- Freeradius-Users - lists.freeradius.org

Referencing a module by a ${}-Variable
by freeradius-mlist-users＠m20.kunterbunt.de 14 Jan '21

14 Jan '21

Hello all, I am trying to set up a freeradius server with several mysql databases for different sets of accounts. The distinguation of the request should happen via the 'nas' table, which points to the different virtual servers. So, in the directory "sites-enabled" I have a file defining several virtual servers: server wlan { instance_name = "wlan" $INCLUDE "../sites-available/instances_include" } and within in the "instances_include" I want to refer to a separate instance of the SQL module: authorize { filter_username filter_password preprocess sql_instance_${.instance_name} auth_log } These modules are all defined in "mods-enabled": sql sql_instance_wlan { radius_db = "raddb_wlan" $INCLUDE "../mods-available/sql_instances_include" } The problem here is, that the line "sql_instance_${.instance_name}" is not accepted during server startup: including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/instances including configuration file /etc/freeradius/3.0/sites-enabled/../sites-available/instances_include /etc/freeradius/3.0/sites-enabled/../sites-available/instances_include[10]: Parse error after ".instance_name": unexpected token "}" Errors reading or parsing /etc/freeradius/3.0/radiusd.conf First I tried to use ${.name2}, which I hoped to refer to the section name "wlan". When this didn't worked, I defined a separate variable "instance_name". I checked the files, that they have standard UNIX line termination and no additional ctrl characters. FreeRADIUS Version 3.0.17 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... Is there any possibility to refer to a module by a ${} variable? Thanks for your attention and hopefully your help! Kind regards, Michael Sievert

2 1

Problem with EAP Identity
by Michael Schwartzkopff 13 Jan '21

13 Jan '21

Hi, I stumbled upon a strange behaviour of my switches. I want to configure 802.1x. In the first packet the Switch sends: Debug: (7) Received Access-Request Id 81 from x.x.x.46:36296 to x.x.x.154:1812 length 152 Debug: (7) User-Name = "3464A9D11215" The debug goes on: Debug: (7) eap: Peer sent packet with method EAP Identity (1) Debug: (7) eap: EAP session adding &reply:State = 0x45e56b9d45e46617 Debug: (7) modsingle[authenticate]: returned from eap (rlm_eap) Debug: (7) [eap] = handled The next request from the switch is: Debug: (8) Received Access-Request Id 82 from x.x.x.46:36296 to x.x.x.154:1812 length 167 Debug: (8) User-Name = "host/test(a)xxx.xx" (...) Debug: (8) State = 0x45e56b9d45e46617718e28efb749ef6f and then the RADIUS server complains: Debug: (8) eap: Previous EAP request found for state 0x45e56b9d45e46617, released from the list Debug: (8) eap: Identity does not match User-Name. Authentication failed Debug: (8) eap: Failed in handler Can anyone explain what happens here? Does the switch change the User-Name within the RADIUS / EAP session? Is this a bug of the switch? Or does something other happen here? Thanks for any hints. Mit freundlichen Grüßen, -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG,80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief Aufsichtsratsvorsitzender: Florian Kirstein

3 5

Wrong date of freeradius 3 recording in MySql
by Nikolai Petrov 12 Jan '21

12 Jan '21

Hello, I installed FreeRADIUS 3, Daloradius, and MySQL Debian 9. After some struggle I drove everything I had on another machine with a similar installation but with freeradius 2. I noticed a problem with accounting (wrote in db). The time is correct, but the date is 2 days ago. The problem is from freeradius. When I write from PHP in MySql my date is ok, but from accounting, it comes with a date of -2 days. *Do you any idea of where to hide the problem?* Best Regards, Nikolai Petrov

