Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NEW Package: freeRADIUS 2.x

    Scheduled Pinned Locked Moved pfSense Packages
    628 Posts 80 Posters 829.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      Nachtfalke
      last edited by

      @Fesoj:

      Nachtfalke,

      when you say "…and after this freeradius needs a restart" does that mean the freeradius process gets killed and restarted quite frequently, especially after new users have been added?

      When adding/deleting a users it is absolutly essential to restart the freeradius service. But it is not killed (killall -9) it gets restarted (/usr/local/etc/rc.d/radiusd onerestart)
      It is further essential if you add a client, and interface, change eap settings, change SQL or LDAP settings. It is simple essential after all changes you are doing. There ist no way around - this is the way freeradius2 works  :)

      1 Reply Last reply Reply Quote 0
      • F
        Fesoj
        last edited by

        I just looked at radiusd.c and before doing anything else gets done the configuration files are read and this is the only place where read_mainconfig() gets called (and not at later times again triggered by a signal as is done in dnsmasq). The executable is small and there are only a few small local files to read, so restarting shouldn't take a lot of time. Also I do not see any problems when new users are added, only after starting the box (I still need to verify under which conditions restarting of freeradius and/or other services cause the login problems).

        Tomorrow I'll restart the pfSense box again a few times and try to access the internet within the first 30 seconds after the box has signalled that it is ready. Meanwhile I also have a second box prepared with an older single core AMD CPU, so I can study the behavior of freeradius2 without having the Snort and the Squid stuff installed (just in case these packages slow down the entire system) and then see what happens if I add these packages again.

        Currently I tend to think that an Atom based system needs probably about 2 minutes until it is usable if many resource hungry packages are installed.

        1 Reply Last reply Reply Quote 0
        • F
          Fesoj
          last edited by

          Maybe the problem of not being able to log in is not at all related to freeRADIUS2. The PortalAuth log has the following entries whenever I restart the Squid/SquidGuard daemons:

          Feb 29 20:03:45 squid[15693]: Squid Parent: child process 16200 exited with status 0
          Feb 29 20:03:48 squid[30849]: Squid Parent: child process 31376 started
          Feb 29 20:04:03 squid[31376]: The url_rewriter helpers are crashing too rapidly, need help!
          Feb 29 20:04:03 squid[30849]: Squid Parent: child process 31376 exited due to signal 6
          Feb 29 20:04:06 squid[30849]: Squid Parent: child process 53720 started

          I searched for the url_rewriter problem, but I did not find a real solution. This message seems to show up quite frequently, so it could just be a bogus message.

          1 Reply Last reply Reply Quote 0
          • F
            Fesoj
            last edited by

            Somewhere else somebody suggested to check the db files of SquidGuard when SquidGuard is having problems. I did it and got:

            [2.0.1-RELEASE][admin@pfsense2.bridge]/var/db/squidGuard/blk_BL_aggressive(40): /usr/local/bin/db42/db_verify domains.db
            db_verify: Page 1: out-of-order key at entry 2
            db_verify: Page 1: out-of-order key at entry 4
            db_verify: Page 1: out-of-order key at entry 6
            db_verify: Page 1: out-of-order key at entry 10
            …
            db_verify: DB->verify: domains.db: DB_VERIFY_BAD: Database verification failed

            The files urls.db are ok, but all the domains.db files failed. Downloading the black list again and letting the system rebuild the database does not help.

            Does somebody know whether one needs to worry about this?

            1 Reply Last reply Reply Quote 0
            • N
              Nachtfalke
              last edited by

              @Fesoj:

              Somewhere else somebody suggested to check the db files of SquidGuard when SquidGuard is having problems. I did it and got:

              [2.0.1-RELEASE][admin@pfsense2.bridge]/var/db/squidGuard/blk_BL_aggressive(40): /usr/local/bin/db42/db_verify domains.db
              db_verify: Page 1: out-of-order key at entry 2
              db_verify: Page 1: out-of-order key at entry 4
              db_verify: Page 1: out-of-order key at entry 6
              db_verify: Page 1: out-of-order key at entry 10
              …
              db_verify: DB->verify: domains.db: DB_VERIFY_BAD: Database verification failed

              The files urls.db are ok, but all the domains.db files failed. Downloading the black list again and letting the system rebuild the database does not help.

              Does somebody know whether one needs to worry about this?

