FreeRADIUS

Purpose

RADIUS server for WPA Enterprise authentication

Install

Amazon Linux 2

• Set DNS servers to DCs to be used
• Set Chrony sources to use the DCs, comment out the Amazon pools.
• Set static IP, add to Windows DNS.
• Install FreeRadius packages.

sudo yum -y install freeradius freeradius-utils

• Update /etc/raddb/radiusd.conf user and group from radiusd to root. Though I have done this with another radius server running google auth, I think there should be a better option. More research should be done.
• Uncomment pam module from /etc/raddb/sites-enabled/default
• Create symlink for pam module

sudo ln -s /etc/raddb/mods-available/pam /etc/raddb/mods-enabled/pam

• Update /etc/raddb/users by adding the default auth type to PAM. It is also common practice to uncomment the disabled group.

DEFAULT Group == "disabled", Auth-Type := Reject
                Reply-Message = "Your account has been disabled."

DEFAULT Auth-Type := PAM

• Add your client, in this case I added a subnet where the access points reside.

client wifi {
        ipaddr = 192.168.1.0/24
        secret = somesecret
        require_message_authenticator = no
        nas_type = other
}

sssd

sudo yum -y install sssd realmd adcli