NEW Package: freeRADIUS 2.x
-
Thank you, this worked.
-
Thank you, this worked.
You can also report what features you enabled and how it improved your setup.
-
Thank you, this worked.
You can also report what features you enabled and how it improved your setup.
And which files you need to configure so we can think about building a GUI for that if possible :-)
-
Is there a timeline for when this package will be updated to work with 2.1-DEVELOPMENT? Unfortunately, I need 2.1 for a client's system since their NIC isn't supported in 2.0.1 (RealTek 8111e), and I'm trying to get FreeRADIUS working so I can use WPA2-Enterprise. Thanks!
-
Is there a timeline for when this package will be updated to work with 2.1-DEVELOPMENT? Unfortunately, I need 2.1 for a client's system since their NIC isn't supported in 2.0.1 (RealTek 8111e), and I'm trying to get FreeRADIUS working so I can use WPA2-Enterprise. Thanks!
after installing gui, did you tried to install binaries on console?
these posts maybe usefull for amd64 installs
http://forum.pfsense.org/index.php/topic,43675.msg231974.html#msg231974
http://forum.pfsense.org/index.php/topic,43675.msg232046.html#msg232046
http://forum.pfsense.org/index.php/topic,43675.msg232220.html#msg232220
http://forum.pfsense.org/index.php/topic,43675.msg232064.html#msg232064 -
It's an i386 install, because the graphics chipset (Intel Atom D2700) doesn't work properly in FreeBSD AMD64 (heck, it doesn't TOTALLY work properly in i386 there are missing characters, and amazingly, it doesn't even work in Windows 7 64-bit - there are no drivers from Intel).
Sorry if I missed this but I'm not seeing it, if you still think it'd help, how would I go about reinstalling from the terminal then?
-
Sorry if I missed this but I'm not seeing it, if you still think it'd help, how would I go about reinstalling from the terminal then?
Maybe the package has installed missing libs, put as whe do not have .pbi package for freeradius2, you need to enable ssh/go to console and type
pkg_add -r http://e-sac.siteseguro.ws/packages/8/All/freeradius-2.1.12.tbz
pkg_add -r http://e-sac.siteseguro.ws/packages/8/All/openldap-sasl-client-2.4.26.tbz -
Thank you! I'll try it out ASAP. Will this work through a firmware upgrade from the GUI or will it need to be re-done every time a new snapshot is loaded?
-
Thank you! I'll try it out ASAP. Will this work through a firmware upgrade from the GUI or will it need to be re-done every time a new snapshot is loaded?
Every firmware update, all packages are reinstalled, so I think you need to do this too.
-
Okay, thanks. It'll probably be Monday morning when I'm up at the campground where this install is, and I'll give it a whirl. Do a firmware update, then try to get FreeRADIUS and WPA2-Enterprise up and running there.
-
Tried that, didn't do the trick, freeRADIUS 2 still won't start on 2.1 development.
