palw3ey/ye3radius repository overview

docker run -dt --name myradius -e Y_TEST_NAS=yes -e Y_TEST_USER=yes -p 1812-1813:1812-1813/udp docker.io/palw3ey/ye3radius

docker run -dt --name mymariadb -e MYSQL_ROOT_PASSWORD=mypass -p 3306:3306 mariadb:latest

docker exec -it mymariadb mariadb --user=root --password=mypass

create database radius;
create user 'radiusDBuser'@'%' identified by 'radiusDBpassword';
GRANT ALL PRIVILEGES ON radius.* TO radiusDBuser;
quit;

# install mariadb-client-core
sudo apt install mariadb-client-core -y

# get mymariadb container ip adress
mymariadb_ip=$(docker inspect --format='{{.NetworkSettings.IPAddress}}' mymariadb)

wget https://github.com/palw3ey/ye3radius/raw/main/schema.sql
mariadb --host=$mymariadb_ip --port=3306 --user=radiusDBuser --password=radiusDBpassword --database=radius < schema.sql
mariadb --host=$mymariadb_ip --port=3306 --user=radiusDBuser --password=radiusDBpassword --database=radius -e "SHOW TABLES;"

nas_address="0.0.0.0/0"
nas_secret="strongSecret"
mariadb --host=$mymariadb_ip --port=3306 --user=radiusDBuser --password=radiusDBpassword --database=radius -e "INSERT INTO  nas (nasname,shortname,type,ports,secret,server,community,description) VALUES ('"$nas_address"', 'nas access sql', 'other',NULL ,'"$nas_secret"',NULL ,NULL ,'RADIUS Client');"

employee_username="tux"
employee_password="strongPassword"
mariadb --host=$mymariadb_ip --port=3306 --user=radiusDBuser --password=radiusDBpassword --database=radius -e "INSERT INTO radcheck (username, attribute, op, value) VALUES ('"$employee_username"', 'Cleartext-Password', ':=', '"$employee_password"');"

mariadb --host=$mymariadb_ip --port=3306 --user=radiusDBuser --password=radiusDBpassword --database=radius

INSERT INTO radreply
  (username, attribute, op, value)
VALUES
  ('tux', 'cisco-avpair', '+=', 'ipsec:dns-servers=1.1.1.1 8.8.8.8'),
  ('tux', 'cisco-avpair', '+=', 'ipsec:default-domain=example.lan');
quit;

docker run -dt --name myradius -e Y_DB_ENABLE=yes \
	-e Y_DB_SERVER=$mymariadb_ip -e Y_DB_PORT=3306 -e Y_DB_TLS_REQUIRED=no \
	-e Y_DB_LOGIN=radiusDBuser -e Y_DB_PASSWORD=radiusDBpassword \
	-p 1812-1813:1812-1813/udp \
	palw3ey/ye3radius

# check if container is ready :
docker logs myradius

# get container IP :
myradius_ip=$(docker inspect --format='{{.NetworkSettings.IPAddress}}' myradius)

# On a ubuntu host :
apt install freeradius-utils
radtest $employee_username $employee_password $myradius_ip:1812 0 $nas_secret -x

docker exec -it myradius radtest test 1234 localhost:1812 0 testing123 -x

configure terminal
aaa new-model
radius server ye3radius
  address ipv4 10.10.10.250 auth-port 1812 acct-port 1813
  key strongSecret
  exit
do test aaa group radius server name ye3radius test 1234 new-code

docker exec -it myradius tail -f /var/log/radius/radius.log
# To exit : Ctrl C

mysql --host=$mymariadb_ip --port=3306 --user=radiusDBuser --password=radiusDBpassword --database=radius

INSERT INTO radcheck
	(username, attribute, op, value)
VALUES
	('emily', 'Cleartext-Password', ':=', 'emilyStrongPassword');

DELETE FROM radcheck
WHERE username = 'emily';

