This service is my first to containerize. At the present time, my school organization's wifi authenticates via radius, and I host an instance of freeradius on our network control server, along with dhcp. This single point of failure is a not good thing, so radiusd is a good candidate to be converted to a container service that I can run on multiple nodes, perhaps a kubernetes cluster.

The first step was to build my docker image and get it running so it would take authentication requests over ports 1812 & 1813. I have a custom image from my Dockerfile, so I can skip all the install info, which really just this:

yum install -y freeradius freeradius-utils 

Also, my work installation is centos6, and a previous attempt to run radiusd on centos7 gave me too much trouble to work out the changes to the configs right now. So, my custom image is based on centos 6.

docker run -it --name myRadiusd -p 1812:1812 -p 1813:1813 -p 1812:1812/udp -p 1813:1813/udp soops/radiusd bash

Next, I backed up to working /etc/raddb folder from my control server and copied it to my local system. I spun up an instance of my radiusd image on my windows system. At first I tried to mount the local raddb folder as a shared volume, but it mapped as world writable and the radiusd service wouldn't start. I came upon the docker cp command and it did the trick.

docker cp raddb/. myRadiusd:/etc/raddb

This worked swimmingly :-) The service started without a hitch, and I had a working copy of my radiusd service from work. Now to test!

As mentioned above, the radiusd image is running on my Windows system, so I will test using the radtest from a container in my pi cluster. I had to install some utilities:

yum install freeradius-utils hostname -y

I also had to install a package so the radtest script's hostname directive would work.

One more thing to get ready: I added an entry for my test machine in the clients.conf file. I took the ip from ignored attempt entry in the /var/log/radiusd/radiusd.log

client radtest {
        ipaddr = 172.17.0.1
        secret = test
        nastype = other
        }

I also added a test user to the /etc/raddb/users file with a super duper secure password...

test            Cleartext-Password := "securePassword"

From the pi-cluster container, I ran radtest:

radtest test securePassword 192.168.0.18 1812 test

I got back a response which, while needs further troubleshooting, shows that the instance is responding.

[root@container-id /]# radtest -t chap test securePassword 192.168.0.18 1812 test
Sent Access-Request Id 216 from 0.0.0.0:45303 to 192.168.0.18:1812 length 75
        User-Name = "test"
        CHAP-Password = 0x0cd1072b900009f73e66b3e10600b13370
        NAS-IP-Address = 172.17.0.3
        NAS-Port = 1812
        Message-Authenticator = 0x00
        Cleartext-Password = "securePassword"
Received Access-Reject Id 216 from 192.168.0.18:1812 to 0.0.0.0:0 length 20
(0) -: Expected Access-Accept got Access-Reject

So, just have to troubleshoot the reject message, but I suspect that has to do with being transplanted into my local network. The important part is that the radiusd instance is responding. Now I need to set it up as an alternate authentication offer at work and give it a try...