NEW Package: freeRADIUS 2.x
-
@Nachtfalke
if you see that library there and it is not seen by ldconfig just run:ldconfig -m /usr/local/lib/mysql/
Unfortunately ldconfig doesn't run recursively…
Hi,
this worked - unfortunately only until reboot.
Is this perhaps of write protection of pfsense ?
Or is there a possibility to make this "permanent" ? I don't want to put this into the rc_start_file. -
you need to edit rc.conf file,
just type:cat /etc/defaults/rc.conf | grep ldconfigand you should figure out what to do ;)
-
You can check and Fix it via freeradius.inc file if you do not whant to change system files
-
Updates pkg v1.5.0
-
Fixed: loading rlm_sql_mysql.so module after reboot (Thanks: pszafer + marcelloc)
-
Fixed: XMLRPC sync for MACs
-
Fixed: restart of service when adding MACs
-
Modfied: handling of cert-managers in GUI
-
-
I'm trying to get LDAP working but I'm getting the following output:
[ldap] ldap_search() failed: Operations error [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns fail Invalid user: [USER/PASSW]Does anyone know why this is happening? When I manually do an ldap search with another program with the same user I do get a result back.
you didn't give anything about your config, but I'll try guess:
If you have MS AD try to filter:
(sAMAccountName=%{mschap:User-Name})
otherwise maybe:
(uid=%{mschap:User-Name})I don't know if you have your Identity configured properly, show it for us
Hi,
I googled a little bit around for some of the errors:
Did you:
Enable Active Directory support in LDAP GUI ? You should enable this if there is "operations error".
http://freeradius.1045715.n5.nabble.com/Ldap-search-and-AD-operations-error-td2787134.htmlPerhaps try with "ldasearch:
ldapsearch -v -h <ad server=""> -D "cn= <account to="" bind="">dc=ad, dc=hud, dc=ac, dc=uk" -w <password> -x -b "dc=ad, dc=hud, dc=ac, dc=uk" "(sAMAccountName=mytestusername)"</password></account></ad>Perhaps it can help if you change
/usr/local/etc/raddb/modules/papand enable this:
auto_header = yesPerhaps this mini how-to will help us with kerberos and AD
http://lists.cistron.nl/pipermail/freeradius-devel/2006-January/009250.htmlI hope you'll find a solution :D
-
hello, I have PAP fully working (wpa_suplicant get connected to wlan), no lucky with any EAP.
I'm thinking and want to have your opinion, what is better:- MS-CHAPv2?
- certificates?
- both?
is it possible to get certificates auth working via Kerberos?
I'm thinking I'm misunderstaning how this certificates working ;) -
hello, I have PAP fully working (wpa_suplicant get connected to wlan), no lucky with any EAP.
I'm thinking and want to have your opinion, what is better:- MS-CHAPv2?
- certificates?
- both?
is it possible to get certificates auth working via Kerberos?
I'm thinking I'm misunderstaning how this certificates working ;)Hi,
To use PEAP (Protected EAP) with MSCHAPv2 is workinh using MAC OS X, Ubuntu, Android, Windows XP (I tested this today).
To configure that you don't have to change anything on freeradius2 EAP. Just add a user with username an password.On WLAN-AP (I used DD-WRT) you have to enable WPA Enterprise or WPA2 Enterprise. Then you have to enter th IP of the RADIUS server and the shared secret.
The IP of the WLAN AP and the shared secret you have to enter on freeradius NAS/Clients.On the client you can should then choose PEAP and MSCHAPv2. You will be prompted to accept the CA-Certificate of the freeradius server.
Than you will be prompted for a username and password - thats the one you entered in freeradius2 users.Than all should work. But this is only authorization with username/password. It is NOT TLS or TTLS. TLS means, that the client-certificate (client on your WLAN PC) hast to be valid with the CA on the freeradius server. I didn't get this work today, but I think there are some options on freeradius2 EAP GUI missing. I will check this.
The most secure thing would be to use certificates and username/password together.
If the username/password combination isn't to easy then I don't think that there is a big difference between using ONLY certs or ONLY user/pw.PS: Check the pfsense docs for "FreeRADIUS 2.x package" - there are two documentations with screenshots. Perhaps this will help you. One is in german but really good screenshots.
And I will check additional options in EAP pulldown menues like MD5, TLS, TTLS and so on. But the freeradius configuration is rare configuration hints…as far as I could see this.
