Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NEW Package: freeRADIUS 2.x

    Scheduled Pinned Locked Moved pfSense Packages
    628 Posts 80 Posters 762.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      Nachtfalke
      last edited by

      @valshare:

      (…)
      is missing in the default file. If have made the change in freeradius.inc on line 1212 and pushed on "save" in the ldap settings and restartet the server.

      So after you made the changes on line 1212 the above entry is there, correct ?

      And without the changes on this line 1212 you cannot authenticate a user ?

      Can you post the complete output of radiusd -X when authenticationg with and without the freeradius.inc changes ?
      delete passwords. Perhaps we can find another way to work around this entry just from GUI.

      1 Reply Last reply Reply Quote 0
      • V
        valshare
        last edited by

        @Nachtfalke:

        @valshare:

        (…)
        is missing in the default file. If have made the change in freeradius.inc on line 1212 and pushed on "save" in the ldap settings and restartet the server.

        So after you made the changes on line 1212 the above entry is there, correct ?

        no, there are no changes in the default file.

        1 Reply Last reply Reply Quote 0
        • N
          Nachtfalke
          last edited by

          Use the attached file (freeradius.inc), copy it to /usr/local/pkg and then got to
          FreeRADIUS => LDAP => Save

          Check before in FreeRADIUS => View config => virtual-server-default

          PS: Did it work with the "DEFAULT" entries from webGUI in FreeRADIUS => Users ?

          Thanks

          freeradius.inc.txt

          1 Reply Last reply Reply Quote 0
          • V
            valshare
            last edited by

            Hi,

            i have copied your file in the right place and set the rights to 755.
            Go to Services => LDAP => pushed the save button

            View the config => virtual-server-default

            but it changed nothing :(

            checked it with the console:

            
            [2.0.1-RELEASE][root@pfsense.xxx.local]/usr/local/pkg(220): cat freeradius.inc | grep hot
                    $varmodulesldapenableauthenticate = "Auth-Type LDAP {" . "\n\t\t\tldap" . "\n\t\t\tif (LDAP-Group == " . '"hotspot") {' . "\n\t\t\t\tnoop" . "\n\t\t\t}" . "\n\t\t\telse {" . "\n\t\t\t\treject" . "\n\t\t\t}" . "\n\t\t\t$varmodulesldap2enableauthenticate" . "\n\t}";
            [2.0.1-RELEASE][root@pfsense.xxx.local]/usr/local/pkg(221): cat /usr/local/etc/raddb/sites-available/default | grep hot
            [2.0.1-RELEASE][root@pfsense.xxx.local]/usr/local/pkg(222):
            
            

            sorry, but what can i do wrong?

            1 Reply Last reply Reply Quote 0
            • N
              Nachtfalke
              last edited by

              @valshare:

              Hi,

              i have copied your file in the right place and set the rights to 755.
              Go to Services => LDAP => pushed the save button

              View the config => virtual-server-default

              but it changed nothing :(

              checked it with the console:

              
              [2.0.1-RELEASE][root@pfsense.xxx.local]/usr/local/pkg(220): cat freeradius.inc | grep hot
                      $varmodulesldapenableauthenticate = "Auth-Type LDAP {" . "\n\t\t\tldap" . "\n\t\t\tif (LDAP-Group == " . '"hotspot") {' . "\n\t\t\t\tnoop" . "\n\t\t\t}" . "\n\t\t\telse {" . "\n\t\t\t\treject" . "\n\t\t\t}" . "\n\t\t\t$varmodulesldap2enableauthenticate" . "\n\t}";
              [2.0.1-RELEASE][root@pfsense.xxx.local]/usr/local/pkg(221): cat /usr/local/etc/raddb/sites-available/default | grep hot
              [2.0.1-RELEASE][root@pfsense.xxx.local]/usr/local/pkg(222):
              
              

              sorry, but what can i do wrong?

              did you rename it from freeradius.inc.txt to freeradius.inc ?
              For me it is working.

