freeradius rlm_pap on debian squeeze

HTML がわかっていず面倒なので <pre> と FireFox extension の It's All Text!
emacsclient & auto-fill-mode & set-fill-column 72 あたりで (C-x f)

0. インストールの前に
   直に /etc/passwd を触らせるのではなく PAM 経由。一応インストール前の
   状態を確認

       # cd /etc
       # ls -l passwd group shadow gshadow
       -rw-r--r-- 1 root root    820 Apr 30 14:03 group
       -rw-r----- 1 root shadow  679 Apr 30 14:03 gshadow
       -rw-r--r-- 1 root root   1584 Apr 30 14:03 passwd
       -rw-r----- 1 root shadow 1348 Apr 30 14:03 shadow
       # grep freerad passwd group shadow gshadowN
       # ls -l /etc/pam.d/radiusd
       ls: cannot access /etc/pam.d/radiusd: No such file or directory


1. インストール
   そのまま

       # aptitude install freeradius

   何も問われず。で、何されたか? を確認

       # ls -l passwd group shadow gshadow
       -rw-r--r-- 1 root root    849 Apr 30 15:26 group
       -rw-r----- 1 root shadow  705 Apr 30 15:26 gshadow
       -rw-r--r-- 1 root root   1630 Apr 30 15:26 passwd
       -rw-r----- 1 root shadow 1377 Apr 30 15:26 shadow
       # grep freerad passwd group shadow gshadow
       passwd:freerad:x:114:120::/etc/freeradius:/bin/false
       group:shadow:x:42:freerad
       group:ssl-cert:x:111:freerad
       group:freerad:x:120:
       shadow:freerad:*:15094:0:99999:7:::
       gshadow:shadow:*::freerad
       gshadow:ssl-cert:!::freerad
       gshadow:freerad:!::
       # ls -l /etc/pam.d/radiusd
       -rw-r--r-- 1 root root 227 Sep 28  2010 /etc/pam.d/radiusd

   グループ shadow に freerad が加えられた。イコール freerad ユーザアカ
   ウントで /etc/shadow を読むことができる。/etc/pam.d/radiusd の中身は、
   うん。特に...


3. 設定ファイル変更
   How do I use PAM with FreeRADIUS? や rlm_pam の説明眺めながらファイル
三つ更新。どこかで見付けたパスワード生成ワンライナー

       # cat /dev/urandom | tr -dc '0-9A-Za-z' | fold -b16 | head -n1
       ZkPbwZ17bCDEx7Kx

   を多用しつつ。余裕があるなら? もちろん /dev/random の方が良いらしい

   
/etc/freeradius/users
     # diff -uw users.dpkg-dist users
     --- users.dpkg-dist     2011-04-30 15:59:45.000000000 +0900
     +++ users       2011-04-30 15:41:02.000000000 +0900
     @@ -163,6 +163,8 @@
      #      Service-Type = Framed-User,
      #      Fall-Through = Yes
 
     +DEFAULT Auth-Type = Pam
     +
      #
      # Default for PPP: dynamic IP address, PPP mode, VJ-compression.
      # NOTE: we do not use Hint = "PPP", since PPP might also be auto-detected
     # 

   
/etc/freeradius/clients.conf
     # diff -uw clients.conf.dpkg-dist clients.conf
     --- clients.conf.dpkg-dist 2011-04-30 16:03:19.000000000 +0900
     +++ clients.conf   2011-04-30 15:40:26.000000000 +0900
     @@ -98,7 +98,7 @@
        #  The default secret below is only for testing, and should
        #  not be used in any real environment.
        #
     -       secret          = testing123
     +       secret          = ZkPbwZ17bCDEx7Kx
 
             #
             #  Old-style clients do not send a Message-Authenticator
     @@ -232,3 +232,14 @@
      #              secret = testing123
      #        }
      #}
     +
     +client 172.27.0.0/17 {
     +       shortname       = primary_site
     +       secret          = jf5O7D0FD2v4KJqH
     +}
     +
     +client 172.27.129.0/17 {
     +       shortname       = secondary_site
     +       secret          = wvlo17pzXHzOnLfL
     +}
     + 

   
/etc/freeradius/sites-enabled/default
     # diff -uw sites-enabled/default.dpkg-dist sites-enabled/default
     --- sites-enabled/default.dpkg-dist     2011-04-30 16:00:37.000000000 +0900
     +++ sites-enabled/default       2011-04-30 16:00:42.000000000 +0900
     @@ -263,7 +263,7 @@
 
             #
             #  Pluggable Authentication Modules.
     -#      pam
     +       pam
 
             #
             #  See 'man getpwent' for information on how the 'unix'
     # 

3. 再起動
   # /etc/init.d/freeradius restart


4. テスト
   # radtest chamaken 'bl0gSP010' localhost 10 ZkPbwZ17bCDEx7Kx
   Sending Access-Request of id 65 to 127.0.0.1 port 1812
           User-Name = "chamaken"
           User-Password = "bl0gSP010"
           NAS-IP-Address = 127.0.1.1
           NAS-Port = 10
   rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=65, length=20
   # radtest chamaken 'invalid_passwd' localhost 10 ZkPbwZ17bCDEx7Kx
   Sending Access-Request of id 32 to 127.0.0.1 port 1812
           User-Name = "chamaken"
           User-Password = "invalid_passwd"
           NAS-IP-Address = 127.0.1.1
           NAS-Port = 10
   rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=32, length=20


5. その他
   freeradius とは /etc/init.d/freeradius stop した後に

       # freeradius -X

   で戦うべし。/etc/freeradius/users の DEFAULT Auth-Type = Pam
   の位置に気をつけて。PPP の前、先頭行でも良いくらい