MonsterOps logo MonsterOps
Docs / RADIUS / Realms & Authentication

Realms & Authentication

Overview

The Realms module does two related jobs:

  1. RADIUS proxy — route requests for a realm (e.g. @partner.net) to a home server or server pool elsewhere, instead of authenticating them locally. MonsterOps generates FreeRADIUS proxy.conf and hot-applies it.
  2. Per-realm authentication — decide how each realm's subscribers are authenticated: with a password MonsterOps owns, or against Active Directory.

Where things are

  • Home Servers / Pools / Realms — CRUD for the proxy topology. A realm points at a home server or a pool; a pool groups home servers for failover/load-balancing.
  • NAS Group → realm routing — send requests from a set of NAS devices to a given realm.
  • Realm health — badges from Status-Server probes tell you whether each home server is answering.
  • Authentication tab — for each realm, pick the method:
  • Local password — MonsterOps owns each subscriber's password (any protocol, works offline). It can optionally sync the user list from Active Directory. No server-side setup.
  • Directory-delegated — subscribers log in with their real AD password, verified live against a Domain Controller via winbind / ntlm_auth. This needs the RADIUS host joined to the domain — a one-time, root-level step run outside the UI (deploy/provision-ad.sh). Delegated realm rows show a host: ready / needs join badge; click it for the exact command and per-check status.

Common tasks

  • Proxy a realm to a partner — add the home server(s), (optionally) a pool, then a realm that targets them; route the right NAS group to it.
  • Authenticate a realm against AD — set the realm's method to Directory-delegated, join the host to the domain, then map AD groups to plans.
  • Sync users from AD but keep local passwords — use Local password with the AD user-list sync.

Problems you may hit

Delegated auth rejects with Auth-Type NTLM-Auth

The host isn't joined to the domain, or winbind/ntlm_auth can't reach a Domain Controller. Check the realm's host: needs join badge and run the join step. The full walkthrough — prerequisites, the domain join, verification, group mapping, and this exact error — is in the Active Directory guide in the repository.

Never run the domain join casually

Joining the host to a domain changes system auth (nsswitch, PAM, winbind). Do it deliberately, on the intended host, with the documented provider-ad.sh step — not by hand mid-incident.

  • Proxied realm times out — the home server is down or the shared secret between proxies is wrong; check the realm health badge and the Logs.
  • Changes to proxy config don't take — MonsterOps writes proxy.conf and reloads; confirm the path in Configuration (MONSTEROPS_FREERADIUS_PROXY_CONF) matches your FreeRADIUS install.