Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NEW Package: freeRADIUS 2.x

    Scheduled Pinned Locked Moved pfSense Packages
    628 Posts 80 Posters 752.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      msi
      last edited by

      G'day

      I registered for this forum due to pfSense' use for FreeRADIUS with Active Directory. Thanks to earlier writer who also added information on how to get this on PfSense 2.0.x. Before looking more at pfSense itself due to capability as easy NAT and Proxying I have pondered upon the "FreeRADIUS Beginners Guide" from PacktPub which also states that due to AD storing passwords as NTLM hash, we can't use the LDAP module in FreeRADIUS but ntlm_auth.

      Also Windows systems until/including W7 only support WPA Enterprise with PEAP + MS-CHAPv2 (or EAP-TLS with client certificates) when no additional supplicant is present.

      For MS-CHAPv2 and AD the way is to use ntlm_auth wiht Samba against AD as "authentication oracle" instead of "as LDAP database". I had to build Samba 3.6  (with ADS since it's disabled in default builds) + dependencies on FreeBSD 8.2 from ports (make package). Then I had to ship a dozen of libraries like libgssapi_krb5.so.10 to make Samba happily start on the PfSense box. For sure this breaks using the web configurator. But hey, seems to work! :)

      I know PfSense 2.1 will switch over to PC-BSD PBI packages. Having Samba available for this kind of authentication scenario would be fabulous. Since it seems yet to be the only known and documented to get FreeRADIUS 2.x work with AD and environments that have lots of Windows clients.
      I can only state here that it seems to work fairly well here but I'll monitor how well it really does in further testing.

      Are there any plans to include Samba with the a next PfSense/FreeRADIUS in some way?

      1 Reply Last reply Reply Quote 0
      • marcellocM
        marcelloc
        last edited by

        Msi,

        I did this samba_ntlm auth(for squid) yesterday and compiled two packages That may help you.Take a look on http://e-sac.siteseguro.ws/packages .
        Heimdal is the "native" Kerberos package for freebsd and do not has a lot of dependencies like kerberos5.
        Current pfsense version is based on freebsd8.1 so 8.2 packages may break some dependencies.

        Install heimdal-1.4_1.tbz and samba36-3.6.3.tbz on a test machine and see if you have same result without lib issues or broken gui.

        If you could reach a full functional setup with captive portal and active directory try to build a tutorial for us  :)

        Treinamentos de Elite: http://sys-squad.com

        Help a community developer! ;D

        1 Reply Last reply Reply Quote 0
        • N
          Nachtfalke
          last edited by

          If there is a working samba package which we can use with pfsense and freeradius2 package then I will try to implement a GUI to configure the needed samba parameters when using freeradius with AD.
          I want to be honset - I am not up to date why we cannot/should not use samba with pfsense and I do not need this support for my daily job ;)

          But I would try to implement this feature if it is possible for me  :)

          1 Reply Last reply Reply Quote 0
          • M
            msi
            last edited by

            Hi

            I have quite limited time yet but yes: So far PfSense really rocks!

            marceloc: Thank you, indeed I haven't payed attention against what kind of Kerberos Samba got built, I simply hit "make package" on FreebSD 8.2 under /usr/ports/net/samba36 and payed attention to have ADS enabled (since that is precisely not enabled by default in FBSD packages).
            How did you achieve this? (I had quite a couple of dependencies like libiconv, gettext, python27 etc.)

            By breaking the UI I meant that by only editing config files on shell in /usr/local/etc/raddb the GUI didn't get updated - but that was fully expected. :)

            BTW: It must be your Howto on Google docs? - It's quite good although the mentioned book seems to make it a little bit shorter even.

            Nachtfalke, that would be very great, for sure it's less good to have a full-blown Samba on a Firewall, but if we just have a config to have stripped-down Samba working as authentication backend and disable all the fancy file sharing stuff, I'd say that it is a "calculated" risk ;)

            Once I understood the concepts it was fairly straightforward for a working results via Config files. A small smb.conf (about 15 lines with Domain config etc.), a module config for modules/ntlm_auth and modules/mschap to get it. After 'net join ads' I had to restart Samba and radiusd and everything was working.

            Let me know / point me in the direction how I could provide some help, I'm fairly new to PfSense.

            1 Reply Last reply Reply Quote 0
            • marcellocM
              marcelloc
              last edited by

              @msi:

              Thank you, indeed I haven't payed attention against what kind of Kerberos Samba got built, I simply hit "make package" on FreebSD 8.2 under /usr/ports/net/samba36 and payed attention to have ADS enabled (since that is precisely not enabled by default in FBSD packages).
              How did you achieve this? (I had quite a couple of dependencies like libiconv, gettext, python27 etc.)