              I got the same error when checking another domains.db on my machine. But I don't think this is really related to freeradius2 and this thread  ;)

              1 Reply Last reply Reply Quote 0
              • F
                Fesoj
                last edited by

                I got the same error when checking another domains.db on my machine. But I don't think this is really related to freeradius2 and this thread

                In my case I called db_verify on an system with SquidGuard running. This might not be the best idea. Before I'll continue I need to do some mandatory reading on Berkeley DBs. So far I know that db_verify doesn't acquire any locks, but SquidGuard might. In that case the error messages could be bogus.

                … but now it's time to go home.

                1 Reply Last reply Reply Quote 0
                • S
                  saye
                  last edited by

                  Hi
                  I am running 2.0.1 64 bit and this issue of not starting freeradius2 is still exist.

                  I really would like to know is there any fix of this bug in close future?

                  I know that the great pfsense team are working on 2.1 release but some features of pfsense may excel brilliant over other UTMs and will broaden its popularity.
                  Thus as a matter of fact I should say that this feature of pfSense( authenticating via a radius server for large number of users ) and also synchronizing pfsense and authenticating pfsense users via windows radius and then adding some parameters( such as time quota) that windows radius will miss is a great idea that I swear will be one of best features of pfsense.

                  Cheers to one of the best open source projects of all time.

                  tanx

                  1 Reply Last reply Reply Quote 0
                  • N
                    Nachtfalke
                    last edited by

                    @saye:

                    Hi
                    I am running 2.0.1 64 bit and this issue of not starting freeradius2 is still exist.

                    I really would like to know is there any fix of this bug in close future?

                    (…)

                    Don't know about any bug that freeradius2 is not starting !?!

                    You should explain that more in detail:

                    1.) When it is not starting - after pfsense reboot ?
                    2.) What does syslog say - did you enable logging ?

                    freeradius2 package is configured by default that you ONLY need to add an interface and the the service is running. Try and test if this is working!
                    Don't use the old freeradius package and the freeradius2 package together!

                    1 Reply Last reply Reply Quote 0
                    • F
                      Fesoj
                      last edited by

                      Tomorrow I'll restart the pfSense box again a few times and try to access the internet within the first 30 seconds

                      I restarted the box a couple of times (having verified that the configuration of the system worked) and tried to login via CP/freeRADIUS2 after about 30s.  There were no login problems at all.

                      Now it looks as if some kind of previous misconfiguration was responsible for the login problems.

                      The only freeRADIUS related messages were

                      Mar 1 14:17:48 radiusd[4350]: rlm_radutmp: Login entry for NAS pfsense2 port 2 wrong order
                      Mar 1 14:17:48 radiusd[4350]: rlm_radutmp: Login entry for NAS pfsense2 port 2 wrong order

                      and

                      Mar 1 14:18:08 radiusd[4350]: rlm_radutmp: Logout for NAS pfsense2 port 2, but no Login record
                      Mar 1 14:18:08 radiusd[4350]: rlm_radutmp: Logout for NAS pfsense2 port 2, but no Login record

                      but I guess these are without further consequences.

                      1 Reply Last reply Reply Quote 0
                      • N
                        Nachtfalke
                        last edited by

                        The rlm_radutmp problems are related to a known bug/mishandling of CaptivePortal.
                        But it does not make any problems if you do not use Simultaneous-Use = 1. Higher values are working.

                        http://doc.pfsense.org/index.php/FreeRADIUS_2.x_package#KNOWN_BUGS

                        1 Reply Last reply Reply Quote 0
                        • Q
                          qbik
                          last edited by

                          Hi I am using this package and created a group with 2 attributes: Max-All-Session := 600 (5 min) Simultaneous-Use := 1. I've enabled the noresetcounter on radiusd.conf, users on that group are able to authenticate ok, however they do not get disconnected after 600 sec have past. CP is enabled, interim updates enabled, authenticate users every minute is enabled. I have the same setup on another pf sense server with freeradius installed but not with this package and all is working ok on that one. I am using MySQL on both.

                          Thanks

                          1 Reply Last reply Reply Quote 0
                          • S
                            saye
                            last edited by

                            I 've tried it on 2.0 release and it's working
                            but on 2.0.1 I 've tested it and it appears that 'modules' directory is missing

                            I tried: radiusd -X
                            and it said:
                            : Error reading directory /usr/local/etc/raddb/modules/: No such file or directory

                            I's a strange problem.
                            Thank you in advance

                            1 Reply Last reply Reply Quote 0
                            • marcellocM
                              marcelloc
                              last edited by

                              @saye:

                              I 've tried it on 2.0 release and it's working
                              but on 2.0.1 I 've tested it and it appears that 'modules' directory is missing

                              I tried: radiusd -X
                              and it said:
                              : Error reading directory /usr/local/etc/raddb/modules/: No such file or directory

                              Both installs are i386 or x64?
                              Can you try a package reinstall? Both 2.0 and 2.0.1 use the same package from freebsd.

