NEW Package: freeRADIUS 2.x

Nachtfalke

Updates pkg v1.6.6:

Added: Possibility to sync to a remote host which has a different GUI protocol/port as the sync master
Bumped package to RC1 - there seems to be no reportet bug related to this package and at the moment there are no feature improvements planned.

Known bugs:

When using "stop/start accounting on CP then "Amount of Time/Amount of Traffic" isn't working correctly.
http://redmine.pfsense.org/issues/2164
When using CP + RADIUS + Vouchers and "reauthenticate every minute" is enabled then CP sends the voucher as username to RADIUS. This causes RADIUS to disconnect the "user/voucher" because of an unknown/wrong "username".
http://redmine.pfsense.org/issues/2155
When stop/start accounting on CP is enabled than the syslog shows many "wrong order" or "Login found bot no logout detected". This seems to not affect the usage of RADIUS but it is not 100% correct.
http://redmine.pfsense.org/issues/2143

qbik

I got it to work, I edited the files but did not know the config resets on reboot, so I edited freeradius.inc on line 362 and 1633, now all is working. On the other server I am using the normal freeradius package installed by me. I just need some more customization for french error message, working on it right now, i will upload the screenshots for the vouchers soon. This package is great, thanks again!

@Nachtfalke:

@qbik:

Hi I am using this package and created a group with 2 attributes: Max-All-Session := 600 (5 min) Simultaneous-Use := 1. I've enabled the noresetcounter on radiusd.conf, users on that group are able to authenticate ok, however they do not get disconnected after 600 sec have past. CP is enabled, interim updates enabled, authenticate users every minute is enabled. I have the same setup on another pf sense server with freeradius installed but not with this package and all is working ok on that one. I am using MySQL on both.

Thanks

Hi,
do you use freeradius2 package on both pfsense or not ? That's not clear for me.

the attribute: Max-All-Session is not a predefined attribute in GUI. So you probably created this attribute in your mysql database ? And if you use mysql as database for accounting then you need to use the sqlcounter.conf file. This file is NOT supported from GUI. You need to check and perhaps edit this file from shell.

I don't how it works with mxsql but if I use the ../raddb/modules/counter module (without external database) then this modul is ONLY running on accounting-stop packets, interim-updates do not work. So make sure that it does with mysql.

re-authenticate every minute should be enabled on CP so that the user gets disconnected. that's right what you did. You should enabled "Disable acct_unique" in FreeRADIUS -> Settings to make accounting work properly.

Nachtfalke

Updates pkg v1.6.6_1:

Fixed: counter files are placed in /var/log because nanobsd systems have write access to this folder (RAM) but after reboot the folders will be deleted. So we recreate them if they do not exist.

Known bugs:

When using "stop/start accounting on CP then "Amount of Time/Amount of Traffic" isn't working correctly.
http://redmine.pfsense.org/issues/2164
When using CP + RADIUS + Vouchers and "reauthenticate every minute" is enabled then CP sends the voucher as username to RADIUS. This causes RADIUS to disconnect the "user/voucher" because of an unknown/wrong "username".
http://redmine.pfsense.org/issues/2155
When stop/start accounting on CP is enabled than the syslog shows many "wrong order" or "Login found bot no logout detected". This seems to not affect the usage of RADIUS but it is not 100% correct.
http://redmine.pfsense.org/issues/2143

blasterreal

CaptiveProtal logout screen to show the remaining time or the quota information is it possible?
or to display them in real-time.

Nachtfalke

@Blasterreal:

CaptiveProtal logout screen to show the remaining time or the quota information is it possible?
or to display them in real-time.

This is not a problem of FreeRADIUS. It is a problem of the NAS (CaptivePortal).
In general it is no problem to send back an Item/value to the NAS (reply-item) but the NAS must be able to display or interpret.

So for example if the timelimit of a user is reached then the CP displays "Your maximum daily usage time is reached". Thats the "Reply-Message" attribute the counter module sends back to the NAS. So probably it would be possibly to implement this field in the logout popup window of CP and then it would probably be possible to display remaining time or something like that.

