### **FreeRADIUS Crash Course for a School Environment with AD Integration (IPv4-Only)**  
*(Softbox MSP Focus: IPv4-Only, No IPv6 Support)*  

---

### **1. What is RADIUS?**  
**RADIUS (Remote Authentication Dial-In User Service)** is a network protocol for centralized authentication, authorization, and accounting (AAA). It’s used in:  
- **Wireless networks** (802.1X)  
- **DSL modems**  
- **VPN gateways**  
- **Switches/APs**  

**Key Components:**  
- **Client (NAS):** Network Access Server (e.g., switch, AP, firewall) that sends user credentials to the RADIUS server.  
- **Server (RADIUS):** Validates credentials against a backend (e.g., AD, LDAP, SQL).  
- **Protocol Flow:**  
  1. User authenticates (e.g., via Wi-Fi, SSH, or PPP).  
  2. NAS sends an **Access-Request** to the RADIUS server.  
  3. Server checks credentials against a backend (e.g., AD).  
  4. Server replies with **Access-Accept**, **Access-Reject**, or **Accounting-Request**.  

---

### **2. Key Features of FreeRADIUS**  
FreeRADIUS is an open-source RADIUS server with:  
- **Modular architecture** (plugins for LDAP, SQL, EAP, etc.).  
- **IPv4 support** (standard for Softbox MSP).  
- **EAP (Extensible Authentication Protocol)** for secure 802.1X.  
- **Accounting** for usage tracking (e.g., bandwidth, login times).  
- **Proxying** for load balancing or multi-site setups.  

---

### **3. Architecture for Your School Use Case**  
**Scenario:**  
- **MS DC/AD** handles user identities (e.g., `students`, `staff`, `guests`).  
- **FreeRADIUS** acts as the central AAA server.  
- **NAS devices** (e.g., Proxmox VMs, VMware ESXi hosts, APs) forward RADIUS requests.  

**Workflow:**  
1. **User connects** to the network (e.g., via Wi-Fi).  
2. **NAS** sends user credentials to **FreeRADIUS** (via IPv4).  
3. **FreeRADIUS** queries **AD/LDAP** for authentication.  
4. **FreeRADIUS** authorizes the user (e.g., assign VLANs, limit bandwidth).  
5. **Accounting** logs are stored for billing/monitoring.  

---

### **4. Step-by-Step Setup (IPv4-Only)**  

#### **A. Prerequisites**  
- **Linux Server** (e.g., Ubuntu/Debian/Proxmox VM).  
- **IPv4 connectivity** (ensure `ipv4` is enabled in kernel and network).  
- **AD/LDAP integration** (e.g., Microsoft Active Directory).  
- **TLS/SSL** for secure communication (required for RADIUS).  

---

#### **B. Install FreeRADIUS**  
```bash
# Debian/Ubuntu
sudo apt update
sudo apt install freeradius freeradius-utils
```

---

#### **C. Configure FreeRADIUS for AD Integration**  
1. **LDAP Configuration (AD):**  
   Edit `/etc/freeradius/3.0/sites-enabled/inner-tunnel` (or `default`):  
   ```ini
   ldap {
       server = "ad.example.com"  # AD DC IPv4 address
       base_dn = "DC=example,DC=com"
       bind_dn = "CN=radius,CN=Users,DC=example,DC=com"
       bind_password = "your-ad-password"
       filter = "(sAMAccountName=%{User-Name})"
       attribute = sAMAccountName
       timeout = 5
       start_tls = yes
   }
   ```  
   **Note:** Use `ldapsearch` to test LDAP connectivity.  

2. **Authentication Method:**  
   In `/etc/freeradius/3.0/sites-enabled/inner-tunnel`, replace `auth` with:  
   ```ini
   authenticate {
       ldap
   }
   ```  

3. **Authorization Rules:**  
   Add policies to assign VLANs or bandwidth limits:  
   ```ini
   authorize {
       ldap
       policy filter-ipv4 {
           if (User-Name =~ /^student/) {
               Tunnel-Type = VLAN
               Tunnel-Medium-Type = 6
               Tunnel-Client-Endpoint = "ipv4"
           }
       }
   }
   ```  

---

#### **D. Configure RADIUS Clients (NAS)**  
Edit `/etc/freeradius/3.0/clients.conf`:  
```ini
client NAS-IPv4-Address {
    ipaddr = 192.168.1.1  # Replace with NAS's IPv4 address
    secret = "your-shared-secret"
    short_name = "NAS-Name"
    require_message_integrity = yes
    nastype = other
}
```  
**Note:** Ensure NAS devices are configured with the same shared secret and IPv4 address.  

---

#### **E. TLS/SSL for Secure Communication**  
1. **Generate Certificates (self-signed or CA-signed):**  
   Use `openssl` to create a certificate chain. Store in `/etc/freeradius/3.0/certs/`.  

2. **Configure TLS in `radiusd.conf`:**  
   ```ini
   tls {
       ca_file = "/etc/freeradius/3.0/certs/ca.pem"
       cert_file = "/etc/freeradius/3.0/certs/server.pem"
       key_file = "/etc/freeradius/3.0/certs/server.key"
       dh_file = "/etc/freeradius/3.0/certs/dh2048.pem"
       verify_client = yes
   }
   ```  

3. **NAS Configuration:**  
   Ensure NAS devices are configured to use TLS and trust the CA certificate.  

---

#### **F. Test the Setup**  
1. **Simulate a RADIUS Request:**  
   ```bash
   radtest user@example.com password 192.168.1.1 0 your-shared-secret
   ```  
   Check `/var/log/freeradius/radius.log` for output.  

2. **Use Wireshark:**  
   Capture IPv4 RADIUS packets (port 1812/1813) to debug.  

---

### **5. Security Best Practices**  
- **Firewall Rules:** Ensure only trusted NAS devices can communicate with the RADIUS server on ports 1812 (authentication) and 1813 (accounting).  
- **Shared Secrets:** Use strong, unique shared secrets for each NAS device.  
- **TLS Enforcement:** Require TLS for all RADIUS communication to prevent eavesdropping.  

---

### **6. Common Pitfalls**  
- **IP Address Mismatch:** Ensure the NAS's IP address in `clients.conf` matches its actual IPv4 address.  
- **LDAP Configuration Errors:** Double-check `bind_dn`, `base_dn`, and `filter` settings in the LDAP block.  
- **TLS Certificate Issues:** Verify the CA certificate is trusted by the NAS and the certificate chain is complete.  

---

### **7. Next Steps for You**  
1. **Provision a FreeRADIUS VM** in Proxmox with IPv4 support.  
2. **Integrate with AD** using LDAP (test via `ldapsearch`).  
3. **Secure TLS** and configure NAS devices.  
4. **Monitor logs** and test with real users.  

Let me know if you need scripts for LDAP testing, TLS certificate generation, or IPv4 subnet planning! 🚀