NEW Package: freeRADIUS 2.x

Nachtfalke

Hi Guys,

i have decided to see if I can replace another solution we using with a Pfsense Captive portal and a Psfense Radius solution. But, I follow the instructions on the Radius documentation, but the first hiccup I have is that i dont have the option to even install the package.

In pfsense 2.x go to System => Packages => Available Packages and click on the + behind freeradius2.
After Installation go to Services => FreeRADIUS

Am I blind or is the package option just not on the 2.0.1 menu? :)

Regards,

Gigg

Hi Gigg,

freeradius2 package is available for i386 and amd64, pfsense 2.0 and 2.0.1. I could just try on server with a HDD. I used the .iso images and installed pfsense.
Not sure if this package is available (by default) for nanobsd and other system.

@zlyzwy
Great to hear and to read this :D
I would like to implement this how-to (copy and paste) to my pfsense documentation - makeing a copyright to your name and linking to this post. Is that ok ? It is a very detailed how-to and I think it is exactly what we need :)

Further I tested with Plain-MAC-Auth an CP. At first: It is working as it should and you have different possibilities:

1.) If you want to use Plain-MAC-Auth from pfSense GUI then you should do the following:

Go to CP and enable "Enable RADIUS MAC authentication"
Enter any shared secret you like in the field below. This is NOT the shared secret which is used for the communication between NAS(CP) and freeRADIUS.
the "MAC address format" you do not need to change. The "correct" setting would be "11-22-33-44-55-66" but this is not important because freeradius converts all MAC addresses formats to this format.
enter the mac address in freeradius "MACs" in this format: 11-22-33-aa-bb-33

Thats all. Browse the web and you will be connected. System Log and Portal Auth show this:
Systemlog:

radiusd[33247]: Login OK: [00-04-23-5c-9d-19/blaaa] (from client pfsense port 2 cli 00-04-23-5c-9d-19)

Portal Auth:

logportalauth[14855]: MACHINE LOGIN: 00-04-23-5c-9d-19, 00:04:23:5c:9d:19, 192.168.0.88

2.) If you do NOT want to use Plain-MAC-Auth from pfsense GUI you can disable that.

Go to pfsense GUI "Users" and add a user with username "00-04-23-5c-9d-19" - that is the MAC-address and as password choose the password from the CP (schared secret). In my case it was "blaaa".
CP is converting the MAC to the username field and adds the "shared secret" as the password field.

I will try to explain it a little bit more in detail and post it in my documentation - but now I will go out to dinner - it's my brothers birthday today :)

Nachtfalke

Updates pkg v1.5.3;

Added: Limit Bandwidth (WISPr-Bandwidth-Max-Down/WISPr-Bandwidth-Max-Up)
Modified: Rearranged options GUI for "users" a little bit
Fixed: Simultenous-Use isn't a "requiered" field anymore. If set to 1 and in CP "reauthenticate every minute" was checked it leads to a "multiconnect"/discoonect. Further if CP gets restarted and user wasn't disconnected before there is as well a "multiconnect"
Fixed: CP does not know ChilliSpot attribute so I choose "Acct-x-octets" in "reply-name"
Added: There are now the same CHECK-ITEMS and REPLY-ITEMS available for Plain-MAC-Auth as for 802.1X auth (users/macs)
Updated: pfsense documentation (Plain-MAC-Auth and Plain-MAC-Auth as 802.1X request with Captive Portal) and (Limit Bandwidth)

zlyzwy

@zlyzwy
Great to hear and to read this
I would like to implement this how-to (copy and paste) to my pfsense documentation - makeing a copyright to your name and linking to this post. Is that ok ? It is a very detailed how-to and I think it is exactly what we need

No problem at all. I am glad it's helpful..:)

1.) If you want to use Plain-MAC-Auth from pfSense GUI then you should do the following:

Go to CP and enable "Enable RADIUS MAC authentication"

Enter any shared secret you like in the field below. This is NOT the shared secret which is used for the communication between NAS(CP) and freeRADIUS.

