NEW Package: freeRADIUS 2.x

Nachtfalke

Can you run freeradius in debug mode and try again.
Configure everything on GUI, save and the stop the radiusd service on the GUI.

after that go to the pfsense console and type:

radiusd -X

Then try to authenticate a user and check the output of freeradius. It probably tells you what you have to do or what is not correct.

Or perhaps you are using a password which is using special characters which are not allowed. Try a simple password first.
Or the firewall rules on the xampp server do not allow traffic from pfsense - check this and disable all firewall rules.

red2006

Thank you very much for a fast reply on my inquiry.

i tried stopping the radius service on GUI and on console,
but i get the FAILED to connect to any sql server message of radiusd -X syntax.

attached are my configurations for

SQL in freeradius

Captive Portal

security setting on my xampp server

and the error message on the radiusd -X

maybe i miss something on the configuration but i just followed the instructions on this thread

Thank you very very much…

Nachtfalke

Hi,

your CP configuration looks wired. The authentication port for radius is 3306 - which is your sql port !? This looks strange.

To make clear the way how freeradius is working:

Freeradius has a listening port for authentication and if you need an accounting port
You must configure the ports on the "interfaces" tab of freeradius
The CP must connect to the listening ports of freeradius.

CP does not connect directly to the mysql database - it connects to freeradius and freeradius decides if to send the request to mysql or somewhere else.

In general the authentication port for freeradius is 1812 and the accounting port is 1813
and these two ports are important for the CP.

red2006

hello Nachtfalke,

and thank you very much for your patience…

i change my port on my captive portal config to 1812

but still same error appears on radiusd -X on console

rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked
rlm_sql (sql): Attempting to connect to radius@192.168.1.7:3306/radius
rlm_sql (sql): starting 0
rlm_sql (sql): Attempting to connect rlm_sql_mysql #0
rlm_sql_mysql: Starting connect to MySQL server for #0
rlm_sql_mysql: Couldn't connect socket to MySQL server radius@192.168.1.7:radius
rlm_sql_mysql: Mysql error 'Can't connect to MySQL server on '192.168.1.7' (60)'
rlm_sql (sql): Failed to connect DB handle #0
rlm_sql (sql): starting 1
rlm_sql (sql): starting 2
rlm_sql (sql): starting 3
rlm_sql (sql): starting 4
rlm_sql (sql): Failed to connect to any SQL server.
rlm_sql (sql): Processing generate_sql_clients
rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas
rlm_sql (sql): Ignoring unconnected handle 4..
rlm_sql (sql): Ignoring unconnected handle 3..
rlm_sql (sql): Ignoring unconnected handle 2..
rlm_sql (sql): Ignoring unconnected handle 1..
rlm_sql (sql): Ignoring unconnected handle 0..
rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 0
Failed to load clients from SQL.
rlm_sql (sql): Closing sqlsocket 4
rlm_sql (sql): Closing sqlsocket 3
rlm_sql (sql): Closing sqlsocket 2
rlm_sql (sql): Closing sqlsocket 1
rlm_sql (sql): Closing sqlsocket 0
/usr/local/etc/raddb/sql.conf[2]: Instantiation failed for module "sql"
/usr/local/etc/raddb/sites-enabled/default[185]: Failed to load module "sql".
/usr/local/etc/raddb/sites-enabled/default[185]: Failed to parse "sql" entry.
/usr/local/etc/raddb/sites-enabled/default[69]: Errors parsing authorize section.

i attached my

nas/clients configuration here

and my interfaces configuration.

thank you very much for your patience Nachtfalke.

-red

nas.jpg_thumb

interfaces.jpg_thumb

DestekTeknik

Dear Fellas,

I've terribly noticed that, on my system, when accounting update mode from CP is selected as Start/Stop "Accounting", FreeRadius is counting triple times the actual value from time to time.

I mean I tested it with a 20 mi Forever account, and it killed the user at exactly 20 min later. But after that, the clients I've created, ended up so quickly, so I do a radtest check simultaniously with a client, and saw that, every 60 seconds, around 180 seconds are counted.

The only difference is the deadline date that I've given to the other accounts. They are also selected as Forever.

Any ideas?

DestekTeknik

One more question,

Which WebGUI are you using to manage freeRadius on a MySQL backend?

Nachtfalke

@red2006

Interfaces looks ok.

NAS/Clients:
You do not need to add the mysql server as a client. A client is only a sqitch, or an access point or the CP.
So it is not "mistake" to add the mysql server but it has no benefit :-)

I am no mysql expert but you should check the password of the mysql database and the user which has access to the database. the username and password must be entered on the freeradius -> SQL GUI.
Make sure that you chose the correct username and password.

