NEW Package: freeRADIUS 2.x

Nachtfalke

Hello,

i have freeradius2 and client name "ted", he has god IP address 172.16.3.1 in freeradius, and in DHCP server he has got static IP binded to his MAC address of device A. I want to enable "ted" to connect with his device B. Do I have to create another account in freeradius or: in DHCP server i bind his device B MAC address to another IP address(172.16.3.2) and add 172.16.3.2 to "ted" IP range?

Hi,

this post is a little bit confusing - for me.

You need just one entry with "ted" in FreeRADIUS => Users.
If you want FreeRADIUS to assign an client an IP address then the NAS must support that. pfsense (NAS) does not support that - as far as I know.

filip_pag

i want to do this
http://imageshack.us/photo/my-images/831/freeradius.png/
that ted can connect only by his iPhone and iPod

Nachtfalke

@filip_pag:

i want to do this
http://imageshack.us/photo/my-images/831/freeradius.png/
that ted can connect only by his iPhone and iPod

HI,

create a user on freeradius with username "ted" or whatever you like and a password for this user.

Forget about "Framed-IP-Address" on FreeRADIUS GUI. pfSense DHCP server does not understand this if FreeRADIUS sends "Framed-IP-Address".
Just add two static mappings on DHCP for the iphone MAC and another one for the iPad MAC. The one with 172.16.3.1 and the other with 172.16.3.2
The IP address is independent from the configuration you do on FreeRADIUS.

What freeradius is doing in your screenshot is only the following:
iPad connects to wifi
wifi demands a username/password from iPad user
iPad user enters "ted" and the password
wifi checks this username/password against FreeRADIUS
FreeRADIUS sends an "Access-Accept" if credentials are correct or "Access-Reject" if credentials are wrong

Then the iPad has access to the network and the DHCP server offers the IP address to iPad.

filip_pag

understand but,

I create static IP 172.16.3.1 binded to MAC,
and i added framed IP 172.16.3.1 to teds account.

from another PC, static IP 172.16.3.6 that has binded its MAC
I tried to connect with teds account and freeradius disconects me,
think that it works, can I add 2 framed IP-s to one freeradius user account?

Nachtfalke

@filip_pag:

understand but,

I create static IP 172.16.3.1 binded to MAC,
and i added framed IP 172.16.3.1 to teds account.

from another PC, static IP 172.16.3.6 that has binded its MAC
I tried to connect with teds account and freeradius disconects me,
think that it works, can I add 2 framed IP-s to one freeradius user account?

The disconnection is probably not because of the IP address but because of "Simultaneous-Use" settings. Leave this field empty or set it to 2 or higher.

Further post the syslog output.

I don't think that a user can have two IPs….Try with "172.17.3.1+" which gives the next IP to a user which is free if 172.16.3.1 is in use.

Cino

Nachtfalke

I meant to report this a while ago, but your probably already know this. Everytime I reboot my box, i see these errors on the console,see attachment. Its not hurting anything from what I can tell.

Stephen

freeradius2.jpg_thumb

Nachtfalke

@Cino:

Nachtfalke

I meant to report this a while ago, but your probably already know this. Everytime I reboot my box, i see these errors on the console,see attachment. Its not hurting anything from what I can tell.

Stephen

Hi,

do you have "Plain MAC Auth" enabled or disabled ?
Do you have these two files after the "errors" when you boot up pfsense ?


/usr/local/etc/raddb/files.backup
/usr/local/etc/raddb/policy.conf.backup

–--- edit -----
@cino:
I couldn't find any post from you on the last 5 pages - and if there was one - I missed it ;-)

Ich checked here at home with "Plain MAC Auth" enabled and disabled and rebooted - no problems.
In general - after package installation - freeradius2 creates a backup of the following files:


/usr/local/etc/raddb/modules/files
to
/usr/local/etc/raddb/files.backup
and
/usr/local/etc/raddb/policy.conf
to
/usr/local/etc/raddb/policy.conf.backup

Because when enabling Plain MAC Auth these files will be overwritten and to make sure we can get back the original one I made the backups after package installation.