2 5

EAP-PEAP: unknown ca error
by Nick Iatsenko 08 Jan '21

08 Jan '21

Hello everyone, I successfully configured FreeRADIUS 3.0.21 on my new Opnsense firewall. Connected devices via Wi-Fi: - iOS : OK - MacOS : OK - Android : KO I found another person (Daniel Lopez) having similar issue with EAP-TLS back in 2017 but he was provided link to the resource with instructions for different clients (OS) but not Android. Root CA is used to issue Server cert (no intermediate cert is used - it's a home setup ;) ). I installed Root CA cert on my Pixel3 > Settings > Security > Encryption & Credentials > Install a certificate > CA Certificate > followed the dialog New Root CA cert is visible under Settings > Security > Encryption & Credentials > Trusted credentials > User My concern: I don't see my new Root CA cert under CA certificate section in the Wi-Fi profile and have to choose "Use system certificates" Below is the debug result. I hope it helps to confirm my hypothesis (presented Server cert is not Trusted by Android phone). Feel free to forward me to the other Android related resource if this is not the right place to ask for help with my issue. (261) Received Access-Request Id 62 from 192.168.31.2:53892 to 192.168.31.1:1812 length 183 (261) Service-Type = Framed-User (261) Framed-MTU = 1400 (261) User-Name = "Nick_Pixel3" (261) State = 0x7616a93d7e1fb07496c66d6bce81643b (261) NAS-Port-Id = "guest_WLAN" (261) NAS-Port-Type = Wireless-802.11 (261) Calling-Station-Id = "96-4D-45-A8-84-E0" (261) Called-Station-Id = "CC-2D-E0-A9-52-2A:XATA_guest" (261) EAP-Message = 0x0209001119800000000715030300020230 (261) Message-Authenticator = 0x145801a756ad058b3a78d10e7f6343f1 (261) NAS-Identifier = "MikroTik" (261) NAS-IP-Address = 192.168.31.2 (261) session-state: No cached attributes (261) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (261) authorize { (261) policy filter_username { (261) if (&User-Name) { (261) if (&User-Name) -> TRUE (261) if (&User-Name) { (261) if (&User-Name =~ / /) { (261) if (&User-Name =~ / /) -> FALSE (261) if (&User-Name =~ /@[^@]*@/ ) { (261) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (261) if (&User-Name =~ /\.\./ ) { (261) if (&User-Name =~ /\.\./ ) -> FALSE (261) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (261) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (261) if (&User-Name =~ /\.$/) { (261) if (&User-Name =~ /\.$/) -> FALSE (261) if (&User-Name =~ /(a)\./) { (261) if (&User-Name =~ /(a)\./) -> FALSE (261) } # if (&User-Name) = notfound (261) } # policy filter_username = notfound (261) [preprocess] = ok (261) [chap] = noop (261) [mschap] = noop (261) [digest] = noop (261) suffix: Checking for suffix after "@" (261) suffix: No '@' in User-Name = "Nick_Pixel3", looking up realm NULL (261) suffix: No such realm "NULL" (261) [suffix] = noop (261) eap: Peer sent EAP Response (code 2) ID 9 length 17 (261) eap: Continuing tunnel setup (261) [eap] = ok (261) } # authorize = ok (261) Found Auth-Type = eap (261) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (261) authenticate { (261) eap: Expiring EAP session with state 0x7616a93d7e1fb074 (261) eap: Finished EAP session with state 0x7616a93d7e1fb074 (261) eap: Previous EAP request found for state 0x7616a93d7e1fb074, released from the list (261) eap: Peer sent packet with method EAP PEAP (25) (261) eap: Calling submodule eap_peap to process data (261) eap_peap: Continuing EAP-TLS (261) eap_peap: Peer indicated complete TLS record size will be 7 bytes (261) eap_peap: Got complete TLS record (7 bytes) (261) eap_peap: [eaptls verify] = length included (261) eap_peap: <<< recv TLS 1.2 [length 0002] (261) eap_peap: ERROR: TLS Alert read:fatal:unknown CA (261) eap_peap: TLS_accept: Need to read more data: error (261) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read): error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca (261) eap_peap: TLS - In Handshake Phase (261) eap_peap: TLS - Application data. (261) eap_peap: ERROR: TLS failed during operation (261) eap_peap: ERROR: [eaptls process] = fail (261) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (261) eap: Sending EAP Failure (code 4) ID 9 length 4 (261) eap: Failed in EAP select (261) [eap] = invalid (261) } # authenticate = invalid (261) Failed to authenticate the user (261) Using Post-Auth-Type Reject (261) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (261) Post-Auth-Type REJECT { (261) attr_filter.access_reject: EXPAND %{User-Name} (261) attr_filter.access_reject: --> Nick_Pixel3 (261) attr_filter.access_reject: Matched entry DEFAULT at line 11 (261) [attr_filter.access_reject] = updated (261) [eap] = noop (261) policy remove_reply_message_if_eap { (261) if (&reply:EAP-Message && &reply:Reply-Message) { (261) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (261) else { (261) [noop] = noop (261) } # else = noop (261) } # policy remove_reply_message_if_eap = noop (261) } # Post-Auth-Type REJECT = updated

