Hi guys, Whats the different between command: # Service radiusd start # radiusd when i use radiusd or radiusd -X everything works fine. but when i use service radiusd start, i have problem connecting with the postgresql DB. Log: (radiusd) Thu Jan 26 08:38:10 2012 : Info: Loaded virtual server inner-tunnel Thu Jan 26 08:38:10 2012 : Info: rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Thu Jan 26 08:38:10 2012 : Info: rlm_sql (sql): Attempting to connect to radiusd@localhost:5432/radiusdb Thu Jan 26 08:38:10 2012 : Info: Loaded virtual server <default> Thu Jan 26 08:38:10 2012 : Info: Ready to process requests. Thu Jan 26 08:38:16 2012 : Info: Exiting normally. (service radiusd start) Thu Jan 26 08:39:23 2012 : Info: Loaded virtual server inner-tunnel Thu Jan 26 08:39:23 2012 : Info: rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Thu Jan 26 08:39:23 2012 : Info: rlm_sql (sql): Attempting to connect to radiusd@localhost:5432/radiusdb Thu Jan 26 08:39:23 2012 : Error: rlm_sql_postgresql: Couldn't connect socket to PostgreSQL server radiusd@localhost:radiusdb Thu Jan 26 08:39:23 2012 : Error: rlm_sql (sql): Failed to connect DB handle #0 Thu Jan 26 08:39:23 2012 : Info: Loaded virtual server <default> Thu Jan 26 08:39:23 2012 : Info: Ready to process requests. Thu Jan 26 08:39:28 2012 : Info: Exiting normally. Thanks Eric -- View this message in context: http://freeradius.1045715.n5.nabble.com/Service-radiusd-Start-vs-radiusd-tp5... Sent from the FreeRadius - User mailing list archive at Nabble.com.
On Wed, Jan 25, 2012 at 1:49 PM, eric.chang <eric_xxxx@yahoo.co.nz> wrote:
when i use radiusd or radiusd -X everything works fine.
but when i use service radiusd start, i have problem connecting with the postgresql DB.
Somewhat a long shot, but do you have selinux enabled? If yes, try disabling it, or make sure that your selinux-policy is greater than the one mentioned in this bug report: https://bugzilla.redhat.com/show_bug.cgi?id=665563 If not, then you can run something like "bash -x /etc/init.d/freeradius start". It should print out the actual command line used to start freeradius, which might contain additional arguments responsible for your failure. -- Fajar
On Wed, Jan 25, 2012 at 2:11 PM, Fajar A. Nugraha <list@fajar.net> wrote:
If not, then you can run something like "bash -x /etc/init.d/freeradius start".
Sorry, it should be "bash -x /etc/init.d/radiusd start" (since you mentioned you started it with "service radiusd start") -- Fajar
It should print out the actual command line used to start freeradius, which might contain additional arguments responsible for your failure.
-- Fajar
After disabled selinux, everything works fine. Thank you -- View this message in context: http://freeradius.1045715.n5.nabble.com/Service-radiusd-Start-vs-radiusd-tp5... Sent from the FreeRadius - User mailing list archive at Nabble.com.
On 01/25/2012 08:27 AM, eric.chang wrote:
After disabled selinux, everything works fine.
Did you: 1. Disable SELinux for freeradius 2. Disable SELinux entirely If you did number 2. I would STRONGLY advise against it. Instead, if you must, do this: setsebool -P radiusd_disable_trans=1
On 01/25/2012 12:38 PM, Alan Buxey wrote:
Hi,
Did you:
1. Disable SELinux for freeradius 2. Disable SELinux entirely
...well, i'd say read up on SELinux and use the tools to make the correct policy for FreeRADIUS to work on your system WITH SELinux running
That's certainly what *I* would do. But as a first step, turning it back on whilst he does the reading is probably wise ;o)
I have did number 1 :( Let me try number 2 now, and see what happen. btw my setup is: Red Hat Enterprise Linux Server 5.7 FreeRADIUS 2.1.7 PostgreSQL 9.1.2 -- View this message in context: http://freeradius.1045715.n5.nabble.com/Service-radiusd-Start-vs-radiusd-tp5... Sent from the FreeRadius - User mailing list archive at Nabble.com.
i mean i did #2 disabled selinux entirely .... -- View this message in context: http://freeradius.1045715.n5.nabble.com/Service-radiusd-Start-vs-radiusd-tp5... Sent from the FreeRadius - User mailing list archive at Nabble.com.
