OpenPortalServer开源Portal协议WEB认证服务器 简介
OpenPortalServer开源Portal协议WEB认证服务器作者：LeeSonQQ:25901875 E-Mail: LeeSon@vip.qq.comOpenPortal官方交流群 119688084
该软件是基于华为AC/BASPORTAL协议的服务端程序，Java编写。
支持Huawei H3C Portal V1 V2协议PAP CHAP认证方式的Portal服务器
-------------------------------------------------------------------------------------------新手安装配置说明： -------------------------------------------------------------------------------------------windows环境下：
1.首先保证已有JDK1.7环境，MySQL环境 ,tomcat7
2.解压路径无中文及空格
3.配置文件说明\webapps\ROOT\WEB-INF\classes\jdbc.properties 首先修改该数据库配置文件 创建openportalserver数据库 UTF-8字符集 导入数据库文件OpenPortalServer.sql 后台账号：admin密码:admin
4.配置AC设备 安装和配置Radius服务如果使用AC模拟器进行模拟测试则可忽略这步如果使用页面展示、本地接入用户认证方式 不用配置radius
5.运行 bin/startup.bat 快捷方式
6.浏览器http://服务器IP
7.如果使用AC模拟器测试用户名密码随意如果真实环境（不用我废话了）
-------------------------------------------------------------------------------------------
Linux环境:安装jdk1.7mysqltomcat7 将解压目录下的webapps目录替换
Portal认证服务核心引擎接口路径为 根目录的 html文件 采用GET提交，Json信息返回！ -------------------------------------------------------------------------------------------
对接配置说明：
超时设置 3-5秒日志记录 是否输出详细日志到文件验证码设置 是否开启用户登陆的验证码用户心跳 是否进行用户离线检测超时重复次数一次检查周期内用户在线检测超时几次算已经下线计费检测周期间隔多长时间检测一次用户是否在线，余额是否够认证方式 页面展示,本地接入用户,外接radius自助注册开关是否允许自助注册接入用户，默认每个新用户给10分钟的时长设备账号 对应设备的local-user用户账号密码，在本地接入用户和页面展示 认证方式时必须配置，而且设备用默认domain设备密码 对应设备的local-user用户账号密码，在本地接入用户和页面展示 认证方式时必须配置，而且设备用默认domain
-------------------------------------------------------------------------------------------
本地用户认证模式则 下面交换机不用设置domain leeson.org 设备账号密码就是交换机的账号密码
-------------------------------------------------------------------------------------------以华为S5700交换机为例，配置信息详细说明：
交换机配置如下配置步骤步骤 1创建 VLAN 并配置接口允许通过的 VLAN，保证网络通畅。# 创建 VLAN10 和 VLAN20。 vlan batch 10 20 # 配置交换机连接上行网络的接口 E0/0/1为 Access 类型接口，并将 GE0/0/1 加入VLAN20。 interface Ethernet0/0/1 port link-typeaccess port default vlan 20 quit
# 配置交换机连接 RADIUS 和portalServer 的接口 E0/0/2 为Access 类型接口，并将 GE0/0/2 加入 VLAN20。 interface Ethernet0/0/2 port link-typeaccess port default vlan 20 quit
# 创建 VLANIF10 和 VLANIF20，并配置VLANIF 的 IP 地址，以使用户终端、Switch、企业内网资源之间能够建立起路由。此处假设 VLANIF10 的 IP 地址为192.168.10.20/24；VLANIF20 的 IP 地址为192.168.20.29/24。 interface vlanif 10 ip address 192.168.10.2024 //10.1
interface vlanif 20 ip address 192.168.0.124 //0.1 quit 步骤 2创建并配置 RADIUS 服务器模板、AAA 方案以及认证域。# 创建并配置 RADIUS 服务器模板“rd1”。 radius-server template rd1 radius-serverauthentication 192.168.0.2 1812 radius-serveraccounting 192.168.0.2 1813 radius-servershared-key simple leeson radius-serverretransmit 2 quit
# 创建 AAA 方案“abc”并配置认证方式为RADIUS。 aaa authentication-scheme abc authentication-moderadius quit accounting-scheme acc accounting-mode radius quit # 创建认证域“leeson.org”，并在其上绑定AAA 方案“abc”与RADIUS 服务器模板“rd1”。 domain leeson.org authentication-scheme abc accounting-schemeacc radius-server rd1 quit quit
# 配置全局默认域为“leeson.org”。用户进行接入认证时，以格式“user@xxx.xxx”输入用户名即可在xxx.xxx 域下进行 aaa 认证。如果用户名中不携带域名或携带的域名不存在，用户将会在默认域中进行认证。 domain leeson.org
步骤 3配置外部 Portal 认证# 创建并配置名称为“abc”的 Portal 服务器模板。 web-auth-server abc server-ip192.168.0.2 port 50100 shared-keysimple leeson urlhttp://192.168.0.2 quit
