This is a draft document that was built and uploaded automatically. It may document beta software and be incomplete or even incorrect. Use this document at your own risk.

Jump to content
Setting Up a FreeRADIUS Server
SUSE Linux Enterprise Server for SAP applications 16.1

Setting Up a FreeRADIUS Server

Publication Date: 22 May 2026
WHAT?

FreeRADIUS is the open source RADIUS server implementation for AAA (Authentication, Authorization, and Accounting).

WHY?

This article provides a complete overview of the FreeRADIUS server setup and basic FreeRADIUS configuration for testing.

EFFORT

It takes 15 minutes to install and configure FreeRADIUS. You need up to 30 minutes to fully understand the FreeRADIUS architecture and functionality.

GOAL

Basic understanding of setting up and testing a FreeRADIUS server.

REQUIREMENTS
  • A virtual machine or instance to install FreeRADIUS.

  • Another virtual machine on your network to test client functions.

1 About FreeRADIUS

The RADIUS (Remote Authentication Dial-In User Service) protocol is a standard service for managing network access. FreeRADIUS is the open source RADIUS server implementation and the most widely used RADIUS server.

FreeRADIUS verifies users and clients and manages network access and operations. FreeRADIUS ensures secure communication between network devices and user authentication servers.

FreeRADIUS performs authentication, authorization and accounting (AAA) for very large businesses such as Internet service providers and cellular network providers, and is also popular for small networks. It authenticates users and devices, authorizes those users and devices for certain network services, and tracks the use of services for billing and auditing. You do not have to use all three of the AAA protocols, use only the ones you need.

RADIUS operates over a distributed architecture and runs separately from the Network Access Server (NAS). User access data is stored on a central RADIUS server that is available to multiple NAS devices. The NAS provides physical access to the network, such as a managed Ethernet switch or a wireless access point. FreeRADIUS verifies and manages network access and operations. FreeRADIUS ensures secure communication between network devices and user authentication servers. To set up a FreeRADIUS server, you must install, configure and define user accounts, and define and determine authentication and authorization for FreeRADIUS. After installing FreeRADIUS, you must test the function by integrating FreeRADIUS with the devices to be managed.

FreeRADIUS Architecture
Figure 1: FreeRADIUS Architecture

This article includes an example that shows installing FreeRADIUS, creating a set of test certificates, starting the server, adding client server and user, testing authentication, and testing multiple clients.

2 Installing the FreeRADIUS server

Ensure that you install the freeradius-server and freeradius-server-utils packages on a separate machine from your Network Access Server (NAS).

Install freeradius-server and freeradius-server-utils.

> sudo zypper install freeradius-server freeradius-server-utils

3 Creating test certificates on the server

Certificates enable secure communication between the FreeRADIUS clients and the FreeRADIUS server.

To allow access to the server, certificate authentication is required. To test the authentication using FreeRADIUS, you can create test certificates. The following example shows how to create test certificates to test FreeRADIUS. Ensure that you remove the test certificates created for testing and use the correct certificates after testing FreeRADIUS.

Note
Note

The test certificates created are not suitable for production use.

Create a set of test certificates in /etc/raddb/certs.

> sudo  /etc/raddb/certs/bootstrap

This runs the FreeRADIUS bootstrap script, which creates a local Certificate Authority (CA), generates server certificates or client certificates, signs the certificates using the CA and places the certs or keys in the respective locations for EAP-TLS or PEAP or TTLS.

4 Starting FreeRADIUS on the server

You must start FreeRADIUS on the server after installation.

Procedure 1: Starting FreeRADIUS
  1. For testing purposes, after creating certificates, start the server in debugging mode as the root user.

    > sudo radiusd -X
          [...]
          Listening on auth address * port 1812 bound to server default
          Listening on acct address * port 1813 bound to server default
          Listening on auth address :: port 1812 bound to server default
          Listening on acct address :: port 1813 bound to server default
          Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel
          Listening on proxy address * port 54435
          Listening on proxy address :: port 58415
          Ready to process requests
  2. The Listening and Ready to process requests appear when the server starts correctly.

5 Adding a test client and a user on the server

You can add a client and a user to test authentication for the FreeRADIUS server. The client is a client of the RADIUS server, such as a wireless access point or switch. The users are added in the /etc/raddb/users configuration file.

The machines that can use the devices of the FreeRADIUS server are defined in the /etc/raddb/clients.conf file. These configuration files are stored on the server where FreeRADIUS is installed.

Procedure 2: Configuring users and clients

Add the machines that can use the devices of the FreeRADIUS server and the users by using the following example:

  1. Configure users in the users file, /etc/raddb/users.

    To do this, as a root user, open /etc/raddb/users and uncomment the following lines:

    bob Cleartext-Password := "hello"
        Reply-Message := "Hello, %{User-Name}"
  2. Add a test client, localhost, in /etc/raddb/clients.conf, with the secret testing123.

    > sudo  vi /etc/raddb/clients.conf
          
        client localhost {
        ipaddr = 127.0.0.1
        secret = testing123
        }
  3. You can add clients of the RADIUS server, such as a wireless access point, network switch, or another form of NAS.

