Merge pull request 'Radius inside' (#6) from radius_inside into master

Reviewed-on: #6

README.md

@@ -7,24 +7,21 @@ This project provides a complete **RADIUS Authentication & Accounting Controller
 ## 🏗️ System Architecture
 
 ```
-┌─────────────────┐       UDP 1812/1813       ┌──────────────────┐
-│  UniFi AP /     │ ◄───────────────────────► │    FreeRADIUS    │
-│  Dream Machine  │                           │   (Port 1812/13) │
-└────────┬────────┘                           └────────┬─────────┘
-         │                                             │
-         │ Wi-Fi 802.1X /                             │ SQL Queries
-         │ Guest Auth                                  ▼
-         │                                    ┌──────────────────┐
-         │                                    │    PostgreSQL    │
-         │                                    │  (Radius DB)     │
-         │                                    └────────▲─────────┘
-         │                                             │
-         │ HTTP/8080                                   │ EF Core
-         ▼                                             │
-┌─────────────────┐                                    │
-│ Guests / Admins │ ───────────────────────────────────┘
-│ (Web Portal)    │        RadiusController Web App
-└─────────────────┘
+┌─────────────────┐       UDP 1812/1813 (RADIUS)
+│  UniFi AP /     │ ◄────────────────────────────────┐
+│  Dream Machine  │                                  │
+└─────────────────┘                                  │
+                                                     ▼
+┌─────────────────┐       HTTP 8080 (Web UI)   ┌────────────────────────────────┐
+│ Guests / Admins │ ◄────────────────────────► │ Combined Application Container │
+│ (Browser)       │                            │ (FreeRADIUS + Web Controller)  │
+└─────────────────┘                            └───────────────┬────────────────┘
+                                                               │ PostgreSQL
+                                                               ▼
+                                                       ┌────────────────┐
+                                                       │   PostgreSQL   │
+                                                       │  (Database)    │
+                                                       └────────────────┘
 ```
 
 ---
@@ -51,21 +48,6 @@ services:
       - /mnt/user/appdata/radiuscontroller/pgdata:/var/lib/postgresql/data
       - /mnt/user/appdata/radiuscontroller/sql/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
 
-  freeradius:
-    image: freeradius/freeradius-server:latest
-    container_name: radius_freeradius
-    restart: always
-    depends_on:
-      - postgres
-    ports:
-      - "1812:1812/udp"
-      - "1813:1813/udp"
-    environment:
-      - DB_NAME=radius
-      - DB_HOST=postgres
-      - DB_USER=radius
-      - DB_PASS=radpass
-
   radiuscontroller:
     image: cablon.vanolst.tech/tygozwolle/radius:latest
     container_name: radius_web_controller
@@ -74,9 +56,19 @@ services:
       - postgres
     ports:
       - "8080:8080"
+      - "1812:1812/udp"
+      - "1813:1813/udp"
     environment:
+      - DB_HOST=postgres
+      - DB_PORT=5432
+      - DB_USER=radius
+      - DB_PASS=radpass
+      - DB_NAME=radius
+      - RADIUS_SECRET=radpass
       - ConnectionStrings__DefaultConnection=Host=postgres;Port=5432;Database=radius;Username=radius;Password=radpass;
       - ASPNETCORE_ENVIRONMENT=Production
+    volumes:
+      - /mnt/user/appdata/radiuscontroller/certs:/etc/freeradius/3.0/certs
 ```
 
 2. Start the stack:

docker-compose.yml

@@ -15,21 +15,6 @@ services:
       - /mnt/user/appdata/radiuscontroller/pgdata:/var/lib/postgresql/data
       - /mnt/user/appdata/radiuscontroller/sql/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
 
-  freeradius:
-    image: freeradius/freeradius-server:latest
-    container_name: radius_freeradius
-    restart: always
-    depends_on:
-      - postgres
-    ports:
-      - "1812:1812/udp"
-      - "1813:1813/udp"
-    environment:
