NEW Package: freeRADIUS 2.x

msi

G'day

I registered for this forum due to pfSense' use for FreeRADIUS with Active Directory. Thanks to earlier writer who also added information on how to get this on PfSense 2.0.x. Before looking more at pfSense itself due to capability as easy NAT and Proxying I have pondered upon the "FreeRADIUS Beginners Guide" from PacktPub which also states that due to AD storing passwords as NTLM hash, we can't use the LDAP module in FreeRADIUS but ntlm_auth.

Also Windows systems until/including W7 only support WPA Enterprise with PEAP + MS-CHAPv2 (or EAP-TLS with client certificates) when no additional supplicant is present.

For MS-CHAPv2 and AD the way is to use ntlm_auth wiht Samba against AD as "authentication oracle" instead of "as LDAP database". I had to build Samba 3.6 (with ADS since it's disabled in default builds) + dependencies on FreeBSD 8.2 from ports (make package). Then I had to ship a dozen of libraries like libgssapi_krb5.so.10 to make Samba happily start on the PfSense box. For sure this breaks using the web configurator. But hey, seems to work! :)

I know PfSense 2.1 will switch over to PC-BSD PBI packages. Having Samba available for this kind of authentication scenario would be fabulous. Since it seems yet to be the only known and documented to get FreeRADIUS 2.x work with AD and environments that have lots of Windows clients.
I can only state here that it seems to work fairly well here but I'll monitor how well it really does in further testing.

Are there any plans to include Samba with the a next PfSense/FreeRADIUS in some way?

marcelloc

Msi,

I did this samba_ntlm auth(for squid) yesterday and compiled two packages That may help you.Take a look on http://e-sac.siteseguro.ws/packages .
Heimdal is the "native" Kerberos package for freebsd and do not has a lot of dependencies like kerberos5.
Current pfsense version is based on freebsd8.1 so 8.2 packages may break some dependencies.

Install heimdal-1.4_1.tbz and samba36-3.6.3.tbz on a test machine and see if you have same result without lib issues or broken gui.

If you could reach a full functional setup with captive portal and active directory try to build a tutorial for us :)

Nachtfalke

If there is a working samba package which we can use with pfsense and freeradius2 package then I will try to implement a GUI to configure the needed samba parameters when using freeradius with AD.
I want to be honset - I am not up to date why we cannot/should not use samba with pfsense and I do not need this support for my daily job ;)

But I would try to implement this feature if it is possible for me :)

msi

Hi

I have quite limited time yet but yes: So far PfSense really rocks!

marceloc: Thank you, indeed I haven't payed attention against what kind of Kerberos Samba got built, I simply hit "make package" on FreebSD 8.2 under /usr/ports/net/samba36 and payed attention to have ADS enabled (since that is precisely not enabled by default in FBSD packages).
How did you achieve this? (I had quite a couple of dependencies like libiconv, gettext, python27 etc.)

By breaking the UI I meant that by only editing config files on shell in /usr/local/etc/raddb the GUI didn't get updated - but that was fully expected. :)

BTW: It must be your Howto on Google docs? - It's quite good although the mentioned book seems to make it a little bit shorter even.

Nachtfalke, that would be very great, for sure it's less good to have a full-blown Samba on a Firewall, but if we just have a config to have stripped-down Samba working as authentication backend and disable all the fancy file sharing stuff, I'd say that it is a "calculated" risk ;)

Once I understood the concepts it was fairly straightforward for a working results via Config files. A small smb.conf (about 15 lines with Domain config etc.), a module config for modules/ntlm_auth and modules/mschap to get it. After 'net join ads' I had to restart Samba and radiusd and everything was working.

Let me know / point me in the direction how I could provide some help, I'm fairly new to PfSense.

marcelloc

@msi:

Thank you, indeed I haven't payed attention against what kind of Kerberos Samba got built, I simply hit "make package" on FreebSD 8.2 under /usr/ports/net/samba36 and payed attention to have ADS enabled (since that is precisely not enabled by default in FBSD packages).
How did you achieve this? (I had quite a couple of dependencies like libiconv, gettext, python27 etc.)

Just compile and make package on /usr/ports/security/heimdal before compiling samba

If kerberos5 is installed, you have to remove it first.

@msi:

BTW: It must be your Howto on Google docs? - It's quite good although the mentioned book seems to make it a little bit shorter even.

Any format you want, it could be a google doc or a topic on this forum for example.

Nachtfalke

@msi

If you can provide a samba package and upload it to a server so I am able to add it to my pfsense and you can say that it works then I will start to make a GUI for that.
There are many docs on the net which descrine freeradius and AD which I will use to start and fine tuning will be done later - if needed :-)

marcelloc

Nachtfalke,

I'ts on the same repo as freeradius2.

I'm not sure if it is a good option to install it automatically.

Whe can think about on installing packages as gui options are selected.

heimdal has config on three files and samba just smb.conf

there is some aditional steps to joing domain and on kinit.

msi

So great guys, I'll join back either tomorrow or next, but interestingly with what I tried, I did not have to touch any Kerberos config file, or use kinit. Simply net ads join, and it was happy.

marcelloc: Yeah, makes sense for Heimdal, I'll see what is default on FreeBSD, haven't precisely checked back.

marcelloc

@msi:

marcelloc: Yeah, makes sense for Heimdal, I'll see what is default on FreeBSD, haven't precisely checked back.

