RADIUS Protocol: Network Access Control 2026

# Privilege level authorization
Cisco-AVPair = "shell:priv-lvl=15"

# Download ACL
Cisco-AVPair = "ip:inacl#1=permit tcp any any eq 80"
Cisco-AVPair = "ip:inacl#2=deny ip any any"

# VLAN assignment
Cisco-AVPair = "tunnel-private-group-id=100"

# URL redirect (for web auth)
Cisco-AVPair = "url-redirect=https://captive.example.com"
Cisco-AVPair = "url-redirect-acl=redirect-acl"

# Static IP assignment
Juniper-Framed-IP-Pool = "pool-name"

# Routing instance
Juniper-Local-Routing-Instance = "customer-a"

# CoS parameters  
Juniper-Juniper-Service-Name = "qos-profile"

# FreeRADIUS EAP-TLS configuration
# /etc/freeradius/3.0/mods-enabled/eap
eap {
    default_eap_type = tls
    timer_expire = 60
    ignore_unknown_eap_types = no
    cisco_accounting_username_bug = no
    max_sessions = 4096

    tls {
        certdir = /etc/freeradius/3.0/certs
        private_key_password = 
        private_key_file = ${certdir}/server.key
        certificate_file = ${certdir}/server.pem
        ca_file = ${certdir}/ca.pem
        dh_file = ${certdir}/dh
        random_file = /dev/urandom
        fragment_size = 1024
        include_length = yes
        check_crl = yes
        cipher_list = "HIGH:+3DES"
        cipher_server_preference = no
        ecdh_curve = "prime256v1"
        cache {
            enable = yes
            lifetime = 3600
            max_entries = 255
        }
        verify {
            # Require client certificate
            require_cert = yes
        }
        ocsp {
            enable = yes
            override_cert_url = no
            ocsp_default_url = "http://ocsp.example.com"
            softfail = no
        }
    }
}

# FreeRADIUS PEAP configuration
eap {
    default_eap_type = peap

    peap {
        default_eap_type = mschapv2
        copy_request_to_tunnel = no
        use_tunneled_reply = no
        proxy_tunneled_request_as_eap = yes
        virtual_server = "inner-tunnel"
        
        tls {
            # Same TLS config as EAP-TLS
            certdir = /etc/freeradius/3.0/certs
            private_key_file = ${certdir}/server.key
            certificate_file = ${certdir}/server.pem
            ca_file = ${certdir}/ca.pem
        }
    }
}

eap {
    default_eap_type = ttls

    ttls {
        default_eap_type = mschapv2
        copy_request_to_tunnel = no
        use_tunneled_reply = no
        virtual_server = "inner-tunnel"
        
        tls {
            certdir = /etc/freeradius/3.0/certs
            private_key_file = ${certdir}/server.key
            certificate_file = ${certdir}/server.pem
            ca_file = ${certdir}/ca.pem
        }
    }
}

# Ubuntu/Debian
sudo apt install freeradius freeradius-ldap freeradius-mysql

# RHEL/Fedora
sudo dnf install freeradius freeradius-ldap freeradius-mysql

# Verify installation
sudo radiusd -X  # Debug mode (foreground)

# /etc/freeradius/3.0/clients.conf
client wifi-controller {
    ipaddr = 10.0.10.0/24
    secret = secure-shared-secret-here
    shortname = wifi-controller
    require_message_authenticator = yes
    nas_type = cisco
}

client vpn-gateway {
    ipaddr = 10.0.20.5
    secret = another-secret
    shortname = vpn-gw
    nas_type = other
}

# Default client (last resort)
client localhost {
    ipaddr = 127.0.0.1
    secret = testing123  # CHANGE FOR PRODUCTION
    require_message_authenticator = no
}

# /etc/freeradius/3.0/mods-enabled/ldap
ldap {
    server = 'dc01.example.com'
    port = 389
    identity = 'cn=radius,cn=Users,dc=example,dc=com'
    password = 'service-account-password'
    base_dn = 'dc=example,dc=com'
    
    # Active Directory specific
    user {
        base_dn = 'cn=Users,dc=example,dc=com'
        filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})"
        scope = 'sub'
    }
    
    group {
        base_dn = 'cn=Users,dc=example,dc=com'
        filter = '(objectClass=group)'
        membership_attribute = 'memberOf'
    }
    