the "MAC address format" you do not need to change. The "correct" setting would be "11-22-33-44-55-66" but this is not important because freeradius converts all MAC addresses formats to this format.

enter the mac address in freeradius "MACs" in this format: 11-22-33-aa-bb-33

Thanks for your explanation.
I've got a bit confused about 'shared secret', as your explained there should have two 'shared secret'. The first one is for communication with client and CP. But what's the purpose for second one? Can I fill the same value as the first one? In fact I was thinking they should be same.
The MAC format I used is '00:11:22:33:44:55', but you mentioned it's not important then it should not be the problem.

Anyway, I will give a try again with your procedures.

BTW: I can't see the v1.5.3 update pkg in 'installed packages'.

Update:
Now I can see the v1.5.3 pkg and it's great…

@Nachtfalke

I just tested with latest pkg,here comes some new questions>>
1. Plain-MAC-Auth
I followed your procedures, it doesn't work proerly. The error log is

Jan 18 19:59:40	radiusd[36524]: Login incorrect: [00-02-a5-4e-df-67] (from client CP port 210 cli 00-02-a5-4e-df-67)

I enable the PLAIN MAC AUTHORIZATION (FreeRadius–>Setting Tab), and it does solve the problem.

Jan 18 20:46:45	radiusd[63046]: Login OK: [00-02-a5-4e-df-67] (from client CP port 45 cli 00-02-a5-4e-df-67)

I don't know why but it's working anyway:)

2. Virtual machine in VMware MAC Auth
I have a small server running VMware workstation. The host computer is a windows 2003 server. It's running well until I enable the CP, I add the server's MAC to pass list and the server works as it should be,but not for the virtual server inside VM. I tired to put the VM's MAC to pass list. it's not working. I am receiving the following error from system log:

Jan 18 20:46:45	radiusd[63046]: Login OK: [00-02-a5-4e-df-67] (from client CP port 45 cli 00-02-a5-4e-df-67)
Jan 18 20:46:45	radiusd[63046]: Login OK: [00-02-a5-4e-df-67] (from client CP port 45 cli 00-02-a5-4e-df-67)
Jan 18 20:46:45	radiusd[63046]: rlm_radutmp: Login entry for NAS CP port 45 wrong order
Jan 18 20:46:45	radiusd[63046]: rlm_radutmp: Login entry for NAS CP port 45 wrong order

00-02-a5-4e-df-67 –> Host Computer
There is one strange thing, usually if my virtual server ask the outgoing traffic, there should have the log with MAC. So I can add that MAC to pass list. But I didn't see any log with that MAC.
I also tried to set "Number of simultaneous connections" to 10, no luck...

BTW: there are two virtual servers running in VMwork, one is Debian and another is PFsense itself. I am not sure if it's the reason for this issue. I think this picture will show you my network better than words.
(http://www.gliffy.com/pubdoc/2737259/L.png)

3. Maximum Download Bandwidth/Maximum Upload Bandwidth
I have a 20m/s ADSL at home. I tested with 800 bit/s and 800000bit/s. There should have a obvious difference. However they give the similar result here(around 20m/s).

I am afraid I may put too many requests here.
Many thanks for your help!

Nachtfalke

@zlyzwy

The shared secret you enter on CaptivePortal in section "Primary RADIUS server" is the password which is for communication between CP as NAS and the freeRADIUS server. This shared secret you have to enter and match the shared secret you enter in FreeRADIUS -> NAS/Clients

The shared secret you have to enter on chapter "RADIUS MAC authentication" is the user password. This is a little bit unclear on Captive Portal. This shared secret you have to enter in FreeRADIUS -> Users

pkg v.1.5.3 should be available now. When I am updating this post I pushed the changes on github but then we need to wait until some of the core teams is merging it. In general this takes not much time :-)

zlyzwy

@Nachtfalke:

The shared secret you have to enter on chapter "RADIUS MAC authentication" is the user password. This is a little bit unclear on Captive Portal. This shared secret you have to enter in FreeRADIUS -> Users

@Nachtfalke

I am sorry I can't understand this part. If it's really as you said, then all the users must use one password since there is only one shared secret in CP? Or we can only create one user?

