Ocserv整合Radius认证
目前社区主流SSL VPN有两个分支：openvpn和ocserv，通过官网和检索到的资料对比前者服务端比较强大，后者客户端和移动端支持更好，最近在学习vpn时对移动端要求高，因此选择了后者；
虽然社区文档已经比较全面，但使用过程中还是遇到不少曲折。
学习过程中使用软件相关版本如下：
- ocserv：ocserv-1.1.6
- radius：freeradius-server-3.2.3
- radius客户端：radcli-1.3.0
- 数据库：mysql-5.7.24
首先是按照文档安装、配置好ocserv和freeradius之后单独测试都正常通过，但是Ocserv配置了Radius认证之后启动报错，服务启动失败，错误如下：
error: vhost:default: unknown or unsupported auth method: radius[config=/usr/local/ocserv/conf/radiusclient.conf,groupconfig=true]
从字面看就是不支持radius认证方法，翻看官方文档确实有这么一段描述：
NOTE: radcli (or libradius-client) need to be installed before ocserv. If ocserv is compiled before radius libraries, it will build without radius support. Even if radius libraries are compiled/installed afterwards, it will not work, and ocserv will return errors when you try to start the service with RADIUS authentication enabled.
大意是radclient必须先于ocserv安装，回忆安装过程好像是把顺序搞反了，于是又重新安装了一次ocserv，再次启动，错误没啥变化~
翻看config.log，发现了错误：
Package radcli was not found in the pkg-config search path.
Perhaps you should add the directory containing radcli.pc
to the PKG_CONFIG_PATH environment variable
No package 'radcli' found
configure:13172: $? = 1
configure:13186: result: no
No package 'radcli' found
configure:13218: checking for freeradius client library
configure:13236: gcc -o conftest -g -O2 -Wall -Wno-strict-aliasing -Wextra -Wno-unused-parameter -Wno-sign-compare -Wno-missing-field-initializers -Wno-implicit-fallthrough -Wno-stringop-truncation conftest.c -lfreeradius-client >&5
conftest.c:46:15: fatal error: freeradius-client.h: No such file or directory
46 | #include <freeradius-client.h>
| ^~~~~~~~~~~~~~~~~~~~~
compilation terminated.
原来radclient通过源码编译安装，pkg-config找不到库文件；
其实源码中是包含了.pc文件的，只要放到PKG_CONFIG_PATH相关目录下就好了：
cp ./radcli-1.3.0/lib/radcli.pc /usr/lib64/pkgconfig/
通过命令行测试，ocserv服务端和radius控制台显示认证成功
openconnect -v -l --dump-http-traffic --cafile=/opt/keys/ca.crt 192.168.9.118:1194
(2) sql: SQL query returned: success
(2) sql: 1 record(s) updated
rlm_sql (sql): Released connection (5)
(2) [sql] = ok
(2) [exec] = noop
(2) policy remove_reply_message_if_eap {
(2) if (&reply:EAP-Message && &reply:Reply-Message) {
(2) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
(2) else {
(2) [noop] = noop
(2) } # else = noop
(2) } # policy remove_reply_message_if_eap = noop
(2) if (EAP-Key-Name && &reply:EAP-Session-Id) {
(2) if (EAP-Key-Name && &reply:EAP-Session-Id) -> FALSE
(2) } # post-auth = ok
(2) Sent Access-Accept Id 12 from 127.0.0.1:1812 to 127.0.0.1:33997 length 20