-
Here's the result of my attempt to start it from SSH in debugging mode. Any help would be great I'd LOVE to get this thing running and I appreciate it a ton!:
[2.1-DEVELOPMENT][admin@glacierfire.glaciercamp]/root(3): radiusd -X FreeRADIUS Version 2.1.12, for host i386-portbld-freebsd8.1, built on Jan 3 2012 at 23:44:16 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2\. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/redis including configuration file /usr/local/etc/raddb/modules/rediswho including configuration file /usr/local/etc/raddb/modules/replicate including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/soh including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/local" localstatedir = "/var" sbindir = "/usr/local/sbin" logdir = "/var/log" run_dir = "/var/run" libdir = "/usr/local/lib/freeradius-2.1.12" radacctdir = "/var/log/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 2048 pidfile = "/var/run/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no msg_badpass = "" msg_goodpass = "" } security { max_attributes = 200 reject_delay = 1 status_server = no } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client teakettle2 { ipaddr = 192.168.10.2 require_message_authenticator = no secret = "mqh6rWnxbTkgQkVn" shortname = "teakettle2" nastype = "other" } client cafeteria { ipaddr = 192.168.10.3 require_message_authenticator = no secret = "8UmEX8Xr6sRz64R4" shortname = "cafeteria" nastype = "other" } client lodgelobby { ipaddr = 192.168.10.4 require_message_authenticator = no secret = "5TEEQULqqTB49bYc" shortname = "lodgelobby" nastype = "other" } client conferenceroom { ipaddr = 192.168.10.5 require_message_authenticator = no secret = "5vQTATZSLBGqKNhx" shortname = "conferenceroom" nastype = "other" } client sector1 { ipaddr = 192.168.10.6 require_message_authenticator = no secret = "LgVKSbJ6eRcwdJzU" shortname = "sector1" nastype = "other" } client sector2 { ipaddr = 192.168.10.7 require_message_authenticator = no secret = "aHfBaTuxytqLKXFG" shortname = "sector2" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/local/etc/raddb/modules/expr Module: Linked to module rlm_counter Module: Instantiating module "daily" from file /usr/local/etc/raddb/modules/counter counter daily { filename = "/usr/local/etc/raddb/db.daily" key = "User-Name" reset = "daily" count-attribute = "Acct-Session-Time" counter-name = "Daily-Session-Time" check-name = "Max-Daily-Session" reply-name = "Session-Timeout" allowed-servicetype = "Framed-User" cache-size = 5000 } rlm_counter: Counter attribute Daily-Session-Time is number 11273 rlm_counter: Current Time: 1337493979 [2012-05-20 00:06:19], Next reset 1337580000 [2012-05-21 00:00:00] ERROR: Cannot find a configuration entry for module "weekly". -
**IGNORE ALL OF THIS - it didn't survive a reboot. The package must try to repair itself or something, I'm back to the error above about the module weekly…
P.P.S. I know I'm mostly talking to myself at this point but the magic final edit was hashtagging out weekly, monthly, and forever in freeradius.inc since it turns out that's where radiusd.conf is loaded from. Now, to figure out if whatever I broke to get FreeRADIUS to start is so severe that it won't work for my needs (which are fairly minimal, authenticate a few users who will stay around all the time, and have the ability to add/remove temporary users as needed).**
I think I got it running. I dunno what I broke in the process but first thing I tried was adding the "weekly, monthly, and forever" entries from my working 2.0.2-RC1's version of "/usr/local/etc/raddb/modules/counter" since those were missing. That did NO good. Changed nothing. So instead I hashtagged out weekly monthly and forever from radiusd.conf. Then on an error related to MOTP, so I edited the file "default" that contained MOTP references to hashtag that out. Then I halted on more errors about daily (yes, daily too this time), weekly, monthly, and forever so I hashtagged out a all those references in default and it starts!
I know I broke something in the process. I also know that I have no idea WHAT I BROKE, and I randomly hashtagged things out. The server starts but who knows if it'll work for what I want (WPA2-Enterprise). I'll find out Monday when I'm up there if I can connect to the private network I'm setting up now.
Anyone got any insight into what I broke? LOL
-
I did the GUI for that package. What you broke is nothing important for you. So no problem.
The counter files will be installed on package installation process. If you do not need the counters that will be no problem for you. Uncommenting this in "default" is no problem.The same for MOTP. this a is one time password feature - you probably do not need this for your environment. :)
I posted on the dev mailing list and we will see what is happening for pfsense 2.1 :)
http://lists.pfsense.org/pipermail/dev/2012-May/000176.htmlPS: If you have the time to do so, you can do the following:
copy and execute the code on pfsense GUI -> Diagnostics -> Command prompt -> PHP execute
Just copy the lines below - this will probably create all your missing files.require_once("freeradius.inc"); freeradius_dictionary_resync(); freeradius_modulesmotp_resync(); freeradius_modulesdatacounter_resync(); freeradius_datacounter_acct_resync(); freeradius_datacounter_auth_resync(); freeradius_modulescounter_resync(); -
Thanks, as far as I know it works, but I haven't been up to the campground this is installed at (it's about 30 miles away). I know pfSense works, I haven't got any complaints and I see users connecting. No idea, however, if my WPA2-Enterprise admin network works. I know all my setup and VLAN tagging works (because I had no issues connecting when it was WPA2-PSK).
