NEW Package: freeRADIUS 2.x
-
@Nachtfalke
I just would like to say that if you want copy content of my gdoc to freeradius/pfsense wiki, enjoy and do it ;)Thank you for that! Some parts of your tutorial can be done from GUI. Others need additional configuration. I added the URL to the docs. :-)
Someday I wish do delete as much as possible from samba package and leave just winbindd, ntlm_auth and related necessary packages, just don't know when I'll have enough time to do it ;)
If you've done it successfully you let me know. ;) Perhaps future versions of freeradius do have (better) support for that or I will add an option in GUI to add samba package as optional setting.
-
Thanks for this package.
I would like to disable the other types of EAP. How should I go about doing this? Right now I am using EAP-TLS and that is all I want to use.
What is the most secure WPA2 auth? I am thinking either EAP-TLS or EAP-TTLS. Am I right?
Like I said. Thanks for the package.
-
Thanks for this package.
I would like to disable the other types of EAP. How should I go about doing this? Right now I am using EAP-TLS and that is all I want to use.
What is the most secure WPA2 auth? I am thinking either EAP-TLS or EAP-TTLS. Am I right?
Like I said. Thanks for the package.
If you disable "Weak EAP types" then you disable MD5, GTC and LEAP.
Then you there should only be three strong types available:-
EAP-TLS which is very secure and the strongest encryption
-
EAP-TTLS
-
Protected EAP (PEAP)
EAP-TTLS and PEAP could be clasified as secure, too, but less than EAP-TLS.
Because all the three types are secure types and so I didn't implement any option in the GUI to disable them.
If you would like to disable this just go to/usr/local/etc/raddb/eap.conf
and delete/comment the TTLS and PEAP blocks and restart freeradius.
-
-
Thanks. I just wanted to know if that would work.
-
Thanks. I just wanted to know if that would work.
It will unless you do not change anything in FreeRADIUS => EAP. A click on "Save" will overwrite the complete file.
-
What I meant for Vouchers packages is the following:
-Ability to create plans (by time or by traffic) and able to assign users to it and print those vouchers (easy part) also modify the GUI
-The problem comes when we create 2 weeks plans for example, and our DHCP lease is only a day, if the user is off for a day and someone else gets the ip he had before, he will be asked to authenticate again. Now if he has used 5 days of plan, would he now have 5 days left or since he has been authenticated he will have 2 weeks again. this is why I want to implement sqlippool to better mange the leases and prevent this from happening.When I have a chance I will post screen shots of what I have and see where we can go from there. Also, I am trying to build an Asterisk package, could you point me on some doc you used?
Regards
Hi,
I am glad there is finally a good package for this. I had done this before by custom package building on FreeBSD with VMWare and then installing on PFsense, no GUI. I am using it on a hotel right now with 1000 rooms. I would like to contribute and share my work to contribute to a robust solution with MySQL integrated.You are welcome!
There are a couple of things that I've came across and want to fix are the following:
-Implement Freeradius with sqlippool or better manage DHCP leasesI do not have much experience with *SQL databases. The basic support to connect to an *SQL database is ready and working. But you are right. I didn't take a look at sqlippool and of course if there will be GUI support for creating a custom SQL query would be really nice.
I thought of to hardcode the main part of a counter (daily, weekly,time, data) in the sqlcounter.conf and from GUI everybody can add the queries he likes.-If user is authenticated for 1 day and server reboots, he has to authenticate again ( I want accounting to continue where it left off)
I don't think there is any way around - if freeradius or the NAS reboots the user has to reauthenticate. If the NAS sends "interim updates" or "start/stop" accounting updates then there will be no big accounting loss when server reboots/crashes. To get high availability you need to use more than one RADIUS server and more than one database (freeradius2 package can do failover/loadbalancing for LDAP or *SQL).
So I would be interested in what we can do on this point.-Better Voucher/User GUI and printing options.
You have to explain that more in detail.
I'l be glad to share my work and help where I can.
