I have been installing FreeRADIUS 3 on pfSense for about out 5 years and it always came bundled with some version of *mysql57-client* (this or that minor version) and it always worked well with *mysql57-server* (again, this or that minor version), which FreeRADIUS connected to. To give you a context, the last time I installed was about a month ago and the versions were as follows: pfSense -> 2.6.0 (FreeBSD 1.3-STABLE) FreeRADIUS -> 3.0.25 MySQL Client -> 5.736 But the guys at pfSense decided to skip version 13 of FreeBSD and build version 2.7.0 on FreeBSDversion 14. The 2.7.0 version of pfSense comes with *freeradius3-3.2.2* and *mysql80-client-8.0.32_2* . Of course, I could just install *mysql80-client-8.0.32_2* and modify my SQL code a little bit and it would still work. But the problem is that I have Syslog-NG installed on the system and it too connects to the same MySQL instance and though it has been upgraded to version 4.20, it still uses the old *mysql57-client. * So is there a way to get FreeRADIUS 3.2.2 to work with the old MySQL client, you know, using the good old "libdbi" driver? * * -- This email has been checked for viruses by Avast antivirus software. www.avast.com
On Sep 9, 2023, at 4:03 PM, Selahattin CILEK <selahattin_cilek@hotmail.com> wrote:
I have been installing FreeRADIUS 3 on pfSense for about out 5 years and it always came bundled with some version of *mysql57-client* (this or that minor version) and it always worked well with *mysql57-server* (again, this or that minor version), which FreeRADIUS connected to. To give you a context, the last time I installed was about a month ago and the versions were as follows: ... But the guys at pfSense decided to skip version 13 of FreeBSD and build version 2.7.0 on FreeBSDversion 14. The 2.7.0 version of pfSense comes with *freeradius3-3.2.2* and *mysql80-client-8.0.32_2* . Of course, I could just install *mysql80-client-8.0.32_2* and modify my SQL code a little bit and it would still work. But the problem is that I have Syslog-NG installed on the system and it too connects to the same MySQL instance and though it has been upgraded to version 4.20, it still uses the old *mysql57-client. *
Why doesn't syslog-ng use the newer MySQL client library?
So is there a way to get FreeRADIUS 3.2.2 to work with the old MySQL client, you know, using the good old "libdbi" driver?
You can build it from source. In general it's not a good idea to have multiple versions of the same library on a system. All kinds of things can go wrong. Alan DeKok.
On 09.09.2023 23:44, Alan DeKok wrote:
On Sep 9, 2023, at 4:03 PM, Selahattin CILEK <selahattin_cilek@hotmail.com> wrote:
I have been installing FreeRADIUS 3 on pfSense for about out 5 years and it always came bundled with some version of *mysql57-client* (this or that minor version) and it always worked well with *mysql57-server* (again, this or that minor version), which FreeRADIUS connected to. To give you a context, the last time I installed was about a month ago and the versions were as follows: ... But the guys at pfSense decided to skip version 13 of FreeBSD and build version 2.7.0 on FreeBSDversion 14. The 2.7.0 version of pfSense comes with *freeradius3-3.2.2* and *mysql80-client-8.0.32_2* . Of course, I could just install *mysql80-client-8.0.32_2* and modify my SQL code a little bit and it would still work. But the problem is that I have Syslog-NG installed on the system and it too connects to the same MySQL instance and though it has been upgraded to version 4.20, it still uses the old *mysql57-client. * Why doesn't syslog-ng use the newer MySQL client library? That's a good question, I have been wondering that myself too. Maybe they don't want to break anything by upgrading to the newer DB client. Who knows...
So is there a way to get FreeRADIUS 3.2.2 to work with the old MySQL client, you know, using the good old "libdbi" driver? You can build it from source. Where would one start? Could you point to a specific direction?
In general it's not a good idea to have multiple versions of the same library on a system. All kinds of things can go wrong.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- This email has been checked for viruses by Avast antivirus software. www.avast.com
On Sep 10, 2023, at 3:40 AM, Selahattin CILEK <selahattin_cilek@hotmail.com> wrote:
Where would one start? Could you point to a specific direction?
http://wiki.freeradius.org has a lot of documentation on this topic. There's also https://freeradius.org/documentation/freeradius-server/3.2.4/installation/so... And FreeBSD should have it's own packaging system which includes FreeRADIUS. Alan DeKok.
