Category: Linux

FreeRadius is the radius solution for Linux in my opinion, and hooks in well with nearly anything you could ever find yourself wanting it to work with! It will work in conjunction with Squid, PPTPD, Apache, WHMCS, and so so many other things.

And the good news is, the installation and configuration is pretty darn simple! In fact it should take you no more than about 15 to 20 minutes to complete by following this guide.

What you will need for this tutorial

1. A VPS with Centos 5.x or 6.x or Ubuntu 11 (32 or 64 bit is ok)
2. About 20 minutes of free time
3. Putty terminal already connected to your server, ready to go!

Need a VPS? I highly recommend DigitalOcean if you are shopping around, pretty quick support and their entire website is perfectly automated. It’s a very impressive place to hang out!

Let’s begin, Installing the packages

First we need to install the freeradius package and it’s dependencies:

CentOS 5:

yum install freeradius2 freeradius2-mysql freeradius2-utils mysql-server -y

CentOS 6:

yum install freeradius freeradius-mysql freeradius-utils mysql-server -y

Ubuntu:

apt-get install freeradius freeradius-mysql freeradius-utils mysql-server

This should go off without any problems at all, and let’s continue on.

The next thing we should do is setup our MySQL installation.

Installing MySQL

CentOS:

service mysqld start

Ubuntu:

service mysql start

IMPORTANT! Currently the MySQL database is pretty unprotected, make sure you run the mysql_secure_installation at the end of this step!

Now we will create the database needed for Free Radius to use and also populate with with tables and apply the required permissions for free radius to connect to it. You can if you wish change the username and password from the below (I would probably change the password even though we’re only adding authentication from localhost) however please write down your changes next to you as you will need them later!

CentOS:

mysql -uroot <<EOFMYSQL
CREATE DATABASE radius;
GRANT ALL PRIVILEGES ON radius.* TO radius@localhost IDENTIFIED BY "radpass";
flush privileges;
use radius;
SOURCE /etc/raddb/sql/mysql/schema.sql
exit
EOFMYSQL

Ubuntu:

mysql -uroot <<EOFMYSQL
CREATE DATABASE radius;
GRANT ALL PRIVILEGES ON radius.* TO radius@localhost IDENTIFIED BY "radpass";
flush privileges;
use radius;
SOURCE /etc/freeradius/sql/mysql/schema.sql
exit
EOFMYSQL

Okay, now it’s time to secure our MySQL installation by typing:

/usr/bin/mysql_secure_installation

This will start the MySQL secure install application, it will ask you various questions about the install environment you would like to keep, and ask you to change the root password. Generally speaking apart from changing the root password your answer to everything else should be the default one (yes). There are circumstances to choose other options but that is outside the scope of this tutorial sorry. Plenty of reading on Google for those of you who are interested!

I cannot stress how important this step is however, please make sure you complete it before continuing!

Optional – Installing nano

Okay, now it’s config editing time, for the examples we will use the editor ‘nano’ as it’s my favorite for quick and dirty but basic tasks. You’re free however to use whatever you are comfortable with.

First we need to make sure nano is installed (you can skip this if you’re going to use something other than nano)

CentOS:

yum install nano -y

Ubuntu:

apt-get install nano -y

Edit sql.conf

CentOS:

nano /etc/raddb/sql.conf

Ubuntu:

nano /etc/freeradius/sql.conf

You need to make sure that the values for the following are the same in your file. If you changed any of the details in the MySQL earlier (such as the radius username or password) make sure it’s reflected here too.

        # Connection info:
	server = "localhost"
	#port = 3306
	login = "radius"
	password = "radpass"

	# Database table configuration for everything except Oracle
	radius_db = "radius"

Edit radiusd.conf

CentOS:

nano /etc/raddb/radiusd.conf

Ubuntu:

nano /etc/freeradius/radiusd.conf

We need to make sure that a line is uncommented (no hash symbol on the same line of text before it)
Do a search in nano (using Ctrl+W) and type in “sql.conf” (without quotes) and make sure that the line matching that below is uncommented.

$INCLUDE  sql.conf

Edit sites-available/default

CentOS:

nano /etc/raddb/sites-available/default

Ubuntu:

nano /etc/freeradius/sites-available/default

There are two occurrences of “sql” (no quotes) within this file that need to be uncommented. One is inside the section “authorize” and the other inside the section “accounting”.

Edit sites-available/inner-tunnel

CentOS:

nano /etc/raddb/sites-available/inner-tunnel

Ubuntu:

nano /etc/freeradius/sites-available/inner-tunnel

There are two occurrences of “sql” (no quotes) within this file that need to be uncommented. One is inside the section “authorize” and the other inside the section “session”.

Edit clients.conf

CentOS:

nano /etc/raddb/clients.conf

Ubuntu:

nano /etc/freeradius/clients.conf

Inside this file there is a setting called “secret” (no quotes) that we need to change from the default value of “testing123” (no quotes) as that’s a bit too obvious. It probably looks like the below by default in your file:

secret = testing123

Let’s quickly visit random.org and grab something a bit more secure, you don’t have to – you can set it to your pet’s name if you wish! However  I am a fan of secure passwords, and random stuff. if you are too, click this link (opens in a new window and different every time) and pick a random one one to use.

Now it should look something like this:

secret = mL9fXjMfQ5rjQ6fB

Did we break it? Checking to see if Radius works ok

Now is the hmmm part, did we follow the tutorial correctly and will FreeRadius start ok? let’s find out!

