I need some help with setting up multiple eap types. I am running CentOS 7.4. I have 2 profiles or virtual servers setup and want to use eap for one and eap-tls for the other. I am a little confused on how to set this up. For reference i've been trying to follow these sites:Freeradius Example Configuration - OTPme | | | Freeradius Example Configuration - OTPme Redmine | | | https://wiki.freeradius.org/config/Virtual-server Do I add the virtual_server=profile1 to the type of authentication in the eap config file? Thank you,
On Wed, 2017-11-29 at 04:15 +0000, Andrew Meyer via Freeradius-Users wrote:
I need some help with setting up multiple eap types. I am running CentOS 7.4. I have 2 profiles or virtual servers setup and want to use eap for one and eap-tls for the other. I am a little confused on how to set this up.
Easiest way is probably to copy the eap module configuration raddb/mods-available/eap to say raddb/mods-available/eap-ts, and rename the instance name, so you have eap { # configuration for one type of eap ... } as the default, and then e.g. eap eap-tls { # configuration for another type of eap ... } as your new copy. Then in one virtual server call "eap" as usual, and in the other virtual server call "eap-tls". -- Matthew
I will try this, and let you know if I run into errors. thank you! On Wednesday, November 29, 2017 4:49 AM, Matthew Newton <mcn@freeradius.org> wrote: On Wed, 2017-11-29 at 04:15 +0000, Andrew Meyer via Freeradius-Users wrote:
I need some help with setting up multiple eap types. I am running CentOS 7.4. I have 2 profiles or virtual servers setup and want to use eap for one and eap-tls for the other. I am a little confused on how to set this up.
Easiest way is probably to copy the eap module configuration raddb/mods-available/eap to say raddb/mods-available/eap-ts, and rename the instance name, so you have eap { # configuration for one type of eap ... } as the default, and then e.g. eap eap-tls { # configuration for another type of eap ... } as your new copy. Then in one virtual server call "eap" as usual, and in the other virtual server call "eap-tls". -- Matthew - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
So i'm getting this when I restart radiusd: [root@asm-rancid02 mods-enabled]# sudo systemctl status radiusd -l ● radiusd.service - FreeRADIUS high performance RADIUS server. Loaded: loaded (/usr/lib/systemd/system/radiusd.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Wed 2017-11-29 08:54:47 CST; 1s ago Process: 15573 ExecStart=/usr/sbin/radiusd -d /etc/raddb (code=exited, status=0/SUCCESS) Process: 17531 ExecStartPre=/usr/sbin/radiusd -C -X (code=exited, status=1/FAILURE) Process: 17530 ExecStartPre=/bin/chown -R radiusd.radiusd /var/run/radiusd (code=exited, status=0/SUCCESS) Main PID: 15580 (code=exited, status=0/SUCCESS) Nov 29 08:54:47 asm-rancid02.mgt.asm.borg.local radiusd[17531]: uses = 0 Nov 29 08:54:47 asm-rancid02.mgt.asm.borg.local radiusd[17531]: lifetime = 0 Nov 29 08:54:47 asm-rancid02.mgt.asm.borg.local radiusd[17531]: cleanup_interval = 30 Nov 29 08:54:47 asm-rancid02.mgt.asm.borg.local radiusd[17531]: idle_timeout = 60 Nov 29 08:54:47 asm-rancid02.mgt.asm.borg.local radiusd[17531]: retry_delay = 30 Nov 29 08:54:47 asm-rancid02.mgt.asm.borg.local radiusd[17531]: spread = no Nov 29 08:54:47 asm-rancid02.mgt.asm.borg.local radiusd[17531]: } Nov 29 08:54:47 asm-rancid02.mgt.asm.borg.local radiusd[17531]: # Instantiating module "eap-tls" from file /etc/raddb/mods-enabled/eap-ts Nov 29 08:54:47 asm-rancid02.mgt.asm.borg.local radiusd[17531]: /etc/raddb/mods-enabled/eap-ts[14]: Failed to find 'Auth-Type eap-tls' section. Cannot authenticate users. Nov 29 08:54:47 asm-rancid02.mgt.asm.borg.local radiusd[17531]: /etc/raddb/mods-enabled/eap-ts[14]: Instantiation failed for module "eap-tls" [root@asm-rancid02 mods-enabled]# Is that because I haven't told a virtual server where to look yet? On Wednesday, November 29, 2017 4:49 AM, Matthew Newton <mcn@freeradius.org> wrote: On Wed, 2017-11-29 at 04:15 +0000, Andrew Meyer via Freeradius-Users wrote:
I need some help with setting up multiple eap types. I am running CentOS 7.4. I have 2 profiles or virtual servers setup and want to use eap for one and eap-tls for the other. I am a little confused on how to set this up.
