Error in my EAP-TLS config since 3.0.11
Hi List, I use FreeRADIUS 3.0.11 on Arch Linux (ARM). Since I've updated FreeRADIUS from 3.0.10 to 3.0.11 I'm unable to start the FreeRADIUS server.
# Instantiating module "eap" from file /etc/raddb/mods-enabled/eap /etc/raddb/mods-enabled/eap[17]: Failed to find 'Auth-Type EAP' section. Cannot authenticate users. /etc/raddb/mods-enabled/eap[17]: Instantiation failed for module "eap"
Here is the full output of radiusd -X: http://pastebin.com/GARg9fGC Here is the file /etc/raddb/mods-enabled/eap: http://pastebin.com/3Rww96t6 I haven't changed the configuration of the server for months. Downgrading to older versions (e.g. 3.0.10) resolves the issue. Is this a bug in the FreeRADIUS server or rather a misconfiguration that was tolerated in older versions? Thanks in advance for any hints. Regards Jannis
On Feb 6, 2016, at 6:46 AM, Jannis Pinter via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote: I use FreeRADIUS 3.0.11 on Arch Linux (ARM). Since I've updated FreeRADIUS from 3.0.10 to 3.0.11 I'm unable to start the FreeRADIUS server.
# Instantiating module "eap" from file /etc/raddb/mods-enabled/eap /etc/raddb/mods-enabled/eap[17]: Failed to find 'Auth-Type EAP' section. Cannot authenticate users. /etc/raddb/mods-enabled/eap[17]: Instantiation failed for module "eap"
You have an "eap" module, but not "eap" listed in any "authenticate" section. This is a misconfiguration which was allowed in older versions. The EAP module *must* be listed in "authenticate" for it to work. It can also be listed in the "authorize" section. You've probably configured an "eap" module, but then aren't using it anywhere. So the question is, what are you doing? Why do you have an "eap" module, but no "eap" in "authenticate" ? Alan DeKok.
Am 06.02.2016 um 15:09 schrieb Alan DeKok:
You have an "eap" module, but not "eap" listed in any "authenticate" section. This is a misconfiguration which was allowed in older versions. The EAP module *must* be listed in "authenticate" for it to work. It can also be listed in the "authorize" section. You've probably configured an "eap" module, but then aren't using it anywhere. So the question is, what are you doing? Why do you have an "eap" module, but no "eap" in "authenticate" ?
Hi Alan, thank you for your response. I do have eap listed in the "authenticate" section as well as in the "authorize" section. Here is a copy of /etc/raddb/sites-enabled/default: http://pastebin.com/LN2yYaZ7 Any ideas? Regards Jannis
On Feb 6, 2016, at 9:29 AM, Jannis Pinter via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
thank you for your response. I do have eap listed in the "authenticate" section as well as in the "authorize" section.
Hmm... can you send me a "tar" file of your raddb directory off-list? Alan DeKok.
participants (2)
-
Alan DeKok -
Jannis Pinter