Regards
As I said above - if you have any SQL ideas or something developed (sqlcounter, sqlippool, DOCUMENTATION :D ) then I really would appreciate to implement your work! :)
-
What I meant for Vouchers packages is the following:
-Ability to create plans (by time or by traffic) and able to assign users to it and print those vouchers (easy part) also modify the GUI
-The problem comes when we create 2 weeks plans for example, and our DHCP lease is only a day, if the user is off for a day and someone else gets the ip he had before, he will be asked to authenticate again. Now if he has used 5 days of plan, would he now have 5 days left or since he has been authenticated he will have 2 weeks again. this is why I want to implement sqlippool to better mange the leases and prevent this from happening.When I have a chance I will post screen shots of what I have and see where we can go from there. Also, I am trying to build an Asterisk package, could you point me on some doc you used?
Regards
I will wait for your screenshots to better understand what you mean. Further I took a look into sqlippool and the default config seems to work as far as I can see that. You only have to import the sql.table into your database and put in some content.
A better way would be to to make CaptivePortal able to understand "Framed-IP-Address" and "Framed-IP-Netmask" and "Framed-Route" attributes. This would allow us to always assign the sam IP address to a user when authentication on CP against freeradius. So no worry about any lease times on DHCP. As far as I know the PPTP implementation on pfsense can do this.
Abou your two plans - time or traffic:
-
Vouchers (time): A 10 day voucher will allow the user to use the internet for 10 days after first login. Fine!
-
Amount of Time (freeradius): An amount of 1440min (1 day) will allow the user to use this amount when he likes. 120min on the first day. 1000min on the nex day and 320min on the fifth day. This would work like a charm IF CP would reset the "Acct-Session-Time" attribute between every "start/stop" accounting update. ermal wrote a patch which should fix that hopefully in previous versions.
-
Amount of time (freeradius): This is working, too, with the new "Amount of time" counter I implemented (without any sql database). When running CP accounting updates in interim-update mode this is working like a charm. If running in "start/stop" accounting THEN CP needs to handle the "Acct-X-Octets" the correct way and reset them between every update. This probably will be fixed in future versions, too. If you want to run this against an *sql database we need to create the correct query. There is no need for a GUI because we can create 4 types (daily, weekly, monthly, forever) and put this into the sqlcounter.conf
Perhaps I misunderstand something but I hope your screenshots will clarify this if I was wrong :-)
-
-
It will unless you do not change anything in FreeRADIUS => EAP. A click on "Save" will overwrite the complete file.
Where does it pull the config from? What php file would I have to edit?
-
It will unless you do not change anything in FreeRADIUS => EAP. A click on "Save" will overwrite the complete file.
Where does it pull the config from? What php file would I have to edit?
File to edit:
/usr/local/pkg/freeradius.inc
Function to edit:
function freeradius_eapconf_resync()
-
http://forum.pfsense.org/index.php/topic,46648.0.html
should have been posted here. mea culpa.
-
http://forum.pfsense.org/index.php/topic,46648.0.html
should have been posted here. mea culpa.
Fixed that. Thanks!
Shouldn't be any big problems with that except when using freeradius-cert-manager -
Long startup time of freeradius2 with pfsense 2.0.1
I have a WLAN system based on pfSense running in a small hotel, where user access is handled by the captive portal of pfSense using freeradius2 for authentication. I am getting some complaints about not being able to get connected to the internet. The captive portal is enabled all the time.
I can to reproduce this "login" problem in the following situations:
(1) After booting, when all services are already running, pfSense does not redirect to the login page of the captive portal and the HTML request just times out.
(2) A few times, after waiting for more than 2 minutes, all of a sudden the login page is shown and subsequently everything works as expected.
(3) When changing parameters of the freeradius2 configuration (probably freeradius2 is restarting in the background), the login screen doesn't show up again.
(4) If the captive portal is enabled without using any authentication, the login screen always appears (that's why I think it could be related to freeradius2 and not the captive portal itself).Is this a known behavior of freeradius2? In case it just takes a couple of minutes (but why does it take so long?) until the logins work, I can live with that, as regular operation doesn't require frequent restarts or rebooting. Otherwise there might be a problem, at least for my system.
-
Long startup time of freeradius2 with pfsense 2.0.1
I have a WLAN system based on pfSense running in a small hotel, where user access is handled by the captive portal of pfSense using freeradius2 for authentication. I am getting some complaints about not being able to get connected to the internet. The captive portal is enabled all the time.
