Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    NEW Package: freeRADIUS 2.x

    pfSense Packages
    80
    628
    345190
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      Nachtfalke last edited by

      @pszafer:

      hello, I have PAP fully working (wpa_suplicant get connected to wlan), no lucky with any EAP.
      I'm thinking and want to have your opinion, what is better:

      • MS-CHAPv2?
      • certificates?
      • both?

      is it possible to get certificates auth working via Kerberos?
      I'm thinking I'm misunderstaning how this certificates working ;)

      Hi,

      To use PEAP (Protected EAP) with MSCHAPv2 is workinh using MAC OS X, Ubuntu, Android, Windows XP (I tested this today).
      To configure that you don't have to change anything on freeradius2 EAP. Just add a user with username an password.

      On WLAN-AP (I used DD-WRT) you have to enable WPA Enterprise or WPA2 Enterprise. Then you have to enter th IP of the RADIUS server and the shared secret.
      The IP of the WLAN AP and the shared secret you have to enter on freeradius NAS/Clients.

      On the client you can should then choose PEAP and MSCHAPv2. You will be prompted to accept the CA-Certificate of the freeradius server.
      Than you will be prompted for a username and password - thats the one you entered in freeradius2 users.

      Than all should work. But this is only authorization with username/password. It is NOT TLS or TTLS. TLS means, that the client-certificate (client on your WLAN PC) hast to be valid with the CA on the freeradius server. I didn't get this work today, but I think there are some options on freeradius2 EAP GUI missing. I will check this.

      The most secure thing would be to use certificates and username/password together.
      If the username/password combination isn't to easy then I don't think that there is a big difference between using ONLY certs or ONLY user/pw.

      PS: Check the pfsense docs for "FreeRADIUS 2.x package" - there are two documentations with screenshots. Perhaps this will help you. One is in german but really good screenshots.

      And I will check additional options in EAP pulldown menues like MD5, TLS, TTLS and so on. But the freeradius configuration is rare configuration hints…as far as I could see this.

      Any news on LDAP + AD ?
      What/where do you mean to use "Kerberos auth with certificates" ?

      1 Reply Last reply Reply Quote 0
      • P
        pszafer last edited by

        ok, it's simplier that I thought.
        Because I wanna to my AD Win Server 2008 to be CA, but I can just copy CA certificate to the pfSense freeradius, so nevermind about kerberos and certs ;)

        I'll try to test everything you suggested as soon as possible, but it could be monday or tuesday because I had some new PC's in work and it would take some time to configure them

        1 Reply Last reply Reply Quote 0
        • N
          Nachtfalke last edited by

          @pszafer:

          ok, it's simplier that I thought.
          Because I wanna to my AD Win Server 2008 to be CA, but I can just copy CA certificate to the pfSense freeradius, so nevermind about kerberos and certs ;)

          I'll try to test everything you suggested as soon as possible, but it could be monday or tuesday because I had some new PC's in work and it would take some time to configure them

          Hey, no stress :D

          Your feedback is great and testing is good :D
          All what we could test and what is working will be put into the pfsense docs.
          Perhaps in the next week I will find some time to try with my colleague (linuy geek) to setup MySQL and OpenLDAP ans test both with freeradius2.

          Further I will add some new EAP types to the package.

          1 Reply Last reply Reply Quote 0
          • N
            Nachtfalke last edited by

            Updates pkg v1.5.1

            • Added: additional eap.conf options (fragment size, include_length, enable cache)

            • Added: More authentication protocls and methods based on the follwoing links:
              http://hostap.epitest.fi/wpa_supplicant/
              http://freeradius.org/features/eap.html

            1 Reply Last reply Reply Quote 0
            • Z
              zlyzwy last edited by

              Hi,

              Anyone use SQL function? Does it work now?

              I tried it here,but it's still not working but I did see a lot of new options.

              One more question, is there any log I can analyse what's wrong with SQL? I checked with system log and /var/log/radius.log. There is no information.

              Many thanks for your great work!

              ZLYZWY

              1 Reply Last reply Reply Quote 0
              • N
                Nachtfalke last edited by

                @zlyzwy:

                Hi,

                Anyone use SQL function? Does it work now?

                I tried it here,but it's still not working but I did see a lot of new options.

                One more question, is there any log I can analyse what's wrong with SQL? I checked with system log and /var/log/radius.log. There is no information.

                Many thanks for your great work!

                ZLYZWY

                Hi zlyzwy,

                MySQL and PostgreSQL should work. FreeRADIUS is compiled with these modules and the bug with the missing lib after areboot should be fixed (only MySQL). Of course, if you enable SQL but FreeRADIUS could not connect to the database, the service fails and freeradius stops. MySQL connection error is displayed fast. PostgreSQL takes ~30-60s to fail - if not connectable to a database.
                If you want to debug output of RADIUS and SQL, then do all the configs from GUI and after you did that, stop the service, connect with SSH to your pfsense and then type:

                radiusd -X
                

                This is debugging mode. There you will get all output. You can post it here if neccessary. Perhaps we can help.

                1 Reply Last reply Reply Quote 0
                • Z
                  zlyzwy last edited by

                  Hi Nachtfalke,

                  Really thanks for such a quick reply~~

                  here is the output for debug:

                  # radiusd -X
                  FreeRADIUS Version 2.1.12, for host i386-portbld-freebsd8.1, built on Jan  3 201                                                                              2 at 23:44:16
                  Copyright (C) 1999-2009 The FreeRADIUS server project and contributors.
                  There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
                  PARTICULAR PURPOSE.
                  You may redistribute copies of FreeRADIUS under the terms of the
                  GNU General Public License v2.
                  Starting - reading configuration files ...
                  including configuration file /usr/local/etc/raddb/radiusd.conf
                  including configuration file /usr/local/etc/raddb/clients.conf
                  /usr/local/etc/raddb/clients.conf[2]: Expecting section start brace '{' after "c                                                                              lient PF"
                  Errors reading /usr/local/etc/raddb/radiusd.conf
                  
                  

                  Can you help to analyse the error?

                  UPDATE
                  I can read sql.conf file from web interface. here is the output:

                  /usr/local/etc/raddb/sql.conf
                  
                  sql {
                  	database = "mysql"
                  	driver = "rlm_sql_${database}"
                  	server = "IP"
                  	port = 3306
                  	login = "xxx"
                  	password = "XXX"
                  	radius_db = "radius"
                  	acct_table1 = "radacct"
                  	acct_table2 = "radacct"
                  	postauth_table = "radpostauth"
                  	authcheck_table = "radcheck"
                  	authreply_table = "radreply"
                  	groupcheck_table = "radgroupcheck"
                  	groupreply_table = "radgroupreply"
                  	usergroup_table = "radusergroup"
                  	read_groups = yes
                  	deletestalesessions = yes
                  	sqltrace = yes
                  	sqltracefile = ${logdir}/sqltrace.sql
                  	num_sql_socks = 5
                  	connect_failure_retry_delay = 60
                  	lifetime = 0
                  	max_queries = 0
                  	readclients = yes
                  	nas_table = "nas"
                  	$INCLUDE sql/${database}/dialup.conf
                  }
                  
                  sql sql2 {
                  	database = "mysql"
                  	driver = "rlm_sql_${database}"
                  	server = "localhost"
                  	port = 3306
                  	login = "radius"
                  	password = "radpass"
                  	radius_db = "radius"
                  	acct_table1 = "radacct"
                  	acct_table2 = "radacct"
                  	postauth_table = "radpostauth"
                  	authcheck_table = "radcheck"
                  	authreply_table = "radreply"
                  	groupcheck_table = "radgroupcheck"
                  	groupreply_table = "radgroupreply"
                  	usergroup_table = "radusergroup"
                  	read_groups = yes
                  	deletestalesessions = yes
                  	sqltrace = no
                  	sqltracefile = ${logdir}/sqltrace.sql
                  	num_sql_socks = 5
                  	connect_failure_retry_delay = 60
                  	lifetime = 0
                  	max_queries = 0
                  	readclients = yes
                  	nas_table = "nas"
                  	$INCLUDE sql/${database}/dialup.conf
                  }
                  
                  

                  I create a database in MySQL named "radius". That's all my settings.
                  Should I create the tables first, if yes, then what's the structure of these tables?

                  1 Reply Last reply Reply Quote 0
                  • S
                    sandern last edited by

                    @Nachtfalke:

                    On the client you can should then choose PEAP and MSCHAPv2. You will be prompted to accept the CA-Certificate of the freeradius server.
                    Than you will be prompted for a username and password - thats the one you entered in freeradius2 users.

                    Thats fine for non-domain computers but as the network link isn't established before logon, network scripts can't be executed nor 'll they be able to logon.

                    1 Reply Last reply Reply Quote 0
                    • N
                      Nachtfalke last edited by

                      @sandern:

                      @Nachtfalke:

                      On the client you can should then choose PEAP and MSCHAPv2. You will be prompted to accept the CA-Certificate of the freeradius server.
                      Than you will be prompted for a username and password - thats the one you entered in freeradius2 users.

                      Thats fine for non-domain computers but as the network link isn't established before logon, network scripts can't be executed nor 'll they be able to logon.

                      Then you have to create a "Computer logon" which will be executed before user logon:
                      http://pcloadletter.co.uk/2011/07/11/cisco-wifi-active-directory-auth/

                      1 Reply Last reply Reply Quote 0
                      • Z
                        zlyzwy last edited by

                        I downloaded the FreeRadius's package and there are some *.sql for mysql. I run the script and it did create some tables.

