NEW Package: freeRADIUS 2.x

marcelloc · Jan 18, 2012, 5:01 PM

Hi Guyd,

Can you tell me what version of pfsense you using. Mine does not have a packages option under systems and I cant load the radius option.

Thx

pfsense 2.0.1 full install x64
pfsense 2.0.1 full install i386

Metu69salemi · Jan 18, 2012, 9:28 PM

Shared secret is used between radius server and device, which is using radius server. it's another layer of security. This has nothing todo with user passwords

Nachtfalke · Jan 18, 2012, 9:54 PM

Updates pkg v1.5.4:

Added: Checks if a function or a part of it needs to be run (when disabled from GUI). This should speed up the starting process of freeradius after reboot.
Fixed: Accidentally deleted certs in ../raddb/certs/ folder after reboot when using pfSense Cert-Manager - this break freeRADIUS start until clicking save in EAP again.

=== edit ===

Fixed: call some functions after installation to initialize configuration files.

@Metu69salemi:

Shared secret is used between radius server and device, which is using radius server. it's another layer of security. This has nothing todo with user passwords

What you say is absolutly correct - in general.
Captive Portal is using the name "shared secret" on two places. In Primary RADIUS server it is used in the correct context.
In RADIUS MAC authentication it is not the correct context I would say. This is explained one line below:

If this option is enabled, the captive portal will try to authenticate users by sending their MAC address as the username and the password entered below to the RADIUS server.

Metu69salemi · Jan 18, 2012, 10:11 PM

@Nachtfalke:

Updates pkg v1.5.4:

Added: Checks if a function or a part of it needs to be run (when disabled from GUI). This should speed up the starting process of freeradius after reboot.

Fixed: Accidentally deleted certs in ../raddb/certs/ folder after reboot when using pfSense Cert-Manager - this break freeRADIUS start until clicking save in EAP again.

@Metu69salemi:

Shared secret is used between radius server and device, which is using radius server. it's another layer of security. This has nothing todo with user passwords

What you say is absolutly correct - in general.
Captive Portal is using the name "shared secret" on two places. In Primary RADIUS server it is used in the correct context.
In RADIUS MAC authentication it is not the correct context I would say. This is explained one line below:

If this option is enabled, the captive portal will try to authenticate users by sending their MAC address as the username and the password entered below to the RADIUS server.

Ok thank you for info

zlyzwy · Jan 19, 2012, 1:17 AM

Hi guys,

Thanks for all your patents and detail explanation…
To be honest, I am still not 100% understand this part, but I will need some test on it.

Can you take a look at the following questions?

@zlyzwy:

Update:
Now I can see the v1.5.3 pkg and it's great…

@Nachtfalke

I just tested with latest pkg,here comes some new questions>>
1. Plain-MAC-Auth
I followed your procedures, it doesn't work proerly. The error log is
Jan 18 19:59:40	radiusd[36524]: Login incorrect: [00-02-a5-4e-df-67] (from client CP port 210 cli 00-02-a5-4e-df-67)
I enable the PLAIN MAC AUTHORIZATION (FreeRadius–>Setting Tab), and it does solve the problem.
Jan 18 20:46:45	radiusd[63046]: Login OK: [00-02-a5-4e-df-67] (from client CP port 45 cli 00-02-a5-4e-df-67)
I don't know why but it's working anyway:)