2 1

EAP-TLS with LDAP user attribute check
by stray electron 08 Jan '21

08 Jan '21

Hello Everyone, (short) How can I check an LDAP group membership (or attribute) in an EAP-TLS setup? Any help would be appreciated. :) (long) I try to set up a Freeradius 3.0 where the client auth is done with EAP-TLS but also checks if the client is in the LDAP (and/or check some user attribute in the LDAP). If the client has a valid certificate but is not in the LDAP then he should be rejected. Since the auth is already done by EAP-TLS certificates no user bind to the LDAP should be needed, besides I don't have the user password anyway. But I have an LDAP account configured for the Radius server so it can access the user data. So far EAP-TLS works fine, I suppose the 10-times repetition of the authorize part is due to the EAP messages exchanged with the client, or am I wrong? Problem is though, that the LDAP search is done 10-times too for each client request. I think this would lead to a huge load of our LDAP server. I tried to put the ldap stanza into other places like post-auth, but then it tries to write to the LDAP, or in authenticate where the user password is required. For now I have the LDAP configured that way, that it will do all the attribute filtering/checking for the Radius. So if a user is not allowed to access the WLAN the Radius just does not find the user. But it would be also fine if the Radius itself would do the attribute checking somehow, but I do not know how to import and use these attributes. Is there a way to reduce the LDAP searches/load somehow? (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { rlm_ldap (ldap): Reserved connection (0) (0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (uid=clientname) (0) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "uid=clientname,ou=user,o=example,c=de" (0) ldap: Processing user attributes rlm_ldap (ldap): Released connection (0) rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.example.de:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) [ldap] = ok (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) } # authorize = ok (0) authenticate { (0) } # authenticate = handled ...[well this repeats several times, so I shortened it a bit] (1) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (2) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (3) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (4) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (5) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (6) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (7) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (8) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (9) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" ... (10) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (10) authorize { rlm_ldap (ldap): Reserved connection (4) (10) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (10) ldap: --> (uid=clientname) (10) ldap: Performing search in "ou=user,o=example,c=de" with filter "(uid=clientname)", scope "sub" (10) ldap: Waiting for search result... (10) ldap: User object found at DN "uid=clientname,ou=user,o=example,c=de" (10) ldap: Processing user attributes rlm_ldap (ldap): Released connection (4) rlm_ldap (ldap): Opening additional connection (6), 1 of 26 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.example.de:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (10) [ldap] = ok (10) } # authorize = updated (10) authenticate { (10) } # authenticate = ok (10) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (10) post-auth { (10) } # post-auth = ok Regards, Felix Freeradius3 Configuration: ------------------------------------ server eduroam { listen { type = auth ipaddr = * port = 1812 } authorize { linelog_recv_request split_username_nai if (noop || !&Stripped-User-Domain) { reject } if (&Stripped-User-Domain != "${operator_name}") { update { control:Load-Balance-Key := &Calling-Station-ID control:Proxy-To-Realm := 'eduroam_flr' request:Operator-Name := "1${operator_name}" } return } ldap if (!ok) { reject } eap { ok = return updated = return } } pre-proxy { attr_filter.pre-proxy linelog_send_proxy_request } post-proxy { attr_filter.post-proxy linelog_recv_proxy_response } authenticate { eap } post-auth { update reply { Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 } if (&control:Proxy-To-Realm) { update reply { Tunnel-Private-Group-ID = ${eduroam_default_guest_vlan} } } else { update reply { Tunnel-Private-Group-ID = ${eduroam_default_local_vlan} } } if (&session-state:Stripped-User-Name) { update reply { User-Name := "%{session-state:Stripped-User-Name}@%{Stripped-User-Domain}" } } linelog_send_accept Post-Auth-Type REJECT { attr_filter.access_reject linelog_send_reject } } } # Loading module "ldap" from file /etc/freeradius/3.0/mods-enabled/ldap ldap { server = "ldaps://ldap.example.de:636" identity = "cn=radius,ou=accounts,ou=admin,o=example,c=de" password = <<< secret >>> sasl { } user { scope = "sub" access_positive = yes sasl { } } group { filter = "(objectClass=posixGroup)" scope = "sub" name_attribute = "cn" membership_attribute = "memberOf" membership_filter = "(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "ou=user,o=example,c=de" } profile { } options { ldap_debug = 0 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { ca_file = "/etc/ssl/certs/ca-certificates.crt" start_tls = no require_cert = "demand" } }

2 1

Unable to delete unwanted attributes from Disconnect-Request
by Tasos Kotaras 08 Jan '21

