海运的博客

1.ROS网络管理功能十分强大，如需简单对IP或网段进行限速可使用简单队列限速。

queue simple add target-addresses=192.168.0.0/24 limit-at=500000/1000000  max-limit=1000000/2000000 \
burst-threshold=1000000/1000000 burst-limit=1000000/3000000 burst-time=8/8 
#limit-at 限制在此速率
#max-limit 空闲时可用最大速率，未设置等于limit-at
#burst-threshold 速率阀值
#burst-limit 单位时间内速率低于阀值，可突破至此速率
#burst time 突破速率的时间间隔

2.使用简单限速用户较少时会造成带宽的浪费，为此可使用PCQ动态限速。

queue type add name=down-pcq kind=pcq pcq-rate=0 pcq-limit=50 pcq-total-limit=2000 pcq-classifier=dst-address
#PCQ下载队列，针对内部目标IP
#默认情况下仅能容纳50个用户，即2000/50，用户较多时可调整pcq-total-limit或pcq-limit数值
queue type add name=up-pcq kind=pcq pcq-rate=0 pcq-limit=50 pcq-total-limit=2000 pcq-classifier=src-address   
#PCQ上传队列，针对内部源IP
queue simple add name=pcq-queue target-addresses=192.168.1.0/24 max-limit=500000/1000000 queue=up-pcq/down-pcq
#新建简单队列应用PCQ规则

3.基于等级优先级HTB设置,可针对IP、协议进行限制。

ip firewall mangle add chain=forward action=mark-connection new-connection-mark=1.2 src-address=192.168.1.2 passthrough=yes 
ip firewall mangle add chain=forward action=mark-connection new-connection-mark=1.3 src-address=192.168.1.3 passthrough=yes 
#标记特定的连接
ip firewall mangle add chain=forward action=mark-packet new-packet-mark=1.2 connection-mark=1.3 passthrough=no 
ip firewall mangle add chain=forward action=mark-packet new-packet-mark=1.3 connection-mark=1.3 passthrough=no 
#标记特定连接的所有数据包

建立父队列：

queue tree add name=totaldown parent=ether2 limit-at=2000000 max-limit=2000000
queue tree add name=totalup parent=ether1 limit-at=500000 max-limit=500000 
#标记数据LAN为下载，WAN为上传
#Global-in识别Prerouting标记的数据
#Global-out/total能识别pre，forward，post标记的数据

建立子队列：

queue tree add name=pc1.2down parent=totaldown limit-at=2000000 max-limit=2000000 priority=2 
queue tree add name=pc1.2up parent=totalup limit-at=500000 max-limit=5555500000 priority=2 
queue tree add name=pc1.3down parent=totaldown  limit-at=1000000 max-limit=1000000 priority=3 
queue tree add name=pc1.3up parent=totalup  limit-at=500000 max-limit=500000 priority=3 

之前有介绍安装Radiusmanager做为ROS验证服务器，不过Radiusmanager为商业软件，喜欢开源软件的可使用daloRADIUS替代，功能同样强大。
LAMP环境安装：

yum -y install httpd httpd-devel mysql mysql-server mysql-devel
yum -y install php php-devel php-mysql php-common php-gd php-mbstring php-mcrypt php-xml
/etc/init.d/httpd start
/etc/init.d/mysqld start
chkconfig httpd on
chkconfig mysqld on
mysqladmin -u root password 'newpassowrd'

Freeradius安装：

yum install freeradius2 freeradius2-mysql freeradius2-utils
/etc/init.d/radiusd start
chkconfig radiusd on

测试Freeradius：

radiusd -X
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on command file /var/run/radiusd/radiusd.sock
Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel
Listening on proxy address * port 1814
Ready to process requests.

配置Freeradius支持sql：

cat /etc/raddb/radiusd.conf 
$INCLUDE sql.conf #调用sql.conf配置，去除之前的#

cat /etc/raddb/sites-enabled/default #下两段中添加sql
authorize {
    preprocess
    chap
    mschap
    digest
    suffix
    eap {
        ok = return
    }
    files
    sql
    expiration
    logintime
    pap
}
accounting {
    detail
    unix
    radutmp
    sql
    exec
    attr_filter.accounting_response
}

设置Freeradius sql连接信息：

cat /etc/raddb/sql.conf 
    database = "mysql"
    driver = "rlm_sql_${database}"
    server = "localhost"
    #port = 3306
    login = "radius"
    password = "radiupass"
      radius_db = "radius"

安装DaloRADIUS：

wget http://downloads.sourceforge.net/project/daloradius/daloradius/daloradius0.9-9/daloradius-0.9-9.tar.gz
tar zxvf daloradius-0.9-9.tar.gz 
mv daloradius-0.9-9 /var/www/html/daloradius
chown -R apache:apache /var/www/html/daloradius

创建数据库并导入：

mysql -u root -p
mysql>create database radius;
mysql>grant all on radius.* to radius@localhost identified by "radpass"; 
mysql>exit;
mysql -uroot -p radius < /var/www/html/daloradius/contrib/db/mysql-daloradius.sql 
mysql -uroot -p radius < /var/www/html/daloradius/contrib/db/fr2-mysql-daloradius-and-freeradius.sql 

