pfSense Gold Subscription

Author Topic: NEW Package: freeRADIUS 2.x  (Read 105119 times)

0 Members and 1 Guest are viewing this topic.

Offline Nachtfalke

  • Hero Member
  • *****
  • Posts: 2753
  • Karma: +0/-0
    • View Profile
NEW Package: freeRADIUS 2.x
« on: December 05, 2011, 06:37:42 am »
This could/should be the offical thread for the new freeRADIUS 2.x package.
At the moment it is ALPHA status and based on the freeRADIUS 1.1.8 package. There are just some radiusd.conf syntax fixes to fit the freeRADIU2 syntax.

This package is based on freeRADIUS 2.1.12.

In the future there should be more options configurable from the GUI and some reorganisation of the .inc and .xml files.

ATTENTION:
At the moment the packages freeradius and freeradius2 are using the same config files. Please do not install both at the same time and please do not use on productiv systems before you save your config.

Feedback would be nice because I could not test this package till now. So feedback to hopfully working basic options would be nice, too.

I will update this thread in the future.

Offline ptt

  • Hero Member
  • *****
  • Posts: 1127
  • Karma: +0/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #1 on: December 05, 2011, 08:24:48 am »
ATTENTION:
At the moment the packages freeradius and freeradius2 are using the same config files. Please do not install both at the same time and please do not use on productiv systems before you save your config.

Just one small cosmetic thing, change your "warning" to: please do not use in production systems

Offline Nachtfalke

  • Hero Member
  • *****
  • Posts: 2753
  • Karma: +0/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #2 on: December 05, 2011, 02:49:00 pm »
Strange - I could not modify my post.
But I changed the description on the package GUI of pfsense ;o)

I am sure there will be further mistakes in the future but english isn't my native language.

Offline ptt

  • Hero Member
  • *****
  • Posts: 1127
  • Karma: +0/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #3 on: December 05, 2011, 04:41:40 pm »
New FreeRadius2 doesn't start, in system logs i get this:

Code: [Select]
Dec 5 19:15:32 php: : Not calling package sync code for dependency freeradiussettings of freeradius2 because some include files are missing.
Dec 5 19:15:32 php: : Not calling package sync code for dependency freeradiusclients of freeradius2 because some include files are missing.
Dec 5 19:15:30 php: : Restarting/Starting all packages.

But the old FreeRadius version starts OK

Offline Nachtfalke

  • Hero Member
  • *****
  • Posts: 2753
  • Karma: +0/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #4 on: December 06, 2011, 07:12:32 am »
I have got these problems on freeradius and freeradius2.
But only after reboot of pfsense.
I pushed a fix for freeradius2.

Try with package version 0.3

Offline Nachtfalke

  • Hero Member
  • *****
  • Posts: 2753
  • Karma: +0/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #5 on: December 10, 2011, 06:19:53 pm »
I updated freeradius2 from 0.3 ALPHA up to 1.0 BETA.

The freeradius2 package should now have all the features that freeradius has and some improvements.

New freeradius2 features:
  • IPv6 for clients and listening interfaces
  • select different interfaces for different tasks (auth, acct, proxy, status, detail, CoA)
  • additional parameters added in settings
  • enable server to run in threaded mode

Offline gionag

  • Newbie
  • *
  • Posts: 5
  • Karma: +0/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #6 on: December 13, 2011, 03:19:15 am »
hello,
I wanted to understand how to implement freeradius2 of a system that works with version 1.

Uninstalled the previous version and then installed version 2 the applications that worked now no longer work. Specifically, the authentication for openvpn road warriors no longer works. A log level I do not see things very useful. Just somthing about "0 packets in queue".

What are the steps to authenticate freeradius2 of openvpn? I have to do something different?

Summing up I set like this:

Services -> "freeradius"

User: test pass: test
NAS: 192.168.1.1 (ip of the router), ShortNome: pfSense, secret: testing

under "users" -> "server"
RADIUS: 192.168.1.1
Secret: test
description : Local Radius Server

under "openvpn"
Selected > Local Radius server


I've done something wrong?

thanks

(pfsense 2.0)

Offline Nachtfalke

  • Hero Member
  • *****
  • Posts: 2753
  • Karma: +0/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #7 on: December 13, 2011, 05:53:04 am »
Hi,

I do not know, how to use OpenVPN RoadWarrior with RADIUS. Is there any tutorial ?
Generally I didn't change much in the background.

In the users tab I didn't change anything
The settings tab is the same as before just some different syntax for logging and some additional parameters but they are all at default.
In the client tab I had to change the syntax of the clients.conf to new freeradius2 version but the parameters are still the same.

