NEW Package: freeRADIUS 2.x

Nachtfalke

Any guides on cert creation for eap-tls.

I checked:

Choose if you would like to create a client.p12 to export it to a windows client. You need this file if you use EAP-TLS.

Where do I get the cert it created?

I am using pfsense default cert manager. Not the cert manager that freeradius uses.

Here all is explained:
http://doc.pfsense.org/index.php/FreeRADIUS_2.x_package#EAP-TLS

PS: In pfsense 2.1 there will be a possibility to download a .p12 file for System -> CertManager
Jimp added this some days ago. If you gitsync your system you will have this ability.

webdawg

How stable is the gitsync?

Another thing that I was concerned about…though unrelated....

pfsense digitally signs its packages right?

The git is signed too?

Thanks for all the help.

Web

Nachtfalke

Updates pkg v1.6.5:

Replaced: old traffic counter which didn't work against two shell scripts (authentication + accounting) which now work on interim-updates and start/stop updates. (start/stop istn'working correct BECAUSE CP doesn't reset the octets between every update. Interim-Update does this)
Changed: units in GUI from bits, bytes and seconds to high and better readable values
Changed: placing all scripts (traffic counter + motp in central folder under /usr/local/etc/raddb/scripts/)
Changed: placing files and databases for time-/traffic-counter in /var/log/radacct/ This makes it possible to use them on embedded systems because of read-write access to this folders.
Updated pfsense docs

Known bugs:

When using "stop/start accounting on CP then "Amount of Time/Amount of Traffic" isn't working correctly.
http://redmine.pfsense.org/issues/2164
When using CP + RADIUS + Vouchers and "reauthenticate every minute" is enabled then CP sends the voucher as username to RADIUS. This causes RADIUS to disconnect the "user/voucher" because of an unknown/wrong "username".
http://redmine.pfsense.org/issues/2155
When stop/start accounting on CP is enabled than the syslog shows many "wrong order" or "Login found bot no logout detected". This seems to not affect the usage of RADIUS but it is not 100% correct.
http://redmine.pfsense.org/issues/2143

============================================

Don't know how stable it is.
http://doc.pfsense.org/index.php/Updating_pfSense_code_between_snapshots

This command will show you :D

pfSsh.php playback gitsync RELENG_2_0

pszafer

@Nachtfalke
I just would like to say that if you want copy content of my gdoc to freeradius/pfsense wiki, enjoy and do it ;)

Someday I wish do delete as much as possible from samba package and leave just winbindd, ntlm_auth and related necessary packages, just don't know when I'll have enough time to do it ;)

Nachtfalke

@pszafer:

@Nachtfalke
I just would like to say that if you want copy content of my gdoc to freeradius/pfsense wiki, enjoy and do it ;)

Thank you for that! Some parts of your tutorial can be done from GUI. Others need additional configuration. I added the URL to the docs. :-)

@pszafer:

Someday I wish do delete as much as possible from samba package and leave just winbindd, ntlm_auth and related necessary packages, just don't know when I'll have enough time to do it ;)

If you've done it successfully you let me know. ;) Perhaps future versions of freeradius do have (better) support for that or I will add an option in GUI to add samba package as optional setting.

webdawg

Thanks for this package.

I would like to disable the other types of EAP. How should I go about doing this? Right now I am using EAP-TLS and that is all I want to use.

What is the most secure WPA2 auth? I am thinking either EAP-TLS or EAP-TTLS. Am I right?

Like I said. Thanks for the package.

Nachtfalke

@webdawg:

Thanks for this package.

I would like to disable the other types of EAP. How should I go about doing this? Right now I am using EAP-TLS and that is all I want to use.

What is the most secure WPA2 auth? I am thinking either EAP-TLS or EAP-TTLS. Am I right?

Like I said. Thanks for the package.

If you disable "Weak EAP types" then you disable MD5, GTC and LEAP.
Then you there should only be three strong types available:

EAP-TLS which is very secure and the strongest encryption
EAP-TTLS
Protected EAP (PEAP)

EAP-TTLS and PEAP could be clasified as secure, too, but less than EAP-TLS.

Because all the three types are secure types and so I didn't implement any option in the GUI to disable them.
If you would like to disable this just go to

/usr/local/etc/raddb/eap.conf

and delete/comment the TTLS and PEAP blocks and restart freeradius.

webdawg

Thanks. I just wanted to know if that would work.

Nachtfalke

@webdawg:

Thanks. I just wanted to know if that would work.

It will unless you do not change anything in FreeRADIUS => EAP. A click on "Save" will overwrite the complete file.

qbik

What I meant for Vouchers packages is the following:
-Ability to create plans (by time or by traffic) and able to assign users to it and print those vouchers (easy part) also modify the GUI
-The problem comes when we create 2 weeks plans for example, and our DHCP lease is only a day, if the user is off for a day and someone else gets the ip he had before, he will be asked to authenticate again. Now if he has used 5 days of plan, would he now have 5 days left or since he has been authenticated he will have 2 weeks again. this is why I want to implement sqlippool to better mange the leases and prevent this from happening.

