NEW Package: freeRADIUS 2.x
-
Hello everyone,
I got pfsense setup with Captive portal, Freeradius 2, and mysql since a couple of months. This is based on Khan tutorial How to Captive portal with self registration. I tried today to implement a time limit rule, to limit the connection time to 1 hour per day. I added in the radcheck table the line3 jean@bon.fr Max-Daily-Session := 3600
which goes with the previously implemented password check
2 jean@bon.fr Password == tototo
.
For those who are not familier with the self registration, the user is asked to create an account, with a username/email adress and a password. This is recorder in the reg_user database. This database is linked to freeradius2. Therefore I also added the following tablescui
nas
radacct
radcheck
radgroupcheck
radgroupreply
radippool
radpostauth
radreply
radusergroup
reg_users
wimaxThe pfsense captive portal is set to work with freeradius 2, and with start/stop accounting.
However, accounting does not work. The radacct table stays empty. I tried to add a manual entry with the user name I'm working on, but values stay NULL.
I lauched freeradius manually with the radiusd -X command. When I tried to access to the Internet, then I am redirected and asked to useh my login and password with the captive portal login page. I can log in and it works perfectly, but there is no sign of accounting.
My user is jean@bon.fr and password is tototo, from 192.168.1.52.rad_recv: Access-Request packet from host 127.0.0.1 port 5172, id=132, length=134
NAS-IP-Address = 192.168.1.1
NAS-Identifier = "pfsense.localdomain"
User-Name = "jean@bon.fr"
User-Password = "tototo"
Service-Type = Login-User
NAS-Port-Type = Ethernet
NAS-Port = 4
Framed-IP-Address = 192.168.1.52
Called-Station-Id = "192.168.1.1"
Calling-Station-Id = "08:00:27:b4:23:6f"Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
+- entering group authorize {…}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] Looking up realm "bon.fr" for User-Name = "jean@bon.fr"
[suffix] No such realm "bon.fr"
++[suffix] returns noop
[ntdomain] No '' in User-Name = "jean@bon.fr", skipping NULL due to config.
++[ntdomain] returns noop
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
++[files] returns noop
++- entering policy redundant {…}
[sql] expand: %{User-Name} -> jean@bon.fr
[sql] sql_set_user escaped user –> 'jean@bon.fr'
rlm_sql (sql): Reserving sql socket id: 2
[sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'jean@bon.fr' ORDER BY id
WARNING: Found User-Password == "…".
WARNING: Are you sure you don't mean Cleartext-Password?
WARNING: See "man rlm_pap" for more information.
[sql] User found in radcheck table
[sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'jean@bon.fr' ORDER BY id
[sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'jean@bon.fr' ORDER BY priority
[sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Free' ORDER BY id
[sql] User found in group Free
[sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Free' ORDER BY id
rlm_sql (sql): Released sql socket id: 2
+++[sql] returns ok
++- policy redundant returns ok
rlm_counter: Entering module authorize code
rlm_counter: Searching the database for key 'jean@bon.fr'
rlm_counter: Could not find the requested key in the database.
rlm_counter: Check item = 3600, Count = 0
rlm_counter: res is greater than zero
rlm_counter: (Check item - counter) is greater than zero
rlm_counter: Authorized user jean@bon.fr, check_item=3600, counter=0
rlm_counter: Sent Reply-Item for user jean@bon.fr, Type=Session-Timeout, value=3600
++[daily] returns ok
rlm_counter: Entering module authorize code
rlm_counter: Could not find Check item value pair
++[weekly] returns noop
rlm_counter: Entering module authorize code
rlm_counter: Could not find Check item value pair
++[monthly] returns noop
rlm_counter: Entering module authorize code
rlm_counter: Could not find Check item value pair
++[forever] returns noop
rlm_checkval: Item Name: Calling-Station-Id, Value: 08:00:27:b4:23:6f
rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs
++[checkval] returns notfound
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns updated
Found Auth-Type = PAP
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!! Replacing User-Password in config items with Cleartext-Password. !!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!! Please update your configuration so that the "known good" !!!