                        About the error can't export the debug info, I solve it by re-install the package.
                        Then I run the debug again, here is the info about SQL.
                        (Full log here:http://pastebin.com/rSi3xWra)

                         Module: Linked to module rlm_sql
                         Module: Instantiating module "sql" from file /usr/local/etc/raddb/sql.conf
                          sql {
                                driver = "rlm_sql_mysql"
                                server = "192.168.1.25"
                                port = "3306"
                                login = "radius"
                                password = "radpass"
                                radius_db = "radius"
                                read_groups = yes
                                sqltrace = yes
                                sqltracefile = "/var/log/sqltrace.sql"
                                readclients = yes
                                deletestalesessions = yes
                                num_sql_socks = 5
                                lifetime = 0
                                max_queries = 0
                                sql_user_name = "%{User-Name}"
                                default_user_profile = ""
                                nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas"
                                authorize_check_query = "SELECT id, username, attribute, value, op           FROM radcheck           WHERE username = '%{SQL-User-Name}'           ORDER BY id"
                                authorize_reply_query = "SELECT id, username, attribute, value, op           FROM radreply           WHERE username = '%{SQL-User-Name}'           ORDER BY id"
                                authorize_group_check_query = "SELECT id, groupname, attribute,           Value, op           FROM radgroupcheck           WHERE groupname = '%{Sql-Group}'           ORDER BY id"
                                authorize_group_reply_query = "SELECT id, groupname, attribute,           value, op           FROM radgroupreply           WHERE groupname = '%{Sql-Group}'           ORDER BY id"
                                accounting_onoff_query = "          UPDATE radacct           SET              acctstoptime       =  '%S',              acctsessiontime    =  unix_timestamp('%S') -                                    unix_timestamp(acctstarttime),              acctterminatecause =  '%{Acct-Terminate-Cause}',              acctstopdelay      =  %{%{Acct-Delay-Time}:-0}           WHERE acctstoptime IS NULL           AND nasipaddress      =  '%{NAS-IP-Address}'           AND acctstarttime     <= '%S'"
                                accounting_update_query = "           UPDATE radacct           SET              framedipaddress = '%{Framed-IP-Address}',              acctsessiontime     = '%{Acct-Session-Time}',              acctinputoctets     = '%{%{Acct-Input-Gigawords}:-0}'  << 32 |                                    '%{%{Acct-Input-Octets}:-0}',              acctoutputoctets    = '%{%{Acct-Output-Gigawords}:-0}' << 32 |                                    '%{%{Acct-Output-Octets}:-0}'           WHERE acctsessionid = '%{Acct-Session-Id}'           AND username        = '%{SQL-User-Name}'           AND nasipaddress    = '%{NAS-IP-Address}'"
                                accounting_update_query_alt = "           INSERT INTO radacct             (acctsessionid,    acctuniqueid,      username,              realm,            nasipaddress,      nasportid,              nasporttype,      acctstarttime,     acctsessiontime,              acctauthentic,    connectinfo_start, acctinputoctets,              acctoutputoctets, calledstationid,   callingstationid,              servicetype,      framedprotocol,    framedipaddress,              acctstartdelay,   xascendsessionsvrkey)           VALUES             ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}',              '%{SQL-User-Name}',              '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}',              '%{NAS-Port-Type}',              DATE_SUB('%S',                       INTERVAL (%{%{Acct-Session-Time}:-0} +                                 %{%{Acct-Delay-Time}:-0}) SECOND),                       '%{Acct-Session-Time}',              '%{Acct-Authentic}', '',              '%{%{Acct-Input-Gigawords}:-0}' << 32 |              '%{%{Acct-Input-Octets}:-0}',              '%{%{Acct-Output-Gigawords}:-0}' << 32 |              '%{%{Acct-Output-Octets}:-0}',              '%{Called-Station-Id}', '%{Calling-Station-Id}',              '%{Service-Type}', '%{Framed-Protocol}',              '%{Framed-IP-Address}',              '0', '%{X-Ascend-Session-Svr-Key}')"
                                accounting_start_query = "           INSERT INTO radacct             (acctsessionid,    acctuniqueid,     username,              realm,            nasipaddress,     nasportid,              nasporttype,      acctstarttime,    acctstoptime,              acctsessiontime,  acctauthentic,    connectinfo_start,              connectinfo_stop, acctinputoctets,  acctoutputoctets,              calledstationid,  callingstationid, acctterminatecause,              servicetype,      framedprotocol,   framedipaddress,              acctstartdelay,   acctstopdelay,    xascendsessionsvrkey)           VALUES             ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}',              '%{SQL-User-Name}',              '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}',              '%{NAS-Port-Type}', '%S', NULL,              '0', '%{Acct-Authentic}', '%{Connect-Info}',              '', '0', '0',              '%{Called-Station-Id}', '%{Calling-Station-Id}', '',              '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}',              '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')"
                                accounting_start_query_alt = "           UPDATE radacct SET              acctstarttime     = '%S',              acctstartdelay    = '%{%{Acct-Delay-Time}:-0}',              connectinfo_start = '%{Connect-Info}'           WHERE acctsessionid  = '%{Acct-Session-Id}'           AND username         = '%{SQL-User-Name}'           AND nasipaddress     = '%{NAS-IP-Address}'"
                                accounting_stop_query = "           UPDATE radacct SET              acctstoptime       = '%S',              acctsessiontime    = '%{Acct-Session-Time}',              acctinputoctets    = '%{%{Acct-Input-Gigawords}:-0}' << 32 |                                   '%{%{Acct-Input-Octets}:-0}',              acctoutputoctets   = '%{%{Acct-Output-Gigawords}:-0}' << 32 |                                   '%{%{Acct-Output-Octets}:-0}',              acctterminatecause = '%{Acct-Terminate-Cause}',              acctstopdelay      = '%{%{Acct-Delay-Time}:-0}',              connectinfo_stop   = '%{Connect-Info}'           WHERE acctsessionid   = '%{Acct-Session-Id}'           AND username          = '%{SQL-User-Name}'           AND nasipaddress      = '%{NAS-IP-Address}'"
                                accounting_stop_query_alt = "           INSERT INTO radacct             (acctsessionid, acctuniqueid, username,              realm, nasipaddress, nasportid,              nasporttype, acctstarttime, acctstoptime,              acctsessiontime, acctauthentic, connectinfo_start,              connectinfo_stop, acctinputoctets, acctoutputoctets,              calledstationid, callingstationid, acctterminatecause,              servicetype, framedprotocol, framedipaddress,              acctstartdelay, acctstopdelay)           VALUES             ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}',              '%{SQL-User-Name}',              '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}',              '%{NAS-Port-Type}',              DATE_SUB('%S',                  INTERVAL (%{%{Acct-Session-Time}:-0} +                  %{%{Acct-Delay-Time}:-0}) SECOND),              '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '',              '%{Connect-Info}',              '%{%{Acct-Input-Gigawords}:-0}' << 32 |              '%{%{Acct-Input-Octets}:-0}',              '%{%{Acct-Output-Gigawords}:-0}' << 32 |              '%{%{Acct-Output-Octets}:-0}',              '%{Called-Station-Id}', '%{Calling-Station-Id}',              '%{Acct-Terminate-Cause}',              '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}',              '0', '%{%{Acct-Delay-Time}:-0}')"
                                group_membership_query = "SELECT groupname           FROM radusergroup           WHERE username = '%{SQL-User-Name}'           ORDER BY priority"
                                connect_failure_retry_delay = 60
                                simul_count_query = ""
                                simul_verify_query = "SELECT radacctid, acctsessionid, username,                                nasipaddress, nasportid, framedipaddress,                                callingstationid, framedprotocol                                FROM radacct                                WHERE username = '%{SQL-User-Name}'                                AND acctstoptime IS NULL"
                                postauth_query = "INSERT INTO radpostauth                           (username, pass, reply, authdate)                           VALUES (                           '%{User-Name}',                           '%{%{User-Password}:-%{Chap-Password}}',                           '%{reply:Packet-Type}', '%S')"
                                safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"
                          }
                        rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked
                        rlm_sql (sql): Attempting to connect to radius@192.168.1.25:3306/radius
                        rlm_sql (sql): starting 0
                        rlm_sql (sql): Attempting to connect rlm_sql_mysql #0
                        rlm_sql_mysql: Starting connect to MySQL server for #0
                        rlm_sql (sql): Connected new DB handle, #0
                        rlm_sql (sql): starting 1
                        rlm_sql (sql): Attempting to connect rlm_sql_mysql #1
                        rlm_sql_mysql: Starting connect to MySQL server for #1
                        rlm_sql (sql): Connected new DB handle, #1
                        rlm_sql (sql): starting 2
                        rlm_sql (sql): Attempting to connect rlm_sql_mysql #2
                        rlm_sql_mysql: Starting connect to MySQL server for #2
                        rlm_sql (sql): Connected new DB handle, #2
                        rlm_sql (sql): starting 3
                        rlm_sql (sql): Attempting to connect rlm_sql_mysql #3
                        rlm_sql_mysql: Starting connect to MySQL server for #3
                        rlm_sql (sql): Connected new DB handle, #3
                        rlm_sql (sql): starting 4
                        rlm_sql (sql): Attempting to connect rlm_sql_mysql #4
                        rlm_sql_mysql: Starting connect to MySQL server for #4
                        rlm_sql (sql): Connected new DB handle, #4
                        rlm_sql (sql): Processing generate_sql_clients
                        rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas
                        rlm_sql (sql): Reserving sql socket id: 4
                        rlm_sql_mysql: query:  SELECT id, nasname, shortname, type, secret, server FROM nas
                        rlm_sql (sql): Released sql socket id: 4
                        

                        Still the same problem, no matter what I did in web setting, there is no log MySQL. :(

                        =================================================================================================

                        Just a quick update:
                        Now I think there is some progress, I can see the log in MySQL.