-      - DB_NAME=radius
-      - DB_HOST=postgres
-      - DB_USER=radius
-      - DB_PASS=radpass
-
   radiuscontroller:
     image: cablon.vanolst.tech/tygozwolle/radius:latest
     container_name: radius_web_controller
@@ -38,7 +23,16 @@ services:
       - postgres
     ports:
       - "8080:8080"
+      - "1812:1812/udp"
+      - "1813:1813/udp"
     environment:
+      - DB_HOST=postgres
+      - DB_PORT=5432
+      - DB_USER=radius
+      - DB_PASS=radpass
+      - DB_NAME=radius
+      - RADIUS_SECRET=radpass
       - ConnectionStrings__DefaultConnection=Host=postgres;Port=5432;Database=radius;Username=radius;Password=radpass;
       - ASPNETCORE_ENVIRONMENT=Production
-
+    volumes:
+      - /mnt/user/appdata/radiuscontroller/certs:/etc/freeradius/3.0/certs

radiuscontroller/Dockerfile

@@ -1,8 +1,22 @@
-FROM mcr.microsoft.com/dotnet/aspnet:9.0 AS base
-USER $APP_UID
+FROM mcr.microsoft.com/dotnet/aspnet:9.0 AS base
+USER root
+
+# Install FreeRADIUS, PostgreSQL module, and utility packages
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    freeradius \
+    freeradius-postgresql \
+    freeradius-utils \
+    ca-certificates \
+    openssl \
+    && rm -rf /var/lib/apt/lists/*
+
+# Create symlink so both /etc/raddb and /etc/freeradius/3.0 work
+RUN ln -sf /etc/freeradius/3.0 /etc/raddb
+
 WORKDIR /app
 EXPOSE 8080
-EXPOSE 8081
+EXPOSE 1812/udp
+EXPOSE 1813/udp
 
 FROM mcr.microsoft.com/dotnet/sdk:9.0 AS build
 ARG BUILD_CONFIGURATION=Release
@@ -19,5 +33,21 @@ RUN dotnet publish "./radiuscontroller.csproj" -c $BUILD_CONFIGURATION -o /app/p
 
 FROM base AS final
 WORKDIR /app
+
+# Copy pre-configured FreeRADIUS PostgreSQL rules & EAP authentication config
+COPY radiuscontroller/raddb/clients.conf /etc/freeradius/3.0/clients.conf
+COPY radiuscontroller/raddb/mods-enabled/sql /etc/freeradius/3.0/mods-enabled/sql
+COPY radiuscontroller/raddb/mods-enabled/eap /etc/freeradius/3.0/mods-enabled/eap
+COPY radiuscontroller/raddb/sites-enabled/default /etc/freeradius/3.0/sites-enabled/default
+COPY radiuscontroller/raddb/sites-enabled/inner-tunnel /etc/freeradius/3.0/sites-enabled/inner-tunnel
+
+# Add custom dictionary for Max-Octets attribute
+COPY radiuscontroller/raddb/dictionary.custom /etc/freeradius/3.0/dictionary.custom
+RUN echo '$INCLUDE /etc/freeradius/3.0/dictionary.custom' >> /etc/freeradius/3.0/dictionary
+
+# Copy published application and entrypoint script
 COPY --from=publish /app/publish .
-ENTRYPOINT ["dotnet", "radiuscontroller.dll"]
+COPY radiuscontroller/entrypoint.sh /app/entrypoint.sh
+RUN chmod +x /app/entrypoint.sh
+
+ENTRYPOINT ["/app/entrypoint.sh"]

radiuscontroller/entrypoint.sh

@@ -0,0 +1,77 @@
+#!/bin/sh
+set -e
+
+# Default environment variables
+DB_HOST="${DB_HOST:-postgres}"
+DB_PORT="${DB_PORT:-5432}"
+DB_USER="${DB_USER:-radius}"
+DB_PASS="${DB_PASS:-radpass}"
+DB_NAME="${DB_NAME:-radius}"
+RADIUS_SECRET="${RADIUS_SECRET:-radpass}"
+
+echo "================================================="
+echo " Starting RADIUS Controller & FreeRADIUS Stack"
+echo " DB Host: $DB_HOST:$DB_PORT | Database: $DB_NAME"
+echo " RADIUS Secret: $RADIUS_SECRET (Allows all IP addresses)"
+echo "================================================="
+
+# Dynamically update FreeRADIUS SQL configuration with DB settings
+SQL_CONF="/etc/freeradius/3.0/mods-enabled/sql"
+if [ -f "$SQL_CONF" ]; then
+    sed -i "s/server = .*/server = \"$DB_HOST\"/" "$SQL_CONF"
+    sed -i "s/port = .*/port = $DB_PORT/" "$SQL_CONF"
+    sed -i "s/login = .*/login = \"$DB_USER\"/" "$SQL_CONF"
+    sed -i "s/password = .*/password = \"$DB_PASS\"/" "$SQL_CONF"
+    sed -i "s/radius_db = .*/radius_db = \"$DB_NAME\"/" "$SQL_CONF"
+fi
+
+# Dynamically update RADIUS shared secret for all client networks from env
+CLIENTS_CONF="/etc/freeradius/3.0/clients.conf"
+if [ -f "$CLIENTS_CONF" ]; then
+    sed -i "s/secret = .*/secret = $RADIUS_SECRET/" "$CLIENTS_CONF"
+fi
+
+# Generate FreeRADIUS EAP certificates if missing
+CERT_DIR="/etc/freeradius/3.0/certs"
+if [ ! -f "$CERT_DIR/server.pem" ]; then
+    echo "Generating FreeRADIUS EAP certificates..."
