Setting Up a FreeRADIUS Server

After the bootstrap is complete, start the server in debugging mode as a root user.

• To do this, run the following command:

  

  Note

  Start the FreeRADIUS server in debugging mode only for testing. Other than for testing, use sudo systemctl start freeradius

  > sudo  radiusd -X
        [...]
        Listening on auth address * port 1812 bound to server default
        Listening on acct address * port 1813 bound to server default
        Listening on auth address :: port 1812 bound to server default
        Listening on acct address :: port 1813 bound to server default
        Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel
        Listening on proxy address * port 54435
        Listening on proxy address :: port 58415
        Ready to process requests

  The Listening and Ready to process requests appear when the server starts correctly.

Add the machines that can use the devices of the FreeRADIUS server and the users by using the following example:

1. Configure users in the authorization file, /etc/raddb/mods-config/files/authorize.

   To do this, open /etc/raddb/mods-config/files/authorize and uncomment the following lines:

   bob   Cleartext-Password := "hello"
       Reply-Message := "Hello, %{User-Name}"
     
     "john" Cleartext-Password := "newpassword"
       Service-Type = New-User,
       Framed-IP-Address = 190.155.2.50

2. Add a test client and user to test the authentication in /etc/raddb/client.conf.

   vi /etc/raddb/client.conf

   A test client, localhost, is provided in /etc/raddb/client.conf, with the secret testing123.

   client private-networks {
         ipaddr          = 190.1.0/22
         secret          = testingabc-1
         }
         client common-network {
           ipaddr          = 191.1.0/27
           secret          = testingxyz
           }

3. Add clients of the RADIUS server, such as a wireless access point, network switch, or another form of NAS.

   Create a client configuration on your server by using the following example.

   Uncomment the following entry in /etc/raddb/client.conf and use the IP address of your test client machine or access gateway instead of the given IP address.

   client private-network-1 {
   ipaddr          = 192.0.2.0/24
   secret          = testing123-1
   }

   You must also configure the client to talk to the RADIUS server by using the IP address of the machine running the RADIUS server. The client must use the same secret as configured above in the client section.

4. On the client machine, install freeradius-server-utils.

   > sudo sudo zypper install freeradius-server and freeradius-server-utils

Start the FreeRADIUS daemon to provide authentication, authorization, and accounting (AAA) services in a network environment for network access control and network access management.

1. Start the FreeRADIUS daemon.

   > sudo  systemctl restart freeradius

2. Enable auto-start for FreeRADIUS on system boot up.

   > sudo  systemctl enable freeradius

Test the authentication for the newly added user using the following example:

• Open a new terminal, and as an unprivileged user, use the radtest command to log in as the newly added user bob.

  >  radtest bob hello 127.0.0.1 0 testing123
          Sent Access-Request Id 241 from 0.0.0.0:35234 to 127.0.0.1:1812 length 73
                  User-Name = "bob"
                  User-Password = "hello"
                  NAS-IP-Address = 127.0.0.1
                  NAS-Port = 0
                  Message-Authenticator = 0x00
                  Cleartext-Password = "hello"
          Received Access-Accept Id 241 from 127.0.0.1:1812 to 0.0.0.0:0 length 20

  After the authentication is successful, a login message appears in the terminal in which you started FreeRADIUS, as shown below.

  (3) pap: Login attempt with password
            (3) pap: Comparing with "known good" Cleartext-Password
            (3) pap: User authenticated successfully
            (3)     [pap] = ok
            [...]
            (3) Sent Access-Accept Id 241 from 127.0.0.1:1812 to 127.0.0.1:35234 length 0
            (3) Finished request
            Waking up in 4.9 seconds.
            (3) Cleaning up request packet ID 241 with timestamp +889

  The access request is successful and the authentication methods PAP, CHAP, MS-CHAPv1, MS-CHAPv2, PEAP, EAP-TTLS, EAP-GTC, EAP-MD5 work for the user bob.