Hi all, I installed freeradius-3.0.4-6.el7 on Centos 7.1 to replace our existing freeradius-2.1.12-6. I am having difficulty enabling LDAP. LDAP in our existing freeradius-2.1.12-6 works like a charm, but as soon as I enable LDAP in /sites-available/inner-tunnel radiusd won't start. I have linked ldap in /mods-available. ldap -> /etc/raddb/mods-available/ldap # diff inner-tunnel inner-tunnel.ORIG 227,229c224,226 < Auth-Type LDAP { < ldap < } ---
# Auth-Type LDAP { # ldap # }
Here is relevant error messages. # systemctl status radiusd.service -l radiusd.service - FreeRADIUS high performance RADIUS server. Loaded: loaded (/usr/lib/systemd/system/radiusd.service; disabled) Active: failed (Result: exit-code) since Wed 2015-10-07 10:20:41 PDT; 10min ago Process: 17895 ExecStart=/usr/sbin/radiusd -d /etc/raddb (code=exited, status=0/SUCCESS) Process: 18504 ExecStartPre=/usr/sbin/radiusd -C (code=exited, status=1/FAILURE) Process: 18500 ExecStartPre=/bin/chown -R radiusd.radiusd /var/run/radiusd (code=exited, status=0/SUCCESS) Main PID: 17897 (code=exited, status=0/SUCCESS) Oct 07 10:20:41 ccndev4.triumf.ca systemd[1]: Starting FreeRADIUS high performance RADIUS server.... Oct 07 10:20:41 ccndev4.triumf.ca systemd[1]: radiusd.service: control process exited, code=exited status=1 Oct 07 10:20:41 ccndev4.triumf.ca systemd[1]: Failed to start FreeRADIUS high performance RADIUS server.. Oct 07 10:20:41 ccndev4.triumf.ca systemd[1]: Unit radiusd.service entered failed state. # journalctl -xn -- Logs begin at Sat 2015-10-03 09:04:12 PDT, end at Wed 2015-10-07 10:30:01 PDT. -- Oct 07 10:20:01 ccndev4.triumf.ca systemd[1]: Starting Session 735 of user root. -- Subject: Unit session-735.scope has begun with start-up -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- Unit session-735.scope has begun starting up. Oct 07 10:20:01 ccndev4.triumf.ca systemd[1]: Started Session 735 of user root. -- Subject: Unit session-735.scope has finished start-up -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- Unit session-735.scope has finished starting up. -- The start-up result is done. Oct 07 10:20:01 ccndev4.triumf.ca CROND[18463]: (root) CMD (/usr/lib64/sa/sa1 1 1) Oct 07 10:20:41 ccndev4.triumf.ca systemd[1]: Starting FreeRADIUS high performance RADIUS server.... -- Subject: Unit radiusd.service has begun with start-up -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- Unit radiusd.service has begun starting up. Oct 07 10:20:41 ccndev4.triumf.ca systemd[1]: radiusd.service: control process exited, code=exited status Oct 07 10:20:41 ccndev4.triumf.ca systemd[1]: Failed to start FreeRADIUS high performance RADIUS server.. -- Subject: Unit radiusd.service has failed -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- Unit radiusd.service has failed. -- The result is failed. Oct 07 10:20:41 ccndev4.triumf.ca systemd[1]: Unit radiusd.service entered failed state. Oct 07 10:30:01 ccndev4.triumf.ca systemd[1]: Starting Session 736 of user root. -- Subject: Unit session-736.scope has begun with start-up -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- Unit session-736.scope has begun starting up. Oct 07 10:30:01 ccndev4.triumf.ca systemd[1]: Started Session 736 of user root. -- Subject: Unit session-736.scope has finished start-up Any ideas? Many thanks in advance, Hossein Rafighi -- _____ _____ _____ _ _ _ _ ____ Hossein Rafighi |_ _|| _ \ |_ _|| | | || \_/ || __|TRIUMF, 4004 Wesbrook Mall | | | |_| ) | | | | | || || |__ Vancouver BC, Canada, V6T 2A3 | | | _ / | | | \_/ || \_/ || __|Voice: (604) 222-1047 | | | | \ \ _| |_ | || | | || | Fax: (604) 222-1074 |_| |_| \_\|_____| \___/ |_| |_||_| Website: http://www.triumf.ca
On Oct 7, 2015, at 1:40 PM, Hossein Rafighi <Hossein.Rafighi@triumf.ca> wrote:
I installed freeradius-3.0.4-6.el7
Please don't. 3.0.10 was released this week. It's trivial to build your own RPM. And that RPM will include many fixes.
