OpenWrt Forum Archive

Topic: FreeRADIUS on openwrt!! - Testers needed.

The content of this topic has been archived on 13 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Post #1
cmartin
28 Oct 2004, 18:43

Hi DEVS,

I'm working on using openwrt to authenticate against RADIUS or WPA-RADIUS. So far I can get openwrt  configured correctly for that using the nas binary.
I tried to get tinyPEAP to work on openwrt, but I wasn't successfull. So I decided to take a look at FreeRADIUS. I have successfully built FreeRADIUS within buildroot using the makefile I wrote (see below).
Up until now I haven't had time to test it. I will start off trying EAP-TLS using the demo certs that come with freeradius. If others are willing to help out with the other EAP methods (e.g. PEAP) that would be great.

My makefile below packages the modules, radiusd and the democerts all seperately, so you can use only the parts you need. As soon as there are some success stories we could write up HOWTOs for setting the different environments up (most interesting will be what dependencies each method has).

Just drop my freeradius.mk file in BUILDROOT/make, add freeradius to the PACKAGES definition in the toplevel Makefile and run 'make packages'.

You end up with a bunch of ipks for freeradius in your packages directory.

Have fun! - Oh and watch out for that line in the code below starting with "$(FREERADIUS_IPK_DIR)/freeradiusd/usr/share/freeradius/dictionary" - that belongs to the line above it (the Board Software Linebreaks it since it's too long)

P.S. The sql module wouldn't build, so I removed it using the --without-sql option in configure.

Here's my freeradius.mk:

#############################################################
#
# freeradius (RADIUS authentication server)
#
#############################################################

FREERADIUS_SITE=ftp://ftp.freeradius.org/pub/radius
FREERADIUS_VER=1.0.1
FREERADIUS_SOURCE:=freeradius-$(FREERADIUS_VER).tar.gz
FREERADIUS_DIR:=$(BUILD_DIR)/freeradius-$(FREERADIUS_VER)
FREERADIUS_IPK_DIR:=$(FREERADIUS_DIR)-ipk

$(DL_DIR)/$(FREERADIUS_SOURCE):
    $(WGET) -P $(DL_DIR) $(FREERADIUS_SITE)/$(FREERADIUS_SOURCE)

#freeradius-source: $(DL_DIR)/$(FREERADIUS_SOURCE)

$(FREERADIUS_DIR)/.unpacked: $(DL_DIR)/$(FREERADIUS_SOURCE)
    zcat $(DL_DIR)/$(FREERADIUS_SOURCE) | tar -C $(BUILD_DIR) -xvf -
    touch  $(FREERADIUS_DIR)/.unpacked

$(FREERADIUS_DIR)/.configured: $(FREERADIUS_DIR)/.unpacked
    (cd $(FREERADIUS_DIR); rm -rf config.cache; 
        $(TARGET_CONFIGURE_OPTS) 
        ./configure 
        --target=$(GNU_TARGET_NAME) 
        --host=$(GNU_TARGET_NAME) 
        --build=$(GNU_HOST_NAME) 
        --prefix=/usr 
        --exec-prefix=/usr 
        --bindir=/usr/bin 
        --sbindir=/usr/sbin 
        --libexecdir=/usr/lib 
        --localstatedir=/var 
        --sysconfdir=/etc 
        --without-rlm_sql 
    );
    touch  $(FREERADIUS_DIR)/.configured

freeradius-build: $(FREERADIUS_DIR)/.configured
    $(MAKE) CC=$(TARGET_CC) -C $(FREERADIUS_DIR)
    for i in `find $(FREERADIUS_DIR)/src/modules/ -name .libs`; do $(STAGING_DIR)/bin/mipsel-linux-uclibc-strip $${i}/*.so; done
    for i in `find $(FREERADIUS_DIR)/src/modules/ -name .libs`; do $(STAGING_DIR)/bin/mipsel-linux-uclibc-strip $${i}/*.a; done
    $(STAGING_DIR)/bin/mipsel-linux-uclibc-strip $(FREERADIUS_DIR)/src/modules/rlm_eap/.libs/radeapclient
    $(STAGING_DIR)/bin/mipsel-linux-uclibc-strip $(FREERADIUS_DIR)/src/main/.libs/radiusd
    $(STAGING_DIR)/bin/mipsel-linux-uclibc-strip $(FREERADIUS_DIR)/src/lib/.libs/*.so
    $(STAGING_DIR)/bin/mipsel-linux-uclibc-strip $(FREERADIUS_DIR)/src/lib/.libs/*.a
    $(STAGING_DIR)/bin/mipsel-linux-uclibc-strip $(FREERADIUS_DIR)/libltdl/.libs/*.so
    $(STAGING_DIR)/bin/mipsel-linux-uclibc-strip $(FREERADIUS_DIR)/libltdl/.libs/*.a