                        Table radpostauth

                        
                        1	test	test123	Access-Accept	2012-01-15 22:42:55
                        
                        

                        I am going to test more with Captive Portal.

                        :)))

                        1 Reply Last reply Reply Quote 0
                        • N
                          Nachtfalke last edited by

                          @zlyzwy

                          Did you solve the probem in "clients.conf" ? There was an error because of an open brace "{". This shouldn't happen if you create the clients from the GUI.

                          The log output you posted on pastebin shows the "probem":

                          Failed binding to authentication address * port 1812: Address already in use
                          /usr/local/etc/raddb/radiusd.conf[36]: Error binding to port for 0.0.0.0 port 1812
                          

                          This is happening if you start the freeradius service from GUI than it is listening on the auth port. If you then start it again on console with "radiusd -X" than the service gets startet two times. So first stop the service from GUI or kill it from console with

                          killall -9 radiusd
                          

                          Only if there is no other radiusd service running, start it in debug mode from GUI with "radiusd -X"

                          MySQL:
                          You have to create the MySQL database by hand and you have to create the tables and you have to put the data into the tables. FreeRADIUS is only reading the table (authentication). The SQL GUI shows you the default names of the tables. If you choose other table names you have to correct this in the web GUI.

                          On pfsense there are several example .sql files. I don't know the exxact path at the moment because I do not have access to any pfsense.

                          Try to search the files with:

                          find / -iname "*.sql*"
                          

                          There are the tables for MySQL, PostgreSQL and so on. If you open the tables with an editor (vi) than there is explained how the table should look like and for what you should use it.

                          Here you can see how to import the example freeradius .sql structure into your database:

                          http://wiki.freeradius.org/SQL-HOWTO#Create+MySQL+Database
                          

                          –--- edit -----
                          Some more information about MySQL database creation:
                          http://www.howtoforge.com/setting-up-a-freeradius-based-aaa-server-with-mysql-and-management-with-daloradius

                          1 Reply Last reply Reply Quote 0
                          • Z
                            zlyzwy last edited by

                            @Nachtfalke
                            @Nachtfalke:

                            Did you solve the probem in "clients.conf" ? There was an error because of an open brace "{". This shouldn't happen if you create the clients from the GUI.

                            I always create the client from the GUI. I am sure I can solve it by remove all the clients from GUI and add the clients again.
                            This is happening when I upgrade/re-install the package.

                            =========================================================================
                            By entering the debug mode, I also find the problem. Do the following step in console will be all right.
                            1.```
                            service radiusd stop

                            2\.```
                            Radiusd -X
                            

                            The debug is really useful~~

                            =========================================================================
                            I must prepare the database first. The SQL script can be found at latest Freeradius release.
                            (freeradius-server-2.1.12\raddb\sql\mysql)

                            1 Reply Last reply Reply Quote 0
                            • N
                              Nachtfalke last edited by

                              Updates pkg v1.5.2:

                              • Added: "Amount of Time" and "Amount of Traffic" per user connected through captive portal and freeradius2

                              • Updated: FreeRADIUS 2.x package on pfSense documentation

                              1 Reply Last reply Reply Quote 0
                              • F
                                firestrife23 last edited by

                                I tried to upgrade package to v1.5.2 and it get stuck at "Loading package instructions…"

                                1 Reply Last reply Reply Quote 0
                                • N
                                  Nachtfalke last edited by

                                  @firestrife23:

                                  I tried to upgrade package to v1.5.2 and it get stuck at "Loading package instructions…"

                                  No problems here on amd64 and i386. Updating from pkg v1.5.1 to v1.5.2.

                                  Removing freeradius2 components...
                                  Tabs items... done.
                                  Menu items... done.
                                  Services... done.
                                  Loading package instructions...
                                  Deinstall commands... done.
                                  Removing package instructions...done.
                                  Auxiliary files... done.
                                  Package XML... done.
                                  Configuration... done.
                                  Beginning package installation for freeradius2...
                                  Downloading package configuration file... done.
                                  Saving updated package information... done.
                                  Downloading freeradius2 and its dependencies... 
                                  Checking for package installation... Loading package configuration... done.
                                  Configuring package components...
                                  Additional files... done.
                                  Loading package instructions...
                                  Custom commands...
                                  Executing custom_php_install_command()...done.
                                  Executing custom_php_resync_config_command()...done.
                                  Custom commands...
                                  Executing custom_php_install_command()...done.
                                  Executing custom_php_resync_config_command()...done.
                                  Menu items... done.
                                  Integrated Tab items... done.
                                  Services... done.
                                  Writing configuration... done.
                                  
                                  Package reinstalled.
                                  
                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    pszafer last edited by

                                    ok, first I want show you that PAP working for me:

                                    first question:

                                    radtest -t pap addressbook ppp123PPP 10.8.0.1 1 ppp123PPP
                                    Sending Access-Request of id 172 to 10.8.0.1 port 1812
                                    	User-Name = "addressbook"
                                    	User-Password = "ppp123PPP"
                                    	NAS-IP-Address = 10.8.0.1
                                    	NAS-Port = 1
                                    	Message-Authenticator = 0x00000000000000000000000000000000
                                    rad_recv: Access-Accept packet from host 10.8.0.1 port 1812, id=172, length=20
                                    

                                    Now on radiusd -X side:

                                    Ready to process requests.
                                    rad_recv: Access-Request packet from host 10.8.0.1 port 63417, id=172, length=81
                                    	User-Name = "addressbook"
                                    	User-Password = "ppp123PPP"
                                    	NAS-IP-Address = 10.8.0.1
                                    	NAS-Port = 1
                                    	Message-Authenticator = 0x84a2dbf3faa9c1eed0e6b541fe4773bb
                                    # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
                                    +- entering group authorize {...}
                                    ++[preprocess] returns ok
                                    ++[chap] returns noop
                                    ++[mschap] returns noop
                                    ++[digest] returns noop
                                    [suffix] No '@' in User-Name = "addressbook", skipping NULL due to config.
                                    ++[suffix] returns noop
                                    [ntdomain] No '\' in User-Name = "addressbook", skipping NULL due to config.
                                    ++[ntdomain] returns noop
                                    [eap] No EAP-Message, not doing EAP
                                    ++[eap] returns noop
                                    [ldap] performing user authorization for addressbook
                                    [ldap] 	expand: (sAMAccountName=%{mschap:User-Name}) -> (sAMAccountName=addressbook)
                                    [ldap] 	expand: cn=Users,dc=p,dc=t -> cn=Users,dc=p,dc=t
                                      [ldap] ldap_get_conn: Checking Id: 0
                                      [ldap] ldap_get_conn: Got Id: 0
                                      [ldap] attempting LDAP reconnection
                                      [ldap] (re)connect to server.p.t:389, authentication 0
                                      [ldap] bind as cn=addressbook,cn=Users,dc=p,dc=t/ppp123PPP to server.p.t:389
                                      [ldap] waiting for bind result ...
                                      [ldap] Bind was successful
                                      [ldap] performing search in cn=Users,dc=p,dc=t, with filter (sAMAccountName=addressbook)
                                    [ldap] looking for check items in directory...
                                    [ldap] looking for reply items in directory...
                                    WARNING: No "known good" password was found in LDAP.  Are you sure that the user is configured correctly?
                                    [ldap] Setting Auth-Type = LDAP
                                    [ldap] user addressbook authorized to use remote access
                                      [ldap] ldap_release_conn: Release Id: 0
                                    ++[ldap] returns ok
                                    rlm_counter: Entering module authorize code
                                    rlm_counter: Could not find Check item value pair
                                    ++[daily] returns noop
                                    rlm_counter: Entering module authorize code
                                    rlm_counter: Could not find Check item value pair
                                    ++[weekly] returns noop
                                    rlm_counter: Entering module authorize code
                                    rlm_counter: Could not find Check item value pair
                                    ++[monthly] returns noop
                                    rlm_counter: Entering module authorize code
                                    rlm_counter: Could not find Check item value pair
                                    ++[forever] returns noop
                                    rlm_checkval: Could not find item named Calling-Station-Id in request
                                    rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs
                                    ++[checkval] returns notfound
                                    ++[expiration] returns noop
                                    ++[logintime] returns noop
                                    [pap] WARNING! No "known good" password found for the user.  Authentication may fail because of this.
                                    ++[pap] returns noop
                                    Found Auth-Type = LDAP
                                    # Executing group from file /usr/local/etc/raddb/sites-enabled/default
                                    +- entering group LDAP {...}
                                    [ldap] login attempt by "addressbook" with password "ppp123PPP"
                                    [ldap] user DN: CN=addressbook,CN=Users,DC=p,DC=t
                                      [ldap] (re)connect to server.p.t:389, authentication 1
                                      [ldap] bind as CN=addressbook,CN=Users,DC=p,DC=t/ppp123PPP to server.p.t:389
                                      [ldap] waiting for bind result ...
                                      [ldap] Bind was successful
                                    [ldap] user addressbook authenticated succesfully
                                    ++[ldap] returns ok
                                    Login OK: [addressbook] (from client admin port 1)
                                    # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default
                                    +- entering group post-auth {...}
                                    ++[exec] returns noop
                                    Sending Access-Accept of id 172 to 10.8.0.1 port 63417
                                    Finished request 0.
                                    Going to the next request
                                    Waking up in 4.9 seconds.
                                    Cleaning up request 0 ID 172 with timestamp +5
                                    Ready to process requests.
                                    