# 使能 Portal 认证功能。 interface vlanif 10 web-auth-server abcdirect quit
步骤 4查看配置的 Portal 服务器的参数信息。# 执行命令 displayweb-auth-server configuration 查看 Portal 服务器相关的配置信息。<SWITCH>display web-auth-serverconfigurationListening port : 2000 Portal : version 1, version 2 Include reply message : enabled ----------------------------------------------------------------------- -Web-auth-server Name : abc IP-address : 192.168.20.30 Shared-key :%$%$]$c{$)Bp!XFdN>G2DBG(T#wn%$%$ Port / PortFlag : 50100 / NO URL : http://192.168.0.2Bounded Vlanif : 10 ----------------------------------------------------------------------- - 1Web authentication server(s) in total
步骤 5在交换机上添加默认路由：ip route-static 0.0.0.0 0.0.0.0 192.168.0.1 其中 192.168.0.1为交换机上行端口的网关地址
步骤 6配置 portal 白名单portal free-rule 0 destination ip192.168.0.1 mask 255.255.255.255 portal free-rule 1 destination ip192.168.0.2 mask 255.255.255.255 portal free-rule 2 destination ipxxx.xxx.xxx.xxx mask 255.255.255.255 其中的 xxx.xxx.xxx.xxx 为用户认证之后上网所需的 DNS 地址，实际以真实网络环境中的 DNS为准//排除网关 PORTAL服务器 Radius服务器 DNS
可选配置：接口视图下（vlan-if，ge）：dhcp select relay# 使能接口VLANIF100的DHCP Relay功能。 dhcp enable interface vlanif 100 dhcp select relay
#Portal用户下线探测portal timer offline-detect命令用来配置Portal认证用户下线探测周期。undo portal timer offline-detect命令用来恢复下线探测周期的缺省值。缺省情况下，下线探测周期为300秒。注意：portal timer offline-detect命令功能仅适用于二层Portal认证方式。
-------------------------------------------------------------------------------------------------------OpenPortalServer对接 华为S5700配置
dis cur#!Software Version V200R001C00SPC300sysname Quidway#vlan batch 10 100#web-auth-server version v2portal free-rule 2 source ip 10.0.0.100mask 255.255.255.255portal free-rule 3 destination ip10.0.0.100 mask 255.255.255.255portal free-rule 4 destination ip 10.0.0.1mask 255.255.255.255portal free-rule 5 source ip 10.0.0.1 mask255.255.255.255portal free-rule 6 source ip 192.168.100.1mask 255.255.255.255portal free-rule 7 destination ip192.168.100.1 mask 255.255.255.255#domain leeson.com#http server loads5700si-v200r001c00.001.web.zip#undo nap slave enable#dhcp enable#radius-server template leeson radius-server shared-key simple leeson radius-server authentication 10.0.0.100 1812 radius-server accounting 10.0.0.100 1813 radius-server retransmit 2#web-auth-server leeson server-ip 10.0.0.100 port50100 shared-key simple leeson urlhttp://10.0.0.100/OpenPortalServer source-ip 10.0.0.1#aaa authentication-scheme default authentication-scheme leeson authentication-mode radius authorization-scheme default accounting-scheme default accounting-scheme leeson accounting-mode radius domain default domain default_admin domain leeson.com authentication-scheme leeson accounting-scheme leeson radius-serverleeson local-user admin password cipher%$%$03~N$}rD0X}s=D%#SD-/ybYP%$%$ local-user admin privilege level 15 local-user admin service-type http local-user leeson password cipher%$%$3.-^M/J1RB:MO{"\t&bDye\S%$%$ local-user leeson privilege level 15#interface Vlanif1#interface Vlanif10 ipaddress 10.0.0.1 255.255.255.0 web-auth-serverleeson direct#interface Vlanif100 ipaddress 192.168.100.1 255.255.255.0 web-auth-server leeson direct dhcpselect interface