    # TLS
    start_tls = yes
    tls_cacertfile = /etc/ssl/certs/ca.pem
    tls_certfile = /etc/ssl/certs/server.pem
    tls_keyfile = /etc/ssl/private/server.key
}

# /etc/freeradius/3.0/mods-enabled/sql
sql {
    driver = "rlm_sql_mysql"
    dialect = "mysql"
    
    server = "localhost"
    port = 3306
    login = "radius"
    password = "db-password"
    
    radius_db = "radius"
    acct_table1 = "radacct"
    authcheck_table = "radcheck"
    authreply_table = "radreply"
    groupcheck_table = "radgroupcheck"
    groupreply_table = "radgroupreply"
    usergroup_table = "radusergroup"
}

CREATE DATABASE radius;
GRANT ALL ON radius.* TO 'radius'@'localhost' IDENTIFIED BY 'db-password';

USE radius;

CREATE TABLE radcheck (
    id int(11) NOT NULL AUTO_INCREMENT,
    username varchar(64) NOT NULL,
    attribute varchar(64) NOT NULL,
    op char(2) NOT NULL DEFAULT '==',
    value varchar(253) NOT NULL,
    PRIMARY KEY (id)
);

CREATE TABLE radreply (
    id int(11) NOT NULL AUTO_INCREMENT,
    username varchar(64) NOT NULL,
    attribute varchar(64) NOT NULL,
    op char(2) NOT NULL DEFAULT '=',
    value varchar(253) NOT NULL,
    PRIMARY KEY (id)
);

CREATE TABLE radacct (
    radacctid bigint(20) NOT NULL AUTO_INCREMENT,
    acctsessionid varchar(64) NOT NULL,
    username varchar(64) NOT NULL,
    nasipaddress varchar(15) NOT NULL,
    acctstarttime datetime DEFAULT NULL,
    acctstoptime datetime DEFAULT NULL,
    acctinputoctets bigint(20) DEFAULT NULL,
    acctoutputoctets bigint(20) DEFAULT NULL,
    PRIMARY KEY (radacctid)
);

# Add users
INSERT INTO radcheck (username, attribute, op, value) 
VALUES ('john', 'Cleartext-Password', ':=', 'password123');

# Add authorization attributes
INSERT INTO radreply (username, attribute, op, value)
VALUES ('john', 'Framed-IP-Address', '=', '10.10.10.100'),
       ('john', 'Session-Timeout', '=', '28800');

# /etc/freeradius/3.0/proxy.conf
realm example.com {
    type = radius
    authhost = radius.example.com:1812
    accthost = radius.example.com:1813
    secret = inter-realm-secret
}

realm local {
    type = radius
    authhost = localhost:18120
    accthost = localhost:18130
    secret = local-secret
}

# Default realm
realm NULL {
    type = radius
    authhost = localhost:1812
    accthost = localhost:1813
    secret = testing123
}

server default {
    listen {
        type = auth
        ipaddr = *
        port = 0
    }
    
    listen {
        type = acct
        ipaddr = *
        port = 0
    }
    
    authorize {
        preprocess
        chap
        mschap
        suffix
        eap {
            ok = return
        }
        files
        sql
        ldap
        expiration
        logintime
        pap
    }
    
    authenticate {
        Auth-Type PAP {
            pap
        }
        Auth-Type CHAP {
            chap
        }
        Auth-Type MS-CHAP {
            mschap
        }
        eap
    }
    
    preacct {
        preprocess
        acct_unique
        suffix
        files
    }
    
    accounting {
        detail
        sql
        exec
        attr_filter.accounting_response
    }
    
    session {
        radutmp
        sql
    }
    
    post-auth {
        Post-Auth-Type REJECT {
            attr_filter.access_reject
        }
    }
}

# For any user matching a specific group
# /etc/freeradius/3.0/mods-config/sql/main/mysql/queries.conf
groupreply {
    Tunnel-Type = "VLAN"
    Tunnel-Medium-Type = "IEEE-802"
    Tunnel-Private-Group-ID = "100"
}

INSERT INTO radreply (username, attribute, op, value)
VALUES ('john', 'Tunnel-Type', '=', '13'),
       ('john', 'Tunnel-Medium-Type', '=', '6'),
       ('john', 'Tunnel-Private-Group-ID', '=', '100');

# Initiate a disconnect from the RADIUS server
# Using radclient (FreeRADIUS)
echo "User-Name = john, Acct-Session-Id = \"12345678\"" | \
    radclient -r 1 -t 3 10.0.10.5:3799 disconnect shared-secret