+    mkdir -p "$CERT_DIR"
+
+    # Generate CA key and certificate
+    openssl req -new -x509 -keyout "$CERT_DIR/ca.key" -out "$CERT_DIR/ca.pem" \
+        -days 3650 -nodes -subj "/CN=RADIUS CA" 2>/dev/null
+
+    # Generate server key and CSR
+    openssl req -new -keyout "$CERT_DIR/server.key" -out "$CERT_DIR/server.csr" \
+        -nodes -subj "/CN=RADIUS Server" 2>/dev/null
+
+    # Sign the server certificate with the CA
+    openssl x509 -req -in "$CERT_DIR/server.csr" -CA "$CERT_DIR/ca.pem" \
+        -CAkey "$CERT_DIR/ca.key" -CAcreateserial -out "$CERT_DIR/server.crt" \
+        -days 3650 2>/dev/null
+
+    # Combine server key + cert into server.pem
+    cat "$CERT_DIR/server.key" "$CERT_DIR/server.crt" > "$CERT_DIR/server.pem"
+
+    # Generate DH parameters (small size for speed, adequate for internal use)
+    openssl dhparam -out "$CERT_DIR/dh" 1024 2>/dev/null
+
+    # Clean up intermediate files
+    rm -f "$CERT_DIR/server.csr" "$CERT_DIR/server.key" "$CERT_DIR/server.crt" "$CERT_DIR/ca.key" "$CERT_DIR/ca.srl"
+
+    echo "EAP certificates generated successfully."
+fi
+
+# Ensure correct permissions for FreeRADIUS config directory
+chown -R freerad:freerad /etc/freeradius/3.0/ || true
+
+# Start FreeRADIUS daemon in background
+echo "Starting FreeRADIUS service..."
+freeradius -x &
+
+# Wait briefly for FreeRADIUS to initialize
+sleep 2
+
+# Start ASP.NET Core Application
+echo "Starting ASP.NET Core Web Controller..."
+exec dotnet radiuscontroller.dll

radiuscontroller/raddb/clients.conf

@@ -0,0 +1,17 @@
+client localhost {
+	ipaddr = 127.0.0.1
+	secret = radpass
+	shortname = localhost
+}
+
+client local_net {
+	ipaddr = 0.0.0.0/0
+	secret = radpass
+	shortname = all_clients
+}
+
+client local_net_v6 {
+	ipv6addr = ::/0
+	secret = radpass
+	shortname = all_clients_v6
+}

radiuscontroller/raddb/dictionary.custom

@@ -0,0 +1,3 @@
+# Custom RADIUS attributes for Radius Controller
+# Max-Octets: Limits total bytes (upload + download) per session
+ATTRIBUTE	Max-Octets	227	integer

radiuscontroller/raddb/mods-enabled/eap

@@ -0,0 +1,42 @@
+eap {
+	default_eap_type = peap
+	timer_expire = 60
+	ignore_unknown_eap_types = no
+	cisco_accounting_username_bug = no
+	max_sessions = ${max_requests}
+
+	# TLS configuration section named "certs"
+	tls-config certs {
+		private_key_password = whatever
+		private_key_file = ${certdir}/server.pem
+		certificate_file = ${certdir}/server.pem
+		ca_file = ${cadir}/ca.pem
+		dh_file = ${certdir}/dh
+		cipher_list = "DEFAULT@SECLEVEL=1"
+		cipher_server_preference = no
+		tls_min_version = "1.0"
+		tls_max_version = "1.2"
+	}
+
+	# PEAP configuration referencing tls-config certs
+	peap {
+		tls = certs
+		default_eap_type = mschapv2
+		copy_request_to_tunnel = yes
+		use_tunneled_reply = yes
+		virtual_server = "inner-tunnel"
+	}
+
+	# TTLS configuration referencing tls-config certs
+	ttls {
+		tls = certs
