Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NEW Package: freeRADIUS 2.x

    Scheduled Pinned Locked Moved pfSense Packages
    628 Posts 80 Posters 831.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • ?
      Guest
      last edited by

      My how-to actually doesn't work. I though it was working but I latter realized it wasn't accepting any connection. It seem the "(CRL has expired)" in the logs is Freeradius not being happy abou the CRL / not finding it.

      About step4, I did read this somewhere on the Internet, I just can't find the link. I actually seem that putting it in a separate "crl.pem" might be the standard way though.  ???

      I've found some interesting information here: http://www.breezy.ca/?q=node/223

      I've tried to add the crl_file = ${raddbdir}/certs/crl.pem in eap.conf and createated crl.pem but it still won't use the certificate revocation list (it reject everything). I know little about openssl so I am not sure if the crl is in the good format.

      1 Reply Last reply Reply Quote 0
      • A
        Altercation
        last edited by

        The freeradius2 wiki page is one of the better doc pages I've read for pfsense. I wanted to point out a minor error (or rather a possible point of confusion) in the wiki page:

        Where the initial localhost radtest is performed, the sample command includes "username password" and, while this should be clear enough to anyone setting up RADIUS, the command should be correct from:

        radtest username password 127.0.0.1:1812 0 testing123
        

        to:

        radtest testuser testpassword 127.0.0.1:1812 0 testing123
        
        1 Reply Last reply Reply Quote 0
        • N
          Nachtfalke
          last edited by

          @Altercation:

          The freeradius2 wiki page is one of the better doc pages I've read for pfsense. I wanted to point out a minor error (or rather a possible point of confusion) in the wiki page:

          Where the initial localhost radtest is performed, the sample command includes "username password" and, while this should be clear enough to anyone setting up RADIUS, the command should be correct from:

          radtest username password 127.0.0.1:1812 0 testing123
          

          to:

          radtest testuser testpassword 127.0.0.1:1812 0 testing123
          

          Fixed.
          Thanks :-)

          1 Reply Last reply Reply Quote 0
          • ?
            Guest
            last edited by

            I agree the freeradius2 wiki page is really useful. I wouldn't have managed to made freeradius work without it.

            I still haven't managed to get a Certificate revocation list working with freeeradius2. I've basically abandoned using EAP-TLS and I am only using EAP-TTLS with MSChapv2 inner authentication.

            I got it working fine on Ubuntu (network manager), Android 4, Nokia n900 and windows. Figuring how to add the certificate and use it in windows is the most complicated by far. And EAP-TLS seems even more complicated (I tried but didn't manged to get the client certificate to work).

            EAP-TTLS should be fine in term of security if used properly (with good password of course). The only (huge) problem seem to be devices that don't properly check the CA certificate… either because they were badly configured, the user ignored a warning or are just plain broken.

            1 Reply Last reply Reply Quote 0
            • S
              Sailorsknot
              last edited by

              I've setup a user with a "download limit" and set cron jobs to reset each night.  I set "$PORTAL_MESSAGE$" on captive portal Authentication error page.  When user reaches the "download limit" user is presented the captive portal logon page, and after user enters valid username/password, the captive portal error pages replies "invalid user credentials".  Anyway to change this to change this?  (ie:  download limit reached, etc.)?

              1 Reply Last reply Reply Quote 0
              • ?
                Guest
                last edited by

                I don't known about the captive portal, I don't use it. Hope you can figure something out.

                Personally I've tried setting using the account expiration (at a specific date) feature in Freeradius2 and it doesn't seem to work. If I put a date in the past (using the format "Jan 01 2012") the account seems to still be valid. If I put the date of tomorrow and wait until the next day the account is still valid.

                I would really like to make this feature work to create guest account valid for a few days. Anyone using it? According to the Freeradius2 package wiki page this feature should work.

                Alternatively if I could could do a script that would enable me to add/remove user account this could work too. Just changing the configuration file manually doesn't seem to reflect the change in Freeradius even after restarting the service.

                1 Reply Last reply Reply Quote 0
                • N
                  Nachtfalke
                  last edited by

                  @arekkusu:

                  (…)
                  Personally I've tried setting using the account expiration (at a specific date) feature in Freeradius2 and it doesn't seem to work. If I put a date in the past (using the format "Jan 01 2012") the account seems to still be valid. If I put the date of tomorrow and wait until the next day the account is still valid.

                  I would really like to make this feature work to create guest account valid for a few days. Anyone using it? According to the Freeradius2 package wiki page this feature should work.
                  (...)