on Centos 7.1 to replace our existing freeradius-2.1.12-6. I am having difficulty enabling LDAP. LDAP in our existing freeradius-2.1.12-6 works like a charm, but as soon as I enable LDAP in /sites-available/inner-tunnel radiusd won't start. I have linked ldap in /mods-available.
Did you run the server in debugging mode as suggested in the FAQ, web pages, "man" page, and daily on this list? No? Why not? The debug output will *tell you* what's going wrong, and why.
Here is relevant error messages.
Nope. None of those messages are relevant. You're looking at the logs from systemd, not the logs from FreeRADIUS. Alan DeKok.
Thanks for the quick reply. Are you saying this is a known issue with the version I have, and is fixed in 3.0.10? Running the server in debug mode gives: Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/ldap /etc/raddb/mods-enabled/ldap[115]: Invalid location for 'if' Errors reading or parsing /etc/raddb/radiusd.conf There are so many "if"s I am not sure which the above is referring to? Also the last line is not quite clear to me! Cheers, Hossein On 10/7/2015 10:47 AM, Alan DeKok wrote:
On Oct 7, 2015, at 1:40 PM, Hossein Rafighi <Hossein.Rafighi@triumf.ca> wrote:
I installed freeradius-3.0.4-6.el7 Please don't. 3.0.10 was released this week. It's trivial to build your own RPM. And that RPM will include many fixes.
on Centos 7.1 to replace our existing freeradius-2.1.12-6. I am having difficulty enabling LDAP. LDAP in our existing freeradius-2.1.12-6 works like a charm, but as soon as I enable LDAP in /sites-available/inner-tunnel radiusd won't start. I have linked ldap in /mods-available. Did you run the server in debugging mode as suggested in the FAQ, web pages, "man" page, and daily on this list? No? Why not?
The debug output will *tell you* what's going wrong, and why.
Here is relevant error messages. Nope. None of those messages are relevant. You're looking at the logs from systemd, not the logs from FreeRADIUS.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- _____ _____ _____ _ _ _ _ ____ Hossein Rafighi |_ _|| _ \ |_ _|| | | || \_/ || __|TRIUMF, 4004 Wesbrook Mall | | | |_| ) | | | | | || || |__ Vancouver BC, Canada, V6T 2A3 | | | _ / | | | \_/ || \_/ || __|Voice: (604) 222-1047 | | | | \ \ _| |_ | || | | || | Fax: (604) 222-1074 |_| |_| \_\|_____| \___/ |_| |_||_| Website: http://www.triumf.ca
ldap[115]: Invalid location for 'if'
it means the "if" in line 115 of /etc/raddb/mods-enabled/ldap On Wed, Oct 7, 2015 at 3:01 PM, Hossein Rafighi <Hossein.Rafighi@triumf.ca> wrote:
Thanks for the quick reply.
Are you saying this is a known issue with the version I have, and is fixed in 3.0.10? Running the server in debug mode gives: Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/ldap /etc/raddb/mods-enabled/ldap[115]: Invalid location for 'if' Errors reading or parsing /etc/raddb/radiusd.conf
There are so many "if"s I am not sure which the above is referring to? Also the last line is not quite clear to me!