Hullo, a FreeRADIUS newbie here, with a (hopefully) basic question: I am struggling to figure out how to use freeradius-client as NAS/authenticator when authenticating a supplicant to freeradius-server. I already implemented a version that calculated and verified the EAP MD5 hashes locally (without FR client), but I would now like to move authentication responsibilities to the server. I am currently trying to forward EAP identity response from the supplicant, but cannot get the server to accept my Message-Authenticator. I think I have established that I need to add at least PW_EAP_MESSAGE (with the EAP bytes attached) and PW_MESSAGE_AUTHENTICATOR attributes when using the FR client, but how am I able to calculate the correct HMAC MD5 without the packet identifier that (I think) is generated in the FR client? The secret is configured correctly on both sides, of that I am 99,99% sure. :) Best regards, Simo
On Sep 11, 2023, at 12:56 PM, Simo Tappola <simo.tappola@gmail.com> wrote:
a FreeRADIUS newbie here, with a (hopefully) basic question: I am struggling to figure out how to use freeradius-client as NAS/authenticator when authenticating a supplicant to freeradius-server.
The short answer is you don't. The freeradius-client library is intended to do RADIUS. EAP is substantially more complex. If you need to implement EAP, then I would suggest looking at hostap / wpa_supplicant. It has a large set of EAP methods available, and is very well documented. It even has a basic RADIUS client which is used in the eapol_test program.
I am currently trying to forward EAP identity response from the supplicant, but cannot get the server to accept my Message-Authenticator.
The code to calculate Message-Authenticator is online in many places, including in FreeRADIUS. The freeradius-client library doesn't do Message-Authenticator, but that shouldn't be too hard to add.
I think I have established that I need to add at least PW_EAP_MESSAGE (with the EAP bytes attached) and PW_MESSAGE_AUTHENTICATOR attributes when using the FR client, but how am I able to calculate the correct HMAC MD5 without the packet identifier that (I think) is generated in the FR client? The secret is configured correctly on both sides, of that I am 99,99% sure. :)
I have to ask why you're writing yet another EAP library. There's already source code available in hostap. Plus, EAP-MD5 isn't any better than CHAP. It's 99.9% CHAP, but just wrapped in an EAP layer. It adds complexity for no additional benefit. So rather than talking about technical details, perhaps you can explain why you need to do EAP, and why you're re-implementing EAP. It's 2023... I would very much suggest just using PAP. It's secure, and it's fine. Alan DeKok.
ma 11. syysk. 2023 klo 20.44 Alan DeKok (aland@deployingradius.com) kirjoitti:
On Sep 11, 2023, at 12:56 PM, Simo Tappola <simo.tappola@gmail.com> wrote:
a FreeRADIUS newbie here, with a (hopefully) basic question: I am struggling to figure out how to use freeradius-client as NAS/authenticator when authenticating a supplicant to freeradius-server.
The short answer is you don't. The freeradius-client library is intended to do RADIUS. EAP is substantially more complex.
If you need to implement EAP, then I would suggest looking at hostap / wpa_supplicant. It has a large set of EAP methods available, and is very well documented. It even has a basic RADIUS client which is used in the eapol_test program.
I re-read my original post and realised I may have given an impression that I am implementing the supplicant part, while in reality I am working on the NAS/authenticator. The supplicant(s) is/are just black boxes for now, although later it might be feasible to transfer also custom data from the authenticator to supplicants, which, in my admittedly limited understanding, should be possible with EAP. That's also why piggy-backing the EAP packets inside RADIUS frames seemed like a clever option. Wireshark also decoded the frames - including embedded EAP packets - correctly. Which library/component would be your recommendation in the authenticator device? I don't particularly *want* to write any code, but at least some amount of customization seems unavoidable.
I have to ask why you're writing yet another EAP library. There's already source code available in hostap.
Plus, EAP-MD5 isn't any better than CHAP. It's 99.9% CHAP, but just wrapped in an EAP layer. It adds complexity for no additional benefit.
So rather than talking about technical details, perhaps you can explain why you need to do EAP, and why you're re-implementing EAP.
Learning, that's the short answer. I've only just begun dabbling on this and don't really know what I'm doing yet. So for now this is mainly a research project, and MD5 seemed like a reasonably simple first try. Ultimately, PEAP/TLS is probably the way to go, but I would first like to understand the (best, hopefully, or at least good) options I have in the authenticator. Regards, Simo
On Sep 12, 2023, at 4:07 AM, Simo Tappola <simo.tappola@gmail.com> wrote:
I re-read my original post and realised I may have given an impression that I am implementing the supplicant part, while in reality I am working on the NAS/authenticator. The supplicant(s) is/are just black boxes for now, although later it might be feasible to transfer also custom data from the authenticator to supplicants, which, in my admittedly limited understanding, should be possible with EAP. That's also why piggy-backing the EAP packets inside RADIUS frames seemed like a clever option. Wireshark also decoded the frames - including embedded EAP packets - correctly.
