NEW Package: freeRADIUS 2.x

Fesoj · Mar 1, 2012, 1:39 PM

Tomorrow I'll restart the pfSense box again a few times and try to access the internet within the first 30 seconds

I restarted the box a couple of times (having verified that the configuration of the system worked) and tried to login via CP/freeRADIUS2 after about 30s. There were no login problems at all.

Now it looks as if some kind of previous misconfiguration was responsible for the login problems.

The only freeRADIUS related messages were

Mar 1 14:17:48 radiusd[4350]: rlm_radutmp: Login entry for NAS pfsense2 port 2 wrong order
Mar 1 14:17:48 radiusd[4350]: rlm_radutmp: Login entry for NAS pfsense2 port 2 wrong order

and

Mar 1 14:18:08 radiusd[4350]: rlm_radutmp: Logout for NAS pfsense2 port 2, but no Login record
Mar 1 14:18:08 radiusd[4350]: rlm_radutmp: Logout for NAS pfsense2 port 2, but no Login record

but I guess these are without further consequences.

Nachtfalke · Mar 1, 2012, 1:56 PM

The rlm_radutmp problems are related to a known bug/mishandling of CaptivePortal.
But it does not make any problems if you do not use Simultaneous-Use = 1. Higher values are working.

http://doc.pfsense.org/index.php/FreeRADIUS_2.x_package#KNOWN_BUGS

qbik · Mar 3, 2012, 10:55 PM

Hi I am using this package and created a group with 2 attributes: Max-All-Session := 600 (5 min) Simultaneous-Use := 1. I've enabled the noresetcounter on radiusd.conf, users on that group are able to authenticate ok, however they do not get disconnected after 600 sec have past. CP is enabled, interim updates enabled, authenticate users every minute is enabled. I have the same setup on another pf sense server with freeradius installed but not with this package and all is working ok on that one. I am using MySQL on both.

Thanks

saye · Mar 4, 2012, 11:10 AM

I 've tried it on 2.0 release and it's working
but on 2.0.1 I 've tested it and it appears that 'modules' directory is missing

I tried: radiusd -X
and it said:
: Error reading directory /usr/local/etc/raddb/modules/: No such file or directory

I's a strange problem.
Thank you in advance

marcelloc · Mar 4, 2012, 11:22 AM

@saye:

I 've tried it on 2.0 release and it's working
but on 2.0.1 I 've tested it and it appears that 'modules' directory is missing

I tried: radiusd -X
and it said:
: Error reading directory /usr/local/etc/raddb/modules/: No such file or directory

Both installs are i386 or x64?
Can you try a package reinstall? Both 2.0 and 2.0.1 use the same package from freebsd.

Nachtfalke · Mar 4, 2012, 12:25 PM

@qbik:

Hi I am using this package and created a group with 2 attributes: Max-All-Session := 600 (5 min) Simultaneous-Use := 1. I've enabled the noresetcounter on radiusd.conf, users on that group are able to authenticate ok, however they do not get disconnected after 600 sec have past. CP is enabled, interim updates enabled, authenticate users every minute is enabled. I have the same setup on another pf sense server with freeradius installed but not with this package and all is working ok on that one. I am using MySQL on both.

Thanks

Hi,
do you use freeradius2 package on both pfsense or not ? That's not clear for me.

the attribute: Max-All-Session is not a predefined attribute in GUI. So you probably created this attribute in your mysql database ? And if you use mysql as database for accounting then you need to use the sqlcounter.conf file. This file is NOT supported from GUI. You need to check and perhaps edit this file from shell.

I don't how it works with mxsql but if I use the ../raddb/modules/counter module (without external database) then this modul is ONLY running on accounting-stop packets, interim-updates do not work. So make sure that it does with mysql.

re-authenticate every minute should be enabled on CP so that the user gets disconnected. that's right what you did. You should enabled "Disable acct_unique" in FreeRADIUS -> Settings to make accounting work properly.

@saye:

I 've tried it on 2.0 release and it's working
but on 2.0.1 I 've tested it and it appears that 'modules' directory is missing

I tried: radiusd -X
and it said:
: Error reading directory /usr/local/etc/raddb/modules/: No such file or directory

I's a strange problem.
Thank you in advance

Modules directory will be created when installing freeradius2 package. It is part of the default freeradius installation. Nothing changed there. Probably some problem while reinstallation.

Check if this folder exists - if not - reinstall package.

I tested with 2.0.1 and it is working.

Nachtfalke · Mar 4, 2012, 1:31 PM

Updates pkg v1.6.6:

Added: Possibility to sync to a remote host which has a different GUI protocol/port as the sync master
Bumped package to RC1 - there seems to be no reportet bug related to this package and at the moment there are no feature improvements planned.