2. Virtual machine in VMware MAC Auth
I have a small server running VMware workstation. The host computer is a windows 2003 server. It's running well until I enable the CP, I add the server's MAC to pass list and the server works as it should be,but not for the virtual server inside VM. I tired to put the VM's MAC to pass list. it's not working. I am receiving the following error from system log:
Jan 18 20:46:45	radiusd[63046]: Login OK: [00-02-a5-4e-df-67] (from client CP port 45 cli 00-02-a5-4e-df-67)
Jan 18 20:46:45	radiusd[63046]: Login OK: [00-02-a5-4e-df-67] (from client CP port 45 cli 00-02-a5-4e-df-67)
Jan 18 20:46:45	radiusd[63046]: rlm_radutmp: Login entry for NAS CP port 45 wrong order
Jan 18 20:46:45	radiusd[63046]: rlm_radutmp: Login entry for NAS CP port 45 wrong order
00-02-a5-4e-df-67 –> Host Computer
There is one strange thing, usually if my virtual server ask the outgoing traffic, there should have the log with MAC. So I can add that MAC to pass list. But I didn't see any log with that MAC.
I also tried to set "Number of simultaneous connections" to 10, no luck...

BTW: there are two virtual servers running in VMwork, one is Debian and another is PFsense itself. I am not sure if it's the reason for this issue. I think this picture will show you my network better than words.
(http://www.gliffy.com/pubdoc/2737259/L.png)

3. Maximum Download Bandwidth/Maximum Upload Bandwidth
I have a 20m/s ADSL at home. I tested with 800 bit/s and 800000bit/s. There should have a obvious difference. However they give the similar result here(around 20m/s).

I am afraid I may put too many requests here.
Many thanks for your help!
Thanks in advance!

Nachtfalke · Jan 19, 2012, 8:15 AM

@zlyzwy:

(…)
@Nachtfalke

I just tested with latest pkg,here comes some new questions>>
1. Plain-MAC-Auth
I followed your procedures, it doesn't work proerly. The error log is
Jan 18 19:59:40	radiusd[36524]: Login incorrect: [00-02-a5-4e-df-67] (from client CP port 210 cli 00-02-a5-4e-df-67)
I enable the PLAIN MAC AUTHORIZATION (FreeRadius–>Setting Tab), and it does solve the problem.
Jan 18 20:46:45	radiusd[63046]: Login OK: [00-02-a5-4e-df-67] (from client CP port 45 cli 00-02-a5-4e-df-67)
I don't know why but it's working anyway:)

First I am sorry. I didn't see that you updated your post ;-)
First it is good that Plain-MAC-Auth is working :)
Second:
Disable Plain-MAC-Auth and put this in "FreeRADIUS -> Users tab"
Username: 00-02-a5-4e-df-67
Password: (The shared secret from Captive Portal below the point "Enable MAC authorization)
Delete the entry in "FreeRADIUS -> MACs" with this MAC address: 00-02-a5-4e-df-67

Then it should work.

@zlyzwy:

2. Virtual machine in VMware MAC Auth
I have a small server running VMware workstation. The host computer is a windows 2003 server. It's running well until I enable the CP, I add the server's MAC to pass list and the server works as it should be,but not for the virtual server inside VM. I tired to put the VM's MAC to pass list. it's not working. I am receiving the following error from system log:
Jan 18 20:46:45	radiusd[63046]: Login OK: [00-02-a5-4e-df-67] (from client CP port 45 cli 00-02-a5-4e-df-67)
Jan 18 20:46:45	radiusd[63046]: Login OK: [00-02-a5-4e-df-67] (from client CP port 45 cli 00-02-a5-4e-df-67)
Jan 18 20:46:45	radiusd[63046]: rlm_radutmp: Login entry for NAS CP port 45 wrong order
Jan 18 20:46:45	radiusd[63046]: rlm_radutmp: Login entry for NAS CP port 45 wrong order
00-02-a5-4e-df-67 –> Host Computer
There is one strange thing, usually if my virtual server ask the outgoing traffic, there should have the log with MAC. So I can add that MAC to pass list. But I didn't see any log with that MAC.
I also tried to set "Number of simultaneous connections" to 10, no luck...