                                    Now I'm trying to get ktutil work, but not sure if really needed it.

                                    1 Reply Last reply Reply Quote 0
                                    • N
                                      Nachtfalke last edited by

                                      @pszafer:

                                      ok, first I want show you that PAP working for me:

                                      first question:

                                      radtest -t pap addressbook ppp123PPP 10.8.0.1 1 ppp123PPP
                                      Sending Access-Request of id 172 to 10.8.0.1 port 1812
                                      	User-Name = "addressbook"
                                      	User-Password = "ppp123PPP"
                                      	NAS-IP-Address = 10.8.0.1
                                      	NAS-Port = 1
                                      	Message-Authenticator = 0x00000000000000000000000000000000
                                      rad_recv: Access-Accept packet from host 10.8.0.1 port 1812, id=172, length=20
                                      

                                      Now on radiusd -X side:

                                      Ready to process requests.
                                      rad_recv: Access-Request packet from host 10.8.0.1 port 63417, id=172, length=81
                                      	User-Name = "addressbook"
                                      	User-Password = "ppp123PPP"
                                      	NAS-IP-Address = 10.8.0.1
                                      	NAS-Port = 1
                                      	Message-Authenticator = 0x84a2dbf3faa9c1eed0e6b541fe4773bb
                                      # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
                                      +- entering group authorize {...}
                                      ++[preprocess] returns ok
                                      ++[chap] returns noop
                                      ++[mschap] returns noop
                                      ++[digest] returns noop
                                      [suffix] No '@' in User-Name = "addressbook", skipping NULL due to config.
                                      ++[suffix] returns noop
                                      [ntdomain] No '\' in User-Name = "addressbook", skipping NULL due to config.
                                      ++[ntdomain] returns noop
                                      [eap] No EAP-Message, not doing EAP
                                      ++[eap] returns noop
                                      [ldap] performing user authorization for addressbook
                                      [ldap] 	expand: (sAMAccountName=%{mschap:User-Name}) -> (sAMAccountName=addressbook)
                                      [ldap] 	expand: cn=Users,dc=p,dc=t -> cn=Users,dc=p,dc=t
                                        [ldap] ldap_get_conn: Checking Id: 0
                                        [ldap] ldap_get_conn: Got Id: 0
                                        [ldap] attempting LDAP reconnection
                                        [ldap] (re)connect to server.p.t:389, authentication 0
                                        [ldap] bind as cn=addressbook,cn=Users,dc=p,dc=t/ppp123PPP to server.p.t:389
                                        [ldap] waiting for bind result ...
                                        [ldap] Bind was successful
                                        [ldap] performing search in cn=Users,dc=p,dc=t, with filter (sAMAccountName=addressbook)
                                      [ldap] looking for check items in directory...
                                      [ldap] looking for reply items in directory...
                                      WARNING: No "known good" password was found in LDAP.  Are you sure that the user is configured correctly?
                                      [ldap] Setting Auth-Type = LDAP
                                      [ldap] user addressbook authorized to use remote access
                                        [ldap] ldap_release_conn: Release Id: 0
                                      ++[ldap] returns ok
                                      rlm_counter: Entering module authorize code
                                      rlm_counter: Could not find Check item value pair
                                      ++[daily] returns noop
                                      rlm_counter: Entering module authorize code
                                      rlm_counter: Could not find Check item value pair
                                      ++[weekly] returns noop
                                      rlm_counter: Entering module authorize code
                                      rlm_counter: Could not find Check item value pair
                                      ++[monthly] returns noop
                                      rlm_counter: Entering module authorize code
                                      rlm_counter: Could not find Check item value pair
                                      ++[forever] returns noop
                                      rlm_checkval: Could not find item named Calling-Station-Id in request
                                      rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs
                                      ++[checkval] returns notfound
                                      ++[expiration] returns noop
                                      ++[logintime] returns noop
                                      [pap] WARNING! No "known good" password found for the user.  Authentication may fail because of this.
                                      ++[pap] returns noop
                                      Found Auth-Type = LDAP
                                      # Executing group from file /usr/local/etc/raddb/sites-enabled/default
                                      +- entering group LDAP {...}
                                      [ldap] login attempt by "addressbook" with password "ppp123PPP"
                                      [ldap] user DN: CN=addressbook,CN=Users,DC=p,DC=t
                                        [ldap] (re)connect to server.p.t:389, authentication 1
                                        [ldap] bind as CN=addressbook,CN=Users,DC=p,DC=t/ppp123PPP to server.p.t:389
                                        [ldap] waiting for bind result ...
                                        [ldap] Bind was successful
                                      [ldap] user addressbook authenticated succesfully
                                      ++[ldap] returns ok
                                      Login OK: [addressbook] (from client admin port 1)
                                      # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default
                                      +- entering group post-auth {...}
                                      ++[exec] returns noop
                                      Sending Access-Accept of id 172 to 10.8.0.1 port 63417
                                      Finished request 0.
                                      Going to the next request
                                      Waking up in 4.9 seconds.
                                      Cleaning up request 0 ID 172 with timestamp +5
                                      Ready to process requests.
                                      

                                      Now I'm trying to get ktutil work, but not sure if really needed it.

                                      Looks good as far as I can see that.
                                      It is ok that there are some warnings and some other auth-types which fail but this is the order of the auth-type modules.
                                      And the output shows that the user gets authenticated with auth-type ldap. :)

                                      Not sure for what we need ktutil !?!

                                      Perhaps you can write a little how-to how you configured that, whats your domain name, what you entered on AD and so on. It would help me and others. Did you have to edit some other files by hand ? If yes then tell me what and I will try to implement that into GUI if needed!

                                      So far thank you very much for taking time and testing this - testing my package and functionalities I could not test at the moment! I really appreciate your help! :)

                                      1 Reply Last reply Reply Quote 0
                                      • P
                                        pszafer last edited by

                                        of course I will write about this soon, but this is not what we want to accomplish.
                                        why?
                                        PAP in Windows 7 is disabled by group policy and I agree with MS in that, because sending password in plain text via WiFi would be irresponsible

                                        I need ktutil because that util is used in how to from link you gave ;)

                                        1 Reply Last reply Reply Quote 0
                                        • P
                                          pszafer last edited by

                                          so trully it is not so much to do:

                                          1. Edit /usr/local/etc/raddb/sites-enabled/default

                                          in authorize section (I'm not sure if it wasn't like this originally):

                                          • comment unix line #
                                          • uncomment line ntdomain
                                          • uncomment ldap line
                                          • uncomment or add pap line

                                          in authenticate section:

                                          • add or uncomment
                                          Auth-Type PAP {
                                          		pap
                                          	}
                                          
                                          

                                          in preacct section:

                                          • uncomment ntdomain line

                                          post-auth section:

                                          • comment ldap section
                                            ===========================
                                            in radiusd.conf add in the end of file:
                                            $INCLUDE policy.conf
                                            $INCLUDE sites-enabled/
                                            ===========================
                                            modules/ldap looks like this:
                                          ldap {
                                          	#
                                          	#  Note that this needs to match the name in the LDAP
                                          	#  server certificate, if you're using ldaps.
                                          	server = "server.p.t"
                                          	identity = "cn=freeradiususer,cn=Users,dc=p,dc=t"
                                          	password = ppp123PPP
                                          	basedn = "cn=Users,dc=p,dc=t"
                                          	filter = "(sAMAccountName=%{mschap:User-Name})"
                                          	#base_filter = "(objectclass=radiusprofile)"
                                          
                                          

                                          I think that's it.

                                          Now I'm trying to understand what we need to get MSCHAP working!

                                          1 Reply Last reply Reply Quote 0
                                          • N
                                            Nachtfalke last edited by

                                            @pszafer:

                                            so trully it is not so much to do:

                                            1. Edit /usr/local/etc/raddb/sites-enabled/default

                                            in authorize section (I'm not sure if it wasn't like this originally):

                                            • comment unix line #
                                            • uncomment line ntdomain
                                            • uncomment ldap line
                                            • uncomment or add pap line

                                            This is the default if you install freeradius2 package. I did all these changes. Unis line is commented by default. I configured ntdomain as you need it here. LDAP line will be commented or uncommented if we enable/disable it on LDAP GUI (authorization).

                                            @pszafer:

                                            in authenticate section:

                                            • add or uncomment
                                            Auth-Type PAP {
                                            		pap
                                            	}
                                            
                                            

                                            This is default. If we do not need LDAP in authentication than we can enable/disable this from LDAP GUI. PAP is there by default.

                                            @pszafer:

                                            in preacct section:

                                            • uncomment ntdomain line

                                            I did that in the past and it is default after package installation.

                                            @pszafer:

                                            post-auth section:

                                            • comment ldap section

                                            Is by default commented. We do not have any option to change that from GUI.

                                            @pszafer:

                                            ===========================
                                            in radiusd.conf add in the end of file:
                                            $INCLUDE policy.conf
                                            $INCLUDE sites-enabled/

                                            This is by default.

