Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NEW Package: freeRADIUS 2.x

    Scheduled Pinned Locked Moved pfSense Packages
    628 Posts 80 Posters 750.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • I
      itbit
      last edited by

      Hi marcelloc and Nachtfalke,

      thanks for the follow up,
      I'm currently testing and so far so good
      I think adjusting the timeout will meet my needs in a better way
      I still like the idea of having the option of disabling a server without having to delete it as in my case I'm managing about 7 mobile networks that are installed in boats and usually go out of range
      hence there is a big chance that at least four or of them will not be available when i do a new entry on the radius server (that is where the time out helps)
      but sometimes some of this boats are down for maintenance for a few month and in that case I would like to stop the replication to them without having to delete the entry (that is where the check box for the Destination server helps)

      So far I have check the backup file for the pfsense settings and the entry for the check box is there :)
      I also added an extra line to the function freeradius_sync_on_changes() so it will log the servers that are disable
      (not a big deal, but it is nice to double check that it is actually doing what it is supposed to be doing)

      –-----------------------------------------------------------------------------------------------------------
      function freeradius_sync_on_changes() {
      global $config, $g;
      $varsyncenablexmlrpc = $config['installedpackages']['freeradiussync']['config'][0]['varsyncenablexmlrpc'];

      // if checkbox is NOT checked do nothing
      if(!$varsyncenablexmlrpc) {
      return;
      }

      log_error("FreeRADIUS: Starting XMLRPC process (freeradius_do_xmlrpc_sync).");

      // if checkbox is checked get IP and password of the destination hosts
      foreach ($config['installedpackages']['freeradiussync']['config'] as $rs ){
      foreach($rs['row'] as $sh){
      // if checkbox is NOT checked do nothing
      if($sh['varsyncdestinenable']) {
      $varsyncprotocol = $sh['varsyncprotocol'];
      $sync_to_ip = $sh['varsyncipaddress'];
      $password  = $sh['varsyncpassword'];
      $varsyncport = $sh['varsyncport'];
      if($password && $sync_to_ip && $varsyncport && $varsyncprotocol)
      freeradius_do_xmlrpc_sync($sync_to_ip, $password, $varsyncport, $varsyncprotocol);
          }
                          else {
                          log_error("FreeRADIUS: Sync with {$sh['varsyncipaddress']} is disable");
                          }

              }
      }
      log_error("FreeRADIUS: Finished XMLRPC process (freeradius_do_xmlrpc_sync).");
      }
      –---------------------------------------------------------------------------------------------------

      Cheers,

      1 Reply Last reply Reply Quote 0
      • N
        Nachtfalke
        last edited by

        Hi itbit,
        Hi marcello,

        I am going to be on holliday the next two weeks. I don't want to add some code which could (but probably will not) cause a problem with the package. If you are able to do some tests please feel free to add these changes to the package on github. I think the both options - change the timeout value and to disable/enable temporarily some hosts will be a good improvement.

        Thanks for your help!

        1 Reply Last reply Reply Quote 0
        • I
          itbit
          last edited by

          Hi Nachtfalke and Marcelloc,

          I have updated both freeradius.inc and freeradiussync.xml to allow the modification of the default XMLRPC timeout from the GUI
          I also added the checkbox option for selecting to which servers we want to sync

          both files have been attached to this post.

          I also tried (but failed) to include an option to specify the user name for the account that will sync because in some of my Pfesnses I changed the default username from 'admin' to something else
          but it works out that 'admin' is hardcoded in several places including xmlrpc.inc…

          hopefully this all looks right to you, so far I have tested and is working as expected.

          Cheers,

          freeradius.inc.txt
          freeradiussync.xml.txt

          1 Reply Last reply Reply Quote 0
          • marcellocM
            marcelloc
            last edited by

            itbit,

            push it via github.

