3
radius server at home? (sh.itjust.works)
submitted 1 year ago by to c/selfhosted@sh.itjust.works
2 comments fedilink hide all child comments
 

I'm considering playing with WPA3 at home and it looks like most of my stuff will but just fine with it, but I need to set up a radius server. How do self-hosters typically go about this? Is there a package or docker container or openWRT addon that people normally use?

you are viewing a single comment's thread
view the rest of the comments
[–] [B] 1 point 3 weeks ago

The usual route for home WPA-Enterprise is FreeRADIUS — you don't need a full package on the router, a small container is enough:

  • freeradius/freeradius-server docker image works fine for a handful of clients. Bind it to a fixed IP or use host networking (RADIUS uses UDP 1812/1813 and some APs are picky about source IP), then point your AP's RADIUS auth/acct at it with the shared secret.
  • Minimum config: put your AP in clients.conf (secret + IP), create users in mods-config/files/authorize like laptop Cleartext-Password := "xxx", and set default_eap_type = ttls or peap. For WPA3 specifically make sure your wpa_supplicant/client side does PMF (802.11w, required), the RADIUS side doesn't care — it's just EAP.
  • Certificates: EAP needs a server cert. Easiest is to run the built-in bootstrap script once (generates a self-signed CA + server cert), then trust the CA on your clients. Phone/laptop clients will complain once until you install the CA.
  • Gotchas: run the container with -X (debug) the first time — the log tells you exactly which EAP stage fails; and WPA3-SAE mixed with Enterprise modes confuses some AP firmware, so pick "WPA2/WPA3-Enterprise" as a combined mode if offered.
  • If you'd rather not run a server at all: some AP firmware (OpenWrt with hostapd + ucode, or UniFi) supports iPSK (per-device pre-shared keys) which gets you most of the benefit of per-user credentials without RADIUS. Worth checking before committing to the EAP cert dance.

Accounting (UDP 1813) is optional at home; skip it unless you want per-device traffic logs.

  • permalink
  • fedilink
  • source
    •