NEW Package: freeRADIUS 2.x

Nachtfalke

Did you enable accounting on MySQL tab to get accounting information into mysql database?

If not it will probably be put into:

/var/log/radacct/

Further it would be more helpfull to take a look on the accounting packets and not on the authentication packets when running radiusd -X

And did you configure an accounting listening port on freeradius?

PS: radiusd -X tells you to use "Cleartext-Password"

dupdup

@Nachtfalke:

And did you configure an accounting listening port on freeradius?

I forgot that point… Now the radacct table is populated. When I radtest with the user I also get

Session-Timeout = 3513

Which seems to be a good point.
Thanks !

PS: radiusd -X tells you to use "Cleartext-Password"

;) I will work on that

2devnull

Nachtfalke and other forum friends….I apologize if you have already covered it as I have not read through this entire thread and do not have search capabilities on this forum.

The scenario on what I want to do is simple, I would like to add an extra parameter to a FreeRADIUS User Check-Item to reject them if the SSID passed in the Access-Request is not in the Check-Item regex. The info is passed in Called-Station-Id parameter (in my case MySSID):

rad_recv: Access-Request packet from host 192.168.50.3 port 4757, id=215, length=303
	User-Name = "myusername"
	NAS-Port = 0
	Called-Station-Id = "0A-XX-XX-F3-XX-3B:MySSID"
	Calling-Station-Id = "38-XX-3C-XX-76-XX"
	Framed-MTU = 1400
	NAS-Port-Type = Wireless-802.11
	Connect-Info = "CONNECT 0Mbps 802.11"
	EAP-Message = 0x023500901900170301002002efe6be8da848c0c84b7ee5c3638829081db2d23b4b6bc871f86521d046d4fe170301006094ff4a2cb4096b122fc68b0761a6ef5838ff979394afe05f94b15e3c5004573db259b80a1b647a6410997b6a88fdb03267472454a63fa6acaa784d56baac483d355f99c82b9ca5b4e756b00d623d9e3c7624c20ee50559dd68b7cc914d1b522d
	State = 0x95b4f59e1ac1503b59281ecd56cb7c13
	Message-Authenticator = 0x265371b9a316aeed1dd3a7e317f108e4

Please advise how this can be done. The reason I need to do it this way is that my Ubiquity UniFi AP drops the VLAN on the floor that FreeRADIUS passes back and therefore allows the user to successfully authenticate on any SSID (therefore on any VLAN). At least if FreeRADIUS can send a Reject then the user can only come in the SSID I set them up for and therefore they fall into the correct VLAN this SSID is setup to use in the AP.

Thank you in advance for your help.

2devnull

Well, if it helps I'm trying to do something similar (NOT USING WINDOWS however) using either just the User file or the MySQL tables –> https://kb.meraki.com/knowledge_base/radius-scoping-authentication-with-called-station-id-and-windows-groups

Nachtfalke

Not sure if this works with the GUI only. You should check the operators if they would help you:
http://wiki.freeradius.org/config/Operators

If this does not work with the check-item calling-station-id then you probably need to use "unlang" commands on the ../raddb/sites-available/default

freeradius.org/radiusd/man/unlang.html

2devnull

Thank you for the information. I will give it a further try as I went down there before to some extent and still reached a road block.

One of the issues that I got was when making changes to ../raddb/sites-available/default, it gets wiped out if a then use the GUI. Is there a way to prevent this?

Nachtfalke

@2devnull:

Thank you for the information. I will give it a further try as I went down there before to some extent and still reached a road block.

One of the issues that I got was when making changes to ../raddb/sites-available/default, it gets wiped out if a then use the GUI. Is there a way to prevent this?

Hi,

yes this is a known behaviour. The GUI is limited in some way. To make sure that your changes in this file will not beoverwritten after a reboot or some GUI changes you need to make your changes on:


/usr/local/pkg/freeradius.inc

The part you need to modify is between line 1295 and 2140. Probably start at line 1460.

Unfortunately this will be also overwritten if updating the package. On some other forum post I read an idea where someone is creating a .diff between the original freeradius.inc and th new one you created. Then importing the .diff with the help of the "System patches" package. This would make changes easier imported.

2devnull

OK, I added this code after preprocess in the authorize section of /usr/local/pkg/freeradius.inc (line 1548) but it does not seem to notice it is there. I would assume the syntax may not be correct and get an error at least.


preprocess
rewrite.called_station_id
if ($varusersvlanid != '%{Called-Station-SSID}') {
   update control {
      Auth-Type := Reject
   }
}

BTW - The following were added to the respective files below to get the Called-Station-SSID to capture the SSID passed from the AP in Access-Request - Called-Station-Id = "0E-XX-XX-XX-24-3B:MySSID" and appears to expand correctly and capture the SSID.

raddb/dictionary

# The SSID the supplicant/user device connected to
ATTRIBUTE        Called-Station-SSID        3010                string

raddb/policy.conf

        #  Add "rewrite.called_station_id" in the "authorize" and "preacct"
        #  sections.
        rewrite.called_station_id {
                if((Called-Station-Id) && "%{Called-Station-Id}" =~ /^%{config:policy.mac-addr}(:(.+))?$/i) {
                        update request {
                                Called-Station-Id := "%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}"
                        }

                        # SSID component?
                        if ("%{8}") {
                                update request {
                                        Called-Station-Id := "%{Called-Station-Id}:%{8}"
                                        Called-Station-SSID :="%{8}" <<------ added this
                                }
                        }
                        updated
                }
                else {
                        noop
                }
        }

2devnull

Well, I decided with the number of hoops I was jumping through and still not get it to work, I went with a SaaS provider Radius instead. Anyway, just wanted to leave what I have partially working. I got rid of the users flat file and enable a MySQL DB instead. I then included this after preprocess:


if("%{sql:SELECT count(*) FROM `radusergroup` WHERE username = '%{User-Name}' AND groupname = '%{Called-Station-SSID}'}" < 1){
        update control {
                 Auth-Type := Reject
        }
}

This works with radtest as I am able to change the ssid and the accept/reject works as expected. However, on an actual Android device I only get rejects with nothing really informative as to why.