Any news on LDAP + AD ?
What/where do you mean to use "Kerberos auth with certificates" ? -
ok, it's simplier that I thought.
Because I wanna to my AD Win Server 2008 to be CA, but I can just copy CA certificate to the pfSense freeradius, so nevermind about kerberos and certs ;)I'll try to test everything you suggested as soon as possible, but it could be monday or tuesday because I had some new PC's in work and it would take some time to configure them
-
ok, it's simplier that I thought.
Because I wanna to my AD Win Server 2008 to be CA, but I can just copy CA certificate to the pfSense freeradius, so nevermind about kerberos and certs ;)I'll try to test everything you suggested as soon as possible, but it could be monday or tuesday because I had some new PC's in work and it would take some time to configure them
Hey, no stress :D
Your feedback is great and testing is good :D
All what we could test and what is working will be put into the pfsense docs.
Perhaps in the next week I will find some time to try with my colleague (linuy geek) to setup MySQL and OpenLDAP ans test both with freeradius2.Further I will add some new EAP types to the package.
-
Updates pkg v1.5.1
-
Added: additional eap.conf options (fragment size, include_length, enable cache)
-
Added: More authentication protocls and methods based on the follwoing links:
http://hostap.epitest.fi/wpa_supplicant/
http://freeradius.org/features/eap.html
-
-
Hi,
Anyone use SQL function？ Does it work now？
I tried it here，but it's still not working but I did see a lot of new options.
One more question, is there any log I can analyse what's wrong with SQL? I checked with system log and /var/log/radius.log. There is no information.
Many thanks for your great work!
ZLYZWY
-
Hi,
Anyone use SQL function？ Does it work now？
I tried it here，but it's still not working but I did see a lot of new options.
One more question, is there any log I can analyse what's wrong with SQL? I checked with system log and /var/log/radius.log. There is no information.
Many thanks for your great work!
ZLYZWY
Hi zlyzwy,
MySQL and PostgreSQL should work. FreeRADIUS is compiled with these modules and the bug with the missing lib after areboot should be fixed (only MySQL). Of course, if you enable SQL but FreeRADIUS could not connect to the database, the service fails and freeradius stops. MySQL connection error is displayed fast. PostgreSQL takes ~30-60s to fail - if not connectable to a database.
If you want to debug output of RADIUS and SQL, then do all the configs from GUI and after you did that, stop the service, connect with SSH to your pfsense and then type:radiusd -XThis is debugging mode. There you will get all output. You can post it here if neccessary. Perhaps we can help.
-
Hi Nachtfalke,
Really thanks for such a quick reply~~
here is the output for debug:
# radiusd -X FreeRADIUS Version 2.1.12, for host i386-portbld-freebsd8.1, built on Jan 3 201 2 at 23:44:16 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/clients.conf /usr/local/etc/raddb/clients.conf[2]: Expecting section start brace '{' after "c lient PF" Errors reading /usr/local/etc/raddb/radiusd.confCan you help to analyse the error?
UPDATE
I can read sql.conf file from web interface. here is the output:/usr/local/etc/raddb/sql.conf sql { database = "mysql" driver = "rlm_sql_${database}" server = "IP" port = 3306 login = "xxx" password = "XXX" radius_db = "radius" acct_table1 = "radacct" acct_table2 = "radacct" postauth_table = "radpostauth" authcheck_table = "radcheck" authreply_table = "radreply" groupcheck_table = "radgroupcheck" groupreply_table = "radgroupreply" usergroup_table = "radusergroup" read_groups = yes deletestalesessions = yes sqltrace = yes sqltracefile = ${logdir}/sqltrace.sql num_sql_socks = 5 connect_failure_retry_delay = 60 lifetime = 0 max_queries = 0 readclients = yes nas_table = "nas" $INCLUDE sql/${database}/dialup.conf } sql sql2 { database = "mysql" driver = "rlm_sql_${database}" server = "localhost" port = 3306 login = "radius" password = "radpass" radius_db = "radius" acct_table1 = "radacct" acct_table2 = "radacct" postauth_table = "radpostauth" authcheck_table = "radcheck" authreply_table = "radreply" groupcheck_table = "radgroupcheck" groupreply_table = "radgroupreply" usergroup_table = "radusergroup" read_groups = yes deletestalesessions = yes sqltrace = no sqltracefile = ${logdir}/sqltrace.sql num_sql_socks = 5 connect_failure_retry_delay = 60 lifetime = 0 max_queries = 0 readclients = yes nas_table = "nas" $INCLUDE sql/${database}/dialup.conf }I create a database in MySQL named "radius". That's all my settings.
