Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NEW Package: freeRADIUS 2.x

    pfSense Packages
    80
    628
    632.9k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      Nachtfalke
      last edited by

      It is experimental and as far as I know you didn't compile experimental options.
      http://freeradius.org/features/dhcp.html

      1 Reply Last reply Reply Quote 0
      • marcellocM
        marcelloc
        last edited by

        @marcelloc:

        I can't see this option on package make config.

        Now I can see it as  experimental option  ;)

        Treinamentos de Elite: http://sys-squad.com

        Help a community developer! ;D

        1 Reply Last reply Reply Quote 0
        • Q
          qbik
          last edited by

          Thank you for this information!

          1 Reply Last reply Reply Quote 0
          • N
            Nachtfalke
            last edited by

            Updates pkg v1.6.6_3:

            • Fixes: accounting scripts and small updates on the documentation. More infos in this thread:
              http://forum.pfsense.org/index.php/topic,48404.0.html

            Known bugs:

            • When using "stop/start accounting on CP then "Amount of Time/Amount of Traffic" isn't working correctly.
              http://redmine.pfsense.org/issues/2164

            • When using CP + RADIUS + Vouchers and "reauthenticate every minute" is enabled then CP sends the voucher as username to RADIUS. This causes RADIUS to disconnect the "user/voucher" because of an unknown/wrong "username".
              http://redmine.pfsense.org/issues/2155

            • When stop/start accounting on CP is enabled than the syslog shows many "wrong order" or "Login found bot no logout detected". This seems to not affect the usage of RADIUS but it is not 100% correct.
              http://redmine.pfsense.org/issues/2143

            1 Reply Last reply Reply Quote 0
            • Q
              qbik
              last edited by

              Hi,
              I want to do some test with DHCP on freeradius, I have a virtual machine where freeradius has DHCP enabled. I wanted to know if there is a way I can tell your package on installation to fetch my package file (from my server) and all dependencies will be treated as normal (from your server).

              Thanks

              1 Reply Last reply Reply Quote 0
              • marcellocM
                marcelloc
                last edited by

                @qbik:

                Hi,
                I want to do some test with DHCP on freeradius, I have a virtual machine where freeradius has DHCP enabled. I wanted to know if there is a way I can tell your package on installation to fetch my package file (from my server) and all dependencies will be treated as normal (from your server).

                Thanks

                No. what you can do is install freeradius2 package and then at console/ssh replace freeradius2 with your build using pkg_delete and pkg_add -r

                Treinamentos de Elite: http://sys-squad.com

                Help a community developer! ;D

                1 Reply Last reply Reply Quote 0
                • Q
                  qbik
                  last edited by

                  Thank you, this worked.

                  1 Reply Last reply Reply Quote 0
                  • marcellocM
                    marcelloc
                    last edited by

                    @qbik:

                    Thank you, this worked.

                    You can also report what features you enabled and how it improved your setup.

                    Treinamentos de Elite: http://sys-squad.com

                    Help a community developer! ;D

                    1 Reply Last reply Reply Quote 0
                    • N
                      Nachtfalke
                      last edited by

                      @marcelloc:

                      @qbik:

                      Thank you, this worked.

                      You can also report what features you enabled and how it improved your setup.

                      And which files you need to configure so we can think about building a GUI for that if possible :-)

                      1 Reply Last reply Reply Quote 0
                      • M
                        markuhde
                        last edited by

                        Is there a timeline for when this package will be updated to work with 2.1-DEVELOPMENT? Unfortunately, I need 2.1 for a client's system since their NIC isn't supported in 2.0.1 (RealTek 8111e), and I'm trying to get FreeRADIUS working so I can use WPA2-Enterprise. Thanks!

                        1 Reply Last reply Reply Quote 0
                        • marcellocM
                          marcelloc
                          last edited by

                          @markuhde:

                          Is there a timeline for when this package will be updated to work with 2.1-DEVELOPMENT? Unfortunately, I need 2.1 for a client's system since their NIC isn't supported in 2.0.1 (RealTek 8111e), and I'm trying to get FreeRADIUS working so I can use WPA2-Enterprise. Thanks!

                          after installing gui, did you tried to install binaries on console?