Known bugs:

When using "stop/start accounting on CP then "Amount of Time/Amount of Traffic" isn't working correctly.
http://redmine.pfsense.org/issues/2164
When using CP + RADIUS + Vouchers and "reauthenticate every minute" is enabled then CP sends the voucher as username to RADIUS. This causes RADIUS to disconnect the "user/voucher" because of an unknown/wrong "username".
http://redmine.pfsense.org/issues/2155
When stop/start accounting on CP is enabled than the syslog shows many "wrong order" or "Login found bot no logout detected". This seems to not affect the usage of RADIUS but it is not 100% correct.
http://redmine.pfsense.org/issues/2143

qbik · Mar 6, 2012, 6:21 PM

I got it to work, I edited the files but did not know the config resets on reboot, so I edited freeradius.inc on line 362 and 1633, now all is working. On the other server I am using the normal freeradius package installed by me. I just need some more customization for french error message, working on it right now, i will upload the screenshots for the vouchers soon. This package is great, thanks again!

@Nachtfalke:

@qbik:

Hi I am using this package and created a group with 2 attributes: Max-All-Session := 600 (5 min) Simultaneous-Use := 1. I've enabled the noresetcounter on radiusd.conf, users on that group are able to authenticate ok, however they do not get disconnected after 600 sec have past. CP is enabled, interim updates enabled, authenticate users every minute is enabled. I have the same setup on another pf sense server with freeradius installed but not with this package and all is working ok on that one. I am using MySQL on both.

Thanks

Hi,
do you use freeradius2 package on both pfsense or not ? That's not clear for me.

the attribute: Max-All-Session is not a predefined attribute in GUI. So you probably created this attribute in your mysql database ? And if you use mysql as database for accounting then you need to use the sqlcounter.conf file. This file is NOT supported from GUI. You need to check and perhaps edit this file from shell.

I don't how it works with mxsql but if I use the ../raddb/modules/counter module (without external database) then this modul is ONLY running on accounting-stop packets, interim-updates do not work. So make sure that it does with mysql.

re-authenticate every minute should be enabled on CP so that the user gets disconnected. that's right what you did. You should enabled "Disable acct_unique" in FreeRADIUS -> Settings to make accounting work properly.

Nachtfalke · Mar 9, 2012, 10:19 PM

Updates pkg v1.6.6_1:

Fixed: counter files are placed in /var/log because nanobsd systems have write access to this folder (RAM) but after reboot the folders will be deleted. So we recreate them if they do not exist.

Known bugs:

When using "stop/start accounting on CP then "Amount of Time/Amount of Traffic" isn't working correctly.
http://redmine.pfsense.org/issues/2164
When using CP + RADIUS + Vouchers and "reauthenticate every minute" is enabled then CP sends the voucher as username to RADIUS. This causes RADIUS to disconnect the "user/voucher" because of an unknown/wrong "username".
http://redmine.pfsense.org/issues/2155
When stop/start accounting on CP is enabled than the syslog shows many "wrong order" or "Login found bot no logout detected". This seems to not affect the usage of RADIUS but it is not 100% correct.
http://redmine.pfsense.org/issues/2143

blasterreal · Mar 13, 2012, 7:39 AM

CaptiveProtal logout screen to show the remaining time or the quota information is it possible?
or to display them in real-time.

Nachtfalke · Mar 13, 2012, 7:02 PM

@Blasterreal:

CaptiveProtal logout screen to show the remaining time or the quota information is it possible?
or to display them in real-time.

This is not a problem of FreeRADIUS. It is a problem of the NAS (CaptivePortal).
In general it is no problem to send back an Item/value to the NAS (reply-item) but the NAS must be able to display or interpret.

So for example if the timelimit of a user is reached then the CP displays "Your maximum daily usage time is reached". Thats the "Reply-Message" attribute the counter module sends back to the NAS. So probably it would be possibly to implement this field in the logout popup window of CP and then it would probably be possible to display remaining time or something like that.

But I do not understand the code of CP and so I cannot definitly say if it will work.

msi · Mar 22, 2012, 10:56 AM

G'day

I registered for this forum due to pfSense' use for FreeRADIUS with Active Directory. Thanks to earlier writer who also added information on how to get this on PfSense 2.0.x. Before looking more at pfSense itself due to capability as easy NAT and Proxying I have pondered upon the "FreeRADIUS Beginners Guide" from PacktPub which also states that due to AD storing passwords as NTLM hash, we can't use the LDAP module in FreeRADIUS but ntlm_auth.

Also Windows systems until/including W7 only support WPA Enterprise with PEAP + MS-CHAPv2 (or EAP-TLS with client certificates) when no additional supplicant is present.

For MS-CHAPv2 and AD the way is to use ntlm_auth wiht Samba against AD as "authentication oracle" instead of "as LDAP database". I had to build Samba 3.6 (with ADS since it's disabled in default builds) + dependencies on FreeBSD 8.2 from ports (make package). Then I had to ship a dozen of libraries like libgssapi_krb5.so.10 to make Samba happily start on the PfSense box. For sure this breaks using the web configurator. But hey, seems to work! :)

I know PfSense 2.1 will switch over to PC-BSD PBI packages. Having Samba available for this kind of authentication scenario would be fabulous. Since it seems yet to be the only known and documented to get FreeRADIUS 2.x work with AD and environments that have lots of Windows clients.
I can only state here that it seems to work fairly well here but I'll monitor how well it really does in further testing.

