NEW Package: freeRADIUS 2.x

[Nachtfalke]

radcheck seems to be the correct place for username and password.

radiusd -X will tell you what is missng or wrong. Run freeradius in this mode and read all the output. On some line you will see that freeradius will check for a username and then you can see what is missing, wrong or what happened.

[myke]

Hello everyone,

I have 2 questions :
I want to use Freeradius 2 for certificates for TLS.
But when i export client P.12 on my mobility controller, it tells me the password isn't valid.

There is a bug or what i'm doing wrong?

So i decided to convert my certificat with openssl and it's okay when i'm exporting  but i've got a error radius when i'm logging:
"Error: TLS Alert read:fatal:unknown CA
Thu Nov 22 17:57:49 2012 : Error:    TLS_accept: failed in SSLv3 read client certificate A
Thu Nov 22 17:57:49 2012 : Error: rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca"

This means there is a problem with the certificat but i can't find the solution…

Thanks for the help.
Best regards.

[Nachtfalke]

In general you should create your CA ander server cert on pfsene Cert Manager.
then select these two certificates on freeradius -> EAP and save.

Client certificates can be build on pfsense Cert Manager and export the .p12 file. This should work and the .p12 file should be without any password. can you try with an empty password ? But this is more a "pfsense" problem than a freeradius problem.

I am not sure but if I remember correct there was another thread here in the forum which is about the .p12 file and a password. Perhaps the search function can help you.

[myke]

@Nachtfalke:

In general you should create your CA ander server cert on pfsene Cert Manager.
then select these two certificates on freeradius -> EAP and save.

Client certificates can be build on pfsense Cert Manager and export the .p12 file. This should work and the .p12 file should be without any password. can you try with an empty password ? But this is more a "pfsense" problem than a freeradius problem.

I am not sure but if I remember correct there was another thread here in the forum which is about the .p12 file and a password. Perhaps the search function can help you.

Thanks for the answer.

My Certificate Authority and certificate was created in pfsense Cert manager. I just created .pfx with openssl.
In first time i try with an empty password and second time with a password "pfsense" but exactly the same result.

I use pfsense 2.0.1 AMD release.

Myke.

[red2006]

@Nachtfalke

Hello…

ive encountered 2 problems with my pfsense+captiveportal+freeradius
im currently testing the configuration before i test my sql component.

idont know if youve already encountered this and ive seen some posts here on the forum but never rily got the chance to have the solution.

first: MAX-DAILY-USAGE time...

currently i have 50 users on my freeradius2 users tab
with different max time on daily basis
but the problem is...
if one of the users got the maximum daily usage time...
all of the users also maxed out of their daily time even if they've just going to log in for the first time of the day.

i understand that the other threads have problem on max-daily-usage time on not resetting the counter/session to zero(0) so that the next day they'll have a fresh acct with a fresh daily time usage.

so how can i reset the session/counter of the max-daily-usage so that i dont have to create another acct for all of users all over again.

and how would i resolve the all users maxed out of their time when one(1) user consumed all of his/her time in a day.

Second(2) - WebGUI slow process

i am experiencing a slow process on the webGUI of pfsense...
what could be the problem?
i didnt change anything on my configuration nor installed additional packages.
but it takes at leat 3 mins to go to another page on my webGUI of pfsense.

ive already restarted pfsense.
check all my network connectivity and work all fine.

but still have the super slow process on the webGUI even if just clikcing or navigating to the pages of the webGUI...

hope you can help me with this Nachtfalke.

Tahnk you very very much.

[Nachtfalke]

@red2006

the counter module in /usr/local/ect/raddb/mnodules is a predifined module within the freeradius2 package. it works how it comes from freeradius.org. The freeradius2 package does not change anything on this module.

here is a description:

http://linux.die.net/man/5/rlm_counter

The database which contains the daily-usage can be found here:
/var/log/radacct/timecounter/daily/db.daily

Depending on what you set in the users setting - the counter will be resetted.

The problem why users gets disconnected if one user has rached its limit is probably because of the fact that CP is sending wrong values. Which values are wrong and why there are wrong - I don't know. I am really really sorry but I do not know what CP is doing wrong. If you know what is wrong and you can explain what is happening, how ist can be reproduced in a testing environment and perhaps do some packet-captures you should open a ticket on redmine so that someone can fix this bug on CP.

