The install genuinely takes about a minute. But a fresh FreeRADIUS authenticates nobody — no switch, no access point, no user exists yet. This guide does the install and then the three short steps that turn it into a working login server.
RADIUS is the quiet gatekeeper behind office WiFi logins, 802.1X switch ports and VPN sign-ins: the device asks the server, and the server says yes or no. FreeRADIUS on Ubuntu is the standard free way to run that gatekeeper. Below is the full honest path — install, first client, first user, and a local test with radtest — so that when you point a real access point at it, the first real login already works.
This really is the one-minute part. Two packages give you the server and the testing tools, and Ubuntu starts the service on its own.
sudo apt updatesudo apt install -y freeradius freeradius-utilssudo systemctl status freeradius — it should show active (running)sudo ss -lunp | grep 1812 — UDP 1812 is authentication, UDP 1813 is accountingAll configuration lives in one place: /etc/freeradius/3.0/. You will mainly touch two files there — clients.conf and users.
A RADIUS server trusts nothing by default. Your switch, access point or VPN box is called a client (also called a NAS), and it must be registered with its IP address and a shared secret — a password both sides know. Open sudo nano /etc/freeradius/3.0/clients.conf and add a block like this at the end:
client office-ap {ipaddr = 192.168.1.10 — the IP of your access point or switchsecret = MyStrongSecret42 — use your own long, random secret; this one is only an exampleshortname = office-ap then close with }The same secret must later be typed into the access point itself. If the two do not match exactly, the server silently ignores the device — no error, just nothing.
Now give the server somebody to authenticate. Open sudo nano /etc/freeradius/3.0/users and add this line at the top of the file, because FreeRADIUS reads this file top to bottom and the first match wins:
testuser Cleartext-Password := "TestPass123"sudo freeradius -C — it must end with Configuration appears to be OKsudo systemctl restart freeradiusPlain-text test users are perfect for proving the setup works. For a real office you will later connect FreeRADIUS to your existing user database or Active Directory instead of keeping passwords in this file.
Never test a new RADIUS server by pointing real users at it. The radtest tool sends one fake login from the server itself, using the built-in localhost client whose default secret is testing123:
radtest testuser TestPass123 localhost 0 testing123Only after this local test passes should you configure the same username, server IP and shared secret on your access point or switch and try a real login.
The complete setup on a real Ubuntu server — install, first client, first user and the live test, all shown step by step in the video.
▶️ Watch Full VideoThe installation is — two apt commands and the service is running. But a default install has no real clients and no real users, so it cannot log anybody in yet. Adding one client, one user and passing a radtest test takes a few more minutes, and only then is the setup actually finished.
UDP 1812 carries authentication — the yes or no login decisions. UDP 1813 carries accounting — records of who logged in, when the session started and stopped, and how much data moved. Most small setups configure authentication first and add accounting when they want login history.
Because the FreeRADIUS package ships with a built-in client entry for localhost whose secret is testing123. That secret is only for testing on the server itself. Every real device — switch, access point, VPN box — must get its own client entry in clients.conf with its own strong secret.