BTW: there are two virtual servers running in VMwork, one is Debian and another is PFsense itself. I am not sure if it's the reason for this issue. I think this picture will show you my network better than words.
(http://www.gliffy.com/pubdoc/2737259/L.png)

Uuuhh..hmm..I am out of ideas why this is happening. But to make it clear "rlm_radutmp" is containing all clients which are authorized. This is the file which checks for "Simultaneous-Use". You increased the "Simultaneous-Use" - that is what I had told you, too. Check again that there is not a double entry in "MACs" and "Users" with this MAC address: 00-02-a5-4e-df-67.

@zlyzwy:

3. Maximum Download Bandwidth/Maximum Upload Bandwidth
I have a 20m/s ADSL at home. I tested with 800 bit/s and 800000bit/s. There should have a obvious difference. However they give the similar result here(around 20m/s).

I read about this behaviour on some forum posts. It has something to do with that CP is only changing bandwidth for users which authenticate new. It doesn't change this for existing connections.
When I tested this at home I found out that you have to enable "Bandwidth Limits" on CP first. You can enter a value but if you set a setting on FreeRADIUS then the value of the CP will be overwritten (that's what we want). And then I am not sure if there is the same bug in this function as with "amount of traffic". The traffic which goes through CP is for example 1MB but accounting will tell RADIUS that there are 6MB. Not sure if this affects Bandwidth Limits in any way, too.
So I am sorry but I could not tell you where the problem for Bandwidth Limits is. Need to test this more and find out which checkboxes on CP I need to enable and which services needs to be restartet.

@zlyzwy:

I am afraid I may put too many requests here.
Many thanks for your help!

Thats no problem - for me :-)

pszafer · Jan 19, 2012, 11:54 AM

do You have any other materials about freeradius and AD without samba?
I cannot find anything else and trully I am tired of doing same thing again and again and don't have chance to get it working properly :/

Nachtfalke · Jan 19, 2012, 1:55 PM

@pszafer:

do You have any other materials about freeradius and AD without samba?
I cannot find anything else and trully I am tired of doing same thing again and again and don't have chance to get it working properly :/

I am sorry. I don't have any how-tos or tutorial and I do not have access to any AD :(

But correct me if I am wrong: You got it working with PAP ?
If yes, can you please write down what you have configured - I would like to add it to the pfsense docs so this could be a basis for someone else who wants to try this - or for further if freeradius adds better support for connecting to an AD.

zlyzwy · Jan 19, 2012, 4:03 PM

@Nachtfalke

First I am sorry. I didn't see that you updated your post ;-)
First it is good that Plain-MAC-Auth is working
Second:
Disable Plain-MAC-Auth and put this in "FreeRADIUS -> Users tab"
Username: 00-02-a5-4e-df-67
Password: (The shared secret from Captive Portal below the point "Enable MAC authorization)
Delete the entry in "FreeRADIUS -> MACs" with this MAC address: 00-02-a5-4e-df-67

Then it should work.

I confirm this works.:) Nice~~

Uuuhh..hmm..I am out of ideas why this is happening. But to make it clear "rlm_radutmp" is containing all clients which are authorized. This is the file which checks for "Simultaneous-Use". You increased the "Simultaneous-Use" - that is what I had told you, too. Check again that there is not a double entry in "MACs" and "Users" with this MAC address: 00-02-a5-4e-df-67.

I am sure there is only one MAC for one record. I also tried to remove all the record and just put server's MAC to list. The result is the same– only host can access the Internet, vm machine can't.
I have an idea for this issue, because my host server and VM_debian are actually using one physical network card (VM is directly bridged on host). FreeRadius recognize there are two clients using the same MAC to get passed? Of course, this is only my guess.
But if this is correct, 'simultaneous connections' should solve the problem if I set the value as '2'.. :(
I google with the error log, very little information...

I read about this behaviour on some forum posts. It has something to do with that CP is only changing bandwidth for users which authenticate new. It doesn't change this for existing connections.
When I tested this at home I found out that you have to enable "Bandwidth Limits" on CP first. You can enter a value but if you set a setting on FreeRADIUS then the value of the CP will be overwritten (that's what we want). And then I am not sure if there is the same bug in this function as with "amount of traffic". The traffic which goes through CP is for example 1MB but accounting will tell RADIUS that there are 6MB. Not sure if this affects Bandwidth Limits in any way, too.
So I am sorry but I could not tell you where the problem for Bandwidth Limits is. Need to test this more and find out which checkboxes on CP I need to enable and which services needs to be restartet.