                                            @pszafer:

                                            modules/ldap looks like this:

                                            ldap {
                                            	#
                                            	#  Note that this needs to match the name in the LDAP
                                            	#  server certificate, if you're using ldaps.
                                            	server = "server.p.t"
                                            	identity = "cn=freeradiususer,cn=Users,dc=p,dc=t"
                                            	password = ppp123PPP
                                            	basedn = "cn=Users,dc=p,dc=t"
                                            	filter = "(sAMAccountName=%{mschap:User-Name})"
                                            	#base_filter = "(objectclass=radiusprofile)"
                                            
                                            

                                            I added the commented lines to the GUI. So they are now UNcommented. Not sure if the default entries are ok or not.
                                            But I think we can change this when we need to. When you telling me this :D

                                            @pszafer:

                                            I think that's it.

                                            Now I'm trying to understand what we need to get MSCHAP working!

                                            Great! :-)

                                            1 Reply Last reply Reply Quote 0
                                            • F
                                              firestrife23 last edited by

                                              What's the advantage of enabling SQL server? Because I don't see it on pfSense documentation.

                                              1 Reply Last reply Reply Quote 0
                                              • Z
                                                zlyzwy last edited by

                                                Hi Nachtfalke,

                                                I just tested with Captive Portal + FreeRadius + MySQL for a Hotspot site.

                                                Basically it's now working here, I can login through CP and see the login information in MySQL.

                                                There are still two options that I can't work it around.

                                                1. per-user bandwidth restriction
                                                This option is available in CP. But it's a global setting which means it will effect all clients with same setting.
                                                I think there should have the same settings according to account? Does FreeRadius support it yet?

                                                2. RADIUS MAC authentication
                                                I tested this function, it doesn't work. I always get the login page even I added the MAC in FreeRadius.
                                                With the same setting, pass-through MACs in CP does work properly. Once I add the MAC, it works immediately.

                                                Thanks for your patient.

                                                1 Reply Last reply Reply Quote 0
                                                • N
                                                  Nachtfalke last edited by

                                                  @firestrife23:

                                                  What's the advantage of enabling SQL server? Because I don't see it on pfSense documentation.

                                                  The advantage of a SQL database is if you have many many users. If you add many users to the freeradius users file - I would say 500+ - than your response time can be slow because the freeradius server has to go through the list from top to down until finding the user or not. So you should check the documentation about "Status server updates". There you will get information about how your RADIUS server performs and if the server can handle the requests. If you use a database the requests can be processes faster if you have many users because of the structur. This are the performance advantages.

                                                  For accounting there are better possibilities to do SELECTs on the database but you have to configure the sqlcounter module that it works for you.

                                                  An other point could be that you create a web GUI for your SQL database so that people could add new users to the database but should not have access to pfsense or freeradius. This could be useful in a hotel - you setup the freeradius and the connection to the database and the rest will be done from a separate web GUI from the hotel people.

                                                  That's my opinion. Perhaps I will add this to the pfsense docs ;)

                                                  @zlyzwy
                                                  Can you write down the steps you did for creating the database, importing the tables (names of tables) and how you configured freeradius SQL ?

                                                  1.) I will add this in the next days so we have the possibility to set separate Download und upload bandwidth for users (overwriting the settings from CP which are for ALL users). I have coded this but it is on my HDD at home ;o)
                                                  Or do you meand volume of traffic like 500MB in max per week ? This is supported from freeradius and CP but with some disadvantages which I wrote down in the docs.

                                                  2.) I will try to test this at home with CP if I found some time. Sending the "Calling-Station-ID" (MAC) is working but I didn't test it with CP.

                                                  1 Reply Last reply Reply Quote 0
                                                  • G
                                                    gigg last edited by

                                                    Hi Guys,

                                                    i have decided to see if I can replace another solution we using with a Pfsense Captive portal and a Psfense Radius solution. But, I follow the instructions on the Radius documentation, but the first hiccup I have is that i dont have the option to even install the package.

                                                    In pfsense 2.x go to System => Packages => Available Packages and click on the + behind freeradius2.
                                                        After Installation go to Services => FreeRADIUS

                                                    Am I blind or is the package option just not on the 2.0.1 menu? :)

                                                    Regards,

                                                    Gigg

                                                    1 Reply Last reply Reply Quote 0
                                                    • Z
                                                      zlyzwy last edited by

                                                      @zlyzwy
                                                      Can you write down the steps you did for creating the database, importing the tables (names of tables) and how you configured freeradius SQL ?

                                                      Sure:)
                                                      In general, I used PhpMyAdmin to manage MySQL database, you can use any other tools as you like.
                                                      All the following .SQL files can be found in latest FreeRadius package.(http://freeradius.org/download.html)

                                                      MYSQL
                                                      1. Create the database named radius from PhpMyAdmin

                                                      CREATE DATABASE  `radius` ;
                                                      

                                                      2. Import the table 'admin'. Please change  'localhost' to your Pfsense name or just changed it to '%' which means from any client can connect to MySQL. Of course you can also change the default password('radpass') here.

                                                      
                                                      #
                                                      #  Create default administrator for RADIUS
                                                      #
                                                      CREATE USER 'radius'@'localhost';
                                                      SET PASSWORD FOR 'radius'@'localhost' = PASSWORD('radpass');
                                                      
                                                      # The server can read any table in SQL
                                                      GRANT SELECT ON radius.* TO 'radius'@'localhost';
                                                      
                                                      # The server can write to the accounting and post-auth logging table.
                                                      #
                                                      #  i.e. 
                                                      GRANT ALL on radius.radacct TO 'radius'@'localhost';
                                                      GRANT ALL on radius.radpostauth TO 'radius'@'localhost';
                                                      
                                                      

                                                      3. Import the table 'schema'. I don't change anything and it works fine.

                                                      ###########################################################################
                                                      # $Id$                 #
                                                      #                                                                         #
                                                      #  schema.sql                       rlm_sql - FreeRADIUS SQL Module       #
                                                      #                                                                         #
                                                      #     Database schema for MySQL rlm_sql module                            #
                                                      #                                                                         #
                                                      #     To load:                                                            #
                                                      #         mysql -uroot -prootpass radius < schema.sql                     #
                                                      #                                                                         #
                                                      #                                   Mike Machado <mike@innercite.com>#
                                                      ###########################################################################
                                                      #
                                                      # Table structure for table 'radacct'
                                                      #
                                                      
                                                      CREATE TABLE radacct (
                                                        radacctid bigint(21) NOT NULL auto_increment,
                                                        acctsessionid varchar(64) NOT NULL default '',
                                                        acctuniqueid varchar(32) NOT NULL default '',
                                                        username varchar(64) NOT NULL default '',
                                                        groupname varchar(64) NOT NULL default '',
                                                        realm varchar(64) default '',
                                                        nasipaddress varchar(15) NOT NULL default '',
                                                        nasportid varchar(15) default NULL,
                                                        nasporttype varchar(32) default NULL,
                                                        acctstarttime datetime NULL default NULL,
                                                        acctstoptime datetime NULL default NULL,
                                                        acctsessiontime int(12) default NULL,
                                                        acctauthentic varchar(32) default NULL,
                                                        connectinfo_start varchar(50) default NULL,
                                                        connectinfo_stop varchar(50) default NULL,
                                                        acctinputoctets bigint(20) default NULL,
                                                        acctoutputoctets bigint(20) default NULL,
                                                        calledstationid varchar(50) NOT NULL default '',
                                                        callingstationid varchar(50) NOT NULL default '',
                                                        acctterminatecause varchar(32) NOT NULL default '',
                                                        servicetype varchar(32) default NULL,
                                                        framedprotocol varchar(32) default NULL,
                                                        framedipaddress varchar(15) NOT NULL default '',
                                                        acctstartdelay int(12) default NULL,
                                                        acctstopdelay int(12) default NULL,
                                                        xascendsessionsvrkey varchar(10) default NULL,
                                                        PRIMARY KEY  (radacctid),
                                                        KEY username (username),
                                                        KEY framedipaddress (framedipaddress),
                                                        KEY acctsessionid (acctsessionid),
                                                        KEY acctsessiontime (acctsessiontime),
                                                        KEY acctuniqueid (acctuniqueid),
                                                        KEY acctstarttime (acctstarttime),
                                                        KEY acctstoptime (acctstoptime),
                                                        KEY nasipaddress (nasipaddress)
                                                      ) ;
                                                      
                                                      #
                                                      # Table structure for table 'radcheck'
                                                      #
                                                      
                                                      CREATE TABLE radcheck (
                                                        id int(11) unsigned NOT NULL auto_increment,
                                                        username varchar(64) NOT NULL default '',
                                                        attribute varchar(64)  NOT NULL default '',
                                                        op char(2) NOT NULL DEFAULT '==',
                                                        value varchar(253) NOT NULL default '',
                                                        PRIMARY KEY  (id),
                                                        KEY username (username(32))
                                                      ) ;
                                                      
                                                      #
                                                      # Table structure for table 'radgroupcheck'
                                                      #
                                                      
                                                      CREATE TABLE radgroupcheck (
                                                        id int(11) unsigned NOT NULL auto_increment,
                                                        groupname varchar(64) NOT NULL default '',
                                                        attribute varchar(64)  NOT NULL default '',
                                                        op char(2) NOT NULL DEFAULT '==',
                                                        value varchar(253)  NOT NULL default '',
                                                        PRIMARY KEY  (id),
                                                        KEY groupname (groupname(32))
                                                      ) ;
                                                      
                                                      #
                                                      # Table structure for table 'radgroupreply'
                                                      #
                                                      
