How To Install FreeRADIUS on AlmaLinux 9

FreeRADIUS is one of the most widely used open-source RADIUS servers, providing essential services for authentication, authorization, and accounting (AAA) in network management. It is particularly valuable for organizations that require secure access control for users and devices. This article will guide you through the detailed process of installing FreeRADIUS on AlmaLinux 9, ensuring you have a robust and secure RADIUS server set up for your network needs.

Understanding FreeRADIUS

What is FreeRADIUS?

FreeRADIUS is an open-source RADIUS server that facilitates AAA services for various types of networks. It supports a wide range of authentication protocols and can handle thousands of requests per second, making it suitable for both small businesses and large enterprises. With its modular architecture, FreeRADIUS can be extended to meet specific requirements, enhancing its flexibility and usability.

Use Cases of FreeRADIUS

FreeRADIUS is commonly used in various scenarios, including:

• Internet Service Providers (ISPs) managing customer access.
• Enterprise networks requiring secure employee access.
• Educational institutions providing network access to students and staff.
• Wireless networks that need centralized authentication methods.

Prerequisites for Installation

System Requirements

Before installing FreeRADIUS, ensure your system meets the following minimum hardware specifications:

• CPU: 1 GHz or faster.
• RAM: At least 1 GB (2 GB recommended).
• Disk Space: 500 MB free space for installation.

Software Requirements

You will need a fresh installation of AlmaLinux 9. Ensure you have administrative access to the terminal with root or sudo privileges to perform the installation and configuration tasks.

Familiarity with Basic Commands

A basic understanding of Linux command-line operations is essential. Familiarity with commands such as cd, ls, nano, and systemctl will be beneficial throughout this process.

Preparing Your AlmaLinux System

Updating the System

The first step in preparing your system is to ensure that all existing packages are up-to-date. Open your terminal and run the following command:

sudo dnf update -y

Installing Necessary Packages

You may need additional packages that are required by FreeRADIUS. Install them using the following command:

sudo dnf install gcc make -y

Installing FreeRADIUS

Installing FreeRADIUS using DNF

The simplest way to install FreeRADIUS on AlmaLinux 9 is through the DNF package manager. Execute the following command:

sudo dnf install freeradius freeradius-utils -y

Starting and Enabling the Service

Once installed, you need to start the FreeRADIUS service and enable it to run at boot time. Use these commands:

sudo systemctl enable --now radiusd.service

Verifying Installation

You can check if FreeRADIUS is running correctly by executing:

sudo systemctl status radiusd.service

If everything is set up correctly, you should see an “active (running)” status in the output.

Configuring FreeRADIUS

Understanding Configuration Files

The main configuration files for FreeRADIUS are located in the directory /etc/raddb/. Key files include:

• /etc/raddb/radiusd.conf: Main configuration file for server settings.
• /etc/raddb/clients.conf: Configuration file for client devices that will connect to the RADIUS server.
• /etc/raddb/users: File where user accounts and their permissions are defined.

Configuring Clients

You need to specify which devices can communicate with your RADIUS server by editing the clients.conf. Open this file using a text editor:

sudo nano /etc/raddb/clients.conf

Add a client entry like this:

# Example client configuration
client my_client {
    ipaddr = 192.168.1.100
    secret = testing123
    shortname = my_client
}

This example allows a device with IP address 192.168.1.100 to connect using the shared secret “testing123”. Adjust the IP address and secret as necessary for your environment.

Configuring Users

User accounts can be added or modified in the users file. Open it with:

sudo nano /etc/raddb/users

Add user entries as follows:

# Example user configuration
username Cleartext-Password := "password"
    Reply-Message = "Hello, %{User-Name}"

This example creates a user named “username” with a cleartext password “password”. You can customize attributes as needed.

Testing Configuration

You can verify that your configuration works by using the radtest. Run this command to test user authentication:

radtest username password localhost 0 secret

If configured correctly, you should see an “Access-Accept” response from the server.

Securitizing Your FreeRADIUS Server

Best Practices for Security

Securitizing your RADIUS server is critical to prevent unauthorized access. Here are key practices to follow:

• Limit Access: Configure clients in /etc/raddb/clients.conf, allowing only trusted devices to connect.
• Password Management: Use strong passwords and secrets for clients and users alike.
• User Roles: Define user roles carefully in the /etc/raddb/users, ensuring minimal privilege necessary for operation.
• Avoid Default Settings: Change default configurations wherever possible to enhance security.
• Create Backups: Regularly back up your configuration files to recover from any accidental changes or failures.
• Audit Logs: Regularly check logs located in /var/log/radius.log. This helps identify unauthorized access attempts or misconfigurations.
• Suspend Inactive Users: Regularly review user accounts and disable those that are no longer active.
• TLS Encryption: Consider implementing TLS encryption for secure communication between clients and servers.

Troubleshooting Common Issues

If you encounter issues during installation, consider these common problems:

• Poor Internet Connection: Ensure you have a stable internet connection when running installation commands via DNF.
• PAM Configuration Errors: If using PAM (Pluggable Authentication Module), ensure it’s properly configured in conjunction with FreeRADIUS.
• Mismatched Versions: Ensure that installed packages are compatible with AlmaLinux 9; check official documentation if needed.

Troubleshooting Configuration Errors

If authentication fails after configuration, consider these steps:

• Error Messages: Review error messages returned by radtest; they often indicate what went wrong (e.g., unknown user).
• User Credentials: Double-check usernames and passwords in your users file; ensure they match what you’re testing against.
• NAT Issues: If clients are behind NAT, ensure proper IP addresses are configured in clients.conf.
• Status Checks: Use commands like systectl status radiusd.service , or check logs at /var/log/radius.log for detailed error information.

Congratulations! You have successfully installed FreeRADIUS. Thanks for using this tutorial for installing the FreeRADIUS on your AlmaLinux 9 system. For additional or useful information, we recommend you check the official FreeRADIUS website.