid else "FAIL!")
#####