FreeRADIUS plugin #190

mimugmail · 2017-06-30T13:05:41Z

Hi,

here's a first start for a new Freeradius3 plugin.
Building and installing the package works but it's not getting installed under services (need help @fichtner ).

At the moment it's more or less a copy of Quagga / General from @fabianfrz and only PoC-quality.
I'm gonna add clients.conf and users for basic configuration, but it would be nice to check functionality via UI.

Any hints for linking the package?

Thanks!

fichtner

<3 @mimugmail

fichtner · 2017-06-30T13:06:42Z

net/freeradius3/Makefile

+PLUGIN_NAME=            freeradius3
+PLUGIN_VERSION=         0.0.1
+PLUGIN_COMMENT=         Freeradius3
+PLUGIN_DEPENDS=         talloc python2 gdbm


without reading on, curious why the depends?

Hm, these were the dependencies when installing freeradius, don't know if it's required here also

well, for one it should have "freeradius3", the rest is automatic...

(you're building package os-freeradius, which depends on package freeradius3)

Ah, ok, fixed!

fichtner · 2017-06-30T13:07:40Z

net/freeradius3/Makefile

@@ -0,0 +1,7 @@
+PLUGIN_NAME=            freeradius3


probably prefer "freeradius", which might be some work...

Sure, I can rename it in the code. Grabbed the naming from pfSense, perhaps some enthusiast wants to implement also Freeradius2. :)

fichtner · 2017-06-30T13:08:25Z

net/freeradius3/opnsense/scripts/Freeradius3/setup.sh

@@ -0,0 +1,15 @@
+#!/bin/sh


note to self: check against freebsd freeradius3 pkg-plist

I just copied it, is there some action required from my side?

no, I'll take care of this

fichtner · 2017-06-30T13:09:01Z

net/freeradius3/pkg-descr

@@ -0,0 +1,9 @@
+FreeRADIUS includes a RADIUS server, a BSD licensed client library, a PAM library, and an Apache module. In most cases, the word FreeRADIUS refers to the RADIUS server.


Line breaks for 70ish characters please :)

fichtner · 2017-06-30T13:10:48Z

net/freeradius3/opnsense/mvc/app/models/OPNsense/Freeradius3/Menu/Menu.xml

@@ -0,0 +1,5 @@
+<menu>
+  <Routing cssClass="fa fa-map-signs" order="45">


Done, stupid copy+past :)

mimugmail · 2017-07-06T04:09:59Z

I did some final newline fixes which resulted from copy+paste and added a button to "General" for VLAN assignment.

So for now it supports:

General Radius features for authentication (like any application which supports Radius e.g. OpenVPN)
WIFI WPA-Enterprise authentication
802.1X switchport authentication and dynamic VLAN assignment

These should be the most common scenarios for Radius so I'd like to let the userbase test and ask them for their use cases to add their wishes.

Whats missing:

Usage of OPNsense created CA and certificates to allow EAP-TLS, but this is a bigger change and I'd first pull this one to master.

fichtner

No static etc/ files yet? In general this is ready to merge so I approve, but several style notes and questions for your consideration. Great work again, thank you!

Let me know when this is ready from your perspective.

fichtner · 2017-07-06T05:49:47Z

net/freeradius/Makefile

@@ -0,0 +1,7 @@
+PLUGIN_NAME=            freeradius
+PLUGIN_VERSION=         0.3.0


just FYI: as long as the pull request is open you don't have to necessarily bump the version more than once. we also have PLUGIN_REVISION= which can be set to a numeric value for bugfixes, that's why most plugins only have X.Y, not X.Y.Z. But @fabianfrz likes three version numbers and that's perfectly fine here... only want to explain :)

I'm fine with both, let's keep it this way.

fichtner · 2017-07-06T05:50:30Z

net/freeradius/Makefile

+PLUGIN_NAME=            freeradius
+PLUGIN_VERSION=         0.3.0
+PLUGIN_COMMENT=         RADIUS Authentication, Authorization and Accounting Server
+PLUGIN_DEPENDS=         freeradius3


also FYI, freeradius3 has been bumped to 3.0.14 in the ports tree two days ago

fichtner · 2017-07-06T05:51:32Z

net/freeradius/src/etc/inc/plugins.inc.d/freeradius.inc

+
+    if (isset($config['OPNsense']['freeradius']['general']['enabled']) && $config['OPNsense']['freeradius']['general']['enabled'] == 1) {
+        $services[] = array(
+            'description' => gettext('FreeRADIUS lets you run a local radius service instance.'),


