Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NEW Package: freeRADIUS 2.x

    pfSense Packages
    80
    628
    736.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      thetrevster
      last edited by

      That is unfortunate, I could really use this feature. Is the bug actively being worked on / any idea on when it will be fixed? Thanks.

      1 Reply Last reply Reply Quote 0
      • ?
        A Former User
        last edited by

        @sisko212:

        Good day to everybody,
        As you maybe know, latest package Freeradius2 1.6.15 that contains a Freeradius 2.2.6 daemon, has a trouble on EAP-TLS authentication.
        Above all with latest Android 6.0 Marshmallow.
        Some tech details are available here:
        https://code.google.com/p/android/issues/detail?id=188867#c29
        Someone known if it exists a workaround, perhaps editing some configuration files on freeradius, or also on Android with some apps, in order to avoid this issue ?
        Thanks a lot in advance for your time and for any suggestion.

        Just got Marshmallow OTA update myself and smacked into this same problem.  EAP-TLS configuration that has been working fine for quite a while, now no longer works on upgraded Nexus 7.

        Symptoms are that the device appears to negotiate authentication, FreeRADIUS logs indicate the device was authenticated, but the device never finishes joining the network, and just keeps repeating.

        From the Google thread, the issue is tied to the use of TLSv1.2 and downgrading to TLSv1.1 or 1.0, the final keying is correct.  But downgrading to broken encryption standards is not what I'd consider a workaround.

        From other forum reading, it sounds like this is going to be a quickly growing problem as Marshmallow is currently being rolled out OTA to all Nexus devices and expected to hit OEM devices soon.

        So really the only question then is how soon an updated release that contains a fix for this issue can be made available.

        1 Reply Last reply Reply Quote 0
        • D
          David_W
          last edited by

          @TechyTech:

          Just got Marshmallow OTA update myself and smacked into this same problem.  EAP-TLS configuration that has been working fine for quite a while, now no longer works on upgraded Nexus 7.

          As I said earlier in the thread, the package needs to be respun with FreeRADIUS 2.2.9 to solve this problem. If the package has a maintainer, hopefully he/she can deal with this, otherwise it would be helpful if someone built and tested an upgraded package, then submitted a pull request.

          The longer term issue is that FreeRADIUS 2.x is now End of Life. A new package is needed, based on FreeRADIUS 3.x, though, depending on the timeline for pfSense 2.3, there may well be little point building a FreeRADIUS 3.x package for pfSense 2.2. It might be best to build a FreeRADIUS 3.x package for pfSense 2.3 rather than upgrading the FreeRADIUS 2.x package for the Bootstrap based pfSense 2.3 GUI.

          1 Reply Last reply Reply Quote 0
          • S
            sisko212
            last edited by

            @David_W:

            …package needs to be respun with FreeRADIUS 2.2.9 to solve this problem....The longer term issue is that FreeRADIUS 2.x is now End of Life. A new package is needed, based on FreeRADIUS 3.x...

            I Agree with you, but for users like me, developing a new pfsense package with latest freeradius 3 version, requires a skill and time (to read pfsense package build documentation) that not everybody has …
            At moment, only as temporary workaround, I installed a Zeroshel distribution, only for wifi authentication, because it has a newer freeradius (maybe 2.2.12 or .19) than pfsense, and it is able to work with latest Android and iOS releases.

            1 Reply Last reply Reply Quote 0
            • D
              David_W
              last edited by

              @sisko212:

              At moment, only as temporary workaround, I installed a Zeroshel distribution, only for wifi authentication, because it has a newer freeradius (maybe 2.2.12 or .19) than pfsense, and it is able to work with latest Android and iOS releases.

              FreeRADIUS 2.2.9 is the latest - and quite possibly the last - release in the 2.2.x series. If you see version numbers higher than that, they're not using the version numbering from the FreeRADIUS developers.

              Your work-round is probably the best for now. I don't have the time to do any work on fixing the package and I'm not sure anyone is maintaining it. The chances are that all that is needed is to upgrade the FreeRADIUS code to 2.2.9, though there might be other changes necessary for the package to work correction with 2.2.9.

              A FreeRADIUS 3.x package is a much larger undertaking. Arguably the correct approach - as I have advocated elsewhere - is to produce a FreeRADIUS 3.x package for pfSense 2.3 rather than upgrading the current 2.x package for Bootstrap. Considering the limited life remaining of pfSense 2.2.x, it's hard to justify the effort involved in developing a FreeRADIUS 3.x package for non Bootstrap versions of pfSense.

              1 Reply Last reply Reply Quote 0
              • S
                sloper
                last edited by

                @David_W:

                The chances are that all that is needed is to upgrade the FreeRADIUS code to 2.2.9, though there might be other changes necessary for the package to work correction with 2.2.9.

                I am 100% willing to do this and test it. I'm having trouble finding (in the package's source) where it finds the actual Freeradius software. If anyone can point me in the right direction, I'll definitely update the package.

