Jun 15, 2026 · 8 min read · Virtualization

How to Install and Setup a FreeRADIUS Server on Raspberry Pi 5

This guide covers preparing the environment, installing FreeRADIUS, configuring the server, and testing the setup for optimal performance.

Prerequisites

Ensure you have the following prerequisites ready before initializing deployment:

A Raspberry Pi 5 running Raspberry Pi OS (64-bit).
Sudo administrative privileges enabled on the user profile.
A stable local area network connection.

Step-by-Step Installation and Configuration

⚠️ Switch to Root Environment

All commands in this guide must be run inside an isolated root shell environment. Before initializing configuration, switch to root using the following command (enter your current user password when prompted):

sudo -i

Alternatively, if the root account itself is unlocked, you can use this command instead (requires entering the root account password):

su -

1. Install FreeRADIUS

Install the core FreeRADIUS service package using the package manager:

apt install freeradius

2. Verify Service Status

Check the initial initialization status of the daemon service to ensure it installed correctly:

systemctl status freeradius.service

If the service is not active, start it using:

systemctl start freeradius.service

Enable the service to start automatically on boot:

systemctl enable freeradius.service

root@raspberrypi:/etc/freeradius/3.0# systemctl status freeradius.service                                                  
● freeradius.service - FreeRADIUS multi-protocol policy server
     Loaded: loaded (/usr/lib/systemd/system/freeradius.service; enabled; preset: enabled)
     Active: active (running) since Tue 2026-06-23 07:19:28 BST; 4h 34min ago
 Invocation: 676ac481a3e349a89050b95cd0157347
       Docs: man:radiusd(8)
             man:radiusd.conf(5)
             http://wiki.freeradius.org/
             http://networkradius.com/doc/
    Process: 3082 ExecStartPre=/usr/sbin/freeradius $FREERADIUS_OPTIONS -Cx -lstdout (code=exited, status=0/SUCCESS)
   Main PID: 3085 (freeradius)
     Status: "Processing requests"
      Tasks: 65:245m (limit: 9626)
        CPU: 1.901s
     CGroup: /system.slice/freeradius.service
             └─5:245m3085 /usr/sbin/freeradius -f

Jun 23 07:19:28 raspberrypi freeradius[3082]: Compiling Post-Auth-Type Challenge for attr Post-Auth-Type
Jun 23 07:19:28 raspberrypi freeradius[3082]: Compiling Post-Auth-Type Client-Lost for attr Post-Auth-Type
Jun 23 07:19:28 raspberrypi freeradius[3082]: Compiling Auth-Type PAP for attr Auth-Type
Jun 23 07:19:28 raspberrypi freeradius[3082]: Compiling Auth-Type CHAP for attr Auth-Type
Jun 23 07:19:28 raspberrypi freeradius[3082]: Compiling Auth-Type MS-CHAP for attr Auth-Type
Jun 23 07:19:28 raspberrypi freeradius[3082]:  # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/3.0/>
Jun 23 07:19:28 raspberrypi freeradius[3082]: Compiling Post-Auth-Type REJECT for attr Post-Auth-Type
Jun 23 07:19:28 raspberrypi freeradius[3082]: radiusd: #### Skipping IP addresses and Ports ####
Jun 23 07:19:28 raspberrypi freeradius[3082]: Configuration appears to be OK
Jun 23 07:19:28 raspberrypi systemd[1]: Started freeradius.service - FreeRADIUS multi-protocol policy server.

Output 1: Terminal verification showing active and running service state.

3. Generate Security Certificates

Navigate to the certificates directory and run the Makefile to generate default SSL/TLS test certificates:

cd /etc/freeradius/3.0/certs/
make

After running the command, you should see output indicating that the certificates have been generated successfully. The default certificates will be located in the certs/ directory.

++++++++++++++++++++++++*.......+........+.+......+..+............+.+........+...............+.......+............+...+...+
..+.......+....................+.......+.....+................+.........+...+...+.....+.........+......+..........+..+.+...
...........+......+.+.........+.....+.......+...+...........+...+.......+.....+...+......+.+.........+.....+....+...+..+...
.......+.....+.............+..+...+..........+...+.....+.........+......+......+..........+.....+...............+.+..+.+...
........+...+...+....+...+......+......+........+.......+.....+.+..+...+....+...........+...+....+...+...+...........+....+
......+...+..+...+......+....+...+..+..........++++++
-----
chmod g+r client.key
openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr  -key 'whatever' -out client.crt -extensions xpclient_ext -ex
tfile xpextensions -config ./client.cnf
Using configuration from ./client.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 2 (0x2)
        Validity
            Not Before: Jun 23 05:34:00 2026 GMT
            Not After : Aug 22 05:34:00 2026 GMT
        Subject:
            countryName               = FR
            stateOrProvinceName       = Radius
            organizationName          = Example Inc.
            commonName                = user@example.org
            emailAddress              = user@example.org
        X509v3 extensions:
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://www.example.com/example_ca.crl