                              Treinamentos de Elite: http://sys-squad.com

                              Help a community developer! ;D

                              1 Reply Last reply Reply Quote 0
                              • N
                                Nachtfalke
                                last edited by

                                @qbik:

                                Hi I am using this package and created a group with 2 attributes: Max-All-Session := 600 (5 min) Simultaneous-Use := 1. I've enabled the noresetcounter on radiusd.conf, users on that group are able to authenticate ok, however they do not get disconnected after 600 sec have past. CP is enabled, interim updates enabled, authenticate users every minute is enabled. I have the same setup on another pf sense server with freeradius installed but not with this package and all is working ok on that one. I am using MySQL on both.

                                Thanks

                                Hi,
                                do you use freeradius2 package on both pfsense or not ? That's not clear for me.

                                the attribute: Max-All-Session is not a predefined attribute in GUI. So you probably created this attribute in your mysql database ? And if you use mysql as database for accounting then you need to use the sqlcounter.conf file. This file is NOT supported from GUI. You need to check and perhaps edit this file from shell.

                                I don't how it works with mxsql but if I use the ../raddb/modules/counter module (without external database) then this modul is ONLY running on accounting-stop packets, interim-updates do not work. So make sure that it does with mysql.

                                re-authenticate every minute should be enabled on CP so that the user gets disconnected. that's right what you did. You should enabled "Disable acct_unique" in FreeRADIUS -> Settings to make accounting work properly.

                                @saye:

                                I 've tried it on 2.0 release and it's working
                                but on 2.0.1 I 've tested it and it appears that 'modules' directory is missing

                                I tried: radiusd -X
                                and it said:
                                : Error reading directory /usr/local/etc/raddb/modules/: No such file or directory

                                I's a strange problem.
                                Thank you in advance

                                Modules directory will be created when installing freeradius2 package. It is part of the default freeradius installation. Nothing changed there. Probably some problem while reinstallation.

                                Check if this folder exists - if not - reinstall package.

                                I tested with 2.0.1 and it is working.

                                1 Reply Last reply Reply Quote 0
                                • N
                                  Nachtfalke
                                  last edited by

                                  Updates pkg v1.6.6:

                                  • Added: Possibility to sync to a remote host which has a different GUI protocol/port as the sync master

                                  • Bumped package to RC1 - there seems to be no reportet bug related to this package and at the moment there are no feature improvements planned.

                                  Known bugs:

                                  • When using "stop/start accounting on CP then "Amount of Time/Amount of Traffic" isn't working correctly.
                                    http://redmine.pfsense.org/issues/2164

                                  • When using CP + RADIUS + Vouchers and "reauthenticate every minute" is enabled then CP sends the voucher as username to RADIUS. This causes RADIUS to disconnect the "user/voucher" because of an unknown/wrong "username".
                                    http://redmine.pfsense.org/issues/2155

                                  • When stop/start accounting on CP is enabled than the syslog shows many "wrong order" or "Login found bot no logout detected". This seems to not affect the usage of RADIUS but it is not 100% correct.
                                    http://redmine.pfsense.org/issues/2143

                                  1 Reply Last reply Reply Quote 0
                                  • Q
                                    qbik
                                    last edited by

                                    I got it to work, I edited the files but did not know the config resets on reboot, so I edited freeradius.inc on line 362 and 1633, now all is working. On the other server I am using the normal freeradius package installed by me. I just need some more customization for french error message, working on it right now, i will upload the screenshots for the vouchers soon. This package is great, thanks again!

                                    @Nachtfalke:

                                    @qbik:

                                    Hi I am using this package and created a group with 2 attributes: Max-All-Session := 600 (5 min) Simultaneous-Use := 1. I've enabled the noresetcounter on radiusd.conf, users on that group are able to authenticate ok, however they do not get disconnected after 600 sec have past. CP is enabled, interim updates enabled, authenticate users every minute is enabled. I have the same setup on another pf sense server with freeradius installed but not with this package and all is working ok on that one. I am using MySQL on both.