Cheers, Hossein
On 10/7/2015 10:47 AM, Alan DeKok wrote:
On Oct 7, 2015, at 1:40 PM, Hossein Rafighi <Hossein.Rafighi@triumf.ca> wrote:
I installed freeradius-3.0.4-6.el7
Please don't. 3.0.10 was released this week. It's trivial to build your own RPM. And that RPM will include many fixes.
on Centos 7.1 to replace our existing freeradius-2.1.12-6. I am having
difficulty enabling LDAP. LDAP in our existing freeradius-2.1.12-6 works like a charm, but as soon as I enable LDAP in /sites-available/inner-tunnel radiusd won't start. I have linked ldap in /mods-available.
Did you run the server in debugging mode as suggested in the FAQ, web pages, "man" page, and daily on this list? No? Why not?
The debug output will *tell you* what's going wrong, and why.
Here is relevant error messages.
Nope. None of those messages are relevant. You're looking at the logs from systemd, not the logs from FreeRADIUS.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- _____ _____ _____ _ _ _ _ ____ Hossein Rafighi |_ _|| _ \ |_ _|| | | || \_/ || __|TRIUMF, 4004 Wesbrook Mall | | | |_| ) | | | | | || || |__ Vancouver BC, Canada, V6T 2A3 | | | _ / | | | \_/ || \_/ || __|Voice: (604) 222-1047 | | | | \ \ _| |_ | || | | || | Fax: (604) 222-1074 |_| |_| \_\|_____| \___/ |_| |_||_| Website: http://www.triumf.ca
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Oct 7, 2015, at 2:01 PM, Hossein Rafighi <Hossein.Rafighi@triumf.ca> wrote:
Are you saying this is a known issue with the version I have, and is fixed in 3.0.10?
You edited the default configuration and broke it. Don't do that.
Running the server in debug mode gives: ... /etc/raddb/mods-enabled/ldap[115]: Invalid location for 'if' Errors reading or parsing /etc/raddb/radiusd.conf
There are so many "if"s I am not sure which the above is referring to? Also the last line is not quite clear to me!
It's line 115 of the file /etc/raddb/mods-enabled/ldap. I really don't know how to make the error message any more clear. Alan DeKok.
Sorry, but I edited the /mods-available/ldap module I thought was relevant?! I an revert back, but where can I enable ldap for users authentication? Also, I see the "if ((ok || updated) && User-Password)" statement, but not sure if I need to comment it out?! Isn't it needed there? Hossein On 10/7/2015 11:03 AM, Alan DeKok wrote:
On Oct 7, 2015, at 2:01 PM, Hossein Rafighi <Hossein.Rafighi@triumf.ca> wrote:
Are you saying this is a known issue with the version I have, and is fixed in 3.0.10? You edited the default configuration and broke it. Don't do that.
Running the server in debug mode gives: ... /etc/raddb/mods-enabled/ldap[115]: Invalid location for 'if' Errors reading or parsing /etc/raddb/radiusd.conf
There are so many "if"s I am not sure which the above is referring to? Also the last line is not quite clear to me! It's line 115 of the file /etc/raddb/mods-enabled/ldap.