                          these posts maybe usefull for amd64 installs
                          http://forum.pfsense.org/index.php/topic,43675.msg231974.html#msg231974
                          http://forum.pfsense.org/index.php/topic,43675.msg232046.html#msg232046
                          http://forum.pfsense.org/index.php/topic,43675.msg232220.html#msg232220
                          http://forum.pfsense.org/index.php/topic,43675.msg232064.html#msg232064

                          Treinamentos de Elite: http://sys-squad.com

                          Help a community developer! ;D

                          1 Reply Last reply Reply Quote 0
                          • M
                            markuhde
                            last edited by

                            It's an i386 install, because the graphics chipset (Intel Atom D2700) doesn't work properly in FreeBSD AMD64 (heck, it doesn't TOTALLY work properly in i386 there are missing characters, and amazingly, it doesn't even work in Windows 7 64-bit - there are no drivers from Intel).

                            Sorry if I missed this but I'm not seeing it, if you still think it'd help, how would I go about reinstalling from the terminal then?

                            1 Reply Last reply Reply Quote 0
                            • marcellocM
                              marcelloc
                              last edited by

                              @markuhde:

                              Sorry if I missed this but I'm not seeing it, if you still think it'd help, how would I go about reinstalling from the terminal then?

                              Maybe the package has installed missing libs, put as whe do not have .pbi package for freeradius2, you need to enable ssh/go to console and type

                              pkg_add -r http://e-sac.siteseguro.ws/packages/8/All/freeradius-2.1.12.tbz
                              pkg_add -r http://e-sac.siteseguro.ws/packages/8/All/openldap-sasl-client-2.4.26.tbz

                              Treinamentos de Elite: http://sys-squad.com

                              Help a community developer! ;D

                              1 Reply Last reply Reply Quote 0
                              • M
                                markuhde
                                last edited by

                                Thank you! I'll try it out ASAP. Will this work through a firmware upgrade from the GUI or will it need to be re-done every time a new snapshot is loaded?

                                1 Reply Last reply Reply Quote 0
                                • marcellocM
                                  marcelloc
                                  last edited by

                                  @markuhde:

                                  Thank you! I'll try it out ASAP. Will this work through a firmware upgrade from the GUI or will it need to be re-done every time a new snapshot is loaded?

                                  Every firmware update, all packages are reinstalled, so I think you need to do this too.

                                  Treinamentos de Elite: http://sys-squad.com

                                  Help a community developer! ;D

                                  1 Reply Last reply Reply Quote 0
                                  • M
                                    markuhde
                                    last edited by

                                    Okay, thanks. It'll probably be Monday morning when I'm up at the campground where this install is, and I'll give it a whirl. Do a firmware update, then try to get FreeRADIUS and WPA2-Enterprise up and running there.

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      markuhde
                                      last edited by

                                      Tried that, didn't do the trick, freeRADIUS 2 still won't start on 2.1 development.

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        markuhde
                                        last edited by

                                        Here's the result of my attempt to start it from SSH in debugging mode. Any help would be great I'd LOVE to get this thing running and I appreciate it a ton!:

                                        
[2.1-DEVELOPMENT][admin@glacierfire.glaciercamp]/root(3): radiusd -X
FreeRADIUS Version 2.1.12, for host i386-portbld-freebsd8.1, built on Jan  3 2012 at 23:44:16
Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. 
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A 
PARTICULAR PURPOSE. 
You may redistribute copies of FreeRADIUS under the terms of the 
GNU General Public License v2\. 
Starting - reading configuration files ...
including configuration file /usr/local/etc/raddb/radiusd.conf
including configuration file /usr/local/etc/raddb/clients.conf
including files in directory /usr/local/etc/raddb/modules/
including configuration file /usr/local/etc/raddb/modules/wimax
including configuration file /usr/local/etc/raddb/modules/always
including configuration file /usr/local/etc/raddb/modules/attr_filter
including configuration file /usr/local/etc/raddb/modules/attr_rewrite
including configuration file /usr/local/etc/raddb/modules/chap
including configuration file /usr/local/etc/raddb/modules/checkval
including configuration file /usr/local/etc/raddb/modules/counter
including configuration file /usr/local/etc/raddb/modules/cui
including configuration file /usr/local/etc/raddb/modules/detail
including configuration file /usr/local/etc/raddb/modules/detail.example.com
including configuration file /usr/local/etc/raddb/modules/detail.log
including configuration file /usr/local/etc/raddb/modules/digest
including configuration file /usr/local/etc/raddb/modules/dynamic_clients
including configuration file /usr/local/etc/raddb/modules/echo
including configuration file /usr/local/etc/raddb/modules/etc_group
including configuration file /usr/local/etc/raddb/modules/exec
including configuration file /usr/local/etc/raddb/modules/expiration
including configuration file /usr/local/etc/raddb/modules/expr
including configuration file /usr/local/etc/raddb/modules/files
including configuration file /usr/local/etc/raddb/modules/inner-eap
including configuration file /usr/local/etc/raddb/modules/ippool
including configuration file /usr/local/etc/raddb/modules/krb5
including configuration file /usr/local/etc/raddb/modules/ldap
including configuration file /usr/local/etc/raddb/modules/linelog
including configuration file /usr/local/etc/raddb/modules/logintime
including configuration file /usr/local/etc/raddb/modules/mac2ip
including configuration file /usr/local/etc/raddb/modules/mschap
including configuration file /usr/local/etc/raddb/modules/mac2vlan
including configuration file /usr/local/etc/raddb/modules/ntlm_auth
including configuration file /usr/local/etc/raddb/modules/opendirectory
including configuration file /usr/local/etc/raddb/modules/otp
including configuration file /usr/local/etc/raddb/modules/pam
including configuration file /usr/local/etc/raddb/modules/pap
including configuration file /usr/local/etc/raddb/modules/passwd
including configuration file /usr/local/etc/raddb/modules/perl
including configuration file /usr/local/etc/raddb/modules/policy
including configuration file /usr/local/etc/raddb/modules/preprocess
including configuration file /usr/local/etc/raddb/modules/radutmp
including configuration file /usr/local/etc/raddb/modules/realm
including configuration file /usr/local/etc/raddb/modules/redis
including configuration file /usr/local/etc/raddb/modules/rediswho
including configuration file /usr/local/etc/raddb/modules/replicate
including configuration file /usr/local/etc/raddb/modules/smbpasswd
including configuration file /usr/local/etc/raddb/modules/smsotp
including configuration file /usr/local/etc/raddb/modules/soh
including configuration file /usr/local/etc/raddb/modules/sql_log
including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login
including configuration file /usr/local/etc/raddb/modules/sradutmp
including configuration file /usr/local/etc/raddb/modules/unix
including configuration file /usr/local/etc/raddb/modules/acct_unique
including configuration file /usr/local/etc/raddb/eap.conf
including configuration file /usr/local/etc/raddb/policy.conf
including files in directory /usr/local/etc/raddb/sites-enabled/
including configuration file /usr/local/etc/raddb/sites-enabled/control-socket
including configuration file /usr/local/etc/raddb/sites-enabled/default
including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel
main {
	allow_core_dumps = no
}
including dictionary file /usr/local/etc/raddb/dictionary
main {
	name = "radiusd"
	prefix = "/usr/local"
	localstatedir = "/var"
	sbindir = "/usr/local/sbin"
	logdir = "/var/log"
	run_dir = "/var/run"
	libdir = "/usr/local/lib/freeradius-2.1.12"
	radacctdir = "/var/log/radacct"
	hostname_lookups = no
	max_request_time = 30
	cleanup_delay = 5
	max_requests = 2048
	pidfile = "/var/run/radiusd.pid"
	checkrad = "/usr/local/sbin/checkrad"
	debug_level = 0
	proxy_requests = yes
 log {
	stripped_names = no
	auth = no
	auth_badpass = no
	auth_goodpass = no
	msg_badpass = ""
	msg_goodpass = ""
 }
 security {
	max_attributes = 200
	reject_delay = 1
	status_server = no
 }
}
radiusd: #### Loading Realms and Home Servers ####
radiusd: #### Loading Clients ####
 client teakettle2 {
	ipaddr = 192.168.10.2
	require_message_authenticator = no
	secret = "mqh6rWnxbTkgQkVn"
	shortname = "teakettle2"
	nastype = "other"
 }
 client cafeteria {
	ipaddr = 192.168.10.3
	require_message_authenticator = no
	secret = "8UmEX8Xr6sRz64R4"
	shortname = "cafeteria"
	nastype = "other"
 }
 client lodgelobby {
	ipaddr = 192.168.10.4
	require_message_authenticator = no
	secret = "5TEEQULqqTB49bYc"
	shortname = "lodgelobby"
	nastype = "other"
 }
 client conferenceroom {
	ipaddr = 192.168.10.5
	require_message_authenticator = no
	secret = "5vQTATZSLBGqKNhx"
	shortname = "conferenceroom"
	nastype = "other"
 }
 client sector1 {
	ipaddr = 192.168.10.6
	require_message_authenticator = no
	secret = "LgVKSbJ6eRcwdJzU"
	shortname = "sector1"
	nastype = "other"
 }
 client sector2 {
	ipaddr = 192.168.10.7
	require_message_authenticator = no
	secret = "aHfBaTuxytqLKXFG"
	shortname = "sector2"
	nastype = "other"
 }
radiusd: #### Instantiating modules ####
 instantiate {
 Module: Linked to module rlm_exec
 Module: Instantiating module "exec" from file /usr/local/etc/raddb/modules/exec
  exec {
	wait = no
	input_pairs = "request"
	shell_escape = yes
  }
 Module: Linked to module rlm_expr
 Module: Instantiating module "expr" from file /usr/local/etc/raddb/modules/expr
 Module: Linked to module rlm_counter
 Module: Instantiating module "daily" from file /usr/local/etc/raddb/modules/counter
  counter daily {
	filename = "/usr/local/etc/raddb/db.daily"
	key = "User-Name"
	reset = "daily"
	count-attribute = "Acct-Session-Time"
	counter-name = "Daily-Session-Time"
	check-name = "Max-Daily-Session"
	reply-name = "Session-Timeout"
	allowed-servicetype = "Framed-User"
	cache-size = 5000
  }
rlm_counter: Counter attribute Daily-Session-Time is number 11273
rlm_counter: Current Time: 1337493979 [2012-05-20 00:06:19], Next reset 1337580000 [2012-05-21 00:00:00]
ERROR: Cannot find a configuration entry for module "weekly".
                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          markuhde
                                          last edited by