I think this is too long, simply "FreeRADIUS" is ok as it is shown in the dashboard service widget.

fichtner · 2017-07-06T05:54:33Z

net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/Api/ServiceController.php

+    {
+        if ($this->request->isPost()) {
+            $backend = new Backend();
+            $response = $backend->configdRun("freeradius start", true);


why detach here? better not to even if it takes a few seconds

What exactly does that mean? You are speaking to a copy+paster :)

"true" means start the service asynchronously as a background job, the controller will return immediately but the service status may not be ready yet. if copy+paste, try without it.

cd plugins && fgrep configdRun -r * | grep start

returns always lines with "true" when there's start. Keep it so? :)

weird, but fine by me

Perhaps some more pkg maintainers than me do just copy+paste :P

fichtner · 2017-07-06T05:55:27Z

net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/ClientController.php

+{
+    public function indexAction()
+    {
+        $this->view->title = gettext("FreeRADIUS-Clients");


No hyphen "-" in composite string

fichtner · 2017-07-06T05:59:44Z

...dius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/dialogEditFreeRADIUSUser.xml

+        <id>user.description</id>
+        <label>Description</label>
+        <type>text</type>
+        <help>Surname, Lastname, or anything you need to describe.</help>


Surname, and "last name" are the same. Vorname is "given name" if you meant that. No capitalisation of works in English beyond the first word mostly.

fichtner · 2017-07-06T06:00:27Z

...dius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/dialogEditFreeRADIUSUser.xml

+        <id>user.vlan</id>
+        <label>VLAN ID</label>
+        <type>text</type>
+        <help>VLAN ID the user get's in, e.g. for 802.1X, leave empty if you don't know what it is.</help>


"get's in" -> receives

fichtner · 2017-07-06T06:00:43Z

net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/general.xml

+        <id>general.vlanassign</id>
+        <label>Enable VLAN assignment</label>
+        <type>checkbox</type>
+        <help>This allows you to dynamically assign VLANs on your physical switchports.</help>


"switch ports"

fichtner · 2017-07-06T06:01:14Z

net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Menu/Menu.xml

+<menu>
+  <Services>
+    <FreeRADIUS VisibleName="FreeRADIUS" cssClass="fa fa-address-book-o">
+      <General VisibleName="General" cssClass="fa fa-address-book-o fa-fw" url="/ui/freeradius/general/index" order="10"/>


No cssClass for sub-sub-nav :)

fichtner · 2017-07-06T06:02:14Z

net/freeradius/src/opnsense/scripts/Freeradius/setup.sh

@@ -0,0 +1,15 @@
+#!/bin/sh


Note to self: I will slightly change this after merge if it needs adjustment.

fichtner · 2017-07-06T06:27:59Z

net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/Menu/Menu.xml

@@ -0,0 +1,9 @@
+<menu>
+  <Services>
+    <FreeRADIUS VisibleName="FreeRADIUS" cssClass="fa fa-address-book-o">


PS: VisibleName is automatic if it matches the node name, so you don't need it at all here.

mimugmail · 2017-07-06T06:28:39Z

@fichtner Is there something missing in Menu.xml since there's no icon displayed?

fichtner · 2017-07-06T06:31:07Z

symbol missing from our font awesome version? I can take a look after merge if you want

mimugmail · 2017-07-06T06:35:48Z

Possibly, yes.

For me it's mergeable now. Thanks for taking the time to review @fichtner and @fabianfrz 👍

fichtner · 2017-07-06T06:37:29Z

@mimugmail thanks again! 👍

fichtner · 2017-07-06T10:55:41Z

@mimugmail we don't have font awesome 4.7 yet...

fichtner · 2017-07-06T11:06:12Z

icon fixed via opnsense/core@92d1886

rout3rx · 2017-08-06T10:40:16Z

is there anyone to told me how to install radius on opnsense as you develops?

fichtner · 2017-08-06T10:40:56Z

it's easily available from the firmware: plugin menu in 17.7 :)

rout3rx · 2017-08-06T11:26:52Z

thanks for your worthwhile effort.
i hope opnsense team tried to have : best reporting for every modules and Antivirus and Antispam for a complete UTM.

fabianfrz · 2017-08-06T11:46:24Z

@rout3rx @mimugmail may be working on AV integration (c-icap/av_scan/clamav) but anti spam is currently not planned.