freeradius-package: freeradius-build
    # Remove IPK directory from previous build
    (if [ -d $(FREERADIUS_IPK_DIR) ]; then 
        rm -rf $(FREERADIUS_IPK_DIR); 
    fi);
    # Build modules as seperate IPKs
    (for i in `find $(FREERADIUS_DIR)/src/modules/ -name .libs`; do 
        MODULE_DIR_NAME=`echo $${i}|sed 's//.libs$$//'|sed 's/.*///'`; 
        MODULE_NAME=`echo $${i}|sed 's//.libs$$//'|sed 's/.*///'|sed 's/rlm_//'|sed 's/_/-/g'`; 
        mkdir -p $(FREERADIUS_IPK_DIR)/$${MODULE_DIR_NAME}/CONTROL; 
        echo "Package: freeradius-$${MODULE_NAME}" > $(FREERADIUS_IPK_DIR)/$${MODULE_DIR_NAME}/CONTROL/control; 
        echo "Version: $(FREERADIUS_VER)" >> $(FREERADIUS_IPK_DIR)/$${MODULE_DIR_NAME}/CONTROL/control; 
        echo "Architecture: mipsel" >> $(FREERADIUS_IPK_DIR)/$${MODULE_DIR_NAME}/CONTROL/control; 
        echo "Maintainer: Chris Martin <cmartin@opensimpad.org>" >> $(FREERADIUS_IPK_DIR)/$${MODULE_DIR_NAME}/CONTROL/control; 
        echo "Source: $(FREERADIUS_SITE)/$(FREERADIUS_SOURCE)" >> $(FREERADIUS_IPK_DIR)/$${MODULE_DIR_NAME}/CONTROL/control; 
        echo "Section: net" >> $(FREERADIUS_IPK_DIR)/$${MODULE_DIR_NAME}/CONTROL/control; 
        echo "Priority: optional" >> $(FREERADIUS_IPK_DIR)/$${MODULE_DIR_NAME}/CONTROL/control; 
        echo "Depends: freeradius" >> $(FREERADIUS_IPK_DIR)/$${MODULE_DIR_NAME}/CONTROL/control; 
        echo "Description: $${MODULE_DIR_NAME} module for FreeRADIUS Authentication Server" >> $(FREERADIUS_IPK_DIR)/$${MODULE_DIR_NAME}/CONTROL/control; 
        mkdir -p $(FREERADIUS_IPK_DIR)/$${MODULE_DIR_NAME}/usr/lib; 
        cp $${i}/* $(FREERADIUS_IPK_DIR)/$${MODULE_DIR_NAME}/usr/lib; 
        cd $(BUILD_DIR); $(IPKG_BUILD) $(FREERADIUS_IPK_DIR)/$${MODULE_DIR_NAME}; 
    done);
    # Build radiusd IPK
    mkdir -p $(FREERADIUS_IPK_DIR)/freeradiusd/CONTROL
    echo "Package: freeradius" > $(FREERADIUS_IPK_DIR)/freeradiusd/CONTROL/control
    echo "Version: $(FREERADIUS_VER)" >> $(FREERADIUS_IPK_DIR)/freeradiusd/CONTROL/control
    echo "Architecture: mipsel" >> $(FREERADIUS_IPK_DIR)/freeradiusd/CONTROL/control
    echo "Maintainer: Chris Martin <cmartin@opensimpad.org>" >> $(FREERADIUS_IPK_DIR)/freeradiusd/CONTROL/control
    echo "Source: $(FREERADIUS_SITE)/$(FREERADIUS_SOURCE)" >> $(FREERADIUS_IPK_DIR)/freeradiusd/CONTROL/control
    echo "Section: net" >> $(FREERADIUS_IPK_DIR)/freeradiusd/CONTROL/control
    echo "Priority: optional" >> $(FREERADIUS_IPK_DIR)/freeradiusd/CONTROL/control
    echo "Depends: libpthread" >> $(FREERADIUS_IPK_DIR)/freeradiusd/CONTROL/control
    echo "Description: FreeRADIUS Authentication Server" >> $(FREERADIUS_IPK_DIR)/freeradiusd/CONTROL/control
    mkdir -p $(FREERADIUS_IPK_DIR)/freeradiusd/usr/sbin
