Radius inside #6

Merged
tygozwolle merged 11 commits from radius_inside into master 2026-07-24 15:46:57 +02:00
11 changed files with 376 additions and 53 deletions
+25 -33
View File
@@ -7,24 +7,21 @@ This project provides a complete **RADIUS Authentication & Accounting Controller
## 🏗️ System Architecture ## 🏗️ System Architecture
``` ```
┌─────────────────┐ UDP 1812/1813 ┌──────────────────┐ ┌─────────────────┐ UDP 1812/1813 (RADIUS)
│ UniFi AP / │ ◄───────────────────────► │ FreeRADIUS │ │ UniFi AP / │ ◄────────────────────────────────┐
│ Dream Machine │ (Port 1812/13) │ Dream Machine │
└────────────────┘ └────────┬─────────┘ └────────────────┘
│ │
│ Wi-Fi 802.1X / │ SQL Queries ┌─────────────────┐ HTTP 8080 (Web UI) ┌────────────────────────────────┐
│ Guest Auth ▼ │ Guests / Admins │ ◄────────────────────────► │ Combined Application Container │
┌──────────────────┐ │ (Browser)│ (FreeRADIUS + Web Controller) │
│ │ PostgreSQL │ └─────────────────┘ └───────────────┬────────────────┘
(Radius DB) │ PostgreSQL
│ └────────▲─────────┘
│ │ ┌────────────────┐
│ HTTP/8080EF Core PostgreSQL │
│ (Database)
┌─────────────────┐ │ └────────────────┘
│ Guests / Admins │ ───────────────────────────────────┘
│ (Web Portal) │ RadiusController Web App
└─────────────────┘
``` ```
--- ---
@@ -51,21 +48,6 @@ services:
- /mnt/user/appdata/radiuscontroller/pgdata:/var/lib/postgresql/data - /mnt/user/appdata/radiuscontroller/pgdata:/var/lib/postgresql/data
- /mnt/user/appdata/radiuscontroller/sql/init.sql:/docker-entrypoint-initdb.d/init.sql:ro - /mnt/user/appdata/radiuscontroller/sql/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
freeradius:
image: freeradius/freeradius-server:latest
container_name: radius_freeradius
restart: always
depends_on:
- postgres
ports:
- "1812:1812/udp"
- "1813:1813/udp"
environment:
- DB_NAME=radius
- DB_HOST=postgres
- DB_USER=radius
- DB_PASS=radpass
radiuscontroller: radiuscontroller:
image: cablon.vanolst.tech/tygozwolle/radius:latest image: cablon.vanolst.tech/tygozwolle/radius:latest
container_name: radius_web_controller container_name: radius_web_controller
@@ -74,9 +56,19 @@ services:
- postgres - postgres
ports: ports:
- "8080:8080" - "8080:8080"
- "1812:1812/udp"
- "1813:1813/udp"
environment: environment:
- DB_HOST=postgres
- DB_PORT=5432
- DB_USER=radius
- DB_PASS=radpass
- DB_NAME=radius
- RADIUS_SECRET=radpass
- ConnectionStrings__DefaultConnection=Host=postgres;Port=5432;Database=radius;Username=radius;Password=radpass; - ConnectionStrings__DefaultConnection=Host=postgres;Port=5432;Database=radius;Username=radius;Password=radpass;
- ASPNETCORE_ENVIRONMENT=Production - ASPNETCORE_ENVIRONMENT=Production
volumes:
- /mnt/user/appdata/radiuscontroller/certs:/etc/freeradius/3.0/certs
``` ```
2. Start the stack: 2. Start the stack:
+10 -16
View File
@@ -15,21 +15,6 @@ services:
- /mnt/user/appdata/radiuscontroller/pgdata:/var/lib/postgresql/data - /mnt/user/appdata/radiuscontroller/pgdata:/var/lib/postgresql/data