CentOS:

service radiusd restart

Ubuntu:

service freeradius restart

You should see something like this:

Don’t worry if the stopping radius says it didn’t finish ok, that’s because it wasn’t already running! What is important is if it says it started ok or not, if it didn’t then go back over the config files and make sure they are correct. If it fails to start it should also give you a clue why to help you figure out what went wrong.

Okay, we’re good. Let’s stop the radius server and continue on

You can stop free radius by entering the appropriate command below:

CentOS:

service radiusd stop

Ubuntu:

service freeradius stop

Optional – Authorizing other servers to access this Radius Server – clients.conf

Sometimes you will only want a radius server to authenticate users through services and applications that are on the same server as the radius server, so if that’s the case then you only need the secret you set in the final config file we edited previously. However it makes sense if you have many services and applications on different servers that you want people to have the same username and password for to use the 1 radius server for all of them. So we need to give authority to these servers to be able to come knock on our new radius server’s door and ask “Is this username and password for John Smith valid?”

And this is were we specify the ip address / hostname and the password for those other servers to use so they can verify logins against your radius server!

Open up clients.conf by using the appropriate command:

CentOS:

nano /etc/raddb/clients.conf

Ubuntu:

nano /etc/freeradius/clients.conf

Yep this is the same file we were in before changing the secret for requests to the radius server that come from localhost. This time we need to scroll right down to the bottom of the config file (in nano you can hold Ctrl+V to have a “pgdn” effect and mover there quicker) and paste in your version of the below:

client APP_SERVER_IP {
	secret		= A PASSWORD FOR THE APP SERVER
	shortname	= A NAME FOR THE APP SERVER
        nastype         = other
}

Here is a quick explanation of the properties we need to set:

APP_SERVER_IP - this is the ip address or the public hostname (domain name) of the server accessing our radius server

secret - this is the password that should be expected from the application server

shortname - this is a nickname for the application server that will be accessing our new radius server

nastype - just leave this as other

You can add as many of these as you need, but lets only add the one for now for testing purposes (keep it simple) and you can always come back later when you have proven everything else is working!

Making changes to the radius config files

When you do make a change to any of the radius config files, the changes are not automatically loaded, you need to restart the radius service for it to pick up it’s configuration again.

To do this, run the appropriate command from those given below:

CentOS:

service radiusd restart

Ubuntu:

service freeradius restart

Adding a user to the Radius database for authentication

Okay we are nearly there I promise! Next we have to add users to the radius database to be used later for authentication. To do this we need to open MySQL again but this time we will include the -p parameter indicating that the user root is password protected and we have to supply MySQL with one!

mysql -uroot -p

MySQL will now ask you for your password, type it in followed by enter.

Now we switch to the radius database:

use radius;

Then we run some SQL to add the user to the database. The example below will add a user called ‘myusername’ with a password of ‘mypassword’, don’t copy this as it’s not very secure is it being posted all over the internet, change them to something of your own first! 🙂

INSERT INTO `radcheck` (`id`, `username`, `attribute`, `op`, `value`) VALUES (1,'myusername','User-Password',':=','mypassword');

Then we type exit to close MySQL and return normal bash prompt.

exit

Testing out our Radius server

Ok you remember earlier when I told you to change the secret for localhost and write it down next to you? You’re going to need it now.

First lets give radius one last restart to make sure it’s running ok and the latest config is loaded.

CentOS:

service radiusd restart

Ubuntu:

service freeradius restart

Now we’re going to try out that user we created in the radius database by typing this into the shell:

radtest myusername mypassword 127.0.0.1 0 radpass

To help you with what is going on here, here is an explanation of the command’s parameters:

myusername - this is the username for the user we created through MySQL in the radius database in the previous step.

mypassword - this is the password for the user we created through MySQL in the radius database in the previous step.

127.0.0.1 - this is the ip address of the radius server, leave that as localhost for now.

0 - this is important but we wont go into it in this tutorial, for now its a magical required zero.

radpass - this is the secret we changed earlier that i told you to write down next to you.

When you submit your command you should see “rad_recv: Access-Accept” which means well done your radius is working.

Some common reasons for it not working:

• If you see it try 3 times and then fail, this could mean 1 of two things:
  • Your radius service isn’t running!
  • The password (secret for an application attempting to authenticate on your radius, not the user’s pasword) is incorrect. – this is because when the password is wrong, FreeRadius acts like there is no one listening, this helps protect you against would be hackers!
• If you see it try once and it reports that it is invalid then it could mean:
  
   
  • The user’s password is incorrect
  • MySQL service is not running! – Radius will startup ok even if MySQL didn’t!
• If you see the message: “Access-Reject packet from host 127.0.0.1” it means:
  • The user’s username and or password is incorrect.

Hopefully these hints helped you out of your problem, but if not, this final step might help you.

Radius debug mode

Okay for this you will need two putty sessions open, so go ahead and open another.

First we need to make sure that FreeRadius is stopped, so in the first putty session type the applicable command of the following:

CentOS:

service radiusd stop

Ubuntu:

service freeradius stop

Then in the same window type in the following to start the FreeRadius debug console:

radiusd -X

First you will see a bunch of text scrolling, that’s the radius setting itself up, look for warnings or errors here, they could be signs of a broken config file.

Once it settles it’s ready for another attempt, so in your window have another go at testing your login against the radius server and watching for the reaction of radiusd in the other window.

If you see: “Received packet from x.x.x.x with invalid Message-Authenticator!” This means that the secret (not the user’s password but the radius secret) is incorrect. When this happens FreeRadius will just pretend it’s not there, so you may see your client also attempting to connect more than once (usually 3 times) before stopping.

Most errors are pretty self explanatory, but if you have any problems, feel free to leave a comment!

Thanks,

Xavier.