Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Light editing freeradius_server.md #2384

Merged
merged 1 commit into from
Sep 16, 2024
Merged

Light editing freeradius_server.md #2384

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 10 additions & 11 deletions docs/guides/security/freeradius_radius_server.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
title: FreeRADIUS RADIUS Server
author: Neel Chauhan
contributors:
contributors: Steven Spencer
tested_with: 9.4
tags:
- security
Expand All @@ -13,17 +13,16 @@ tags:

RADIUS is an AAA (authentication, authorization and accounting) protocol to manage network access. [FreeRADIUS](https://www.freeradius.org/) is the de-facto RADIUS server for Linux and other Unix-like systems.


## Prerequisites and assumptions

The following are minimum requirements for using this procedure:
The following are minimum requirements for this procedure:

* The ability to run commands as the root user or use `sudo` to elevate privileges
* A RADIUS client, such as a router, switch or Wi-Fi access point

## Installing FreeRADIUS

We can install FreeRADIUS from the `dnf` repositories:
You can install FreeRADIUS from the `dnf` repositories:

```bash
dnf install -y freeradius
Expand Down Expand Up @@ -53,9 +52,9 @@ user Cleartext-Password := "password"

Replace `user` and `password` with the respective desired username and password.

Keep in mind that the password isn't hashed so if an attacker gets hold of the `users` file they could gain unauthorized access to your protected network.
Know that the password is not hashed, so if an attacker gets hold of the `users` file they could gain unauthorized access to your protected network.

You could also do an `MD5`-hashed or `Crypt`-hashed password. To generate an MD5-hashed password, run:
You can also do an `MD5`-hashed or `Crypt`-hashed password. To generate an MD5-hashed password, run:

```bash
echo -n password | md5sum | awk '{print $1}'
Expand All @@ -69,7 +68,7 @@ You will get a hash of `5f4dcc3b5aa765d61d8327deb882cf99`. In `users` file, inse
user MD5-Password := "5f4dcc3b5aa765d61d8327deb882cf99"
```

We will also need to define clients. This is to prevent unauthorized access to our RADIUS server. Edit the `clients.conf` file:
You will also need to define clients. This is to prevent unauthorized access to our RADIUS server. Edit the `clients.conf` file:

```bash
vi clients.conf
Expand All @@ -83,19 +82,19 @@ client 172.20.0.254 {
}
```

Replace `172.20.0.254` and `secret123` with the IP address and secret value to be used by the client. This can be repeated for multiple clients.
Replace `172.20.0.254` and `secret123` with the IP address and secret value the clients will use. Repeat this for many clients.

## Enabling FreeRADIUS

After the initial configuration is completed, we can start `radiusd`:
After the initial configuration, you can start `radiusd`:

```bash
systemctl enable --now radiusd
```

## Configuring RADIUS on a switch

After setting up the FreeRADIUS server, we will configure a RADIUS client on the author's MikroTik switch as a wired 802.1X client:
After setting up the FreeRADIUS server, you will configure a RADIUS client on the author's MikroTik switch as a wired 802.1X client:

```bash
/radius
Expand All @@ -104,4 +103,4 @@ add address=172.20.0.12 secret=secret123 service=dot1x
add interface=combo3
```

Replace `172.20.0.12` with the FreeRADIUS server's IP address and `secret123` with the secret we set earlier.
Replace `172.20.0.12` with the FreeRADIUS server's IP address and `secret123` with the secret you set earlier.
Loading