Include directive for separate ippool configs not working
Hi all, I'd like to integrate freeradius into a config management framework. In order for this to work with multiple ippool instances I've decided to create a ippool.d/ directory containing several config files. Loading the config files itself is not a problem, however placement of the include statement is. I've tried to put the following line in several places: $INCLUDE /etc/freeradius/ippool.d/ E.g.: - At the end of modules {}, - Below a working ippool main_pool {}, which resides inside modules {} - Inside instantiate {} - authorize {) - ... Nothing seems to work. Freeradius -X starts the service correctly. I can see my configs are loaded. However anything that's defined inside them just doesn't show up. I'm running the current Debian stable package (2.1.10).
FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu, built on Nov 14 2010 at 21:12:30 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including configuration file /etc/freeradius/snmp.conf including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including files in directory /etc/freeradius/ippool.d/ including configuration file /etc/freeradius/ippool.d/foobar.conf
main { allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main {
[ ... ]
Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests.
Kind regards, Tom De Vylder
Tom De Vylder wrote:
I'd like to integrate freeradius into a config management framework. In order for this to work with multiple ippool instances I've decided to create a ippool.d/ directory containing several config files.
Those files are... ? That information might help.
Loading the config files itself is not a problem, however placement of the include statement is.
Uh... no. The $INCLUDE statement includes the files or directory you name, in the place of the $INCLUDE statement.
I've tried to put the following line in several places:
$INCLUDE /etc/freeradius/ippool.d/
E.g.: - At the end of modules {}, - Below a working ippool main_pool {}, which resides inside modules {} - Inside instantiate {} - authorize {) - ...
Nothing seems to work.
Wonderful. You didn't follow the existing examples or documentation, and you tried a bunch of random things in the hope that they might work. Each module configuration goes into the "modules" section. This is documented, and numerous examples are given. There are even examples of configuring multiple instances of a module. There are even examples of *using* multiple instances of a module. So... Are you including the module configuration in the correct place? Have you configured multiple instances of the module correctly? Are you *using* each instance of the module? Alan DeKok.
On 01 Jul 2011, at 19:44, Alan DeKok wrote:
Tom De Vylder wrote:
I'd like to integrate freeradius into a config management framework. In order for this to work with multiple ippool instances I've decided to create a ippool.d/ directory containing several config files.
Those files are... ? That information might help.
E.g.: pool1.conf: ippool main_pool { range-start = 192.168.10.1 range-stop = 192.168.10.254 [ ... ] } pool2.conf ippool secondary_pool { range-start = 192.168.11.1 range-stop = 192.168.11.254 [ ... ] } Source: http://wiki.freeradius.org/Rlm_ippool, section custom configuration.
Loading the config files itself is not a problem, however placement of the include statement is.
Uh... no. The $INCLUDE statement includes the files or directory you name, in the place of the $INCLUDE statement.
According to the log file it doesn't look that way. So I assumed it wasn't the case. Hence the question.
I've tried to put the following line in several places:
$INCLUDE /etc/freeradius/ippool.d/
E.g.: - At the end of modules {}, - Below a working ippool main_pool {}, which resides inside modules {} - Inside instantiate {} - authorize {) - ...
Nothing seems to work.
Wonderful. You didn't follow the existing examples or documentation, and you tried a bunch of random things in the hope that they might work.
Being all-knowing as you are you also should've know I actually did rtfm. Couldn't find anything useful and indeed tried a bunch of random things, thankyouverymuch.
Each module configuration goes into the "modules" section. This is documented, and numerous examples are given. There are even examples of configuring multiple instances of a module. There are even examples of *using* multiple instances of a module.
Judging by the look of radiusd.conf and the examples there I wouldn't even guess needing multiple instances of ippool. See example above. Both ip pools are configured in a single instance in a single module{} section. What I wanted to accomplish was to simply split both ippool $name {} sections into a separate ippool-$name.conf file.
So... Are you including the module configuration in the correct place?
Yes I am. It's in the log file I've included in my initial mail.
On Mon, Jul 4, 2011 at 3:02 PM, Tom De Vylder <tom@penumbra.be> wrote:
On 01 Jul 2011, at 19:44, Alan DeKok wrote:
pool1.conf: ippool main_pool { range-start = 192.168.10.1 range-stop = 192.168.10.254 [ ... ] } pool2.conf ippool secondary_pool { range-start = 192.168.11.1 range-stop = 192.168.11.254 [ ... ] }
Source: http://wiki.freeradius.org/Rlm_ippool, section custom configuration.
Loading the config files itself is not a problem, however placement of the include statement is.
Uh... no. The $INCLUDE statement includes the files or directory you name, in the place of the $INCLUDE statement.
According to the log file it doesn't look that way. So I assumed it wasn't the case. Hence the question.
I've tried to put the following line in several places:
$INCLUDE /etc/freeradius/ippool.d/
E.g.: - At the end of modules {}, - Below a working ippool main_pool {}, which resides inside modules {} - Inside instantiate {} - authorize {) - ...
Nothing seems to work.
Wonderful. You didn't follow the existing examples or documentation, and you tried a bunch of random things in the hope that they might work.
Being all-knowing as you are you also should've know I actually did rtfm. Couldn't find anything useful and indeed tried a bunch of random things, thankyouverymuch.
Each module configuration goes into the "modules" section. This is documented, and numerous examples are given. There are even examples of configuring multiple instances of a module. There are even examples of *using* multiple instances of a module.
Judging by the look of radiusd.conf and the examples there I wouldn't even guess needing multiple instances of ippool. See example above. Both ip pools are configured in a single instance in a single module{} section.
The config you wrote defines two instances of ipool:
ippool main_pool {
that's the first instance
ippool secondary_pool {
... and that's the second instance. It doesn't really matter (functionality-wise) whether they're on the same or different files, or even directly inside modules section of radiusd.conf.