Further try checing this with different pfsense versions - 2.0.0, 2.0.1, 2.0.2, 2.1. Perhaps only some versions are affected and not all.

Your second question:
Is the slowness of the GUI dependend if you have freeradius2 package installed or not ?
You can check with the command "top" on console which process is using much memory/CPU time when the GUI is slow.

I hope this will help you :)

[red2006]

@Nachtfalke

ive managed to restore my pfsense configuration from the moment ive configured the CP+freeradius
and its working fine now(slow process no more)

i dont know what rily happened.

and i reuploaded all of my users again.

i now have a very minimal config on my CP and free radius just for the bug testing again of pfsense+CP+freeRadius

i limited the bandwidth per user on CP, so all of the users added on freeradius would have same bandwidth restrictions
and session limit is set on freeradius and everybody on the users tab have the same session limit.

i tested to have a different bandwidth allocation on freeradius acct entry but the users authentication replied accept-reject. i dont know why this happens but i when i emptied the bandwidth limit on the user entry on free radius, the user authentication succeeded… i dont know what the problem on that.

also all of my users have now an unlimited access on the internet but with a hard time out of 1 hour, i will not set anything first on the user max daily time limit until i got some answers or further testing on the max daily usage per user.

i currently have 160 users on the users tab and i dont think i want to reenter them again if i misconfigured again the user max daily time.

ill try to look for ways on how to reset or clear the cache of users max daily time usage coz on my last testing even if the user maxed out of his time per day, he cannot realy login/reauthenticated the next day or any succeeding days, meaning that CP is not really resetting its time/counter/cache on any basis, even if i reconfigure the user to another max daily time usage. The only solution is to rename the username. Thats the only solution to really have a fresh or counter reset on the users account.

thanks alot Nachtfalke.

hope to have a solution on atleast on the max daily usage of the users soon... thanks alot.

---

another one.

is this possible?
to have the logs or table of user account login or time usage of users from the moment the account was created.
to have it printed or shown on the webGUI?

thanks.
i need that report for my network monitoring blabla... :-)

thanks again... youve been realy a big help on my part.

[Nachtfalke]

Hi,

I think the problem is CaptivePortal which isn't doing accounting the correct way. Perhaps you should go the same way using redmine.pfsense.org like I wrote here:
http://forum.pfsense.org/index.php/topic,52324.msg300182.html#new

For getting more information when a user is logged on you can enable logging on freeradius2 GUI –> Settings.
Then you could extend the output when someone with wrong or correct username/password authenticates. Take a look at the following link:
http://doc.pfsense.org/index.php/FreeRADIUS_2.x_package#Syslog:_Expand_the_logging_output_to_your_needs

You could try with:

Remaining time in seconds: %{reply:Session-Timeout} 

As far as I know freeradius sends back "Sessio9n-Timeout" as attribute in a reply message. You can fill in other attributes - you just have to find out their name and if the appear in a request or a reply and so on :-)

Good luck and thank you for your help!

[shell]

Suddenly my radius stopped working. Without any message or any error. Starting the service manually gives the following error message:

gdbm fatal: read error

Backup, Restore, fresh install of the package…. no success. Now i'm totally confused  ???

[Nachtfalke]

Please start freeradius from console in debug mode. type:

radiusd -X

and the post the complete output. I am sure the error is somewhere else.

[shell]

Here is the output:

http://paste.pcspinnt.de/pastebin.php?show=m72943fe0

May be it's a bug. I'm using the newest freeradius2 package (Beta 1.1.8 pkg v1.0.5 platform: 2.0)

[Nachtfalke]

@shell:

Here is the output:

http://paste.pcspinnt.de/pastebin.php?show=m72943fe0

May be it's a bug. I'm using the newest freeradius2 package (Beta 1.1.8 pkg v1.0.5 platform: 2.0)

You mixed up things. there are two different freeradius packages.
freeradius and freeradius2. They are both not compatible. Which version do you use and which version do you want to use ?

This is the thread for freeradius2 package.

[shell]

Sorry, wrong paste. Now the right one:

RC1
2.1.12_1 pkg v1.6.6_4
platform: 2.0

[Nachtfalke]

Ok, no problem.

In checked your radiusd -X output and could not found a problem.

I checked the installed packages on my system with

pkg_info

and I found

gdbm-1.9.1

Make sure that you have this on your pfsense - I am not absolutly sure but I think this comes with pfsense by default.