Nachtfalke

@zlyzwy:

@Nachtfalke:

The shared secret you have to enter on chapter "RADIUS MAC authentication" is the user password. This is a little bit unclear on Captive Portal. This shared secret you have to enter in FreeRADIUS -> Users

@Nachtfalke

I am sorry I can't understand this part. If it's really as you said, then all the users must use one password since there is only one shared secret in CP? Or we can only create one user?

That's correct. All Users have the same password (shared secret).

But that's no problem. Think about that: The host should be authorized by its MAC address. Now we can only send the Calling-Station-ID to freeRADIUS server and then freeRADIUS must be able to handle ONLY Calling-Station-ID and authorize or block the user. But before I enabled Plain-MAC-Auth ability on freeRADIUS the RADIUS server only accepted 802.1X (username + password).
That's the reason why we are able to configure captive portal to send the MAC address as username and a password - that's our shared secret.

So username(mac address) is different but password(shared secret) is always the same.

If you have questions, just ask. Perhaps I am just not able to explain it in a way to make it clear :D

gigg

Hi Guyd,

Can you tell me what version of pfsense you using. Mine does not have a packages option under systems and I cant load the radius option.

Thx

marcelloc

@gigg:

Hi Guyd,

Can you tell me what version of pfsense you using. Mine does not have a packages option under systems and I cant load the radius option.

Thx

pfsense 2.0.1 full install x64
pfsense 2.0.1 full install i386

Metu69salemi

Shared secret is used between radius server and device, which is using radius server. it's another layer of security. This has nothing todo with user passwords

Nachtfalke

Updates pkg v1.5.4:

Added: Checks if a function or a part of it needs to be run (when disabled from GUI). This should speed up the starting process of freeradius after reboot.
Fixed: Accidentally deleted certs in ../raddb/certs/ folder after reboot when using pfSense Cert-Manager - this break freeRADIUS start until clicking save in EAP again.

=== edit ===

Fixed: call some functions after installation to initialize configuration files.

@Metu69salemi:

Shared secret is used between radius server and device, which is using radius server. it's another layer of security. This has nothing todo with user passwords

What you say is absolutly correct - in general.
Captive Portal is using the name "shared secret" on two places. In Primary RADIUS server it is used in the correct context.
In RADIUS MAC authentication it is not the correct context I would say. This is explained one line below:

If this option is enabled, the captive portal will try to authenticate users by sending their MAC address as the username and the password entered below to the RADIUS server.

Metu69salemi

@Nachtfalke:

Updates pkg v1.5.4:

Added: Checks if a function or a part of it needs to be run (when disabled from GUI). This should speed up the starting process of freeradius after reboot.

Fixed: Accidentally deleted certs in ../raddb/certs/ folder after reboot when using pfSense Cert-Manager - this break freeRADIUS start until clicking save in EAP again.

@Metu69salemi:

Shared secret is used between radius server and device, which is using radius server. it's another layer of security. This has nothing todo with user passwords

What you say is absolutly correct - in general.
Captive Portal is using the name "shared secret" on two places. In Primary RADIUS server it is used in the correct context.
In RADIUS MAC authentication it is not the correct context I would say. This is explained one line below:

If this option is enabled, the captive portal will try to authenticate users by sending their MAC address as the username and the password entered below to the RADIUS server.

Ok thank you for info

zlyzwy

Hi guys,

Thanks for all your patents and detail explanation…
To be honest, I am still not 100% understand this part, but I will need some test on it.

Can you take a look at the following questions?

