On 08.03.2017 12:08, Antoine JOUBERT wrote:

've encountered an issue while trying to upgrade one of my freeradius servers from 3.0.12 to 3.0.13.

I've done the following to reproduce the issue. I've installed freeradius 3.0.12 on a new server from compiled debian packages :

We encountered the same issue and tried around a bit. The problem seems to be with the postinst script of freeradius-config, or rather /etc/freeradius/certs/Makefile If there is already some config (as naturally is the case with an upgrade), teh postinst fails right in the middle (see below). Since it is bound to exit on any error, the part creating the symlinks in sites-enabled and mods-enabled is never called. A bit suprising to me, I had similar effects on a machine where I had purged all freeradius packages, but created /etc/freeradius/certs manually with some files the FR install should never touch (my secrets, acutally, for later $INCLUDE). So here is where I suspect things to fail: ------------------ snippets of postinst of freeradius-config ------------------- set -e [...] # Create snakoil certificates on initial install make -C /etc/freeradius/certs/ [symlinks to enable sites and mods are supposed to be created here] ---------------------------------------------------------------------------------- Here's a snippet from yesterday's /var/log/apt/term.log: ------------------------------------------- BEGIN -------------------------------------------- Setting up freeradius-config (3.0.13+git) ... make: Entering directory '/etc/freeradius/certs' openssl dhparam -out dh -2 2048 Generating DH parameters, 2048 bit long safe prime, generator 2 This is going to take a long time .....+.....................+.................................................................................................................................. ...............................+...............................................................+........+..................................................... .............................................................................................................................................................. ...........+...........................................+.............+........................................................................................ ...................+.......................................................................................................................................... ...........................................................+.................................................................................................+ ..............................................+.......++*++* openssl req -new -out server.csr -keyout server.key -config ./server.cnf Generating a 2048 bit RSA private key .+++ ..........................................................+++ writing new private key to 'server.key' ----- openssl req -new -x509 -keyout ca.key -out ca.pem \ -days '60' -config ./ca.cnf Generating a 2048 bit RSA private key ..........................................+++ .....+++ writing new private key to 'ca.key' ----- openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key 'whatever' -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server .cnf Using configuration from ./server.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 3 (0x3) Validity Not Before: Mar 9 16:24:07 2017 GMT Not After : May 8 16:24:07 2017 GMT Subject: countryName = FR stateOrProvinceName = Radius organizationName = Example Inc. commonName = Example Server Certificate emailAddress = admin@example.org X509v3 extensions: X509v3 Extended Key Usage: TLS Web Server Authentication X509v3 CRL Distribution Points: Full Name: URI:http://www.example.com/example_ca.crl Certificate is to be certified until May 8 16:24:07 2017 GMT (60 days) failed to update database TXT_DB error number 2 Makefile:78: recipe for target 'server.crt' failed make: *** [server.crt] Error 1 make: Leaving directory '/etc/freeradius/certs' dpkg: error processing package freeradius-config (--configure): subprocess installed post-installation script returned error exit status 2 ------------------------------------------- END -------------------------------------------- -- Dr. Martin Pauly Phone: +49-6421-28-23527 HRZ Univ. Marburg Fax: +49-6421-28-26994 Hans-Meerwein-Str. E-Mail: pauly@HRZ.Uni-Marburg.DE D-35032 Marburg