daloRADIUS

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for daloRADIUS. Select the SecureAnyCloud listing, choose Select, and then choose Continue on the subscription summary.

Select an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, and create or select a security group that opens port 22 from your management network and port 80 for the operator console. Leave the root volume at the default size or larger. The appliance also attaches a dedicated 20 GiB data volume for the database automatically.

Select Launch instance. First-boot initialisation takes a few seconds after the instance state becomes Running and the status checks pass. During this time, the per-instance operator, database and RADIUS shared secret are generated.

The following command launches an instance from the SecureAnyCloud daloRADIUS Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22 and 80 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=daloradius}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name from the EC2 console or with aws ec2 describe-instances.

Connect over SSH using your key pair and the login user for your operating system variant.

OS variant SSH login user

Ubuntu 24.04 ubuntu

ssh -i <key-name>.pem ubuntu@<public-ip>

The operator password, database password and RADIUS shared secret are unique to your instance and were generated on first boot. Read them as root:

sudo cat /root/daloradius-credentials.txt

You will see the operator sign in URL and username, the operator password, the database name, user and password, and the RADIUS shared secret for the built in 127.0.0.1 client. Store these somewhere safe.

The appliance runs three services: Apache (the operator console), FreeRADIUS (the RADIUS server) and MariaDB (the database). Confirm they are active and that FreeRADIUS is listening on the RADIUS ports:

systemctl is-active apache2 freeradius mariadb

sudo ss -lunp | grep -E ':1812|:1813'

curl -s -o /dev/null -w 'operator console: HTTP %{http_code}\n' http://127.0.0.1/operators/login.php

The first command prints active three times, the second shows FreeRADIUS listening on UDP 1812 and 1813, and the third returns HTTP 200.

Open http://<public-ip>/ in your browser. daloRADIUS redirects you to its operator sign-in page. Sign in with the username administrator and the operator password from your credentials file.

After signing in you land on the dashboard, with server and services status, RADIUS and system logs, and the management menus across the top.

Open Management, then Users, and choose New User. Set an authentication type, an optional group, and the username and password the subscriber will use to authenticate. daloRADIUS writes the user into the same radcheck table that FreeRADIUS reads, so the user can authenticate immediately.

Register your network access servers, access points, switches, VPN concentrators and Wi-Fi controllers as RADIUS clients. FreeRADIUS answers requests only from registered clients. Open Management, then Nas, and choose New NAS. Enter the device IP address or hostname, a shared secret, the NAS type and a short name.

The built in 127.0.0.1 client already uses the RADIUS shared secret from your credentials file, so you can test authentication from the instance itself before adding external devices.

From the instance, you can confirm end-to-end RADIUS authentication with radtest, which ships with FreeRADIUS. Create a test user in the operator console (Step 7), then run the following command. Replace the username and password with those of your test user, and the shared secret with the value from your credentials file. A correct password returns Access-Accept, and a wrong password returns Access-Reject.

# From a NAS or test host, sending to your instance at <public-ip> on UDP 1812.
# On the instance itself use 127.0.0.1 and the RADIUS_SHARED_SECRET from your creds file. radtest alice s3cret <public-ip> 0 your-shared-secret

External NAS devices authenticate the same way, sending their requests to your instance on UDP port 1812 with the shared secret you configured for them in Step 8.

The MariaDB data directory is bind-mounted onto a dedicated EBS volume mounted at /data, so your RADIUS users, NAS devices and accounting records live on their own disk. Confirm the layout:

findmnt /data

df -h /data /var/lib/mysql

To grow the database storage later, expand the EBS volume in the EC2 console, then grow the file system on the instance with resize2fs. No data is moved, and no reinstall is needed.

By default, the operator console is served over plain HTTP on port 80. For production, front it with TLS and a real domain name. Point a DNS record at your instance, open port 443 in the security group, and then install a certificate with Certbot:

sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d <your-domain>

Certbot obtains and installs a certificate and configures Apache to redirect HTTP to HTTPS and to renew automatically.

Do not open the operator console or the RADIUS ports to the whole internet. In the EC2 security group:

• Restrict port 22 (SSH) to your management network only
• Restrict ports 80 and 443 (the operator console) to the networks your operators use
• Open UDP 1812 and 1813 (RADIUS authentication and accounting) only to the source addresses of your NAS devices

MariaDB is bound to loopback (127.0.0.1) inside the instance and is never exposed, so never open port 3306 in the security group.

Take a logical backup of the RADIUS database with mariadb-dump. Because MariaDB uses socket authentication for the root user, no password is needed on the instance:

sudo mariadb-dump --single-transaction raddb > /root/raddb-backup.sql

Copy the resulting file off the instance, or schedule regular EBS snapshots of the /data volume for point-in-time recovery.