Why all the hassle to do WPA2-Enterprise? The admin network is also the network that bypasses the proxy. I want to be able to give group leaders passwords that are removed when their group leaves in case they need to bypass SquidGuard for any reason (it is setup fairly restrictive).
On my test setup here at home, running pfSense 2.0.2-RC1, it all works great (for my demo network, which is a similar setup).
Thanks again!
-
Hello,
sorry but i'm a bit n00b :)i've read through this thread but i couldn't find informations about my issue.
i've configured freeRADIUS2 to run with MySQL, apparently everything seems fine as in the log i can see that it connects to the db properly without any error.
My question is, once i'm relying on mysql, i'm left on my own for managing users nas mac etc? in the mean that the pfsense webUI doesn't control them anymore if mySQL is set as abackend?
I ask this because as i can see, local users (flat file) are still authed properly by freeRADIUS, and if i add new users they are not added to the MySQL database, as it results empty.
am i missing something or is it working as intended?
-
Hi,
it is working as intended. Adding users on the GUI will only add users in the flat "users" file.
If you are using MySQL you will have to add them there in any other way to the database. for example you write a HTML web page or do this with some other tool or script. -
ok nice, i kinda figured it out, as i'm planning to use some php to add users to the mysql database.
the problem is that as of now, by browsing the freeradius wiki, i found it extremely difficult to figure out what goes where in terms of users, limitations etc.
for instance i noticed that if i add
"testuser", "cleartest-password", ":=", "testpassword" in the radcheck table
i can perform a successful login on the captive portal.problem is.. what if i also want to limit the usage to 1 hour per day? or eventually bandwidth? are these values also to be added to radcheck? they go in radreply?
an exhaustive list of the usable attributes would be also interesting, ok i know i'm going OT here, so maybe i should ask in the proper section of this board (if any) wiki only reports some of them, and they are not well described/explained on what they are suitable for.
-
Hi again,
if you add a user in GUI then this user is placed in the plain "users" file in /usr/local/etc/raddb/users
all check and reply attributes you can add from GUI will go int users file. The same is with limitations and restrictions.
Most of the features from this package aim to the "users" file.If you are using LDAP or mysql it is up to you to configure this, add users and limitations.
This needs to be done vi console/ssh and via config files:
You can find them - depending on your database - in this folder:/usr/local/etc/raddb/sql/So there it is up to you to create your "SELECTs" and "QUERY". The very best place too find help - depending on this is probably the freeradius mailing list and their homepage.
Limiting bandwidth is a reply attribute - you/freeradius is telling the NAS to limit the bandwidth.
a check attribute is for example "simultaneous-use" or "expiration" - the user wnats to login and the NAS needs to check if there are limitations for this user and needs to check this.
In the GUI there are many attributes implemented - just add them and take a look at the users file to see if they are check or reply attributes.
the check attributes are on the same line as the username.
reply attributes are listed below.attributes:
There are "unlimited" attributes. It always depends on what you NAS understands. Most NAS do have a dictionary of attributes and freeradius knows and understand these attributes. You can find them here - or you create a new one:/usr/local/share/freeradius/dictionary.*If you have ideas to improve the wiki - please feel free to do so. If you wrote some text - I can add this for you to the wiki. :-)
-
Okay, well, there is now no way apparently to get FreeRadius 2.x installed on the latest builds, so I figured I'd try FreeRADIUS 1.x. I cannot, for the life of me, figure out how to get all the certificates and everything to make WPA2-Enterprise. On FreeRADIUS2, once I finally got it to start, everything "just worked" - am I missing something or is FreeRADIUX 1.x not capable of doing WPA2-Enterprise. Desperately need a solution here to get the staff network up at this campground back up and online in the latest builds.