!!! clear text password is in Cleartext-Password, and not in User-Password. !!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Executing group from file /usr/local/etc/raddb/sites-enabled/default
+- entering group PAP {…}
[pap] login attempt with password "tototo"
[pap] Using clear text password "tototo"
[pap] User authenticated successfully
++[pap] returns ok
expand: ->
Login OK: [jean@bon.fr/tototo] (from client local port 4 cli 08:00:27:b4:23:6f)Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default
+- entering group post-auth {…}
++- entering policy redundant {...}
[sql] expand: %{User-Name} -> jean@bon.fr
[sql] sql_set_user escaped user –> 'jean@bon.fr'
[sql] expand: %{User-Password} -> tototo
[sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'jean@bon.fr', 'tototo', 'Access-Accept', '2013-08-17 20:42:34')
rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'jean@bon.fr', 'tototo', 'Access-Accept', '2013-08-17 20:42:34')
rlm_sql (sql): Reserving sql socket id: 1
rlm_sql (sql): Released sql socket id: 1
+++[sql] returns ok
++- policy redundant returns ok
++[exec] returns noop
Sending Access-Accept of id 132 to 127.0.0.1 port 5172
Session-Timeout = 3600
Finished request 13.
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 13 ID 132 with timestamp +3849
Ready to process requests.Here is what is displayed when I lauch radiusd (see e.txt).
Could you please tell me what seems abnormal in the logs. I can't see why the user is not found, nor created, in the radacct, even when I add the line manually.
Regards, -
Did you enable accounting on MySQL tab to get accounting information into mysql database?
If not it will probably be put into:
/var/log/radacct/
Further it would be more helpfull to take a look on the accounting packets and not on the authentication packets when running radiusd -X
And did you configure an accounting listening port on freeradius?
PS: radiusd -X tells you to use "Cleartext-Password"
-
And did you configure an accounting listening port on freeradius?
I forgot that point… Now the radacct table is populated. When I radtest with the user I also get
Session-Timeout = 3513
Which seems to be a good point.
Thanks !PS: radiusd -X tells you to use "Cleartext-Password"
;) I will work on that
-
Nachtfalke and other forum friends….I apologize if you have already covered it as I have not read through this entire thread and do not have search capabilities on this forum.
The scenario on what I want to do is simple, I would like to add an extra parameter to a FreeRADIUS User Check-Item to reject them if the SSID passed in the Access-Request is not in the Check-Item regex. The info is passed in Called-Station-Id parameter (in my case MySSID):
rad_recv: Access-Request packet from host 192.168.50.3 port 4757, id=215, length=303 User-Name = "myusername" NAS-Port = 0 Called-Station-Id = "0A-XX-XX-F3-XX-3B:MySSID" Calling-Station-Id = "38-XX-3C-XX-76-XX" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x023500901900170301002002efe6be8da848c0c84b7ee5c3638829081db2d23b4b6bc871f86521d046d4fe170301006094ff4a2cb4096b122fc68b0761a6ef5838ff979394afe05f94b15e3c5004573db259b80a1b647a6410997b6a88fdb03267472454a63fa6acaa784d56baac483d355f99c82b9ca5b4e756b00d623d9e3c7624c20ee50559dd68b7cc914d1b522d State = 0x95b4f59e1ac1503b59281ecd56cb7c13 Message-Authenticator = 0x265371b9a316aeed1dd3a7e317f108e4
Please advise how this can be done. The reason I need to do it this way is that my Ubiquity UniFi AP drops the VLAN on the floor that FreeRADIUS passes back and therefore allows the user to successfully authenticate on any SSID (therefore on any VLAN). At least if FreeRADIUS can send a Reject then the user can only come in the SSID I set them up for and therefore they fall into the correct VLAN this SSID is setup to use in the AP.
Thank you in advance for your help.
