= Docker Freeradius (+daloradius)
{{tag>docker imagen}}

== freeradius
  * SQL: <code bash>docker run --rm freeradius/freeradius-server cat /etc/raddb/mods-config/sql/main/mysql/schema.sql > ./01-freeradius.sql</code>
  * <code yaml docker-compose.yml>services:
  freeradius:
    image: freeradius/freeradius-server:latest
    container_name: radius_server
    volumes:
      - ./config/clients.conf:/etc/raddb/clients.conf
      - ./config/users:/etc/raddb/users
      - ./config/sql:/etc/raddb/mods-enabled/sql
    ports:
      - "1812:1812/udp" # Puerto de Autenticación
      - "1813:1813/udp" # Puerto de Accounting (opcional)
    command: freeradius -X    
    tty: true
    stdin_open: true
    restart: always
</code>
  * <code properties clients.conf>client network_devices {
    ipaddr      = 0.0.0.0/0
    secret      = testing123  # Esta es la "Shared Secret" que pondrás en tu Router/AP
}
</code>
  * <code properties sql>sql {
    driver = "rlm_sql_mysql"
    server = "192.168.30.51"
    port = "3306"
    login = "radius"
    password = "***"
    radius_db = "radius"

#    sqllog = yes
#    trace = yes

    pool {
        # Reduce el mínimo de conexiones permanentes a 0 o 1
        min = 0

        # Número máximo de conexiones
        max = 5 

        # Conexiones de reserva
        spare = 1

        # Segundos antes de cerrar una conexión inactiva
        idle_timeout = 60
    }

    sqllog {
        logfile = "/var/log/sql.log"
    }
   
    authcheck_table = "radcheck"
    authreply_table = "radreply"
    usergroup_table = "radusergroup"
    groupcheck_table = "radgroupcheck"
    groupreply_table = "radgroupreply"
    group_attribute = "SQL-Group"
    client_table = "nas"
    
    # Tablas de Accounting / Registros de conexión
    acct_table1 = "radacct"
    acct_table2 = "radacct"
    postauth_table = "radpostauth"
 
    $INCLUDE ${modconfdir}/${.:name}/main/mysql/queries.conf
}</code>
  * <code properties users>"usuario_prueba" Cleartext-Password := "password_seguro"
"usuario_prueba2" Crypt-Password := "$5$e220a3496a9d02965d2d0d72eb37903cddc13f6fcc49c1feeffa9f82f6f45611" # fail
"usuario_prueba3" SHA2-Password := "9ab5646239e126f8719956c13b53660b2fc00a087f4835eda9b1b47bf33927c5"
</code>
    * atributos:
      * Cleartext-Password
      * Crypt-Password (fail)
      * SHA2-Password
      * MD5-Password # no probado, no recomendado, MD5
      * SHA-Password # no probado, SHA1

=== generación contraseñas
  * hash-256:<code bash>echo -n "tu_contraseña" | openssl dgst -sha256</code>
  * hash-256:<code sql>SELECT SHA2('tu_contraseña', 256);</code>
  * fail (en freeradius): <code bash>
sudo apt install whois
mkpasswd -m sha-512 mi_clave_123
</code>

== daloradius
  * [[https://github.com/lirantal/daloradius/tree/master]]