rlm_eap_tls sometimes fails to read files after HUP
Hi I have just upgraded to FreeRADIUS 1.1.1 after previously using the 1.0.1 RedHat package. At first startup it works fine but sometimes when the server receives a HUP signal (we do this every 15 mins) to re-read the config files I am getting the following errors :- Wed Mar 22 16:48:45 2006 : Info: Reloading configuration files. Wed Mar 22 16:48:47 2006 : Info: rlm_eap_tls: Loading the certificate file as a chain Wed Mar 22 16:48:47 2006 : Error: rlm_eap_tls: Error reading certificate file Wed Mar 22 16:48:47 2006 : Error: rlm_eap: Failed to initialize type tls Wed Mar 22 16:48:47 2006 : Error: radiusd.conf[9]: eap: Module instantiation failed. Wed Mar 22 16:48:47 2006 : Error: radiusd.conf[1719] Unknown module "eap". Wed Mar 22 16:48:47 2006 : Error: radiusd.conf[1666] Failed to parse authenticate section. At this point I have to restart. As I said this only happens sometimes, at other times it is successful and I just get this :- Wed Mar 22 16:47:36 2006 : Info: Reloading configuration files. Wed Mar 22 16:47:36 2006 : Info: rlm_eap_tls: Loading the certificate file as a chain Wed Mar 22 16:47:37 2006 : Info: Ready to process requests. Could someone advise how to go about debugging this problem? Thanks Ben Thompson
Ben Thompson <bt4@york.ac.uk> wrote:
Could someone advise how to go about debugging this problem?
First I'd suggest editing the code so that it prints the SSL errors to radius.log, rather than stderr: http://bugs.freeradius.org/show_bug.cgi?id=347 That way the reason why SSL can't read the file will be printed too. Without that information, it's pretty much impossible to fix it. I've added a patch as an attachment to the bug report. It builds, but I haven't tested it. I'd suggest: a) try it in a test environment. If it doesn't kill the system, maybe put it in a live environment b) look at the logs to see what SSL errors are being returned right before the "Error reading certificate file" message. Alan DeKok.
On Thu, 2006-03-23 at 12:15 -0500, Alan DeKok wrote:
Ben Thompson <bt4@york.ac.uk> wrote:
Could someone advise how to go about debugging this problem?
b) look at the logs to see what SSL errors are being returned right before the "Error reading certificate file" message.
Hi Thanks for the help, here is the log :- Fri Mar 24 15:37:19 2006 : Info: Reloading configuration files. Fri Mar 24 15:37:19 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Fri Mar 24 15:37:19 2006 : Info: rlm_eap_tls: Loading the certificate file as a chain Fri Mar 24 15:37:19 2006 : Error: rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line Fri Mar 24 15:37:19 2006 : Error: rlm_eap_tls: Error reading certificate file Fri Mar 24 15:37:19 2006 : Error: rlm_eap: Failed to initialize type tls Fri Mar 24 15:37:19 2006 : Error: radiusd.conf[9]: eap: Module instantiation failed. Fri Mar 24 15:37:19 2006 : Error: radiusd.conf[1719] Unknown module "eap". Fri Mar 24 15:37:19 2006 : Error: radiusd.conf[1666] Failed to parse authenticate section. -- Ben Thompson University of York
Ben Thompson <bt4@york.ac.uk> wrote:
Fri Mar 24 15:37:19 2006 : Info: rlm_eap_tls: Loading the certificate file as a chain Fri Mar 24 15:37:19 2006 : Error: rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line
That is singularly unhelpful. I'm not sure what else to suggest at this point. Maybe the server doesn't have permission to read the file? Alan DeKok.
On Mon, 27 Mar 2006, Alan DeKok wrote:
That is singularly unhelpful.
I'm not sure what else to suggest at this point. Maybe the server doesn't have permission to read the file?
I'm going to be just as unhelpful for the moment, but I can confirm something weird is going on with HUP and eap_tls. Unfortunately I can replicate it on a server which is active, and can't on a test server ... most certainly restricts the ability for testing. I've checked permissions a lot, believe me.
gARetH baBB <hick.freeradius@gink.org> wrote:
I'm going to be just as unhelpful for the moment, but I can confirm something weird is going on with HUP and eap_tls.
If it works in 1.1.0 and not 1.1.1, then there's a bug in the server. I have no idea how to track it down, though. Alan DeKok.
participants (3)
-
Alan DeKok -
Ben Thompson -
gARetH baBB