NEW Package: freeRADIUS 2.x

Nachtfalke · Nov 27, 2012, 5:09 PM

Hi,

I think the problem is CaptivePortal which isn't doing accounting the correct way. Perhaps you should go the same way using redmine.pfsense.org like I wrote here:
http://forum.pfsense.org/index.php/topic,52324.msg300182.html#new

For getting more information when a user is logged on you can enable logging on freeradius2 GUI –> Settings.
Then you could extend the output when someone with wrong or correct username/password authenticates. Take a look at the following link:
http://doc.pfsense.org/index.php/FreeRADIUS_2.x_package#Syslog:_Expand_the_logging_output_to_your_needs

You could try with:


Remaining time in seconds: %{reply:Session-Timeout}

As far as I know freeradius sends back "Sessio9n-Timeout" as attribute in a reply message. You can fill in other attributes - you just have to find out their name and if the appear in a request or a reply and so on :-)

Good luck and thank you for your help!

shell · Dec 6, 2012, 10:41 AM

Suddenly my radius stopped working. Without any message or any error. Starting the service manually gives the following error message:

gdbm fatal: read error

Backup, Restore, fresh install of the package…. no success. Now i'm totally confused ???

Nachtfalke · Dec 6, 2012, 7:05 PM

Please start freeradius from console in debug mode. type:

radiusd -X

and the post the complete output. I am sure the error is somewhere else.

shell · Dec 7, 2012, 8:18 AM

Here is the output:

http://paste.pcspinnt.de/pastebin.php?show=m72943fe0

May be it's a bug. I'm using the newest freeradius2 package (Beta 1.1.8 pkg v1.0.5 platform: 2.0)

Nachtfalke · Dec 7, 2012, 8:51 AM

@shell:

Here is the output:

http://paste.pcspinnt.de/pastebin.php?show=m72943fe0

May be it's a bug. I'm using the newest freeradius2 package (Beta 1.1.8 pkg v1.0.5 platform: 2.0)

You mixed up things. there are two different freeradius packages.
freeradius and freeradius2. They are both not compatible. Which version do you use and which version do you want to use ?

This is the thread for freeradius2 package.

shell · Dec 7, 2012, 9:15 AM

Sorry, wrong paste. Now the right one:

RC1
2.1.12_1 pkg v1.6.6_4
platform: 2.0

Nachtfalke · Dec 7, 2012, 10:30 AM

Ok, no problem.

In checked your radiusd -X output and could not found a problem.

I checked the installed packages on my system with

pkg_info

and I found

gdbm-1.9.1

Make sure that you have this on your pfsense - I am not absolutly sure but I think this comes with pfsense by default.

You can try to add it with:
amd64


pkg_add -r http://files.pfsense.org/packages/amd64/8/All/gdbm-1.9.1.tbz

i386:


pkg_add -r http://files.pfsense.org/packages/8/All/gdbm-1.9.1.tbz

shell · Dec 7, 2012, 10:48 AM

Ui, i've an older version:

gdbm-1.8.3_3 The GNU database manager

Will install the new one. May be this works.

EDIT:

pkg_delete gdbm-1.8.3_3

pkg_delete: file '/usr/local/man/man3/gdbm.3.gz' doesn't exist
pkg_delete: file '/usr/local/include/gdbm.h' doesn't exist
pkg_delete: file '/usr/local/lib/libgdbm.a' doesn't exist
pkg_delete: file '/usr/local/lib/libgdbm.la' doesn't exist
pkg_delete: file '/usr/local/lib/libgdbm.so' doesn't exist
pkg_delete: file '/usr/local/info/gdbm.info' doesn't exist
pkg_delete: couldn't entirely delete package (perhaps the packing list is
incorrectly specified?)

EDIT2:

@#$! >:(

Same error:

gdbm fatal: read error

Nachtfalke · Dec 7, 2012, 10:53 AM

Don't know why.

Can you reinstall pfsense - backup the config before you do that.

shell · Dec 7, 2012, 1:36 PM

No, can't do that. It's big machine with several interfaces and many active VPN connections. No further idea?

