FREERADIUS
Agenda
● Introduction to free radius
● Configuring the server.
● Running the server and giving request to it from client
system.
● Configuring the server.
● Different approaches for authorization.
Introduction to freeradius
●
FreeRADIUS project, the open source implementation of
RADIUS, an IETF protocol for AAA (Authorisation,
Authentication, and Accounting).
● FreeRADIUS is responsible for authenticating one third
of all users on the Internet.
Protocols supported by freeradius
Key points
● Only one of ipaddr, ipv4addr, ipv6addr may be specified for a client.
● The transport protocol: If unspecified, defaults to "udp", which is the
traditional RADIUS transport. It may also be "tcp", in which case the server
will accept connections from this client ONLY over TCP.
● The shared secret use to "encrypt" and "sign" packets between the NAS
and FreeRADIUS.
● Default for PPP: dynamic IP address
● Download and Install the freeradius server from
https://freeradius.org/
● Once it is installed run the server using
freeradius -X
● To stop the server
systemctl freeradius stop
If we want to add new client
● Edit the client.conf file and add the following
with your address and secret key
● client example.org {
ipaddr = 192.168.0.187
secret = secretkey
}
● Here the client with specified IP address is
added to server, so it accepts the request from
it.
● Similarly we can add any number of clients.
Editing the users file
● Testing authentication is simple. Edit the users
file (in v3 this has been moved to raddb/mods-
config/files/authorize), and add the following
line of text at the top of the file, before anything
else:
● testing Cleartext-Password := "password"
● This text is used as password which is sent
while sending request to the server.
Sending request to the server
● We can use radtest to send request to the server
● Syntax:
radtest testing1 password1 127.0.0.1 0 testing123
● Here “testing1” is the name which we mentioned in
users file
● “password1” is the password we gave in users file.
● 127.0.0.1 is ip address of server and testing123 is
secret key .
RUNNING THE SERVER
Sending request to server
Response from server
If we give incorrect details
Suppose we send request if server
is off
Testing MD5 With eapol_test
● To test using MD5
● Save the following file as eap-md5.conf:
network={
key_mgmt=NONE
eap=MD5
identity="bob"
password="hello"
}
To test EAP-MSCHAPv2, perform
the following steps:
● Save the following as eap-mschapv2.conf:
network={
key_mgmt=WPA-EAP
eap=MSCHAPV2
identity="bob"
password="hello"
}
We can now test the simplest
method, EAP-TTLS.
● Save the following file as eap-ttls-pap.conf:
● network={
key_mgmt=WPA-EAP
eap=TTLS
identity="bob"
anonymous_identity="anonymous"
password="hello"
phase2="auth=PAP"
}
PEAP authentication
● Save the following file as peap-mschapv2.conf:
network={
key_mgmt=WPA-EAP
eap=PEAP
identity="bob"
anonymous_identity="anonymous"
password="hello"
phase2="auth=MSCHAPV2"
phase1="peapver=0"
}