                                                      CREATE TABLE radgroupreply (
                                                        id int(11) unsigned NOT NULL auto_increment,
                                                        groupname varchar(64) NOT NULL default '',
                                                        attribute varchar(64)  NOT NULL default '',
                                                        op char(2) NOT NULL DEFAULT '=',
                                                        value varchar(253)  NOT NULL default '',
                                                        PRIMARY KEY  (id),
                                                        KEY groupname (groupname(32))
                                                      ) ;
                                                      
                                                      #
                                                      # Table structure for table 'radreply'
                                                      #
                                                      
                                                      CREATE TABLE radreply (
                                                        id int(11) unsigned NOT NULL auto_increment,
                                                        username varchar(64) NOT NULL default '',
                                                        attribute varchar(64) NOT NULL default '',
                                                        op char(2) NOT NULL DEFAULT '=',
                                                        value varchar(253) NOT NULL default '',
                                                        PRIMARY KEY  (id),
                                                        KEY username (username(32))
                                                      ) ;
                                                      
                                                      #
                                                      # Table structure for table 'radusergroup'
                                                      #
                                                      
                                                      CREATE TABLE radusergroup (
                                                        username varchar(64) NOT NULL default '',
                                                        groupname varchar(64) NOT NULL default '',
                                                        priority int(11) NOT NULL default '1',
                                                        KEY username (username(32))
                                                      ) ;
                                                      
                                                      #
                                                      # Table structure for table 'radpostauth'
                                                      #
                                                      
                                                      CREATE TABLE radpostauth (
                                                        id int(11) NOT NULL auto_increment,
                                                        username varchar(64) NOT NULL default '',
                                                        pass varchar(64) NOT NULL default '',
                                                        reply varchar(32) NOT NULL default '',
                                                        authdate timestamp NOT NULL,
                                                        PRIMARY KEY  (id)
                                                      ) ;</mike@innercite.com> 
                                                      

                                                      4. Import the rest of tables one by one.

                                                      #
                                                      # Table structure for table 'cui'
                                                      #
                                                      CREATE TABLE `cui` (
                                                        `clientipaddress` varchar(15) NOT NULL default '',
                                                        `callingstationid` varchar(50) NOT NULL default '',
                                                        `username` varchar(64) NOT NULL default '',
                                                        `cui` varchar(32) NOT NULL default '',
                                                        `creationdate` timestamp NOT NULL default CURRENT_TIMESTAMP,
                                                        `lastaccounting` timestamp NOT NULL default '0000-00-00 00:00:00',
                                                        PRIMARY KEY  (`username`,`clientipaddress`,`callingstationid`)
                                                      ) ENGINE=MyISAM DEFAULT CHARSET=latin1;
                                                      
                                                      
                                                      #
                                                      # Table structure for table 'radippool'
                                                      #
                                                      CREATE TABLE radippool ( 
                                                        id                    int(11) unsigned NOT NULL auto_increment,
                                                        pool_name             varchar(30) NOT NULL,
                                                        framedipaddress       varchar(15) NOT NULL default '',
                                                        nasipaddress          varchar(15) NOT NULL default '',
                                                        calledstationid       VARCHAR(30) NOT NULL,
                                                        callingstationid      VARCHAR(30) NOT NULL,
                                                        expiry_time           DATETIME NULL default NULL,
                                                        username              varchar(64) NOT NULL default '',
                                                        pool_key              varchar(30) NOT NULL,
                                                        PRIMARY KEY (id),
                                                        KEY radippool_poolname_expire (pool_name, expiry_time),
                                                        KEY framedipaddress (framedipaddress),
                                                        KEY radippool_nasip_poolkey_ipaddress (nasipaddress, pool_key, framedipaddress)
                                                      ) ENGINE=InnoDB;
                                                      
                                                      
                                                      #
                                                      # Table structure for table 'nas'
                                                      #
                                                      CREATE TABLE nas (
                                                        id int(10) NOT NULL auto_increment,
                                                        nasname varchar(128) NOT NULL,
                                                        shortname varchar(32),
                                                        type varchar(30) DEFAULT 'other',
                                                        ports int(5),
                                                        secret varchar(60) DEFAULT 'secret' NOT NULL,
                                                        server varchar(64),
                                                        community varchar(50),
                                                        description varchar(200) DEFAULT 'RADIUS Client',
                                                        PRIMARY KEY (id),
                                                        KEY nasname (nasname)
                                                      );
                                                      
                                                      
                                                      #
                                                      # WiMAX Table structure for table 'wimax',
                                                      # which replaces the "radpostauth" table.
                                                      #
                                                      
                                                      CREATE TABLE wimax (
                                                        id int(11) NOT NULL auto_increment,
                                                        username varchar(64) NOT NULL default '',
                                                        authdate timestamp NOT NULL,
                                                        spi varchar(16) NOT NULL default '',
                                                        mipkey varchar(400) NOT NULL default '',
                                                        lifetime int(12) default NULL,
                                                        PRIMARY KEY  (id),
                                                        KEY username (username),
                                                        KEY spi (spi)
                                                      ) ;
                                                      
                                                      

                                                      FreeRadius
                                                      After that, go back to your FreeRadius web interface, In SQL tab, enable the SQL support and change the following items.
                                                      Enable SQL Support  –> Check
                                                      Enable SQL Authorization  --> Enable
                                                      Enable SQL Accounting  --> Enable
                                                      Enable SQL Session  --> Enable
                                                      Enable SQL Post-Auth  --> Enable
                                                      Server IP Address --> A.B.C.D
                                                      Database Password  --> PASSWORD

                                                      TEST
                                                      To test Freeradius work or not, follow the step in Freeradius doc (http://doc.pfsense.org/index.php/FreeRADIUS_2.x_package)
                                                      Once you receiving the following msg

                                                      rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=1, length=20
                                                      

                                                      Check the 'radpostauth' table, if you find the record like this:

                                                      15	test	test	Access-Accept	2012-01-17 20:21:04
                                                      

                                                      All right, your FreeRadius is now connecting to MySQL.
                                                      :)

                                                      1 Reply Last reply Reply Quote 0
                                                      • N
                                                        Nachtfalke last edited by

                                                        @gigg:

                                                        Hi Guys,

                                                        i have decided to see if I can replace another solution we using with a Pfsense Captive portal and a Psfense Radius solution. But, I follow the instructions on the Radius documentation, but the first hiccup I have is that i dont have the option to even install the package.

                                                        In pfsense 2.x go to System => Packages => Available Packages and click on the + behind freeradius2.
                                                            After Installation go to Services => FreeRADIUS

                                                        Am I blind or is the package option just not on the 2.0.1 menu? :)

                                                        Regards,

                                                        Gigg

                                                        Hi Gigg,

                                                        freeradius2 package is available for i386 and amd64, pfsense 2.0 and 2.0.1. I could just try on server with a HDD. I used the .iso images and installed pfsense.
                                                        Not sure if this package is available (by default) for nanobsd and other system.

                                                        @zlyzwy
                                                        Great to hear and to read this :D
                                                        I would like to implement this how-to (copy and paste) to my pfsense documentation - makeing a copyright to your name and linking to this post. Is that ok ? It is a very detailed how-to and I think it is exactly what we need :)

                                                        Further I tested with Plain-MAC-Auth an CP. At first: It is working as it should and you have different possibilities:

                                                        1.) If you want to use Plain-MAC-Auth from pfSense GUI then you should do the following:

                                                        • Go to CP and enable "Enable RADIUS MAC authentication"
                                                        • Enter any shared secret you like in the field below. This is NOT the shared secret which is used for the communication between NAS(CP) and freeRADIUS.
                                                        • the "MAC address format" you do not need to change. The "correct" setting would be "11-22-33-44-55-66" but this is not important because freeradius converts all MAC addresses formats to this format.
                                                        • enter the mac address in freeradius "MACs" in this format: 11-22-33-aa-bb-33

                                                        Thats all. Browse the web and you will be connected. System Log and Portal Auth show this:
                                                        Systemlog:

                                                        radiusd[33247]: Login OK: [00-04-23-5c-9d-19/blaaa] (from client pfsense port 2 cli 00-04-23-5c-9d-19)
                                                        

                                                        Portal Auth:

                                                        logportalauth[14855]: MACHINE LOGIN: 00-04-23-5c-9d-19, 00:04:23:5c:9d:19, 192.168.0.88
                                                        

                                                        2.) If you do NOT want to use Plain-MAC-Auth from pfsense GUI you can disable that.

                                                        • Go to pfsense GUI "Users" and add a user with username "00-04-23-5c-9d-19" - that is the MAC-address and as password choose the password from the CP (schared secret). In my case it was "blaaa".
                                                          CP is converting the MAC to the username field and adds the "shared secret" as the password field.