              Just compile and make package on /usr/ports/security/heimdal before compiling samba

              If kerberos5 is installed, you have to remove it first.

              @msi:

              BTW: It must be your Howto on Google docs? - It's quite good although the mentioned book seems to make it a little bit shorter even.

              Any format you want, it could be a google doc or a topic on this forum for example.

              Treinamentos de Elite: http://sys-squad.com

              Help a community developer! ;D

              1 Reply Last reply Reply Quote 0
              • N
                Nachtfalke
                last edited by

                @msi

                If you can provide a samba package and upload it to a server so I am able to add it to my pfsense and you can say that it works then I will start to make a GUI for that.
                There are many docs on the net which descrine freeradius and AD which I will use to start and fine tuning will be done later - if needed :-)

                1 Reply Last reply Reply Quote 0
                • marcellocM
                  marcelloc
                  last edited by

                  Nachtfalke,

                  I'ts on the same repo as freeradius2.

                  I'm not sure if it is a good option to install it automatically.

                  Whe can think about on installing packages as gui options are selected.

                  heimdal has config on three files and samba just smb.conf

                  there is some aditional steps to joing domain and on kinit.

                  Treinamentos de Elite: http://sys-squad.com

                  Help a community developer! ;D

                  1 Reply Last reply Reply Quote 0
                  • M
                    msi
                    last edited by

                    So great guys, I'll join back either tomorrow or next, but interestingly with what I tried, I did not have to touch any Kerberos config file, or use kinit. Simply net ads join, and it was happy.

                    marcelloc: Yeah, makes sense for Heimdal, I'll see what is default on FreeBSD, haven't precisely checked back.

                    1 Reply Last reply Reply Quote 0
                    • marcellocM
                      marcelloc
                      last edited by

                      @msi:

                      marcelloc: Yeah, makes sense for Heimdal, I'll see what is default on FreeBSD, haven't precisely checked back.

                      Take a look on heimdal ports package description

                      A popular BSD-licensed implementation of Kerberos 5
                      Maintained by: Joerg.Pulz@frm2.tum.de
                      Also listed in: ipv6
                      Requires: autoconf-2.68, autoconf-wrapper-20101119, gettext-0.18.1.1, libiconv-1.13.1_2, libtool-2.4.2, m4-1.4.16,1, perl-5.12.4_4, pkg-config-0.25_1

                      Treinamentos de Elite: http://sys-squad.com

                      Help a community developer! ;D

                      1 Reply Last reply Reply Quote 0
                      • M
                        msi
                        last edited by

                        I have shortened and rewritten what I took out of the FreeRADIUS beginners guide and put that in a Google doc to check if I am on the wrong way.  This is a very much WiP and also a temporary place:
                        https://docs.google.com/document/d/1i536CfITm478tAddzoxSLrjl9KcEqGGA-F_LG9Iwy6A/edit
                        With ntlm_auth it's possible to add a AD group requirement haven't tried that yet.

                        I'd also agree with marcelloc that it's not the best idea to pull in Samba automatically by freeradius since it's only needed when ntlm_auth comes into the game.

                        P.S: Nifty idea I came across - any plans to support virtual servers on pfSense with freeradius instead of default sites-enabled/default?

                        1 Reply Last reply Reply Quote 0
                        • N
                          Nachtfalke
                          last edited by

                          @marcelloc:

                          Nachtfalke,

                          I'ts on the same repo as freeradius2.
                          I'm not sure if it is a good option to install it automatically.
                          Whe can think about on installing packages as gui options are selected.

                          Yeah - better not by default. I will do it probably like I did with the bash package for mOTP. Will only be installed when enabled.

