[Ubuntu] Radsecproy for secure Radius over WAN

Mon, 27 Jun 2016 11:51:44 +0000

Chances are you going to need an radius Auth over WAN - because your Radius and Identity Mngmnt is hosted in the security of the local datacenter of your corp… but the client (i.e. an network switch) is somewhere over the ~~rainbow~~ WAN. You could just pipe the radius traffic over the internet - but there be dragons: radius communication is unencrypted. So… just no.

Enter radsecproxy: Radsecproxy is - as the name implies, an radius proxy - which needs to be installed on both servers (the local one in your company, now called SERVER, and the remote one with the switch attached, now called CLIENT) - and does encrypt the communication between both server parts (over WAN i.e.) via TLS.

[Ubuntu] Freeradius: Improve Uptime

Fri, 20 May 2016 08:00:43 +0000

As a network admin, you’re going to have at least one Freeradius running, mostly for 802.1x authentication. At my place the problem arised, that the service was down too often - for different reasons.

1.) Logrotate
If you’re using logrotate, you should check out /etc/logrotate.d/freeradius:

/var/log/freeradius/*.log {
weekly
rotate 52
compress
delaycompress
notifempty
missingok
postrotate
invoke-rc.d freeradius reload &gt;/dev/null 2&gt;&1 || true
endscript
}

Logrotate does restart freeradius after it swapped the logs with reload, which often results in a crash or race condition (freeradius does not shutdown fast enough, and the restarting process thinks it already got one running process - and both terminate). So to change that, you should stop the process, wait, and start again.

Radius on Nico Maas

[Ubuntu] Radsecproy for secure Radius over WAN

[Ubuntu] Freeradius: Improve Uptime