I can to reproduce this "login" problem in the following situations:
(1) After booting, when all services are already running, pfSense does not redirect to the login page of the captive portal and the HTML request just times out.
(2) A few times, after waiting for more than 2 minutes, all of a sudden the login page is shown and subsequently everything works as expected.
(3) When changing parameters of the freeradius2 configuration (probably freeradius2 is restarting in the background), the login screen doesn't show up again.
(4) If the captive portal is enabled without using any authentication, the login screen always appears (that's why I think it could be related to freeradius2 and not the captive portal itself).Is this a known behavior of freeradius2? In case it just takes a couple of minutes (but why does it take so long?) until the logins work, I can live with that, as regular operation doesn't require frequent restarts or rebooting. Otherwise there might be a problem, at least for my system.
Hi,
don't know why CP isn't showing up with some delay. I don't think it has something to do with freeradius2 because if you enter a wrong RADIUS IP in CP then it is the same as freeradius not responding. But I am not sure at this.
There is a longer (repeating) startup time after reinstallation of freeradius2 package because of of the recreation of the config files. There is no way around.
But you are right - the startup of freeradius2 isn't really fast but I don't know how to speed this up.Restart of freeradius is very fast if you:
(1) add/delete a user
(2) add/delete a client
In syslog you can see the outputHmmm…if you find some more information when or why this is happening, please let me know. I will think about that "problem".
-
Nachtfalke,
I'll keep an eye on the issue. Let me first collect more information to find out under what precise circumstances the login problem occurs. I am pretty sure that it is not the server itself as "radtest <user><user pw="">…" works immediately with a very short response time after the server is marked as running inside the gui. At the same time the client login fails (by not showing the cp login page).
There could be a delay, but it could also be a random error in the way different components interact. I need to work out a suitable test matrix to nail down the problem (booting, restarting services, login immediately or after some time period). Maybe this will give a clearer picture...</user></user>
-
Long startup time of freeradius2 with pfsense 2.0.1
Meanwhile I rebooted the pfSense2 box in question serveral times && checked the internet access after waiting at least 5 minutes. I was able to login all the time. Therefore I think that the inability to login is just a startup timing problem.
I haven't checked the exact details, but if Status->Services reports a running service, it probably just means that a pid file exists, but that doesn't mean that the service is fully available to the outside world. My box uses an Atom 510 CPU and PowerD is enabled. Besides the CP the services Squid, SquidGuard (with a rather large blacklist) and Snort (a few rules) are enabled and especially Snort uses initially a lot of CPU time after the service has started up. The combination of resource hogs and a relatively weak CPU seem to be the cause of the reported problem.
-
Long startup time of freeradius2 with pfsense 2.0.1
Meanwhile I rebooted the pfSense2 box in question serveral times && checked the internet access after waiting at least 5 minutes. I was able to login all the time. Therefore I think that the inability to login is just a startup timing problem.
I haven't checked the exact details, but if Status->Services reports a running service, it probably just means that a pid file exists, but that doesn't mean that the service is fully available to the outside world. My box uses an Atom 510 CPU and PowerD is enabled. Besides the CP the services Squid, SquidGard (with a rather large blacklist) and Snort (a few rules) are enabled and especially Snort uses initially a lot of CPU time after the service has started up. The combination of resource hogs and a relatively weak CPU seem to be the cause the reported problem.
The startup of freeradius2 is probably not the best way. The problem is, that some files needs to be created/changed and after this freeradius needs a restart. I can not replace the restart of freeradius after some functions because I need the restart when changing something from GUI. I am running freeradius2 package on a xeon processor and that's probably why I do not have problems with weak CPU power ;o)
PS: Sometimes the green service arrow isn't representing the actual state. If you have logging enabled you should see how often freeradius is restarting in the syslog.
-
Nachtfalke,
when you say "…and after this freeradius needs a restart" does that mean the freeradius process gets killed and restarted quite frequently, especially after new users have been added?
-
Nachtfalke,
when you say "…and after this freeradius needs a restart" does that mean the freeradius process gets killed and restarted quite frequently, especially after new users have been added?