                          I installed the samba package from your server on pfsense.
                          Tried to start samba (didn't change anything on config):

                          
                          [2.0.1-RELEASE][admin@pfsense.localdomain]/root(5): /usr/local/etc/rc.d/samba onestart
                          Removing stale Samba tdb files:  done
                          Starting winbindd.
                          /libexec/ld-elf.so.1: Shared object "libgssapi.so.2" not found, required by "winbindd"
                          /usr/local/etc/rc.d/samba: WARNING: failed to start winbindd
                          [2.0.1-RELEASE][admin@pfsense.localdomain]/root(6):
                          
                          

                          PS: I think this tutorial will do the job:
                          http://deployingradius.com/documents/configuration/active_directory.html

                          @msi
                          Virtual servers: If you do the job :)
                          I thought about that in the past but I didn't find a way to put this all into a GUI. Probably someone with more experience on php and conding at all would do a better job. But I am not the guy for that  ;)

                          1 Reply Last reply Reply Quote 0
                          • marcellocM
                            marcelloc
                            last edited by

                            @Nachtfalke:

                            [2.0.1-RELEASE][admin@pfsense.localdomain]/root(5): /usr/local/etc/rc.d/samba onestart
                            Removing stale Samba tdb files:  done
                            Starting winbindd.
                            /libexec/ld-elf.so.1: Shared object "libgssapi.so.2" not found, required by "winbindd"
                            /usr/local/etc/rc.d/samba: WARNING: failed to start winbindd
                            [2.0.1-RELEASE][admin@pfsense.localdomain]/root(6):

                            well,
                            maybe a cyrus-sasl-2.1.25_1,openldap-sasl-client-2.4.26, or heimdal dependence.

                            I guess heimdal or cyrrus.

                            Treinamentos de Elite: http://sys-squad.com

                            Help a community developer! ;D

                            1 Reply Last reply Reply Quote 0
                            • Q
                              qbik
                              last edited by

                              Hi,
                              Does someone know if this package was compiled with DHCP option?

                              Thanks

                              1 Reply Last reply Reply Quote 0
                              • marcellocM
                                marcelloc
                                last edited by

                                @qbik:

                                Does someone know if this package was compiled with DHCP option?

                                I can't see this option on package make config.

                                freeradius_2.png
                                freeradius_2.png_thumb

                                Treinamentos de Elite: http://sys-squad.com

                                Help a community developer! ;D

                                1 Reply Last reply Reply Quote 0
                                • N
                                  Nachtfalke
                                  last edited by

                                  It is experimental and as far as I know you didn't compile experimental options.
                                  http://freeradius.org/features/dhcp.html

                                  1 Reply Last reply Reply Quote 0
                                  • marcellocM
                                    marcelloc
                                    last edited by

                                    @marcelloc:

                                    I can't see this option on package make config.

                                    Now I can see it as  experimental option  ;)

                                    Treinamentos de Elite: http://sys-squad.com

                                    Help a community developer! ;D

                                    1 Reply Last reply Reply Quote 0
                                    • Q
                                      qbik
                                      last edited by

                                      Thank you for this information!

                                      1 Reply Last reply Reply Quote 0
                                      • N
                                        Nachtfalke
                                        last edited by

                                        Updates pkg v1.6.6_3:

                                        • Fixes: accounting scripts and small updates on the documentation. More infos in this thread:
                                          http://forum.pfsense.org/index.php/topic,48404.0.html

                                        Known bugs:

                                        • When using "stop/start accounting on CP then "Amount of Time/Amount of Traffic" isn't working correctly.
                                          http://redmine.pfsense.org/issues/2164

                                        • When using CP + RADIUS + Vouchers and "reauthenticate every minute" is enabled then CP sends the voucher as username to RADIUS. This causes RADIUS to disconnect the "user/voucher" because of an unknown/wrong "username".
                                          http://redmine.pfsense.org/issues/2155

                                        • When stop/start accounting on CP is enabled than the syslog shows many "wrong order" or "Login found bot no logout detected". This seems to not affect the usage of RADIUS but it is not 100% correct.
                                          http://redmine.pfsense.org/issues/2143

                                        1 Reply Last reply Reply Quote 0
                                        • Q
                                          qbik
                                          last edited by

                                          Hi,
                                          I want to do some test with DHCP on freeradius, I have a virtual machine where freeradius has DHCP enabled. I wanted to know if there is a way I can tell your package on installation to fetch my package file (from my server) and all dependencies will be treated as normal (from your server).

                                          Thanks

                                          1 Reply Last reply Reply Quote 0
                                          • marcellocM
                                            marcelloc
                                            last edited by

                                            @qbik:

                                            Hi,
                                            I want to do some test with DHCP on freeradius, I have a virtual machine where freeradius has DHCP enabled. I wanted to know if there is a way I can tell your package on installation to fetch my package file (from my server) and all dependencies will be treated as normal (from your server).

                                            Thanks

                                            No. what you can do is install freeradius2 package and then at console/ssh replace freeradius2 with your build using pkg_delete and pkg_add -r

                                            Treinamentos de Elite: http://sys-squad.com

                                            Help a community developer! ;D

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.