Skip to content

Commit

Permalink
Light editing freeradius_server.md (#2384)
Browse files Browse the repository at this point in the history
* Replace "we" with "you" universally
* reword all passive voice to active voice
* Some sentence simplification
* replace conjunctions with words
  • Loading branch information
sspencerwire authored Sep 16, 2024
1 parent b8ab624 commit 0c40732
Showing 1 changed file with 10 additions and 11 deletions.
21 changes: 10 additions & 11 deletions docs/guides/security/freeradius_radius_server.md
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
title: FreeRADIUS RADIUS Server
author: Neel Chauhan
contributors:
contributors: Steven Spencer
tested_with: 9.4
tags:
- security
Expand All @@ -13,17 +13,16 @@ tags:

RADIUS is an AAA (authentication, authorization and accounting) protocol to manage network access. [FreeRADIUS](https://www.freeradius.org/) is the de-facto RADIUS server for Linux and other Unix-like systems.


## Prerequisites and assumptions

The following are minimum requirements for using this procedure:
The following are minimum requirements for this procedure:

* The ability to run commands as the root user or use `sudo` to elevate privileges
* A RADIUS client, such as a router, switch or Wi-Fi access point

## Installing FreeRADIUS

We can install FreeRADIUS from the `dnf` repositories:
You can install FreeRADIUS from the `dnf` repositories:

```bash
dnf install -y freeradius
Expand Down Expand Up @@ -53,9 +52,9 @@ user Cleartext-Password := "password"

Replace `user` and `password` with the respective desired username and password.

Keep in mind that the password isn't hashed so if an attacker gets hold of the `users` file they could gain unauthorized access to your protected network.
Know that the password is not hashed, so if an attacker gets hold of the `users` file they could gain unauthorized access to your protected network.

You could also do an `MD5`-hashed or `Crypt`-hashed password. To generate an MD5-hashed password, run:
You can also do an `MD5`-hashed or `Crypt`-hashed password. To generate an MD5-hashed password, run:

```bash
echo -n password | md5sum | awk '{print $1}'
Expand All @@ -69,7 +68,7 @@ You will get a hash of `5f4dcc3b5aa765d61d8327deb882cf99`. In `users` file, inse
user MD5-Password := "5f4dcc3b5aa765d61d8327deb882cf99"
```

We will also need to define clients. This is to prevent unauthorized access to our RADIUS server. Edit the `clients.conf` file:
You will also need to define clients. This is to prevent unauthorized access to our RADIUS server. Edit the `clients.conf` file:

```bash
vi clients.conf
Expand All @@ -83,19 +82,19 @@ client 172.20.0.254 {
}
```

Replace `172.20.0.254` and `secret123` with the IP address and secret value to be used by the client. This can be repeated for multiple clients.
Replace `172.20.0.254` and `secret123` with the IP address and secret value the clients will use. Repeat this for many clients.

## Enabling FreeRADIUS

After the initial configuration is completed, we can start `radiusd`:
After the initial configuration, you can start `radiusd`:

```bash
systemctl enable --now radiusd
```

## Configuring RADIUS on a switch

After setting up the FreeRADIUS server, we will configure a RADIUS client on the author's MikroTik switch as a wired 802.1X client:
After setting up the FreeRADIUS server, you will configure a RADIUS client on the author's MikroTik switch as a wired 802.1X client:

```bash
/radius
Expand All @@ -104,4 +103,4 @@ add address=172.20.0.12 secret=secret123 service=dot1x
add interface=combo3
```

Replace `172.20.0.12` with the FreeRADIUS server's IP address and `secret123` with the secret we set earlier.
Replace `172.20.0.12` with the FreeRADIUS server's IP address and `secret123` with the secret you set earlier.

0 comments on commit 0c40732

Please sign in to comment.