Configuring RADIUS for a dial-up ISP - ISP Series Episode 6

We dive into the world of RADIUS and set up user access control for our dial-up ISP.
Want more content like this? Support our mission! Send us a Super Thanks and check out our Patreon + Discord community: / serialport
Got some retro gear you want to donate? Get in touch with us at serialport.org.
Our second channel: ‪@TheParallelPort‬
00:00 - Intro
00:36 - AAA
02:29 - Brian Lloyd
04:08 - Livingston RADIUS
08:15 - Modern RADIUS applications
08:46 - Trying out early RADIUS
14:47 - FreeRADIUS
16:36 - Patreon Portal
Huge thanks to:
Downtown Binary for the magical "Astral"
Watch: • Downtown Binary - Astr...
Listen: open.spotify.com/album/1uGa6r...
...and S N U G for the lush "Purple Skies"
Watch: • S N U G - Purple Skies...
Listen: open.spotify.com/album/2nivV1...
Above music provided by Lofi Girl.
References:
Lloyd, Brian. (2023). Interview conducted by Serial Port.
Hassell, J. (2003). RADIUS: Securing Public Access to Private Resources. O'Reilly Media.
The Internet. (1995). Stewart Cheifet Productions.
Gilster, P. (1993). The Internet Navigator. Wiley.
Merit Network Inc Press Conference photo. (1987). Bentley Historical Library.
Merit Network photos. www.merit.edu/about/history/
Vollbrecht, J. (2006). The Beginnings and History of RADIUS. www.interlinknetworks.com/app...
Aupperle, E. M. (1998). Merit - Who, What, and Why. Library Hi Tech, Vol. 16, No. 1.

[@RTheren]

We're making a heavy use of both FreeRADIUS and TACACS (only for some specific use-cases) at our datacenter. Funny how simple protocols from 80/90s are still with us and better than ever,

[@adampope5107]

Tacacs is how we authenticate all of our network devices logins and command permissions.

[@holladiewal6812]

One thing that immediately caught my attention during the compilation of the orignal radiusd, was the "incompatible implicit declaration" errors. This is most likely part of the issue that causes password decryption to fail. This should be relatively easy to fix by adding the approriate header files to be included. With conf.h being present, maybe this is also where one would usually include headers (and change the options vs. adding them to the Makefile). Or maybe the version of C compiler this project originally used had some standard includes set that provided the "missing" functions.

[@KieranMahoney]

Crazy how far radius has come, to go from being one of the most essential parts of an isp to being used at almost every hotel/venue with public wifi

[@sardaukar99]

It's really great to see the ISP grow. Great videos, guys

[@jdarmst]

Woo! Love the dial-up content!

[@easkay]

Love the reference to clabretro at 1:23! ;D

[@treyscarborough1901]

The amount of hours I spent fighting with radius in the late 90s early 2000s i feel your pain. First was converting SCO Unix slip to ppp with compliling merit radius. Every time my company acquired an isp it seamed each used a different radius server. The craziest was one with a microsoft access database as the backend.

[@mo0seboy]

That's definitely a worldly choice of User-Password there.

[@seankearney7070]

This is one of the best channels on KZbin!

[@blackwhitecringy]

Great video as always!, cant wait for the digital saga!

[@JimLeonard]

Definitely stepping up your animated graphics :-) Love it.

[@MotFPS]

I can't like this enough. The RADIUS GUI you made!! OMG so cool.

[@donwald3436]

RADIUS is still critical today for WPA Enterprise, wifi login with credentials.

[@dan0n3]

I use to work with freeRADUIS doing AAA on cell connections and fibre. This took me back.

[@shanebaldacchino]

One of the best KZbin channels. Thanks guys.