            It will be easier to check changes and commit on current code.

            https://github.com/bsdperimeter/pfsense-packages

            Treinamentos de Elite: http://sys-squad.com

            Help a community developer! ;D

            1 Reply Last reply Reply Quote 0
            • I
              itbit
              last edited by

              Well… It took me a bit to figure it out
              but I think I got it.
              i proposed the changes at
              https://github.com/bsdperimeter/pfsense-packages/tree/master/config/freeradius2

              Cheers,

              1 Reply Last reply Reply Quote 0
              • N
                Nachtfalke
                last edited by

                Updates pkg v1.6.6_4:

                • Added: Possibility to edit the timeout when doing an XMLRPC sync between different RADIUS servers. If one RADIUS Server does not respond the main pfsense does not respond until the default timeout of 150s is over.

                • Added: Possibility to endable/disable a host when doing an XMLRPC sync. This allows you to add all destination hosts you want to sync this but if one is down or you do not want to sync the changes to this host you can disable this host for sync.

                Thank you itbit for adding this code and these options to the package. :-)

                Known bugs:

                • When using "stop/start accounting on CP then "Amount of Time/Amount of Traffic" isn't working correctly.
                  http://redmine.pfsense.org/issues/2164

                • When using CP + RADIUS + Vouchers and "reauthenticate every minute" is enabled then CP sends the voucher as username to RADIUS. This causes RADIUS to disconnect the "user/voucher" because of an unknown/wrong "username".
                  http://redmine.pfsense.org/issues/2155

                • When stop/start accounting on CP is enabled than the syslog shows many "wrong order" or "Login found bot no logout detected". This seems to not affect the usage of RADIUS but it is not 100% correct.
                  http://redmine.pfsense.org/issues/2143

                1 Reply Last reply Reply Quote 0
                • D
                  DestekTeknik
                  last edited by

                  Dear friends,

                  I have a stupid question to ask. I've searched on the forum but couldn't find an exact solution to my problem.

                  I'm modifying the files of FR 2 to make it connect to my mysql server and work flawlessly with my daloradius server. I'm backing up the files I've modified, but the problem is, whenever I reboot the machine, all of the files returns to their original values. So I made a backup of the raddb folder, and whenever I reboot my pfsense, I stop the service, untar the backup I've made, and restart the service.

                  I want to get rid all of that. Is there any way to make the file changes permanent?

                  1 Reply Last reply Reply Quote 0
                  • marcellocM
                    marcelloc
                    last edited by

                    @DestekTeknik:

                    I want to get rid all of that. Is there any way to make the file changes permanent?

                    Edit script that creates config files, it's usually package_name.inc script.

                    And to keep this file modification on xml backup, use filer package.

                    Treinamentos de Elite: http://sys-squad.com

                    Help a community developer! ;D

                    1 Reply Last reply Reply Quote 0
                    • N
                      Nachtfalke
                      last edited by

                      @DestekTeknik
                      All files that will be modified by the GUI are in the freeradius.inc:

                      /usr/local/pkg/freeradius.inc
                      

                      So the best solution for you would be to modify the freeradius.inc file so that it does what you want.
                      Then your configuration will survive a reboot :-)

                      But it will not survive a package reinstallation of freeradius and not a pfsense firmware update.
                      For this - if I understand marcelloc correctly - you will have a look at the filer package. I didn't ever used the filer package.

                      1 Reply Last reply Reply Quote 0
                      • A
                        anzak84
                        last edited by

                        After Updates pkg v1.6.6_4:

                        radiusd -X
                        rlm_eap: SSL error error:02001002:system library:fopen:No such file or directory
                        rlm_eap_tls: Error reading certificate file /usr/local/etc/raddb/certs/server_cert.pem
                        rlm_eap: Failed to initialize type tls
                        /usr/local/etc/raddb/eap.conf[2]: Instantiation failed for module "eap"
                        /usr/local/etc/raddb/sites-enabled/default[339]: Failed to load module "eap".
                        /usr/local/etc/raddb/sites-enabled/default[274]: Errors parsing authenticate section.

