Могу ли я использовать RADIUS для strongswan - psk настроен?

# Install & Configure StrongSwan + FreeRADIUS ( MariaDB Backend ) - CentOS7  # Install Require Packages : [root@strongswan ~]# yum install -y epel-release [root@strongswan ~]# yum update && yum install -y gcc gcc-c++ pam-devel zlib-devel systemd-devel openssl-devel [root@strongswan ~]# yum install -y freeradius freeradius-mysql freeradius-utils mariadb mariadb-server  # Download StrongSwan : [root@strongswan ~]# wget http://www.strongswan.org/download/strongswan-5.5.0.tar.gz [root@strongswan ~]# tar zvxf strongswan-5.5.tar.gz [root@strongswan ~]# cd strongswan-5.5.0  # Compile StrongSwan : [root@strongswan ~]# ./configure --prefix=/usr --sysconfdir=/etc/strongswan --localstatedir=/var --enable-unity --enable-xauth-eap --enable-eap-identity --enable-eap-md5 --enable-xauth-pam --enable-eap-tls --enable-eap-radius --enable-eap-mschapv2 --enable-dhcp --enable-systemd --enable-eap-dynamic --enable-openssl --enable-addrblock --enable-certexpire --enable-radattr --enable-swanctl --disable-gmp [root@strongswan ~]# make && make install  # Generate Certificates : [root@strongswan ~]# cd /etc/strongswan/ipsec.d/ [root@strongswan ipsec.d]# ipsec pki --gen --type rsa --size 2048 --outform pem > private/strongswanKey.pem [root@strongswan ipsec.d]# ipsec pki --self --ca --lifetime 3650 --in private/strongswanKey.pem --type rsa --dn "C=Ir, O=IT, CN=StrongSwanVPN" --outform pem > cacerts/strongswanCert.pem  [root@strongswan ipsec.d]# ipsec pki --gen --type rsa --size 2048 --outform pem > private/vpnHostKey.pem [root@strongswan ipsec.d]# chmod 600 private/vpnHostKey.pem  [root@strongswan ipsec.d]# ipsec pki --pub --in private/vpnHostKey.pem --type rsa | ipsec pki --issue --lifetime 730 --cacert cacerts/strongswanCert.pem --cakey private/strongswanKey.pem --dn "C=Ir, O=IT, CN=StrongSwanVPN" --san 192.168.1.1 --flag serverAuth --outform pem > certs/vpnHostCert.pem  # Generate Client Certificate : [root@strongswan ipsec.d]# ipsec pki --gen --type rsa --size 2048 --outform pem > private/ClientKey.pem [root@strongswan ipsec.d]# chmod 600 private/ClientKey.pem [root@strongswan ipsec.d]# ipsec pki --pub --in private/ClientKey.pem --type rsa | ipsec pki --issue --lifetime 730 --cacert cacerts/strongswanCert.pem --cakey private/strongswanKey.pem --dn "C=Ir, O=IT, CN=StrongSwanVPN" --outform pem > certs/ClientCert.pem  # Export CLIENT CERTIFICATE As a PKCS#12 File : [root@strongswan ipsec.d]# openssl pkcs12 -export -inkey private/ClientKey.pem -in certs/ClientCert.pem -name "Client's VPN Certificate" -certfile cacerts/strongswanCert.pem -caname "strongSwan Root CA" -out Client.p12  # Configure StrongSwan : [root@strongswan ~]# vim /etc/strongswan/ipsec.conf ------------------------ config setup uniqueids=no  conn standard_ikev2 keyexchange=ikev2 ike=aes256-sha256-modp1024,3des-sha1-modp1024,aes256-sha1-modp1024! esp=aes256-sha256,3des-sha1,aes256-sha1! fragmentation=no rekey=no left=192.168.1.1 leftsendcert=always leftfirewall=yes leftsubnet=0.0.0.0/0 leftcert=vpnHostCert.pem right=%any rightauth=eap-radius rightsourceip=10.0.0.0/24 eap_identity=%any dpdaction=clear auto=add ------------------------ [root@strongswan ~]# vim /etc/strongswan/ipsec.secrets : RSA vpnHostKey.pem  [root@strongswan ~]# vim /etc/strongswan/strongswan.conf ------------------------ charon { load_modular = yes  compress = yes plugins { include strongswan.d/charon/*.conf eap-radius { servers { server-a { accounting = yes secret = 123456 address = 192.168.1.1 auth_port = 1812 acct_port = 1813 } } } }  include strongswan.d/*.conf } ------------------------ [root@strongswan ~]# vim /etc/sysctl.conf net.ipv4.ip_forward = 1 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.all.send_redirects = 0  # start strongswan service : [root@strongswan ~]# systemctl start strongswan && systemctl enable strongswan  # Configure FreeRADIUS : [root@strongswan ~]# vim /etc/raddb/mods-available/sql ------------------------ database = "mysql" driver = "rlm_sql_mysql" server = "localhost" port = 3306 login = "radius" password = "radius-password" radius_db = "radius" read_clients = yes ------------------------  # Enable sql Module : [root@strongswan ~]# ln -s /etc/raddb/mods-available/sql /etc/raddb/mods-enabled/sql  # Comment "files" and Uncomment "sql" : [root@strongswan ~]# vim /etc/raddb/sites-available/default  # Comment -> "files" and Uncomment -> "sql" : [root@strongswan ~]# vim /etc/raddb/sites-available/inner-tunnel  [root@strongswan ~]# vim /etc/raddb/client.conf ------------------------ client 0.0.0.0 { secret = 123456 nas_type = other shortname = 0.0.0.0 require_message_authenticator = no } ------------------------ [root@strongswan ~]# cat /etc/strongswan/ipsec.d/cacerts/strongswanCert.pem > /etc/raddb/certs/ca.pem [root@strongswan ~]# cat /etc/strongswan/ipsec.d/certs/vpnHostCert.pem > /etc/raddb/certs/server.pem [root@strongswan ~]# cat /etc/strongswan/ipsec.d/private/vpnHostKey.pem > /etc/raddb/certs/server.key [root@strongswan ~]# cat /etc/raddb/certs/server.key >> /etc/raddb/certs/server.pem  # start radiusd service : [root@strongswan ~]# systemctl start radiusd && systemctl enable radiusd  ## Configure MariaDB : [root@strongswan ~]# systemctl start mariadb && systemctl enable mariadb [root@strongswan ~]# mysql_secure_installation  [root@strongswan ~]# mysql -u root -p Enter Password: ******  MariaDB> create database radius; MariaDB> grant all privileges on radius.* to radius@localhost identified by "radius-password"; MariaDB> flush privileges; MariaDB> use radius; MariaDB> source /etc/raddb/mods-config/sql/main/mysql/schema.sql;  # add username|password : MariaDB> INSERT INTO radcheck (username,attribute,op,VALUE) VALUES ('ehsan','Cleartext-Password',':=','eh@12345'); MariaDB> INSERT INTO radcheck (username,attribute,op,VALUE) VALUES ('alireza','Cleartext-Password',':=','abc123');