                                                        I will try to explain it a little bit more in detail and post it in my documentation - but now I will go out to dinner - it's my brothers birthday today :)

                                                        1 Reply Last reply Reply Quote 0
                                                        • N
                                                          Nachtfalke last edited by

                                                          Updates pkg v1.5.3;

                                                          • Added: Limit Bandwidth (WISPr-Bandwidth-Max-Down/WISPr-Bandwidth-Max-Up)

                                                          • Modified: Rearranged options GUI for "users" a little bit

                                                          • Fixed: Simultenous-Use isn't a "requiered" field anymore. If set to 1 and in CP "reauthenticate every minute" was checked it leads to a "multiconnect"/discoonect. Further if CP gets restarted and user wasn't disconnected before there is as well a "multiconnect"

                                                          • Fixed: CP does not know ChilliSpot attribute so I choose "Acct-x-octets" in "reply-name"

                                                          • Added: There are now the same CHECK-ITEMS and REPLY-ITEMS available for Plain-MAC-Auth as for 802.1X auth (users/macs)

                                                          • Updated: pfsense documentation (Plain-MAC-Auth and Plain-MAC-Auth as 802.1X request with Captive Portal) and (Limit Bandwidth)

                                                          1 Reply Last reply Reply Quote 0
                                                          • Z
                                                            zlyzwy last edited by

                                                            @zlyzwy
                                                            Great to hear and to read this
                                                            I would like to implement this how-to (copy and paste) to my pfsense documentation - makeing a copyright to your name and linking to this post. Is that ok ? It is a very detailed how-to and I think it is exactly what we need

                                                            No problem at all. I am glad it's helpful..:)

                                                            1.) If you want to use Plain-MAC-Auth from pfSense GUI then you should do the following:

                                                            • Go to CP and enable "Enable RADIUS MAC authentication"
                                                            • Enter any shared secret you like in the field below. This is NOT the shared secret which is used for the communication between NAS(CP) and freeRADIUS.
                                                            • the "MAC address format" you do not need to change. The "correct" setting would be "11-22-33-44-55-66" but this is not important because freeradius converts all MAC addresses formats to this format.
                                                            • enter the mac address in freeradius "MACs" in this format: 11-22-33-aa-bb-33

                                                            Thanks for your explanation.
                                                            I've got a bit confused about 'shared secret', as your explained there should have two 'shared secret'. The first one is for communication with client and CP. But what's the purpose for second one? Can I fill the same value as the first one? In fact I was thinking they should be same.
                                                            The MAC format I used is '00:11:22:33:44:55', but you mentioned it's not important then it should not be the problem.

                                                            Anyway, I will give a try again with your procedures.

                                                            BTW: I can't see the v1.5.3 update pkg in 'installed packages'.

                                                            Update:
                                                            Now I can see the v1.5.3 pkg and it's great…

                                                            @Nachtfalke

                                                            I just tested with latest pkg,here comes some new questions>>
                                                            1. Plain-MAC-Auth
                                                            I followed your procedures, it doesn't work proerly. The error log is

                                                            Jan 18 19:59:40	radiusd[36524]: Login incorrect: [00-02-a5-4e-df-67] (from client CP port 210 cli 00-02-a5-4e-df-67)
                                                            

                                                            I enable the PLAIN MAC AUTHORIZATION (FreeRadius–>Setting Tab), and it does solve the problem.

                                                            Jan 18 20:46:45	radiusd[63046]: Login OK: [00-02-a5-4e-df-67] (from client CP port 45 cli 00-02-a5-4e-df-67)
                                                            

                                                            I don't know why but it's working anyway:)

                                                            2. Virtual machine in VMware MAC Auth
                                                            I have a small server running VMware workstation. The host computer is a windows 2003 server. It's running well until I enable the CP, I add the server's MAC to pass list and the server works as it should be,but not for the virtual server inside VM. I tired to put the VM's MAC to pass list. it's not working. I am receiving the following error from system log:

                                                            Jan 18 20:46:45	radiusd[63046]: Login OK: [00-02-a5-4e-df-67] (from client CP port 45 cli 00-02-a5-4e-df-67)
                                                            Jan 18 20:46:45	radiusd[63046]: Login OK: [00-02-a5-4e-df-67] (from client CP port 45 cli 00-02-a5-4e-df-67)
                                                            Jan 18 20:46:45	radiusd[63046]: rlm_radutmp: Login entry for NAS CP port 45 wrong order
                                                            Jan 18 20:46:45	radiusd[63046]: rlm_radutmp: Login entry for NAS CP port 45 wrong order
                                                            

                                                            00-02-a5-4e-df-67 –> Host Computer
                                                            There is one strange thing, usually if my virtual server ask the outgoing traffic, there should have the log with MAC. So I can add that MAC to pass list. But I didn't see any log with that MAC.
                                                            I also tried to set "Number of simultaneous connections" to 10, no luck...

                                                            BTW: there are two virtual servers running in VMwork, one is Debian and another is PFsense itself. I am not sure if it's the reason for this issue. I think this picture will show you my network better than words.
                                                            (http://www.gliffy.com/pubdoc/2737259/L.png)

                                                            3. Maximum Download Bandwidth/Maximum Upload Bandwidth
                                                            I have a 20m/s ADSL at home. I tested with 800 bit/s and 800000bit/s. There should have a obvious difference. However they give the similar result here(around 20m/s).

                                                            I am afraid I may put too many requests here.
                                                            Many thanks for your help!

                                                            1 Reply Last reply Reply Quote 0
                                                            • N
                                                              Nachtfalke last edited by

                                                              @zlyzwy

                                                              The shared secret you enter on CaptivePortal in section "Primary RADIUS server" is the password which is for communication between CP as NAS and the freeRADIUS server. This shared secret you have to enter and match the shared secret you enter in FreeRADIUS -> NAS/Clients

                                                              The shared secret you have to enter on chapter "RADIUS MAC authentication" is the user password. This is a little bit unclear on Captive Portal. This shared secret you have to enter in FreeRADIUS -> Users

                                                              pkg v.1.5.3 should be available now. When I am updating this post I pushed the changes on github but then we need to wait until some of the core teams is merging it. In general this takes not much time :-)

                                                              1 Reply Last reply Reply Quote 0
                                                              • Z
                                                                zlyzwy last edited by

                                                                @Nachtfalke:

                                                                The shared secret you have to enter on chapter "RADIUS MAC authentication" is the user password. This is a little bit unclear on Captive Portal. This shared secret you have to enter in FreeRADIUS -> Users

                                                                @Nachtfalke

                                                                I am sorry I can't understand this part. If it's really as you said, then all the users must use one password since there is only one shared secret in CP? Or we can only create one user?

                                                                1 Reply Last reply Reply Quote 0
                                                                • N
                                                                  Nachtfalke last edited by

                                                                  @zlyzwy:

                                                                  @Nachtfalke:

                                                                  The shared secret you have to enter on chapter "RADIUS MAC authentication" is the user password. This is a little bit unclear on Captive Portal. This shared secret you have to enter in FreeRADIUS -> Users

                                                                  @Nachtfalke

                                                                  I am sorry I can't understand this part. If it's really as you said, then all the users must use one password since there is only one shared secret in CP? Or we can only create one user?

                                                                  That's correct. All Users have the same password (shared secret).

                                                                  But that's no problem. Think about that: The host should be authorized by its MAC address. Now we can only send the Calling-Station-ID to freeRADIUS server and then freeRADIUS must be able to handle ONLY Calling-Station-ID and authorize or block the user. But before I enabled Plain-MAC-Auth ability on freeRADIUS the RADIUS server only accepted 802.1X (username + password).
                                                                  That's the reason why we are able to configure captive portal to send the MAC address as username and a password - that's our shared secret.

                                                                  So username(mac address) is different but password(shared secret) is always the same.

                                                                  If you have questions, just ask. Perhaps I am just not able to explain it in a way to make it clear :D

                                                                  1 Reply Last reply Reply Quote 0
                                                                  • G
                                                                    gigg last edited by

                                                                    Hi Guyd,

                                                                    Can you tell me what version of pfsense you using. Mine does not have a packages option under systems and I cant load the radius option.

                                                                    Thx

                                                                    1 Reply Last reply Reply Quote 0
                                                                    • marcelloc
                                                                      marcelloc last edited by

                                                                      @gigg:

                                                                      Hi Guyd,

                                                                      Can you tell me what version of pfsense you using. Mine does not have a packages option under systems and I cant load the radius option.

                                                                      Thx

                                                                      pfsense 2.0.1 full install x64
                                                                      pfsense 2.0.1 full install i386

                                                                      Treinamentos de Elite: http://sys-squad.com

                                                                      Help a community developer! ;D

                                                                      1 Reply Last reply Reply Quote 0
                                                                      • M
                                                                        Metu69salemi last edited by

                                                                        Shared secret is used between radius server and device, which is using radius server. it's another layer of security. This has nothing todo with user passwords

                                                                        1 Reply Last reply Reply Quote 0
                                                                        • N
                                                                          Nachtfalke last edited by

                                                                          Updates pkg v1.5.4:

                                                                          • Added: Checks if a function or a part of it needs to be run (when disabled from GUI). This should speed up the starting process of freeradius after reboot.

                                                                          • Fixed: Accidentally deleted certs in ../raddb/certs/ folder after reboot when using pfSense Cert-Manager - this break freeRADIUS start until clicking save in EAP again.

                                                                          === edit ===

                                                                          • Fixed: call some functions after installation to initialize configuration files.

                                                                          @Metu69salemi:

                                                                          Shared secret is used between radius server and device, which is using radius server. it's another layer of security. This has nothing todo with user passwords

                                                                          What you say is absolutly correct - in general.
                                                                          Captive Portal is using the name "shared secret" on two places. In Primary RADIUS server it is used in the correct context.
                                                                          In RADIUS MAC authentication it is not the correct context I would say. This is explained one line below:

                                                                          If this option is enabled, the captive portal will try to authenticate users by sending their MAC address as the username and the password entered below to the RADIUS server.

                                                                          1 Reply Last reply Reply Quote 0
                                                                          • M
                                                                            Metu69salemi last edited by

                                                                            @Nachtfalke:

                                                                            Updates pkg v1.5.4:

                                                                            • Added: Checks if a function or a part of it needs to be run (when disabled from GUI). This should speed up the starting process of freeradius after reboot.

                                                                            • Fixed: Accidentally deleted certs in ../raddb/certs/ folder after reboot when using pfSense Cert-Manager - this break freeRADIUS start until clicking save in EAP again.