    cp $(FREERADIUS_DIR)/src/main/.libs/radiusd $(FREERADIUS_IPK_DIR)/freeradiusd/usr/sbin
    mkdir -p $(FREERADIUS_IPK_DIR)/freeradiusd/etc/init.d
    mkdir -p $(FREERADIUS_IPK_DIR)/freeradiusd/etc/raddb
    mkdir -p $(FREERADIUS_IPK_DIR)/freeradiusd/usr/lib
    mkdir -p $(FREERADIUS_IPK_DIR)/freeradiusd/usr/share/freeradius
    cp -r $(FREERADIUS_DIR)/raddb/* $(FREERADIUS_IPK_DIR)/freeradiusd/etc/raddb
    cat $(FREERADIUS_DIR)/raddb/radiusd.conf|sed 's/^logdir =/#logdir =/' > $(FREERADIUS_IPK_DIR)/freeradiusd/etc/raddb/radiusd.conf
    cp -r $(FREERADIUS_DIR)/src/lib/.libs/* $(FREERADIUS_IPK_DIR)/freeradiusd/usr/lib
    cp -r $(FREERADIUS_DIR)/libltdl/.libs/* $(FREERADIUS_IPK_DIR)/freeradiusd/usr/lib
    rm -f $(FREERADIUS_IPK_DIR)/freeradiusd/etc/raddb/Makefile
    rm -rf $(FREERADIUS_IPK_DIR)/freeradiusd/etc/raddb/CVS
    rm -rf $(FREERADIUS_IPK_DIR)/freeradiusd/etc/raddb/certs
    cp $(FREERADIUS_DIR)/scripts/rc.radiusd $(FREERADIUS_IPK_DIR)/freeradiusd/etc/init.d/S99radiusd
    cat $(FREERADIUS_DIR)/share/dictionary|sed 's/^$$INCLUDE/#$$INCLUDE/g'|sed 's/#$$INCLUDE dictionary.cisco$$/$$INCLUDE dictionary.cisco/' > $(FREERADIUS_IPK_DIR)/freeradiusd/usr/share/freeradius/dictionary
    cp $(FREERADIUS_DIR)/share/dictionary.cisco $(FREERADIUS_IPK_DIR)/freeradiusd/usr/share/freeradius
    cd $(BUILD_DIR); $(IPKG_BUILD) $(FREERADIUS_IPK_DIR)/freeradiusd
    # Build democerts IPK
    mkdir -p $(FREERADIUS_IPK_DIR)/freeradius-democerts/CONTROL
    echo "Package: freeradius-democerts" > $(FREERADIUS_IPK_DIR)/freeradius-democerts/CONTROL/control
    echo "Version: $(FREERADIUS_VER)" >> $(FREERADIUS_IPK_DIR)/freeradius-democerts/CONTROL/control
    echo "Architecture: mipsel" >> $(FREERADIUS_IPK_DIR)/freeradius-democerts/CONTROL/control
    echo "Maintainer: Chris Martin <cmartin@opensimpad.org>" >> $(FREERADIUS_IPK_DIR)/freeradius-democerts/CONTROL/control
    echo "Source: $(FREERADIUS_SITE)/$(FREERADIUS_SOURCE)" >> $(FREERADIUS_IPK_DIR)/freeradius-democerts/CONTROL/control
    echo "Section: net" >> $(FREERADIUS_IPK_DIR)/freeradius-democerts/CONTROL/control
    echo "Priority: optional" >> $(FREERADIUS_IPK_DIR)/freeradius-democerts/CONTROL/control
    echo "Depends: freeradius" >> $(FREERADIUS_IPK_DIR)/freeradius-democerts/CONTROL/control
    echo "Description: Demo certs for FreeRADIUS Authentication Server" >> $(FREERADIUS_IPK_DIR)/freeradius-democerts/CONTROL/control
    mkdir -p $(FREERADIUS_IPK_DIR)/freeradius-democerts/etc/raddb/certs/demoCA
    cp -r $(FREERADIUS_DIR)/raddb/certs/* $(FREERADIUS_IPK_DIR)/freeradius-democerts/etc/raddb/certs
    rm -rf $(FREERADIUS_IPK_DIR)/freeradius-democerts/etc/raddb/certs/CVS
    rm -rf $(FREERADIUS_IPK_DIR)/freeradius-democerts/etc/raddb/certs/demoCA/CVS
    cd $(BUILD_DIR); $(IPKG_BUILD) $(FREERADIUS_IPK_DIR)/freeradius-democerts