@zlyzwy:

Update:
Now I can see the v1.5.3 pkg and it's great…

@Nachtfalke

I just tested with latest pkg,here comes some new questions>>
1. Plain-MAC-Auth
I followed your procedures, it doesn't work proerly. The error log is
Jan 18 19:59:40	radiusd[36524]: Login incorrect: [00-02-a5-4e-df-67] (from client CP port 210 cli 00-02-a5-4e-df-67)
I enable the PLAIN MAC AUTHORIZATION (FreeRadius–>Setting Tab), and it does solve the problem.
Jan 18 20:46:45	radiusd[63046]: Login OK: [00-02-a5-4e-df-67] (from client CP port 45 cli 00-02-a5-4e-df-67)
I don't know why but it's working anyway:)

2. Virtual machine in VMware MAC Auth
I have a small server running VMware workstation. The host computer is a windows 2003 server. It's running well until I enable the CP, I add the server's MAC to pass list and the server works as it should be,but not for the virtual server inside VM. I tired to put the VM's MAC to pass list. it's not working. I am receiving the following error from system log:
Jan 18 20:46:45	radiusd[63046]: Login OK: [00-02-a5-4e-df-67] (from client CP port 45 cli 00-02-a5-4e-df-67)
Jan 18 20:46:45	radiusd[63046]: Login OK: [00-02-a5-4e-df-67] (from client CP port 45 cli 00-02-a5-4e-df-67)
Jan 18 20:46:45	radiusd[63046]: rlm_radutmp: Login entry for NAS CP port 45 wrong order
Jan 18 20:46:45	radiusd[63046]: rlm_radutmp: Login entry for NAS CP port 45 wrong order
00-02-a5-4e-df-67 –> Host Computer
There is one strange thing, usually if my virtual server ask the outgoing traffic, there should have the log with MAC. So I can add that MAC to pass list. But I didn't see any log with that MAC.
I also tried to set "Number of simultaneous connections" to 10, no luck...

BTW: there are two virtual servers running in VMwork, one is Debian and another is PFsense itself. I am not sure if it's the reason for this issue. I think this picture will show you my network better than words.
(http://www.gliffy.com/pubdoc/2737259/L.png)

3. Maximum Download Bandwidth/Maximum Upload Bandwidth
I have a 20m/s ADSL at home. I tested with 800 bit/s and 800000bit/s. There should have a obvious difference. However they give the similar result here(around 20m/s).

I am afraid I may put too many requests here.
Many thanks for your help!
Thanks in advance!

Nachtfalke

@zlyzwy:

(…)
@Nachtfalke

I just tested with latest pkg,here comes some new questions>>
1. Plain-MAC-Auth
I followed your procedures, it doesn't work proerly. The error log is
Jan 18 19:59:40	radiusd[36524]: Login incorrect: [00-02-a5-4e-df-67] (from client CP port 210 cli 00-02-a5-4e-df-67)
I enable the PLAIN MAC AUTHORIZATION (FreeRadius–>Setting Tab), and it does solve the problem.
Jan 18 20:46:45	radiusd[63046]: Login OK: [00-02-a5-4e-df-67] (from client CP port 45 cli 00-02-a5-4e-df-67)
I don't know why but it's working anyway:)

First I am sorry. I didn't see that you updated your post ;-)
First it is good that Plain-MAC-Auth is working :)
Second:
Disable Plain-MAC-Auth and put this in "FreeRADIUS -> Users tab"
Username: 00-02-a5-4e-df-67
Password: (The shared secret from Captive Portal below the point "Enable MAC authorization)
Delete the entry in "FreeRADIUS -> MACs" with this MAC address: 00-02-a5-4e-df-67

Then it should work.

