The HYPR RADIUS server is created to facilitate authentication via the RADIUS protocol. The server software is a Java spring boot microservice that runs on port 9077.
Acquire a REDHAT or CENTOS 7+ server or virtual machine, port 9077 should be accessible
Acquire RADIUS WAR file from artifactory - 3.6.0 war file location (restricted to HYPR Customer Solutions): https://r.hypr.com/artifactory/hypr-maven-dev/com/hypr/server/radius-server/3.6.0/radius-server-3.6.0.war
Copy the RADIUS WAR file into the /opt/hypr directory
Acquire and copy the RADIUS shell script called radius.sh and put it into the /opt/hypr directory
Ensure that you have a running VAULT server
Ensure that you have configured a VAULT namespace
Ensure that you have a valid VAULT token
Ensure that you are on HYPR Server 3.7 or higher
Follow the below instructions on how to deploy and configure the RADIUS server
- Go to the /opt/hypr directory on your server
- Start the RADIUS server by running ./radius.sh on the command line (located in HYPRRadiusServer->run folder)
- Enter the VAULT URL
- Enter the VAULT Token
- Enter the VAULT namespace
- Verify that the startup has completed
- Navigate to http://<your_host>:9077/radius/settings or if you have NGINX or a reverse proxy configured, just go to https://<your_host>/radius/settings
- Enter the provided configuration key and move to the “Configuration Settings” instructions below!
- Set the Local RADIUS Domain to 127.0.0.1 - This is used to verify that the RADIUS server is running properly.
- Set the local RADIUS secret for testing the RADIUS server. This should be a String value.
- Set the IP Addresses and the SECRETS of the clients that you expect to connect to this RADIUS server. The RADIUS server can support multiple clients such as VPN, VDI, and SSH PAM modules with individual secret values.
- Set the RADIUS timeout, this should “60000” which is 60 seconds.
- Set the HYPR Relying Party URL - This should be the URL of your HYPR server that you have been given or deployed yourself.
Set the HYPR Relying Party App ID - This should be the app you configured in your HYPR FIDO Control Center.
Set the proxy configuration if you require a proxy to communicate from the RADIUS server to the HYPR Server itself.
- Click Submit and Restart to submit the information and restart the RADIUS server. You should see a confirmation message once the server is restarted.
The HYPR RADIUS server comes with a local RADIUS client that is web based and can be used to test the RADIUS server functionality with the configured RP. Follow these instructions to make sure that the RADIUS server is successfully authenticating users.
Go to the RADIUS server login page at https://<host_url>/radius/login on your browser
Put in the username of a previously registered user with the relying party and app ID
- Authenticate on your mobile when you receive the PUSH notification
- See that the authentication is completed on your browser
This will confirm that your local RADIUS client is working. This RADIUS client uses the 127.0.0.1 Client IP address that’s configured earlier and the local RADIUS secret as well.
Next up you should deploy your own RADIUS clients and configure your RADIUS server to work with those clients on the settings screen.
Updated about a year ago