# Change authorization (apply new VLAN)
echo "User-Name = john, Tunnel-Private-Group-ID = \"200\"" | \
    radclient -r 1 -t 3 10.0.10.5:3799 coa shared-secret

pip install pyrad

#!/usr/bin/env python3
"""RADIUS authentication and accounting client using pyrad."""

import pyrad.packet
from pyrad.client import Client, Timeout
from pyrad.dictionary import Dictionary
import socket
import sys


class RadiusClient:
    def __init__(self, server, secret, auth_port=1812, acct_port=1813,
                 timeout=5, retries=3):
        self.client = Client(
            server=server,
            secret=secret.encode(),
            dict=Dictionary("dictionary"),
            auth_port=auth_port,
            acct_port=acct_port,
            timeout=timeout,
            retries=retries,
        )

    def authenticate(self, username, password, nas_ip=None,
                     nas_identifier="NAS-01", service_type=1,
                     nas_port_type=5):
        """Authenticate a user. Returns (success, reply_attributes)."""
        req = self.client.CreateAuthPacket(
            code=pyrad.packet.AccessRequest,
            User_Name=username,
            NAS_Identifier=nas_identifier,
            Service_Type=service_type,
            NAS_Port_Type=nas_port_type,
        )
        req["User-Password"] = req.PwCrypt(password)
        req["NAS-IP-Address"] = nas_ip or socket.gethostbyname(
            socket.gethostname()
        )

        try:
            reply = self.client.SendPacket(req)
        except Timeout:
            return False, {"error": "RADIUS server timeout"}
        except pyrad.client.ServerPacketError as e:
            return False, {"error": str(e)}

        if reply.code == pyrad.packet.AccessAccept:
            attrs = self._parse_reply(reply)
            return True, attrs
        elif reply.code == pyrad.packet.AccessReject:
            return False, {"error": "Access denied"}
        elif reply.code == pyrad.packet.AccessChallenge:
            return False, {"error": "Challenge required", "eap": True}
        return False, {"error": f"Unexpected code: {reply.code}"}

    def accounting_start(self, username, session_id, nas_ip=None,
                         nas_identifier="NAS-01"):
        """Send accounting start packet."""
        req = self.client.CreateAcctPacket(
            code=pyrad.packet.AccountingRequest,
            User_Name=username,
            NAS_Identifier=nas_identifier,
            Acct_Status_Type=1,  # Start
            Acct_Session_Id=session_id,
        )
        req["NAS-IP-Address"] = nas_ip or socket.gethostbyname(
            socket.gethostname()
        )
        try:
            reply = self.client.SendPacket(req)
            return reply.code == pyrad.packet.AccountingResponse
        except Timeout:
            return False

    def accounting_stop(self, username, session_id, session_time=0,
                        input_octets=0, output_octets=0,
                        terminate_cause=1):
        """Send accounting stop packet."""
        req = self.client.CreateAcctPacket(
            code=pyrad.packet.AccountingRequest,
            User_Name=username,
            Acct_Status_Type=2,  # Stop
            Acct_Session_Id=session_id,
            Acct_Session_Time=session_time,
            Acct_Input_Octets=input_octets,
            Acct_Output_Octets=output_octets,
            Acct_Terminate_Cause=terminate_cause,
        )
        try:
            reply = self.client.SendPacket(req)
            return reply.code == pyrad.packet.AccountingResponse
        except Timeout:
            return False

    def _parse_reply(self, reply):
        """Convert RADIUS reply attributes to a dict."""
        attrs = {}
        for attr in reply.keys():
            try:
                val = reply[attr]
                if isinstance(val, list):
                    val = [str(v) for v in val]
                else:
                    val = str(val)
                attrs[attr] = val
            except Exception:
                continue
        return attrs


if __name__ == "__main__":
    client = RadiusClient(
        server="127.0.0.1",
        secret="testing123",
    )

    success, result = client.authenticate("john", "password123")
    if success:
        print(f"Authenticated: {result}")
    else:
        print(f"Failed: {result}")
        sys.exit(1)

# Typical accounting packet
Acct-Status-Type = Interim-Update (3)
Acct-Session-Id = "550E8400-E29B-41D4-A716-446655440000"
Acct-Input-Octets = 1048576
Acct-Output-Octets = 2097152
Acct-Input-Packets = 15000
Acct-Output-Packets = 25000
Acct-Session-Time = 3600
Acct-Input-Gigawords = 0
Acct-Output-Gigawords = 0
NAS-IP-Address = 10.0.10.5
NAS-Identifier = "wifi-controller-01"
User-Name = "john"