                                          **IGNORE ALL OF THIS - it didn't survive a reboot. The package must try to repair itself or something, I'm back to the error above about the module weekly…

                                          P.P.S. I know I'm mostly talking to myself at this point but the magic final edit was hashtagging out weekly, monthly, and forever in freeradius.inc since it turns out that's where radiusd.conf is loaded from. Now, to figure out if whatever I broke to get FreeRADIUS to start is so severe that it won't work for my needs (which are fairly minimal, authenticate a few users who will stay around all the time, and have the ability to add/remove temporary users as needed).**

                                          I think I got it running. I dunno what I broke in the process but first thing I tried was adding the "weekly, monthly, and forever" entries from my working 2.0.2-RC1's version of "/usr/local/etc/raddb/modules/counter" since those were missing. That did NO good. Changed nothing. So instead I hashtagged out weekly monthly and forever from radiusd.conf. Then on an error related to MOTP, so I edited the file "default" that contained MOTP references to hashtag that out. Then I halted on more errors about daily (yes, daily too this time), weekly, monthly, and forever so I hashtagged out a all those references in default and it starts!

                                          I know I broke something in the process. I also know that I have no idea WHAT I BROKE, and I randomly hashtagged things out. The server starts but who knows if it'll work for what I want (WPA2-Enterprise). I'll find out Monday when I'm up there if I can connect to the private network I'm setting up now.

                                          Anyone got any insight into what I broke? LOL

                                          1 Reply Last reply Reply Quote 0
                                          • N
                                            Nachtfalke
                                            last edited by

                                            I did the GUI for that package. What you broke is nothing important for you. So no problem.
                                            The counter files will be installed on package installation process. If you do not need the counters that will be no problem for you. Uncommenting this in "default" is no problem.

                                            The same for MOTP. this a is one time password feature - you probably do not need this for your environment. :)

                                            I posted on the dev mailing list and we will see what is happening for pfsense 2.1 :)
                                            http://lists.pfsense.org/pipermail/dev/2012-May/000176.html

                                            PS: If you have the time to do so, you can do the following:
                                            copy and execute the code on pfsense GUI -> Diagnostics -> Command prompt -> PHP execute
                                            Just copy the lines below - this will probably create all your missing files.

                                            
require_once("freeradius.inc");
freeradius_dictionary_resync();
freeradius_modulesmotp_resync();
freeradius_modulesdatacounter_resync();
freeradius_datacounter_acct_resync();
freeradius_datacounter_auth_resync();
freeradius_modulescounter_resync();
                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post