There is nothing more I could tell you - I didn't connect freeradius to any sql database. Perhaps double check that the database name and tables are correct or perhaps contact user zlyzwy by PM.

@DestekTeknik
pfsense 2.0.1 has some problems with accounting. can you try with 2.0.2 and/or 2.1 ? There were some bugfixes on CP and accounting.
But if I remember correct there are some other threads on the forum which are telling a similar problem that yours.

You tested time quota, right ?
This should be implemented well in freeradius because it comes directly from the freeradius developers. So the problem probably lies in the CP code.
the traffic quota is just using some shell scripts which do the accounting. So it could be possible that there is something wrong.

Did you check the pfsense doc ?
http://doc.pfsense.org/index.php/FreeRADIUS_2.x_package

DestekTeknik

Yes I've tested the time quota, and I don't need the traffic quota.

I haven't tested on 2.1 cause I need a stable platform for this at the moment, and don't know how to get to 2.0.2 either…

I've read the documentation, and selected start/stop accounting setting based on the documentation, but at the moment, it is selected as interim update-not working as it should-but at least, updates the correct time when the user logouts. So no automated system to kick the user when the time is finished, just the hard logout time setting from the CP.

Do you prefer any WebGui's for the mysql management of freeradius? I'm looking into dialup-admin, but I believe they are both pointing to different table schema's so I have no idea if they work together.

Nachtfalke

I do not use any mysql database so do not use any GUI for that ;)
Other people are talking about "daloradius" but this seems to be more a complete product than just only a GUI.

DestekTeknik

daloradius-I am standing away from it at the moment, cause it is giving me headaches for the last year :)

anyway I'm dealing with dialup admin at the moment, if any of us is using it, a how-to guide will be appreciated :)

DestekTeknik

Hello folks,

I desperately need of a permanent file change in the default site file. I'm currently adding the only line I need via the edit file option of pfSense WebGUI, but the file reverts back to original after reboot. The line I add is "noresetcounter" under sql part.

Strange thing is, I also ad an attribute about Max-All-Session to the dictionary file, but that file stays the same after every reboot.

Does anyone have any ideas about this situation?

Nachtfalke

@DestekTeknik:

Hello folks,

I desperately need of a permanent file change in the default site file. I'm currently adding the only line I need via the edit file option of pfSense WebGUI, but the file reverts back to original after reboot. The line I add is "noresetcounter" under sql part.

Strange thing is, I also ad an attribute about Max-All-Session to the dictionary file, but that file stays the same after every reboot.

Does anyone have any ideas about this situation?

You need to modify the /usr/local/pkg/freeradius.inc file.

The dictionary file will be modified in this function:
freeradius_dictionary_resync()

Not sure where you did the sql changes.

DestekTeknik

@Nachtfalke:

@DestekTeknik:

Hello folks,

I desperately need of a permanent file change in the default site file. I'm currently adding the only line I need via the edit file option of pfSense WebGUI, but the file reverts back to original after reboot. The line I add is "noresetcounter" under sql part.

Strange thing is, I also ad an attribute about Max-All-Session to the dictionary file, but that file stays the same after every reboot.

Does anyone have any ideas about this situation?

You need to modify the /usr/local/pkg/freeradius.inc file.

The dictionary file will be modified in this function:
freeradius_dictionary_resync()

Not sure where you did the sql changes.

I've no problem with the changes that I've made to the dictionary file. They stay the same after the reboot.

I'm just adding a line saying "noresetcounter" to the /raddb/sites-available/default file, and this line is gone after the reboot.
I don't know how to make a change via the freeradius.inc file.
I've tried using Filer package, but because it starts after freeradius starts, It changes the file while freeradius is running, and this makes no difference for the first run. I have to restart the service manually to make it happen.

Can you suggest a solution to this?

the lines of default file look like after changing:

#  See "Authorization Queries" in sql.conf

         redundant {
			sql
			### sql2 DISABLED ###
	}
        noresetcounter ## I just add this line ##
#

Nachtfalke

Open the file /usr/local/pkg/freeradius.inc with an editor like vi.
Best way to connect to your pfsense using SSH and use the console. Type:


vi /usr/local/pkg/freeradius.inc

scroll down to the line 1232
There starts the function "freeradius_serverdefault_resync ()"
This function creates the ../sites-enabled/default file.
Starting from line 1396 to 2066 this is what is the part you need to change.

red2006

@red2006

Interfaces looks ok.

