Setting Up FreeRADIUS with PAP & PostgreSQL (Development Environment)

• Save the content for Dockerfile, docker-compose.yml, and init-db.sh into files with those exact names.

Run the following command:

chmod +x init-db.sh

Get the PostgreSQL schema file:

curl -o schema.sql https://raw.githubusercontent.com/FreeRADIUS/freeradius-server/v3.2.x/raddb/mods-config/sql/main/postgresql/schema.sql

IMPORTANT: Edit docker-compose.yml and replace BOTH instances of your_secure_password with a strong, unique password.

mkdir ./raddb ./logs

Copy the default FreeRADIUS configuration from the image to your host's ./raddb directory. You typically do this once.

# Build a temporary image first (if not already built)
docker build -t temp-freeradius-config .

# Copy config out from the temporary container
docker run --rm --entrypoint /bin/sh temp-freeradius-config -c "tar cf - -C /etc raddb" | tar xf - -C .

# Optionally remove the temporary image
# docker rmi temp-freeradius-config

Ensure the ./raddb directory exists and is populated before proceeding.

• Set driver = "rlm_sql_postgresql".
• Set dialect = "postgresql".
• In the postgresql { ... } section, configure the connection using environment variables passed from docker-compose.yml:

  server = "%{env:DB_HOST}"
  port = "%{env:DB_PORT}"
  login = "%{env:DB_USER}"
  password = "%{env:DB_PASSWORD}"
  radius_db = "%{env:DB_NAME}"

• Review/adjust connection pool settings (pool {}) if needed for performance. You might also adjust SQL queries later if necessary.

• Ensure a symbolic link exists from ./raddb/mods-enabled/sql to ../mods-available/sql. Create it if it doesn't exist (ensure you are in the project root):

# Ensure you are in the project root directory (freeradius-pg-docker)
ln -s ../mods-available/sql ./raddb/mods-enabled/sql

This file controls the main request flow. Modify the sections to integrate SQL and PAP.

• authorize {} section:
  • Add sql (usually near the top) to fetch user details/checks from the database.
  • You might keep files as a fallback.
  • Keep pap if you need authorize checks based on Auth-Type PAP.

  authorize {
      # ... other initial checks ...
      sql # Check SQL first
      # files # Optional: Check files module if not found in SQL
      pap # Keep pap here if needed for Auth-Type PAP checks
      # ... other modules ...
  }

• authenticate {} section:
  • Ensure the Auth-Type PAP { pap } block exists to handle PAP authentication.
  • The pap module itself (configured in mods-available/pap) determines if passwords are checked against the users file (default) or potentially SQL (requires additional configuration like Password-With-Header and SQL query adjustments).
  • You might add sql here too if specific SQL checks are needed during authentication.

  authenticate {
      Auth-Type PAP {
          pap # Handle PAP authentication via the pap module
      }
      # ... other Auth-Types like CHAP ...
      # You might add 'sql' here if needed for other checks
  }

• accounting {} section:
  • Add sql to log accounting records to the database.
  • Remove or comment out file-based logging (detail, radacct) if you only want SQL accounting.

  accounting {
      # detail # Optional: file logging
      sql # Log accounting to SQL
  }

• session {} and post-auth {} sections:
  • Review and add sql if needed for your logic (e.g., updating tables after successful authentication).

• Add entries for each RADIUS client (NAS, switch, AP, VPN, testing tools) that will send requests.
• Specify the client's IP address and the shared secret.
• Crucially, include an entry for 127.0.0.1 if testing with radtest from the host/container (e.g., use secret testing123).

client localhost {
    ipaddr = 127.0.0.1
    secret = testing123 # Use the same secret in radtest
}

# Add other clients as needed
# client my_access_point {
#   ipaddr = 192.168.1.100
#   secret = your_ap_secret
# }

• Add any users who will authenticate via PAP using this file, defining their Cleartext-Password.
• You can also define attributes here.

papuser Cleartext-Password := "pappassword"
        Reply-Message = "Hello from users file, %u"

• This file can serve as a fallback or for specific user overrides even when using SQL.

docker-compose up -d

Monitor logs for errors or status messages:

docker-compose logs -f postgres freeradius

• Add user to PostgreSQL database (for SQL auth testing):

  docker-compose exec postgres psql -U radius -d radius -c "INSERT INTO radcheck (username, attribute, op, value) VALUES ('sqluser', 'Cleartext-Password', ':=', 'sqlpassword');"

• Add user to ./raddb/users file (for PAP file auth testing):

  Add the user entry (like the example provided earlier) to ./raddb/users on your host machine.

  Remember to restart FreeRADIUS after editing ./raddb/users:

  docker-compose restart freeradius

• Test SQL user:

  radtest sqluser sqlpassword localhost 0 testing123

• Test PAP user from 'users' file:

  radtest papuser pappassword localhost 0 testing123