When adding/deleting a users it is absolutly essential to restart the freeradius service. But it is not killed (killall -9) it gets restarted (/usr/local/etc/rc.d/radiusd onerestart)
It is further essential if you add a client, and interface, change eap settings, change SQL or LDAP settings. It is simple essential after all changes you are doing. There ist no way around - this is the way freeradius2 works :) -
I just looked at radiusd.c and before doing anything else gets done the configuration files are read and this is the only place where read_mainconfig() gets called (and not at later times again triggered by a signal as is done in dnsmasq). The executable is small and there are only a few small local files to read, so restarting shouldn't take a lot of time. Also I do not see any problems when new users are added, only after starting the box (I still need to verify under which conditions restarting of freeradius and/or other services cause the login problems).
Tomorrow I'll restart the pfSense box again a few times and try to access the internet within the first 30 seconds after the box has signalled that it is ready. Meanwhile I also have a second box prepared with an older single core AMD CPU, so I can study the behavior of freeradius2 without having the Snort and the Squid stuff installed (just in case these packages slow down the entire system) and then see what happens if I add these packages again.
Currently I tend to think that an Atom based system needs probably about 2 minutes until it is usable if many resource hungry packages are installed.
-
Maybe the problem of not being able to log in is not at all related to freeRADIUS2. The PortalAuth log has the following entries whenever I restart the Squid/SquidGuard daemons:
Feb 29 20:03:45 squid[15693]: Squid Parent: child process 16200 exited with status 0
Feb 29 20:03:48 squid[30849]: Squid Parent: child process 31376 started
Feb 29 20:04:03 squid[31376]: The url_rewriter helpers are crashing too rapidly, need help!
Feb 29 20:04:03 squid[30849]: Squid Parent: child process 31376 exited due to signal 6
Feb 29 20:04:06 squid[30849]: Squid Parent: child process 53720 startedI searched for the url_rewriter problem, but I did not find a real solution. This message seems to show up quite frequently, so it could just be a bogus message.
-
Somewhere else somebody suggested to check the db files of SquidGuard when SquidGuard is having problems. I did it and got:
[2.0.1-RELEASE][admin@pfsense2.bridge]/var/db/squidGuard/blk_BL_aggressive(40): /usr/local/bin/db42/db_verify domains.db
db_verify: Page 1: out-of-order key at entry 2
db_verify: Page 1: out-of-order key at entry 4
db_verify: Page 1: out-of-order key at entry 6
db_verify: Page 1: out-of-order key at entry 10
…
db_verify: DB->verify: domains.db: DB_VERIFY_BAD: Database verification failedThe files urls.db are ok, but all the domains.db files failed. Downloading the black list again and letting the system rebuild the database does not help.
Does somebody know whether one needs to worry about this?
-
Somewhere else somebody suggested to check the db files of SquidGuard when SquidGuard is having problems. I did it and got:
[2.0.1-RELEASE][admin@pfsense2.bridge]/var/db/squidGuard/blk_BL_aggressive(40): /usr/local/bin/db42/db_verify domains.db
db_verify: Page 1: out-of-order key at entry 2
db_verify: Page 1: out-of-order key at entry 4
db_verify: Page 1: out-of-order key at entry 6
db_verify: Page 1: out-of-order key at entry 10
…
db_verify: DB->verify: domains.db: DB_VERIFY_BAD: Database verification failedThe files urls.db are ok, but all the domains.db files failed. Downloading the black list again and letting the system rebuild the database does not help.
Does somebody know whether one needs to worry about this?
I got the same error when checking another domains.db on my machine. But I don't think this is really related to freeradius2 and this thread ;)
-
I got the same error when checking another domains.db on my machine. But I don't think this is really related to freeradius2 and this thread
In my case I called db_verify on an system with SquidGuard running. This might not be the best idea. Before I'll continue I need to do some mandatory reading on Berkeley DBs. So far I know that db_verify doesn't acquire any locks, but SquidGuard might. In that case the error messages could be bogus.
… but now it's time to go home.
-
Hi
I am running 2.0.1 64 bit and this issue of not starting freeradius2 is still exist.I really would like to know is there any fix of this bug in close future?
I know that the great pfsense team are working on 2.1 release but some features of pfsense may excel brilliant over other UTMs and will broaden its popularity.
