I run a small wireless network for a non-profit organization in my home town, it consists of a single high site with internet connectivity, with nine client sites connecting via wireless. The network is built with Ubiquiti hardware, with a Mikrotik 750 handling the routing. I also use this network for experimentation and learning. One of the things that I have been keen on doing is managing it as though it is a commercial network in terms of the network architecture. To this end I have decided to deploy a Raspberrry Pi based Radius server for PPPoE Authentication. The Mikrotik will serve as the PPPoE server, and the Raspberry Pi Radius server will be managed with DaloRADIUS. The instructions below should be easy to use on any Debian based distro.
This tutorial will not cover installation of Raspbian onto your Raspberry Pi.
You will aslo need to configure DaloRadius to connect to the database:
vi /var/www/daloradius/library/daloradius.conf.php
Input the following values
$configValues['DALORADIUS_VERSION'] = '0.9-9';
$configValues['FREERADIUS_VERSION'] = '2';
$configValues['CONFIG_DB_ENGINE'] = 'mysql';
$configValues['CONFIG_DB_HOST'] = 'localhost';
$configValues['CONFIG_DB_PORT'] = '3306';
$configValues['CONFIG_DB_USER'] = 'radiusuder';
$configValues['CONFIG_DB_PASS'] = 'radiuspass';
$configValues['CONFIG_DB_NAME'] = 'radiusdb';
The default configuration of FreeRADIUS loads user accounts from a file located at /etc/freeradius/users.
It makes sense to test the functioning of FreeRADIUS before trying to link it to a database. To activate the test user you have to edit /etc/freeradius/users:
Uncomment the following lines:
#"John Doe" Cleartext-Password := "hello"
# Reply-Message = "Hello, %{User-Name}"
To look like this:
"John Doe" Cleartext-Password := "hello"
Reply-Message = "Hello, %{User-Name}"
Restart the freeradius service and show the debug console to make sure all is well:
$/etc/init.d/freeradius stop
$freeradius -XXX
If all goes well you will be presented with the last line :
Info: Ready to process requests.
Press CTRL+C to disconnect.
Start the freeradius service again
$/etc/init.d/freeradius start
Use radtest to make sure that you can authenticate against the file:
$radtest "John Doe" hello 127.0.0.1 0 testing123
Sending Access-Request of id 180 to 127.0.0.1 port 1812
User-Name = "John Doe"
User-Password = "hello"
NAS-IP-Address = 127.0.1.1
NAS-Port = 0
Message-Authenticator = 0x00000000000000000000000000000000
Now it is time to switch over to mysql authentication:
$vi /etc/freeradius/radiusd.conf
Change the lines that read:
# $INCLUDE sql.conf<
# $INCLUDE sql/mysql/counter.conf
To:
$INCLUDE sql.conf
$INCLUDE sql/mysql/counter.conf
Update the configuration to reflect the database username and password as chosen earlier:
$vi /etc/freeradius/sql.conf
server = "localhost"
#port = 3306
login = "radiususer"
password = "radiuspass"
# Database table configuration for everything except Oracle
radius_db = "radiusdb"
Uncomment the lines that read "sql" in the session, accounting and authorize sections
$vi /etc/freeradius/sites-enabled/default
Uncomment sql in authorize{}
# See “Authorization Queries” in sql.conf
sql
Uncomment sql in accounting{}
# See “Accounting queries” in sql.conf
sql
Uncomment sql in session{}
# See “Simultaneous Use Checking Queries” in sql.conf
sql
Uncomment sql in post-auth{}
# See “Authentication Logging Queries” in sql.conf
sql
To test the configuration, stop the freeradius service:
Then run the freeradius debug console.
If it comes back without any errors you can continue.
To enable remote authentication from a Mikrotik device edit /etc/freeradius/clients.conf
Add the following to the end of the file, changing the IP/Class as appropriate.
$vi /etc/freeradius/clients.conf
client 10.0.0.0/24 {
secret = mikrotest
shortname = mikrotikpppoe
nastype= mikrotik
}
Also edit /etc/freeradius/dictionary and add mikrotik:
$vi /etc/freeradius.dictionary
and add:
$INCLUDE /usr/share/freeradius/dictionary.mikrotik
Restart FreeRadius
$service freeradius restart
You can now log in with a web browser on http://<raspberry-ip>/daloradius
username: administrator
password: radius