              Auth-Type LDAP {
              			ldap
              			if (LDAP-Group == "hotspot") {
              				noop
              			}
              			else {
              				reject
              			}
              			#ldap2
              	}
              
              1 Reply Last reply Reply Quote 0
              • V
                valshare
                last edited by

                yes, i have rename the freeradius.inc.txt file to freeradius.inc as you can see in the code.
                grep found the change you have made. I will try it again later.

                strange  ??? But big thnx for your support.

                1 Reply Last reply Reply Quote 0
                • E
                  etudiant_22
                  last edited by

                  Bonjour,

                  je fais pars de mon problème dans ce forum en espérant que quelqu'un puisse m'aider.

                  J'ai donc installé et configuré pfsense et plus précisément le portail captif pour que lorsque que des clients wifi de mon réseau veulent se conecter, il leur faut insérer leur login et mot de passe.

                  Avec les compte sur la base local tout marche bien.

                  Maintenant je voudrai mettre en place freeradius (le package de pfsense), et c'est la que je bloque.

                  • Je créer un utilisateur dans la base local de radius pour tester.
                  • J'active l'authentification radius dans le service portail captif et la quand j
                  • Je lance mon navigateur web
                  • je rentre le login et mot de passe  et la j'ai ce message :

                  No valid RADIUS responses received

                  Merci d'avance

                  1 Reply Last reply Reply Quote 0
                  • marcellocM
                    marcelloc
                    last edited by

                    etudiant_22,

                    I know you love your mother language but please translate your question to english or post it on french forum.

                    Cordialement,

                    Marcello Coutinho

                    Treinamentos de Elite: http://sys-squad.com

                    Help a community developer! ;D

                    1 Reply Last reply Reply Quote 0
                    • N
                      Nachtfalke
                      last edited by

                      @etudiant_22:

                      Bonjour,

                      je fais pars de mon problème dans ce forum en espérant que quelqu'un puisse m'aider.

                      J'ai donc installé et configuré pfsense et plus précisément le portail captif pour que lorsque que des clients wifi de mon réseau veulent se conecter, il leur faut insérer leur login et mot de passe.

                      Avec les compte sur la base local tout marche bien.

                      Maintenant je voudrai mettre en place freeradius (le package de pfsense), et c'est la que je bloque.

                      • Je créer un utilisateur dans la base local de radius pour tester.
                      • J'active l'authentification radius dans le service portail captif et la quand j
                      • Je lance mon navigateur web
                      • je rentre le login et mot de passe  et la j'ai ce message :

                      No valid RADIUS responses received

                      Merci d'avance

                      That's google translated - cool ;o)

                      "salut
                      jetez un oeil à la documentation du paquet
                      http://doc.pfsense.org/index.php/FreeRADIUS_2.x_package"

                      1 Reply Last reply Reply Quote 0
                      • N
                        Nachtfalke
                        last edited by

                        Updates pkg v1.6.0:

                        • Added: Ability to set individual redirection URL after login per user/mac

                        Known bugs:

                        • When using "stop/start accounting on CP then "Amount of Time" isn't working correctly.
                          http://redmine.pfsense.org/issues/2164

                        • When using CP + RADIUS + Vouchers and "reauthenticate every minute" is enabled then CP sends the voucher as username to RADIUS. This causes RADIUS to disconnect the "user/voucher" because of an unknown/wrong "username".
                          http://redmine.pfsense.org/issues/2155

                        • When stop/start accounting on CP is enabled than the syslog shows many "wrong order" or "Login found bot no logout detected". This seems to not affect the usage of RADIUS but it is not 100% correct.
                          http://redmine.pfsense.org/issues/2143

                        1 Reply Last reply Reply Quote 0
                        • N
                          Nachtfalke
                          last edited by

                          Updates pkg v1.6.1:

                          • Added: custom logging options for syslog output. We can now see the remaining time, download volume, max bandwidth

