FreeRADIUS PAM Authentication on Raspberry Pi: A Guide

Title: Authenticating Wireless Users with Local Linux Credentials using FreeRADIUS on Raspberry Pi

In this guide, we will walk you through the process of setting up FreeRADIUS (version 3.2.1) on your Raspberry Pi to authenticate wireless users using local Linux credentials.

Prerequisites

Before we begin, ensure that your Raspberry Pi has a working wireless network and that you have already set up wireless users in the /etc/freeradius/users file.

Installing FreeRADIUS

1. Update your Raspberry Pi's package list:

sudo apt-get update

2. Install FreeRADIUS and its dependencies:

sudo apt-get install freeradius freeradius-common freeradius-utils

Configuring FreeRADIUS

Configure the users file

By default, FreeRADIUS looks for the user database in the /etc/freeradius/users file. Ensure that this file contains your wireless users and their corresponding Linux usernames and passwords.

# /etc/freeradius/users
nas_radius_secret_key
   Cleartext-Password := nas_radius_secret_key
   User-Password := PW1234
   User-Flags := Requisite-Group
   User-Group := wireless_users

Modify the FreeRADIUS configuration file

Edit the main configuration file located at /etc/freeradius/radiusd.conf:

sudo nano /etc/freeradius/radiusd.conf

Find the authorize section and add the following lines:

authorize {
    if (User-Name == "") {
        reject
        update control {
            Error-Message := "No username supplied"
        }
    }

    if (User-Password == "") {
        reject
        update control {
            Error-Message := "No password supplied"
        }
    }

    if (PAP-Password != user_password) {
        reject
        update control {
            Error-Message := "Incorrect password"
        }
    }

    accept
}

Save and close the file.

Create the Linux password file

Create a new file at /etc/freeradius/30-linux.conf:

sudo nano /etc/freeradius/30-linux.conf

Add the following lines:

client 127.0.0.1 {
    secret = nas_radius_secret_key
    auth_port = 1812
    acct_port = 1813

    sql_ip_pool = ippool
    sql_users = users

    preprocess
    authorize
    account
    post-auth {
        update reply {
            Reply-Message := "Welcome to the network!"
        }
    }
}

Save and close the file.

Configure the SQL backend

Edit the sql configuration file located at /etc/freeradius/sql:

sudo nano /etc/freeradius/sql

Add the following lines:

# sql
sql_ippool_conf = /etc/freeradius/sql/ippool.conf
sql_users_conf = /etc/freeradius/sql/users.conf

Save and close the file.

Now, create the ippool.conf and users.conf files in the /etc/freeradius/sql directory:

sudo touch /etc/freeradius/sql/ippool.conf
sudo touch /etc/freeradius/sql/users.conf

Edit the ippool.conf file:

sudo nano /etc/freeradius/sql/ippool.conf

Add the following lines:

driver = sql
sql_db = radiusdb
sql_table = ippool
sql_query = select ip from ippool where group_name = '%{User-Name}'
sql_bind_ip_to_name = yes

Save and close the file.

Edit the users.conf file:

sudo nano /etc/freeradius/sql/users.conf

Add the following lines:

driver = sql
sql_db = radiusdb
sql_table = users
sql_query = select password from users where username = '%{User-Name}'
sql_bind_password = cleartext

Save and close the file.

Set up the SQL database

Install the SQL backend by running:

sudo apt-get install sqlite3 libsqlite3-dev

Create the SQL database:

sqlite3 /etc/freeradius/sql/radiusdb

Create the ippool and users tables:

CREATE TABLE ippool (
    id INTEGER PRIMARY KEY,
    group_name TEXT,
    ip TEXT
);

CREATE TABLE users (
    id INTEGER PRIMARY KEY,
    username TEXT,
    password TEXT
);

Populate the tables with your wireless users and their corresponding IP addresses and passwords:

INSERT INTO ippool (id, group_name, ip) VALUES (1, 'wireless_users', '192.168.1.%{User-Name}');

INSERT INTO users (id, username, password) VALUES (1, 'nas_radius_secret_key', 'PW1234');

Exit the SQL database:

.quit

Starting and Testing FreeRADIUS

Start the FreeRADIUS services:

sudo systemctl start freeradius
sudo systemctl enable freeradius

Test the FreeRADIUS configuration by running:

sudo radtest nas_radius_secret_key username PW1234 192.168.1.1 1812 pass

If the test is successful, you should see the message "Welcome to the network!"

Summary

In this guide, we set up FreeRADIUS on Raspberry Pi to authenticate wireless users using local Linux credentials. This configuration allows wireless users to authenticate using their local Linux usernames and passwords, providing a more seamless and secure authentication process.

References

• FreeRADIUS Documentation
• FreeRADIUS on Raspberry Pi
• Setting up FreeRADIUS on Raspberry Pi
• FreeRADIUS SQL Backend