PrivacyIDEA RADIUS plugin Part 3

再延續PrivacyIDEA  Radius 外掛這個主題

前導如下:

https://xrcd2.blogspot.com/2026/05/privacyidea-radius-plugin-part-2.html

privacyIDEA 帳號的取得方式,常見的有 

(1) Create a new Passwd Resolver (/etc/passwd)

(2) Create a new LDAP Resolver (如 Windows AD（Active Directory） )

(3) Create a new SQL Resolver

先建立 Resolvers 解析器 ,再建 Realm 領域 與其建立連結.

如要建立(或取得)一個 privacyIDEA 的使用者,它可以來自(1) privacyIDEA Linux 本機上的使用者.

可自行參考 https://xrcd2.blogspot.com/2025/04/privacyidea.html

或 (2) LDAP 上的帳號 可自行參考  https://xrcd2.blogspot.com/2025/04/privacyidea-2fardp-test.html 

如(1)透過本機的/etc/passwd的作法,密碼只能透過設定 PIN 碼取代之,因為 privacyIDEA 無權去讀解寫/etc/shadow

[root@2FA src]# ls -la /etc/shadow

---------- 1 root root 1327 May 23 19:45 /etc/shadow

[root@2FA src]# ls -la /etc/passwd

-rw-r--r-- 1 root root 2955 May 23 19:45 /etc/passwd

[root@2FA src]# 

(2) LDAP Resolver 對 privacyIDEA 而言它,簡單的說他只負責驗證,使用者跟Token/OTP的配對關連及登入驗證部份.

如上所述,如需更簡單的管理 privacyIDEA 上的使用者,透過 MySQL 是一個不錯的選擇.

使用情境假設. privacyIDEA 用於 VPN 及 Windows RDP 登入控管.那使用者在[遠端連回公司辦公]的安控,就是有二段完全獨立的雙因子驗證 (2FA) ,如第一階段 VPN 的部份可以用 privacyIDEA SQL 身份及OTP,第二階段 RDP 的部份,可以用 privacyIDE Windows AD 身份及OTP.這樣應該更安全了吧.

以下筆記為建立  privacyIDEA SQL 使用者帳戶的小筆記

[root@2FA src]# mysql

Welcome to the MariaDB monitor.  Commands end with ; or \g.

Your MariaDB connection id is 184

Server version: 10.11.15-MariaDB MariaDB Server

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> CREATE DATABASE vpn_users;

Query OK, 1 row affected (0.005 sec)

MariaDB [(none)]> CREATE USER 'pi_resolver'@'localhost' IDENTIFIED BY 'Passw0rd';

Query OK, 0 rows affected (0.003 sec)

MariaDB [(none)]> GRANT ALL PRIVILEGES ON vpn_users.* TO 'pi_resolver'@'localhost';

Query OK, 0 rows affected (0.001 sec)

MariaDB [(none)]> FLUSH PRIVILEGES;

Query OK, 0 rows affected (0.001 sec)

MariaDB [(none)]> use vpn_users;

Database changed

MariaDB [vpn_users]> CREATE TABLE pi_users (

    ->     id INT AUTO_INCREMENT PRIMARY KEY,

    ->     username VARCHAR(64) NOT NULL UNIQUE,

    ->     password_hash VARCHAR(255),

    ->     email VARCHAR(100),

    ->     mobile VARCHAR(20),

    ->     description VARCHAR(255)

    -> ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

Query OK, 0 rows affected (0.005 sec)

MariaDB [vpn_users]> INSERT INTO pi_users (username, email, mobile) VALUES ('testuser', 'testuser@vlab.tw', '0912345678');

Query OK, 1 row affected (0.001 sec)

MariaDB [vpn_users]>  SELECT * FROM pi_users\G;

*************************** 1. row ***************************

           id: 1

     username: testuser

password_hash: NULL

        email: testuser@vlab.tw

       mobile: 0912345678

  description: NULL

1 row in set (0.000 sec)

ERROR: No query specified

MariaDB [vpn_users]> UPDATE pi_users SET description = 'TEST User' WHERE id = 1;

Query OK, 1 row affected (0.001 sec)

Rows matched: 1  Changed: 1  Warnings: 0

MariaDB [vpn_users]>  SELECT * FROM pi_users\G;

*************************** 1. row ***************************

           id: 1

     username: testuser

password_hash: NULL

        email: testuser@vlab.tw

       mobile: 0912345678

  description: TEST User

1 row in set (0.000 sec)

ERROR: No query specified

MariaDB [vpn_users]> 

=======================

==>

 {"userid":"id","username":"username","password":"password_hash","email":"email","mobile":"mobile","description":"description"}

======================

CREATE TABLE pi_users (

    id INT AUTO_INCREMENT PRIMARY KEY,

    username VARCHAR(64) NOT NULL UNIQUE,

    password_hash VARCHAR(255),

    email VARCHAR(100),

    mobile VARCHAR(20),

    description VARCHAR(255)

) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

==========================

[root@2FA ~]# vi   /etc/privacyidea/rlm_perl.ini

[Default]

URL = https://localhost/validate/check

#REALM = defrealm

#RESCONF = deflocal

REALM = mysql 

RESCONF = SQL

===================================

MariaDB [(none)]> use vpn_users;

Reading table information for completion of table and column names

You can turn off this feature to get a quicker startup with -A

Database changed

MariaDB [vpn_users]>  SELECT * FROM pi_users\G;

*************************** 1. row ***************************

           id: 1

     username: testuser

password_hash: NULL

        email: testuser@vlab.tw

       mobile: 0912345678

  description: TEST User

*************************** 2. row ***************************

           id: 2

     username: vpn.sqluser

password_hash: {SSHA256}p5yVX9/7OX0TrPdHlQhrm4rPZyi5F/8KbnPPPP/qFqsTAuA8

        email: vpn.sqluser@vlab.tw

       mobile: 0939000000

  description: VPN User in SQL

2 rows in set (0.000 sec)

ERROR: No query specified

MariaDB [vpn_users]> 

======================================