Setting up external Radius server for RUTOS authentication

Summary

In this example we will perform a basic Radius server configuration for router's SSH and WebUI authentication. We will use freeradius package to set up a local Radius server on Ubuntu operating system. Lastly we will test the configuration with a RUT series device.

Topology used in this example

Prerequisites

• Router with the ability to install an additional PAM package
• Ubuntu machine with the ability to host a local FreeRadius server

Preparing Ubuntu machine

Installing the FreeRadius server

Firstly, update the package list and upgrade the packages to their latest version:

sudo apt update
sudo apt upgrade

Next, install the FreeRadius package:

sudo apt install freeradius

Defining a Client

Client - router that will use FreeRadius to authenticate WebUI and/or SSH users. In order to add/edit clients, we need to access the clients.conf file. Use your favorite text editor to access it:

sudo nano /etc/freeradius/3.0/clients.conf

For this example we will add the following lines in order to accept any IP address as a client:

client 0.0.0.0/0 {
    secret = demoscrt
    shortname = 0.0.0.0/0
}

Note: IP of a specific Public IP of the client can be used instead of 0.0.0.0/0

Defining a User and Password

Before we create a user's login credentials, let's use an MD5 hash instead of a clear text password. We will generate a hash value of demo123 using the following command:

echo -n demo123| md5sum | awk '{print $1}'

We will now define credentials for user demo. Use your favorite text editor to access it:

sudo nano /etc/freeradius/3.0/users

Add required lines to the file:

demo     MD5-Password:= "62cc2d8b4bf2d8728120d052163a77df"
       Reply-Message := "Hello, %{User-Name}"

Once these changes are made, start the FreeRadius service:

sudo /etc/init.d/freeradius start

Preparing the router

Creating a static IP lease for FreeRadius server

Firstly, we will set a static IP lease for the Ubuntu machine running FreeRadius server. To do that you can use two methods.

First method

• Connect to the WebUI
• Navigate to Status → Network → LAN
• In the DHCP Leases section you should the Ubuntu machine's IP
• Press near the instance to create a static IP lease

Second method

• Connect to the WebUI
• Navigate to Network → DHCP → Static Leases
• Add the Ubuntu machine's MAC, IP, and provide a description

• Press

Creating a new RUTOS user

Now we will need to create a new user with SSH access. To do that follow these steps:

• Go to System → Administration → User Settings → System Users section
• In the Add new user section fill the user's login credentials.

You can specify your own custom role or choose one from the default roles. In this example, admin role was chosen. File:Networking new device user fw76 v1.png
Remember: use the same username as in FreeRadius users file. The password can be different, compared to the one in FreeRadius users file.

• Press near the newly created user
• Enable the SSH access
• Press

PAM package installation

Now we will need to install a PAM package, to do that follow these steps:

• Go to System → Package Manager → Packages
• Install the PAM package

Radius server configuration

Now we will set the FreeRadius server's information on the router

For SSH authentication

• Go to System → Administration → Access Control → PAM section
• Press near the SSH instance
• Enable the instance
• Set module to RADIUS
• Set type to Required
• Set server to Ubuntu machine's IP
• Set secret to the one defined in the FreeRadius clients.conf file
• Leave Port and Timeout to their default values

• Press

For WebUI authentication

• Go to System → Administration → Access Control → PAM section
• Press near the SSH instance
• Enable the instance
• Set module to RADIUS
• Select the newly created user or enable PAM authentication for all users
• Set type to Required
• Set server to Ubuntu machine's IP
• Set secret to the one defined in the FreeRadius clients.conf file
• Leave Port and Timeout to their default values

• Press

Testing Authentication

Now that we have the setup configured, we can test if the server authenticates the users.

In order to see authentication requests on the server side:

a. Run radius server in debug mode by first disabling the freeradius service using command

sudo /etc/init.d/freeradius stop

and then running the following command:

sudo freeradius -X

b. Tail the log file using the following command:

sudo tail -f /var/log/freeradius/radius.log

Once we see the logs, we can connect to the Hotspot using user credentials defined from either a smartphone or another computer:

• Connect to the wireless network

• Login using credentials defined in the Radius server users

• You should see authorization success window

• Logs should show Login OK message