                                                                            @Metu69salemi:

                                                                            Shared secret is used between radius server and device, which is using radius server. it's another layer of security. This has nothing todo with user passwords

                                                                            What you say is absolutly correct - in general.
                                                                            Captive Portal is using the name "shared secret" on two places. In Primary RADIUS server it is used in the correct context.
                                                                            In RADIUS MAC authentication it is not the correct context I would say. This is explained one line below:

                                                                            If this option is enabled, the captive portal will try to authenticate users by sending their MAC address as the username and the password entered below to the RADIUS server.

                                                                            Ok thank you for info

                                                                            1 Reply Last reply Reply Quote 0
                                                                            • Z
                                                                              zlyzwy last edited by

                                                                              Hi guys,

                                                                              Thanks for all your patents and detail explanation…
                                                                              To be honest, I am still not 100% understand this part, but I will need some test on it.

                                                                              Can you take a look at the following questions?

                                                                              @zlyzwy:

                                                                              Update:
                                                                              Now I can see the v1.5.3 pkg and it's great…

                                                                              @Nachtfalke

                                                                              I just tested with latest pkg,here comes some new questions>>
                                                                              1. Plain-MAC-Auth
                                                                              I followed your procedures, it doesn't work proerly. The error log is

                                                                              Jan 18 19:59:40	radiusd[36524]: Login incorrect: [00-02-a5-4e-df-67] (from client CP port 210 cli 00-02-a5-4e-df-67)
                                                                              

                                                                              I enable the PLAIN MAC AUTHORIZATION (FreeRadius–>Setting Tab), and it does solve the problem.

                                                                              Jan 18 20:46:45	radiusd[63046]: Login OK: [00-02-a5-4e-df-67] (from client CP port 45 cli 00-02-a5-4e-df-67)
                                                                              

                                                                              I don't know why but it's working anyway:)

                                                                              2. Virtual machine in VMware MAC Auth
                                                                              I have a small server running VMware workstation. The host computer is a windows 2003 server. It's running well until I enable the CP, I add the server's MAC to pass list and the server works as it should be,but not for the virtual server inside VM. I tired to put the VM's MAC to pass list. it's not working. I am receiving the following error from system log:

                                                                              Jan 18 20:46:45	radiusd[63046]: Login OK: [00-02-a5-4e-df-67] (from client CP port 45 cli 00-02-a5-4e-df-67)
                                                                              Jan 18 20:46:45	radiusd[63046]: Login OK: [00-02-a5-4e-df-67] (from client CP port 45 cli 00-02-a5-4e-df-67)
                                                                              Jan 18 20:46:45	radiusd[63046]: rlm_radutmp: Login entry for NAS CP port 45 wrong order
                                                                              Jan 18 20:46:45	radiusd[63046]: rlm_radutmp: Login entry for NAS CP port 45 wrong order
                                                                              

                                                                              00-02-a5-4e-df-67 –> Host Computer
                                                                              There is one strange thing, usually if my virtual server ask the outgoing traffic, there should have the log with MAC. So I can add that MAC to pass list. But I didn't see any log with that MAC.
                                                                              I also tried to set "Number of simultaneous connections" to 10, no luck...

                                                                              BTW: there are two virtual servers running in VMwork, one is Debian and another is PFsense itself. I am not sure if it's the reason for this issue. I think this picture will show you my network better than words.
                                                                              (http://www.gliffy.com/pubdoc/2737259/L.png)

                                                                              3. Maximum Download Bandwidth/Maximum Upload Bandwidth
                                                                              I have a 20m/s ADSL at home. I tested with 800 bit/s and 800000bit/s. There should have a obvious difference. However they give the similar result here(around 20m/s).

                                                                              I am afraid I may put too many requests here.
                                                                              Many thanks for your help!

                                                                              Thanks in advance!

                                                                              1 Reply Last reply Reply Quote 0
                                                                              • N
                                                                                Nachtfalke last edited by

                                                                                @zlyzwy:

                                                                                (…)
                                                                                @Nachtfalke

                                                                                I just tested with latest pkg,here comes some new questions>>
                                                                                1. Plain-MAC-Auth
                                                                                I followed your procedures, it doesn't work proerly. The error log is

                                                                                Jan 18 19:59:40	radiusd[36524]: Login incorrect: [00-02-a5-4e-df-67] (from client CP port 210 cli 00-02-a5-4e-df-67)
                                                                                

                                                                                I enable the PLAIN MAC AUTHORIZATION (FreeRadius–>Setting Tab), and it does solve the problem.

                                                                                Jan 18 20:46:45	radiusd[63046]: Login OK: [00-02-a5-4e-df-67] (from client CP port 45 cli 00-02-a5-4e-df-67)
                                                                                

                                                                                I don't know why but it's working anyway:)

                                                                                First I am sorry. I didn't see that you updated your post ;-)
                                                                                First it is good that Plain-MAC-Auth is working :)
                                                                                Second:
                                                                                Disable Plain-MAC-Auth and put this in "FreeRADIUS -> Users tab"
                                                                                Username:  00-02-a5-4e-df-67
                                                                                Password:    (The shared secret from Captive Portal below the point "Enable MAC authorization)
                                                                                Delete the entry in "FreeRADIUS -> MACs" with this MAC address: 00-02-a5-4e-df-67

                                                                                Then it should work.

                                                                                @zlyzwy:

                                                                                2. Virtual machine in VMware MAC Auth
                                                                                I have a small server running VMware workstation. The host computer is a windows 2003 server. It's running well until I enable the CP, I add the server's MAC to pass list and the server works as it should be,but not for the virtual server inside VM. I tired to put the VM's MAC to pass list. it's not working. I am receiving the following error from system log:

                                                                                Jan 18 20:46:45	radiusd[63046]: Login OK: [00-02-a5-4e-df-67] (from client CP port 45 cli 00-02-a5-4e-df-67)
                                                                                Jan 18 20:46:45	radiusd[63046]: Login OK: [00-02-a5-4e-df-67] (from client CP port 45 cli 00-02-a5-4e-df-67)
                                                                                Jan 18 20:46:45	radiusd[63046]: rlm_radutmp: Login entry for NAS CP port 45 wrong order
                                                                                Jan 18 20:46:45	radiusd[63046]: rlm_radutmp: Login entry for NAS CP port 45 wrong order
                                                                                

                                                                                00-02-a5-4e-df-67 –> Host Computer
                                                                                There is one strange thing, usually if my virtual server ask the outgoing traffic, there should have the log with MAC. So I can add that MAC to pass list. But I didn't see any log with that MAC.
                                                                                I also tried to set "Number of simultaneous connections" to 10, no luck...

                                                                                BTW: there are two virtual servers running in VMwork, one is Debian and another is PFsense itself. I am not sure if it's the reason for this issue. I think this picture will show you my network better than words.
                                                                                (http://www.gliffy.com/pubdoc/2737259/L.png)

                                                                                Uuuhh..hmm..I am out of ideas why this is happening. But to make it clear "rlm_radutmp" is containing all clients which are authorized. This is the file which checks for "Simultaneous-Use". You increased the "Simultaneous-Use" - that is what I had told you, too. Check again that there is not a double entry in "MACs" and "Users" with this MAC address: 00-02-a5-4e-df-67.

                                                                                @zlyzwy:

                                                                                3. Maximum Download Bandwidth/Maximum Upload Bandwidth
                                                                                I have a 20m/s ADSL at home. I tested with 800 bit/s and 800000bit/s. There should have a obvious difference. However they give the similar result here(around 20m/s).

                                                                                I read about this behaviour on some forum posts. It has something to do with that CP is only changing bandwidth for users which authenticate new. It doesn't change this for existing connections.
                                                                                When I tested this at home I found out that you have to enable "Bandwidth Limits" on CP first. You can enter a value but if you set a setting on FreeRADIUS then the value of the CP will be overwritten (that's what we want). And then I am not sure if there is the same bug in this function as with "amount of traffic". The traffic which goes through CP is for example 1MB but accounting will tell RADIUS that there are 6MB. Not sure if this affects Bandwidth Limits in any way, too.
                                                                                So I am sorry but I could not tell you where the problem for Bandwidth Limits is. Need to test this more and find out which checkboxes on CP I need to enable and which services needs to be restartet.

                                                                                @zlyzwy:

                                                                                I am afraid I may put too many requests here.
                                                                                Many thanks for your help!

                                                                                Thats no problem - for me :-)

                                                                                1 Reply Last reply Reply Quote 0
                                                                                • P
                                                                                  pszafer last edited by

                                                                                  do You have any other materials about freeradius and AD without samba?
                                                                                  I cannot find anything else and trully I am tired of doing same thing again and again and don't have chance to get it working properly :/

                                                                                  1 Reply Last reply Reply Quote 0
                                                                                  • N
                                                                                    Nachtfalke last edited by

                                                                                    @pszafer:

                                                                                    do You have any other materials about freeradius and AD without samba?
                                                                                    I cannot find anything else and trully I am tired of doing same thing again and again and don't have chance to get it working properly :/

                                                                                    I am sorry. I don't have any how-tos or tutorial and I do not have access to any AD :(

                                                                                    But correct me if I am wrong: You got it working with PAP ?
                                                                                    If yes, can you please write down what you have configured - I would like to add it to the pfsense docs so this could be a basis for someone else who wants to try this - or for further if freeradius adds better support for connecting to an AD.

                                                                                    1 Reply Last reply Reply Quote 0
                                                                                    • First post
                                                                                      Last post