Thus as a matter of fact I should say that this feature of pfSense( authenticating via a radius server for large number of users ) and also synchronizing pfsense and authenticating pfsense users via windows radius and then adding some parameters( such as time quota) that windows radius will miss is a great idea that I swear will be one of best features of pfsense.Cheers to one of the best open source projects of all time.
tanx
-
Hi
I am running 2.0.1 64 bit and this issue of not starting freeradius2 is still exist.I really would like to know is there any fix of this bug in close future?
(…)
Don't know about any bug that freeradius2 is not starting !?!
You should explain that more in detail:
1.) When it is not starting - after pfsense reboot ?
2.) What does syslog say - did you enable logging ?freeradius2 package is configured by default that you ONLY need to add an interface and the the service is running. Try and test if this is working!
Don't use the old freeradius package and the freeradius2 package together! -
Tomorrow I'll restart the pfSense box again a few times and try to access the internet within the first 30 seconds
I restarted the box a couple of times (having verified that the configuration of the system worked) and tried to login via CP/freeRADIUS2 after about 30s. There were no login problems at all.
Now it looks as if some kind of previous misconfiguration was responsible for the login problems.
The only freeRADIUS related messages were
Mar 1 14:17:48 radiusd[4350]: rlm_radutmp: Login entry for NAS pfsense2 port 2 wrong order
Mar 1 14:17:48 radiusd[4350]: rlm_radutmp: Login entry for NAS pfsense2 port 2 wrong orderand
Mar 1 14:18:08 radiusd[4350]: rlm_radutmp: Logout for NAS pfsense2 port 2, but no Login record
Mar 1 14:18:08 radiusd[4350]: rlm_radutmp: Logout for NAS pfsense2 port 2, but no Login recordbut I guess these are without further consequences.
-
The rlm_radutmp problems are related to a known bug/mishandling of CaptivePortal.
But it does not make any problems if you do not use Simultaneous-Use = 1. Higher values are working.http://doc.pfsense.org/index.php/FreeRADIUS_2.x_package#KNOWN_BUGS
-
Hi I am using this package and created a group with 2 attributes: Max-All-Session := 600 (5 min) Simultaneous-Use := 1. I've enabled the noresetcounter on radiusd.conf, users on that group are able to authenticate ok, however they do not get disconnected after 600 sec have past. CP is enabled, interim updates enabled, authenticate users every minute is enabled. I have the same setup on another pf sense server with freeradius installed but not with this package and all is working ok on that one. I am using MySQL on both.
Thanks
-
I 've tried it on 2.0 release and it's working
but on 2.0.1 I 've tested it and it appears that 'modules' directory is missingI tried: radiusd -X
and it said:
: Error reading directory /usr/local/etc/raddb/modules/: No such file or directoryI's a strange problem.
Thank you in advance -
I 've tried it on 2.0 release and it's working
but on 2.0.1 I 've tested it and it appears that 'modules' directory is missingI tried: radiusd -X
and it said:
: Error reading directory /usr/local/etc/raddb/modules/: No such file or directoryBoth installs are i386 or x64?
Can you try a package reinstall? Both 2.0 and 2.0.1 use the same package from freebsd. -
Hi I am using this package and created a group with 2 attributes: Max-All-Session := 600 (5 min) Simultaneous-Use := 1. I've enabled the noresetcounter on radiusd.conf, users on that group are able to authenticate ok, however they do not get disconnected after 600 sec have past. CP is enabled, interim updates enabled, authenticate users every minute is enabled. I have the same setup on another pf sense server with freeradius installed but not with this package and all is working ok on that one. I am using MySQL on both.
Thanks
Hi,
do you use freeradius2 package on both pfsense or not ? That's not clear for me.the attribute: Max-All-Session is not a predefined attribute in GUI. So you probably created this attribute in your mysql database ? And if you use mysql as database for accounting then you need to use the sqlcounter.conf file. This file is NOT supported from GUI. You need to check and perhaps edit this file from shell.