------------------------------------------------------------------------------------------- H3C-MSR830-10对接OpenPortal配置
portal server cbqt_wifi_pts ip192.168.1.250 key cipher $c$3$WcdcTvygU/tgJgwXYIR72l92h8HoFlyWoCFi8RS2Cj1goAg=url http://192.168.1.250:8081/portal server-type imcportal free-rule 0 source ip anydestination ip 114.114.114.114 mask 255.255.255.255portal free-rule 1 source ip anydestination ip 192.168.1.254 mask 255.255.255.255portal free-rule 2 source ip anydestination ip 192.168.70.254 mask 255.255.255.255portal free-rule 3 source ip anydestination ip 192.168.1.250 mask 255.255.255.255portal server cbqt_wifi_pts server-detectmethod http action permit-all interval 600 retry 5
interface Vlan-interface70 ipaddress 192.168.70.254 255.255.255.0 dhcpselect relay dhcprelay server-select 1 portal server cbqt_wifi_pts method direct ippolicy-based-route WAN-TAIQIU
radius scheme cbqt_wifi_rs server-type extended primary authentication 192.168.1.250 primary accounting 192.168.1.250 keyauthentication cipher $c$3$Jb32HhDG0KQEFUJK/ie49Sc5ARR1gBavK0rY+MOwlhSU= keyaccounting cipher $c$3$nG1DwgslbalnXYZul3aAOdVU8ro2+/cWK4Oi6adZw/Rv5ZM= user-name-format without-domain#domain cbqt_wifi_dm authentication portal radius-schemecbqt_wifi_rs authorization portal radius-schemecbqt_wifi_rs accounting portal radius-scheme cbqt_wifi_rs access-limitdisable state active idle-cut disable self-service-url disable
H3C-MSR对接配置
2015/8/12 13:13:39<H3C-MSR>dis <H3C-MSR>display cu <H3C-MSR>displaycurrent-configuration # version 5.20, Release 2311# sysname H3C-MSR# ftpserver enable# l2tpenable# firewall enable# nataddress-group 1 nataging-time udp 180# domain default enable system# darp2p signature-file flash:/p2p_default.mtd# lldpenable# qoscarl 1 destination-ip-address range 192.169.0.31 to 192.169.0.254 per-addressshared-bandwidth qoscarl 10 source-ip-address range 192.169.0.31 to 192.169.0.254 per-addressshared-bandwidth# portal server portal ip 192.169.0.20 keycipher $c$3$tmKimwpWYurgJSFeXElUKoFApV9rMZ6xfw== url http://192.169.0.20:8080 portal free-rule 0 source ip any destinationip 218.201.4.3 mask 255.255.255.255 portal free-rule 1 source ip any destinationip 192.169.0.20 mask 255.255.255.255 portal server portal server-detect method httpaction permit-all interval 60 retry 5# iphttp port 9000# blacklist enable#acl number 3000 rule0 permit ip source 192.169.0.0 0.0.15.255 rule1 permit ip source 192.169.101.0 0.0.0.255 rule100 deny ipacl number 3002 name LAN-Defend rule0 deny tcp destination-port eq 135 rule1 deny udp destination-port eq 135 rule2 deny tcp destination-port eq 139 rule3 deny udp destination-port eq netbios-dgm rule4 deny udp destination-port eq netbios-ns rule5 deny udp destination-port eq netbios-ssn rule6 deny tcp destination-port eq 137 rule7 deny tcp destination-port eq 138 rule8 deny udp destination-port eq 136 rule200 permit icmp rule300 permit ip source 192.169.0.0 0.0.15.255 rule301 permit ip source 192.169.101.0 0.0.0.255 rule302 permit ip source 192.169.99.0 0.0.0.7 rule303 permit udp destination-port eq bootps rule400 deny ipacl number 3003 name WAN-Defend rule0 deny tcp destination-port eq 135 rule1 deny udp destination-port eq 135 rule2 deny udp destination-port eq netbios-dgm rule3 deny udp destination-port eq netbios-ns rule4 deny udp destination-port eq netbios-ssn rule5 deny tcp destination-port eq 139 rule6 deny tcp destination-port eq 137 rule7 deny tcp destination-port eq 138 rule8 deny udp destination-port eq 136
