Kann ich RADIUS für Strongswan-Psk verwenden?

# Install & Configure StrongSwan + FreeRADIUS ( MariaDB Backend ) - CentOS7 # Install Require Packages : [root@strongswan ~]# yum install -y epel-release [root@strongswan ~]# yum update && yum install -y gcc gcc-c++ pam-devel zlib-devel systemd-devel openssl-devel [root@strongswan ~]# yum install -y freeradius freeradius-mysql freeradius-utils mariadb mariadb-server # Download StrongSwan : [root@strongswan ~]# wget http://www.strongswan.org/download/strongswan-5.5.0.tar.gz [root@strongswan ~]# tar zvxf strongswan-5.5.tar.gz [root@strongswan ~]# cd strongswan-5.5.0 # Compile StrongSwan : [root@strongswan ~]# ./configure --prefix=/usr --sysconfdir=/etc/strongswan --localstatedir=/var --enable-unity --enable-xauth-eap --enable-eap-identity --enable-eap-md5 --enable-xauth-pam --enable-eap-tls --enable-eap-radius --enable-eap-mschapv2 --enable-dhcp --enable-systemd --enable-eap-dynamic --enable-openssl --enable-addrblock --enable-certexpire --enable-radattr --enable-swanctl --disable-gmp [root@strongswan ~]# make && make install # Generate Certificates : [root@strongswan ~]# cd /etc/strongswan/ipsec.d/ [root@strongswan ipsec.d]# ipsec pki --gen --type rsa --size 2048 --outform pem > private/strongswanKey.pem [root@strongswan ipsec.d]# ipsec pki --self --ca --lifetime 3650 --in private/strongswanKey.pem --type rsa --dn "C=Ir, O=IT, CN=StrongSwanVPN" --outform pem > cacerts/strongswanCert.pem [root@strongswan ipsec.d]# ipsec pki --gen --type rsa --size 2048 --outform pem > private/vpnHostKey.pem [root@strongswan ipsec.d]# chmod 600 private/vpnHostKey.pem [root@strongswan ipsec.d]# ipsec pki --pub --in private/vpnHostKey.pem --type rsa | ipsec pki --issue --lifetime 730 --cacert cacerts/strongswanCert.pem --cakey private/strongswanKey.pem --dn "C=Ir, O=IT, CN=StrongSwanVPN" --san 192.168.1.1 --flag serverAuth --outform pem > certs/vpnHostCert.pem # Generate Client Certificate : [root@strongswan ipsec.d]# ipsec pki --gen --type rsa --size 2048 --outform pem > private/ClientKey.pem [root@strongswan ipsec.d]# chmod 600 private/ClientKey.pem [root@strongswan ipsec.d]# ipsec pki --pub --in private/ClientKey.pem --type rsa | ipsec pki --issue --lifetime 730 --cacert cacerts/strongswanCert.pem --cakey private/strongswanKey.pem --dn "C=Ir, O=IT, CN=StrongSwanVPN" --outform pem > certs/ClientCert.pem # Export CLIENT CERTIFICATE As a PKCS#12 File : [root@strongswan ipsec.d]# openssl pkcs12 -export -inkey private/ClientKey.pem -in certs/ClientCert.pem -name "Client's VPN Certificate" -certfile cacerts/strongswanCert.pem -caname "strongSwan Root CA" -out Client.p12 # Configure StrongSwan : [root@strongswan ~]# vim /etc/strongswan/ipsec.conf ------------------------ config setup uniqueids=no conn standard_ikev2 keyexchange=ikev2 ike=aes256-sha256-modp1024,3des-sha1-modp1024,aes256-sha1-modp1024! esp=aes256-sha256,3des-sha1,aes256-sha1! fragmentation=no rekey=no left=192.168.1.1 leftsendcert=always leftfirewall=yes leftsubnet=0.0.0.0/0 leftcert=vpnHostCert.pem right=%any rightauth=eap-radius rightsourceip=10.0.0.0/24 eap_identity=%any dpdaction=clear auto=add ------------------------ [root@strongswan ~]# vim /etc/strongswan/ipsec.secrets : RSA vpnHostKey.pem [root@strongswan ~]# vim /etc/strongswan/strongswan.conf ------------------------ charon { load_modular = yes compress = yes plugins { include strongswan.d/charon/*.conf eap-radius { servers { server-a { accounting = yes secret = 123456 address = 192.168.1.1 auth_port = 1812 acct_port = 1813 } } } } include strongswan.d/*.conf } ------------------------ [root@strongswan ~]# vim /etc/sysctl.conf net.ipv4.ip_forward = 1 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.all.send_redirects = 0 # start strongswan service : [root@strongswan ~]# systemctl start strongswan && systemctl enable strongswan # Configure FreeRADIUS : [root@strongswan ~]# vim /etc/raddb/mods-available/sql ------------------------ database = "mysql" driver = "rlm_sql_mysql" server = "localhost" port = 3306 login = "radius" password = "radius-password" radius_db = "radius" read_clients = yes ------------------------ # Enable sql Module : [root@strongswan ~]# ln -s /etc/raddb/mods-available/sql /etc/raddb/mods-enabled/sql # Comment "files" and Uncomment "sql" : [root@strongswan ~]# vim /etc/raddb/sites-available/default # Comment -> "files" and Uncomment -> "sql" : [root@strongswan ~]# vim /etc/raddb/sites-available/inner-tunnel [root@strongswan ~]# vim /etc/raddb/client.conf ------------------------ client 0.0.0.0 { secret = 123456 nas_type = other shortname = 0.0.0.0 require_message_authenticator = no } ------------------------ [root@strongswan ~]# cat /etc/strongswan/ipsec.d/cacerts/strongswanCert.pem > /etc/raddb/certs/ca.pem [root@strongswan ~]# cat /etc/strongswan/ipsec.d/certs/vpnHostCert.pem > /etc/raddb/certs/server.pem [root@strongswan ~]# cat /etc/strongswan/ipsec.d/private/vpnHostKey.pem > /etc/raddb/certs/server.key [root@strongswan ~]# cat /etc/raddb/certs/server.key >> /etc/raddb/certs/server.pem # start radiusd service : [root@strongswan ~]# systemctl start radiusd && systemctl enable radiusd ## Configure MariaDB : [root@strongswan ~]# systemctl start mariadb && systemctl enable mariadb [root@strongswan ~]# mysql_secure_installation [root@strongswan ~]# mysql -u root -p Enter Password: ****** MariaDB> create database radius; MariaDB> grant all privileges on radius.* to radius@localhost identified by "radius-password"; MariaDB> flush privileges; MariaDB> use radius; MariaDB> source /etc/raddb/mods-config/sql/main/mysql/schema.sql; # add username|password : MariaDB> INSERT INTO radcheck (username,attribute,op,VALUE) VALUES ('ehsan','Cleartext-Password',':=','eh@12345'); MariaDB> INSERT INTO radcheck (username,attribute,op,VALUE) VALUES ('alireza','Cleartext-Password',':=','abc123');