    If your RADIUS server is on a remote machine 192.0.2.0, create a client configuration on your server by using the following example.

    Add the following entry in /etc/raddb/clients.conf and use the IP address of your test client machine or access gateway instead of the given IP address.

    client private-network-1 {
    ipaddr          = 192.0.2.0/24
    secret          = testing123-1
    }

    You must configure the client to talk to the RADIUS server by using the IP address of the machine running the RADIUS server. The client must use the same secret as configured above in the client section.

    You can add more users and configure the database.

6 Restarting the FreeRADIUS daemon on the server

After adding client and user, you must restart the FreeRADIUS daemon.

Procedure 3: Restarting the FreeRADIUS daemon

Restart the FreeRADIUS daemon to provide authentication, authorization, and accounting (AAA) services in a network environment for network access control and network access management.

  1. Restart the FreeRADIUS daemon.

    > sudo systemctl restart radiusd
  2. Enable auto-start for FreeRADIUS on system boot up.

    > sudo systemctl enable radiusd

7 Testing authentication on the client

You can test the authentication for the newly added user in FreeRADIUS.

7.1 Testing authentication

To test the authentication for the newly added user bob, open a new terminal, and as an unprivileged user, use the radtest command to log in.

>  radtest bob hello 127.0.0.1 0 testing123
        Sent Access-Request Id 241 from 0.0.0.0:35234 to 127.0.0.1:1812 length 73
                User-Name = "bob"
                User-Password = "hello"
                NAS-IP-Address = 127.0.0.1
                NAS-Port = 0
                Message-Authenticator = 0x00
                Cleartext-Password = "hello"
        Received Access-Accept Id 241 from 127.0.0.1:1812 to 0.0.0.0:0 length 20

After the authentication is successful, a login message appears in the terminal in which you started FreeRADIUS, as shown below.

(3) pap: Login attempt with password
          (3) pap: Comparing with "known good" Cleartext-Password
          (3) pap: User authenticated successfully
          (3)     [pap] = ok
          [...]
          (3) Sent Access-Accept Id 241 from 127.0.0.1:1812 to 127.0.0.1:35234 length 0
          (3) Finished request
          Waking up in 4.9 seconds.
          (3) Cleaning up request packet ID 241 with timestamp +889

The access request is successful and the authentication methods PAP, CHAP, MS-CHAPv1, MS-CHAPv2, PEAP, EAP-TTLS, EAP-GTC, EAP-MD5 work for the user bob.

8 Deploying FreeRADIUS

After you have successfully tested your FreeRADIUS setup using the debugging mode and test certificates, you must update the server for production use. A production environment requires higher security, persistence, and performance monitoring.

Procedure 4: Deploying FreeRADIUS

You must remove all the test certificates in /etc/raddb/certs and replace them with your own certificates, comment out all the test users and clients, and stop radiusd.

  1. Before updating the configurations and replacing certificates, you must stop radiusd.

    > sudo  systemctl stop radiusd
  2. Replace the self-signed test certificates created by bootstrap with the correct certificates.

  3. Delete all files in /etc/raddb/certs/ excluding README.

  4. Install your CA-signed certificates or generate production-grade certificates with strong bit-lengths (at least 2048-bit) and appropriate expiration dates.

  5. Ensure the radiusd user has read permissions for the new certificate files.

    ls -l /etc/raddb/certs/
        -rw-r----- 1 root radiusd 1704 Jan 27 10:00 server.key 
        -rw-r----- 1 root radiusd 1200 Jan 27 10:00 server.crt
  6. Delete test users in /etc/raddb/mods-config/files/authorize and /etc/raddb/users.

  7. Remove the localhost with the default secret testing123 in clients.conf.

  8. Update your client blocks to use strong secrets unique to each Network Access Server (NAS).

  9. Verify the configurations.

    > sudo  raidusd -C

    The configurations are verified before starting FreeRADIUS.

  10. Ensure you are not running radiusd -X while deploying as it is slow and logs passwords to the screen. Use the system service.

    sudo systemctl enable --now radiusd
  11. Start FreeRADIUS.

    > sudo  systemctl start radiusd

9 Troubleshooting FreeRADIUS

There are several test users and test clients provided. Ensure that your server has the correct firewall settings. If your test logins fail, review all the output to understand the issues.

Possible troubleshooting methods are given below:

  • Check FreeRADIUS logs in /var/log/freeradius/radius.log or /var/log/radius/radius.log.

  • Check if FreeRADIUS is running.

    > sudo  systemctl status radiusd

    If FreeRADIUS is not running, start FreeRADIUS.

    > sudo  systemctl start radiusd

    If a FreeRADIUS server is already running, an error Address already in use appears. Stop that server before running the server in debugging mode.

    If the server does not start, verify the output. The output includes the details about the errors. You can direct the output to a text file with tee:

    radiusd -X | tee radiusd.text
  • Check if the ports for FreeRADIUS in the firewall are open for communication.

  • Check user authentication.

    >  radtest username password localhost 0 testing123
  • Verify client configuration. Ensure that the secret and IP in the client and the FreeRADIUS server match.

  • Update FreeRADIUS software. Ensure that you use the latest stable version of FreeRADIUS.