Easiest way is probably to copy the eap module configuration raddb/mods-available/eap to say raddb/mods-available/eap-ts, and rename the instance name, so you have eap { # configuration for one type of eap ... } as the default, and then e.g. eap eap-tls { # configuration for another type of eap ... } as your new copy. Then in one virtual server call "eap" as usual, and in the other virtual server call "eap-tls". -- Matthew - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Nov 29, 2017, at 9:56 AM, Andrew Meyer via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Nov 29 08:54:47 asm-rancid02.mgt.asm.borg.local radiusd[17531]: # Instantiating module "eap-tls" from file /etc/raddb/mods-enabled/eap-ts Nov 29 08:54:47 asm-rancid02.mgt.asm.borg.local radiusd[17531]: /etc/raddb/mods-enabled/eap-ts[14]: Failed to find 'Auth-Type eap-tls' section. Cannot authenticate users.
You edited the configuration files and broke the server. Don't do that.
Is that because I haven't told a virtual server where to look yet?
The message should be pretty clear. Do you have an "Auth-Type eap-tls" section in the new virtual server? You can't just follow instructions blindly. You have to put *some* effort into it. Did you change the new virtual server to change "eap" to "eap-tls" *everywhere*? No? Then why do you expect it to use "eap-tls" instead of "eap"? The configuration files don't magically understand what you want to do. That's your responsibility. Alan DeKok.
On Wed, 2017-11-29 at 14:56 +0000, Andrew Meyer via Freeradius-Users wrote:
Nov 29 08:54:47 asm-rancid02.mgt.asm.borg.local radiusd[17531]: /etc/raddb/mods-enabled/eap-ts[14]: Failed to find 'Auth-Type eap- tls' section. Cannot authenticate users. Nov 29 08:54:47 asm-rancid02.mgt.asm.borg.local radiusd[17531]: /etc/raddb/mods-enabled/eap-ts[14]: Instantiation failed for module "eap-tls" [root@asm-rancid02 mods-enabled]#
Is that because I haven't told a virtual server where to look yet?
Add "eap-tls" to the authenticate section next to "eap". -- Matthew
I figured it out. Thank you Alan & Matthew. On Wednesday, November 29, 2017 9:05 AM, Matthew Newton <mcn@freeradius.org> wrote: On Wed, 2017-11-29 at 14:56 +0000, Andrew Meyer via Freeradius-Users wrote:
Nov 29 08:54:47 asm-rancid02.mgt.asm.borg.local radiusd[17531]: /etc/raddb/mods-enabled/eap-ts[14]: Failed to find 'Auth-Type eap- tls' section. Cannot authenticate users. Nov 29 08:54:47 asm-rancid02.mgt.asm.borg.local radiusd[17531]: /etc/raddb/mods-enabled/eap-ts[14]: Instantiation failed for module "eap-tls" [root@asm-rancid02 mods-enabled]#
Is that because I haven't told a virtual server where to look yet?
Add "eap-tls" to the authenticate section next to "eap". -- Matthew - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Wed, 2017-11-29 at 15:04 +0000, Matthew Newton wrote:
On Wed, 2017-11-29 at 14:56 +0000, Andrew Meyer via Freeradius-Users wrote:
Nov 29 08:54:47 asm-rancid02.mgt.asm.borg.local radiusd[17531]: /etc/raddb/mods-enabled/eap-ts[14]: Failed to find 'Auth-Type eap- tls' section. Cannot authenticate users. Nov 29 08:54:47 asm-rancid02.mgt.asm.borg.local radiusd[17531]: /etc/raddb/mods-enabled/eap-ts[14]: Instantiation failed for module "eap-tls" [root@asm-rancid02 mods-enabled]#
Is that because I haven't told a virtual server where to look yet?
Add "eap-tls" to the authenticate section next to "eap".
Would help if fingers wrote what I was thinking. Change "eap" in your new virtual server to "eap-tls" in the authenticate section. You need to make all the changes, not just some of them. -- Matthew
participants (3)
-
Alan DeKok -
Andrew Meyer -
Matthew Newton