                                    Thanks

                                    Hi,
                                    do you use freeradius2 package on both pfsense or not ? That's not clear for me.

                                    the attribute: Max-All-Session is not a predefined attribute in GUI. So you probably created this attribute in your mysql database ? And if you use mysql as database for accounting then you need to use the sqlcounter.conf file. This file is NOT supported from GUI. You need to check and perhaps edit this file from shell.

                                    I don't how it works with mxsql but if I use the ../raddb/modules/counter module (without external database) then this modul is ONLY running on accounting-stop packets, interim-updates do not work. So make sure that it does with mysql.

                                    re-authenticate every minute should be enabled on CP so that the user gets disconnected. that's right what you did. You should enabled "Disable acct_unique" in FreeRADIUS -> Settings to make accounting work properly.

                                    1 Reply Last reply Reply Quote 0
                                    • N
                                      Nachtfalke
                                      last edited by

                                      Updates pkg v1.6.6_1:

                                      • Fixed: counter files are placed in /var/log because nanobsd systems have write access to this folder (RAM) but after reboot the folders will be deleted. So we recreate them if they do not exist.

                                      Known bugs:

                                      • When using "stop/start accounting on CP then "Amount of Time/Amount of Traffic" isn't working correctly.
                                        http://redmine.pfsense.org/issues/2164

                                      • When using CP + RADIUS + Vouchers and "reauthenticate every minute" is enabled then CP sends the voucher as username to RADIUS. This causes RADIUS to disconnect the "user/voucher" because of an unknown/wrong "username".
                                        http://redmine.pfsense.org/issues/2155

                                      • When stop/start accounting on CP is enabled than the syslog shows many "wrong order" or "Login found bot no logout detected". This seems to not affect the usage of RADIUS but it is not 100% correct.
                                        http://redmine.pfsense.org/issues/2143

                                      1 Reply Last reply Reply Quote 0
                                      • B
                                        blasterreal
                                        last edited by

                                        CaptiveProtal logout screen to show the remaining time or the quota information is it possible?
                                        or to display them in real-time.

                                        1 Reply Last reply Reply Quote 0
                                        • N
                                          Nachtfalke
                                          last edited by

                                          @Blasterreal:

                                          CaptiveProtal logout screen to show the remaining time or the quota information is it possible?
                                          or to display them in real-time.

                                          This is not a problem of FreeRADIUS. It is a problem of the NAS (CaptivePortal).
                                          In general it is no problem to send back an Item/value to the NAS (reply-item) but the NAS must be able to display or interpret.

                                          So for example if the timelimit of a user is reached then the CP displays "Your maximum daily usage time is reached". Thats the "Reply-Message" attribute the counter module sends back to the NAS. So probably it would be possibly to implement this field in the logout popup window of CP and then it would probably be possible to display remaining time or something like that.

                                          But I do not understand the code of CP and so I cannot definitly say if it will work.

                                          1 Reply Last reply Reply Quote 0
                                          • M
                                            msi
                                            last edited by

                                            G'day

                                            I registered for this forum due to pfSense' use for FreeRADIUS with Active Directory. Thanks to earlier writer who also added information on how to get this on PfSense 2.0.x. Before looking more at pfSense itself due to capability as easy NAT and Proxying I have pondered upon the "FreeRADIUS Beginners Guide" from PacktPub which also states that due to AD storing passwords as NTLM hash, we can't use the LDAP module in FreeRADIUS but ntlm_auth.

                                            Also Windows systems until/including W7 only support WPA Enterprise with PEAP + MS-CHAPv2 (or EAP-TLS with client certificates) when no additional supplicant is present.

                                            For MS-CHAPv2 and AD the way is to use ntlm_auth wiht Samba against AD as "authentication oracle" instead of "as LDAP database". I had to build Samba 3.6  (with ADS since it's disabled in default builds) + dependencies on FreeBSD 8.2 from ports (make package). Then I had to ship a dozen of libraries like libgssapi_krb5.so.10 to make Samba happily start on the PfSense box. For sure this breaks using the web configurator. But hey, seems to work! :)

                                            I know PfSense 2.1 will switch over to PC-BSD PBI packages. Having Samba available for this kind of authentication scenario would be fabulous. Since it seems yet to be the only known and documented to get FreeRADIUS 2.x work with AD and environments that have lots of Windows clients.
                                            I can only state here that it seems to work fairly well here but I'll monitor how well it really does in further testing.

                                            Are there any plans to include Samba with the a next PfSense/FreeRADIUS in some way?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.