radiusd service do not start
Hi, I installed freeradius to manage the wifi network of our organization (17 wifi ap) It works well when launched in command line (radiusd X), but I cant make it work as a service, Service radiusd start seems to work, but radius close immediately after, so a status will say that radiusd is dead, but subsys is locked. Here is the output of the radius X : # radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "nobody" main: group = "nobody" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms listen: port = 1812 listen: type = "auth" listen: port = 1813 listen: type = "acct" radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = yes eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/wifi.dasilva.int.pem" tls: certificate_file = "/etc/raddb/certs/wifi.dasilva.int.pem" tls: CA_file = "/etc/raddb/certs/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "tls" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. I dont see any errors in that, and I cant seem to find a solution via google. Fiy, the identification is done by certificates. Nicolas INNOCENT Resp. Informatique Groupe Da Silva ----------------------------------------------------- Tél : 05 62 20 41 31 Fax : 05 62 20 60 04 @ : sysadmin@groupe-dasilva.com Site web : <http://www.dasilva.fr/> http://www.dasilva.fr/ -----------------------------------------------------
UNCLASSIFIED From: freeradius-users-bounces+frank.ranner=defence.gov.au@lists.freeradius.or g [mailto:freeradius-users-bounces+frank.ranner=defence.gov.au@lists.freer adius.org] On Behalf Of Nicolas Sent: Thursday, 31 January 2008 03:04 To: freeradius-users@lists.freeradius.org Subject: radiusd service do not start Hi, I installed freeradius to manage the wifi network of our organization (17 wifi ap) It works well when launched in command line (radiusd -X), but I can't make it work as a service, 'Service radiusd start' seems to work, but radius close immediately after, so a status will say that radiusd is dead, but subsys is locked. That indicates a permissions problem. When you run radiusd -X it runs as root. When you start as a service it switches to the user specified in radiusd.conf, usually radiusd. Try: strace -f -e open,stat radiusd and look for lines with EPERM indicating files that failed to open because of permission fails. These will probably be owned by root. regards, Frank Ranner
Hi, That was my first guess too, but no, I even tried to run it as root, The strace log : [root@Eliza ~]# strace -f -e open,stat radiusd open("/etc/ld.so.cache", O_RDONLY) = 3 open("/lib/libcrypt.so.1", O_RDONLY) = 3 open("/lib/libssl.so.6", O_RDONLY) = 3 open("/lib/libcrypto.so.6", O_RDONLY) = 3 open("/lib/libnsl.so.1", O_RDONLY) = 3 open("/lib/libresolv.so.2", O_RDONLY) = 3 open("/lib/libpthread.so.0", O_RDONLY) = 3 open("/usr/lib/libradius-1.0.5.so", O_RDONLY) = 3 open("/usr/lib/libltdl.so.3", O_RDONLY) = 3 open("/lib/libdl.so.2", O_RDONLY) = 3 open("/lib/libc.so.6", O_RDONLY) = 3 open("/usr/lib/libgssapi_krb5.so.2", O_RDONLY) = 3 open("/usr/lib/libkrb5.so.3", O_RDONLY) = 3 open("/lib/libcom_err.so.2", O_RDONLY) = 3 open("/usr/lib/libk5crypto.so.3", O_RDONLY) = 3 open("/usr/lib/libz.so.1", O_RDONLY) = 3 open("/usr/lib/libkrb5support.so.0", O_RDONLY) = 3 open("/etc/localtime", O_RDONLY) = 3 Thu Jan 31 08:41:24 2008 : Info: Starting - reading configuration files ... open("/etc/raddb/radiusd.conf", O_RDONLY) = 3 open("/etc/raddb/proxy.conf", O_RDONLY) = 4 open("/etc/raddb/clients.conf", O_RDONLY) = 4 open("/etc/raddb/snmp.conf", O_RDONLY) = 4 open("/etc/raddb/eap.conf", O_RDONLY) = 4 open("/etc/raddb/sql.conf", O_RDONLY) = 4 open("/etc/raddb/dictionary", O_RDONLY) = 3 open("/usr/share/freeradius/dictionary", O_RDONLY) = 4 open("/usr/share/freeradius/dictionary.compat", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.3com", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.3gpp", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.3gpp2", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.acc", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.alcatel", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.alteon", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.ascend", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.bay", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.bintec", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.cabletron", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.cisco", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.cisco.vpn5000", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.cisco.bbsm", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.colubris", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.erx", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.extreme", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.freeradius", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.foundry", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.gandalf", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.garderos", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.gemtek", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.itk", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.juniper", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.karlnet", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.livingston", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.localweb", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.microsoft", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.navini", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.nomadix", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.propel", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.quintum", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.redback", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.redcreek", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.shasta", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.shiva", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.sonicwall", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.springtide", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.telebit", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.trapeze", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.tunnel", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.usr", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.valemount", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.versanet", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.wispr", O_RDONLY) = 5 open("/usr/share/freeradius/dictionary.xedia", O_RDONLY) = 5 open("/etc/raddb/naslist", O_RDONLY) = 3 open("/usr/local/var/log/radius/radius.log", O_WRONLY|O_CREAT|O_APPEND, 0666) = 4 open("/etc/raddb/clients", O_RDONLY) = 3 open("/etc/raddb/realms", O_RDONLY) = 3 open("/etc/nsswitch.conf", O_RDONLY) = 3 open("/etc/ld.so.cache", O_RDONLY) = 3 open("/lib/libnss_files.so.2", O_RDONLY) = 3 open("/etc/passwd", O_RDONLY) = 3 open("/etc/group", O_RDONLY) = 3 open("/etc/passwd", O_RDONLY) = 3 open("/proc/sys/kernel/ngroups_max", O_RDONLY) = 3 open("/etc/group", O_RDONLY) = 3 open("/usr/local/var/log/radius/radius.log", O_WRONLY|O_CREAT|O_APPEND, 0666) = 3 Process 10370 detached Nicolas INNOCENT Resp. Informatique Groupe Da Silva ----------------------------------------------------- Tél : 05 62 20 41 31 Fax : 05 62 20 60 04 @ : sysadmin@groupe-dasilva.com Site web : <http://www.dasilva.fr/> http://www.dasilva.fr/ ----------------------------------------------------- _____ De : freeradius-users-bounces+sysadmin=groupe-dasilva.com@lists.freeradius.org [mailto:freeradius-users-bounces+sysadmin=groupe-dasilva.com@lists.freeradiu s.org] De la part de Ranner, Frank MR Envoyé : jeudi 31 janvier 2008 03:05 À : FreeRadius users mailing list Objet : RE: radiusd service do not start [SEC=UNCLASSIFIED] UNCLASSIFIED From: freeradius-users-bounces+frank.ranner=defence.gov.au@lists.freeradius.org [mailto:freeradius-users-bounces+frank.ranner=defence.gov.au@lists.freeradiu s.org] On Behalf Of Nicolas Sent: Thursday, 31 January 2008 03:04 To: freeradius-users@lists.freeradius.org Subject: radiusd service do not start Hi, I installed freeradius to manage the wifi network of our organization (17 wifi ap) It works well when launched in command line (radiusd X), but I cant make it work as a service, Service radiusd start seems to work, but radius close immediately after, so a status will say that radiusd is dead, but subsys is locked. That indicates a permissions problem. When you run radiusd -X it runs as root. When you start as a service it switches to the user specified in radiusd.conf, usually radiusd. Try: strace -f -e open,stat radiusd and look for lines with EPERM indicating files that failed to open because of permission fails. These will probably be owned by root. regards, Frank Ranner
participants (2)
-
Nicolas -
Ranner, Frank MR