Certificate is to be certified until Aug 22 05:34:00 2026 GMT (60 days)

Write out database with 1 new entries
Database updated
openssl pkcs12 -export -in client.crt -inkey client.key -out client.p12  -passin pass:'whatever' -passout pass:'whatever'
chmod g+r client.p12
cp client.p12 'user@example.org'.p12
openssl pkcs12 -in client.p12 -out client.pem -passin pass:'whatever' -passout pass:'whatever'
chmod g+r client.pem
cp client.pem 'user@example.org'.pem

Output 2: Client Certificate Generation Partial Logs

4. Configure EAP Authentication Profile

Open the EAP file, and ensure the target paths match your certificate structures:

cd /etc/freeradius/3.0/
nano mods-enabled/eap

Add or Modify the following certificate variable bindings inside the eap module block:

ca_file = ${cadir}/ca.pem
certificate_file = ${certdir}/server.pem
private_key_file = ${certdir}/server.key

5. Fix Directory Security Permissions

Recursively fix owner and group assignments across the certificates layout directory to secure access privileges:

chown -R root:freerad certs/

6. Restart Service Instance

Apply security permission modifications directly by executing a background service restart:

systemctl restart freeradius.service

7. Define Authorized Network Hardware Clients

Open the network client definitions config file to add network access hardware entry listings:

nano clients.conf

Append the following hardware block definition syntax structures at the bottom of the file layout:

client my_router {
        ipaddr = 192.168.0.1
        secret = "rpifreerad"
}

Note: Make sure to replace 192.168.0.1 with the actual IP address of your wireless router or network access point device.

Note on Shared Secret: You should create a strong, secure secret key to replace rpifreerad. This identical secret key must also be configured inside your router's RADIUS settings menu so it can communicate with the server.

8. Populate Local Users Database

Open the users credentials database config file to register authenticated profile endpoints:

nano users

Create the test identity profile tracking ruleset parameter row strings directly inside the file:

rpifreeraduser Cleartext-Password := "rpifreeradpwd"

Note: Replace rpifreeraduser and rpifreeradpwd with your desired username and password values for testing authentication.

9. Apply Client and User Profiles

Restart the application server to load the newly registered router configurations and user authentication profiles:

systemctl restart freeradius.service

10. Enable Server Authentication Logging

Open the main server configuration layout to update authentication tracking activity adjustments:

nano radiusd.conf

Ensure authentication logging metrics recording parameter values are explicitly turned on inside the log settings structural section:

log {
        auth = yes
}

root@raspberrypi:/etc/freeradius/3.0# tail -f /var/log/freeradius/radius.log                                               
Tue Jun 23 07:19:28 2026 : Info: Ready to process requests
Tue Jun 23 07:19:41 2026 : Auth: (9)   Login OK: [rpifreeraduser] (from client my_router port 0 via TLS tunnel)
Tue Jun 23 07:19:41 2026 : Auth: (10) Login OK: [rpifreeraduser] (from client my_router port 1 cli 5C-F3-70-DB-E9-B1)
Tue Jun 23 07:20:07 2026 : Auth: (19)   Login incorrect (mschap: MS-CHAP2-Response is incorrect): [rpifreeraduser] (from cl
ient my_router port 0 via TLS tunnel)

Output 3: Live tail logs detailing successful and rejected profile validation handshakes.

11. Complete System Setup

Commit all outstanding security, networking, and user validation changes into active operational memory structures:

systemctl restart freeradius.service

Wireless Router Configuration Guide

To finalize your setup, log into your wireless router's administrator web interface, navigate to the Wireless Security settings, change the security mode to WPA2/WPA3-Enterprise (or RADIUS), and fill out the configuration fields using your specific infrastructure parameters:

RADIUS Server IP Address: Enter the local IP address of your Raspberry Pi 5 running the FreeRADIUS server (you can check this on the Pi using the hostname -I command).
Shared Secret / Key: Enter the matching secret passkey you defined inside your server's clients.conf file (for example: rpifreerad).
Authentication Port: Enter 1812 (this is the standard default network UDP port FreeRADIUS uses for handling access authorization tokens).

Conclusion

With these steps, you should have a functional FreeRADIUS server running on your Raspberry Pi 5. This setup can be further expanded with additional modules, database backends, and custom authentication methods as needed for your specific use case.