@zlyzwy:

2. Virtual machine in VMware MAC Auth
I have a small server running VMware workstation. The host computer is a windows 2003 server. It's running well until I enable the CP, I add the server's MAC to pass list and the server works as it should be,but not for the virtual server inside VM. I tired to put the VM's MAC to pass list. it's not working. I am receiving the following error from system log:
Jan 18 20:46:45	radiusd[63046]: Login OK: [00-02-a5-4e-df-67] (from client CP port 45 cli 00-02-a5-4e-df-67)
Jan 18 20:46:45	radiusd[63046]: Login OK: [00-02-a5-4e-df-67] (from client CP port 45 cli 00-02-a5-4e-df-67)
Jan 18 20:46:45	radiusd[63046]: rlm_radutmp: Login entry for NAS CP port 45 wrong order
Jan 18 20:46:45	radiusd[63046]: rlm_radutmp: Login entry for NAS CP port 45 wrong order
00-02-a5-4e-df-67 –> Host Computer
There is one strange thing, usually if my virtual server ask the outgoing traffic, there should have the log with MAC. So I can add that MAC to pass list. But I didn't see any log with that MAC.
I also tried to set "Number of simultaneous connections" to 10, no luck...

BTW: there are two virtual servers running in VMwork, one is Debian and another is PFsense itself. I am not sure if it's the reason for this issue. I think this picture will show you my network better than words.
(http://www.gliffy.com/pubdoc/2737259/L.png)

Uuuhh..hmm..I am out of ideas why this is happening. But to make it clear "rlm_radutmp" is containing all clients which are authorized. This is the file which checks for "Simultaneous-Use". You increased the "Simultaneous-Use" - that is what I had told you, too. Check again that there is not a double entry in "MACs" and "Users" with this MAC address: 00-02-a5-4e-df-67.

@zlyzwy:

3. Maximum Download Bandwidth/Maximum Upload Bandwidth
I have a 20m/s ADSL at home. I tested with 800 bit/s and 800000bit/s. There should have a obvious difference. However they give the similar result here(around 20m/s).

I read about this behaviour on some forum posts. It has something to do with that CP is only changing bandwidth for users which authenticate new. It doesn't change this for existing connections.
When I tested this at home I found out that you have to enable "Bandwidth Limits" on CP first. You can enter a value but if you set a setting on FreeRADIUS then the value of the CP will be overwritten (that's what we want). And then I am not sure if there is the same bug in this function as with "amount of traffic". The traffic which goes through CP is for example 1MB but accounting will tell RADIUS that there are 6MB. Not sure if this affects Bandwidth Limits in any way, too.
So I am sorry but I could not tell you where the problem for Bandwidth Limits is. Need to test this more and find out which checkboxes on CP I need to enable and which services needs to be restartet.

@zlyzwy:

I am afraid I may put too many requests here.
Many thanks for your help!

Thats no problem - for me :-)

pszafer

do You have any other materials about freeradius and AD without samba?
I cannot find anything else and trully I am tired of doing same thing again and again and don't have chance to get it working properly :/

Nachtfalke

@pszafer:

do You have any other materials about freeradius and AD without samba?
I cannot find anything else and trully I am tired of doing same thing again and again and don't have chance to get it working properly :/

I am sorry. I don't have any how-tos or tutorial and I do not have access to any AD :(

But correct me if I am wrong: You got it working with PAP ?
If yes, can you please write down what you have configured - I would like to add it to the pfsense docs so this could be a basis for someone else who wants to try this - or for further if freeradius adds better support for connecting to an AD.

zlyzwy

@Nachtfalke

First I am sorry. I didn't see that you updated your post ;-)
First it is good that Plain-MAC-Auth is working
Second:
Disable Plain-MAC-Auth and put this in "FreeRADIUS -> Users tab"
Username: 00-02-a5-4e-df-67
Password: (The shared secret from Captive Portal below the point "Enable MAC authorization)
Delete the entry in "FreeRADIUS -> MACs" with this MAC address: 00-02-a5-4e-df-67

Then it should work.

I confirm this works.:) Nice~~

Uuuhh..hmm..I am out of ideas why this is happening. But to make it clear "rlm_radutmp" is containing all clients which are authorized. This is the file which checks for "Simultaneous-Use". You increased the "Simultaneous-Use" - that is what I had told you, too. Check again that there is not a double entry in "MACs" and "Users" with this MAC address: 00-02-a5-4e-df-67.

