RADIUS Authentication

Configure the RADIUS server

In this example, we will authenticate users through the traditional RADIUS users file. Alternatively, the RADIUS server can query an LDAP server.

We will use a FreeRADIUS 3.0 server.

1. Follow the FreeRADIUS Getting Started guide to install FreeRADIUS on a server.

2. Add your HAProxy ALOHA appliance as a new RADIUS client in the FreeRADIUS client configuration file, /etc/freeradius/3.0/clients.conf.

   client aloha {
      # The ALOHA IP address
      ipaddr = 192.168.1.38
   
      # Secret shared between the RADIUS server and ALOHA
      secret = saUz@w7!iwfa
   
      # Do not require the Message-Authenticator field
      require_message_authenticator = no
   
      # Transport protocol
      proto = udp
   
      # Network Access Server type for ALOHA
      nas_type = other
   }

3. Add usernames and passwords to the RADIUS user authorization file, /etc/freeradius/3.0/mods-config/files/authorize.

   alice Cleartext-Password := "TmjRDl61NuiA"
   bob   Cleartext-Password := "AIQols16y1R6"
   carol Cleartext-Password := "Jb4cWp70D94u"
   dave  Cleartext-Password := "Jkxv:Qoc;p4@"

   You can also limit how a user can log into HAProxy ALOHA to one of the following methods:

   Login method ID	Description
   wui	Log in via the web UI.
   sshd	Log in via SSH.
   login	Log in via a local keyboard or serial login.

   Add a NAS-Identifier parameter to set the login allowed, for example:

   carol Cleartext-Password := "Jb4cWp70D94u", NAS-Identifier == "wui"

4. Restart the RADIUS server.

   $ sudo systemctl restart freeradius

   To test your setup, start the RADIUS server in debug mode.

See also

• Generate password hash for use with RADIUS

• Authentication via LDAP for FreeRADIUS

Configure HAProxy ALOHA

On the HAProxy ALOHA server:

1. Edit the file /etc/security/pam_radius.conf.

   Select the Tools tab, then use the File manager to browse to the /etc/security folder and edit the file pam_radius.conf.

   Add your RADIUS server. Use the same secret string you specified in the FreeRADIUS client configuration file.

   # RADIUS Server[:Port]  Shared Secret  [Timeout (s)]  [source_ip] [vrf]
   192.168.1.69            saUz@w7!iwfa   60

2. Edit the file /etc/security/users.conf.

   Select the Tools tab, then use the File manager to browse to the /etc/security folder and edit the file users.conf.

   Add the same users that you defined on the RADIUS server, specifying the following for each:

   • auth_type of radius

   • optional: service set to wui, sshd, or login. This is another way restrict how a user can log in, rather than setting it in the FreeRADIUS authorize file.

   • allow or deny to enable or disable this user's login

   • map_to_user set to either admin for read/write access or monitor for read-only access.

   These directives implement the example access rights listed at the top of this page.

   user=alice      auth_type=radius                  : allow map_to_user admin
   user=bob        auth_type=radius service=wui,sshd : allow map_to_user admin
   user=carol      auth_type=radius service=wui      : allow map_to_user admin
   user=dave       auth_type=radius service=wui      : allow map_to_user monitor
   
   :deny

3. In the Services tab, click pam setup .

   

4. Add RADIUS support to the PAM service.

   service pam
       autostart
       radius_auth 1

5. Apply your changes to the PAM configuration.

   

6. Restart the PAM service.

   

7. Save your configuration from the Setup tab.

You can now test logging in to the web UI with various credentials.

Reference

<FILTERS>:<ACTIONS>