                          • Updated: freeradius 2.x package documentation

                          Known bugs:

                          • When using "stop/start accounting on CP then "Amount of Time" isn't working correctly.
                            http://redmine.pfsense.org/issues/2164

                          • When using CP + RADIUS + Vouchers and "reauthenticate every minute" is enabled then CP sends the voucher as username to RADIUS. This causes RADIUS to disconnect the "user/voucher" because of an unknown/wrong "username".
                            http://redmine.pfsense.org/issues/2155

                          • When stop/start accounting on CP is enabled than the syslog shows many "wrong order" or "Login found bot no logout detected". This seems to not affect the usage of RADIUS but it is not 100% correct.
                            http://redmine.pfsense.org/issues/2143

                          1 Reply Last reply Reply Quote 0
                          • F
                            filip_pag
                            last edited by

                            Hello,

                            i have freeradius2 and client name "ted", he has god IP address 172.16.3.1 in freeradius, and in DHCP server he has got static IP binded to his MAC address of device A. I want to enable "ted" to connect with his device B. Do I have to create another account in freeradius or: in DHCP server i bind his device B MAC address to another IP address(172.16.3.2) and add 172.16.3.2 to "ted" IP range?

                            1 Reply Last reply Reply Quote 0
                            • N
                              Nachtfalke
                              last edited by

                              @filip_pag:

                              Hello,

                              i have freeradius2 and client name "ted", he has god IP address 172.16.3.1 in freeradius, and in DHCP server he has got static IP binded to his MAC address of device A. I want to enable "ted" to connect with his device B. Do I have to create another account in freeradius or: in DHCP server i bind his device B MAC address to another IP address(172.16.3.2) and add 172.16.3.2 to "ted" IP range?

                              Hi,

                              this post is a little bit confusing - for me.

                              You need just one entry with "ted" in FreeRADIUS => Users.
                              If you want FreeRADIUS to assign an client an IP address then the NAS must support that. pfsense (NAS) does not support that - as far as I know.

                              1 Reply Last reply Reply Quote 0
                              • F
                                filip_pag
                                last edited by

                                i want to do this
                                http://imageshack.us/photo/my-images/831/freeradius.png/
                                that ted can connect only by his iPhone and iPod

                                1 Reply Last reply Reply Quote 0
                                • N
                                  Nachtfalke
                                  last edited by

                                  @filip_pag:

                                  i want to do this
                                  http://imageshack.us/photo/my-images/831/freeradius.png/
                                  that ted can connect only by his iPhone and iPod

                                  HI,

                                  create a user on freeradius with username "ted" or whatever you like and a password for this user.

                                  Forget about "Framed-IP-Address" on FreeRADIUS GUI. pfSense DHCP server does not understand this if FreeRADIUS sends "Framed-IP-Address".
                                  Just add two static mappings on DHCP for the iphone MAC and another one for the iPad MAC. The one with 172.16.3.1 and the other with 172.16.3.2
                                  The IP address is independent from the configuration you do on FreeRADIUS.

                                  What freeradius is doing in your screenshot is only the following:
                                  iPad connects to wifi
                                  wifi demands a username/password from iPad user
                                  iPad user enters "ted" and the password
                                  wifi checks this username/password against FreeRADIUS
                                  FreeRADIUS sends an "Access-Accept" if credentials are correct or "Access-Reject" if credentials are wrong

                                  Then the iPad has access to the network and the DHCP server offers the IP address to iPad.

                                  1 Reply Last reply Reply Quote 0
                                  • F
                                    filip_pag
                                    last edited by

                                    understand but,

                                    I create static IP 172.16.3.1 binded to MAC,
                                    and i added framed IP 172.16.3.1 to teds account.

                                    from another PC, static IP 172.16.3.6 that has binded its MAC
                                    I tried to connect with teds account and freeradius disconects me,
                                    think that it works, can I add 2 framed IP-s to one freeradius user account?