What I wanted to accomplish was to simply split both ippool $name {} sections into a separate ippool-$name.conf file.
Well, just split it. As long as it's included inside modules section of radiusd.conf, it should work. Try using something like this on radiusd.conf: modules { ... $INCLUDE ${confdir}/modules/ $INCLUDE ${confdir}/ippool.d/ ... } An additonal note, I don't think you can use "ippool main_pool" on pool1.conf, as the instance "main_pool" of ippool module is already defined on modules/ippool.conf. -- Fajar
On 04 Jul 2011, at 10:19, Fajar A. Nugraha wrote:
On Mon, Jul 4, 2011 at 3:02 PM, Tom De Vylder <tom@penumbra.be> wrote:
On 01 Jul 2011, at 19:44, Alan DeKok wrote:
pool1.conf: ippool main_pool { range-start = 192.168.10.1 range-stop = 192.168.10.254 [ ... ] } pool2.conf ippool secondary_pool { range-start = 192.168.11.1 range-stop = 192.168.11.254 [ ... ] }
Source: http://wiki.freeradius.org/Rlm_ippool, section custom configuration.
Loading the config files itself is not a problem, however placement of the include statement is.
Uh... no. The $INCLUDE statement includes the files or directory you name, in the place of the $INCLUDE statement.
According to the log file it doesn't look that way. So I assumed it wasn't the case. Hence the question.
I've tried to put the following line in several places:
$INCLUDE /etc/freeradius/ippool.d/
E.g.: - At the end of modules {}, - Below a working ippool main_pool {}, which resides inside modules {} - Inside instantiate {} - authorize {) - ...
Nothing seems to work.
Wonderful. You didn't follow the existing examples or documentation, and you tried a bunch of random things in the hope that they might work.
Being all-knowing as you are you also should've know I actually did rtfm. Couldn't find anything useful and indeed tried a bunch of random things, thankyouverymuch.
Each module configuration goes into the "modules" section. This is documented, and numerous examples are given. There are even examples of configuring multiple instances of a module. There are even examples of *using* multiple instances of a module.
Judging by the look of radiusd.conf and the examples there I wouldn't even guess needing multiple instances of ippool. See example above. Both ip pools are configured in a single instance in a single module{} section.
The config you wrote defines two instances of ipool:
ippool main_pool {
that's the first instance
ippool secondary_pool {
... and that's the second instance.
It doesn't really matter (functionality-wise) whether they're on the same or different files, or even directly inside modules section of radiusd.conf.
What I wanted to accomplish was to simply split both ippool $name {} sections into a separate ippool-$name.conf file.
Well, just split it. As long as it's included inside modules section of radiusd.conf, it should work. Try using something like this on radiusd.conf:
modules { ... $INCLUDE ${confdir}/modules/ $INCLUDE ${confdir}/ippool.d/ ... }
That's the very first thing I've tried. :) Configs are loaded, but the configuration inside them just doesn't show up.
From the log file:
including files in directory /etc/freeradius/ippool.d/ including configuration file /etc/freeradius/ippool.d/ippool-config1.conf including configuration file /etc/freeradius/ippool.d/ippool-config2.conf However none of the configuration settings show up. When I grep for session-db on the logs with radius running in debug mode only the one from main_pool shows up.
On Mon, Jul 4, 2011 at 3:31 PM, Tom De Vylder <tom@penumbra.be> wrote:
Well, just split it. As long as it's included inside modules section of radiusd.conf, it should work. Try using something like this on radiusd.conf:
modules { ... $INCLUDE ${confdir}/modules/ $INCLUDE ${confdir}/ippool.d/ ... }
That's the very first thing I've tried. :)
Configs are loaded, but the configuration inside them just doesn't show up.
Now we're getting somewhere. Good.
From the log file:
including files in directory /etc/freeradius/ippool.d/ including configuration file /etc/freeradius/ippool.d/ippool-config1.conf including configuration file /etc/freeradius/ippool.d/ippool-config2.conf
That's not in your first mail (instead it was foobar.conf)
However none of the configuration settings show up. When I grep for session-db on the logs with radius running in debug mode only the one from main_pool shows up.
IIRC modules are initialized when something (e.g. post-auth section) calls it. So check: - what are your ippool instance names? Are they still "main_pool" and "secondary_pool"? If yes, main_pool might conflict with ippool.conf. - are you including "secondary_pool" anywhere in post-auth? If you want more help, paste the complete output of radiusd -X during startup AND when an access-request comes. -- Fajar
Tom De Vylder wrote:
Configs are loaded, but the configuration inside them just doesn't show up.
From the log file:
i.e. "debug output". Inventing your own terminology for things is a guaranteed way to confuse yourself.
including files in directory /etc/freeradius/ippool.d/ including configuration file /etc/freeradius/ippool.d/ippool-config1.conf including configuration file /etc/freeradius/ippool.d/ippool-config2.conf
However none of the configuration settings show up.
What, exactly do you mean by that? That statement is semantically equivalent to "it doesn't work". I'll note that you didn't post the *rest* of the debug output. You've instead given the *minimum* amount of text from it. You're making it as hard as possible for us to help you.
When I grep for session-db on the logs with radius running in debug mode only the one from main_pool shows up.
Let me guess... you made the module configuration, but you didn't tell the server to *use* the module. There's a reason that "sql", "files", etc. are listed in the raddb/sites-enabled/default file. Those entries tell the server to *use* the module which defined in the "modules" directory. If the debug output doesn't say "instantiating module secondary_pool", then it's because you didn't tell the server to use the module. Fix that. This is documented. Alan DeKok.
participants (3)
-
Alan DeKok -
Fajar A. Nugraha -
Tom De Vylder