The pfSense Store

Author Topic: NEW Package: freeRADIUS 2.x  (Read 105179 times)

0 Members and 1 Guest are viewing this topic.

Offline markuhde

  • Full Member
  • ***
  • Posts: 188
  • Karma: +0/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #345 on: May 21, 2012, 03:14:28 am »
Thanks, as far as I know it works, but I haven't been up to the campground this is installed at (it's about 30 miles away). I know pfSense works, I haven't got any complaints and I see users connecting. No idea, however, if my WPA2-Enterprise admin network works. I know all my setup and VLAN tagging works (because I had no issues connecting when it was WPA2-PSK).

Why all the hassle to do WPA2-Enterprise? The admin network is also the network that bypasses the proxy. I want to be able to give group leaders passwords that are removed when their group leaves in case they need to bypass SquidGuard for any reason (it is setup fairly restrictive).

On my test setup here at home, running pfSense 2.0.2-RC1, it all works great (for my demo network, which is a similar setup).

Thanks again!

Offline Rampage

  • Jr. Member
  • **
  • Posts: 46
  • Karma: +0/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #346 on: June 12, 2012, 03:04:54 am »
Hello,
sorry but i'm a bit n00b :)

i've read through this thread but i couldn't find informations about my issue.

i've configured freeRADIUS2 to run with MySQL, apparently everything seems fine as in the log i can see that it connects to the db properly without any error.

My question is, once i'm relying on mysql, i'm left on my own for managing users nas mac etc? in the mean that the pfsense webUI doesn't control them anymore if mySQL is set as abackend?

I ask this because as i can see, local users (flat file) are still authed properly by freeRADIUS, and if i add new users they are not added to the MySQL database, as it results empty.

am i missing something or is it working as intended?

Offline Nachtfalke

  • Hero Member
  • *****
  • Posts: 2754
  • Karma: +1/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #347 on: June 12, 2012, 01:28:27 pm »
Hi,

it is working as intended. Adding users on the GUI will only add users in the flat "users" file.
If you are using MySQL you will have to add them there in any other way to the database. for example you write a HTML web page or do this with some other tool or script.

Offline Rampage

  • Jr. Member
  • **
  • Posts: 46
  • Karma: +0/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #348 on: June 12, 2012, 02:53:58 pm »
ok nice, i kinda figured it out, as i'm planning to use some php to add users to the mysql database.

the problem is that as of now, by browsing the freeradius wiki, i found it extremely difficult to figure out what goes where in terms of users, limitations etc.

for instance i noticed that if i add

"testuser", "cleartest-password", ":=", "testpassword" in the radcheck table
i can perform a successful login on the captive portal.

problem is.. what if i also want to limit the usage to 1 hour per day? or eventually bandwidth? are these values also to be added to radcheck? they go in radreply?

an exhaustive list of the usable attributes would be also interesting, ok i know i'm going OT here, so maybe i should ask in the proper section of this board (if any) wiki only reports some of them, and they are not well described/explained on what they are suitable for.


Offline Nachtfalke

  • Hero Member
  • *****
  • Posts: 2754
  • Karma: +1/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #349 on: June 12, 2012, 03:58:06 pm »
Hi again,

if you add a user in GUI then this user is placed in the plain "users" file in /usr/local/etc/raddb/users
all check and reply attributes you can add from GUI will go int users file. The same is with limitations and restrictions.
Most of the features from this package aim to the "users" file.

If you are using LDAP or mysql it is up to you to configure this, add users and limitations.
This needs to be done vi console/ssh and via config files:
You can find them - depending on your database - in this folder:
Code: [Select]
/usr/local/etc/raddb/sql/
So there it is up to you to create your "SELECTs" and "QUERY". The very best place too find help - depending on this is probably the freeradius mailing list and their homepage.

Limiting bandwidth is a reply attribute - you/freeradius is telling the NAS to limit the bandwidth.
a check attribute is for example "simultaneous-use" or "expiration" - the user wnats to login and the NAS needs to check if there are limitations for this user and needs to check this.
In the GUI there are many attributes implemented - just add them and take a look at the users file to see if they are check or reply attributes.
the check attributes are on the same line as the username.
reply attributes are listed below.


attributes:
There are "unlimited" attributes. It always depends on what you NAS understands. Most NAS do have a dictionary of attributes and freeradius knows and understand these attributes. You can find them here - or you create a new one:
Code: [Select]
/usr/local/share/freeradius/dictionary.*

If you have ideas to improve the wiki - please feel free to do so. If you wrote some text - I can add this for you to the wiki. :-)

Offline markuhde

  • Full Member
  • ***
  • Posts: 188
  • Karma: +0/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #350 on: June 17, 2012, 03:59:23 pm »
Okay, well, there is now no way apparently to get FreeRadius 2.x installed on the latest builds, so I figured I'd try FreeRADIUS 1.x. I cannot, for the life of me, figure out how to get all the certificates and everything to make WPA2-Enterprise. On FreeRADIUS2, once I finally got it to start, everything "just worked" - am I missing something or is FreeRADIUX 1.x not capable of doing WPA2-Enterprise. Desperately need a solution here to get the staff network up at this campground back up and online in the latest builds.