                        radiusd.conf

                        modules {
                        $INCLUDE ${confdir}/modules/
                        #$INCLUDE eap.conf
                        …...........
                        #$INCLUDE sites-enabled/
                        …..............

                        radiusd -X

                        radiusd: #### Loading Virtual Servers ####
                        server { # from file /usr/local/etc/raddb/radiusd.conf
                        modules {
                        } # modules
                        } # server
                        radiusd: #### Opening IP addresses and Ports ####
                        listen {
                                type = "auth"
                                ipaddr = 192.168.65.254
                                port = 1812
                        Failed binding to authentication address 192.168.65.254 port 1812: Address already in use
                        /usr/local/etc/raddb/radiusd.conf[36]: Error binding to port for 192.168.65.254 port 1812

                        and

                        radtest test test 127.0.0.1:1812 0 test

                        Sending Access-Request of id 226 to 127.0.0.1 port 1812
                                User-Name = "test"
                                User-Password = "test"
                                NAS-IP-Address = 192.168.65.254
                                NAS-Port = 0
                                Message-Authenticator = 0x00000000000000000000000000000000
                        radclient: no response from server for ID 226 socket 3

                        how to solve the problem. FreeRadius removal and reinstallation does not help: (

                        RADIUS NAS IP attribute change to 192.168.65.254. Working.

                        1 Reply Last reply Reply Quote 0
                        • N
                          Nachtfalke
                          last edited by

                          After reinstalling freeradius go to the EAP tab and check if the certificates are correct and then click again on "save".
                          It could also help to change the "cert manager" option on the EAP-tab, click save and then change back and click save again.

                          1 Reply Last reply Reply Quote 0
                          • N
                            Nachtfalke
                            last edited by

                            New version of freeradius is available:
                            2.2.0

                            When looking at the freeradius.org webpage it says:

                            100% configuration file compatible with 2.1.x. The only fix needed is to disallow "hashsize=0" for rlm_passwd
                            

                            So this should be no problem for the configuration.

                            But the makefile seems to have changed - and now different "build options" must be used. Can someone verify this and perhaps make it available for pfsense ?
                            http://www.freebsd.org/cgi/cvsweb.cgi/ports/net/freeradius2/
                            http://www.freebsd.org/cgi/cvsweb.cgi/ports/net/freeradius2/Makefile?rev=1.108

                            Thanks

                            1 Reply Last reply Reply Quote 0
                            • O
                              oragon
                              last edited by

                              newbie question. i have reinstalled my pfsense 2.0.1 for 3 times but i don't see the freeradius 2.x as my available package. please advise on how i could have it. thanks for the reply

                              1 Reply Last reply Reply Quote 0
                              • marcellocM
                                marcelloc
                                last edited by

                                you have nano or full install????

                                Treinamentos de Elite: http://sys-squad.com

                                Help a community developer! ;D

                                1 Reply Last reply Reply Quote 0
                                • N
                                  Nachtfalke
                                  last edited by

                                  In general freeradius2 package is available for i386/amd64 installations using pfsense version 2.x
                                  Full installation on HDD is supported and it should run on nanobsd installations, too.

                                  Not sure, why it will not be displayed on you installation but you can try this:
                                  1.) login on pfsense
                                  2.) access this URL: http://your_pfsense_IP/pkg_mgr_install.php?id=freeradius2

                                  1 Reply Last reply Reply Quote 0
                                  • Z
                                    z3r0tech
                                    last edited by

                                    @Nachtfalke:

                                    In general freeradius2 package is available for i386/amd64 installations using pfsense version 2.x
                                    Full installation on HDD is supported and it should run on nanobsd installations, too.