-- Get total data usage per user (last 30 days)
SELECT username,
       SUM(acctinputoctets + acctoutputoctets) AS total_bytes,
       ROUND(SUM(acctinputoctets + acctoutputoctets) / 1073741824, 2) AS total_gb,
       COUNT(*) AS sessions,
       ROUND(SUM(acctsessiontime) / 3600, 1) AS total_hours
FROM radacct
WHERE acctstarttime >= NOW() - INTERVAL 30 DAY
GROUP BY username
ORDER BY total_bytes DESC;

-- Active sessions right now
SELECT username, nasipaddress, acctstarttime, acctinputoctets, acctoutputoctets
FROM radacct
WHERE acctstoptime IS NULL;

-- Peak concurrent usage by hour
SELECT DATE_FORMAT(acctstarttime, '%Y-%m-%d %H:00:00') AS hour_slot,
       COUNT(*) AS concurrent
FROM radacct
WHERE acctstarttime >= NOW() - INTERVAL 7 DAY
GROUP BY hour_slot
ORDER BY concurrent DESC
LIMIT 10;

# /etc/freeradius/3.0/sites-enabled/tls
listen {
    type = auth
    proto = tcp
    tls {
        certdir = /etc/freeradius/3.0/certs
        private_key_file = ${certdir}/server.key
        certificate_file = ${certdir}/server.pem
        ca_file = ${certdir}/ca.pem
    }
}

# RadSec client
client radsec-peer {
    ipaddr = 10.0.30.0/24
    proto = tls
    secret =  # Not needed when using TLS client certs
    shortname = radsec-peer
}

# Stop the service, run in foreground debug
sudo systemctl stop freeradius
sudo radiusd -X

# Check firewall
sudo iptables -L -n | grep 1812
sudo ufw status

# Verify client is configured
grep -A5 "client wifi" /etc/freeradius/3.0/clients.conf

# Test packet reachability
radtest john password123 127.0.0.1 0 testing123

# Common causes:
# 1. Certificate issues — check expiration
openssl x509 -in /etc/freeradius/3.0/certs/server.pem -text -noout

# 2. Wrong EAP type — ensure client and server agree
# 3. Inner method mismatch — PEAP expects MSCHAPv2 inside
# 4. TLS version mismatch — configure ciphers
tail -f /var/log/freeradius/radius.log | grep -i "eap\|tls\|ssl"

# Check if accounting is enabled in the NAS
# Verify SQL connection
sudo radiusd -X | grep sql

# Test accounting
radacct -d /etc/freeradius/3.0/ -n 1

# FreeRADIUS debug output:
# "Ignoring request to authentication port"
# "Request from unknown client IP"

# Fix: verify secret in clients.conf matches NAS config
# Always restart after changing secrets

# Configure EAP fragment size
eap {
    tls {
        fragment_size = 1024  # Max fragment size
        include_length = yes  # Include total length
    }
}

# Check RADIUS server status
sudo systemctl status freeradius
sudo radiusd -C  # Configuration check

# View live authentication attempts
sudo tail -f /var/log/freeradius/radius.log

# Count recent authentications
grep -c "Login OK" /var/log/freeradius/radius.log
grep -c "Login incorrect" /var/log/freeradius/radius.log

# Check active sessions
sudo radwho

# Verify packet counters
sudo radiusd -C -l stdout

# /etc/freeradius/3.0/radiusd.conf
thread_pool {
    start_servers = 5
    max_servers = 32
    min_spare_servers = 3
    max_spare_servers = 10
    max_requests_per_server = 0
    autoscale = yes
}

# Increase UDP buffer sizes
# /etc/sysctl.d/99-radius.conf
net.core.rmem_max = 16777216
net.core.rmem_default = 1048576
net.core.wmem_max = 16777216
net.core.wmem_default = 1048576

# Install radclient for benchmarking
# Test authentication throughput
time seq 1 1000 | parallel -j 10 \
    'echo "User-Name = test{}-password:testing123" | \
     radclient -r 1 -t 2 127.0.0.1:1812 auth testing123'

# Monitor server performance
sudo radiusd -C -l stdout | grep -e "requests" -e "average"