配置DaloRADIUS：

cat cat /var/www/html/daloradius/library/daloradius.conf.php
$configValues['CONFIG_DB_ENGINE'] = 'mysql';
$configValues['CONFIG_DB_HOST'] = 'localhost';
$configValues['CONFIG_DB_PORT'] = '3306';
$configValues['CONFIG_DB_USER'] = 'radius';
$configValues['CONFIG_DB_PASS'] = 'radpass';
$configValues['CONFIG_DB_NAME'] = 'radius';
$configValues['CONFIG_PATH_DALO_VARIABLE_DATA'] = '/var/www/daloradius/var'; #如在别目录需修改

添加RADIUS客户端：

cat /etc/raddb/clients.conf
client 192.168.1.21 {
    secret        = root
    shortname    = ROS
}

通过浏览器访问www.haiyun.me/daloradius即可登录管理，默认账号：administrator，密码：radius。
Daloradius新建用户测试，ROS端配置RADIUS请参考：安装Radiusmanager做为ROS验证服务器。

通过Daloradius管理界面可查看在线用户：

1.ROS下PPPOE服务器配置

ip pool add name=pppoe ranges=192.168.2.2-192.168.2.254 
#新建PPPOE客户端IP池              
ppp profile set default local-address=pppoe remote-address=pppoe dns-server=8.8.8.8,4.4.4.4 
#新建PPPOE模板
interface pppoe-server server add service-name=pppoe interface=ether2 authentication=pap \
default-profile=default one-session-per-host=yes keepalive-timeout=10 disabled=no
#开启并设置PPPOE服务器
ppp secret add name=user password=passwd service=pppoe 
#使用本地pap验证，新建PPPOE用户

2.ROS端配置使用RADIUS验证：

ppp aaa set use-radius=yes 
#允许使用RADIUS认证     
radius add address=192.168.1.22 secret=root service=ppp authentication-port=1812 \
accounting-port=1813 disabled=no 
#设置RADIUS服务器地址，验证端口，验证服务
radius incoming set accept=yes port=1700 
#允许RADIUS端断开用户PPP连接

3.Radiusmanager端配置，新建NAS，即ROS客户端：

新建用户，即PPPOE客户：

测试PPPOE登录：

Radiusmanager免费开源替代产品Daloradius请参考ROS使用Daloradius+Freeradius验证。

关闭SElinux：

cat /etc/sysconfig/selinux 
SELINUX=disabled
reboot #重启生效

安装httpd和mysql：

yum install -y httpd mod_ssl php php-common php-gd php-pear php-pecl-memcache php-mhash php-xml gcc gcc-c++
yum install -y mysql-devel curl php-mysql php-mcrypt compat-libstdc++-33 libtool-ltdl-devel
/etc/init.d/mysqld start
/etc/init.d/httpd start
chkconfig httpd on
chkconfig mysqld on
/usr/bin/mysqladmin -u root password 'newpassowrd' #设置Mysql root密码
#下面脚本用于新建radiusmanger数据库和用户，可自行修改。
cat >> mysql-temp.sql << END
CREATE DATABASE radius;
CREATE DATABASE conntrack;
CREATE USER 'radius'@'localhost' IDENTIFIED BY 'radius123';
CREATE USER 'conntrack'@'localhost' IDENTIFIED BY 'conn123';
GRANT ALL ON radius.* TO radius@localhost;
GRANT ALL ON conntrack.* TO conntrack@localhost;
END
mysql -u root -p < mysql-temp.sql

安装inocube：

wget http://www.dmasoftlab.com/cont/download/ioncube_loaders_lin_x86.tar.gz
tar zxvf ioncube_loaders_lin_x86.tar.gz 
cp -r ioncube /usr/local/

配置PHP加载inocube：

php -v #查看php版本，加载inocube对应版本。
cat >>/etc/php.ini << END
zend_extension=/usr/local/ioncube/ioncube_loader_lin_5.1.so
END
/etc/init.d/httpd restart
php -m|grep ioncube #查看是否成功加载ioncube模块

安装freeradius：

wget http://www.dmasoftlab.com/cont/download/freeradius-server-2.1.8-dmamod-1.tar.gz
tar zxvf freeradius-server-2.1.8-dmamod-1.tar.gz 
cd freeradius-server-2.1.8
./configure
make
make install
chmod 644 /usr/local/etc/raddb/dictionary
chown apache /usr/local/etc/raddb
chown apache /usr/local/etc/raddb/clients.conf
radiusd -X 

修改网卡MAC用于通过验证：

cat >> /etc/sysconfig/network-scripts/ifcfg-eth0 <<EOF
MACADDR=00:D0:09:B8:B7:34
END
/sbin/ifconfig eth0 down
/sbin/ifconfig eth0 hw ether 00:D0:09:B8:B7:34
/sbin/ifconfig eth0 up

安装radiusmanager：

wget http://deluxsola.googlecode.com/files/radiusmanager-3.9.0.tar.gz
tar zxvf radiusmanager-3.9.0.tar.gz 
cd radiusmanager-3.9.0
./install.sh