Problem with config (if- statement) on 3.0.10
Hello Now i have my up to date radius installation but i am struggeling with my configuration (i need to implement an eduroam config using PEAP-MSCHAPv2 and EAP-TTLS-MSCHAPv2 in combination with our LDAP servers). The server won't start, attached is the output: ----------------------------------- radius1:/etc/raddb # radiusd -X Copyright (C) 1999-2015 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/ldap including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/inner-eap including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/pap including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/dhcp including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/eduroam /etc/raddb/sites-enabled/mpimf_eduroam[65]: Invalid location for 'if' Errors reading or parsing /etc/raddb/radiusd.conf ----------------------------------- the /sites-enabled/eduroam looks like this: ----------------------------------- authorize { preprocess auth_log mschap suffix eap { ok = return } files redundant_ldap } authenticate { Auth-Type MS-CHAP { mschap } Auth-Type eap { eap update control { Tmp-String-0 = "%{debug:2}" } update control { Tmp-String-0 = "%{debug:0}" } } } preacct { preprocess acct_unique suffix } accounting { detail unix radutmp exec attr_filter.accounting_response } session { radutmp } post-auth { reply_log redundant_ldap exec Post-Auth-Type REJECT { attr_filter.access_reject } ### enable debug logging from here on update control { Tmp-String-0 = "%{debug:2}" } if (Realm == my-realm.de || Realm == NULL) { update reply { Filter-Id = "my-realm-Secure.in" } } else { update reply { Filter-Id = "gast.in" } } ### disable debug logging again update control { Tmp-String-0 = "%{debug:0}" } } pre-proxy { pre_proxy_log } post-proxy { post_proxy_log eap } ----------------------------------- What am i doing wrong? Best, Thomas -- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany
On Oct 29, 2015, at 7:01 AM, Thomas Stather <Thomas.Stather@mpimf-heidelberg.mpg.de> wrote:
Now i have my up to date radius installation but i am struggeling with my configuration (i need to implement an eduroam config using PEAP-MSCHAPv2 and EAP-TTLS-MSCHAPv2 in combination with our LDAP servers).
The server won't start, attached is the output:
You need to put a "server eduroam { ... }" wrapper around the virtual server. Alan DeKok.
Hi Thanks for that, i added the "listen" sections to my virtual server (auth and acct) and now this seems to be fixed, but the next error has just showed up: ------------------------------------- radiusd -X ...... including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/mpimf_eduroam /etc/raddb/sites-enabled/mpimf_eduroam[88]: Parse error in condition /etc/raddb/sites-enabled/mpimf_eduroam[88]: ...my-realm.de" || Realm == NULL) { /etc/raddb/sites-enabled/mpimf_eduroam[88]: ^ Must have string as value for attribute Errors reading or parsing /etc/raddb/radiusd.conf ------------------------------------- the section in the virtual server config file looks like this: ------------------------------------- post-auth { reply_log redundant_ldap exec Post-Auth-Type REJECT { attr_filter.access_reject } ### enable debug logging from here on update control { Tmp-String-0 = "%{debug:2}" } if (Realm == "my-realm.de" || Realm == NULL) { update reply { Filter-Id = "my-realm-Secure.in" } } else { update reply { Filter-Id = "gast.in" } } ------------------------------------- Best, Thomas Am 29.10.2015 um 13:29 schrieb Alan DeKok:
On Oct 29, 2015, at 7:01 AM, Thomas Stather <Thomas.Stather@mpimf-heidelberg.mpg.de> wrote:
Now i have my up to date radius installation but i am struggeling with my configuration (i need to implement an eduroam config using PEAP-MSCHAPv2 and EAP-TTLS-MSCHAPv2 in combination with our LDAP servers).
The server won't start, attached is the output: You need to put a "server eduroam { ... }" wrapper around the virtual server.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany
On Oct 29, 2015, at 10:15 AM, Thomas Stather <Thomas.Stather@mpimf-heidelberg.mpg.de> wrote:
Thanks for that, i added the "listen" sections to my virtual server (auth and acct) and now this seems to be fixed, but the next error has just showed up:
------------------------------------- radiusd -X ...... including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/mpimf_eduroam /etc/raddb/sites-enabled/mpimf_eduroam[88]: Parse error in condition /etc/raddb/sites-enabled/mpimf_eduroam[88]: ...my-realm.de" || Realm == NULL) { /etc/raddb/sites-enabled/mpimf_eduroam[88]: ^ Must have string as value for attribute
So... fix that. Use a string "NULL". See "man unlang". This is documented. Alan DeKok.
ok thanks i corrected this and some other mistakes in my config file and now the server starts (but won't authenticate users, see my next post). Best, Thomas Am 29.10.2015 um 15:40 schrieb Alan DeKok:
On Oct 29, 2015, at 10:15 AM, Thomas Stather <Thomas.Stather@mpimf-heidelberg.mpg.de> wrote:
Thanks for that, i added the "listen" sections to my virtual server (auth and acct) and now this seems to be fixed, but the next error has just showed up:
------------------------------------- radiusd -X ...... including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/mpimf_eduroam /etc/raddb/sites-enabled/mpimf_eduroam[88]: Parse error in condition /etc/raddb/sites-enabled/mpimf_eduroam[88]: ...my-realm.de" || Realm == NULL) { /etc/raddb/sites-enabled/mpimf_eduroam[88]: ^ Must have string as value for attribute So... fix that. Use a string "NULL".
See "man unlang". This is documented.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany
participants (2)
-
Alan DeKok -
Thomas Stather