- /mnt/user/appdata/radiuscontroller/sql/init.sql:/docker-entrypoint-initdb.d/init.sql:ro - /mnt/user/appdata/radiuscontroller/sql/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
freeradius:
image: freeradius/freeradius-server:latest
container_name: radius_freeradius
restart: always
depends_on:
- postgres
ports:
- "1812:1812/udp"
- "1813:1813/udp"
environment:
- DB_NAME=radius
- DB_HOST=postgres
- DB_USER=radius
- DB_PASS=radpass
radiuscontroller: radiuscontroller:
image: cablon.vanolst.tech/tygozwolle/radius:latest image: cablon.vanolst.tech/tygozwolle/radius:latest
container_name: radius_web_controller container_name: radius_web_controller
@@ -38,7 +23,16 @@ services:
- postgres - postgres
ports: ports:
- "8080:8080" - "8080:8080"
- "1812:1812/udp"
- "1813:1813/udp"
environment: environment:
- DB_HOST=postgres
- DB_PORT=5432
- DB_USER=radius
- DB_PASS=radpass
- DB_NAME=radius
- RADIUS_SECRET=radpass
- ConnectionStrings__DefaultConnection=Host=postgres;Port=5432;Database=radius;Username=radius;Password=radpass; - ConnectionStrings__DefaultConnection=Host=postgres;Port=5432;Database=radius;Username=radius;Password=radpass;
- ASPNETCORE_ENVIRONMENT=Production - ASPNETCORE_ENVIRONMENT=Production
volumes:
- /mnt/user/appdata/radiuscontroller/certs:/etc/freeradius/3.0/certs
+34 -4
View File
@@ -1,8 +1,22 @@
FROM mcr.microsoft.com/dotnet/aspnet:9.0 AS base FROM mcr.microsoft.com/dotnet/aspnet:9.0 AS base
USER $APP_UID USER root
# Install FreeRADIUS, PostgreSQL module, and utility packages
RUN apt-get update && apt-get install -y --no-install-recommends \
freeradius \
freeradius-postgresql \
freeradius-utils \
ca-certificates \
openssl \
&& rm -rf /var/lib/apt/lists/*
# Create symlink so both /etc/raddb and /etc/freeradius/3.0 work
RUN ln -sf /etc/freeradius/3.0 /etc/raddb
WORKDIR /app WORKDIR /app
EXPOSE 8080 EXPOSE 8080
EXPOSE 8081 EXPOSE 1812/udp
EXPOSE 1813/udp
FROM mcr.microsoft.com/dotnet/sdk:9.0 AS build FROM mcr.microsoft.com/dotnet/sdk:9.0 AS build
ARG BUILD_CONFIGURATION=Release ARG BUILD_CONFIGURATION=Release
@@ -19,5 +33,21 @@ RUN dotnet publish "./radiuscontroller.csproj" -c $BUILD_CONFIGURATION -o /app/p
FROM base AS final FROM base AS final
WORKDIR /app WORKDIR /app
# Copy pre-configured FreeRADIUS PostgreSQL rules & EAP authentication config
COPY radiuscontroller/raddb/clients.conf /etc/freeradius/3.0/clients.conf
COPY radiuscontroller/raddb/mods-enabled/sql /etc/freeradius/3.0/mods-enabled/sql
COPY radiuscontroller/raddb/mods-enabled/eap /etc/freeradius/3.0/mods-enabled/eap
COPY radiuscontroller/raddb/sites-enabled/default /etc/freeradius/3.0/sites-enabled/default
COPY radiuscontroller/raddb/sites-enabled/inner-tunnel /etc/freeradius/3.0/sites-enabled/inner-tunnel
# Add custom dictionary for Max-Octets attribute
COPY radiuscontroller/raddb/dictionary.custom /etc/freeradius/3.0/dictionary.custom
RUN echo '$INCLUDE /etc/freeradius/3.0/dictionary.custom' >> /etc/freeradius/3.0/dictionary