+		default_eap_type = mschapv2
+		copy_request_to_tunnel = yes
+		use_tunneled_reply = yes
+		virtual_server = "inner-tunnel"
+	}
+
+	# MSCHAPv2 configuration
+	mschapv2 {
+	}
+}

radiuscontroller/raddb/mods-enabled/sql

@@ -0,0 +1,45 @@
+sql {
+	driver = "rlm_sql_postgresql"
+	dialect = "postgresql"
+
+	server = "postgres"
+	port = 5432
+	login = "radius"
+	password = "radpass"
+	radius_db = "radius"
+
+	# Standard FreeRADIUS SQL Table Mappings
+	authcheck_table = "radcheck"
+	authreply_table = "radreply"
+	groupcheck_table = "radgroupcheck"
+	groupreply_table = "radgroupreply"
+	usergroup_table = "radusergroup"
+
+	# Accounting Table Mappings
+	acct_table1 = "radacct"
+	acct_table2 = "radacct"
+
+	# Post-auth Table Mapping
+	postauth_table = "radpostauth"
+
+	# NAS Client Table Mapping
+	client_table = "nas"
+	read_clients = yes
+
+	group_attribute = "SQL-Group"
+
+	pool {
+		start = 2
+		min = 1
+		max = 10
+		spare = 3
+		uses = 0
+		retry_delay = 30
+		lifetime = 0
+		idle_timeout = 60
+	}
+
+	read_groups = yes
+
+	$INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf
+}

radiuscontroller/raddb/sites-enabled/default

@@ -0,0 +1,78 @@
+server default {
+listen {
+	type = auth
+	ipaddr = *
+	port = 1812
+	limit {
+	      max_connections = 16
+	      lifetime = 0
+	      idle_timeout = 30
+	}
+}
+
+listen {
+	type = acct
+	ipaddr = *
+	port = 1813
+	limit {
+	      max_connections = 16
+	      lifetime = 0
+	      idle_timeout = 30
+	}
+}
+
+authorize {
+	filter_username
+	preprocess
+	sql
+	chap
+	mschap
+	digest
+	pap
+	eap {
+		ok = return
+	}
+	expiration
+	logintime
+}
+
+authenticate {
+	Auth-Type PAP {
+		pap
+	}
+	Auth-Type CHAP {
+		chap
+	}
+	Auth-Type MS-CHAP {
+		mschap
+	}
+	mschap
+	eap
+}
+
+pre-proxy {
+}
+
+post-proxy {
+	eap
+}
+
+accounting {
+	detail
+	sql
+	exec
+}
+
+session {
+	sql
+}
+
+post-auth {
+	sql
+	exec
+	Post-Auth-Type REJECT {
+		sql
+		attr_filter.access_reject
+	}
+}
+}

radiuscontroller/raddb/sites-enabled/inner-tunnel

@@ -0,0 +1,36 @@
+server inner-tunnel {
+authorize {
+	filter_username
+	sql
+	chap
+	mschap
+	pap
+	eap {
+		ok = return
+	}
+	expiration
+	logintime
+}
+
+authenticate {
+	Auth-Type PAP {
+		pap
+	}
+	Auth-Type CHAP {
+		chap
+	}
+	Auth-Type MS-CHAP {
+		mschap
+	}
+	mschap
+	eap
+}
+
+post-auth {
+	sql
+	Post-Auth-Type REJECT {
+		sql
+		attr_filter.access_reject
+	}
+}
+}

sql/init.sql

@@ -86,6 +86,15 @@ CREATE TABLE IF NOT EXISTS nas (
     description VARCHAR(200) DEFAULT 'RADIUS Client'
 );
 
+CREATE TABLE IF NOT EXISTS radpostauth (
+    id BIGSERIAL PRIMARY KEY,
+    username VARCHAR(64) NOT NULL DEFAULT '',
+    pass VARCHAR(64) NOT NULL DEFAULT '',
+    reply VARCHAR(32) NOT NULL DEFAULT '',
+    authdate TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS radpostauth_username ON radpostauth (username);
+
 -- Application Management Tables
 CREATE TABLE IF NOT EXISTS guest_profiles (
     id SERIAL PRIMARY KEY,