Internal Resources

System Components

• FreeRADIUS Server runs on a DigitalOcean Droplet (Ubuntu Linux). This is the central authentication engine.
• MikroTik Routers at customer sites are configured to check with the RADIUS server whenever someone logs in.
• Admin Users are defined in a text file on the RADIUS server with individual usernames and passwords.
• SSH Access is how authorized admins manage the server itself (add/remove users, troubleshoot, etc.).

Authentication Flow

The router never stores the user's password. It simply asks the RADIUS server "is this person allowed?" and acts on the answer.

The FreeRADIUS server runs on a DigitalOcean Droplet, a cloud-hosted virtual machine. This keeps the authentication infrastructure off-premises and accessible from any ITI-managed site.

Only authorized administrators should access this server. Access is via SSH using key-based authentication.

Procedure

1. Open PowerShell (Windows) or Terminal (Mac/Linux).
2. Connect to the server:

ssh root@<RADIUS_SERVER_IP>

3. Confirm you see a Linux command prompt (e.g., root@radius:~#).
4. You are now on the RADIUS server and can manage users and configuration.

All user accounts are managed in the users file on the RADIUS server.

Adding a New Employee

1. SSH into the RADIUS server.
2. Open the users file:

sudo nano /etc/freeradius/3.0/users

3. Add the new user entry at the top of the file:

<USERNAME>   Cleartext-Password := "<STRONG_PASSWORD>"
             Auth-Type := PAP

4. Save the file (Ctrl+O, then Ctrl+X in nano).
5. Restart FreeRADIUS to apply the change:

sudo systemctl restart freeradius

6. Test the new credentials from a MikroTik router or using radtest.
7. Record the change in the change log.

Resetting a Password

Edit the users file, find the employee's entry, change the password value, save, and restart FreeRADIUS. Communicate the new password securely (never via email or text).

Disabling an Employee (Temporary)

Comment out their entry by adding a # at the beginning of each line of their user block. Restart FreeRADIUS. This preserves the entry for easy re-enablement.

Removing an Employee (Permanent)

Delete their entry from the users file entirely. Restart FreeRADIUS. Confirm login no longer works. Record the removal in the change log.

When an employee leaves ITI, their RADIUS account must be disabled immediately. This is one of the primary benefits of centralized authentication: one change revokes access everywhere.

Offboarding Checklist

1. SSH into the RADIUS server.
2. Open the users file and locate the employee's entry.
3. Comment out or delete their user block.
4. Save the file and restart FreeRADIUS: sudo systemctl restart freeradius
5. Attempt to log in as the former employee from any enrolled router to confirm the login is rejected.
6. Record the change in the change log with the date, your name, and the reason.
7. Review whether the employee had any local MikroTik accounts on individual routers (break-glass accounts). If so, change those passwords.

Each MikroTik router must be configured to use RADIUS for administrator logins. Paste these commands into the router's Winbox terminal.

/radius add address=<RADIUS_SERVER_IP> secret=<RADIUS_SECRET> service=login
/user aaa set use-radius=yes
/radius set 0 src-address=0.0.0.0
/radius set 0 require-message-auth=no

What Each Command Does

FreeRADIUS will only accept authentication requests from routers it trusts. Trust is established in the clients.conf file. There are two approaches:

Option A: Individual Client Entries (More Secure)

Each router is registered by its public IP address. This is the most secure approach because the RADIUS server only accepts requests from known IPs.

client mikrotik-example {
    ipaddr = <ROUTER_PUBLIC_IP>
    secret = <RADIUS_SECRET>
}

Option B: Global Client Entry (More Convenient)

Accepts requests from any IP address. This is easier to manage when deploying many routers, but requires extra vigilance on user account security and logging.

client mikrotik-global {
    ipaddr = 0.0.0.0/0
    secret = <RADIUS_SECRET>
}

After editing clients.conf, restart FreeRADIUS: sudo systemctl restart freeradius

Ping the RADIUS Server from MikroTik

/ping <RADIUS_SERVER_IP> count=4

Test a Login

Open a new Winbox session to the router and log in with a RADIUS user account. If it works, the user is authenticated via RADIUS.

Check FreeRADIUS Service Status

sudo systemctl status freeradius

Run Debug Mode

If something isn't working, stop the service and run FreeRADIUS in debug mode to see authentication attempts in real time:

sudo systemctl stop freeradius
sudo freeradius -X

Debug mode shows every incoming request, the lookup result, and the accept/reject decision. Press Ctrl+C to stop, then restart the service normally.

• Individual accounts only. Every person gets their own username and password. No shared accounts.
• Strong, unique passwords. Use the company password vault to generate and store credentials.
• Restrict SSH access. Only authorized administrators should have SSH keys for the RADIUS server.
• Enable DigitalOcean backups. Weekly automated backups protect against data loss.
• Maintain local break-glass accounts. Each router should have one local admin account in case RADIUS is unreachable. Store these passwords in the vault.
• Review user accounts quarterly. Audit the users file to confirm every entry is a current, active employee.
• Document every change. Use the change log at the bottom of this page for every addition, removal, or modification.
• Never send credentials in plaintext. Use phone calls, encrypted messaging, or in-person delivery for new account passwords.

If FreeRADIUS Is Down

When the RADIUS server is unreachable, MikroTik routers will fall back to local authentication. Employees can log in using the local break-glass admin account on each router. This is why maintaining those local accounts in the password vault is critical.

Recovering Server Access

1. Log into the DigitalOcean control panel.
2. Access the Droplet via the DigitalOcean web console (if SSH is down).
3. Check the FreeRADIUS service status and logs.
4. If the Droplet itself is unresponsive, use DigitalOcean's power cycle or recovery options.

Restoring from Backup

1. In the DigitalOcean control panel, navigate to the Droplet's Backups section.
2. Select the most recent backup and restore.
3. After restoration, verify FreeRADIUS starts and users can authenticate.
4. Check the users file to confirm it reflects the latest employee roster (backup may be up to a week old).

Record every user account or configuration change below. This log is the audit trail for RADIUS administration.

The FreeRADIUS system is the foundation for centralized authentication at ITI. Planned enhancements include:

• Microsoft Entra Integration. Allow employees to authenticate with their Microsoft 365 credentials instead of separate RADIUS passwords.
• Role-Based Access Groups. Define permission levels (full admin, read-only, CSR access) so different staff get different capabilities.
• CSR Read-Only Access. Give CSRs visibility into router status for troubleshooting without full admin rights.
• Web Management Interface. A simple web panel for adding/removing users without SSH access.
• Mass MikroTik Rollout Automation. Scripts to configure RADIUS on many routers at once instead of one at a time.
• Multi-Factor Authentication. Add a second factor (TOTP/push notification) for router logins for high-security environments.