-
Well, if it helps I'm trying to do something similar (NOT USING WINDOWS however) using either just the User file or the MySQL tables –> https://kb.meraki.com/knowledge_base/radius-scoping-authentication-with-called-station-id-and-windows-groups
-
Not sure if this works with the GUI only. You should check the operators if they would help you:
http://wiki.freeradius.org/config/OperatorsIf this does not work with the check-item calling-station-id then you probably need to use "unlang" commands on the ../raddb/sites-available/default
-
Thank you for the information. I will give it a further try as I went down there before to some extent and still reached a road block.
One of the issues that I got was when making changes to ../raddb/sites-available/default, it gets wiped out if a then use the GUI. Is there a way to prevent this?
-
Thank you for the information. I will give it a further try as I went down there before to some extent and still reached a road block.
One of the issues that I got was when making changes to ../raddb/sites-available/default, it gets wiped out if a then use the GUI. Is there a way to prevent this?
Hi,
yes this is a known behaviour. The GUI is limited in some way. To make sure that your changes in this file will not beoverwritten after a reboot or some GUI changes you need to make your changes on:
/usr/local/pkg/freeradius.inc
The part you need to modify is between line 1295 and 2140. Probably start at line 1460.
Unfortunately this will be also overwritten if updating the package. On some other forum post I read an idea where someone is creating a .diff between the original freeradius.inc and th new one you created. Then importing the .diff with the help of the "System patches" package. This would make changes easier imported.
-
OK, I added this code after preprocess in the authorize section of /usr/local/pkg/freeradius.inc (line 1548) but it does not seem to notice it is there. I would assume the syntax may not be correct and get an error at least.
preprocess rewrite.called_station_id if ($varusersvlanid != '%{Called-Station-SSID}') { update control { Auth-Type := Reject } }
BTW - The following were added to the respective files below to get the Called-Station-SSID to capture the SSID passed from the AP in Access-Request - Called-Station-Id = "0E-XX-XX-XX-24-3B:MySSID" and appears to expand correctly and capture the SSID.
raddb/dictionary
# The SSID the supplicant/user device connected to ATTRIBUTE Called-Station-SSID 3010 string
raddb/policy.conf
# Add "rewrite.called_station_id" in the "authorize" and "preacct" # sections. rewrite.called_station_id { if((Called-Station-Id) && "%{Called-Station-Id}" =~ /^%{config:policy.mac-addr}(:(.+))?$/i) { update request { Called-Station-Id := "%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}" } # SSID component? if ("%{8}") { update request { Called-Station-Id := "%{Called-Station-Id}:%{8}" Called-Station-SSID :="%{8}" <<------ added this } } updated } else { noop } }
-
Well, I decided with the number of hoops I was jumping through and still not get it to work, I went with a SaaS provider Radius instead. Anyway, just wanted to leave what I have partially working. I got rid of the users flat file and enable a MySQL DB instead. I then included this after preprocess:
if("%{sql:SELECT count(*) FROM `radusergroup` WHERE username = '%{User-Name}' AND groupname = '%{Called-Station-SSID}'}" < 1){ update control { Auth-Type := Reject } }
This works with radtest as I am able to change the ssid and the accept/reject works as expected. However, on an actual Android device I only get rejects with nothing really informative as to why.
Thanks for the help.
-
you need to run freeradius in debug mode to get all output of errors and warnings.
Did you try tu run freeradius with this command:radiusd -X
Please make sure you killed the running radiusd process before starting again in debug mode.
-
yes, did radiusd -X and radiusd -XX
-
Hi,
I have installed this package with MySQL on the same server and is working ok. I need to run a php script to reconnect users if the server restarts, if I execute it manually it work, but I want to run it on sratup after Radius and Mysql have start, where in /usr/local/pkg/freeradius.inc would a call to the function go?Thanks for your help
-
Unfortunately there are many places and situation when freeradius needs to restart the service so that changes will take effect. So in general freeradius restarts everywhere where this line can be found:
restart_service('radiusd')
On line 1292 the ySQL configuration of freeradius will be loaded and freeradius restarted.