First I set SELinux back to enforcing reboot & test (not working, fail to auth) setsebool -P radiusd_disable_trans=1 reboot & test (everything works fine) ---lets try disable postgresql instead of radiusd setsebool -P radiusd_disable_trans=0 setsebool -P postgresql_disable_trans=1 reboot & test (not working, fail to auth) I guess we have a winner: setsebool -P radiusd_disable_trans=1 Thank you -- View this message in context: http://freeradius.1045715.n5.nabble.com/Service-radiusd-Start-vs-radiusd-tp5... Sent from the FreeRadius - User mailing list archive at Nabble.com.
i did some reading on SELinux... but there are pages and pages of info, and with my limited linux skill... I hardly understand a thing... Welcome if anyone have any instruction which I can try Thanks Eric -- View this message in context: http://freeradius.1045715.n5.nabble.com/Service-radiusd-Start-vs-radiusd-tp5... Sent from the FreeRadius - User mailing list archive at Nabble.com.
On 01/26/2012 10:27 AM, Alan Buxey wrote:
Hi,
I guess we have a winner: setsebool -P radiusd_disable_trans=1
yes but as already said, RHEL SElinux policy should already be fine for this
It's been a while since I looked, but when I did the RHEL5 SELinux policy was good for nothing except very, very basic FreeRADIUS usage. Has that changed now? Using "sesearch" I don't for example see any references to postgresql_t for unix socket connection, and it's not obvious to me that the policy permits ntlm_auth to be exec'd.
Hi,
yes but as already said, RHEL SElinux policy should already be fine for this
It's been a while since I looked, but when I did the RHEL5 SELinux policy was good for nothing except very, very basic FreeRADIUS usage.
Has that changed now? Using "sesearch" I don't for example see any references to postgresql_t for unix socket connection, and it's not obvious to me that the policy permits ntlm_auth to be exec'd.
perhaps I wrote my sentence lazily.....the RHEL SElinux policy SHOULD already be fine for this ;-) alan
On 01/26/2012 06:33 AM, Alan Buxey wrote:
Hi,
yes but as already said, RHEL SElinux policy should already be fine for this
It's been a while since I looked, but when I did the RHEL5 SELinux policy was good for nothing except very, very basic FreeRADIUS usage.
Has that changed now? Using "sesearch" I don't for example see any references to postgresql_t for unix socket connection, and it's not obvious to me that the policy permits ntlm_auth to be exec'd.
perhaps I wrote my sentence lazily.....the RHEL SElinux policy SHOULD already be fine for this ;-)
You say you're running RHEL 5.7 (and not some RHEL clone such as CentOS or Scientific Linux). That means you've paid us for a subscription and part of what you've paid for is a promise things will work. If they are not working please following the support procedures with your RHEL representative to get help and/or file a bug (sorry, I can't tell you how that process works because I sit on the other end inside of engineering). The issue will be assigned to one of us in engineering, because it appears to be an SELinux policy issue it won't likely come to me, rather it will go to an engineer assigned to SELinux policy issues. SELinux policy problems usually get fixed very quickly once they get reported, in the interim the engineer assigned to the bug will likely tell you the optimal temporary workaround. -- John Dennis <jdennis@redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/
My RHEL 5.7 is only a 30 days evaluation, there wont be any support. Just trying it and doing some learning at home. At work we use RHEL 5.6, when we do setup the new server and if the same SELinux problem occur, i will try the support procedures. Thanks Eric -- View this message in context: http://freeradius.1045715.n5.nabble.com/Service-radiusd-Start-vs-radiusd-tp5... Sent from the FreeRadius - User mailing list archive at Nabble.com.
On 01/25/2012 03:27 AM, eric.chang wrote:
After disabled selinux, everything works fine.
What distribution are you using? FreeRADIUS + SELinux is supposed to to be a supported combination (with distribution provided packages). It's important to note that SELinux handles "transitions" for initscripts and running something from the initscript is not the same as running it by hand. Also, be aware that as of Fedora 16 SysV initscritps have been replaced by systemd service files. -- John Dennis <jdennis@redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/
participants (5)
-
Alan Buxey -
eric.chang -
Fajar A. Nugraha -
John Dennis -
Phil Mayers