                  This feature is not described on freeradius2 wiki page. Here is a description of how it should work:
                  http://lists.freeradius.org/pipermail/freeradius-users/2009-December/043702.html
                  Check the users file if the syntax is correct after you entered that in the GUI.

                  Not sure if it will work if you set a "Session-Timeout" on freeradius GUI, too. It could be possible that "Session-Timeout" and "Expiration" will not work correctly when used together because "Expiration" sends a Session-Timeout to CP and "Session-Timeout" will be, too. This could be a conflict.

                  But to make sure that CP understands Session-Timeout you have to enbale it on CP page.

                   	Use RADIUS Session-Timeout attributes
                  When this is enabled, clients will be disconnected after the amount of time retrieved from the RADIUS Session-Timeout attribute.
                  
                  1 Reply Last reply Reply Quote 0
                  • I
                    itbit
                    last edited by

                    Hi,
                    I've been looking into the freeradius and the XMLRPC part of it
                    I ran into certain issues because I'm trying to replicate with mobile networks that might be within internet range or not (trucks and boats…)

                    during my tests the XMLRPC seems to hang when the device it is trying to replicate to does not responds (not sure what is the time out period if any)

                    I looked at the code... but with my limited knowledge what I figure out I could do is actually to select the destination servers before I do the changes
                    to have that ability I modified the package the following way.

                    in
                    /usr/local/pkg/freeradiussync.xml
                    I added a check box for each destination server so we can choose which one we want to syn at that moment

                    <field><fielddescr>Destination Server</fielddescr>
                    <fieldname>none</fieldname>
                    <type>rowhelper</type>
                    <rowhelper><rowhelperfield><fieldname>varsyncdestinenable</fieldname>
                    <type>checkbox</type></rowhelperfield>

                    <rowhelperfield><fielddescr>GUI Protocol</fielddescr>
                    <fieldname>varsyncprotocol</fieldname>
                    <description>http or https]]></description>
                    <type>select</type>
                    <default_value>HTTP</default_value>
                    <options><option><name>HTTP</name><value>http</value></option>
                    <option><name>HTTPS</name><value>https</value></option></options></rowhelperfield>
                    <rowhelperfield><fielddescr>GUI IP-Address</fielddescr>
                    <fieldname>varsyncipaddress</fieldname>

                    <type>input</type>
                    <size>15</size></rowhelperfield>
                    <rowhelperfield><fielddescr>GUI Port</fielddescr>
                    <fieldname>varsyncport</fieldname>

                    <type>input</type>
                    <size>3</size></rowhelperfield>
                    <rowhelperfield><fielddescr>GUI Admin Password</fielddescr>
                    <fieldname>varsyncpassword</fieldname>

                    <type>password</type>
                    <size>20</size></rowhelperfield></rowhelper></field>

                    –---------------------------------------------
                    in
                    /usr/local/pkg/freeradius.inc

                    I updated freeradius_sync_on_changes() so it would look at the check box and execute the line if  it is enable for that server

                    function freeradius_sync_on_changes() {
                    global $config, $g;
                    $varsyncenablexmlrpc = $config['installedpackages']['freeradiussync']['config'][0]['varsyncenablexmlrpc'];

                    // if checkbox is NOT checked do nothing
                    if(!$varsyncenablexmlrpc) {
                    return;
                    }

                    log_error("FreeRADIUS: Starting XMLRPC process (freeradius_do_xmlrpc_sync).");

                    // if checkbox is checked get IP and password of the destination hosts
                    foreach ($config['installedpackages']['freeradiussync']['config'] as $rs ){
                    foreach($rs['row'] as $sh){
                    // if checkbox is NOT checked do nothing
                    if($sh['varsyncdestinenable']) {
                    $varsyncprotocol = $sh['varsyncprotocol'];
                    $sync_to_ip = $sh['varsyncipaddress'];
                    $password  = $sh['varsyncpassword'];
                    $varsyncport = $sh['varsyncport'];
                    if($password && $sync_to_ip && $varsyncport && $varsyncprotocol)
                    freeradius_do_xmlrpc_sync($sync_to_ip, $password, $varsyncport, $varsyncprotocol);
                      }
                            }
                    }
                    log_error("FreeRADIUS: Finished XMLRPC process (freeradius_do_xmlrpc_sync).");
                    }
                    –-------------------------------------------

                    Can anyone validate that these changes make sense and that I'm not breaking something else by doing this?
                    also if helpful for anybody else can it be committed to future releases of the package?