I am sure there is only one MAC for one record. I also tried to remove all the record and just put server's MAC to list. The result is the same– only host can access the Internet, vm machine can't.
I have an idea for this issue, because my host server and VM_debian are actually using one physical network card (VM is directly bridged on host). FreeRadius recognize there are two clients using the same MAC to get passed? Of course, this is only my guess.
But if this is correct, 'simultaneous connections' should solve the problem if I set the value as '2'.. :(
I google with the error log, very little information...

I read about this behaviour on some forum posts. It has something to do with that CP is only changing bandwidth for users which authenticate new. It doesn't change this for existing connections.
When I tested this at home I found out that you have to enable "Bandwidth Limits" on CP first. You can enter a value but if you set a setting on FreeRADIUS then the value of the CP will be overwritten (that's what we want). And then I am not sure if there is the same bug in this function as with "amount of traffic". The traffic which goes through CP is for example 1MB but accounting will tell RADIUS that there are 6MB. Not sure if this affects Bandwidth Limits in any way, too.
So I am sorry but I could not tell you where the problem for Bandwidth Limits is. Need to test this more and find out which checkboxes on CP I need to enable and which services needs to be restartet.

I did a quick test on your point. Basically the 'Bandwidth Limits' in CP works.
For FreeRadius's bandwidth limits, it does not always override the setting in CP. Usually CP's setting will override FreeRadius.

I am afraid I have little time today and these testings may not complete.

In next a couple of days, I can't access my PF box so I will not do any more testing… But I would like to continue this topic later.

Thanks && have a nice day:)

Nachtfalke

@zlyzwy

As far as I know in VMware Workstation you are able to change the MAC address of every interface. So you could try to change/check if all interfaces have different MACs.

To make sure that freeradius does not have old entries, delete the file:

rm /var/log/radutmp

Bandwidth Limits:
I think I cannot do anything against this. freeRADIUS is sending the correct attributes and CP recognizes these attributes but the problem seems to be deeper in the CP code (QoS) and so on. ( I had a very short conversation on mailing-lists about that with ermal).

We will see :)

Nachtfalke

Updates pkg v1.5.5:

Added/Fixed: We are now able to use the "Amount of Download/Upload/Time" limits as intended. There are some problems between CP and "rlm_acct_unique module in freeradius. I added an option in "FreeRADIUS -> Settings" to disable this module. Then the counter work as they should."
Updated: FreeRADIUS documentation (counters)

zlyzwy

@Nachtfalke:

@zlyzwy

As far as I know in VMware Workstation you are able to change the MAC address of every interface. So you could try to change/check if all interfaces have different MACs.

To make sure that freeradius does not have old entries, delete the file:
rm /var/log/radutmp
We will see :)

@Nachtfalke

There are two kinds of network connection method in VM : Bridged, NAT and host only.
I am now using Bridged on host and VM_Debian. Their MACs are:
Host : 00-02-a5-4e-df-67
VM_Debian:00-0c-29-ee-88-30
The host's MAC is also the physical MAC.
I found the FreeRaius can only accept one client. It will always be the lastest one who refresh the network settings.
In windows it's

ipconfig/renew

In Debian it's

/etc/init.d/networking restart

I changed the debian's MAC to be the same as host, but no lucky.
Tried to put Debian's MAC to pass list, no lucky…

I am running out of idea for this issue... I have the feeling this should be the problem of FreeRadius not CP.
I am ready to post this question to FreeRadius Mail list...This is the only free support method I found for FreeRadius...
(I may need to mention this topic in the mail. Will that bring you any inconvenience?)

About bandwidth, I think I may try to do it in Firewall. But just thinking about it....

BTW: I tried to configure the PF in remote, it seems to be as good as local..

Nachtfalke

You can post your question where you want and you can point to this thread if you want. I do not have a problem with that.
But I do not think that RADIUS is the problem. The RADIUS is only doing what the NAS (CP) is telling.

The problem could be perhaps the NAS Port sent in the Access-Request. If both Access-Request do have the same attribute-values.
Try radiusd in debug mode (radiusd -X) and compare the Access-Request when connection with one and then with the other VM.