rule300 permit udp source-port eq dns rule400 permit ip destination 192.169.0.0 0.0.15.255 rule401 permit ip destination 192.169.101.0 0.0.0.255 rule402 permit ip destination 192.169.99.0 0.0.0.7 rule403 permit tcp destination-port eq 22 rule404 permit tcp destination-port eq www rule405 permit tcp destination-port eq 443 rule406 permit udp destination-port eq 1701 rule407 deny ipacl number 3100 description inside access domain-server rule10 deny ip source 192.169.10.0 0.0.0.255 rule11 deny ip source 192.169.11.0 0.0.0.255 rule12 deny ip source 192.169.12.0 0.0.0.255 rule13 deny ip source 192.169.13.0 0.0.0.255 rule14 deny ip source 192.169.14.0 0.0.0.255 rule15 deny ip source 192.169.15.0 0.0.0.255 rule100 permit ip source 192.169.0.0 0.0.15.255 destination 192.169.0.20 0 rule1000 deny ip#
#vlan 1#radius scheme radius primary authentication 192.169.0.20 1645 keycipher $c$3$pBtH9ea/vw5AfpLwHPg20KlJE1fGRKNHJw== primary accounting 192.169.0.20 1646 keycipher $c$3$iZTSbzm+q0xelQbsrxER90iYAQKV6aORPA== timer realtime-accounting 3#domain portal authentication portal radius-scheme radiuslocal authorization portal radius-scheme radiuslocal accounting portal radius-scheme radius local access-limit disable state active idle-cut disable self-service-url disabledomain pppoe accounting lan-access radius-scheme radius authentication ppp radius-scheme radius local authorization ppp radius-scheme radius local accounting ppp radius-scheme radius access-limit disable state active idle-cut enable 10 10240 self-service-url disable ippool 3 192.169.101.2 192.169.101.254domain pppoe-server-10 accounting lan-access radius-scheme radius authentication ppp radius-scheme radius local authorization ppp radius-scheme radius local accounting ppp radius-scheme radius access-limit disable state active idle-cut enable 10 10240 self-service-url disable ippool 10 192.169.10.2 192.169.10.254domain pppoe-server-11 accounting lan-access radius-scheme radius authentication ppp radius-scheme radius local authorization ppp radius-scheme radius local accountingppp radius-scheme radius access-limit disable state active idle-cut enable 10 10240 self-service-url disable ippool 11 192.169.11.2 192.169.11.254domain pppoe-server-12 accounting lan-access radius-scheme radius authentication ppp radius-scheme radius local authorization ppp radius-scheme radius local accounting ppp radius-scheme radius access-limit disable state active idle-cut enable 10 10240 self-service-url disable ippool 12 192.169.12.2 192.169.12.254domain pppoe-server-13 accounting lan-access radius-scheme radius authentication ppp radius-scheme radius local authorization ppp radius-scheme radius local accounting ppp radius-scheme radius access-limit disable state active idle-cut enable 10 10240 self-service-url disable ippool 13 192.169.13.2 192.169.13.254domain