                See the other topic specifically about the TLS issue which I've outlined what I'm looking for a bit more: https://forum.pfsense.org/index.php?topic=104343.msg588608#msg588608

                1 Reply Last reply Reply Quote 0
                • jimpJ
                  jimp Rebel Alliance Developer Netgate
                  last edited by

                  It's not something that can be fixed in the package code in our repositories. The PBI needs to be rebuilt, but due to other changes in the ports tree after the last version was made, rebuilding it is non-trivial. There is an open ticket for it here: https://redmine.pfsense.org/issues/5318

                  In the meantime, FreeRADIUS on pfSense 2.3 is using FreeRADIUS 2.2.9 and is in a good/usable state. If someone absolutely requires it, upgrading to pfSense 2.3 beta (or at least having a VM with it running for FreeRADIUS!) is not a bad suggestion at this point in time.

                  Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                  Need help fast? Netgate Global Support!

                  Do not Chat/PM for help!

                  1 Reply Last reply Reply Quote 0
                  • N
                    nxsfan
                    last edited by

                    Just installed freeRADIUS on a relatively fresh (2.2.6) PFSense install. After minimal configuration clients were served with an expired (1/28/16) "Example Server Certificate". Is this intentional? I originally assumed that bootstrap was called after installing and starting freeRADIUS 2 the first time, but this isn't the case? After deleting the certificate and running bootstrap a new (temporally valid) certificate was generated. Perhaps this is expected? Thanks.

                    1 Reply Last reply Reply Quote 0
                    • T
                      tux
                      last edited by

                      Will this freeradius work with mariadb?

                      1 Reply Last reply Reply Quote 0
                      • T
                        tux
                        last edited by

                        @tux:

                        Will this freeradius work with mariadb?

                        To answer this question, yes as of the moment freeradius2 v1.6.19 under pfsense v2.2.6.  My DB server is mysqld 5.5.47-MariaDB-1ubuntu0.14.04.1.

                        1 Reply Last reply Reply Quote 0
                        • R
                          reggie14
                          last edited by

                          Ias anyone able to install freeradius2 from the package manager in pfsense 2.3-rc?  After restoring my config, the radiusd service is running (and working), but the package manager says freeradius2 isn't installed. I've tried reinstalling (or uninstalling) the package, but nothing works.

                          1 Reply Last reply Reply Quote 0
                          • M
                            michaelschefczyk
                            last edited by

                            What did resolve the problem described by reggie14 in my case was to download the configuration, edit the xml-file by deleting the sections dealing with freeradius and then uploading the result again.

                            1 Reply Last reply Reply Quote 0
                            • R
                              reggie14
                              last edited by

                              @michaelschefczyk:

                              What did resolve the problem described by reggie14 in my case was to download the configuration, edit the xml-file by deleting the sections dealing with freeradius and then uploading the result again.

                              I was able to resolve it by doing another clean install.  The first thing I did (before restoring config) was to install freeradius2.  Then I restored a backup config that had several packages disabled.

                              With your method, did you lose your radius config?

                              1 Reply Last reply Reply Quote 0
                              • M
                                michaelschefczyk
                                last edited by

                                Dear Reggie14,

                                Doing it my way did keep most of the configuration except - for reasons I do not understand completely - the interfaces and the EAP settings. I was able to copy them (both manually and via HASync are possible as it seems) easily from another system. I found that simpler than unplugging cables, reassigning interfaces and link aggregation groups and similar consequences of installing from scratch. For my remaining systems, I plainly uninstalled freeradius before the upgrade to install it again afterwards. That has not been necessary with any 2.x upgrade before. This time, it was probably mandatory to upgrade without any losses.

                                Regards,

                                Michael Schefczyk

                                1 Reply Last reply Reply Quote 0
                                • T
                                  thetrevster
                                  last edited by

                                  Does the amount of traffic counter bug still exist in the latest version of FreeRADIUS on pfSense 2.3 or am I most likely going to have to wait until FreeRADIUS 3 is released?

                                  1 Reply Last reply Reply Quote 0
                                  • jimpJ
                                    jimp Rebel Alliance Developer Netgate
                                    last edited by

                                    @thetrevster:

                                    Does the amount of traffic counter bug still exist in the latest version of FreeRADIUS on pfSense 2.3 or am I most likely going to have to wait until FreeRADIUS 3 is released?

                                    Which bug specifically? There have been fixes recently to both time and data counting.

                                    Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                    Need help fast? Netgate Global Support!

                                    Do not Chat/PM for help!

                                    1 Reply Last reply Reply Quote 0
                                    • T
                                      thetrevster
                                      last edited by

                                      Sorry for not being specific, see post 602 of mine in this thread  :)

                                      1 Reply Last reply Reply Quote 0
                                      • jimpJ
                                        jimp Rebel Alliance Developer Netgate
                                        last edited by

                                        That looks like a traffic counting bug a fixed a while back in the package (In November), FreeRADIUS2 pkg version 1.6.17 or later should be OK.

                                        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                        Need help fast? Netgate Global Support!

                                        Do not Chat/PM for help!

                                        1 Reply Last reply Reply Quote 0
                                        • T
                                          thetrevster
                                          last edited by

                                          Awesome!! This is excellent news - thank you!

                                          1 Reply Last reply Reply Quote 0
                                          • T
                                            thetrevster
                                            last edited by

                                            After further testing the bug unfortunately still seems to be present (see attachment). In the system logs, I can still see the data counting up for a specific user even though that client has absolutely no traffic (or extremely minimal) passing through. Does anybody know if there's any workaround for this?  :-\

                                            Capture.PNG
                                            Capture.PNG_thumb

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.