Are there any plans to include Samba with the a next PfSense/FreeRADIUS in some way?

marcelloc · Mar 22, 2012, 1:09 PM

Msi,

I did this samba_ntlm auth(for squid) yesterday and compiled two packages That may help you.Take a look on http://e-sac.siteseguro.ws/packages .
Heimdal is the "native" Kerberos package for freebsd and do not has a lot of dependencies like kerberos5.
Current pfsense version is based on freebsd8.1 so 8.2 packages may break some dependencies.

Install heimdal-1.4_1.tbz and samba36-3.6.3.tbz on a test machine and see if you have same result without lib issues or broken gui.

If you could reach a full functional setup with captive portal and active directory try to build a tutorial for us :)

Nachtfalke · Mar 22, 2012, 1:25 PM

If there is a working samba package which we can use with pfsense and freeradius2 package then I will try to implement a GUI to configure the needed samba parameters when using freeradius with AD.
I want to be honset - I am not up to date why we cannot/should not use samba with pfsense and I do not need this support for my daily job ;)

But I would try to implement this feature if it is possible for me :)

msi · Mar 22, 2012, 3:27 PM

Hi

I have quite limited time yet but yes: So far PfSense really rocks!

marceloc: Thank you, indeed I haven't payed attention against what kind of Kerberos Samba got built, I simply hit "make package" on FreebSD 8.2 under /usr/ports/net/samba36 and payed attention to have ADS enabled (since that is precisely not enabled by default in FBSD packages).
How did you achieve this? (I had quite a couple of dependencies like libiconv, gettext, python27 etc.)

By breaking the UI I meant that by only editing config files on shell in /usr/local/etc/raddb the GUI didn't get updated - but that was fully expected. :)

BTW: It must be your Howto on Google docs? - It's quite good although the mentioned book seems to make it a little bit shorter even.

Nachtfalke, that would be very great, for sure it's less good to have a full-blown Samba on a Firewall, but if we just have a config to have stripped-down Samba working as authentication backend and disable all the fancy file sharing stuff, I'd say that it is a "calculated" risk ;)

Once I understood the concepts it was fairly straightforward for a working results via Config files. A small smb.conf (about 15 lines with Domain config etc.), a module config for modules/ntlm_auth and modules/mschap to get it. After 'net join ads' I had to restart Samba and radiusd and everything was working.

Let me know / point me in the direction how I could provide some help, I'm fairly new to PfSense.

marcelloc · Mar 22, 2012, 3:34 PM

@msi:

Thank you, indeed I haven't payed attention against what kind of Kerberos Samba got built, I simply hit "make package" on FreebSD 8.2 under /usr/ports/net/samba36 and payed attention to have ADS enabled (since that is precisely not enabled by default in FBSD packages).
How did you achieve this? (I had quite a couple of dependencies like libiconv, gettext, python27 etc.)

Just compile and make package on /usr/ports/security/heimdal before compiling samba

If kerberos5 is installed, you have to remove it first.

@msi:

BTW: It must be your Howto on Google docs? - It's quite good although the mentioned book seems to make it a little bit shorter even.

Any format you want, it could be a google doc or a topic on this forum for example.

Nachtfalke · Mar 22, 2012, 4:19 PM

@msi

If you can provide a samba package and upload it to a server so I am able to add it to my pfsense and you can say that it works then I will start to make a GUI for that.
There are many docs on the net which descrine freeradius and AD which I will use to start and fine tuning will be done later - if needed :-)

marcelloc · Mar 22, 2012, 4:55 PM

Nachtfalke,

I'ts on the same repo as freeradius2.

I'm not sure if it is a good option to install it automatically.

Whe can think about on installing packages as gui options are selected.

heimdal has config on three files and samba just smb.conf

there is some aditional steps to joing domain and on kinit.

msi · Mar 22, 2012, 5:47 PM

So great guys, I'll join back either tomorrow or next, but interestingly with what I tried, I did not have to touch any Kerberos config file, or use kinit. Simply net ads join, and it was happy.

marcelloc: Yeah, makes sense for Heimdal, I'll see what is default on FreeBSD, haven't precisely checked back.

marcelloc · Mar 22, 2012, 6:04 PM

@msi:

marcelloc: Yeah, makes sense for Heimdal, I'll see what is default on FreeBSD, haven't precisely checked back.

Take a look on heimdal ports package description

A popular BSD-licensed implementation of Kerberos 5
Maintained by: Joerg.Pulz@frm2.tum.de
Also listed in: ipv6
Requires: autoconf-2.68, autoconf-wrapper-20101119, gettext-0.18.1.1, libiconv-1.13.1_2, libtool-2.4.2, m4-1.4.16,1, perl-5.12.4_4, pkg-config-0.25_1