When I have a chance I will post screen shots of what I have and see where we can go from there. Also, I am trying to build an Asterisk package, could you point me on some doc you used?

Regards

@Nachtfalke:

@qbik:

Hi,
I am glad there is finally a good package for this. I had done this before by custom package building on FreeBSD with VMWare and then installing on PFsense, no GUI. I am using it on a hotel right now with 1000 rooms. I would like to contribute and share my work to contribute to a robust solution with MySQL integrated.

You are welcome!

@qbik:

There are a couple of things that I've came across and want to fix are the following:
-Implement Freeradius with sqlippool or better manage DHCP leases

I do not have much experience with *SQL databases. The basic support to connect to an *SQL database is ready and working. But you are right. I didn't take a look at sqlippool and of course if there will be GUI support for creating a custom SQL query would be really nice.
I thought of to hardcode the main part of a counter (daily, weekly,time, data) in the sqlcounter.conf and from GUI everybody can add the queries he likes.

@qbik:

-If user is authenticated for 1 day and server reboots, he has to authenticate again ( I want accounting to continue where it left off)

I don't think there is any way around - if freeradius or the NAS reboots the user has to reauthenticate. If the NAS sends "interim updates" or "start/stop" accounting updates then there will be no big accounting loss when server reboots/crashes. To get high availability you need to use more than one RADIUS server and more than one database (freeradius2 package can do failover/loadbalancing for LDAP or *SQL).
So I would be interested in what we can do on this point.

@qbik:

-Better Voucher/User GUI and printing options.

You have to explain that more in detail.

@qbik:

I'l be glad to share my work and help where I can.

Regards

As I said above - if you have any SQL ideas or something developed (sqlcounter, sqlippool, DOCUMENTATION :D ) then I really would appreciate to implement your work! :)

Nachtfalke

@qbik:

What I meant for Vouchers packages is the following:
-Ability to create plans (by time or by traffic) and able to assign users to it and print those vouchers (easy part) also modify the GUI
-The problem comes when we create 2 weeks plans for example, and our DHCP lease is only a day, if the user is off for a day and someone else gets the ip he had before, he will be asked to authenticate again. Now if he has used 5 days of plan, would he now have 5 days left or since he has been authenticated he will have 2 weeks again. this is why I want to implement sqlippool to better mange the leases and prevent this from happening.

When I have a chance I will post screen shots of what I have and see where we can go from there. Also, I am trying to build an Asterisk package, could you point me on some doc you used?

Regards

I will wait for your screenshots to better understand what you mean. Further I took a look into sqlippool and the default config seems to work as far as I can see that. You only have to import the sql.table into your database and put in some content.

A better way would be to to make CaptivePortal able to understand "Framed-IP-Address" and "Framed-IP-Netmask" and "Framed-Route" attributes. This would allow us to always assign the sam IP address to a user when authentication on CP against freeradius. So no worry about any lease times on DHCP. As far as I know the PPTP implementation on pfsense can do this.

Abou your two plans - time or traffic:

Vouchers (time): A 10 day voucher will allow the user to use the internet for 10 days after first login. Fine!
Amount of Time (freeradius): An amount of 1440min (1 day) will allow the user to use this amount when he likes. 120min on the first day. 1000min on the nex day and 320min on the fifth day. This would work like a charm IF CP would reset the "Acct-Session-Time" attribute between every "start/stop" accounting update. ermal wrote a patch which should fix that hopefully in previous versions.
Amount of time (freeradius): This is working, too, with the new "Amount of time" counter I implemented (without any sql database). When running CP accounting updates in interim-update mode this is working like a charm. If running in "start/stop" accounting THEN CP needs to handle the "Acct-X-Octets" the correct way and reset them between every update. This probably will be fixed in future versions, too. If you want to run this against an *sql database we need to create the correct query. There is no need for a GUI because we can create 4 types (daily, weekly, monthly, forever) and put this into the sqlcounter.conf

Perhaps I misunderstand something but I hope your screenshots will clarify this if I was wrong :-)

webdawg

It will unless you do not change anything in FreeRADIUS => EAP. A click on "Save" will overwrite the complete file.

Where does it pull the config from? What php file would I have to edit?

Nachtfalke

@webdawg:

It will unless you do not change anything in FreeRADIUS => EAP. A click on "Save" will overwrite the complete file.

Where does it pull the config from? What php file would I have to edit?

File to edit:

/usr/local/pkg/freeradius.inc

Function to edit:

function freeradius_eapconf_resync()

Fesoj

http://forum.pfsense.org/index.php/topic,46648.0.html

should have been posted here. mea culpa.

Nachtfalke

@Fesoj:

http://forum.pfsense.org/index.php/topic,46648.0.html

should have been posted here. mea culpa.

Fixed that. Thanks!
Shouldn't be any big problems with that except when using freeradius-cert-manager

Fesoj

Long startup time of freeradius2 with pfsense 2.0.1

I have a WLAN system based on pfSense running in a small hotel, where user access is handled by the captive portal of pfSense using freeradius2 for authentication. I am getting some complaints about not being able to get connected to the internet. The captive portal is enabled all the time.