That's good.
Which library/component would be your recommendation in the authenticator device? I don't particularly *want* to write any code, but at least some amount of customization seems unavoidable.
Again... hostap / wpa_supplicant. It includes a full EAP client implementation, and a RADIUS client implementation. Alan DeKok.
Hello, I was wondering where can I find the latest and greatest instructions on how to take FreeRADIUS server into use? I found this ( http://deployingradius.com/documents/configuration/setup.html), written by Alan himself, that seems excellent but it seems to be from 2014, so I'm assuming not all of it is relevant anymore? The instructions there seem temptingly simple and since I am not really interested (at least for the time being) in fiddling with the server too much I would like to change the default configuration as little as possible. Regards, Simo
On Sep 18, 2023, at 4:31 AM, Simo Tappola <simo.tappola@gmail.com> wrote:
I was wondering where can I find the latest and greatest instructions on how to take FreeRADIUS server into use?
To do... what? The server comes with a lot of documentation. Do you have a specific question?
I found this ( http://deployingradius.com/documents/configuration/setup.html), written by Alan himself, that seems excellent but it seems to be from 2014, so I'm assuming not all of it is relevant anymore? The instructions there seem temptingly simple and since I am not really interested (at least for the time being) in fiddling with the server too much I would like to change the default configuration as little as possible.
There should be documentation for most common use-cases. Find out what you want to do with the server, and then read the documentation for how to do that. Alan DeKok.
ma 18. syysk. 2023 klo 14.32 Alan DeKok (aland@deployingradius.com) kirjoitti:
On Sep 18, 2023, at 4:31 AM, Simo Tappola <simo.tappola@gmail.com> wrote:
I was wondering where can I find the latest and greatest instructions on how to take FreeRADIUS server into use?
To do... what?
To authenticate clients/supplicants, basically to get it up and running in the way FreeRADIUS HowTos describes, with minimal changes to the configuration. I suppose my actual question is/was are those instructions still valid, even though they are/seem to be more than ten years old? Or put in another way, what would be your recommendation for a definite, go-to set of instructions to start with? Would it be that Deploying RADIUS site, README, Wiki or something else? Ultimately, it is of course all of them, but what about the very first steps? Simo
On 18/09/2023 20:05, Simo Tappola wrote:
To authenticate clients/supplicants, basically to get it up and running in the way FreeRADIUS HowTos describes, with minimal changes to the configuration. I suppose my actual question is/was are those instructions still valid, even though they are/seem to be more than ten years old?
Have you actually tried them? If so, where did it go wrong? At a quick glance, they still look largely correct to me. -- Matthew
On Sep 18, 2023, at 3:05 PM, Simo Tappola <simo.tappola@gmail.com> wrote:
To authenticate clients/supplicants,
That is what a RADIUS server does...
basically to get it up and running in the way FreeRADIUS HowTos describes, with minimal changes to the configuration.
Have you tried following the documentation?
I suppose my actual question is/was are those instructions still valid, even though they are/seem to be more than ten years old?
The documentation has been *around* for ten years or more. It hasn't been *unmodified* for ten years. Plus, I said that the server comes with documentation. That documentation is clearly up to date, as it's shipped with the latest version of the server. Why not do what it says? Why not read the comments in the configuration files and follow those instructions to get things working?
Or put in another way, what would be your recommendation for a definite, go-to set of instructions to start with?
So start doing... what? I must point out the inherent confusion in asking "How do I do stuff", and when asked for clarification, replying with "I really want to do stuff". Computers don't work on wishes and vague descriptions. Computers work on details.
Would it be that Deploying RADIUS site, README, Wiki or something else? Ultimately, it is of course all of them, but what about the very first steps?
To do what? Perhaps instead of waiting for some kind of blessing to go ahead, you could just try to follow the documentation. Then if it doesn't work, ask detailed questions, and give detailed information. What isn't helpful is asking the same question repeatedly, while not actually making progress. Just get things done. You can't destroy anything by misconfiguring the server. It's all just bits on a hard drive. You can always fix things by updating the configuration files. Alan DeKok.
participants (4)
-
Alan DeKok -
Matthew Newton -
Selahattin CILEK -
Simo Tappola