Take a look on heimdal ports package description

A popular BSD-licensed implementation of Kerberos 5
Maintained by: Joerg.Pulz@frm2.tum.de
Also listed in: ipv6
Requires: autoconf-2.68, autoconf-wrapper-20101119, gettext-0.18.1.1, libiconv-1.13.1_2, libtool-2.4.2, m4-1.4.16,1, perl-5.12.4_4, pkg-config-0.25_1

msi

I have shortened and rewritten what I took out of the FreeRADIUS beginners guide and put that in a Google doc to check if I am on the wrong way. This is a very much WiP and also a temporary place:
https://docs.google.com/document/d/1i536CfITm478tAddzoxSLrjl9KcEqGGA-F_LG9Iwy6A/edit
With ntlm_auth it's possible to add a AD group requirement haven't tried that yet.

I'd also agree with marcelloc that it's not the best idea to pull in Samba automatically by freeradius since it's only needed when ntlm_auth comes into the game.

P.S: Nifty idea I came across - any plans to support virtual servers on pfSense with freeradius instead of default sites-enabled/default?

Nachtfalke

@marcelloc:

Nachtfalke,

I'ts on the same repo as freeradius2.
I'm not sure if it is a good option to install it automatically.
Whe can think about on installing packages as gui options are selected.

Yeah - better not by default. I will do it probably like I did with the bash package for mOTP. Will only be installed when enabled.

I installed the samba package from your server on pfsense.
Tried to start samba (didn't change anything on config):


[2.0.1-RELEASE][admin@pfsense.localdomain]/root(5): /usr/local/etc/rc.d/samba onestart
Removing stale Samba tdb files:  done
Starting winbindd.
/libexec/ld-elf.so.1: Shared object "libgssapi.so.2" not found, required by "winbindd"
/usr/local/etc/rc.d/samba: WARNING: failed to start winbindd
[2.0.1-RELEASE][admin@pfsense.localdomain]/root(6):

PS: I think this tutorial will do the job:
http://deployingradius.com/documents/configuration/active_directory.html

@msi
Virtual servers: If you do the job :)
I thought about that in the past but I didn't find a way to put this all into a GUI. Probably someone with more experience on php and conding at all would do a better job. But I am not the guy for that ;)

marcelloc

@Nachtfalke:

[2.0.1-RELEASE][admin@pfsense.localdomain]/root(5): /usr/local/etc/rc.d/samba onestart
Removing stale Samba tdb files: done
Starting winbindd.
/libexec/ld-elf.so.1: Shared object "libgssapi.so.2" not found, required by "winbindd"
/usr/local/etc/rc.d/samba: WARNING: failed to start winbindd
[2.0.1-RELEASE][admin@pfsense.localdomain]/root(6):

well,
maybe a cyrus-sasl-2.1.25_1,openldap-sasl-client-2.4.26, or heimdal dependence.

I guess heimdal or cyrrus.

qbik

Hi,
Does someone know if this package was compiled with DHCP option?

Thanks

marcelloc

@qbik:

Does someone know if this package was compiled with DHCP option?

I can't see this option on package make config.

freeradius_2.png_thumb

Nachtfalke

It is experimental and as far as I know you didn't compile experimental options.
http://freeradius.org/features/dhcp.html

marcelloc

@marcelloc:

I can't see this option on package make config.

Now I can see it as experimental option ;)

qbik

Thank you for this information!

Nachtfalke

Updates pkg v1.6.6_3:

Fixes: accounting scripts and small updates on the documentation. More infos in this thread:
http://forum.pfsense.org/index.php/topic,48404.0.html

Known bugs:

When using "stop/start accounting on CP then "Amount of Time/Amount of Traffic" isn't working correctly.
http://redmine.pfsense.org/issues/2164
When using CP + RADIUS + Vouchers and "reauthenticate every minute" is enabled then CP sends the voucher as username to RADIUS. This causes RADIUS to disconnect the "user/voucher" because of an unknown/wrong "username".
http://redmine.pfsense.org/issues/2155
When stop/start accounting on CP is enabled than the syslog shows many "wrong order" or "Login found bot no logout detected". This seems to not affect the usage of RADIUS but it is not 100% correct.
http://redmine.pfsense.org/issues/2143

qbik

Hi,
I want to do some test with DHCP on freeradius, I have a virtual machine where freeradius has DHCP enabled. I wanted to know if there is a way I can tell your package on installation to fetch my package file (from my server) and all dependencies will be treated as normal (from your server).

Thanks

marcelloc

@qbik:

Hi,
I want to do some test with DHCP on freeradius, I have a virtual machine where freeradius has DHCP enabled. I wanted to know if there is a way I can tell your package on installation to fetch my package file (from my server) and all dependencies will be treated as normal (from your server).

Thanks

No. what you can do is install freeradius2 package and then at console/ssh replace freeradius2 with your build using pkg_delete and pkg_add -r