I really don't know how to make the error message any more clear.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- _____ _____ _____ _ _ _ _ ____ Hossein Rafighi |_ _|| _ \ |_ _|| | | || \_/ || __|TRIUMF, 4004 Wesbrook Mall | | | |_| ) | | | | | || || |__ Vancouver BC, Canada, V6T 2A3 | | | _ / | | | \_/ || \_/ || __|Voice: (604) 222-1047 | | | | \ \ _| |_ | || | | || | Fax: (604) 222-1074 |_| |_| \_\|_____| \___/ |_| |_||_| Website: http://www.triumf.ca
You've appear to have uncommented documentation. ..read what it says. You need to put that sort of stuff into the virtual server config (ie in the authorize section of the inner tunnel) as the online documentation is telling you :) alan
Much appreciate the advise. I did per your suggestion and all seems okay except for ldap binding! This is weird! I use exact the same username/password for ldap binding on my radius server 2.x, and couple other servers however, on this one I am getting "Invalid credentials"! I must admit, it has been few years since I setup freeradius 2.x, and much has changed since. If I enable start_tls I get: TLS: error: the certificate '/etc/raddb/certs/ccndev4.triumf.ca.crt' could not be found in the database - error -5939:No more entries in the directory. TLS: certificate '/etc/raddb/certs/ccndev4.triumf.ca.crt' successfully loaded from PEM file. TLS: no unlocked certificate for certificate 'E=system@triumf.ca,CN=ccndev4.triumf.ca,OU=Computing Services,O=TRIUMF,L=Vancouver,ST=BC,C=CA'. TLS: certificate [CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US] is not valid - error -8172:Peer's certificate issuer has been marked as not trusted by the user.. TLS: error: connect - force handshake failure: errno 0 - moznss error -8172 TLS: can't connect: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.. rlm_ldap (ldap): Could not start TLS: Connect error rlm_ldap (ldap): Opening connection failed (0) rlm_ldap (ldap): Removing connection pool /etc/raddb/mods-enabled/ldap[12]: Instantiation failed for module "ldap" my certs are self signed and in /certs. The same as freeradius 2 server that is happy! If I set start_tls to no I get: rlm_ldap: Falling back to build time libldap version info. Query for LDAP_OPT_API_INFO returned: -1 rlm_ldap: libldap vendor: OpenLDAP version: 20439 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 4 max = 32 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 1 spread = no } rlm_ldap (ldap): Opening additional connection (0) rlm_ldap (ldap): Connecting to trmail.triumf.ca:389 rlm_ldap (ldap): Could not set random_file: Success rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind credentials incorrect: Invalid credentials rlm_ldap (ldap): Opening connection failed (0) rlm_ldap (ldap): Removing connection pool /etc/raddb/mods-enabled/ldap[12]: Instantiation failed for module "ldap" Here is the LDAP related entries: server = "myldap.triumf.ca" port = 389 identity = "cn=manager,o=triumf" password = **************** base_dn = "o=triumf" edir_autz = yes access_attribute = "uid" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" Everything else is default! Did I miss something else here? Many thanks for all your advise, Hossein On 10/7/2015 11:35 AM, Alan Buxey wrote:
You've appear to have uncommented documentation. ..read what it says. You need to put that sort of stuff into the virtual server config (ie in the authorize section of the inner tunnel) as the online documentation is telling you :)
alan
-- _____ _____ _____ _ _ _ _ ____ Hossein Rafighi |_ _|| _ \ |_ _|| | | || \_/ || __|TRIUMF, 4004 Wesbrook Mall | | | |_| ) | | | | | || || |__ Vancouver BC, Canada, V6T 2A3 | | | _ / | | | \_/ || \_/ || __|Voice: (604) 222-1047 | | | | \ \ _| |_ | || | | || | Fax: (604) 222-1074 |_| |_| \_\|_____| \___/ |_| |_||_| Website: http://www.triumf.ca
On Oct 7, 2015, at 2:14 PM, Hossein Rafighi <Hossein.Rafighi@triumf.ca> wrote:
Sorry, but I edited the /mods-available/ldap module I thought was relevant?! I an revert back, but where can I enable ldap for users authentication? Also, I see the "if ((ok || updated) && User-Password)" statement, but not sure if I need to comment it out?! Isn't it needed there?
You need to READ THE COMMENTS in the file you edited. The comments are documentation. They tell you where that "if" statement should go. Alan DeKok.
radiusd.conf reading could not complete due to it unable to pull in all included modules because the ldap module has something incorrect in it at line 115 alan
Run radiusd -X and see the output - it will tell you what's wrong and why the server won't start from the systemd script alan
participants (4)
-
Alan Buxey -
Alan DeKok -
Hernán Freschi -
Hossein Rafighi