# Tutorial

Step-by-step guides: quick start, license registration, securing your server and common setup recipes.

# Quick Start Guide

From a fresh installation to the first subscriber online, step by step. Each step links to the detailed help.

1. **Install and log in.** Install the server, set network and time zone, log in and change the admin password. See the Installation chapter.
2. **Register the license.** See [Registering Your License](https://help.snono-systems.com/books/sas-radius/page/registering-your-license).
3. **Basic settings.** In *Settings → general settings* set currency and time zone; in *Settings → sites* your company name and logo; in *Settings → advanced* check *User Idle Timeout* (2–3 times your router's interim interval).
4. **Add your router.** *NAS → Actions → New*: name, IP address, shared secret, type *Mikrotik*, version *Mikrotik 6.36 or higher*, Incoming (COA) Port *1700*.
5. **Configure the router.** On the MikroTik: 
    
    ```
    /radius add service=ppp,hotspot address=SAS_IP secret=SECRET timeout=3000ms
    /radius incoming set accept=yes port=1700
    /ppp aaa set use-radius=yes accounting=yes interim-update=1m
    ```
    
    Disable MS-CHAP on the PPPoE server and create the IP pools you will use in profiles.
6. **Create profiles.** *Profiles → profiles list → New*: name, price, speed, duration (Limit Expiration ON), pool name. Optionally create an *Expired* profile for expired users.
7. **Create managers** (optional). Create permission groups in *Settings → permission groups*, then resellers in *Managers → New*, and give them balance with *Deposit*.
8. **Create a user.** *Users → Users List → Actions → New*: username, password, profile.
9. **Activate the user.** *Actions → Activate*, payment method *Manager Balance*.
10. **Connect.** Configure the username and password on the subscriber's router (PPPoE). The user appears in *Users → Online Users*.
11. **If the user can't connect**, check *Log → User Auth Log* for the reason.
12. **Protect your data.** Set up daily backups (*Settings → backup*) and see [Securing Your Server](https://help.snono-systems.com/books/sas-radius/page/securing-your-server).

# Registering Your License

Every SAS Radius server needs a license. The license decides how many users you can have and which add-ons are included. You register it in the Snono client portal using your server's **Hardware ID**.

## 1. Copy the Hardware ID from SAS Radius

1. Log in to your SAS Radius panel.
2. Open *Settings → license*.
3. Copy the **Hardware ID**.

## 2. Register the license in the client portal

1. Log in to the Snono client portal: [client.snono-systems.com](https://client.snono-systems.com/) (create an account if you don't have one).
2. Go to **My Products → License**.
3. Click **Add Product**, then **Register License**.
4. Paste the **Hardware ID** you copied from SAS Radius and complete the registration.

## 3. Check the license in SAS Radius

1. In SAS Radius, open *Settings → license* again and click **Reload License**.
2. The status should be **Active**, with your number of users.

- The server must be able to reach `license.snono.systems` on the internet at all times.
- Reinstalling or changing the server hardware can change the Hardware ID; contact Snono support to move the license.
- When the license is not active, only system administrators can log in.

# Securing Your Server

Your SAS Radius server holds your customers' data and controls your network. Follow these recommendations.

## Accounts

- Change the default `admin` password right after installation, and the server console passwords.
- Give each staff member and reseller their own manager account with the smallest permission group they need.
- Enable **two-factor authentication** for administrators (account menu → Profile → 2FA Setup).
- Use *Enforce Manager Password Strength*, login captcha and *Block manager login after login fails* (Settings → general settings / web).
- Give permissions marked *(Dangerous!)* only to trusted staff.

## Network

- Allow incoming traffic only where needed: RADIUS (UDP 1812/1813) from your routers, the web panel (80/443) from your offices or VPN.
- **Don't expose SSH to the internet.** If remote SSH access is needed, allow it only from known addresses and use keys instead of passwords.
- Allow outgoing traffic, at least to `license.snono.systems` and the update servers.
- Use HTTPS with a valid certificate for the panel and user portal.

## Data

- Enable daily backups to a separate disk and Google Drive, and download a copy regularly.
- Install SAS Radius updates (*Tools → System Update*).
- Review the *System Log* for unexpected logins or *security/violation* events.

<p class="callout warning">If the server shows unusual high CPU or unknown processes, it may be compromised. Contact Snono support immediately and don't reboot or delete anything before evidence is collected.</p>

# Common Setup Recipes

Short guides for frequent tasks. Each links to the detailed pages.

<table id="bkmrk-i-want-to%E2%80%A6how-let-ex"><thead><tr><th>I want to…</th><th>How</th></tr></thead><tbody><tr><td>Let expired users reach a renewal page instead of being rejected</td><td>Create an Expired profile (type FUP, Limit Expiration OFF, own pool) and set it as *Expired Next Profile*. See *Setting Up Expired Users* (Profiles).</td></tr><tr><td>Slow users down after a quota instead of cutting them off</td><td>Use *Quota Next Profile*. See *Setting Up FUP* (Profiles).</td></tr><tr><td>Give free night traffic</td><td>Add a Time-Based Policy with target *Accounting* 0%. See *Time-Based Policies*.</td></tr><tr><td>Sell extra GB or a free 2-day extension</td><td>Create an Extension profile. See *Extension Packages*.</td></tr><tr><td>Compensate all users after an outage</td><td>Bulk Changes → *Increase Expiration (Days)*, or Compensations for an approval workflow.</td></tr><tr><td>Sell through resellers</td><td>Create managers, set prices in the *Pricing List*, and deposit balance.</td></tr><tr><td>Sell prepaid cards in shops</td><td>Generate refill cards, design and print them. See the Cards System chapter.</td></tr><tr><td>Let resellers top up online</td><td>Enable a payment gateway with *Enable Managers Deposits*. See *Payment Gateways Settings*.</td></tr><tr><td>Find out why a user can't connect</td><td>*Log → User Auth Log*. See *User Auth Log and Login Errors*.</td></tr><tr><td>Fix expired users that stay online</td><td>Check the Disconnect/CoA configuration on the router. Also, make sure Limit Expiration is enabled in the profile and that the system timezone and database server time are properly synchronized.</td></tr><tr><td>Send all subscribers a message</td><td>*Tools → Announcements*.</td></tr><tr><td>Brand the panel for a partner</td><td>*Settings → sites*.</td></tr></tbody></table>