                    Cheers,

                    1 Reply Last reply Reply Quote 0
                    • marcellocM
                      marcelloc
                      last edited by

                      Did you tested it? For me it looks fine.

                      Treinamentos de Elite: http://sys-squad.com

                      Help a community developer! ;D

                      1 Reply Last reply Reply Quote 0
                      • N
                        Nachtfalke
                        last edited by

                        Not sure if it makes sense to select the hosts you want to sync. If you do not want to sync a host just delete it. Why using an extra checkbox for that ?
                        I do not think this is really usefull because in general you want to have the same content everywhere.

                        Perhaps another/better option could be to make the timeout editable. I am not familar with XMLRPC code but it seems to be at 150s (2m30s).
                        Try to change the value on this lines in "freeradius.inc" to al value of - lets say - 20s

                        The lines

                        
                        2528
                        2535
                        2559
                        2566
                        
                        

                        Marcello, can you confirm that these are the values for the XMLRPC timeout ?

                        1 Reply Last reply Reply Quote 0
                        • marcellocM
                          marcelloc
                          last edited by

                          @Nachtfalke:

                          Not sure if it makes sense to select the hosts you want to sync. If you do not want to sync a host just delete it.

                          Sometime admin wants just to disable sync host instead of delete it. sarg schedule tab has this checkbox too.

                          @Nachtfalke:

                          Marcello, can you confirm that these are the values for the XMLRPC timeout ?

                          Following code comment, it  looks like a timeout

                          /* send our XMLRPC message and timeout after 150 seconds */
                          		$resp = $cli->send($msg, "150");
                          
                          

                          Treinamentos de Elite: http://sys-squad.com

                          Help a community developer! ;D

                          1 Reply Last reply Reply Quote 0
                          • I
                            itbit
                            last edited by

                            Hi marcelloc and Nachtfalke,

                            thanks for the follow up,
                            I'm currently testing and so far so good
                            I think adjusting the timeout will meet my needs in a better way
                            I still like the idea of having the option of disabling a server without having to delete it as in my case I'm managing about 7 mobile networks that are installed in boats and usually go out of range
                            hence there is a big chance that at least four or of them will not be available when i do a new entry on the radius server (that is where the time out helps)
                            but sometimes some of this boats are down for maintenance for a few month and in that case I would like to stop the replication to them without having to delete the entry (that is where the check box for the Destination server helps)

                            So far I have check the backup file for the pfsense settings and the entry for the check box is there :)
                            I also added an extra line to the function freeradius_sync_on_changes() so it will log the servers that are disable
                            (not a big deal, but it is nice to double check that it is actually doing what it is supposed to be doing)

                            –-----------------------------------------------------------------------------------------------------------
                            function freeradius_sync_on_changes() {
                            global $config, $g;
                            $varsyncenablexmlrpc = $config['installedpackages']['freeradiussync']['config'][0]['varsyncenablexmlrpc'];

                            // if checkbox is NOT checked do nothing
                            if(!$varsyncenablexmlrpc) {
                            return;
                            }

                            log_error("FreeRADIUS: Starting XMLRPC process (freeradius_do_xmlrpc_sync).");

                            // if checkbox is checked get IP and password of the destination hosts
                            foreach ($config['installedpackages']['freeradiussync']['config'] as $rs ){
                            foreach($rs['row'] as $sh){
                            // if checkbox is NOT checked do nothing
                            if($sh['varsyncdestinenable']) {
                            $varsyncprotocol = $sh['varsyncprotocol'];
                            $sync_to_ip = $sh['varsyncipaddress'];
                            $password  = $sh['varsyncpassword'];
                            $varsyncport = $sh['varsyncport'];
                            if($password && $sync_to_ip && $varsyncport && $varsyncprotocol)
                            freeradius_do_xmlrpc_sync($sync_to_ip, $password, $varsyncport, $varsyncprotocol);
                                }
                                                else {
                                                log_error("FreeRADIUS: Sync with {$sh['varsyncipaddress']} is disable");
                                                }

                                    }
                            }
                            log_error("FreeRADIUS: Finished XMLRPC process (freeradius_do_xmlrpc_sync).");
                            }
                            –---------------------------------------------------------------------------------------------------

                            Cheers,

                            1 Reply Last reply Reply Quote 0
                            • N
                              Nachtfalke
                              last edited by

                              Hi itbit,
                              Hi marcello,

                              I am going to be on holliday the next two weeks. I don't want to add some code which could (but probably will not) cause a problem with the package. If you are able to do some tests please feel free to add these changes to the package on github. I think the both options - change the timeout value and to disable/enable temporarily some hosts will be a good improvement.