You can try to add it with:
amd64

pkg_add -r http://files.pfsense.org/packages/amd64/8/All/gdbm-1.9.1.tbz

i386:

pkg_add -r http://files.pfsense.org/packages/8/All/gdbm-1.9.1.tbz

[shell]

Ui, i've an older version:

gdbm-1.8.3_3        The GNU database manager

Will install the new one. May be this works.

EDIT:

pkg_delete gdbm-1.8.3_3

pkg_delete: file '/usr/local/man/man3/gdbm.3.gz' doesn't exist
pkg_delete: file '/usr/local/include/gdbm.h' doesn't exist
pkg_delete: file '/usr/local/lib/libgdbm.a' doesn't exist
pkg_delete: file '/usr/local/lib/libgdbm.la' doesn't exist
pkg_delete: file '/usr/local/lib/libgdbm.so' doesn't exist
pkg_delete: file '/usr/local/info/gdbm.info' doesn't exist
pkg_delete: couldn't entirely delete package (perhaps the packing list is
incorrectly specified?)

EDIT2:

@#$!  >:(

Same error:

gdbm fatal: read error

[Nachtfalke]

Don't know why.

Can you reinstall pfsense - backup the config before you do that.

[shell]

No, can't do that. It's big machine with several interfaces and many active VPN connections. No further idea?

EDIT:

Ok, i think i found a bug. Did a few test and commented out some lines. Now, i can start the radiusd.

Here is what i commented out.

@radiusd.conf:

…
instantiate {

exec
       expr
       #daily
       #weekly
       #monthly
       #forever
       expiration
       logintime
       ### Dis-/Enable sql instatiate
       #sql
}
…

@sites-available/default:

…
      #  The ldap module will set Auth-Type to LDAP if it has not
       #  already been set

### ldap ###

#
       #  Enforce daily limits on time spent logged in.
      #daily
       #weekly
       #monthly
       #forever

#
       # Use the checkval module
…
accounting {
       #  
       #  Create a 'detail'ed log of the packets.
       #  Note that accounting requests which are proxied
       #  are also logged in the detail file.
       detail
       #daily
       #weekly
       #monthly
       #forever
…

Further informations will follow.

EDIT2:

Ok, looks like a big bug. Copied my old configuration and commented out this lines. Now everything works. Can anybody explain me these settings?

[shell]

I've written to patches for these files:

--- /usr/local/etc/raddb/sites-available/default        2012-12-12 07:50:48.000000000 +0100
+++ default     2012-12-12 07:39:34.000000000 +0100
@@ -197,10 +197,10 @@

        #
        #  Enforce daily limits on time spent logged in.[color][/color]
-       daily
-       weekly
-       monthly
-       forever
+       #daily
+       #weekly
+       #monthly
+       #forever

        #
        # Use the checkval module
@@ -400,10 +400,10 @@
        #  Note that accounting requests which are proxied
        #  are also logged in the detail file.
        detail
-       daily
-       weekly
-       monthly
-       forever
+       #daily
+       #weekly
+       #monthly
+       #forever

        ### This makes it possible to run the datacounter_acct module only on accounting-stop and interim-updates
        if ((request:Acct-Status-Type == Stop) || (request:Acct-Status-Type == Interim-Update)) {

--- /usr/local/etc/raddb/radiusd.conf   2012-12-12 07:49:27.000000000 +0100
+++ radiusd.conf        2012-12-12 07:38:03.000000000 +0100
@@ -87,10 +87,10 @@

        exec
        expr
-       daily
-       weekly
-       monthly
-       forever
+       #daily
+       #weekly
+       #monthly
+       #forever
        expiration
        logintime
        ### Dis-/Enable sql instatiate

These two patches are applied via crontab every night. I know this is just a workaround.

[Nachtfalke]

It's not a bug. You have a missing config file on your system.
You should have a file called "counter" here:

usr/local/etc/raddb/modules/

This is for granting time based access.
The function on freeradius.inc is called:

freeradius_modulescounter_resync()

You will find it on line 2611.

And the initial configuration on line 112 and the following.

[shell]

Ah ok, i remember this file. But it's there:

-rw-r-----  1 root  wheel   3.6K Dec  7 13:27 /usr/local/etc/raddb/modules/counter

Here it is: http://paste.pcspinnt.de/pastebin.php?show=m64f35679