                                    Not sure, why it will not be displayed on you installation but you can try this:
                                    1.) login on pfsense
                                    2.) access this URL: http://your_pfsense_IP/pkg_mgr_install.php?id=freeradius2

                                    this is my pfsense:

                                    2.0.1-RELEASE (i386)
                                    built on Mon Dec 12 17:53:52 EST 2011
                                    FreeBSD 8.1-RELEASE-p6

                                    You are on the latest version.

                                    im using the http://mirror.optus.net/pub/pfSense/downloads/pfSense-2.0.1-RELEASE-i386.iso.gz
                                    installed everything on my hdd using vmware workstation 8
                                    installed lusca and squidguard without problems…

                                    i have the same problem it does not show on available packages
                                    here's the error on console when i try pkg_add -r freeradius2
                                    and manual adding it on the pfsense webgui

                                    is there a way i can fetch it or modify the repo links or xml? how?
                                    or how can i install it manually or add it on the available package list?

                                    ![console freeradius2.jpg](/public/imported_attachments/1/console freeradius2.jpg)
                                    ![console freeradius2.jpg_thumb](/public/imported_attachments/1/console freeradius2.jpg_thumb)
                                    freeradius2.jpg
                                    freeradius2.jpg_thumb

                                    1 Reply Last reply Reply Quote 0
                                    • N
                                      Nachtfalke
                                      last edited by

                                      I have some different VMs with 2.0.1 x86/x64 installs and pfsense 2.1 installs.
                                      I can install the package on all machines from the GUI.

                                      The parameter which indicates the version is the same as for lets say squid2 or squidguard:

                                      
                                      <required_version>2.0</required_version>
                                      
                                      

                                      But I am not sure where the check is for the different installation types like CD, nanobsd and embedded :(

                                      Can you try another .iso image from another mirror ?

                                      1 Reply Last reply Reply Quote 0
                                      • Z
                                        z3r0tech
                                        last edited by

                                        @Nachtfalke:

                                        I have some different VMs with 2.0.1 x86/x64 installs and pfsense 2.1 installs.
                                        I can install the package on all machines from the GUI.

                                        The parameter which indicates the version is the same as for lets say squid2 or squidguard:

                                        
                                        <required_version>2.0</required_version>
                                        
                                        

                                        But I am not sure where the check is for the different installation types like CD, nanobsd and embedded :(

                                        Can you try another .iso image from another mirror ?

                                        the url is invalid i found it here https://redmine.pfsense.org/issues/2075
                                        https://redmine.pfsense.org/projects/pfsense/repository/revisions/c70452506a0ab84a9d72547656b516f6e61578da
                                        i don't know how to apply the diff this is the fix…

                                        1 Reply Last reply Reply Quote 0
                                        • N
                                          Nachtfalke
                                          last edited by

                                          That's not the problem why you do not get freeradius in packagemanager GUI.

                                          If you want to use pkg_add -r then just use the complete path to pfsense server.

                                          x86:
                                          pkg_add -r http://files.pfsense.org/packages/8/All/freeradius-2.1.12_1.tbz

                                          x64:
                                          pkg_add -r http://files.pfsense.org/packages/amd64/8/All/freeradius-2.1.12_1.tbz

                                          1 Reply Last reply Reply Quote 0
                                          • Z
                                            z3r0tech
                                            last edited by

                                            @Nachtfalke:

                                            That's not the problem why you do not get freeradius in packagemanager GUI.

                                            If you want to use pkg_add -r then just use the complete path to pfsense server.

                                            x86:
                                            pkg_add -r http://files.pfsense.org/packages/8/All/freeradius-2.1.12_1.tbz

                                            x64:
                                            pkg_add -r http://files.pfsense.org/packages/amd64/8/All/freeradius-2.1.12_1.tbz

                                            thanks! it's working now…

                                            i tried this post to install the gui: http://forum.pfsense.org/index.php?topic=50572.0
                                            Fatal error: Call to undefined function freeradius_install_command() in /usr/local/www/exec.php(244) : eval()'d code on line 9

                                            any solutions?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.