Perhaps doing a cron job which runs periodically and executes your script can do the job? Not sure what you script does and if it hurts if it runs every minute or so.
-
Thanks for the info Nachtfalke. Basically what I need to do is not to stop the accounting of users connected via the captive portal so that when a reboot occurs users do not have to reauthenticate. I have disabled the accounting stop and when rebooted freeradius just continues to count for some seconds, but the problem is that the firewall rules were not created and therefore the user goes back to blocked by the oprtal. I don't know if my best bet is no rewrite the captiveportal db from mysql and then restart accounting for those users or some other way.
Now if I call my function on line 1292 I get error:
radiusd[20265]: rlm_sql_mysql: Couldn't connect socket to MySQL server rednet@localhost:radius radiusd[20265]: rlm_sql_mysql: Mysql error 'Can't connect to local MySQL server through socket '/tmp/mysql.sock' (2)'
Thanks for your help.
-
Hi all,
I read the entire topic, because i wanna use Freeradius to authenticate against AD.
In the topic there are suggestions to make it possible via the gui.My question is. Is it now possible to authencate against AD without the tweaking?
Or do i have to use the tutorial from MatSim (Nachtfalke, marcelloc)Thanx in advance.
-
Hi all,
I read the entire topic, because i wanna use Freeradius to authenticate against AD.
In the topic there are suggestions to make it possible via the gui.My question is. Is it now possible to authencate against AD without the tweaking?
Or do i have to use the tutorial from MatSim (Nachtfalke, marcelloc)Thanx in advance.
Unfortunately my last info is that it does not work without any tweaks and only with GUI.
I do not know which topic/tutorial you mean but probably it is the correct one ;-) -
Unfortunately my last info is that it does not work without any tweaks and only with GUI.
I do not know which topic/tutorial you mean but probably it is the correct one ;-)NachtFalke,
Thanx for your reply. I meant the post of MatSim in this topic.
I hope still that in the near feature someone can make the solution.
I can be probely help with testing:)
At this moment I will try MatSim his tutorial.@MatSim:
I have shortened and rewritten what I took out of the FreeRADIUS beginners guide and put that in a Google doc to check if I am on the wrong way. This is a very much WiP and also a temporary place:
https://docs.google.com/document/d/1i536CfITm478tAddzoxSLrjl9KcEqGGA-F_LG9Iwy6A/edit
With ntlm_auth it's possible to add a AD group requirement haven't tried that yet.I'd also agree with marcelloc that it's not the best idea to pull in Samba automatically by freeradius since it's only needed when ntlm_auth comes into the game.
P.S: Nifty idea I came across - any plans to support virtual servers on pfSense with freeradius instead of default sites-enabled/default?
-
Hi Nachtfalke,
would it be possible for you to compile a radius version with eDIr Support? Just add the WITH_eDIR Option when compiling.
Thanks
Rainer
-
Hi Nachtfalke,
would it be possible for you to compile a radius version with eDIr Support? Just add the WITH_eDIR Option when compiling.
Thanks
Rainer
Hallo Rainer,
unfortunately I was never familar with these compile option syntax on pfsense github. There were always other people who added these parameters (for me) :P. So if you are more familar with that then just add your option to these two files on github:
https://github.com/pfsense/pfsense-packages/blob/master/pkg_config.8.xml
https://github.com/pfsense/pfsense-packages/blob/master/pkg_config.8.xml.amd64Then contact a moderator - as far as I know jimp could be the right person - to compile a new freeradius package.
PS: I cannot do any tests on this package anymore nor can I add further features because I left my old company and the new one is not really open for open source products so probably no pfsense for me anymore the next time :-\
So if anybody else likes to maintain this package please feel free to do so!
Good luck!
-
freeradius 3 is available.
hopefully someone will continue this package. -
Dear Package Developers & Experts,
please consider, if the settings unter "EAP" and then "CERTIFICATES FOR TLS" do work as intended in the freeradius2, 2.1.12_1/2.2.4 pkg v. 1.6.7_3 package. My aim is to use EAP-TLS.