I did a quick test on your point. Basically the 'Bandwidth Limits' in CP works.
For FreeRadius's bandwidth limits, it does not always override the setting in CP. Usually CP's setting will override FreeRadius.

I am afraid I have little time today and these testings may not complete.

In next a couple of days, I can't access my PF box so I will not do any more testing… But I would like to continue this topic later.

Thanks && have a nice day:)

Nachtfalke · Jan 19, 2012, 7:24 PM

@zlyzwy

As far as I know in VMware Workstation you are able to change the MAC address of every interface. So you could try to change/check if all interfaces have different MACs.

To make sure that freeradius does not have old entries, delete the file:

rm /var/log/radutmp

Bandwidth Limits:
I think I cannot do anything against this. freeRADIUS is sending the correct attributes and CP recognizes these attributes but the problem seems to be deeper in the CP code (QoS) and so on. ( I had a very short conversation on mailing-lists about that with ermal).

We will see :)

Nachtfalke · Jan 19, 2012, 11:03 PM

Updates pkg v1.5.5:

Added/Fixed: We are now able to use the "Amount of Download/Upload/Time" limits as intended. There are some problems between CP and "rlm_acct_unique module in freeradius. I added an option in "FreeRADIUS -> Settings" to disable this module. Then the counter work as they should."
Updated: FreeRADIUS documentation (counters)

zlyzwy · Jan 20, 2012, 5:42 AM

@Nachtfalke:

@zlyzwy

As far as I know in VMware Workstation you are able to change the MAC address of every interface. So you could try to change/check if all interfaces have different MACs.

To make sure that freeradius does not have old entries, delete the file:
rm /var/log/radutmp
We will see :)

@Nachtfalke

There are two kinds of network connection method in VM : Bridged, NAT and host only.
I am now using Bridged on host and VM_Debian. Their MACs are:
Host : 00-02-a5-4e-df-67
VM_Debian:00-0c-29-ee-88-30
The host's MAC is also the physical MAC.
I found the FreeRaius can only accept one client. It will always be the lastest one who refresh the network settings.
In windows it's

ipconfig/renew

In Debian it's

/etc/init.d/networking restart

I changed the debian's MAC to be the same as host, but no lucky.
Tried to put Debian's MAC to pass list, no lucky…

I am running out of idea for this issue... I have the feeling this should be the problem of FreeRadius not CP.
I am ready to post this question to FreeRadius Mail list...This is the only free support method I found for FreeRadius...
(I may need to mention this topic in the mail. Will that bring you any inconvenience?)

About bandwidth, I think I may try to do it in Firewall. But just thinking about it....

BTW: I tried to configure the PF in remote, it seems to be as good as local..

Nachtfalke · Jan 20, 2012, 7:11 AM

You can post your question where you want and you can point to this thread if you want. I do not have a problem with that.
But I do not think that RADIUS is the problem. The RADIUS is only doing what the NAS (CP) is telling.

The problem could be perhaps the NAS Port sent in the Access-Request. If both Access-Request do have the same attribute-values.
Try radiusd in debug mode (radiusd -X) and compare the Access-Request when connection with one and then with the other VM.

zlyzwy · Jan 20, 2012, 3:04 PM

@Nachtfalke:

You can post your question where you want and you can point to this thread if you want. I do not have a problem with that.
But I do not think that RADIUS is the problem. The RADIUS is only doing what the NAS (CP) is telling.

I think you are right. It's not the problem of FreeRadius. I change the auth method to local database. The error is the same. I am sorry I was wrong.
Even I sent mail to FreeRadius list, they don't think it's about VM and it should be something about PF.

