FreeRADIUS

Prerequisites

• A VM launched from this SecureAnyCloud FreeRADIUS image on Azure.
• An Azure Network Security Group that allows UDP 1812 and UDP 1813 inbound from your NAS devices only (access points, switches, VPN concentrators). Do not expose RADIUS to the public internet.
• SSH access to the VM as azureuser.

RADIUS clients authenticate with a shared secret. Treat the shared secret like a password, and scope the NSG rules to the source addresses of your network equipment.

Verify the RADIUS server is running

Connect over SSH as azureuser. Then confirm that freeradius.service is active and listening on the authentication and accounting ports.

sudo systemctl is-active freeradius
sudo ss -uln | grep -E ':1812 |:1813 '

The output shows active, with listeners bound to 0.0.0.0:1812 (authentication) and 0.0.0.0:1813 (accounting), plus their IPv6 equivalents.

Retrieve the per-instance credentials and test authentication

On the first boot of your VM, FreeRADIUS generated a unique shared secret and a unique sample user and password. They are stored in the root-owned credentials file:

sudo cat /root/freeradius-credentials.txt

The file contains RADIUS_SECRET, SAMPLE_USER and SAMPLE_PASSWORD, each unique to this VM. Test authentication end to end with the bundled radtest client. It reads those values and sends a PAP Access-Request to the built-in localhost client:

RADIUS_SECRET=$(sudo grep '^RADIUS_SECRET=' /root/freeradius-credentials.txt | cut -d= -f2-)
SAMPLE_USER=$(sudo grep '^SAMPLE_USER=' /root/freeradius-credentials.txt | cut -d= -f2-)
SAMPLE_PASSWORD=$(sudo grep '^SAMPLE_PASSWORD=' /root/freeradius-credentials.txt | cut -d= -f2-) radtest "$SAMPLE_USER" "$SAMPLE_PASSWORD" localhost 0 "$RADIUS_SECRET"

The server returns Access-Accept with the reply message configured for the sample user. This proves that the RADIUS pipeline (client shared secret, users backend and PAP authentication) works end to end.

Confirm invalid credentials are rejected

A correctly configured RADIUS server must reject bad credentials. This image also removes the well known testing123 shared secret that ships with the stock package. Run the block below to test that a wrong password is rejected:

RADIUS_SECRET=$(sudo grep '^RADIUS_SECRET=' /root/freeradius-credentials.txt | cut -d= -f2-)
SAMPLE_USER=$(sudo grep '^SAMPLE_USER=' /root/freeradius-credentials.txt | cut -d= -f2-)
RESULT=$(radtest "$SAMPLE_USER" "the-wrong-password" localhost 0 "$RADIUS_SECRET" 2>&1 || true)
echo "$RESULT" | grep -q 'Access-Reject' && echo "A wrong password is correctly rejected (Access-Reject)."

A request with the wrong password returns Access-Reject. A request signed with the old testing123 shared secret does not authenticate, because that secret is no longer present anywhere in the configuration.

Add a RADIUS client (a NAS device)

Every network device that authenticates users through FreeRADIUS is a RADIUS client (a NAS, network access server) and needs its own shared secret. The shipped clients.conf includes the clients.d/ directory, so you add one small file per device. View the shipped file:

sudo cat /etc/freeradius/3.0/clients.conf

To authorise a wireless access point at 192.0.2.50, for example, create a file such as /etc/freeradius/3.0/clients.d/office-ap.conf with a client block. Choose a long, random shared secret and configure the same secret on the access point:

client office-ap { ipaddr = 192.0.2.50 secret = choose-a-long-random-shared-secret nas_type = other }

You can also authorise a whole subnet of devices by giving ipaddr a CIDR such as 10.20.0.0/24. After you add or change a client, restart the service so that it re-reads the configuration:

sudo systemctl restart freeradius

Add a user

This image uses the simple flat files backend. Users live in /etc/freeradius/3.0/mods-config/files/sac-users, which the standard authorize file includes. Add one entry per user. For a PAP user with a cleartext password, add a block like this. Indent the continuation lines:

alice Cleartext-Password := "choose-a-strong-password" Reply-Message := "Welcome, %{User-Name}"

To attach reply attributes such as a VLAN assignment for 802.1X, add Tunnel-Type, Tunnel-Medium-Type and Tunnel-Private-Group-Id reply items. After you edit the users file, restart the service:

sudo systemctl restart freeradius

For production directories, point FreeRADIUS at an LDAP or SQL backend instead of the flat file. Enable the ldap or sql module under /etc/freeradius/3.0/mods-enabled/ and adjust the authorize and authenticate sections.

For enterprise Wi-Fi and wired 802.1X, enable the eap module and configure the EAP methods your clients use.

Point your NAS devices at the server

On each access point, switch or VPN concentrator, configure the RADIUS server address (this VM's private or public IP), the authentication port 1812, the accounting port 1813, and the shared secret you set for that device in its clients.d/ file.

Keep the NSG rules scoped to your equipment and rotate shared secrets periodically. For wireless authentication, prefer EAP methods over PAP.

Support

SecureAnyCloud provides 24/7 technical support for this FreeRADIUS image by email (sales@secureanycloud.com) and live chat. We help with adding RADIUS clients and users, migrating to LDAP or SQL backends, configuring EAP and 802.1X for enterprise Wi-Fi, RADIUS accounting, reply attributes such as VLAN assignment, version upgrades and troubleshooting.

Critical issues receive a one hour average response time.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch FreeRADIUS 3.2 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Connecting to your instance

Connect over SSH on port 22 as the default login user for the AMI variant you launched. FreeRADIUS ships with no login of its own. The per-instance RADIUS credentials live in a root-only file on the instance.

On Ubuntu 24.04 LTS, the SSH login user is ubuntu. The service is freeradius.service, and the configuration is at /etc/freeradius/3.0.

ssh -i /path/to/key.pem ubuntu@<public-ip>

Prerequisites

• An AWS account and a key pair in the target region.
• A subscription to the FreeRADIUS listing on AWS Marketplace.
• A security group that allows TCP 22 (admin) from your address, and UDP 1812 and UDP 1813 from the NAS devices (access points, switches, VPN concentrators) that will authenticate against the server.

Recommended instance type: m5.large (2 vCPU, 8 GB RAM) is ample for a departmental or site RADIUS server. FreeRADIUS is very light. You need larger sizes only for very high authentication volumes or EAP-heavy 802.1X estates.