But I do not understand the code of CP and so I cannot definitly say if it will work.

msi

G'day

I registered for this forum due to pfSense' use for FreeRADIUS with Active Directory. Thanks to earlier writer who also added information on how to get this on PfSense 2.0.x. Before looking more at pfSense itself due to capability as easy NAT and Proxying I have pondered upon the "FreeRADIUS Beginners Guide" from PacktPub which also states that due to AD storing passwords as NTLM hash, we can't use the LDAP module in FreeRADIUS but ntlm_auth.

Also Windows systems until/including W7 only support WPA Enterprise with PEAP + MS-CHAPv2 (or EAP-TLS with client certificates) when no additional supplicant is present.

For MS-CHAPv2 and AD the way is to use ntlm_auth wiht Samba against AD as "authentication oracle" instead of "as LDAP database". I had to build Samba 3.6 (with ADS since it's disabled in default builds) + dependencies on FreeBSD 8.2 from ports (make package). Then I had to ship a dozen of libraries like libgssapi_krb5.so.10 to make Samba happily start on the PfSense box. For sure this breaks using the web configurator. But hey, seems to work! :)

I know PfSense 2.1 will switch over to PC-BSD PBI packages. Having Samba available for this kind of authentication scenario would be fabulous. Since it seems yet to be the only known and documented to get FreeRADIUS 2.x work with AD and environments that have lots of Windows clients.
I can only state here that it seems to work fairly well here but I'll monitor how well it really does in further testing.

Are there any plans to include Samba with the a next PfSense/FreeRADIUS in some way?

marcelloc

Msi,

I did this samba_ntlm auth(for squid) yesterday and compiled two packages That may help you.Take a look on http://e-sac.siteseguro.ws/packages .
Heimdal is the "native" Kerberos package for freebsd and do not has a lot of dependencies like kerberos5.
Current pfsense version is based on freebsd8.1 so 8.2 packages may break some dependencies.

Install heimdal-1.4_1.tbz and samba36-3.6.3.tbz on a test machine and see if you have same result without lib issues or broken gui.

If you could reach a full functional setup with captive portal and active directory try to build a tutorial for us :)

Nachtfalke

If there is a working samba package which we can use with pfsense and freeradius2 package then I will try to implement a GUI to configure the needed samba parameters when using freeradius with AD.
I want to be honset - I am not up to date why we cannot/should not use samba with pfsense and I do not need this support for my daily job ;)

But I would try to implement this feature if it is possible for me :)

msi

Hi

I have quite limited time yet but yes: So far PfSense really rocks!

marceloc: Thank you, indeed I haven't payed attention against what kind of Kerberos Samba got built, I simply hit "make package" on FreebSD 8.2 under /usr/ports/net/samba36 and payed attention to have ADS enabled (since that is precisely not enabled by default in FBSD packages).
How did you achieve this? (I had quite a couple of dependencies like libiconv, gettext, python27 etc.)

By breaking the UI I meant that by only editing config files on shell in /usr/local/etc/raddb the GUI didn't get updated - but that was fully expected. :)

BTW: It must be your Howto on Google docs? - It's quite good although the mentioned book seems to make it a little bit shorter even.

Nachtfalke, that would be very great, for sure it's less good to have a full-blown Samba on a Firewall, but if we just have a config to have stripped-down Samba working as authentication backend and disable all the fancy file sharing stuff, I'd say that it is a "calculated" risk ;)

Once I understood the concepts it was fairly straightforward for a working results via Config files. A small smb.conf (about 15 lines with Domain config etc.), a module config for modules/ntlm_auth and modules/mschap to get it. After 'net join ads' I had to restart Samba and radiusd and everything was working.

Let me know / point me in the direction how I could provide some help, I'm fairly new to PfSense.

marcelloc

@msi:

Thank you, indeed I haven't payed attention against what kind of Kerberos Samba got built, I simply hit "make package" on FreebSD 8.2 under /usr/ports/net/samba36 and payed attention to have ADS enabled (since that is precisely not enabled by default in FBSD packages).
How did you achieve this? (I had quite a couple of dependencies like libiconv, gettext, python27 etc.)

Just compile and make package on /usr/ports/security/heimdal before compiling samba

If kerberos5 is installed, you have to remove it first.

@msi:

BTW: It must be your Howto on Google docs? - It's quite good although the mentioned book seems to make it a little bit shorter even.

Any format you want, it could be a google doc or a topic on this forum for example.