The settings suggest that one can choose between the FreeRADIUS Cert-Manager (not recommended) and Firewall Cert-Manager (recommended). To use the recommended variant, one has to check the box in "Choose Cert-Manager". As indicated, the Firewall Cert-Manager generates certificates with no private key passwords. Correspondingly, the instructions on "Private Key Password" are "… The certificates created by the firewall's built-in Cert Manager are not protected so you must leave this field empty.". However, the eap.conf file - as far as I can tell - always contains either the password that one does actively enter into the field or the default password (private_key_password = whatever). I think that a configuration with an empty password cannot be generated. With a private_key_password set to anything or "whatever" or at least not nothing at all, the configuration does not seem to work with keyless certificates of the Firewall Cert-Manager. What happens if it does not work is described in more detail under https://forum.pfsense.org/index.php?topic=78684.msg429199#msg429199.
Regards,
Michael Schefczyk
-
Hi,
try to modify the line 899 from this:
$vareapconfprivatekeypassword = ($eapconf['vareapconfprivatekeypassword']?$eapconf['vareapconfprivatekeypassword']:'whatever');
to this:
$vareapconfprivatekeypassword = ($eapconf['vareapconfprivatekeypassword']?$eapconf['vareapconfprivatekeypassword']:'');
Then try again with an empty field on the freeradius EAP GUI.
If it works - consider making a change on github. -
Dear Nachtfalke,
Thank you very much! I am generally able to edit files on the pfSense server using Diagnostics->edit file or via ssh. I can also see the freeradius.inc-file on github. However, I lack the skills required to connect both sides. In particular, I did have a hard time locating the file to be edited on the pfsense server, if this is what you imply. I assume that it may be in /user/pbi/freeradius-amd64, however, there is a large directory structure with many files there. Could you plese tell me where to find the file in question?
Regards,
Michael Schefczyk
-
Hi Nachtfalke,
do you have plans to make freeradius2 work on 2.2? Sadly it still refuses to start with the following output, I just updated my system to the latest Alpha release.
Jul 8 11:18:27 root: /usr/pbi/freeradius-amd64/etc/rc.d/radiusd: WARNING: /usr/local/etc/raddb is not a directory. Jul 8 11:18:27 root: /usr/pbi/freeradius-amd64/etc/rc.d/radiusd: WARNING: failed precmd routine for radiusd
-
You can go to shell a do a search for the files you are looking for like this:
find / -iname "*freeradius*"
This shows you all files which contain "freeradius" within with any letters before or behind.
The file you are looking for is "freeradius.inc" You will find this file here:/usr/local/pkg/
@athurdent
I left my old company more than 6 months ago and the new company does not use pfsense nor are there plans to do so :(
So I personally will not do any changes on this package anymore but everyone who is able to do so and has time please feel free to do it!I only built this package in the past because I needed it and I had the hardware to test all or most of these features in my environment.
-
Dear Nachtfalke, dear all,
It turns out that a change in freeradius.inc is not required to solve the underlying problem.
The real cause is that the CRL does not work, when using the pfsense cert manager with freeradius. The CRL stays – unlike all my other CRLs on the machine – marked as not in use (“NO” in the “In Use” column) while selected in the freeradius package. This does not depend on the CRL beeing empty or containing at least one certificate. If one selects “none” for “SSL Revocation List”, things (including advanced features, such as VLAN ID assignment per user) do work, albeit without a CRL.
Beyond that, I did notice the following issues with EAP-TLS – comments would be appreciated a lot:
-
The end user device connecting needs to provide an identity which is equivalent to the client certificate CN and the freeradius user name. The identity can be typed in at most end user devices, e.g, Android. Other identities cannot be spoofed, I think. But without the identity (i.e., if the user leaves it blank), the items listed for the user (e.g., VLAN ID) will not apply. Hence, if certain VLANs are giving escalated rights, they should not be made the default VLAN. Given the issues below, if one seriously wants to use the items specified per user, one will probably need to assign a mute VLAN as default to avoid the user getting access without specifying the identity – not an elegant solution.