Thanks for the help.

Nachtfalke

you need to run freeradius in debug mode to get all output of errors and warnings.
Did you try tu run freeradius with this command:

radiusd -X

Please make sure you killed the running radiusd process before starting again in debug mode.

2devnull

yes, did radiusd -X and radiusd -XX

qbik

Hi,
I have installed this package with MySQL on the same server and is working ok. I need to run a php script to reconnect users if the server restarts, if I execute it manually it work, but I want to run it on sratup after Radius and Mysql have start, where in /usr/local/pkg/freeradius.inc would a call to the function go?

Thanks for your help

Nachtfalke

Unfortunately there are many places and situation when freeradius needs to restart the service so that changes will take effect. So in general freeradius restarts everywhere where this line can be found:

restart_service('radiusd')

On line 1292 the ySQL configuration of freeradius will be loaded and freeradius restarted.

Perhaps doing a cron job which runs periodically and executes your script can do the job? Not sure what you script does and if it hurts if it runs every minute or so.

qbik

Thanks for the info Nachtfalke. Basically what I need to do is not to stop the accounting of users connected via the captive portal so that when a reboot occurs users do not have to reauthenticate. I have disabled the accounting stop and when rebooted freeradius just continues to count for some seconds, but the problem is that the firewall rules were not created and therefore the user goes back to blocked by the oprtal. I don't know if my best bet is no rewrite the captiveportal db from mysql and then restart accounting for those users or some other way.

Now if I call my function on line 1292 I get error:


radiusd[20265]: rlm_sql_mysql: Couldn't connect socket to MySQL server rednet@localhost:radius
radiusd[20265]: rlm_sql_mysql: Mysql error 'Can't connect to local MySQL server through socket '/tmp/mysql.sock' (2)'

Thanks for your help.

klokslag

Hi all,

I read the entire topic, because i wanna use Freeradius to authenticate against AD.
In the topic there are suggestions to make it possible via the gui.

My question is. Is it now possible to authencate against AD without the tweaking?
Or do i have to use the tutorial from MatSim (Nachtfalke, marcelloc)

Thanx in advance.

Nachtfalke

@klokslag:

Hi all,

I read the entire topic, because i wanna use Freeradius to authenticate against AD.
In the topic there are suggestions to make it possible via the gui.

My question is. Is it now possible to authencate against AD without the tweaking?
Or do i have to use the tutorial from MatSim (Nachtfalke, marcelloc)

Thanx in advance.

Unfortunately my last info is that it does not work without any tweaks and only with GUI.
I do not know which topic/tutorial you mean but probably it is the correct one ;-)

klokslag

@Nachtfalke:

Unfortunately my last info is that it does not work without any tweaks and only with GUI.
I do not know which topic/tutorial you mean but probably it is the correct one ;-)

NachtFalke,

Thanx for your reply. I meant the post of MatSim in this topic.
I hope still that in the near feature someone can make the solution.
I can be probely help with testing:)
At this moment I will try MatSim his tutorial.

@MatSim:

I have shortened and rewritten what I took out of the FreeRADIUS beginners guide and put that in a Google doc to check if I am on the wrong way. This is a very much WiP and also a temporary place:
https://docs.google.com/document/d/1i536CfITm478tAddzoxSLrjl9KcEqGGA-F_LG9Iwy6A/edit
With ntlm_auth it's possible to add a AD group requirement haven't tried that yet.

I'd also agree with marcelloc that it's not the best idea to pull in Samba automatically by freeradius since it's only needed when ntlm_auth comes into the game.

P.S: Nifty idea I came across - any plans to support virtual servers on pfSense with freeradius instead of default sites-enabled/default?

rbackes

Hi Nachtfalke,

would it be possible for you to compile a radius version with eDIr Support? Just add the WITH_eDIR Option when compiling.

Thanks

Rainer

Nachtfalke

@rbackes:

Hi Nachtfalke,

would it be possible for you to compile a radius version with eDIr Support? Just add the WITH_eDIR Option when compiling.

Thanks

Rainer

Hallo Rainer,

unfortunately I was never familar with these compile option syntax on pfsense github. There were always other people who added these parameters (for me) :P. So if you are more familar with that then just add your option to these two files on github:

https://github.com/pfsense/pfsense-packages/blob/master/pkg_config.8.xml
https://github.com/pfsense/pfsense-packages/blob/master/pkg_config.8.xml.amd64

Then contact a moderator - as far as I know jimp could be the right person - to compile a new freeradius package.

PS: I cannot do any tests on this package anymore nor can I add further features because I left my old company and the new one is not really open for open source products so probably no pfsense for me anymore the next time :-\

So if anybody else likes to maintain this package please feel free to do so!

Good luck!

cheonne

freeradius 3 is available.
hopefully someone will continue this package.