daloRADIUS Ubuntu 24.04

Prerequisites

• An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region
• A VM size of Standard_B2s (2 vCPU / 4 GiB RAM) as a sensible starting point. Size up for larger deployments
• NSG inbound rules that allow 22/tcp from your management network and 80/tcp for the web console
• If your network access servers (access points, switches, VPN concentrators) need to reach the RADIUS server, inbound 1812/udp (authentication) and 1813/udp (accounting) from those devices
• A TLS plan for production. daloRADIUS serves plain HTTP on port 80, so terminate TLS in front of it with your own domain

The bundled MariaDB is never exposed. It listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal and choose Create a resource. Search the Marketplace for daloRADIUS by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:daloradius-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name daloradius \
  --image sac1647283583153:daloradius-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 for the web console and the RADIUS ports for your network devices:

az vm open-port --resource-group <your-rg> --name daloradius --port 80 --priority 900
az vm open-port --resource-group <your-rg> --name daloradius --port 1812 --priority 910
az vm open-port --resource-group <your-rg> --name daloradius --port 1813 --priority 920

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that Apache, FreeRADIUS and MariaDB are all active.

MariaDB listens only on 127.0.0.1:3306. Apache serves the console on port 80. FreeRADIUS listens on the RADIUS ports 1812 and 1813.

systemctl is-active apache2 freeradius mariadb daloradius-firstboot

ss -tlnp | grep -E ':80 |:3306 ' | sed 's/ */ /g';
ss -ulnp | grep -E ':1812 |:1813 ' | sed 's/ */ /g'

Step 4 - Retrieve the per-VM credentials

Every VM generates its own operator password, database password and RADIUS shared secret on first boot. It writes them to a root-only credentials file. Read the file with sudo:

sudo cat /root/daloradius-credentials.txt

Sign in to the operators console as user administrator, with the DALORADIUS_ADMIN_PASSWORD from this file. The RADIUS_SHARED_SECRET is the secret your network devices use to talk to FreeRADIUS.

On the VM itself, you can also run sudo mariadb to reach the database directly over the local socket without a password.

Step 5 - Sign in to the operators console

Browse to http://<vm-public-ip>/. The daloRADIUS operators sign-in page opens. Sign in with username administrator and the password from Step 4.

Step 6 - The operator dashboard

After you sign in, you land on the daloRADIUS dashboard. The home page summarises your RADIUS deployment at a glance.

The top navigation gives you Management (users, groups, NAS), Accounting, Billing, Reports, Configuration and Graphs.

Step 7 - Manage RADIUS users

Open Management, then Users, to list, create and edit RADIUS users. Each user maps to rows in the FreeRADIUS radcheck table that the server authenticates against.

Select New User to add a username and password, assign groups and attributes, and apply billing plans.

Step 8 - Manage NAS devices

Open Management, then NAS, to register your network access servers (access points, switches, VPN concentrators). FreeRADIUS reads its clients from the database (read_clients = yes), so the server honours any NAS you add here with its IP and shared secret.

In your NSG, restrict 1812/udp and 1813/udp to the addresses of these devices.

Step 9 - Test RADIUS authentication

You can test the RADIUS server end to end from the VM itself. The block below reads the per-VM shared secret from the credentials file and adds a throwaway test user to radcheck. It then authenticates that user against the local FreeRADIUS server with radtest and removes the user.

A successful login prints Received Access-Accept:

SECRET="$(sudo grep '^RADIUS_SHARED_SECRET=' /root/daloradius-credentials.txt | cut -d= -f2-)" sudo mariadb --protocol=socket -uroot raddb -e "INSERT INTO radcheck (username,attribute,op,value) VALUES ('demo-user','Cleartext-Password',':=','Demo1Pass2')" radtest demo-user 'Demo1Pass2' 127.0.0.1 0 "$SECRET"
sudo mariadb --protocol=socket -uroot raddb -e "DELETE FROM radcheck WHERE username='demo-user'"

In day-to-day use, you add real users from the web console (Step 7). This block is only a quick self test.

Step 10 - No known or default credentials

daloRADIUS normally ships a default operator, administrator / radius, and FreeRADIUS normally ships a default shared secret, testing123. The SecureAnyCloud image eliminates both.

The operator account is rotated to a unique per-VM password, stored as a bcrypt hash. The database password and RADIUS shared secret are also unique per VM, and no known or blank credential authenticates.

You can verify this with the built-in round-trip check. It confirms that the per-VM operator password verifies, while the default radius password and common weak guesses are all rejected. It also confirms that RADIUS authentication succeeds with the per-VM shared secret:

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT(username,' (the only operator account)') FROM raddb.operators WHERE username='administrator'"

sudo bash /usr/local/sbin/daloradius-cred-roundtrip.sh

Adding your own domain and TLS

The appliance serves plain HTTP on port 80. For production, front daloRADIUS with your own domain and a TLS certificate.

You can terminate TLS with Azure Application Gateway, an nginx or Caddy reverse proxy, or a managed load balancer with a certificate for your domain. Forward traffic to the VM on port 80.

The operators console is an administrative interface, so keep it off the public internet where you can. Restrict inbound 80/tcp in your NSG to your management network.

Security notes

• daloRADIUS serves plain HTTP on port 80. For anything beyond a trusted network, put it behind your own TLS-terminating reverse proxy or Azure Application Gateway with a certificate for your domain, and restrict access to the operators console.
• The operator password, the database password and the RADIUS shared secret are all unique per VM, and no known or blank credential authenticates. Keep /root/daloradius-credentials.txt protected. If you share access, change the operator password from within daloRADIUS (Configuration, then Operators).
• The bundled MariaDB listens on 127.0.0.1 only and is never reachable from the network. Administer it through daloRADIUS or over SSH.
• In your NSG, restrict inbound 80/tcp to your management network, and restrict 1812/udp and 1813/udp to the addresses of your network access servers.

Support

This image is maintained by SecureAnyCloud with 24/7 support. If you need help deploying or operating daloRADIUS on Azure, contact us at secureanycloud.com.

Deploy on Azure

Launch daloRADIUS on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com