configure freeradius to send no response if LDAP database fails

[Dave Macias]

Hello,

I was trying to test this out. Thought it was a nice idea. Unfortunately i
still see a response from the radius server with the dead ldap. This causes
the network device not to go to the next available radius server since
radius is responding (with reject). Now if i kill radius, it of course
jumps to the next radius server for authentication.

* I have the do_not_respond policy in policy.d/control
* radius -X shows it responding with "Access-Reject"
* I believe i configured the policy it in the correct spot too.
sites-enabled/default

    authorize {
    ....
    ....
     ldap {
fail = 1
}
if (fail) {
do_not_respond
}
# if previous process update or "ok" and userpw is correct
if ((ok || updated) && User-Password) {
update {
control:Auth-Type := ldap
}
}
else {
update reply {
Reply-Message := "Login Failed. Please check your Username and Password"
}
reject
}
    ....
    ....
}


debug with ldap alive:  https://pastebin.com/VTQjdAM3  ( start on line 949 )
debug with ldap dead:  https://pastebin.com/fyw4e4Hs  ( start on line 903 )

Im assuming my issue is with my post-auth section, since if no conditions
are met then send reject by default. ( line 978 on alive ldap ) ( line 917
on dead ldap ). Is this correct?
What would be the recommended way to go about it?
Any input would be appreciated.

Thank you for the support!


-dave

On Tue, May 1, 2018 at 4:47 PM, Matthew Almen <malmen at polartel.com> wrote:

> Allen, Thank you so much for your response.  I checked and I do have the
> policy.  I added the config you provided in the LDAP portion of the
> authorize section of /etc/raddb/sites-enabled/default and it works
> exactly how you I need it to now!  Matt
>
>
> -----Original Message-----
> From: Freeradius-Users [mailto:freeradius-users-bounces+malmen=
> polartel.com at lists.freeradius.org] On Behalf Of Alan DeKok
> Sent: Tuesday, May 01, 2018 12:57 PM
> To: FreeRadius users mailing list
> Subject: Re: configure freeradius to send no response if LDAP database
> fails
>
> On May 1, 2018, at 1:33 PM, Matthew Almen <malmen at polartel.com> wrote:
> >
> > Hello, I am trying to find out if there is a way to configure freeradius
> to exit or not send a response to queries if the local LDAP database
> becomes unavailable after the radius server is started.  The radiusd
> service will not start if it cannot connect to the local LDAP database
> which I would expect.  If I stop the LDAP service while freeradius is
> running I see from the debugging output pf /usr/sbin/radiusd -X that it
> fails to contact the LDAP server over and over and just keeps sending
> access-rejects back to our NAS router.  Our router is configured to test
> the radius server with a test username but it will not mark the server as
> dead and move onto the next server in the server-group if it receives any
> response from the radius server.  Even if an access-reject is received that
> still satisfies the test and the server does not get marked as dead.  I
> need the server to be marked as dead if LDAP is down and radius is replying
> with an access-reject for everything.  Any help would be appreciated.
> Thanks, Matt
>
>   do this:
>
>         ldap {
>                 fail = 1
>         }
>         if (fail) {
>                 do_not_respond
>         }
>
>   That should do it.
>
>   The magic "fail = 1" prevents it from leaving the "authorize" section if
> the LDAP module fails.
>
>   It then checks for "fail" and runs the "do_not_respond" policy from
> raddb/policy.d/control.  If you don't have that policy there, upgrade.
>
>   Alan DeKok.
>
>
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/
> list/users.html
>
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/
> list/users.html