Nachtfalke

@msi

If you can provide a samba package and upload it to a server so I am able to add it to my pfsense and you can say that it works then I will start to make a GUI for that.
There are many docs on the net which descrine freeradius and AD which I will use to start and fine tuning will be done later - if needed :-)

marcelloc

Nachtfalke,

I'ts on the same repo as freeradius2.

I'm not sure if it is a good option to install it automatically.

Whe can think about on installing packages as gui options are selected.

heimdal has config on three files and samba just smb.conf

there is some aditional steps to joing domain and on kinit.

msi

So great guys, I'll join back either tomorrow or next, but interestingly with what I tried, I did not have to touch any Kerberos config file, or use kinit. Simply net ads join, and it was happy.

marcelloc: Yeah, makes sense for Heimdal, I'll see what is default on FreeBSD, haven't precisely checked back.

marcelloc

@msi:

marcelloc: Yeah, makes sense for Heimdal, I'll see what is default on FreeBSD, haven't precisely checked back.

Take a look on heimdal ports package description

A popular BSD-licensed implementation of Kerberos 5
Maintained by: Joerg.Pulz@frm2.tum.de
Also listed in: ipv6
Requires: autoconf-2.68, autoconf-wrapper-20101119, gettext-0.18.1.1, libiconv-1.13.1_2, libtool-2.4.2, m4-1.4.16,1, perl-5.12.4_4, pkg-config-0.25_1

msi

I have shortened and rewritten what I took out of the FreeRADIUS beginners guide and put that in a Google doc to check if I am on the wrong way. This is a very much WiP and also a temporary place:
https://docs.google.com/document/d/1i536CfITm478tAddzoxSLrjl9KcEqGGA-F_LG9Iwy6A/edit
With ntlm_auth it's possible to add a AD group requirement haven't tried that yet.

I'd also agree with marcelloc that it's not the best idea to pull in Samba automatically by freeradius since it's only needed when ntlm_auth comes into the game.

P.S: Nifty idea I came across - any plans to support virtual servers on pfSense with freeradius instead of default sites-enabled/default?

Nachtfalke

@marcelloc:

Nachtfalke,

I'ts on the same repo as freeradius2.
I'm not sure if it is a good option to install it automatically.
Whe can think about on installing packages as gui options are selected.

Yeah - better not by default. I will do it probably like I did with the bash package for mOTP. Will only be installed when enabled.

I installed the samba package from your server on pfsense.
Tried to start samba (didn't change anything on config):


[2.0.1-RELEASE][admin@pfsense.localdomain]/root(5): /usr/local/etc/rc.d/samba onestart
Removing stale Samba tdb files:  done
Starting winbindd.
/libexec/ld-elf.so.1: Shared object "libgssapi.so.2" not found, required by "winbindd"
/usr/local/etc/rc.d/samba: WARNING: failed to start winbindd
[2.0.1-RELEASE][admin@pfsense.localdomain]/root(6):

PS: I think this tutorial will do the job:
http://deployingradius.com/documents/configuration/active_directory.html

@msi
Virtual servers: If you do the job :)
I thought about that in the past but I didn't find a way to put this all into a GUI. Probably someone with more experience on php and conding at all would do a better job. But I am not the guy for that ;)

marcelloc

@Nachtfalke:

[2.0.1-RELEASE][admin@pfsense.localdomain]/root(5): /usr/local/etc/rc.d/samba onestart
Removing stale Samba tdb files: done
Starting winbindd.
/libexec/ld-elf.so.1: Shared object "libgssapi.so.2" not found, required by "winbindd"
/usr/local/etc/rc.d/samba: WARNING: failed to start winbindd
[2.0.1-RELEASE][admin@pfsense.localdomain]/root(6):

well,
maybe a cyrus-sasl-2.1.25_1,openldap-sasl-client-2.4.26, or heimdal dependence.

I guess heimdal or cyrrus.

qbik

Hi,
Does someone know if this package was compiled with DHCP option?

Thanks

marcelloc

@qbik:

Does someone know if this package was compiled with DHCP option?

I can't see this option on package make config.

freeradius_2.png_thumb

Nachtfalke

It is experimental and as far as I know you didn't compile experimental options.
http://freeradius.org/features/dhcp.html