From 6bdfe929f52e5d3917562b73104d5d4fadcb5375 Mon Sep 17 00:00:00 2001 From: Nachtfalke Date: Sat, 7 Jan 2012 18:46:07 +0100 Subject: Update config/freeradius2/freeradius.inc --- config/freeradius2/freeradius.inc | 83 ++++++++++++++++++--------------------- 1 file changed, 39 insertions(+), 44 deletions(-) diff --git a/config/freeradius2/freeradius.inc b/config/freeradius2/freeradius.inc index baac37ae..59cb2ce5 100644 --- a/config/freeradius2/freeradius.inc +++ b/config/freeradius2/freeradius.inc @@ -86,6 +86,10 @@ function freeradius_install_command() { log_error("FreeRADIUS: Creating backup of the original file to {$filemodulesfilesbackup}"); copy("/usr/local/etc/raddb/modules/files", "/usr/local/etc/raddb/files.backup"); } + + // Disable virtual-server we do not need by default + unlink("/usr/local/etc/raddb/sites-enabled/control-socket"); + unlink("/usr/local/etc/raddb/sites-enabled/inner-tunnel"); $rcfile = array(); $rcfile['file'] = 'radiusd.sh'; @@ -902,41 +906,32 @@ function freeradius_serverdefault_resync() { $varsettings = $config['installedpackages']['freeradiussettings']['config'][0]; // If unchecked we need the normal EAP section. - If (!$varsettings['varsettingsenablemacauth']) { + if (!$varsettings['varsettingsenablemacauth']) { $varplainmacauthenable = ''; $varplainmacauthenable .= "eap {"; $varplainmacauthenable .= "\n\tok = return"; $varplainmacauthenable .= "\n\t}"; - + $varplainmacpreacctenable = ''; $varplainmacpreacctenable .= '##### ACCOUNTING FOR PLAIN MAC-AUTH DISABLED #####'; } // If checked we need to check if it is plain mac or eap else { $varplainmacauthenable = ''; - $varplainmacauthenable .= "# if cleaning up the Calling-Station-Id..."; + $varplainmacauthenable .= "\t### FIRST check MAC address in authorized_macs and if that fails proceed with other checks below in else-section ###"; + $varplainmacauthenable .= "\n\t# if cleaning up the Calling-Station-Id..."; $varplainmacauthenable .= "\n\trewrite_calling_station_id"; - $varplainmacauthenable .= "\n\t# If this is NOT 802.1x, assume mac-auth"; - $varplainmacauthenable .= "\n\tif (!EAP-Message) {"; - $varplainmacauthenable .= "\n\t\t# now check against the authorized_macs file"; - $varplainmacauthenable .= "\n\t\tauthorized_macs"; - $varplainmacauthenable .= "\n\t\tif (!ok) {"; - $varplainmacauthenable .= "\n\t\t\treject"; - $varplainmacauthenable .= "\n\t\t}"; - $varplainmacauthenable .= "\n\t\telse {"; - $varplainmacauthenable .= "\n\t\t\t# accept"; + $varplainmacauthenable .= "\n\t# now check against the authorized_macs file"; + $varplainmacauthenable .= "\n\tauthorized_macs"; + $varplainmacauthenable .= "\n\tif (ok) {"; $varplainmacauthenable .= "\n\t\t\tupdate control {"; - $varplainmacauthenable .= "\n\t\t\t\tAuth-Type := Accept"; - $varplainmacauthenable .= "\n\t\t\t}"; + $varplainmacauthenable .= "\n\t\t\tAuth-Type := Accept"; $varplainmacauthenable .= "\n\t\t}"; $varplainmacauthenable .= "\n\t}"; - $varplainmacauthenable .= "\n\telse {"; - $varplainmacauthenable .= "\n\t\t# normal FreeRadius virtual server config goes here e.g."; - $varplainmacauthenable .= "\n\t\teap"; - $varplainmacauthenable .= "\n\t}"; - + $varplainmacauthenable .= "\n\t### Here we have to place all other authorize modules which should be check when MAC fails ###"; + $varplainmacpreacctenable = ''; - $varplainmacpreacctenable .= '##### ACCOUNTING FOR PLAIN MAC-AUTH #####'; + $varplainmacpreacctenable .= '##### ACCOUNTING FOR PLAIN MAC-AUTH ENABLED #####'; $varplainmacpreacctenable .= "\n\trewrite_calling_station_id"; } @@ -1031,27 +1026,6 @@ authorize { # 'raddb/huntgroups' files. preprocess - # - # This module takes care of EAP-MD5, EAP-TLS, and EAP-LEAP - # authentication. - # - # It also sets the EAP-Type attribute in the request - # attribute list to the EAP type from the packet. - # - # As of 2.0, the EAP module returns "ok" in the authorize stage - # for TTLS and PEAP. In 1.x, it never returned "ok" here, so - # this change is compatible with older configurations. - # - # The example below uses module failover to avoid querying all - # of the following modules if the EAP module returns "ok". - # Therefore, your LDAP and/or SQL servers will not be queried - # for the many packets that go back and forth to set up TTLS - # or PEAP. The load on those servers will therefore