FreeRADIUS on Ubuntu 24.04 LTS
by cloudimg
FreeRADIUS on Ubuntu 24.04, RADIUS AAA for Wi-Fi, VPN and 802.1X, per-VM secret, no testing123
FreeRADIUS is the most widely deployed RADIUS server in the world and the basis of many commercial RADIUS products. It provides centralised authentication, authorisation and accounting, known as AAA, for network access: Wi-Fi access points, VPN concentrators, 802.1X switches, captive portals and network access servers all ask FreeRADIUS whether a user may connect and record how long they were connected. This cloudimg image runs FreeRADIUS 3.2 from the official Ubuntu 24.04 apt archive, under systemd as the dedicated non root freerad service user.
The server answers RADIUS authentication on UDP port 1812 and accounting on UDP port 1813 across all interfaces. Network access servers connect as RADIUS clients, each identified by an IP address and a shared secret, and users are checked against a backend. This image uses the standalone files backend, a simple flat user file, so you add users and clients with a text editor and reload, with no database to run. From there you can grow into LDAP or SQL backends, EAP methods for 802.1X and enterprise Wi-Fi, and per user reply attributes such as VLAN assignment. There is no web console in this image.
Security is built in. The stock FreeRADIUS package ships a well known client shared secret, testing123, and a demonstration user. Neither ships in this image. On the first boot of every VM a unique random shared secret is generated for the built in local client and a unique sample user and password are generated for that specific instance, then written to a root owned credentials file, while the testing123 secret is removed from the entire configuration. No two instances share a credential and no known credential is ever baked into the image.
FreeRADIUS is distributed under the GNU GPL v2, free and open source with no per CPU or per deployment fee. cloudimg is not affiliated with or endorsed by the FreeRADIUS project; FreeRADIUS is a mark of its owner. cloudimg provides packaging, systemd hardening, per instance credential automation, security patching, and 24/7 support with a guaranteed 24 hour response SLA.