daloRADIUS on AWS User Guide

Overview

This image runs daloRADIUS, the open source, web based management platform for FreeRADIUS, together with a fully configured FreeRADIUS server and a MariaDB database, as a single self contained appliance. From one web interface you manage RADIUS users, groups and attributes, hotspots and NAS devices, billing plans, and authentication and accounting reports. Because daloRADIUS reads and writes the same SQL tables that FreeRADIUS authenticates against, a user or device you add in the operator console is honoured by the RADIUS server immediately.

daloRADIUS is a PHP application installed under /var/www/daloradius and served by the Apache web server with mod_php on port 80. FreeRADIUS 3 answers authentication requests on UDP port 1812 and accounting on UDP port 1813. Both are backed by a MariaDB database whose data directory, /var/lib/mysql, is bind mounted onto a dedicated, independently resizable EBS data volume mounted at /data, so all of your subscriber, device and accounting data stays off the operating system disk and survives instance replacement.

The FreeRADIUS and daloRADIUS schema ships in the image, so you land on a working operator sign in page. Three secrets are generated freshly on the first boot of every deployed instance: the daloRADIUS operator password, the application database password, and the FreeRADIUS shared secret for the built in local client. Two instances launched from the same Amazon Machine Image never share any of them. The well known daloRADIUS default operator (administrator / radius) and the FreeRADIUS default shared secret (testing123) are eliminated. The credentials are written to /root/daloradius-credentials.txt with mode 0600 so that only the root user can read them.

Prerequisites

Before you deploy this image you need:

• An Amazon Web Services account where you can launch EC2 instances
• IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
• An EC2 key pair in the target Region for SSH access to the instance
• A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network and port 80 for the operator console
• The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Step 1: Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images choose AWS Marketplace AMIs and search for daloRADIUS. Select the cloudimg listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login). Under Network settings select your VPC and subnet, and either create or select a security group that opens port 22 from your management network and port 80 for the operator console. Leave the root volume at the default size or larger; the appliance also attaches a dedicated 20 GiB data volume for the database automatically.

Select Launch instance. First boot initialisation takes a few seconds after the instance state becomes Running and the status checks pass, while the per instance operator, database and RADIUS shared secret are generated.

Step 2: Launch the Instance from the AWS CLI

The following block launches an instance from the cloudimg daloRADIUS Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22 and 80 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=daloradius}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name from the EC2 console or with aws ec2 describe-instances.

Step 3: Connect to Your Instance

Connect over SSH using your key pair and the login user for your operating system variant.

ssh -i <key-name>.pem ubuntu@<public-ip>

Step 4: Retrieve Your Credentials

The operator password, database password and RADIUS shared secret are unique to your instance and were generated on first boot. Read them as root:

sudo cat /root/daloradius-credentials.txt

You will see the operator sign in URL and username, the operator password, the database name, user and password, and the RADIUS shared secret for the built in 127.0.0.1 client. Store these somewhere safe.

Step 5: Confirm the Services Are Running

The appliance runs three services: Apache (the operator console), FreeRADIUS (the RADIUS server) and MariaDB (the database). Confirm they are active and that FreeRADIUS is listening on the RADIUS ports:

systemctl is-active apache2 freeradius mariadb

sudo ss -lunp | grep -E ':1812|:1813'

curl -s -o /dev/null -w 'operator console: HTTP %{http_code}\n' http://127.0.0.1/operators/login.php

The first command prints active three times, the second shows FreeRADIUS listening on UDP 1812 and 1813, and the third returns HTTP 200.

Step 6: Sign In to the Operator Console

Browse to http://<public-ip>/ and you are taken to the daloRADIUS operator sign in page. Sign in with the username administrator and the operator password from your credentials file.

After signing in you land on the dashboard, with server and services status, RADIUS and system logs, and the management menus across the top.

Step 7: Add a RADIUS User

Open Management then Users and choose New User. Set an authentication type, an optional group, and the username and password the subscriber will use to authenticate. daloRADIUS writes the user into the same radcheck table that FreeRADIUS reads, so the user can authenticate immediately.

Step 8: Register a NAS (RADIUS Client)

Your network access servers, access points, switches, VPN concentrators and Wi-Fi controllers must be registered as RADIUS clients before FreeRADIUS will answer their requests. Open Management then Nas and choose New NAS. Enter the device IP address or hostname, a shared secret, the NAS type and a short name.

The built in 127.0.0.1 client already uses the RADIUS shared secret from your credentials file, so you can test authentication from the instance itself before adding external devices.

Step 9: Test Authentication

From the instance you can confirm end to end RADIUS authentication with radtest, which ships with FreeRADIUS. Create a test user in the operator console (Step 7), then run the following, replacing the username, password and the shared secret with the value from your credentials file. A correct password returns Access-Accept; a wrong password returns Access-Reject.

# From a NAS or test host, sending to your instance at <public-ip> on UDP 1812.
# On the instance itself use 127.0.0.1 and the RADIUS_SHARED_SECRET from your creds file.
radtest alice s3cret <public-ip> 0 your-shared-secret

External NAS devices authenticate the same way, sending their requests to your instance on UDP port 1812 with the shared secret you configured for them in Step 8.

Step 10: The Dedicated Data Volume

The MariaDB data directory is bind mounted onto a dedicated EBS volume mounted at /data, so your RADIUS users, NAS devices and accounting records live on their own disk. Confirm the layout:

findmnt /data

df -h /data /var/lib/mysql

To grow the database storage later, expand the EBS volume in the EC2 console, then grow the file system on the instance with resize2fs; no data is moved and no reinstall is needed.

Step 11: Front the Console with HTTPS (Recommended)

By default the operator console is served over plain HTTP on port 80. For production you should front it with TLS and a real domain name. Point a DNS record at your instance, open port 443 in the security group, then install a certificate with Certbot:

sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d <your-domain>

Certbot obtains and installs a certificate and configures Apache to redirect HTTP to HTTPS and to renew automatically.

Step 12: Lock Down Access

The operator console and the RADIUS ports should not be open to the whole internet. In the EC2 security group:

• Restrict port 22 (SSH) to your management network only
• Restrict port 80 and 443 (the operator console) to the networks your operators use
• Open UDP 1812 and 1813 (RADIUS authentication and accounting) only to the source addresses of your NAS devices

MariaDB is bound to loopback (127.0.0.1) inside the instance and is never exposed; never open port 3306 in the security group.

Step 13: Back Up the Database

Take a logical backup of the RADIUS database with mariadb-dump. Because MariaDB uses socket authentication for the root user, no password is needed on the instance:

sudo mariadb-dump --single-transaction raddb > /root/raddb-backup.sql

Copy the resulting file off the instance, or schedule regular EBS snapshots of the /data volume for point in time recovery.

Support

This image is published by cloudimg with 24/7 technical support by email and chat. We can help with deployment, adding RADIUS clients and users, FreeRADIUS policy and SQL configuration, TLS and custom domains, MariaDB administration, accounting and reporting, and version upgrades.

daloRADIUS and FreeRADIUS are trademarks of their respective owners. This image is not affiliated with, endorsed by, or sponsored by the daloRADIUS or FreeRADIUS projects.