EDIT:

Ok, i think i found a bug. Did a few test and commented out some lines. Now, i can start the radiusd.

Here is what i commented out.

@radiusd.conf:

…
instantiate {

exec
expr
#daily
#weekly
#monthly
#forever
expiration
logintime
### Dis-/Enable sql instatiate
#sql
}
…

@sites-available/default:

…
# The ldap module will set Auth-Type to LDAP if it has not
# already been set

### ldap ###

#
# Enforce daily limits on time spent logged in.
#daily
#weekly
#monthly
#forever

#
# Use the checkval module
…
accounting {
#
# Create a 'detail'ed log of the packets.
# Note that accounting requests which are proxied
# are also logged in the detail file.
detail
#daily
#weekly
#monthly
#forever
…

Further informations will follow.

EDIT2:

Ok, looks like a big bug. Copied my old configuration and commented out this lines. Now everything works. Can anybody explain me these settings?

shell · Dec 12, 2012, 7:22 AM

I've written to patches for these files:

--- /usr/local/etc/raddb/sites-available/default        2012-12-12 07:50:48.000000000 +0100
+++ default     2012-12-12 07:39:34.000000000 +0100
@@ -197,10 +197,10 @@

        #
        #  Enforce daily limits on time spent logged in.[color][/color]
-       daily
-       weekly
-       monthly
-       forever
+       #daily
+       #weekly
+       #monthly
+       #forever

        #
        # Use the checkval module
@@ -400,10 +400,10 @@
        #  Note that accounting requests which are proxied
        #  are also logged in the detail file.
        detail
-       daily
-       weekly
-       monthly
-       forever
+       #daily
+       #weekly
+       #monthly
+       #forever

        ### This makes it possible to run the datacounter_acct module only on accounting-stop and interim-updates
        if ((request:Acct-Status-Type == Stop) || (request:Acct-Status-Type == Interim-Update)) {

--- /usr/local/etc/raddb/radiusd.conf   2012-12-12 07:49:27.000000000 +0100
+++ radiusd.conf        2012-12-12 07:38:03.000000000 +0100
@@ -87,10 +87,10 @@

        exec
        expr
-       daily
-       weekly
-       monthly
-       forever
+       #daily
+       #weekly
+       #monthly
+       #forever
        expiration
        logintime
        ### Dis-/Enable sql instatiate

These two patches are applied via crontab every night. I know this is just a workaround.

Nachtfalke · Dec 12, 2012, 7:42 AM

It's not a bug. You have a missing config file on your system.
You should have a file called "counter" here:

usr/local/etc/raddb/modules/

This is for granting time based access.
The function on freeradius.inc is called:

freeradius_modulescounter_resync()

You will find it on line 2611.

And the initial configuration on line 112 and the following.

shell · Dec 12, 2012, 11:49 AM

Ah ok, i remember this file. But it's there:

-rw-r-----  1 root  wheel   3.6K Dec  7 13:27 /usr/local/etc/raddb/modules/counter

Here it is: http://paste.pcspinnt.de/pastebin.php?show=m64f35679

Nachtfalke · Dec 12, 2012, 6:55 PM

@shell:

Ah ok, i remember this file. But it's there:
-rw-r-----  1 root  wheel   3.6K Dec  7 13:27 /usr/local/etc/raddb/modules/counter
Here it is: http://paste.pcspinnt.de/pastebin.php?show=m64f35679

Ok, then the problem isn't freeradius but some missing files on your pfsense. missing packages like gdbm or something else.
That's why I said - backup the pfsense config, reinstall pfsense and restore config. this will reinstall all packages and restore all config.

If this isn't the way you want to go - then you can modify the freeradius.inc file and uncomment the lines you posted.
Uncomment them on line 349 and 1596. Then you do not need any cron script.

bdani · Dec 16, 2012, 4:54 PM

Hi there!

Has anyone ever tried to set MikroTik RADIUS authentication?
I want to auth my AP-s from PF freeradius2.