UPDATE radcheck
SET value='emilyNewStrongPassword'
WHERE username='emily';

INSERT INTO radcheck
	(username, attribute, op, value)
VALUES
	('emily', 'Auth-Type', ':=', 'Reject');

DELETE FROM radcheck
WHERE username='emily'
AND attribute='Auth-Type'
AND value='Reject';

SELECT * FROM radcheck;

INSERT INTO radusergroup (username, groupname) VALUES ('emily', 'Manager');

INSERT INTO radgroupreply (groupname, attribute, op, value) VALUES ('Manager', 'Class', ':=', 'Manager');

# just add : -e Y_RADSEC_SERVER_ENABLE=yes -p 2083:2083/tcp
docker run -dt --name myradius -e Y_DB_ENABLE=yes \
	-e Y_DB_SERVER=$mymariadb_ip -e Y_DB_PORT=3306 -e Y_DB_TLS_REQUIRED=no \
	-e Y_DB_LOGIN=radiusDBuser -e Y_DB_PASSWORD=radiusDBpassword \
	-e Y_RADSEC_SERVER_ENABLE=yes -p 2083:2083/tcp \
	palw3ey/ye3radius

# get the client key, certificate and ca in the Remote RadSec Server
(docker exec -it myradius cat /etc/raddb/certs/client.key) > client.key
(docker exec -it myradius cat /etc/raddb/certs/client.crt) > client.crt
(docker exec -it myradius cat /etc/raddb/certs/ca.pem) > ca.pem

# get the ip
myradius_ip=$(docker inspect --format='{{.NetworkSettings.IPAddress}}' myradius)
echo $myradius_ip

# create the Radius Proxy with the previous files
docker run -dt --name myradius_proxy \
	-p 1812-1813:1812-1813/udp \
	-e Y_RADSEC_PROXY_ENABLE=yes \
	-e Y_RADSEC_PROXY_IPADDR=$myradius_ip \
	-e Y_RADSEC_PROXY_CLIENT_SECRET=strongProxySecret \
	-v ~/client.key:/etc/raddb/certs/proxy_client.key:ro \
	-v ~/client.crt:/etc/raddb/certs/proxy_client.crt:ro \
	-v ~/ca.pem:/etc/raddb/certs/proxy_ca.pem:ro \
	docker.io/palw3ey/ye3radius 

# install freeradius-utils
sudo apt install freeradius-utils

# get the ip
myradius_proxy_ip=$(docker inspect --format='{{.NetworkSettings.IPAddress}}' myradius_proxy)
echo $myradius_proxy_ip

# test authentication
radclient -x $myradius_proxy_ip:1812 auth strongProxySecret <<EOF
User-Name = "emily"
User-Password = "emilyStrongPassword"
NAS-IP-Address = 192.168.1.2
EOF

# verify authentication
mariadb --host=$mymariadb_ip --port=3306 --user=radiusDBuser --password=radiusDBpassword --database=radius -e "SELECT username, packet_src_ip_address, authdate FROM radpostauth ORDER BY id DESC LIMIT 2;"

# test accounting
radclient -x $myradius_proxy_ip:1813 acct strongProxySecret <<EOF
User-Name = "emily"
NAS-IP-Address = 192.168.1.2
Framed-IP-Address = 192.168.1.3
Acct-Status-Type = Start
Acct-Session-Id = 123456789
EOF

# verify accounting
mariadb --host=$mymariadb_ip --port=3306 --user=radiusDBuser --password=radiusDBpassword --database=radius -e "SELECT radacctid, acctsessionid, acctstarttime, framedipaddress FROM radacct ORDER BY radacctid DESC LIMIT 2;"

git clone https://github.com/palw3ey/ye3radius.git
cd ye3radius
# Make all your modifications, then :
docker build --no-cache --network=host -t ye3radius .
docker run -dt --name my_customized_radius ye3radius