Perhaps try with a reinstallation on freeradius2 package and then the files should be there. If not it is not a problem but post back - then I will have a closer look at this.

Thanks for feedback :-)

Nachtfalke

@Nachtfalke:

Updates pkg v1.6.2:

Added: Support for one-time-paasswords. Implemented an open source solution which can be used from many mobile devices (iPhone, Android, BlackBerry, …)

Updated: freeradius 2.x package documentation

Known bugs:

When using "stop/start accounting on CP then "Amount of Time" isn't working correctly.
http://redmine.pfsense.org/issues/2164

When using CP + RADIUS + Vouchers and "reauthenticate every minute" is enabled then CP sends the voucher as username to RADIUS. This causes RADIUS to disconnect the "user/voucher" because of an unknown/wrong "username".
http://redmine.pfsense.org/issues/2155

When stop/start accounting on CP is enabled than the syslog shows many "wrong order" or "Login found bot no logout detected". This seems to not affect the usage of RADIUS but it is not 100% correct.
http://redmine.pfsense.org/issues/2143

Cino

I dont have "Plain MAC Auth" enabled and dont have the 2 files either. I think I know what could be the issue. I'm running 2.1-Dev on my box which is looking for pbi packages. When I reinstall the package or reinstall just the GUI components, I have to manually installing the binary via from shell. I'm wondering because I'm running the pkg install, it removes these files.

btw, great work on the package!

Nachtfalke

This could be the problem.

So if you like to "eliminate" this error message then just create a backup of these two files by hand. If not - there won't be a problem, too.
The backup is only to prevent unknown site-effects which probably aren't there.

PS: How could you run freeradius2 on 2.1 ? Isn't it based on FreeBSD 9 until now ?

Cino

the binaries are not FreeBSD9.x yet.. i'm gitsync the pfsense code so I can have IPv6 function. Can't wait for FreeBSD9 snapshots but I have a feeling a lot of the packages i'm using wont be able to install :-(

marcelloc

@Cino:

Can't wait for FreeBSD9 snapshots but I have a feeling a lot of the packages i'm using wont be able to install :-(

good feeling :D

I`ll need to learn how to build pbi packages for pfsense.

Nachtfalke

@marcelloc:

@Cino:

Can't wait for FreeBSD9 snapshots but I have a feeling a lot of the packages i'm using wont be able to install :-(

good feeling :D

I`ll need to learn how to build pbi packages for pfsense.

And explain how it works :D

Sailorsknot

I'm trying to use the "Amount of Download Traffic" under the Users Tab to limit users to 2.5GB/week, but for the life of me I can't figure out how to express that to freeRADIUS using the GUI/freeRADIUS/Users/Traffic and Bandwidth entry field?

After entering any number in the "billions" range, immediately when a user attempts logon freeRADIUS reports that "Your maximum daily usage time has been reached" even though the user has never logged on before. The most download traffic I seem to be able to reach is about 50MB. Users can download unlimited data if the field is empty. Is there a limit to the size number that can be used for "amount of download traffic"?

Any help is much appreciated…

Nachtfalke

@Sailorsknot:

I'm trying to use the "Amount of Download Traffic" under the Users Tab to limit users to 2.5GB/week, but for the life of me I can't figure out how to express that to freeRADIUS using the GUI/freeRADIUS/Users/Traffic and Bandwidth entry field?

After entering any number in the "billions" range, immediately when a user attempts logon freeRADIUS reports that "Your maximum daily usage time has been reached" even though the user has never logged on before. The most download traffic I seem to be able to reach is about 50MB. Users can download unlimited data if the field is empty. Is there a limit to the size number that can be used for "amount of download traffic"?

Any help is much appreciated…

Hi Sailorsknot,

there shouldn't be any limit when using freeradius2 and Captive Portal.
The unit for "Amount of download/upload" is bytes. So 2.5GB = 2500000000Byte. With the CP bug you must increase this value multiplied with 6 => 2500000000Byte x 6 = 15.000.000.000Byte

You must disable "Acct_unique" in FreeRADIUS => Settings.