NAS/Clients:
You do not need to add the mysql server as a client. A client is only a sqitch, or an access point or the CP.
So it is not "mistake" to add the mysql server but it has no benefit :-)

I am no mysql expert but you should check the password of the mysql database and the user which has access to the database. the username and password must be entered on the freeradius -> SQL GUI.
Make sure that you chose the correct username and password.

There is nothing more I could tell you - I didn't connect freeradius to any sql database. Perhaps double check that the database name and tables are correct or perhaps contact user zlyzwy by PM.

Hi Nachtfalke,

never rily got a chance to hear from zlyzwy through PM

but, ive finally got a way to connect to my mysql dbase using sql feature of freeradius
everything in my configuration was correct except for one thing.

the "read clients from database" selection must be set to NO it is yes by default

and it connected succesfully with my xampp server mysql database.

but is till have a problem.

ive added users on my radcheck table on my mysql dbase.

but i always get the rejection on radius on user authentication.
what is missing on my data?
and am i correct that the radcheck table is the users table for user authentication.

Thank you very much Nachtfalke.

Good Day to everybody.

Nachtfalke

radcheck seems to be the correct place for username and password.

radiusd -X will tell you what is missng or wrong. Run freeradius in this mode and read all the output. On some line you will see that freeradius will check for a username and then you can see what is missing, wrong or what happened.

myke

Hello everyone,

I have 2 questions :
I want to use Freeradius 2 for certificates for TLS.
But when i export client P.12 on my mobility controller, it tells me the password isn't valid.

There is a bug or what i'm doing wrong?

So i decided to convert my certificat with openssl and it's okay when i'm exporting but i've got a error radius when i'm logging:
"Error: TLS Alert read:fatal:unknown CA
Thu Nov 22 17:57:49 2012 : Error: TLS_accept: failed in SSLv3 read client certificate A
Thu Nov 22 17:57:49 2012 : Error: rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca"

This means there is a problem with the certificat but i can't find the solution…

Thanks for the help.
Best regards.

Nachtfalke

In general you should create your CA ander server cert on pfsene Cert Manager.
then select these two certificates on freeradius -> EAP and save.

Client certificates can be build on pfsense Cert Manager and export the .p12 file. This should work and the .p12 file should be without any password. can you try with an empty password ? But this is more a "pfsense" problem than a freeradius problem.

I am not sure but if I remember correct there was another thread here in the forum which is about the .p12 file and a password. Perhaps the search function can help you.

myke

@Nachtfalke:

In general you should create your CA ander server cert on pfsene Cert Manager.
then select these two certificates on freeradius -> EAP and save.

Client certificates can be build on pfsense Cert Manager and export the .p12 file. This should work and the .p12 file should be without any password. can you try with an empty password ? But this is more a "pfsense" problem than a freeradius problem.

I am not sure but if I remember correct there was another thread here in the forum which is about the .p12 file and a password. Perhaps the search function can help you.

Thanks for the answer.

My Certificate Authority and certificate was created in pfsense Cert manager. I just created .pfx with openssl.
In first time i try with an empty password and second time with a password "pfsense" but exactly the same result.

I use pfsense 2.0.1 AMD release.

Myke.

red2006

@Nachtfalke

Hello…

ive encountered 2 problems with my pfsense+captiveportal+freeradius
im currently testing the configuration before i test my sql component.

idont know if youve already encountered this and ive seen some posts here on the forum but never rily got the chance to have the solution.

first: MAX-DAILY-USAGE time...

currently i have 50 users on my freeradius2 users tab
with different max time on daily basis
but the problem is...
if one of the users got the maximum daily usage time...
all of the users also maxed out of their daily time even if they've just going to log in for the first time of the day.

i understand that the other threads have problem on max-daily-usage time on not resetting the counter/session to zero(0) so that the next day they'll have a fresh acct with a fresh daily time usage.

so how can i reset the session/counter of the max-daily-usage so that i dont have to create another acct for all of users all over again.

and how would i resolve the all users maxed out of their time when one(1) user consumed all of his/her time in a day.

Second(2) - WebGUI slow process

i am experiencing a slow process on the webGUI of pfsense...
what could be the problem?
i didnt change anything on my configuration nor installed additional packages.
but it takes at leat 3 mins to go to another page on my webGUI of pfsense.

ive already restarted pfsense.
check all my network connectivity and work all fine.

but still have the super slow process on the webGUI even if just clikcing or navigating to the pages of the webGUI...

hope you can help me with this Nachtfalke.

Tahnk you very very much.