Frequently Asked Questions (FAQ)

The FreeRADIUS Server is a daemon for unix and unix like operating systems which allows one to set up a radius protocol server. The RADIUS protocol manages the communication between network devices to facilitate remote user authentication and accounting practices. See Architecture for more information on RADIUS components and interactions. The RADIUS protocol serves three primary functions:

FreeRADIUS is an open-source product with all the benefits of open-source software that includes flexibility, scalibility, and cost-effectivness. FreeRADIUS has many features not found in other free and commercial versions. Some of these features are:

Yes. FreeRADIUS is compatible with all known equipment and products which implement the RADIUS standards. FreeRADIUS runs on a large number of 32 and 64 bit Unix-like platforms. Where there are compatibility issues is ofent due to third-party vendors' implementation of the relevant standards.

Yes. You can find it on the official FreeRADIUS site.

Yes. The source is available at ftp or on github. See the instructions on how to build FreeRADIUS.

Yes. FreeRADIUS v2 and later has full support for both IPv6 attributes and IPv6 network packets.

Yes. The official site for FreeRADIUS contains the server, documentation, and additional RADIUS programs. FreeRADIUS is supported by the InkBridge Networks team.

Please see the following for a description of the FreeRADIUS mailing lists. For normal discussion of the server and how to use it, subscribe to the FreeRADIUS user-list. Only subscribe to the development list if you are interested in writing software for the new server.

No. A user with an active session can’t be disconnected with FreeRADIUS. The RADIUS server doesn’t actively maintain the user sessions and only receives information about these sessions from the NAS. This means that you have to signal your NAS to disconnect sessions. Depending on the NAS type and it’s configuration, there are a number of ways to disconnect sessions.

Yes. RADIUS defines a Reply-Message attribute, which you can use to send text messages in a RADIUS reply packet. PPP has provisions for passing text messages back to the user.

However, Microsoft windows users can’t see PPP messages due to Microsoft’s implementation of the PPP protocol. For macs, the only dialer that shows up the server’s message is FreePPP.

Yes. There are several methods to manage login time for groups.

Yes. Edit the raddb/users file with the following entry on the first line (top of the file). This entry accepts everybody on to the network.

If you want this to apply to a single user replace DEFAULT with username. You can also add Auth-Type Accept to radcheck or radgroupcheck entries in order to accept that user/group. This only works for PAP, and does NOT work for EAP-TLS, CHAP, MSCHAP, or WIMAX authentication.

Yes. There are several ways to bind the IP address.

No. The RADIUS server only logs the messages which a NAS sends to it. If your NAS is not sending those messages or attributes, then the RADIUS server will not log them. Configure your NAS to send the information you want to the RADIUS server. Once the NAS is sending the information, the server can then log it.

Yes. All of the attribute operators such as :=, ==, +=, etc. are documented via the:

Yes. use the following example to configure multiple values on an attribute.

No. If CHAP is implemented as the authentication protocol, a file resides on your network with cleartext passwords for all the users that log on using FreeRADIUS. This is a limitation of the CHAP protocol itself, not the RADIUS protocol. The CHAP protocol requires that you store the passwords in plain-text format.

As an administrator, decide which authentication method is required for your business needs. Some considerations are:

Yes. The most common approach is to just assign non-globally-routable IP addresses to those users, such as RFC 1918 addresses. Make sure you have RADIUS authorization enabled on your NAS.

Depending on your internal network configuration, you may need to set up internal routes for those addresses, and if you don’t want them to do anything besides SMTP and POP3 within your network, you’ll have to set up ACLs on your dialup interfaces allowing only ports 25 and 110 through.

User entry in raddb/users file example

Yes. Retrieve the redhat/radiusd.pam file from the distribution and save it as a new file in /etc/pam.d/radiusd.

If you have 100’s to 1000’s of users in /etc/passwd, you’ll want to replace the pam_pwdb.so entries with pam_unix_auth.so, pam_unix_acct.so etc. The pam_pwdb module is slow for authenticating users from a large /etc/passwd file.

Bruno Lopes F. Cabral|mailto:bruno-at-openline-dot-com-dot-br also says:

Now I can emulate group behaviour using just PAM and some tricks, like

and

With this method, I have NO users on /etc/password and NO need for lots of lines on /etc/raddb/users. time to search for a db enabled pam_listfile module

No. After upgrading to FreeRADIUS, some users are unable to fully use the network, but their access worked with the previous RADIUS server you were using.

The NAS doesn’t know which RADIUS server you use, and it doesn’t care. The entire problem is that the responses to the NAS from the servers are different. Since FreeRADIUS only sends the attributes in a response that you’ve configured, your local configuration of FreeRADIUS is incomplete after the upgrade.

Use tcpdump to snoop the RADIUS responses from each server. Once you discover which attributes are missing from the response of FreeRADIUS, you can add them to it’s configuration. Re-start the server, and your users should have full access to the network again.