To make sure that all old entries are deleted stop freeradius2 service, delete the "db." files:

rm /usr/local/etc/raddb/db.*

Then restart freeradius2 and try again.

This should work.

http://doc.pfsense.org/index.php/FreeRADIUS_2.x_package#Accounting_with_Captive_Portal

Sailorsknot

Thanks so much for the quick reply! :D

I stopped freeRadius and deleted the db files and restarted freeRADIUS. I created a new user (test11) and specified 15000000000 for "daily" download limit.

Fails when I try to logon:

Feb 11 18:33:14 logportalauth[3069]: FAILURE: test11, 00:22:43:60:ed:ca, 10.10.10.206, Your maximum daily usage time has been reached

any idea? (again, thanks for helping!!)

Nachtfalke

@Sailorsknot:

Thanks so much for the quick reply! :D

I stopped freeRadius and deleted the db files and restarted freeRADIUS. I created a new user (test11) and specified 15000000000 for "daily" download limit.

Fails when I try to logon:

Feb 11 18:33:14 logportalauth[3069]: FAILURE: test11, 00:22:43:60:ed:ca, 10.10.10.206, Your maximum daily usage time has been reached

any idea? (again, thanks for helping!!)

please show "users" file.
FreeRADIUS => View Config

Sailorsknot

/usr/local/etc/raddb/users

"siteno20" Cleartext-Password := "pquiip", Max-Weekly-Output := 2684354560

"siteno54" Cleartext-Password := "ugekwc", Max-Weekly-Output := 2684354560

"test11" Cleartext-Password := "test11", Max-Daily-Output := 15000000000

Sailorsknot

some poking around… seems the largest number that can be entered in GUI field "Amount of Download Traffic" is : 999999999. If the CP calculates 6 times (divided) then the maximum download can only be: 166MB? I seem to only be able to get to ~60MB.

Do you think it has something to do with this?

http://wiki.freeradius.org/FAQ#Why+do+Acct-Input-Octets+and+Acct-Output-Octets+wrap+at+4+GB%3F

Thanks, I appreciate the help…

Nachtfalke

Updates pkg v1.6.3:

Improved/changed: mobile-one-time-password. mOTP is now running as a freeradius2 module. All attributes (Expiration, bandwidth, VLAN, pp.) can now be used with it. Auth-Type is now "motp" and not always "Accept". So the new module decides if there is access or not and we do not have strange syslog outputs "Login: OK but Access denied".
Updated: freeradius 2.x package documentation

Known bugs:

When using "stop/start accounting on CP then "Amount of Time" isn't working correctly.
http://redmine.pfsense.org/issues/2164
When using CP + RADIUS + Vouchers and "reauthenticate every minute" is enabled then CP sends the voucher as username to RADIUS. This causes RADIUS to disconnect the "user/voucher" because of an unknown/wrong "username".
http://redmine.pfsense.org/issues/2155
When stop/start accounting on CP is enabled than the syslog shows many "wrong order" or "Login found bot no logout detected". This seems to not affect the usage of RADIUS but it is not 100% correct.
http://redmine.pfsense.org/issues/2143

=================================================================

@Sailorsknot:

some poking around… seems the largest number that can be entered in GUI field "Amount of Download Traffic" is : 999999999. If the CP calculates 6 times (divided) then the maximum download can only be: 166MB? I seem to only be able to get to ~60MB.

Do you think it has something to do with this?

http://wiki.freeradius.org/FAQ#Why+do+Acct-Input-Octets+and+Acct-Output-Octets+wrap+at+4+GB%3F

Thanks, I appreciate the help…

Hi again,
thanks for testing this!
The link you posted is - why I said - "In general there should be no limit with freeradius2 and Captive Portal. CP and freeradius2 can work with "gigawords"

There is a bug in CP which calculates other traffic volume than it should be. Many posts in the forum say that the real traffic multiplied with a factor of 6 is the traffic that CP counts.

GUI problems:
I need to check how many digits the GUI allows and perhaps if it makes sense to change from "bytes/s to MBytes/s).

I am not at home this weekend so I do not have all my "equipment" with me. I'll try to do some more tests with "Amount of traffic".