08 Jan '21

Hello<https://stackoverflow.com/posts/65629171/timeline> I'm struggling to remove some unwanted attributes from the disconnect message emitted after a failure in the rest module. More specifically, in accounting mode, when I receive a Accounting-Request, I either return an Accounting-Response or Disconnect-Request, depending on the HTTP status returned in a REST interaction. Both cases work properly, the only issue is that the disconnect message also contains these attributes that nag NAS (they cause it to return a NAK): |NAS-Port Teardown-Indicator (as 3GPP VSA) | These attributes are not present in the request. If they were, I could easily remove them and this would also affect the generated disconnect. But apparently, these attributes are added at some point that I have no control. The "/update disconnect {...}/" has no effect, as I guess it is relevant only to received messages (not clear from the documentation). I understand that disconenct belongs to a different connection, so it cannot be related and handled by tampering with 'reply' or anythig that freeradius provides me as variables. Still, I badly need to somehow solve the issue, as I have no control over the NAS itself. Configuration details: _mod-enabled/rest:_ |accounting { uri = "http://x.x.x.x:yyyy/..." method = 'post' body = 'json' tls = ${..tls} } | _sites-enables/default:_ |accounting { rest # this has no effect (same if placed inside rest {...}): update disconnect { NAS-Port !* ANY Teardown-Indicator !* ANY } } | radius -X writes these: |(0) rest: Sending HTTP POST to "http://x.x.x.x:yyyy/..." (0) rest: Encoding attribute "User-Name" (0) rest: Encoding attribute "Framed-IP-Address" (0) rest: Encoding attribute "Acct-Status-Type" (0) rest: Encoding attribute "Acct-Session-Id" (0) rest: Processing response header (0) rest: Status : 503 (Service Unavailable) (0) rest: ERROR: Server returned no data rlm_rest (rest): Released connection (0) Need 5 more connections to reach 10 spares rlm_rest (rest): Opening additional connection (5), 1 of 27 pending slots used rlm_rest (rest): Skipping pre-connect, connect_uri not specified (0) [rest] = fail (0) } # accounting = fail (0) WARNING: Unknown destination 127.0.0.1:3799 for CoA request. (0) Not sending reply to client. (0) Finished request | REST works OK and the 503 is expected for this particular case. I cannot see something wrong (the ERROR and WARNING are not a huge surprise) I wonder if there is some workaround to persuade freeradius not to add these naughty attributes, or otherwise, give me the chance to remove them?

2 1

disable available EAP types for certain caller-id?
by Kacper Wirski 07 Jan '21

07 Jan '21

Hello, I'd like to limit EAP types available depending on called-station-id (ip addresses only for EAP-TLS. Would something like this - in general - in my "default" site work? Maybe there is a better way to achieve the same thing? Overall I want to use other EAP-types, so I can't just comment them out in eap module, but I'd like to filter them for specific connections. I'm using latest stable Freeradius (3.0.21) authorize { ... if (&Called-Station-Id == "<my-public-ip>" && &EAP-Type != EAP-TLS) { reject } eap { ok = return } ..... } Regards, Kacper -- Ta wiadomość została sprawdzona na obecność wirusów przez oprogramowanie antywirusowe Avast. https://www.avast.com/antivirus

2 2

unsubscribe
by Kostya Berger 04 Jan '21

04 Jan '21

unsubscribe

2 1

Show Dhcp assigned IPS with respective MACs.
by CpServiceSPb 01 Jan '21

01 Jan '21

I have Freeradius 3.0.21 on Ubuntu 18.04 LTS Server (no X) acting as Radius itself and as Dhcp one. There is no Freeradius Web UI installed at the time. What are ways to show assigned IPs by DHCP respectively with its MACs from CLI and from some Web UI something like: MAC IP Assignment time Lease (or RElease) time