freeradius-clean: 
    $(MAKE) -C $(FREERADIUS_DIR) clean

freeradius-dirclean: 
    rm -rf $(FREERADIUS_DIR) 

freeradius-ipk: uclibc freeradius-package
Post #2
sux
30 Oct 2004, 13:04

Hi,

I am also experimenting with freeradius. To save flash, I want to compile the daemon with static libradius and rlm_*-modules and only the modules needed. However, I get an instant segfault within shipped libtool on startup. Already other libtool versions tried.

Current setup:

$(FREERADIUS_DIR)/.configured: $(FREERADIUS_DIR)/.patched
        cd $(FREERADIUS_DIR);
        rm -rf config.cache ;
        $(TARGET_CONFIGURE_OPTS)
        CFLAGS="-g -mips2"
        ac_cv_linux_vers="2"
        ./configure
        --target=$(GNU_TARGET_NAME)
        --host=$(GNU_TARGET_NAME)
        --build=$(GNU_HOST_NAME)
        --prefix=/usr
        --sysconfdir=/etc
        --localstatedir=/var/lib
        $(DISABLE_NLS)
        --enable-static
        --disable-shared
        --without-threads
        touch $(FREERADIUS_DIR)/.configured

and this new freeradius-1.0.1/src/modules/stable:

rlm_chap
rlm_mschap
rlm_detail
rlm_files
rlm_eap

Any ideas, incompatibities between uclibc and libtool etc?

Stefan

Post #3
cmartin
1 Nov 2004, 21:31

Well, I didn't compile in any modules statically and my radiusd runs fine. I haven't had any succes in getting a WPA+RADIUS or a plain RADIUS authentication, but I am working on it. I'm running everything (FreeRADIUS + wpa_supplicant on the client side) in debug mode to get things worked out.

With EAP/TLS I get the TLS Handshake successful, but some error about MS MPE (?) or something of the sort is coming up. I don't really know what that has to do with EAP/TLS, but the error os shown on the RADIUS side.

With PEAP I get an SSL error and need to check that out. But I think PEAP is going to be overkill with FreeRADIUS, since the EAP/TLS libraries are also necessary. EAP/TLS will be smaller, but it requires Client Certificates, so that may not be what most users will want.

Post #4
cmartin
2 Nov 2004, 13:03

OK, I now have successfully authenticated my linux client (using wpa_supplicant) to the wrt using FreeRADIUS on the wrt!!!

I have only tested EAP-TLS using the demo certs in the freeradius distribution.

This works with both WPA-RADIUS and RADIUS (using dynamic WEP) settings via the nas binary.

Now I will set out to discover what is actually NEEDED (libs etc.) and recompile with static bindings instead of shared in order to minimize the package size. The first thing I will do is set up my freeradius.mk to create an ipk for EAP-TLS. As soon as I get PEAP working then it may be good to just have a complete package for PEAP. This way you just install the freeradius version you plan on using. Of course if someone plans on running a mixed environment it may be wise to compile a seperate shared lib version. We'll see ;-)

I will submit my findings soon.

Post #5
cmartin
3 Nov 2004, 17:06

OK, building with static libraries doesn't work for me either.

I eventually gave up on it. I buildt shared libraries. My makefile now creates three IPKs (freeradius-democerts, freeradius-eap-tls and freeradius-eap-peap).

EAP/TLS works like a charm both for RADIUS (+ danamic WEP) and WPA-RADIUS.

EAP/PEAP hasn't been tested.

BTW: My packages are preconfigured, so if you use the democerts it works out of the box. (You only need to have the nas binary started with the appropriate options and the right settings in nvram)

NOTE: Remeber to set date properly on the wrt or the certificate verification fails. I added a routine in the startup script that checks if the date is set to Jan. 1 2000 and if so it sets the date to that of the latest certificate in /etc/raddb/certs - so if you use ntp comment those lines out!

I will work on a script for configuring things.

At the time you would have to set nvram variables and start the nas binary yourself.

Testers welcome!

My feed:
http://opensimpad.org/feeds/openwrt/

The Packages:
http://opensimpad.org/feeds/openwrt/fre … mipsel.ipk
http://opensimpad.org/feeds/openwrt/fre … mipsel.ipk
http://opensimpad.org/feeds/openwrt/fre … mipsel.ipk

Post #6
jasonloveday
19 Dec 2004, 15:18

Hi,
I am playing with this, specifically to do chillispot, wpa + radius.

Is there any chance someone could compile the mysql module, "rlm_sql_mysql" for this?  Or maybe put up a makefile?

I should mention, I'm a linux Midget..

Thanks

Cheers,
Jason

The discussion might have continued from here.