pppoe-server-14 accounting lan-access radius-scheme radius authentication ppp radius-scheme radius local authorization ppp radius-scheme radius local accounting ppp radius-scheme radius access-limit disable state active idle-cut enable 10 10240 self-service-url disable ippool 14 192.169.14.2 192.169.14.254domain pppoe-server-15 accounting lan-access radius-scheme radius authentication ppp radius-scheme radius local authorization ppp radius-scheme radius local accounting ppp radius-scheme radius access-limit disable state active idle-cut enable 10 10240 self-service-url disable ippool 15 192.169.15.2 192.169.15.254domain system authentication ppp local access-limit disable state active idle-cut disable self-service-url disable ippool 2 192.169.99.2 192.169.99.10#pki entity ssl common-name ssl organization-unit xxzx organization gxgs locality chongqing state chongqing country cn#pki domain sslcaidentifier ssl certificate request from ra certificate request entity sslcrlcheck disable#dhcp server ip-pool 1 network 192.169.0.0 mask 255.255.255.0 gateway-list 192.169.0.1 dns-list 218.201.4.3 218.201.17.2 expired day 5#dhcp server ip-pool vlan-10 network 192.169.10.0 mask 255.255.255.0 gateway-list 192.169.10.1 dns-list 218.201.4.3 218.201.21.132#dhcp server ip-pool vlan-11 network 192.169.11.0 mask 255.255.255.0 gateway-list 192.169.11.1 dns-list 218.201.4.3 218.201.21.132#dhcp server ip-pool vlan-12 network 192.169.12.0 mask 255.255.255.0 gateway-list 192.169.12.1 dns-list 218.201.4.3 218.201.21.132#dhcp server ip-pool vlan-13 network 192.169.13.0 mask 255.255.255.0 gateway-list 192.169.13.1 dns-list 218.201.4.3 218.201.21.132#dhcp server ip-pool vlan-14 network 192.169.14.0 mask 255.255.255.0 gateway-list 192.169.14.1 dns-list 218.201.4.3 218.201.21.132#dhcp server ip-pool vlan-15 network 192.169.15.0 mask 255.255.255.0 gateway-list 192.169.15.1 dns-list 218.201.4.3 218.201.21.132#user-group system group-attribute allow-guest#local-user admin password cipher$c$3$OPmwVHESNbfHNXczEeMcdq2DmRDCR7kmS/E= authorization-attribute level 3 service-type ssh terminal service-type ftp service-type weblocal-user dot1x password cipher$c$3$nWqagHMVZB63q5qHyLqXBdUlHB39vQ2RPnE= service-type lan-accesslocal-user h3c password cipher$c$3$ZHwyfLAqYN93aNiWN5J8OHGVh3EAgA== service-type ppp service-type portal#ssl server-policy sslvpn pki-domain ssl#cwmp undocwmp enable#l2tp-group 1 allow l2tp virtual-template 1 tunnel name LNS#interface Aux0 async mode flow link-protocol ppp#interface Cellular0/0 async mode protocol link-protocol ppp# interface Ethernet0/0 portlink-mode route pppoe-server bind Virtual-Template 2#interface Ethernet0/1 portlink-mode route firewall packet-filter 3003 inbound natoutbound 3000 address-group 1