-
Without a CRL it is difficult to block users, once they are in possession of a certificate. It seems that only user settings can prevent a user from being authenticated. That is problematic given the previous comment. I had no luck adding “DEFAULT Auth-Type = Reject” to the “Additional RADIUS Attributes on the TOP” field or similar attempts.
-
Assuming that the end user has control of the certificate, i.e., he has the file and knows the install password, if applicable, it would be nice to be able to limit the certificate / user to a set of devices identified by MAC addresses. Limiting a user to one device works by adding “Calling-Station-Id := AA-BB-CC-DD-EE-FF” to “Additional RADIUS Attributes (CHECK-ITEM)”. What I did not manage is to specify a set of IPs permissible either for an individual user or for all users at large.
I would like to thank Nachtfalke very much for his contributions. I hope that the package freeradius will not disappear in future versions of pfsense despite Nachtfalke’s departure from the package!
Regards,
Michael Schefczyk
-
-
Now, one year later: Is Active Directory Authentication working via GUI-Configuration out of the box?
or do i still need to install a selfcompiled samba package and tweak?
Hi all,
I read the entire topic, because i wanna use Freeradius to authenticate against AD.
In the topic there are suggestions to make it possible via the gui.My question is. Is it now possible to authencate against AD without the tweaking?
Or do i have to use the tutorial from MatSim (Nachtfalke, marcelloc)Thanx in advance.
Unfortunately my last info is that it does not work without any tweaks and only with GUI.
I do not know which topic/tutorial you mean but probably it is the correct one ;-) -
Hi zlyzwy;
Hi Nachtfalke;
Hi Everyone;
Your conversation on the following thread makes my learning curve easier.
https://forum.pfsense.org/index.php?topic=43675.msg235475#msg235475
I want to thank you both for this.
I hope I am not asking too much. I have a question about how to setup sqlcounter in reference to zlyzwy and if I understand it right, the setup is "pfsense+freeradius" + "external databse." Its like after connecting "pfsense+freeradius" to "external database", all accounting stuffs will be logged to the "radacct" table of the external database. I wonder how to setup the counter in pfsense box and how does pfsense send a "disconnect message" if a user has reached a quota like the "download size" in a day or "maximum session" in a day.
Regards; -
Updates pkg v1.4.3:
-
Added: GUI to configure FreeRADIUS2 with LDAP. This will only work if we can use the new binaries.
-
Updated: FreeRADIUS 2.x package documentation on http://doc.pfsense.org/index.php/FreeRADIUS_2.x_package
Reference Version: pfsense 2.1.5 Freeradius 2.2.5_3 pkg v1.6.11
I think there is a misunderstanding on LDAP Authorization and Authentication. When I uncheck "Enable LDAP For Authorization", the General Configuration fields are disabled and emptied. Without this values the Authentication does not know how to connect to LDAP, so it fails. The way is working in my reference Version, you have to Authorize to be able to Authenticate, and that is not correct for all the cases.
I had to modify manually the sites-enable file in order to disable LDAP Authorize for my configuration to work correctly. If you want, follow the freeradius user mailing list for the detail in my situation.
http://freeradius.1045715.n5.nabble.com/Authenticating-users-on-LDAP-based-on-Group-name-td5732701i20.html
-
-
I set up FreeRADIUS for use on my guest wifi network with EAP. At this time I'm not planning on using Captive Portal- I just wanted to be able to provide per-user passwords and bandwidth limits.
However, I'd like to be able to disable users without deleting them. I don't see a "disable" button, but I figure there might be a way to do something similar. I tried setting "Number of simultaneous connections" to 0 and wasn't overly surprised when it didn't work (I'm just using a Asus consumer-grade AP).
Is there a way to effectively disable a user without deleting it?
-
I need to customise freeradius with a custom site file and a custom script for the authentication, where should I place these files in order for them to survive a pfsense upgrade?