[@harryrickenbach5890]

I have been using Free RADIUS server since 2010 for user access for my Wi-Fi Network started running on a Windows XP machine but now running on a Synology disk station using LDAP database

[@taldmd]

Some trivia, there's an evolution of RADIUS protocol and it's called... DIAMETER. It's mostly supported on 3GPP gear (GGSN, real-time charging) AFAIK and not as well supported in common network stuff as RADIUS.

[@nickwallette6201]

I was talking to a cell tech a few years ago, and he was explaining some of the stuff they use. He mentioned "diameter" as the authentication protocol, and I laughed. He gave me a look, like, "... what?" So I said, " 'Diameter'? Like, RADIUS, Diameter...?" The lightbulb went off. "OH.. I never caught that! Huh!"

[@Duncan_Campbell]

Great Video, can't wait till you start on the 56k era.

[@LB4FH]

So great to see videos on the history of old tech like this

[@Leftylove22]

Another great video!!

[@Hallo-pe4vd]

Aww yeah! Waited for this

[@fireaussie7511]

You honestly deserve more than 6k views...

[@MeriaDuck]

That day a full /tmp caused an empty file tonbe semt to all radius servers... Nome of our customers could log in. Fun times working on the helpdesk 😂

[@LeeZhiWei8219]

Man, I only touched Microsoft Active Directory, and RADIUS on my Cisco IOS homelab. This is very enlightening.

[@christopherrasmussen8546]

man I remember RADIUS

[@jonvincent5158]

Thank you! I just bought a Portmaster 3 from ebay and have it working with local users, but haven't yet figured out the RADIUS server from Livingston. This video will definitely come in handy! There's a WinNT version of Livingston/Lucent RADIUS too but idk if it's worth setting up since it's beta software (although y'all probably know that since I pulled the Livingston files I needed from your website lol).

[@blackwhitecringy]

Nice! I also own a PM3, connected via asterisks using a digium card, I'm currently working on setting up radius, currently trying the radius you're talking about. I think you should try it even if it's beta software, nothing wrong with exploring and learning old and new stuff!

[@treyscarborough1901]

I've been trying to get my hands on a pm3, but haven't had much luck. I had 10+ of them I trashed 4-5 years ago that I regret not keeping one.

[@Scoopta]

RADIUS has been on my todo list too for WPA3-EAP and 802.1X

[@MikeHarris1984]

Holy crap. TACACS is still used today in the enterprise to authenticate to network gear to update software and configs. That and RADIUS is still used today too.

[@TimSedlmeyer]

I hope you are using TACACS+ and not TACACS.

[@wlhyatt100]

Saw that 15454. Looking forward to that.

[@henriqueortizmendes]

Did you try RADIUS in ye ole Cyclades?

[@breadmoth6443]

I know I keep commenting the same thing, but seriously when are we going to see anything regarding ISDN ?

[@theserialport]

What should we do with ISDN?

[@joeltyler3427]

Darnit, I wished that I wasn't on the other side of the world.

[@jfbeam]

Ah yes, the "designed by committee" quagmire. Instead of using an existing good, well thought out system - that would give someone "an advantage" - they have to design something inferior to equally inconvenience everyone. We'll give everyone a say, and staple everyone's ideas together. (i.e. the submarine in the Lego Movie... a dozen people all trying to do something different.) Having used TACACS+, RADIUS, and several other systems, TACACS+ is not perfect, but RADIUS is _significantly_ less perfect. In modern terms, I can cut it some slack... security wasn't really a big concern in that era, things like SSL/TLS hadn't been invented yet. (not that AAA traffic should be going across a remotely untrusted network.) Despite "open" and "universal", _every_ vendor did stupid proprietary shit with it. (USR worst of all! USR's vendor-specific-attributes are not RADIUS attributes, they're binary blobs.)

[@Maxtraxv3]

so they invent internet tracking... that doesn't sound great...

[@tcscomment]

...? are you talking about the "accounting" part of AAA?

[@nickwallette6201]

Not even a little bit. They invented "how long have you been online?" or "how many bytes have you transferred?" so you can be billed for services used. That's it.