The problem could be perhaps the NAS Port sent in the Access-Request. If both Access-Request do have the same attribute-values.
Try radiusd in debug mode (radiusd -X) and compare the Access-Request when connection with one and then with the other VM.

In fact, I can't control who between VM and host will login successful first. Once it was working with refresh the network interface but I just tried several times. It doesn't work.

I am going to post this question in CP and hope there is some solution for this..

Many thanks for your help!

filip_pag · Jan 21, 2012, 2:11 PM

hi,
i have a problem, i have pfsense that have:
LAN card(172.16.0.1) with DHCP turned on(172.16.3.1-172.16.6.250), where PC-s are connected.
WAN conenction, configurated as pppoe(dynamic IP)
from packadges there are:
squid
lightsquid
ntop
freeradius2

i did everything by this video:
http://www.youtube.com/watch?v=B6Hjxd1Af-s

in freeradius2:
for Client IP Address i put my LAN card address(172.16.0.1)
for Client IP Address (for port 1812,1813) i put also my LAN card address

in captive portal:
Primary RADIUS server IP address i put 172.16.0.1
RADIUS NAS IP attribute also 172.16.0.1

but every time when i tried to authentificate by username and password i gave, authentification
page appears again.

Nachtfalke · Jan 21, 2012, 2:51 PM

@filip_pag:

hi,
i have a problem, i have pfsense that have:
LAN card(172.16.0.1) with DHCP turned on(172.16.3.1-172.16.6.250), where PC-s are connected.
WAN conenction, configurated as pppoe(dynamic IP)
from packadges there are:
squid
lightsquid
ntop
freeradius2

i did everything by this video:
http://www.youtube.com/watch?v=B6Hjxd1Af-s

in freeradius2:
for Client IP Address i put my LAN card address(172.16.0.1)
for Client IP Address (for port 1812,1813) i put also my LAN card address

in captive portal:
Primary RADIUS server IP address i put 172.16.0.1
RADIUS NAS IP attribute also 172.16.0.1

but every time when i tried to authentificate by username and password i gave, authentification
page appears again.

Hi,

that is no problem of freeradius.
Check System Logs and make sure that thre is "Login OK" for the username. Then authentication from CP user is working.

The redirection problm is another one - as far as i know. Try this:
Configure DHCP on LAN interface.
DNS Server is pfsense LAN interface (172.16.0.1). The client must use this DNS as first DNS.

If this doesn't work search the forum for captivportal and redirection

osvaldotcf · Jan 23, 2012, 3:09 AM

Auth with EAP (TLS + TTLS) with dynamic VLAN

I wonder if this is the case for configure a specific VLAN to a specific IP that would be passed from freeradius for a NAS with a encryted conection using AES.

Is there any test?

Nachtfalke · Jan 23, 2012, 7:40 AM

@osvaldotcf:

Auth with EAP (TLS + TTLS) with dynamic VLAN
(…)

I think you found this in the pfsense docs, right ?

It means that a Client which is connected with EAP-TLS or EAP-TTLS will be put in a specific VLAN which RADIUS tells it.
VLAN attributes can be sent from FreeRADIUS - that is working - but when using TLS or TTLS than we need to send the reply attribute tunneled. This can be configured via "FreeRADIUS -> EAP" on GUI.
In general this should work - but I could not test this till now.

Dynamic VLAN assignment for the NAS does mean that the NAS gets the VLAN attributes from the RADIUS server and than changes the state of the port on NAS. This must be supported by the NAS.

I hope this is what you asked !?

osvaldotcf · Jan 23, 2012, 1:36 PM

Thank you.
I set up a test environment.

Nachtfalke · Jan 24, 2012, 8:56 PM

Updates pkg v1.5.6:

Fixed: typos in description (interfaces, users, macs)
Fixed: syntax error in additional check-items (users,macs)
Added: GUI TLS support for LDAP