Offline Nachtfalke

  • Hero Member
  • *****
  • Posts: 2754
  • Karma: +1/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #351 on: June 17, 2012, 05:00:26 pm »
Okay, well, there is now no way apparently to get FreeRadius 2.x installed on the latest builds, so I figured I'd try FreeRADIUS 1.x. I cannot, for the life of me, figure out how to get all the certificates and everything to make WPA2-Enterprise. On FreeRADIUS2, once I finally got it to start, everything "just worked" - am I missing something or is FreeRADIUX 1.x not capable of doing WPA2-Enterprise. Desperately need a solution here to get the staff network up at this campground back up and online in the latest builds.

I am not 100% sure how it works in freeradius1 but you have to place your certificates in /usr/local/etc/raddb/certs/ folder. Then you need to edit the "eap.conf" file to point to the correct certificates. Perhaps you have to enable "eap" in radiusd.conf.
But you are right - in freeradius1 there is no GUI for that. The certificates need to be in .pem format if I remember correct. So probably best way would be to copy these certificates created on a pfsense 2.0.1 version to pfsense 2.1.

I am not sure if freeradius2 package is visible on package manager on pfsese 2.1 but if it is try to install the package - it will install the GUI but breaks because of the missing packages which are not available in .pbi format.
The go to console and add the freeradius2 package from freebsd server with:
pkg_add -r http://www.bla-bla/freeradius2.tbz

Then it "should" work with the basic features.

Offline markuhde

  • Full Member
  • ***
  • Posts: 188
  • Karma: +0/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #352 on: June 17, 2012, 09:06:00 pm »
Yeah, I had it working that way before, it worked great, but I updated my snapshot and they removed all the non-PBI packages now. So I have no way to install the GUI since it can't manually be installed. Ugh...

Offline Nachtfalke

  • Hero Member
  • *****
  • Posts: 2754
  • Karma: +1/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #353 on: June 18, 2012, 01:38:46 am »
This is the install link in the package manager of pfsense 2.0.1
Perhaps login on your pfsense and type in this URL. This should work...


http://172.17.0.1/pkg_mgr_install.php?id=freeradius2

Offline markuhde

  • Full Member
  • ***
  • Posts: 188
  • Karma: +0/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #354 on: June 18, 2012, 01:56:42 am »
Thanks I'll give that a try tomorrow, I can't honestly see how it would work if the underlying reference to it in the list of available packages is gone, but anything's worth a try :)

Offline markuhde

  • Full Member
  • ***
  • Posts: 188
  • Karma: +0/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #355 on: June 18, 2012, 02:44:21 pm »
Working perfectly, I guess the underlying reference to the package isn't gone. Running today's snapshot, where it'll probably stay for quite some time (maybe until release if it proves stable) since everything I need up here is now working well (content filtering, traffic shaping, a VLAN with priority, and WPA2-Enterprise)! Thanks a ton!

Offline markuhde

  • Full Member
  • ***
  • Posts: 188
  • Karma: +0/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #356 on: June 19, 2012, 01:22:27 am »
That was quick! I see there's now a PBI for freeRADIUS 2.x... Not gonna give it a shot yet I have everything working on the system and not gonna take it down on a client right now, I'll test next week and make sure the PBI "just works" by doing an update probably next Thursday

Offline Nachtfalke

  • Hero Member
  • *****
  • Posts: 2754
  • Karma: +1/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #357 on: June 19, 2012, 05:14:50 am »
That was quick! I see there's now a PBI for freeRADIUS 2.x... Not gonna give it a shot yet I have everything working on the system and not gonna take it down on a client right now, I'll test next week and make sure the PBI "just works" by doing an update probably next Thursday

Don't do that!
We are trying to build the correct .PBIs and the correct dependency .PBIs for freeradius. At the moment there are not all .PBIs on the server. Hopefully the .PBI builder is doing its job.
On the Packages or the 2.1 forum there is a thread where peaople post which packages work for pfsense 2.1. You should have a look there and first install / change packages in production if they were tested.

Just remember - pfsense 2.1 is still development and not ready ;-)

Offline markuhde

  • Full Member
  • ***
  • Posts: 188
  • Karma: +0/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #358 on: June 19, 2012, 10:51:55 am »
Just remember - pfsense 2.1 is still development and not ready ;-)

Something I know all too well, but at least I'm getting to test it in the real world. I built a new system for a client, and didn't realize I couldn't use a Realtek 8111e on-board NIC with pfSense 2.0. Thankfully, all is working now *knock on wood* - if it seems stable, I might not touch it until the final comes out :D

Offline jimp

  • Administrator
  • Hero Member
  • *****
  • Posts: 14998
  • Karma: +4/-0
    • View Profile
Re: NEW Package: freeRADIUS 2.x
« Reply #359 on: June 19, 2012, 11:04:21 am »
All of the PBI bits *should* be there now, and the other bits as well, on files.pfsense.org.

https://github.com/bsdperimeter/pfsense-packages/commit/465839eb99cd094d6d7e5b7d76e82c432165a82b

Give things another test, see how they go.
Need help fast? Commercial Support!

Co-Author of pfSense: The Definitive Guide. - Check the Doc Wiki for FAQs.

Do not PM for help!