next »

[Nachtfalke]

This could/should be the offical thread for the new freeRADIUS 2.x package.
At the moment it is ALPHA status and based on the freeRADIUS 1.1.8 package. There are just some radiusd.conf syntax fixes to fit the freeRADIU2 syntax.

This package is based on freeRADIUS 2.1.12.

In the future there should be more options configurable from the GUI and some reorganisation of the .inc and .xml files.

ATTENTION:
At the moment the packages freeradius and freeradius2 are using the same config files. Please do not install both at the same time and please do not use on productiv systems before you save your config.

Feedback would be nice because I could not test this package till now. So feedback to hopfully working basic options would be nice, too.

I will update this thread in the future.

[ptt]

ATTENTION:
At the moment the packages freeradius and freeradius2 are using the same config files. Please do not install both at the same time and please do not use on productiv systems before you save your config.

Just one small cosmetic thing, change your "warning" to: please do not use in production systems

[Nachtfalke]

Strange - I could not modify my post.
But I changed the description on the package GUI of pfsense ;o)

I am sure there will be further mistakes in the future but english isn't my native language.

[ptt]

New FreeRadius2 doesn't start, in system logs i get this:

Code:

Dec 5 19:15:32 php: : Not calling package sync code for dependency freeradiussettings of freeradius2 because some include files are missing.
Dec 5 19:15:32 php: : Not calling package sync code for dependency freeradiusclients of freeradius2 because some include files are missing.
Dec 5 19:15:30 php: : Restarting/Starting all packages.

But the old FreeRadius version starts OK

[Nachtfalke]

I have got these problems on freeradius and freeradius2.
But only after reboot of pfsense.
I pushed a fix for freeradius2.

Try with package version 0.3

[Nachtfalke]

I updated freeradius2 from 0.3 ALPHA up to 1.0 BETA.

The freeradius2 package should now have all the features that freeradius has and some improvements.

New freeradius2 features:

• IPv6 for clients and listening interfaces
• select different interfaces for different tasks (auth, acct, proxy, status, detail, CoA)
• additional parameters added in settings
• enable server to run in threaded mode

[gionag]

hello,
I wanted to understand how to implement freeradius2 of a system that works with version 1.

Uninstalled the previous version and then installed version 2 the applications that worked now no longer work. Specifically, the authentication for openvpn road warriors no longer works. A log level I do not see things very useful. Just somthing about "0 packets in queue".

What are the steps to authenticate freeradius2 of openvpn? I have to do something different?

Summing up I set like this:

Services -> "freeradius"

User: test pass: test
NAS: 192.168.1.1 (ip of the router), ShortNome: pfSense, secret: testing

under "users" -> "server"
RADIUS: 192.168.1.1
Secret: test
description : Local Radius Server

under "openvpn"
Selected > Local Radius server


I've done something wrong?

thanks

(pfsense 2.0)

[Nachtfalke]

Hi,

I do not know, how to use OpenVPN RoadWarrior with RADIUS. Is there any tutorial ?
Generally I didn't change much in the background.

In the users tab I didn't change anything
The settings tab is the same as before just some different syntax for logging and some additional parameters but they are all at default.
In the client tab I had to change the syntax of the clients.conf to new freeradius2 version but the parameters are still the same.

Where I did many changes is the "interfaces" tab.
If you have one Interface (LAN) which should do authentication and accounting than you need two entries:

Interface IP: 192.168.100.1
Port: 1812
type: auth

Interface IP: 192.168.100.1
Port: 1813
type: acct

If radius should listen on any interface than you can use a  *  instead of the IP.
Not sure if   *   is listening on 127.0.0.1


PS: Further it would/could help if you delete all freeradius entries from your config.xml

Code:

/conf/config.xml

and reboot and reconfigure freeradius2.

Your old settings from freeradius1 are NOT compatible with freeradius2

[gionag]

also installed in a fresh installed system...
same problem

used * insted of the real ip...

Still testing

[Nachtfalke]

Hi,

I read short through this:
http://doc.pfsense.org/index.php/Using_OpenVPN_With_FreeRADIUS
This needs PAM authentication as far as I understand this.

I took a look at

Code:

/usr/local/pkg/freeradius.inc

And changed line 432:

Code:

#pam

to this line:

Code:

pam

Save the file and then go to the freeRADIUS GUI -> Settings -> Save and try again.

[Nachtfalke]

Hi,

I tested the freeRADIUS2 package with this tool:
http://www.novell.com/coolsolutions/tools/14377.html

The problem is the freeRADIUS. I think there are some bigger changes in module handling in the new radiusd.conf. We need to enable/link to the modules listed in the /usr/local/etc/raddb/sites-enabled/ directory.
In the old freeRADIUS 1.x configuration the modules were configured only in radiud.conf.
FreeRADIUS is starting and listening on requests but there seems to be no "Auth-type" selected so that the request could not be used with and authorization module.

If someone could/would fix that - don't hesitate. I will try as far as I found time. Next week I am on vacation and I think I will find some time to work on this problem and hopefully fix it.

[Nachtfalke]

@gionag
I could reproduce this error.
There was a bug in creating the "users" file. I think I fixed this so it should now authenticate fine.


Additional changes pkg v1.1.0 Beta:

• Added some code which prevents that freeradius service isn't starting if interface typ is "detail"
• Swaped authorize, authenticate, ... sections from radiusd.conf to the correct place (/usr/local/etc/raddb/sites-enabled/default && /usr/local/etc/raddb/sites-enabled/inner-tunnel)

[Nachtfalke]

Updates: pkg v1.1.1:

• disabled virtual-server "control-socket" which is experimental and if misconfigured a security issue
• disabled module proxy because in most environments we do not need to proxy requests to another RADIUS PROXY server

[Nachtfalke]

Updates: pkg v1.2.0

• Added GUI to configure eap.conf (EAP, EAP-TLS, EAP-TLS with OCSP support, EAP-TTLS, EAP-PEAP with MSCHAPv2

The GUI contains the by default "uncommented" options in the eap.conf

This authentication methods were tested and work:

• PAP
• CHAP
• MSCHAP
• EAP-MD5

Added "CDATA" for all <description> parts in .XML files.

[Nachtfalke]

Updates: pkg v1.3.0

• Added GUI to configure sql.conf
• Just some small typo/cosmetic GUI fixes

--- edit ---
The GUI is working but I found out that the precompiled freeradius-2.1.12 package is not compiled with MySQL, PostgreSQL.
So there are modules (rlm_sql) missing. We need to build a package from source with additional build_options to support these features.
Help would be appreciated!

Further I would like to have LDAP and KERBEROS support so that we can build a GUI for connecting to LDAP and/or AD.