I don't how it works with mxsql but if I use the ../raddb/modules/counter module (without external database) then this modul is ONLY running on accounting-stop packets, interim-updates do not work. So make sure that it does with mysql.
re-authenticate every minute should be enabled on CP so that the user gets disconnected. that's right what you did. You should enabled "Disable acct_unique" in FreeRADIUS -> Settings to make accounting work properly.
I 've tried it on 2.0 release and it's working
but on 2.0.1 I 've tested it and it appears that 'modules' directory is missingI tried: radiusd -X
and it said:
: Error reading directory /usr/local/etc/raddb/modules/: No such file or directoryI's a strange problem.
Thank you in advanceModules directory will be created when installing freeradius2 package. It is part of the default freeradius installation. Nothing changed there. Probably some problem while reinstallation.
Check if this folder exists - if not - reinstall package.
I tested with 2.0.1 and it is working.
-
Updates pkg v1.6.6:
-
Added: Possibility to sync to a remote host which has a different GUI protocol/port as the sync master
-
Bumped package to RC1 - there seems to be no reportet bug related to this package and at the moment there are no feature improvements planned.
Known bugs:
-
When using "stop/start accounting on CP then "Amount of Time/Amount of Traffic" isn't working correctly.
http://redmine.pfsense.org/issues/2164 -
When using CP + RADIUS + Vouchers and "reauthenticate every minute" is enabled then CP sends the voucher as username to RADIUS. This causes RADIUS to disconnect the "user/voucher" because of an unknown/wrong "username".
http://redmine.pfsense.org/issues/2155 -
When stop/start accounting on CP is enabled than the syslog shows many "wrong order" or "Login found bot no logout detected". This seems to not affect the usage of RADIUS but it is not 100% correct.
http://redmine.pfsense.org/issues/2143
-
-
I got it to work, I edited the files but did not know the config resets on reboot, so I edited freeradius.inc on line 362 and 1633, now all is working. On the other server I am using the normal freeradius package installed by me. I just need some more customization for french error message, working on it right now, i will upload the screenshots for the vouchers soon. This package is great, thanks again!
Hi I am using this package and created a group with 2 attributes: Max-All-Session := 600 (5 min) Simultaneous-Use := 1. I've enabled the noresetcounter on radiusd.conf, users on that group are able to authenticate ok, however they do not get disconnected after 600 sec have past. CP is enabled, interim updates enabled, authenticate users every minute is enabled. I have the same setup on another pf sense server with freeradius installed but not with this package and all is working ok on that one. I am using MySQL on both.
Thanks
Hi,
do you use freeradius2 package on both pfsense or not ? That's not clear for me.the attribute: Max-All-Session is not a predefined attribute in GUI. So you probably created this attribute in your mysql database ? And if you use mysql as database for accounting then you need to use the sqlcounter.conf file. This file is NOT supported from GUI. You need to check and perhaps edit this file from shell.
I don't how it works with mxsql but if I use the ../raddb/modules/counter module (without external database) then this modul is ONLY running on accounting-stop packets, interim-updates do not work. So make sure that it does with mysql.
re-authenticate every minute should be enabled on CP so that the user gets disconnected. that's right what you did. You should enabled "Disable acct_unique" in FreeRADIUS -> Settings to make accounting work properly.
-
Updates pkg v1.6.6_1:
- Fixed: counter files are placed in /var/log because nanobsd systems have write access to this folder (RAM) but after reboot the folders will be deleted. So we recreate them if they do not exist.
Known bugs:
-
When using "stop/start accounting on CP then "Amount of Time/Amount of Traffic" isn't working correctly.
http://redmine.pfsense.org/issues/2164 -
When using CP + RADIUS + Vouchers and "reauthenticate every minute" is enabled then CP sends the voucher as username to RADIUS. This causes RADIUS to disconnect the "user/voucher" because of an unknown/wrong "username".
http://redmine.pfsense.org/issues/2155 -
When stop/start accounting on CP is enabled than the syslog shows many "wrong order" or "Login found bot no logout detected". This seems to not affect the usage of RADIUS but it is not 100% correct.
http://redmine.pfsense.org/issues/2143
-
CaptiveProtal logout screen to show the remaining time or the quota information is it possible?
or to display them in real-time. -
CaptiveProtal logout screen to show the remaining time or the quota information is it possible?
or to display them in real-time.This is not a problem of FreeRADIUS. It is a problem of the NAS (CaptivePortal).