                                    1 Reply Last reply Reply Quote 0
                                    • N
                                      Nachtfalke
                                      last edited by

                                      @filip_pag:

                                      understand but,

                                      I create static IP 172.16.3.1 binded to MAC,
                                      and i added framed IP 172.16.3.1 to teds account.

                                      from another PC, static IP 172.16.3.6 that has binded its MAC
                                      I tried to connect with teds account and freeradius disconects me,
                                      think that it works, can I add 2 framed IP-s to one freeradius user account?

                                      The disconnection is probably not because of the IP address but because of "Simultaneous-Use" settings. Leave this field empty or set it to 2 or higher.

                                      Further post the syslog output.

                                      I don't think that a user can have two IPs….Try with "172.17.3.1+" which gives the next IP to a user which is free if 172.16.3.1 is in use.

                                      1 Reply Last reply Reply Quote 0
                                      • C
                                        Cino
                                        last edited by

                                        Nachtfalke

                                        I meant to report this a while ago, but your probably already know this. Everytime I reboot my box, i see these errors on the console,see attachment. Its not hurting anything from what I can tell.

                                        Stephen

                                        freeradius2.jpg
                                        freeradius2.jpg_thumb

                                        1 Reply Last reply Reply Quote 0
                                        • N
                                          Nachtfalke
                                          last edited by

                                          @Cino:

                                          Nachtfalke

                                          I meant to report this a while ago, but your probably already know this. Everytime I reboot my box, i see these errors on the console,see attachment. Its not hurting anything from what I can tell.

                                          Stephen

                                          Hi,

                                          do you have "Plain MAC Auth" enabled or disabled ?
                                          Do you have these two files after the "errors" when you boot up pfsense ?

                                          
                                          /usr/local/etc/raddb/files.backup
                                          /usr/local/etc/raddb/policy.conf.backup
                                          
                                          

                                          –--- edit -----
                                          @cino:
                                          I couldn't find any post from you on the last 5 pages - and if there was one - I missed it ;-)

                                          Ich checked here at home with "Plain MAC Auth" enabled and disabled and rebooted - no problems.
                                          In general - after package installation - freeradius2 creates a backup of the following files:

                                          
                                          /usr/local/etc/raddb/modules/files
                                          to
                                          /usr/local/etc/raddb/files.backup
                                          and
                                          /usr/local/etc/raddb/policy.conf
                                          to
                                          /usr/local/etc/raddb/policy.conf.backup
                                          
                                          

                                          Because when enabling Plain MAC Auth these files will be overwritten and to make sure we can get back the original one I made the backups after package installation.

                                          Perhaps try with a reinstallation on freeradius2 package and then the files should be there. If not it is not a problem but post back - then I will have a closer look at this.

                                          Thanks for feedback :-)

                                          1 Reply Last reply Reply Quote 0
                                          • N
                                            Nachtfalke
                                            last edited by

                                            @Nachtfalke:

                                            Updates pkg v1.6.2:

                                            • Added: Support for one-time-paasswords. Implemented an open source solution which can be used from many mobile devices (iPhone, Android, BlackBerry, …)

                                            • Updated: freeradius 2.x package documentation

                                            Known bugs:

                                            • When using "stop/start accounting on CP then "Amount of Time" isn't working correctly.
                                              http://redmine.pfsense.org/issues/2164

                                            • When using CP + RADIUS + Vouchers and "reauthenticate every minute" is enabled then CP sends the voucher as username to RADIUS. This causes RADIUS to disconnect the "user/voucher" because of an unknown/wrong "username".
                                              http://redmine.pfsense.org/issues/2155

                                            • When stop/start accounting on CP is enabled than the syslog shows many "wrong order" or "Login found bot no logout detected". This seems to not affect the usage of RADIUS but it is not 100% correct.
                                              http://redmine.pfsense.org/issues/2143

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.