Setting up FreeRADIUS with MySQL on Debian 9

Presented by Jayke Peters

Enable FreeRADIUS to start upon boot

Enter the following command: sudo systemctl enable freeradius

Sources Used

• Main Tutorial (Translated) - Rudimar Remontti
• NTLM Hashing

Hashing Passwords

I highly recommend that you hash your passwords. To do so, follow the steps below:

1. Use the "smbencrypt" command as shown in the link
2. Note the second "NT" hash. This is the hash we will use to store our passwords.
3. Using a MySQL/MariaDB query, update the password for the user or create a new one entirely with the hashed password.

   $ sudo su 
   
   $ mysql
   
   $ INSERT INTO radius.radcheck (`username`,`attribute`,`op`,`value`) VALUES ('USERNAME','NT-Password',':=','HASH');
   

4. Using the "radtest" command, test your new user. If you're having issues, there's a few things you can try:
   1. radtest "username" "password" localhost 0 testing123
   • Restarting FreeRADIUS
   • Use a different form of the command
   • Edit your config files to use NTLM Hashing
   • Contact Me - I will help you

When Problems Occur

• Errors with phpMyAdmin
• Need to add a User
  • First, issue the following command: sudo mysql or sudo mariadb
  • Use the commands found in Part 2
• Set wrong or forgot password

Additional Security Measures

If you are going to have your server open to the internet, I highly recommend that you enable custom security features to keep yourself and your user's information safe from hackers. Here's a current list of the things I use and highly recommend:

• fail2ban
  • Stops Brute-Force attakcs and malicious requests
• ".htaccess" only

  • Requires username and password authentication on the phpMyAdmin page, or your whole server in general

  • How to unblock IP Address(es)

• HTTPS - SSL
  • Encrypts all traffic over port 443 (With Port Forwarding)
• Wildcard Certificates
• If you're having issues
• Configuration Checker
• Enable certificates with FreeRADIUS
  • Where are my certs?
  • Afterwards, enter the following command:
  • sudo service freeradius stop; sudo service freeradius start &