pkg install freeradius3 p5-Digest-MD5 p5-Authen-Radius

pkg lock freeradius3

Резервна копія оригінальних конфігів

 cp -a /usr/local/etc/raddb/ /usr/local/etc/raddb.orig/

Видалимо зайве

 rm -rf /usr/local/etc/raddb/sites-enabled/*
 rm /usr/local/etc/raddb/mods-enabled/eap

Створимо основний конфіг

 nano /usr/local/etc/raddb/sites-enabled/nodeny

з таким вмістом:

/usr/local/etc/raddb/sites-enabled/nodeny

server nodeny {
    listen {
        type = auth
        ipaddr = *
        port = 1812
        limit {
            max_connections = 64
            lifetime = 0
            idle_timeout = 30
        }
    }
    listen {
        type = acct
        ipaddr = *
        port = 1813
    }
 
#  Authorization.
    authorize {
        #detail
        preprocess
        pap
        chap
        files
        perl
#        if((User-Name =~ /^.*%{Calling-Station-ID}.*$/i)){
#            update control {
#                &Auth-Type = 'Perl'
#            }
#        }
        if (ok || updated) {
            update control {
                Auth-Type := Perl
            }
        }
 
    }
 
#  Authentication.
    authenticate {
        Auth-Type Perl {
            perl
        }
        Auth-Type PAP {
            pap
        }
        Auth-Type CHAP {
            chap
        }
    }
 
#  Pre-accounting.  Decide which accounting type to use.
    preacct {
        acct_unique
        preprocess
    }
 
    accounting {
        attr_filter.accounting_response
        perl
    }
 
    session {
        radutmp
    }
 
# Post-Authentication
    post-auth {
        Post-Auth-Type REJECT {
            attr_filter.access_reject # pppoe
            perl #ipoe
        }
        perl
    }
}

також можна увімкнути сервер статусу командою:

ln -s /usr/local/etc/raddb/sites-available/status /usr/local/etc/raddb/sites-enabled/

echo '' > /usr/local/etc/raddb/clients.conf
nano /usr/local/etc/raddb/clients.conf

client 127.0.0.1 {
    ipaddr = 127.0.0.1
    secret = hardpass5
    shortname=NoDenyDB
    nastype = cisco
}

ln -s /usr/local/etc/raddb/mods-available/perl /usr/local/etc/raddb/mods-enabled/
echo '' > /usr/local/etc/raddb/mods-enabled/perl
nano /usr/local/etc/raddb/mods-enabled/perl

perl {
	filename = /usr/local/nodeny/nod/_radius.pl
}

nano /usr/local/etc/raddb/mods-config/attr_filter/access_reject

DEFAULT
    EAP-Message =* ANY,
    State =* ANY,
    Message-Authenticator =* ANY,
    Error-Cause =* ANY,
    Reply-Message =* ANY,
    MS-CHAP-Error = * ANY,
    Proxy-State =* ANY

nano /usr/local/etc/raddb/mods-config/files/authorize

DEFAULT Auth-Type = Perl
        Fall-Through = yes

sysrc radiusd_enable="YES"
#sysrc radiusd_flags="-d /path/to/raddb"
service radiusd start

radtest [-t chap] login password 127.0.0.1 0 hardpass5

$ apt install libfreeradius3 freeradius-common freeradius-config
$ wget https://networkradius.com/assets/packages/radperf/radperf_2.0.1_amd64.deb
$ dpkg -i radperf_2.0.1_amd64.deb

Blank lines in the input separate individual packets. e.g.

users.txt

User-Name = "test"
User-Password = "123"

User-Name = "test1"
User-Password = "0007"

User-Name = "test2"
User-Password = "011998"

testing

radperf -s -f ../users.txt -p 800 -a pap 10.3.1.1 auth radiussomething

where users.csv file contains 10000 user names with password, I get this output:

Total succeeded        :  3811
     Total failed      :  6189
     Total no reply    :  0
     Total time (s)    :  10.588
     Packets/s         :  944
     Response times:
< 10 usec  : 0
< 100 usec : 0
< msec     : 0
< 10 msec  : 1
< 0.1s     : 3758
< s        : 5897
< 10s      : 344
< 100s     : 0

https://docs.librenms.org/Extensions/Applications/#freeradius