Where I did many changes is the "interfaces" tab.
If you have one Interface (LAN) which should do authentication and accounting than you need two entries:

Interface IP: 192.168.100.1
Port: 1812
type: auth

Interface IP: 192.168.100.1
Port: 1813
type: acct

If radius should listen on any interface than you can use a  *  instead of the IP.
Not sure if   *   is listening on 127.0.0.1


PS: Further it would/could help if you delete all freeradius entries from your config.xml
Code: [Select]
/conf/config.xmland reboot and reconfigure freeradius2.

Your old settings from freeradius1 are NOT compatible with freeradius2

Offline gionag

  • Newbie
  • *
  • Posts: 5
  • Karma: +0/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #8 on: December 13, 2011, 06:32:30 am »
also installed in a fresh installed system...
same problem

used * insted of the real ip...

Still testing

Offline Nachtfalke

  • Hero Member
  • *****
  • Posts: 2753
  • Karma: +0/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #9 on: December 13, 2011, 07:30:33 am »
Hi,

I read short through this:
http://doc.pfsense.org/index.php/Using_OpenVPN_With_FreeRADIUS
This needs PAM authentication as far as I understand this.

I took a look at
Code: [Select]
/usr/local/pkg/freeradius.incAnd changed line 432:
Code: [Select]
#pamto this line:
Code: [Select]
pam
Save the file and then go to the freeRADIUS GUI -> Settings -> Save and try again.

Offline Nachtfalke

  • Hero Member
  • *****
  • Posts: 2753
  • Karma: +0/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #10 on: December 15, 2011, 06:10:36 am »
Hi,

I tested the freeRADIUS2 package with this tool:
http://www.novell.com/coolsolutions/tools/14377.html

The problem is the freeRADIUS. I think there are some bigger changes in module handling in the new radiusd.conf. We need to enable/link to the modules listed in the /usr/local/etc/raddb/sites-enabled/ directory.
In the old freeRADIUS 1.x configuration the modules were configured only in radiud.conf.
FreeRADIUS is starting and listening on requests but there seems to be no "Auth-type" selected so that the request could not be used with and authorization module.

If someone could/would fix that - don't hesitate. I will try as far as I found time. Next week I am on vacation and I think I will find some time to work on this problem and hopefully fix it.

Offline Nachtfalke

  • Hero Member
  • *****
  • Posts: 2753
  • Karma: +0/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #11 on: December 15, 2011, 04:02:24 pm »
@gionag
I could reproduce this error.
There was a bug in creating the "users" file. I think I fixed this so it should now authenticate fine.


Additional changes pkg v1.1.0 Beta:
  • Added some code which prevents that freeradius service isn't starting if interface typ is "detail"
  • Swaped authorize, authenticate, ... sections from radiusd.conf to the correct place (/usr/local/etc/raddb/sites-enabled/default && /usr/local/etc/raddb/sites-enabled/inner-tunnel)
« Last Edit: December 15, 2011, 04:04:59 pm by Nachtfalke »

Offline Nachtfalke

  • Hero Member
  • *****
  • Posts: 2753
  • Karma: +0/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #12 on: December 16, 2011, 09:36:48 am »
Updates: pkg v1.1.1:
  • disabled virtual-server "control-socket" which is experimental and if misconfigured a security issue
  • disabled module proxy because in most environments we do not need to proxy requests to another RADIUS PROXY server

Offline Nachtfalke

  • Hero Member
  • *****
  • Posts: 2753
  • Karma: +0/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #13 on: December 18, 2011, 06:11:28 pm »
Updates: pkg v1.2.0
  • Added GUI to configure eap.conf (EAP, EAP-TLS, EAP-TLS with OCSP support, EAP-TTLS, EAP-PEAP with MSCHAPv2
The GUI contains the by default "uncommented" options in the eap.conf

This authentication methods were tested and work:
  • PAP
  • CHAP
  • MSCHAP
  • EAP-MD5

Added "CDATA" for all <description> parts in .XML files.

Offline Nachtfalke

  • Hero Member
  • *****
  • Posts: 2753
  • Karma: +0/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #14 on: December 19, 2011, 09:20:01 am »
Updates: pkg v1.3.0
  • Added GUI to configure sql.conf
  • Just some small typo/cosmetic GUI fixes

--- edit ---
The GUI is working but I found out that the precompiled freeradius-2.1.12 package is not compiled with MySQL, PostgreSQL.
So there are modules (rlm_sql) missing. We need to build a package from source with additional build_options to support these features.
Help would be appreciated!

Further I would like to have LDAP and KERBEROS support so that we can build a GUI for connecting to LDAP and/or AD.
« Last Edit: December 19, 2011, 05:08:26 pm by Nachtfalke »