In general it is no problem to send back an Item/value to the NAS (reply-item) but the NAS must be able to display or interpret.So for example if the timelimit of a user is reached then the CP displays "Your maximum daily usage time is reached". Thats the "Reply-Message" attribute the counter module sends back to the NAS. So probably it would be possibly to implement this field in the logout popup window of CP and then it would probably be possible to display remaining time or something like that.
But I do not understand the code of CP and so I cannot definitly say if it will work.
- 9 days later
-
G'day
I registered for this forum due to pfSense' use for FreeRADIUS with Active Directory. Thanks to earlier writer who also added information on how to get this on PfSense 2.0.x. Before looking more at pfSense itself due to capability as easy NAT and Proxying I have pondered upon the "FreeRADIUS Beginners Guide" from PacktPub which also states that due to AD storing passwords as NTLM hash, we can't use the LDAP module in FreeRADIUS but ntlm_auth.
Also Windows systems until/including W7 only support WPA Enterprise with PEAP + MS-CHAPv2 (or EAP-TLS with client certificates) when no additional supplicant is present.
For MS-CHAPv2 and AD the way is to use ntlm_auth wiht Samba against AD as "authentication oracle" instead of "as LDAP database". I had to build Samba 3.6 (with ADS since it's disabled in default builds) + dependencies on FreeBSD 8.2 from ports (make package). Then I had to ship a dozen of libraries like libgssapi_krb5.so.10 to make Samba happily start on the PfSense box. For sure this breaks using the web configurator. But hey, seems to work! :)
I know PfSense 2.1 will switch over to PC-BSD PBI packages. Having Samba available for this kind of authentication scenario would be fabulous. Since it seems yet to be the only known and documented to get FreeRADIUS 2.x work with AD and environments that have lots of Windows clients.
I can only state here that it seems to work fairly well here but I'll monitor how well it really does in further testing.Are there any plans to include Samba with the a next PfSense/FreeRADIUS in some way?
-
Msi,
I did this samba_ntlm auth(for squid) yesterday and compiled two packages That may help you.Take a look on http://e-sac.siteseguro.ws/packages .
Heimdal is the "native" Kerberos package for freebsd and do not has a lot of dependencies like kerberos5.
Current pfsense version is based on freebsd8.1 so 8.2 packages may break some dependencies.Install heimdal-1.4_1.tbz and samba36-3.6.3.tbz on a test machine and see if you have same result without lib issues or broken gui.
If you could reach a full functional setup with captive portal and active directory try to build a tutorial for us :)
-
If there is a working samba package which we can use with pfsense and freeradius2 package then I will try to implement a GUI to configure the needed samba parameters when using freeradius with AD.
I want to be honset - I am not up to date why we cannot/should not use samba with pfsense and I do not need this support for my daily job ;)But I would try to implement this feature if it is possible for me :)
-
Hi
I have quite limited time yet but yes: So far PfSense really rocks!
marceloc: Thank you, indeed I haven't payed attention against what kind of Kerberos Samba got built, I simply hit "make package" on FreebSD 8.2 under /usr/ports/net/samba36 and payed attention to have ADS enabled (since that is precisely not enabled by default in FBSD packages).
How did you achieve this? (I had quite a couple of dependencies like libiconv, gettext, python27 etc.)By breaking the UI I meant that by only editing config files on shell in /usr/local/etc/raddb the GUI didn't get updated - but that was fully expected. :)
BTW: It must be your Howto on Google docs? - It's quite good although the mentioned book seems to make it a little bit shorter even.
Nachtfalke, that would be very great, for sure it's less good to have a full-blown Samba on a Firewall, but if we just have a config to have stripped-down Samba working as authentication backend and disable all the fancy file sharing stuff, I'd say that it is a "calculated" risk ;)
Once I understood the concepts it was fairly straightforward for a working results via Config files. A small smb.conf (about 15 lines with Domain config etc.), a module config for modules/ntlm_auth and modules/mschap to get it. After 'net join ads' I had to restart Samba and radiusd and everything was working.
Let me know / point me in the direction how I could provide some help, I'm fairly new to PfSense.