GreenRADIUS RadSec Configuration

This guide explains how to configure GreenRADIUS for RADIUS integrations that use RadSec (RADIUS over TLS).

Requirements

• GreenRADIUS v6.1.13.13 or later
• Shell access using an account with sudo permission
• The RADIUS integration supports RadSec and can connect to GreenRADIUS on TCP port 2083

Step 1: Open the RadSec Port on the GreenRADIUS Host

Configure the Container Port Mapping

For containerized deployments, configure the port mapping in the applicable override file:

• Docker: /home/gradmin/grs-docker-compose/docker-compose.override.yml
• Podman: /home/gradmin/grs-docker-compose/podman-compose.override.yml

Download the RadSec Docker Compose configuration ZIP file and extract it. The ZIP file contains docker-compose.override.yml, which you can use as a reference when updating your configuration.

In the existing override file, add the following port mapping to the GRS-FREERADIUS service under services. Preserve the other service settings and any existing port mappings.

services:
  GRS-FREERADIUS:
    ports:
      - "2083:2083/tcp"

The example above shows only the relevant section. If services, GRS-FREERADIUS, or ports already exists, add the mapping under the existing keys.

Apply the updated configuration using the Compose startup command for your deployment, including the same base and override files used when the containers were deployed. For a Docker deployment that uses the standard GreenRADIUS Compose files, run:

cd /home/gradmin/grs-docker-compose
sudo docker-compose -f docker-compose.yml -f docker-compose.override.yml -f docker-compose.override-tz.yml up -d

For Podman, use your deployment's corresponding Compose startup command and override files. Applying the port change recreates the affected container and can briefly interrupt RADIUS authentication.

Update the Firewall Rules

Allow inbound traffic on TCP port 2083 from the RadSec client through the host firewall and any applicable network firewall or cloud security rules.

For OVA deployments, run:

sudo ufw allow 2083/tcp

Step 2: Prepare the CA and Client Certificates

Prepare a Certificate Authority (CA) certificate and a client certificate issued by that CA. You can use tools such as XCA or OpenSSL. The certificates must include the following extensions.

CA Certificate Requirements

Client Certificate Requirements

Step 3: Enable RadSec in Global Configuration

In the GreenRADIUS web admin interface, navigate to Global Configuration > RadSec Configuration.

1. Set Enable RadSec (RADIUS over TLS) to Yes.
2. Set Require Client Certificate for TLS Authentication to Yes.
3. Configure the external CA certificate and client certificate prepared in Step 2.
4. Save the configuration.

Step 4: Configure the GreenRADIUS Server Certificate

Navigate to Global Configuration > Certificate and configure a new server certificate for GreenRADIUS.

The server certificate must include TLS Web Server Authentication in its Extended Key Usage. GreenRADIUS v6.1.13.13 and later includes this extension in newly generated certificates and requires it for uploaded certificates when RadSec is enabled.

If you upload a server certificate instead of generating one in GreenRADIUS, ensure that it includes this extension.

Step 5: Configure the RADIUS Client

Create a Client-based authentication policy for the RADIUS integration with the following settings:

Configure any additional authentication policy settings required for the integration, and save the policy.

Note: If RadSec is disabled in Global Configuration when the policy is saved, a link appears to the RadSec configuration page. RadSec must be enabled there for the integration to use it.