With freeradius is working, but I cannot set bandwith limits… :(
With freeradius2 isn't communicating... :(

any ideas? :)

Thanks in advance... :(

Nachtfalke · Dec 16, 2012, 5:45 PM

@bdani:

Hi there!

Has anyone ever tried to set MikroTik RADIUS authentication?
I want to auth my AP-s from PF freeradius2.

With freeradius is working, but I cannot set bandwith limits… :(
With freeradius2 isn't communicating... :(

any ideas? :)

Thanks in advance... :(

Select an interface for authentication or set "*" for any interface.
on "client/NAS" set the IP address of the mikrotik AP and the correct password.
On Mikrotik set as RADIUS IP the IP of the listening interface and the correct/same password as on "Clients/NAS".

Enable logging on freeradius2 to see what is happening on syslog.

bdani · Dec 16, 2012, 10:03 PM

@Nachtfalke:

@bdani:

Hi there!

Has anyone ever tried to set MikroTik RADIUS authentication?
I want to auth my AP-s from PF freeradius2.

With freeradius is working, but I cannot set bandwith limits… :(
With freeradius2 isn't communicating... :(

any ideas? :)

Thanks in advance... :(

Select an interface for authentication or set "*" for any interface.
on "client/NAS" set the IP address of the mikrotik AP and the correct password.
On Mikrotik set as RADIUS IP the IP of the listening interface and the correct/same password as on "Clients/NAS".

Enable logging on freeradius2 to see what is happening on syslog.

hmmm…

Status: Services
radiusd FreeRADIUS Server Stopped

But I do not know why.... ???

I've checkd the log (all of /var/log) but nothing find why...

MikroTik log say:
timeot...

Now I know why :-)

Where can I see why can't start service?

Nachtfalke · Dec 17, 2012, 9:57 AM

@bdani:

(…)
Where can I see why can't start service?

Go to pfsense console and run freeradius in debug mode. You can do this with that command:

radiusd -X

The output will tell you what is missing/going wrong. If you have questions then please post the complete output you got.

WinstonSmith · Dec 28, 2012, 8:15 PM

@myke:

@Nachtfalke:

In general you should create your CA ander server cert on pfsene Cert Manager.
then select these two certificates on freeradius -> EAP and save.

Client certificates can be build on pfsense Cert Manager and export the .p12 file. This should work and the .p12 file should be without any password. can you try with an empty password ? But this is more a "pfsense" problem than a freeradius problem.

I am not sure but if I remember correct there was another thread here in the forum which is about the .p12 file and a password. Perhaps the search function can help you.

Thanks for the answer.

My Certificate Authority and certificate was created in pfsense Cert manager. I just created .pfx with openssl.
In first time i try with an empty password and second time with a password "pfsense" but exactly the same result.

I use pfsense 2.0.1 AMD release.

Myke.

Did anyone get this working? I came across this relatively fresh posting because I ran into the same problem (didn't I? Maybe someone spots a difference below)

_I created a root-CA and a CA in pfSense cert-manager and created a server-cert and client-cert for EAP-TLS only. In Services->FreeRadius->EAP->CERTIFICATES FOR TLS I choose the CA, server-cert and client-cert. I checked "Create client.p12 for export" and saved.

When I download the .p12 file from /usr/local/etc/raddb/certs/client_cert.p12 or using the cert-manager I get asked for a password when trying to install them on OSX or iOS …_

Thanks a lot!!
Sascha

Nachtfalke · Dec 28, 2012, 9:19 PM

By default the certificates created by freeradius are protected with an "input/ouput" password from reading the certificate. The certificates created by the firewall's built-in Cert Manager are not protected so you must leave this field empty. (Default: whatever)

In general you should leave this password field on freeradius –> EAP empty. If it is the default one it is whatever

If the password field was empty then the password on this .p12 file is not freeradius related but pfsense cert manager related.

http://doc.pfsense.org/index.php/FreeRADIUS_2.x_package#EAP-TLS