                              Thanks for your help!

                              1 Reply Last reply Reply Quote 0
                              • I
                                itbit
                                last edited by

                                Hi Nachtfalke and Marcelloc,

                                I have updated both freeradius.inc and freeradiussync.xml to allow the modification of the default XMLRPC timeout from the GUI
                                I also added the checkbox option for selecting to which servers we want to sync

                                both files have been attached to this post.

                                I also tried (but failed) to include an option to specify the user name for the account that will sync because in some of my Pfesnses I changed the default username from 'admin' to something else
                                but it works out that 'admin' is hardcoded in several places including xmlrpc.inc…

                                hopefully this all looks right to you, so far I have tested and is working as expected.

                                Cheers,

                                freeradius.inc.txt
                                freeradiussync.xml.txt

                                1 Reply Last reply Reply Quote 0
                                • marcellocM
                                  marcelloc
                                  last edited by

                                  itbit,

                                  push it via github.

                                  It will be easier to check changes and commit on current code.

                                  https://github.com/bsdperimeter/pfsense-packages

                                  Treinamentos de Elite: http://sys-squad.com

                                  Help a community developer! ;D

                                  1 Reply Last reply Reply Quote 0
                                  • I
                                    itbit
                                    last edited by

                                    Well… It took me a bit to figure it out
                                    but I think I got it.
                                    i proposed the changes at
                                    https://github.com/bsdperimeter/pfsense-packages/tree/master/config/freeradius2

                                    Cheers,

                                    1 Reply Last reply Reply Quote 0
                                    • N
                                      Nachtfalke
                                      last edited by

                                      Updates pkg v1.6.6_4:

                                      • Added: Possibility to edit the timeout when doing an XMLRPC sync between different RADIUS servers. If one RADIUS Server does not respond the main pfsense does not respond until the default timeout of 150s is over.

                                      • Added: Possibility to endable/disable a host when doing an XMLRPC sync. This allows you to add all destination hosts you want to sync this but if one is down or you do not want to sync the changes to this host you can disable this host for sync.

                                      Thank you itbit for adding this code and these options to the package. :-)

                                      Known bugs:

                                      • When using "stop/start accounting on CP then "Amount of Time/Amount of Traffic" isn't working correctly.
                                        http://redmine.pfsense.org/issues/2164

                                      • When using CP + RADIUS + Vouchers and "reauthenticate every minute" is enabled then CP sends the voucher as username to RADIUS. This causes RADIUS to disconnect the "user/voucher" because of an unknown/wrong "username".
                                        http://redmine.pfsense.org/issues/2155

                                      • When stop/start accounting on CP is enabled than the syslog shows many "wrong order" or "Login found bot no logout detected". This seems to not affect the usage of RADIUS but it is not 100% correct.
                                        http://redmine.pfsense.org/issues/2143

                                      1 Reply Last reply Reply Quote 0
                                      • D
                                        DestekTeknik
                                        last edited by

                                        Dear friends,

                                        I have a stupid question to ask. I've searched on the forum but couldn't find an exact solution to my problem.

                                        I'm modifying the files of FR 2 to make it connect to my mysql server and work flawlessly with my daloradius server. I'm backing up the files I've modified, but the problem is, whenever I reboot the machine, all of the files returns to their original values. So I made a backup of the raddb folder, and whenever I reboot my pfsense, I stop the service, untar the backup I've made, and restart the service.

                                        I want to get rid all of that. Is there any way to make the file changes permanent?

                                        1 Reply Last reply Reply Quote 0
                                        • marcellocM
                                          marcelloc
                                          last edited by

                                          @DestekTeknik:

                                          I want to get rid all of that. Is there any way to make the file changes permanent?

                                          Edit script that creates config files, it's usually package_name.inc script.

                                          And to keep this file modification on xml backup, use filer package.

                                          Treinamentos de Elite: http://sys-squad.com

                                          Help a community developer! ;D

                                          1 Reply Last reply Reply Quote 0
                                          • N
                                            Nachtfalke
                                            last edited by

                                            @DestekTeknik
                                            All files that will be modified by the GUI are in the freeradius.inc:

                                            /usr/local/pkg/freeradius.inc
                                            

                                            So the best solution for you would be to modify the freeradius.inc file so that it does what you want.
                                            Then your configuration will survive a reboot :-)

                                            But it will not survive a package reinstallation of freeradius and not a pfsense firmware update.
                                            For this - if I understand marcelloc correctly - you will have a look at the filer package. I didn't ever used the filer package.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.