rout3rx · 2017-08-06T15:17:55Z

sorry, excuse me i can ask a small question in this board? how can i apply bandwidth limit or user traffic limitation on users in freeradius?

mimugmail · 2017-08-06T17:41:47Z

Against what service so you want to authenticate? Tell ne the attribute named and I'll check how to add them Am 06.08.2017 5:17 nachm. schrieb "rout3rx" <notifications@github.com>:

…

sorry, excuse me i can ask a small question in this board? how can i apply bandwidth limit or user traffic limitation on users in freeradius? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#190 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ATfeoWuLtO-viCWYVkEM6sGzgA0QuKI2ks5sVdkkgaJpZM4OKjuY> .

rout3rx · 2017-08-06T17:49:37Z

when i want create share internet via PPTP or PPPoE connections, i want to apply some restriction like time of connection, bandwidth and traffic quota.

fichtner · 2017-08-06T18:04:39Z

This requires accounting setup and such, we maybe getting a bit ahead of our schedule in providing one step after another in RADIUS integration.

But it's perfectly possible to set this up manually with the package (not the plugin).

rout3rx · 2017-08-06T18:10:36Z

is it possible to add? or can i add more option in freeradius config file?

mimugmail · 2017-08-06T20:32:11Z

Only when managed without the plugin.

Just do a pkg install freeradius3 via CLI and go ahead in /usr/local/etc/raddb

mimugmail added 27 commits June 30, 2017 10:22

Create freeradius3.inc

fdf46d3

Create Makefile

bfd5b0f

Create pkg-descr

9deb431

Create GeneralController.php

dd12ac6

Create general.xml

442b73b

Create ACL.xml

dc99043

Create general.volt

05ecfe6

Create setup.sh

71dd525

Create actions_freeradius3.conf

6c08d95

Create +TARGETS

5d6b464

Create radiusd

b7b6b55

Update +TARGETS

258615c

Create users

c6caf01

Create GeneralController.php

3974f52

Update general.xml

cf16e21

Update GeneralController.php

dff32cd

Create ServiceController.php

8cfabd4

Create General.xml

74383e9

Create General.php

f8eac25

Create Menu.xml

c160316

Update ACL.xml

43e2ad3

Update general.volt

286873f

Update general.volt

e074965

Update setup.sh

35fe046

Update actions_freeradius3.conf

20a5a30

Update actions_freeradius3.conf

f9b5e6e

Update ServiceController.php

40ece5c

fichtner reviewed Jun 30, 2017

View reviewed changes

fichtner self-assigned this Jun 30, 2017

fichtner reviewed Jun 30, 2017

View reviewed changes

Added VLAN assignment and style fixes

275018a

fichtner approved these changes Jul 6, 2017

View reviewed changes

mimugmail added 9 commits July 6, 2017 08:13

Update freeradius.inc

337d95c

Update ClientController.php

2c3f542

Update ClientController.php

9fbe999

Update GeneralController.php

dba79f9

Update UserController.php

1afdb5f

Update dialogEditFreeRADIUSUser.xml

72b67ad

Update dialogEditFreeRADIUSClient.xml

11290f2

Update general.xml

752396e

Update Menu.xml

30dcec7

fichtner reviewed Jul 6, 2017

View reviewed changes

fichtner merged commit 1391330 into opnsense:master Jul 6, 2017

		@@ -0,0 +1,9 @@
		FreeRADIUS includes a RADIUS server, a BSD licensed client library, a PAM library, and an Apache module. In most cases, the word FreeRADIUS refers to the RADIUS server.

		@@ -0,0 +1,5 @@
		<menu>
		<Routing cssClass="fa fa-map-signs" order="45">

FreeRADIUS plugin #190

FreeRADIUS plugin #190

Conversation

mimugmail commented Jun 30, 2017

fichtner left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mimugmail commented Jul 6, 2017

fichtner left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mimugmail commented Jul 6, 2017

fichtner commented Jul 6, 2017

mimugmail commented Jul 6, 2017

fichtner commented Jul 6, 2017

fichtner commented Jul 6, 2017

fichtner commented Jul 6, 2017

rout3rx commented Aug 6, 2017

fichtner commented Aug 6, 2017

rout3rx commented Aug 6, 2017

fabianfrz commented Aug 6, 2017

rout3rx commented Aug 6, 2017

mimugmail commented Aug 6, 2017 via email

rout3rx commented Aug 6, 2017

fichtner commented Aug 6, 2017

rout3rx commented Aug 6, 2017

mimugmail commented Aug 6, 2017