# Copy published application and entrypoint script
COPY --from=publish /app/publish . COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "radiuscontroller.dll"] COPY radiuscontroller/entrypoint.sh /app/entrypoint.sh
RUN chmod +x /app/entrypoint.sh
ENTRYPOINT ["/app/entrypoint.sh"]
+77
View File
@@ -0,0 +1,77 @@
#!/bin/sh
set -e
# Default environment variables
DB_HOST="${DB_HOST:-postgres}"
DB_PORT="${DB_PORT:-5432}"
DB_USER="${DB_USER:-radius}"
DB_PASS="${DB_PASS:-radpass}"
DB_NAME="${DB_NAME:-radius}"
RADIUS_SECRET="${RADIUS_SECRET:-radpass}"
echo "================================================="
echo " Starting RADIUS Controller & FreeRADIUS Stack"
echo " DB Host: $DB_HOST:$DB_PORT | Database: $DB_NAME"
echo " RADIUS Secret: $RADIUS_SECRET (Allows all IP addresses)"
echo "================================================="
# Dynamically update FreeRADIUS SQL configuration with DB settings
SQL_CONF="/etc/freeradius/3.0/mods-enabled/sql"
if [ -f "$SQL_CONF" ]; then
sed -i "s/server = .*/server = \"$DB_HOST\"/" "$SQL_CONF"
sed -i "s/port = .*/port = $DB_PORT/" "$SQL_CONF"
sed -i "s/login = .*/login = \"$DB_USER\"/" "$SQL_CONF"
sed -i "s/password = .*/password = \"$DB_PASS\"/" "$SQL_CONF"
sed -i "s/radius_db = .*/radius_db = \"$DB_NAME\"/" "$SQL_CONF"
fi
# Dynamically update RADIUS shared secret for all client networks from env
CLIENTS_CONF="/etc/freeradius/3.0/clients.conf"
if [ -f "$CLIENTS_CONF" ]; then
sed -i "s/secret = .*/secret = $RADIUS_SECRET/" "$CLIENTS_CONF"
fi
# Generate FreeRADIUS EAP certificates if missing
CERT_DIR="/etc/freeradius/3.0/certs"
if [ ! -f "$CERT_DIR/server.pem" ]; then
echo "Generating FreeRADIUS EAP certificates..."
mkdir -p "$CERT_DIR"
# Generate CA key and certificate
openssl req -new -x509 -keyout "$CERT_DIR/ca.key" -out "$CERT_DIR/ca.pem" \
-days 3650 -nodes -subj "/CN=RADIUS CA" 2>/dev/null
# Generate server key and CSR
openssl req -new -keyout "$CERT_DIR/server.key" -out "$CERT_DIR/server.csr" \
-nodes -subj "/CN=RADIUS Server" 2>/dev/null
# Sign the server certificate with the CA
openssl x509 -req -in "$CERT_DIR/server.csr" -CA "$CERT_DIR/ca.pem" \
-CAkey "$CERT_DIR/ca.key" -CAcreateserial -out "$CERT_DIR/server.crt" \
-days 3650 2>/dev/null
# Combine server key + cert into server.pem
cat "$CERT_DIR/server.key" "$CERT_DIR/server.crt" > "$CERT_DIR/server.pem"
# Generate DH parameters (small size for speed, adequate for internal use)
openssl dhparam -out "$CERT_DIR/dh" 1024 2>/dev/null
# Clean up intermediate files
rm -f "$CERT_DIR/server.csr" "$CERT_DIR/server.key" "$CERT_DIR/server.crt" "$CERT_DIR/ca.key" "$CERT_DIR/ca.srl"
echo "EAP certificates generated successfully."
fi
# Ensure correct permissions for FreeRADIUS config directory
chown -R freerad:freerad /etc/freeradius/3.0/ || true
# Start FreeRADIUS daemon in background
echo "Starting FreeRADIUS service..."
freeradius -x &
# Wait briefly for FreeRADIUS to initialize
sleep 2
# Start ASP.NET Core Application
echo "Starting ASP.NET Core Web Controller..."
