This image is Intended for authorization on Wi-Fi devices using MS Active Directory accounts using EAP MSCHAP.

Checklist for correct operation and Long Uptime:

According to the DNS record of the corresponding FQDN variable, a domain controller, or many controllers, must be available on the network.
In Active Directory, create a group containing users or groups of users who are allowed to authorize using the service. The group name is passed to the ACCESS_GROUP variable.
The password for authorizing Wi-Fi devices on the radius server is set in the RADIUS_SECRET variable, a device with any IP address will gain access to the service.
Pass in the TZ variable the time zone corresponding to the time zone of the domain controller.
In Active Directory, create a user with the rights to add a computer to the domain and able to read the list of groups and users. User credentials are specified in the KRB_LOGIN and KRB_PASS variables.

Features

1. Custom SSL keys

By default, SSL certificates and keys are generated each time the container is started. If there is a need for permanent certificates, generate certificates in any available way and mount them inside when starting the container, passing the path inside the container to the SSL_CERT_PATH, SSL_KEY_PATH, SSL_CA_PATH, DH_PATH variables.

2. Two factor authorization via the MAC address.

Two modes can be set via the MODE variable: PEAP and PEAP-AND-MAC. Default set PEAP.
Create a file containing a line-by-line list of MAC addresses of devices that are allowed authorization Example:
```
00-00-00-00-00-01
00-00-00-00-00-02
00-00-00-00-00-03
```
Mount the file inside the container at startup Example: -v $ (pwd) /mac:/etc/freeradius/3.0/authorized_macs
you can set the variable MAC_LIST_PATH indicating the path to the file containing the list of mac addresses inside the container. (Default: /etc/freeradius/3.0/authorized_macs)

docker run -itd \
   -p 1812:1812/udp \
   -p 1813:1813/udp \
   -e HOSTNAME=PC \
   -e FQDN=EXAMPLE.COM \
   -e FQDN_SHORT=EXAMPLE \
   -e ACCESS_GROUP="radiuswifi" \
   -e RADIUS_SECRET="SECRET" \
   -e TZ="Europe/Moscow" \
   -e KRB_LOGIN="AD_USER" \
   -e KRB_PASS="AD_PASSWORD" \
   -e MODE=PEAP-AND-MAC \
   -v $(pwd)/authorized_macs:/etc/freeradius/3.0/authorized_macs \
   ratelbee/docker-radius-mschap

Example of Docker Compose File

version: '3.8'
services:
   radius:
      image: ratelbee/docker-radius-mschap
      ports:
         - 1812:1812/udp
         - 1813:1813/udp
      env_file:
         - ./var.env
      volume: 
         - ./authorized_macs:/etc/freeradius/3.0/authorized_macs
      restart: always

Required Variables

HOSTNAME=PC
FQDN=EXAMPLE.COM
FQDN_SHORT=EXAMPLE
ACCESS_GROUP=radiuswifi
RADIUS_SECRET=SECRET
TZ=Europe/Moscow
KRB_LOGIN=AD_USER
KRB_PASS=AD_PASSWORD

Other Variables

SSL_CERT_PATH="/etc/ssl/certs/ssl-cert-snakeoil.pem"
SSL_KEY_PATH="/etc/ssl/private/ssl-cert-snakeoil.key"
SSL_CA_PATH="/etc/ssl/certs/ca-certificates.crt"
DH_PATH="/etc/freeradius/3.0/certs/dh"
MODE=PEAP-AND-MAC
MAC_LIST_PATH=/etc/freeradius/3.0/authorized_macs