ipaddress darenable qoscar inbound carl 1 cir 1600 cbs 100000 ebs 0 green pass red discard qoscar outbound carl 10 cir 400 cbs 25000 ebs 0 green pass red discard#interface Ethernet0/2 portlink-mode route speed 100#interface Ethernet0/2.10 vlan-type dot1q vid 10 natoutbound 3100 ipaddress 192.169.10.1 255.255.255.0#interface Ethernet0/2.11 vlan-type dot1q vid 11 natoutbound 3100 ipaddress 192.169.11.1 255.255.255.0#interface Ethernet0/2.12 vlan-type dot1q vid 12 natoutbound 3100 ipaddress 192.169.12.1 255.255.255.0#interface Ethernet0/2.13 vlan-type dot1q vid 13 natoutbound 3100 ipaddress 192.169.13.1 255.255.255.0#interface Ethernet0/2.14 vlan-type dot1q vid 14 ipaddress 192.169.14.1 255.255.255.0#interface Ethernet0/2.15 vlan-type dot1q vid 15 natoutbound 3100 ipaddress 192.169.15.1 255.255.255.0#interface Ethernet0/2.20 vlan-type dot1q vid 20 natoutbound 3100 ipaddress 192.169.20.1 255.255.255.0 portal server portal method direct#interface Serial1/0 link-protocol ppp#interface Serial1/1 link-protocol ppp#interface Virtual-Template1 pppauthentication-mode chap domain system remote address pool 2 ipaddress 192.169.99.1 255.255.255.0#interface Virtual-Template2 pppauthentication-mode chap domain pppoe pppaccount-statistics enable pppipcp remote-address forced pppipcp dns 218.201.4.3 218.201.21.132 remote address pool 3 ipaddress 192.169.101.1 255.255.255.0#interface Virtual-Template10 pppauthentication-mode chap domain pppoe-server-10 pppipcp remote-address forced pppipcp dns 218.201.4.3 218.201.17.2 remote address pool 10#interface Virtual-Template11 pppauthentication-mode chap domain pppoe-server-11 pppipcp remote-address forced pppipcp dns 218.201.4.3 218.201.17.2 remote address pool 11#interface Virtual-Template12 pppauthentication-mode chap domain pppoe-server-12 pppipcp remote-address forced pppipcp dns 218.201.4.3 218.201.17.2 remote address pool 12# interface Virtual-Template13 pppauthentication-mode chap domain pppoe-server-13 pppipcp remote-address forced pppipcp dns 218.201.4.3 218.201.17.2 remote address pool 13#interface Virtual-Template14 pppauthentication-mode chap domain pppoe-server-14 pppipcp remote-address forced pppipcp dns 218.201.4.3 218.201.17.2 remote address pool 14#interface Virtual-Template15 pppauthentication-mode chap domain pppoe-server-15 pppipcp remote-address forced pppipcp dns 218.201.4.3 218.201.17.2 remote address pool 15#interface NULL0#interface Vlan-interface1 ipaddress 192.169.0.1 255.255.255.0 undoip fast-forwarding natoutbound 3100
firewall packet-filter 3002 inbound firewall packet-filter 4000 inbound#interface Ethernet0/3 portlink-mode bridge#interface Ethernet0/4 portlink-mode bridge# dhcp-snooping# ssl-vpn server-policy sslvpn ssl-vpn enable#
# info-center loghost 192.169.0.6 facilitylocal6# dhcpserver forbidden-ip 192.169.10.1 192.169.10.10 dhcpserver forbidden-ip 192.169.11.1 192.169.11.10 dhcpserver forbidden-ip 192.169.12.1 192.169.12.10 dhcpserver forbidden-ip 192.169.13.1 192.169.13.10 dhcpserver forbidden-ip 192.169.14.1 192.169.14.10 dhcpserver forbidden-ip 192.169.15.1 192.169.15.10 dhcpserver forbidden-ip 192.169.0.1 192.169.0.30 dhcpserver detect# dhcpenable# ntp-service unicast-server 202.112.10.60# sshserver enable sshuser admin service-type stelnet authentication-type password# arptimer aging 10# loadxml-configuration# loadtr069-configuration#user-interface tty 12user-interface aux 0 authentication-mode schemeuser-interface vty 0 4 authentication-mode scheme#return
2015/8/12 13:16:01
页:
[1]