exec dotnet radiuscontroller.dll
+17
View File
@@ -0,0 +1,17 @@
client localhost {
ipaddr = 127.0.0.1
secret = radpass
shortname = localhost
}
client local_net {
ipaddr = 0.0.0.0/0
secret = radpass
shortname = all_clients
}
client local_net_v6 {
ipv6addr = ::/0
secret = radpass
shortname = all_clients_v6
}
+3
View File
@@ -0,0 +1,3 @@
# Custom RADIUS attributes for Radius Controller
# Max-Octets: Limits total bytes (upload + download) per session
ATTRIBUTE Max-Octets 227 integer
+42
View File
@@ -0,0 +1,42 @@
eap {
default_eap_type = peap
timer_expire = 60
ignore_unknown_eap_types = no
cisco_accounting_username_bug = no
max_sessions = ${max_requests}
# TLS configuration section named "certs"
tls-config certs {
private_key_password = whatever
private_key_file = ${certdir}/server.pem
certificate_file = ${certdir}/server.pem
ca_file = ${cadir}/ca.pem
dh_file = ${certdir}/dh
cipher_list = "DEFAULT@SECLEVEL=1"
cipher_server_preference = no
tls_min_version = "1.0"
tls_max_version = "1.2"
}
# PEAP configuration referencing tls-config certs
peap {
tls = certs
default_eap_type = mschapv2
copy_request_to_tunnel = yes
use_tunneled_reply = yes
virtual_server = "inner-tunnel"
}
# TTLS configuration referencing tls-config certs
ttls {
tls = certs
default_eap_type = mschapv2
copy_request_to_tunnel = yes
use_tunneled_reply = yes
virtual_server = "inner-tunnel"
}
# MSCHAPv2 configuration
mschapv2 {
}
}
+45
View File
@@ -0,0 +1,45 @@
sql {
driver = "rlm_sql_postgresql"
dialect = "postgresql"
server = "postgres"
port = 5432
login = "radius"
password = "radpass"
radius_db = "radius"
# Standard FreeRADIUS SQL Table Mappings
authcheck_table = "radcheck"
authreply_table = "radreply"
groupcheck_table = "radgroupcheck"
groupreply_table = "radgroupreply"
usergroup_table = "radusergroup"
# Accounting Table Mappings
acct_table1 = "radacct"
acct_table2 = "radacct"
# Post-auth Table Mapping
postauth_table = "radpostauth"
# NAS Client Table Mapping
client_table = "nas"
read_clients = yes
group_attribute = "SQL-Group"
pool {
start = 2
min = 1
max = 10
spare = 3
uses = 0
retry_delay = 30
lifetime = 0
idle_timeout = 60
}
read_groups = yes
$INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf
}
@@ -0,0 +1,78 @@
server default {
listen {
type = auth
ipaddr = *
port = 1812
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
listen {
type = acct
ipaddr = *
port = 1813
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
authorize {
filter_username
preprocess
sql
chap
mschap
digest
pap
eap {
ok = return
}
expiration
logintime
}
authenticate {
Auth-Type PAP {
pap
}
Auth-Type CHAP {
chap
}
Auth-Type MS-CHAP {
mschap
}
mschap
eap
}
pre-proxy {
}
post-proxy {
eap
}
accounting {
detail
sql
exec
}
session {
sql
}
post-auth {
sql
exec
Post-Auth-Type REJECT {
sql
attr_filter.access_reject
}
}
}
@@ -0,0 +1,36 @@
server inner-tunnel {
authorize {
filter_username
sql
chap
mschap
pap
eap {
ok = return
}
expiration
logintime
}
authenticate {
Auth-Type PAP {
pap
}
Auth-Type CHAP {
chap
}
Auth-Type MS-CHAP {
mschap
}
mschap
eap
}
post-auth {
sql
Post-Auth-Type REJECT {
sql
attr_filter.access_reject
}
}
}
+9
View File
@@ -86,6 +86,15 @@ CREATE TABLE IF NOT EXISTS nas (
description VARCHAR(200) DEFAULT 'RADIUS Client' description VARCHAR(200) DEFAULT 'RADIUS Client'
); );
CREATE TABLE IF NOT EXISTS radpostauth (
id BIGSERIAL PRIMARY KEY,
username VARCHAR(64) NOT NULL DEFAULT '',
pass VARCHAR(64) NOT NULL DEFAULT '',
reply VARCHAR(32) NOT NULL DEFAULT '',
authdate TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP
);
CREATE INDEX IF NOT EXISTS radpostauth_username ON radpostauth (username);
-- Application Management Tables -- Application Management Tables
CREATE TABLE IF NOT EXISTS guest_profiles ( CREATE TABLE IF NOT EXISTS guest_profiles (
id SERIAL PRIMARY KEY, id SERIAL PRIMARY KEY,