be reduced. - # - - $varplainmacauthenable - - # # If you want to have a log of authentication requests, # un-comment the following line, and the 'detail auth_log' @@ -1098,9 +1072,30 @@ authorize { # Otherwise, when the first style of realm doesn't match, # the other styles won't be checked. # + suffix ntdomain - + + # + # This module takes care of EAP-MD5, EAP-TLS, and EAP-LEAP + # authentication. + # + # It also sets the EAP-Type attribute in the request + # attribute list to the EAP type from the packet. + # + # As of 2.0, the EAP module returns "ok" in the authorize stage + # for TTLS and PEAP. In 1.x, it never returned "ok" here, so + # this change is compatible with older configurations. + # + # The example below uses module failover to avoid querying all + # of the following modules if the EAP module returns "ok". + # Therefore, your LDAP and/or SQL servers will not be queried + # for the many packets that go back and forth to set up TTLS + # or PEAP. The load on those servers will therefore be reduced. + # + + $varplainmacauthenable + # # Pull crypt'd passwords from /etc/passwd or /etc/shadow, # using the system API's to get the password. If you want @@ -1157,7 +1152,7 @@ authorize { # get a chance to set Auth-Type for themselves. # pap - + # # If "status_server = yes", then Status-Server messages are passed # through the following section, and ONLY the following section. @@ -2951,7 +2946,7 @@ policy { } } else { - noop + noop } } } -- cgit v1.2.3 From 4fce048442bce804c723c51d1b631925d53ae56e Mon Sep 17 00:00:00 2001 From: Nachtfalke Date: Sat, 7 Jan 2012 18:47:03 +0100 Subject: Update config/freeradius2/freeradiussettings.xml --- config/freeradius2/freeradiussettings.xml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/config/freeradius2/freeradiussettings.xml b/config/freeradius2/freeradiussettings.xml index 611db03f..ea7366fc 100644 --- a/config/freeradius2/freeradiussettings.xml +++ b/config/freeradius2/freeradiussettings.xml @@ -104,8 +104,7 @@ Enable Plain MAC Auth varsettingsenablemacauth - - Some NAS are not able to convert the MAC in a 802.1X format then you could enable this. If you doo not need this leave this disabled. It could have unknown side-effects. (Default: unchecked)]]> + checkbox -- cgit v1.2.3 From 035fdc9250dd5ad143b39df593463a1d2e7d1803 Mon Sep 17 00:00:00 2001 From: Nachtfalke Date: Sat, 7 Jan 2012 18:47:39 +0100 Subject: Update config/freeradius2/freeradius.xml --- config/freeradius2/freeradius.xml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/config/freeradius2/freeradius.xml b/config/freeradius2/freeradius.xml index e1c6c9f2..2b31996a 100644 --- a/config/freeradius2/freeradius.xml +++ b/config/freeradius2/freeradius.xml @@ -346,10 +346,9 @@ freeradius_install_command(); freeradius_clients_resync(); freeradius_users_resync(); + freeradius_authorizedmacs_resync(); freeradius_eapconf_resync(); freeradius_sqlconf_resync(); - exec("rm -f /usr/local/etc/raddb/sites-enabled/control-socket"); - exec("rm -f /usr/local/etc/raddb/sites-enabled/inner-tunnel"); freeradius_deinstall_command(); -- cgit v1.2.3 From bdf04b3c174ec32f123e1cc0ba647bed176f4d24 Mon Sep 17 00:00:00 2001 From: Nachtfalke Date: Sat, 7 Jan 2012 18:49:26 +0100 Subject: Update pkg_config.8.xml.amd64 --- pkg_config.8.xml.amd64 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg_config.8.xml.amd64 b/pkg_config.8.xml.amd64 index 10a5f2f2..fb0ce32d 100644 --- a/pkg_config.8.xml.amd64 +++ b/pkg_config.8.xml.amd64 @@ -852,7 +852,7 @@ Do not use together with freeradius package. Both are using the same XML files.]]> http://doc.pfsense.org/index.php/FreeRADIUS_2.x_package System - 2.1.12 pkg v1.4.5 + 2.1.12 pkg v1.4.6 BETA 2.0 nachtfalkeaw@web.de -- cgit v1.2.3 From c8b3389e62896c5d7c1c9b2e6bb70986fd6bc35b Mon Sep 17 00:00:00 2001 From: Nachtfalke Date: Sat, 7 Jan 2012 18:50:00 +0100 Subject: Update pkg_config.8.xml --- pkg_config.8.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg_config.8.xml b/pkg_config.8.xml index cb68e9c4..df8beb40 100644 --- a/pkg_config.8.xml +++ b/pkg_config.8.xml @@ -805,7 +805,7 @@ Do not use together with freeradius package. Both are using the same XML files.]]> http://doc.pfsense.org/index.php/FreeRADIUS_2.x_package System - 2.1.12 pkg v1.4.5 + 2.1.12 pkg v1.4.6 BETA 2.0 nachtfalkeaw@web.de -- cgit v1.2.3