2 1

Re: Freeradius with lets encrypt certificate
by André 30 Dec '20

30 Dec '20

Hello, Problem solved by using openssl verify for debug and this link: https://stackoverflow.com/questions/50803160/unable-to-openssl-verify-letse… And downloading the correct CA and *ADDING* this CA https://www.identrust.com/dst-root-ca-x3 to a file ca_file = file to the mods-enable/eap # tls-config tls-common { Thank you all for your help. Basically it looks like the rootCA for let's encrypt changed. Best regards, Good 2021 year to all. On Tue, Dec 29, 2020 at 7:47 PM Mark Elkins <mje(a)posix.co.za> wrote: > No idea if this will help but... > > I just had a very similar issue with Exim... my mail system. I was using > the wrong (old) intermediate certificate - which has worked for years. > > I use 'dehydrated' to obtain and renew my Let's Encrypt certs. They have > just stopped cross signing - and that triggered my issue - at 2am on the > 25th Dec. > > EXIM requires the current cert, an intermediate, as well as what's in > /usr/share/ca-certificates/mozilla (they use/are "ISRG_Root_X1.crt")... > "dehydrated" has a file in the 'cert' directory called "fullchain.pem" Look > at the second Certificate it contains - the new intermediate. > > The intermediate is no longer.... > > -----BEGIN CERTIFICATE----- > MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/ > ..... cut .... > PfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6 > KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg== > -----END CERTIFICATE----- > > but (in full) > > -----BEGIN CERTIFICATE----- > MIIEZTCCA02gAwIBAgIQQAF1BIMUpMghjISpDBbN3zANBgkqhkiG9w0BAQsFADA/ > MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT > DkRTVCBSb290IENBIFgzMB4XDTIwMTAwNzE5MjE0MFoXDTIxMDkyOTE5MjE0MFow > MjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxCzAJBgNVBAMT > AlIzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuwIVKMz2oJTTDxLs > jVWSw/iC8ZmmekKIp10mqrUrucVMsa+Oa/l1yKPXD0eUFFU1V4yeqKI5GfWCPEKp > Tm71O8Mu243AsFzzWTjn7c9p8FoLG77AlCQlh/o3cbMT5xys4Zvv2+Q7RVJFlqnB > U840yFLuta7tj95gcOKlVKu2bQ6XpUA0ayvTvGbrZjR8+muLj1cpmfgwF126cm/7 > gcWt0oZYPRfH5wm78Sv3htzB2nFd1EbjzK0lwYi8YGd1ZrPxGPeiXOZT/zqItkel > /xMY6pgJdz+dU/nPAeX1pnAXFK9jpP+Zs5Od3FOnBv5IhR2haa4ldbsTzFID9e1R > oYvbFQIDAQABo4IBaDCCAWQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8E > BAMCAYYwSwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5p > ZGVudHJ1c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTE > p7Gkeyxx+tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEE > AYLfEwEBATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2Vu > Y3J5cHQub3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0 > LmNvbS9EU1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYf > r52LFMLGMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjANBgkqhkiG9w0B > AQsFAAOCAQEA2UzgyfWEiDcx27sT4rP8i2tiEmxYt0l+PAK3qB8oYevO4C5z70kH > ejWEHx2taPDY/laBL21/WKZuNTYQHHPD5b1tXgHXbnL7KqC401dk5VvCadTQsvd8 > S8MXjohyc9z9/G2948kLjmE6Flh9dDYrVYA9x2O+hEPGOaEOa1eePynBgPayvUfL > qjBstzLhWVQLGAkXXmNs+5ZnPBxzDJOLxhF2JIbeQAcH5H0tZrUlo5ZYyOqA7s9p > O5b85o3AM/OJ+CktFBQtfvBhcJVd9wvlwPsk+uyOy2HI7mNxKKgsBTt375teA2Tw > UdHkhVNcsAKX1H7GNNLOEADksd86wuoXvg== > -----END CERTIFICATE----- > > Maybe your problem - otherwise please simply delete this email and ignore > me. > > > On 12/29/20 6:23 PM, André wrote: > > freeradius cloned from github:https://github.com/FreeRADIUS/freeradius-server > > Tue Dec 29 14:31:40 2020: tls - Failed verifying chain: error:1414C086:SSL > routines:ssl_build_cert_chain:certificate verify failed:Verify error:unable > to get issuer certificate > Tue Dec 29 14:31:40 2020: rlm_eap_ttls - Failed initializing SSL context > Tue Dec 29 14:31:40 2020: > /usr/local/freeradius/etc/raddb/mods-enabled/eap[1031]: Instantiation > failed for module "eap.ttls" > > I'm using a let's encrypt certificate , but I'm getting this error message. > > What should the files I should be using for the cert? > > Best regards, > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > -- > > Mark James ELKINS - Posix Systems - (South) Africa > mje(a)posix.co.za Tel: +27.826010496 <+27826010496> > For fast, reliable, low cost Internet in ZA: https://ftth.posix.co.za > > [image: Posix Systems][image: VCARD for MJ Elkins] >

1 0