FreeRADIUS AAA Server

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## What Is FreeRADIUS?

FreeRADIUS is the most widely deployed RADIUS server in the world and the basis of many commercial RADIUS products. It provides centralised authentication, authorisation and accounting (AAA) for network access: Wi-Fi access points, VPN concentrators, 802.1X switches, captive portals and dial style network access servers all ask FreeRADIUS whether a user may connect and record session duration. This image delivers FreeRADIUS fully installed and configured as a hardened systemd service, so a working RADIUS server answers authentication requests within minutes of launch, skipping hours of manual setup.

## How It Works

FreeRADIUS is driven entirely by its configuration tree under /etc/freeradius/3.0. The server listens for authentication on UDP 1812 and accounting on UDP 1813. Network access servers connect as RADIUS clients, each identified by an IP address and a shared secret, and users are checked against a backend. This image uses the standalone files backend, a simple flat user file, so you can add users and clients with a text editor and reload, with no database to run. From there you can grow into LDAP or SQL backends, EAP methods for 802.1X and enterprise Wi-Fi, and per user reply attributes such as VLAN assignment.

## Secure by Default

The stock FreeRADIUS package ships a well known client shared secret, testing123, and a demonstration user. Neither ships in this image. On first boot a one shot service generates a cryptographically random shared secret for the built in local client and a unique sample user and password for this specific instance, then writes them to a root owned credentials file. No two instances share a credential and the well known testing123 secret is removed from the entire configuration.

## Key Capabilities

• Centralised AAA for Wi-Fi, VPN, 802.1X switches and network access servers
• A proven clients and users model where each network device authenticates with its own shared secret
• A simple flat file user backend you can grow into LDAP, SQL and EAP
• RADIUS accounting on UDP 1813 for session start, stop and interim records
• A battle tested open source server underpinning a large share of the world's network access control
• No web console and no database: the whole configuration lives in version controllable text and reloads with a single command

## Get Started in Minutes

1. Launch the AMI and allow inbound UDP 1812 and 1813 in your security group.

2. SSH in and retrieve the generated shared secret and sample user from the credentials file.

3. Test authentication with the bundled radtest client.

4. Add your own access points, switches or VPN concentrators as RADIUS clients and your own users to the user file.

5. Reload the service with a single command.

cloudimg engineers can help with RADIUS client and user design, EAP and 802.1X for enterprise Wi-Fi, LDAP or SQL backends, accounting and VLAN policy after purchase.

FreeRADIUS is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.