Until now I saved these files in /usr/pbi/freeradius/etc/raddb but they are not restored after a system upgrade.
I saw reference to /usr/local/etc/raddb, chall I use that directory instead? -
I set up FreeRADIUS for use on my guest wifi network with EAP. At this time I'm not planning on using Captive Portal- I just wanted to be able to provide per-user passwords and bandwidth limits.
However, I'd like to be able to disable users without deleting them. I don't see a "disable" button, but I figure there might be a way to do something similar. I tried setting "Number of simultaneous connections" to 0 and wasn't overly surprised when it didn't work (I'm just using a Asus consumer-grade AP).
Is there a way to effectively disable a user without deleting it?
Hi,
bandwidth limit and number of connections are features that must be supported by your Wireless AP. If the AP does not support it it will not work. A chance that it could work is if your AP supports "accounting" but then you need the coresponding RADIUS attributes from your vendor.
To disable a user there is no "disable" button but I think you can workaround with the "Expiration date". Thi will only work for a specific date.
If you need to disable an account for a specific time then you should add possible time ranges with the "Possiblöe Time Ranges" option. Using both together should allow you to disable a user. -
I need to customise freeradius with a custom site file and a custom script for the authentication, where should I place these files in order for them to survive a pfsense upgrade?
Until now I saved these files in /usr/pbi/freeradius/etc/raddb but they are not restored after a system upgrade.
I saw reference to /usr/local/etc/raddb, chall I use that directory instead?Hi,
I would give you a suggestion to use the additional package "System Patches". The make a "diff" of the original and your new file and paste the diff into the "System Patches" package and then you can enable "auto apply" so it should apply after upgrades - unless there is no change on the original file.For complete new custom scripts - don't know where the best place on pfsense is. Here is a path where freeradius stores custom scripts:
/usr/pbi/freeradius-amd64/etc/raddb/scripts
or you add your script to the freeradius.inc so it will be created on specific action:https://github.com/pfsense/pfsense-packages/blob/master/config/freeradius2/freeradius.inc
Have a look at lines 4143 - 4180
function freeradius_datacounter_auth_resync() { global $config; $conf = ''; $conf .= <<<eod<br>#!/bin/sh ### USAGE: datacounter_auth.sh USERNAME TIMERANGE ### We need this parameters from freeradius users file and ../raddb/modules/datacounter_acct USERNAME=`echo -n "\\$1" | sed 's/[^0-9a-zA-Z._:-]/X/g' ` TIMERANGE=`echo -n "\\$2" | sed 's/[^a-z]//g' ` ### This is to make sure there is a used-octets file after the cronjob resetted the counter if [ -e "/var/log/radacct/datacounter/\$TIMERANGE/max-octets-\$USERNAME" ] && [ ! -e "/var/log/radacct/datacounter/\$TIMERANGE/used-octets-\$USERNAME" ]; then echo 0 > "/var/log/radacct/datacounter/\$TIMERANGE/used-octets-\$USERNAME" fi ### The next two lines are just for getting values for logging output MAXOCTETSUSERNAMEMB=$((`cat "/var/log/radacct/datacounter/\$TIMERANGE/max-octets-\$USERNAME"`/1024/1024)) USEDOCTETSUSERNAMEMB=$((`cat "/var/log/radacct/datacounter/\$TIMERANGE/used-octets-\$USERNAME"`/1024/1024)) ### We check if MAX-OCTETS-USERNAME is greater than USED-OCTETS-USERNAME and accept or reject the user if [ `cat "/var/log/radacct/datacounter/\$TIMERANGE/max-octets-\$USERNAME"` -gt `cat "/var/log/radacct/datacounter/\$TIMERANGE/used-octets-\$USERNAME"` ]; then logger -f /var/log/system.log "FreeRADIUS: Used amount of \$TIMERANGE traffic by \$USERNAME is \$USEDOCTETSUSERNAMEMB MB of \$MAXOCTETSUSERNAMEMB MB! The user was accepted!!!" exit 0 else logger -f /var/log/system.log "FreeRADIUS: Credentials are probably correct but the user \$USERNAME has reached the \$TIMERANGE Amount of Upload and Download Traffic which is \$USEDOCTETSUSERNAMEMB MB of \$MAXOCTETSUSERNAMEMB MB! The user was rejected!!!" exit 99 fi EOD; $filename = FREERADIUS_ETC . '/raddb/scripts/datacounter_auth.sh'; conf_mount_rw(); file_put_contents($filename, $conf); chmod($filename, 0750); conf_mount_ro(); }</eod<br>
You can replace the /bin/bash script there with your own and then give the function an new name, edit the path where you want to save the script and if you want add the function below line 422 so that it will be executed every time you click "Save" on the Freeradius "Settings" menu in the GUI.