Should I create the tables first, if yes, then what's the structure of these tables? -
On the client you can should then choose PEAP and MSCHAPv2. You will be prompted to accept the CA-Certificate of the freeradius server.
Than you will be prompted for a username and password - thats the one you entered in freeradius2 users.Thats fine for non-domain computers but as the network link isn't established before logon, network scripts can't be executed nor 'll they be able to logon.
-
On the client you can should then choose PEAP and MSCHAPv2. You will be prompted to accept the CA-Certificate of the freeradius server.
Than you will be prompted for a username and password - thats the one you entered in freeradius2 users.Thats fine for non-domain computers but as the network link isn't established before logon, network scripts can't be executed nor 'll they be able to logon.
Then you have to create a "Computer logon" which will be executed before user logon:
http://pcloadletter.co.uk/2011/07/11/cisco-wifi-active-directory-auth/ -
I downloaded the FreeRadius's package and there are some *.sql for mysql. I run the script and it did create some tables.
About the error can't export the debug info, I solve it by re-install the package.
Then I run the debug again, here is the info about SQL.
(Full log here:http://pastebin.com/rSi3xWra)Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /usr/local/etc/raddb/sql.conf sql { driver = "rlm_sql_mysql" server = "192.168.1.25" port = "3306" login = "radius" password = "radpass" radius_db = "radius" read_groups = yes sqltrace = yes sqltracefile = "/var/log/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@192.168.1.25:3306/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Released sql socket id: 4Still the same problem, no matter what I did in web setting, there is no log MySQL. :(
=================================================================================================
Just a quick update:
Now I think there is some progress, I can see the log in MySQL.Table radpostauth
1 test test123 Access-Accept 2012-01-15 22:42:55I am going to test more with Captive Portal.
:)))
-
Did you solve the probem in "clients.conf" ? There was an error because of an open brace "{". This shouldn't happen if you create the clients from the GUI.
The log output you posted on pastebin shows the "probem":
Failed binding to authentication address * port 1812: Address already in use /usr/local/etc/raddb/radiusd.conf[36]: Error binding to port for 0.0.0.0 port 1812This is happening if you start the freeradius service from GUI than it is listening on the auth port. If you then start it again on console with "radiusd -X" than the service gets startet two times. So first stop the service from GUI or kill it from console with
killall -9 radiusdOnly if there is no other radiusd service running, start it in debug mode from GUI with "radiusd -X"
MySQL:
You have to create the MySQL database by hand and you have to create the tables and you have to put the data into the tables. FreeRADIUS is only reading the table (authentication). The SQL GUI shows you the default names of the tables. If you choose other table names you have to correct this in the web GUI.On pfsense there are several example .sql files. I don't know the exxact path at the moment because I do not have access to any pfsense.
Try to search the files with:
find / -iname "*.sql*"There are the tables for MySQL, PostgreSQL and so on. If you open the tables with an editor (vi) than there is explained how the table should look like and for what you should use it.
Here you can see how to import the example freeradius .sql structure into your database:
http://wiki.freeradius.org/SQL-HOWTO#Create+MySQL+Database–--- edit -----
Some more information about MySQL database creation:
http://www.howtoforge.com/setting-up-a-freeradius-based-aaa-server-with-mysql-and-management-with-daloradius -
Did you solve the probem in "clients.conf" ? There was an error because of an open brace "{". This shouldn't happen if you create the clients from the GUI.
I always create the client from the GUI. I am sure I can solve it by remove all the clients from GUI and add the clients again.
This is happening when I upgrade/re-install the package.=========================================================================
By entering the debug mode, I also find the problem. Do the following step in console will be all right.
1.```
service radiusd stop2\.``` Radiusd -XThe debug is really useful~~
=========================================================================
I must prepare the database first. The SQL script can be found at latest Freeradius release.
(freeradius-server-2.1.12\raddb\sql\mysql) -
Updates pkg v1.5.2:
-
Added: "Amount of Time" and "Amount of Traffic" per user connected through captive portal and freeradius2
-
Updated: FreeRADIUS 2.x package on pfSense documentation
-
-
I tried to upgrade package to v1.5.2 and it get stuck at "Loading package instructions…"