I can to reproduce this "login" problem in the following situations:

(1) After booting, when all services are already running, pfSense does not redirect to the login page of the captive portal and the HTML request just times out.
(2) A few times, after waiting for more than 2 minutes, all of a sudden the login page is shown and subsequently everything works as expected.
(3) When changing parameters of the freeradius2 configuration (probably freeradius2 is restarting in the background), the login screen doesn't show up again.
(4) If the captive portal is enabled without using any authentication, the login screen always appears (that's why I think it could be related to freeradius2 and not the captive portal itself).

Is this a known behavior of freeradius2? In case it just takes a couple of minutes (but why does it take so long?) until the logins work, I can live with that, as regular operation doesn't require frequent restarts or rebooting. Otherwise there might be a problem, at least for my system.

Nachtfalke

@Fesoj:

Long startup time of freeradius2 with pfsense 2.0.1

I have a WLAN system based on pfSense running in a small hotel, where user access is handled by the captive portal of pfSense using freeradius2 for authentication. I am getting some complaints about not being able to get connected to the internet. The captive portal is enabled all the time.

I can to reproduce this "login" problem in the following situations:

(1) After booting, when all services are already running, pfSense does not redirect to the login page of the captive portal and the HTML request just times out.
(2) A few times, after waiting for more than 2 minutes, all of a sudden the login page is shown and subsequently everything works as expected.
(3) When changing parameters of the freeradius2 configuration (probably freeradius2 is restarting in the background), the login screen doesn't show up again.
(4) If the captive portal is enabled without using any authentication, the login screen always appears (that's why I think it could be related to freeradius2 and not the captive portal itself).

Is this a known behavior of freeradius2? In case it just takes a couple of minutes (but why does it take so long?) until the logins work, I can live with that, as regular operation doesn't require frequent restarts or rebooting. Otherwise there might be a problem, at least for my system.

Hi,

don't know why CP isn't showing up with some delay. I don't think it has something to do with freeradius2 because if you enter a wrong RADIUS IP in CP then it is the same as freeradius not responding. But I am not sure at this.

There is a longer (repeating) startup time after reinstallation of freeradius2 package because of of the recreation of the config files. There is no way around.
But you are right - the startup of freeradius2 isn't really fast but I don't know how to speed this up.

Restart of freeradius is very fast if you:
(1) add/delete a user
(2) add/delete a client
In syslog you can see the output

Hmmm…if you find some more information when or why this is happening, please let me know. I will think about that "problem".

Fesoj

Nachtfalke,

I'll keep an eye on the issue. Let me first collect more information to find out under what precise circumstances the login problem occurs. I am pretty sure that it is not the server itself as "radtest <user><user pw="">…" works immediately with a very short response time after the server is marked as running inside the gui. At the same time the client login fails (by not showing the cp login page).

There could be a delay, but it could also be a random error in the way different components interact. I need to work out a suitable test matrix to nail down the problem (booting, restarting services, login immediately or after some time period). Maybe this will give a clearer picture...</user></user>

Fesoj

Long startup time of freeradius2 with pfsense 2.0.1

Meanwhile I rebooted the pfSense2 box in question serveral times && checked the internet access after waiting at least 5 minutes. I was able to login all the time. Therefore I think that the inability to login is just a startup timing problem.

I haven't checked the exact details, but if Status->Services reports a running service, it probably just means that a pid file exists, but that doesn't mean that the service is fully available to the outside world. My box uses an Atom 510 CPU and PowerD is enabled. Besides the CP the services Squid, SquidGuard (with a rather large blacklist) and Snort (a few rules) are enabled and especially Snort uses initially a lot of CPU time after the service has started up. The combination of resource hogs and a relatively weak CPU seem to be the cause of the reported problem.

Nachtfalke

@Fesoj:

Long startup time of freeradius2 with pfsense 2.0.1

Meanwhile I rebooted the pfSense2 box in question serveral times && checked the internet access after waiting at least 5 minutes. I was able to login all the time. Therefore I think that the inability to login is just a startup timing problem.

I haven't checked the exact details, but if Status->Services reports a running service, it probably just means that a pid file exists, but that doesn't mean that the service is fully available to the outside world. My box uses an Atom 510 CPU and PowerD is enabled. Besides the CP the services Squid, SquidGard (with a rather large blacklist) and Snort (a few rules) are enabled and especially Snort uses initially a lot of CPU time after the service has started up. The combination of resource hogs and a relatively weak CPU seem to be the cause the reported problem.

The startup of freeradius2 is probably not the best way. The problem is, that some files needs to be created/changed and after this freeradius needs a restart. I can not replace the restart of freeradius after some functions because I need the restart when changing something from GUI. I am running freeradius2 package on a xeon processor and that's probably why I do not have problems with weak CPU power ;o)

PS: Sometimes the green service arrow isn't representing the actual state. If you have logging enabled you should see how often freeradius is restarting in the syslog.