-
Hi.
Is it possible to use mOTP with MSCHAPv2?
I am getting a reject, while PAP with mOTP works. -
Good day to everybody,
As you maybe know, latest package Freeradius2 1.6.15 that contains a Freeradius 2.2.6 daemon, has a trouble on EAP-TLS authentication.
Above all with latest Android 6.0 Marshmallow.
Some tech details are available here:
https://code.google.com/p/android/issues/detail?id=188867#c29
Someone known if it exists a workaround, perhaps editing some configuration files on freeradius, or also on Android with some apps, in order to avoid this issue ?
Thanks a lot in advance for your time and for any suggestion. -
The issues you mention should be fixed in FreeRADIUS 2.2.9, which is now in FreeBSD ports.
FreeRADIUS 2.x is now end of life. Hopefully someone will come forward to develop a FreeRADIUS 3.x package, though I would suggest any development efforts target the forthcoming pfSense 2.3.
-
I'm on the latest version of pfSense (2.2.4 - 64 bit) with Captive Portal and the FreeRADIUS 2.x package setup for traffic capping. Everything is working properly to re-authenticate users every minute and I'm using the MAC address as the username. I'm currently capping users at 6000MB (total upload and download) per day. I added a test machine in and noticed that the traffic counter isn't working correctly. I was aware of this issue on older version of pfSense, but it seems that I am having a similar issue in the latest build. Any thoughts? See below an output from the system logs.
Oct 30 15:37:56 root: FreeRADIUS: Used amount of daily traffic by 247703xxxxxx is 35 MB of 6000 MB! The user was accepted!!!
Oct 30 15:38:58 root: FreeRADIUS: Used amount of daily traffic by 247703xxxxxx is 70 MB of 6000 MB! The user was accepted!!!I have a local counter on the test machine, counting all traffic in/out of the wireless NIC. Within that time period, it shows I've only transferred 800KB, but the logs are showing 30+ MB. Thanks in advance for any input.
-
I'm on the latest version of pfSense (2.2.4 - 64 bit) with Captive Portal and the FreeRADIUS 2.x package setup for traffic capping. Everything is working properly to re-authenticate users every minute and I'm using the MAC address as the username. I'm currently capping users at 6000MB (total upload and download) per day. I added a test machine in and noticed that the traffic counter isn't working correctly. I was aware of this issue on older version of pfSense, but it seems that I am having a similar issue in the latest build. Any thoughts? See below an output from the system logs.
Oct 30 15:37:56 root: FreeRADIUS: Used amount of daily traffic by 247703xxxxxx is 35 MB of 6000 MB! The user was accepted!!!
Oct 30 15:38:58 root: FreeRADIUS: Used amount of daily traffic by 247703xxxxxx is 70 MB of 6000 MB! The user was accepted!!!I have a local counter on the test machine, counting all traffic in/out of the wireless NIC. Within that time period, it shows I've only transferred 800KB, but the logs are showing 30+ MB. Thanks in advance for any input.
Yes the the problem still exists int 2.2.4 i tried every thing and every tutorial on the internet but it's confirmed that this is a bug.
-
That is unfortunate, I could really use this feature. Is the bug actively being worked on / any idea on when it will be fixed? Thanks.