problem with ippool module
Im using freeradius 3.2.4 , I have a problem that I couldn't set up ippool module. When I do a symbolic link with mods-enabled and mods-available of ippool module , I set up ippool module with two pools. Then when I go to start the service freeradius with systemd , it couldnt start , syslog says: /"rlm_ippool: Failed to open file /etc/freeradius/db-users.ippool: Read-only file system" "/etc/freeradius/mods-enabled/ippool[67]: Instantiation failed for module "users_employee""/ this is my config of ippool module: /ippool users_employee { filename = ${db_dir}/db-users.ippool range_start = 192.168.248.1 range_stop = 192.168.248.254 netmask = 255.255.254.0 cache_size = 800 ip_index = ${db_dir}/db-users.ipindex override = no maximum_timeout = 0 } ippool it { filename = ${db_dir}/db-it.ippool range_start = 192.168.249.1 range_stop = 192.168.249.254 netmask = 255.255.254.0 cache_size = 800 ip_index = ${db_dir}/db-it.ipindex override = no maximum_timeout = 0 }/ The config example in the file ipool module says that I can put the same config that the file ipool module in the radiusd.conf base config file , but its the same because radiusd.conf have an include of mods-enabled so the config that I have in ipool module is supposed that its going to be charged by the service. If I do "freeradius -X" , the service start in debugg mode with 0 problems , and I can see that freeradius in debugg mode charged the module ippool. I want to use ippool and not sqlipool , I have this: opnsense (openvpn server instance) + freeradius (ldap + ippool) + openldap. I have openvpn server instance in opnsense working and openldap with freeradius ldap module working. Now I need to implement ippool module to create two pools for two groups of LDAP. I need to know if I am missing something important with ippool module , thanks in advantage. --
On Jul 10, 2024, at 7:16 AM, Rubenb <rubenb@verdnatura.es> wrote:
Im using freeradius 3.2.4 , I have a problem that I couldn't set up ippool module. When I do a symbolic link with mods-enabled and mods-available of ippool module , I set up ippool module with two pools.
Then when I go to start the service freeradius with systemd , it couldnt start , syslog says:
/"rlm_ippool: Failed to open file /etc/freeradius/db-users.ippool: Read-only file system"
That seems fairly clear. This isn't a problem with FreeRADIUS. You've configured FreeRADIUS so that it tries to write files to /etc, but /etc isn't writable. So... configure FreeRADIUS to write files somewhere else, which is writable. And in general, it's a bad idea to put DB files into /etc. They usually go into a writable directory, like /var. Alan DeKok.
I dont know if there is a issue , but as you can see: example config file ippool: /ippool main_pool { / /filename = ${db_dir}/db.ippool/ /}/ Config base radiusd.conf: /raddbdir = /etc/freeradius/ /db_dir = ${raddbdir}/ /$INCLUDE ${raddbdir}/mods-enabled// I have not configured to write in /etc , this is by default , as you can see example config file ippool module , and base config of freeradius in radiusd.conf , vars point to /etc/freeradius folder, that folder is writable by freerad user. / / //etc# ls -ls | grep freeradiu 4 drwxr-s--x 9 freerad freerad 4096 Jul 10 13:01 freeradius/ And yes , its a bad idea , but default config have this config point to /etc/freeradius , so .. by default it must run , whatever if you test all that and runs , I can point that DB files to another folder as you recoomended me. I go to test it on another folder by the way , but I dont think this is the problem with this issue El 10/7/24 a las 14:07, Alan DeKok escribió:
On Jul 10, 2024, at 7:16 AM, Rubenb<rubenb@verdnatura.es> wrote:
Im using freeradius 3.2.4 , I have a problem that I couldn't set up ippool module. When I do a symbolic link with mods-enabled and mods-available of ippool module , I set up ippool module with two pools.
Then when I go to start the service freeradius with systemd , it couldnt start , syslog says:
/"rlm_ippool: Failed to open file /etc/freeradius/db-users.ippool: Read-only file system" That seems fairly clear.
This isn't a problem with FreeRADIUS. You've configured FreeRADIUS so that it tries to write files to /etc, but /etc isn't writable.
So... configure FreeRADIUS to write files somewhere else, which is writable.
And in general, it's a bad idea to put DB files into /etc. They usually go into a writable directory, like /var.
Alan DeKok.
- List info/subscribe/unsubscribe? Seehttp://www.freeradius.org/list/users.html
--
On Jul 10, 2024, at 8:38 AM, Rubenb <rubenb@verdnatura.es> wrote:
I dont know if there is a issue , but as you can see:
...
I have not configured to write in /etc , this is by default , as you can see example config file ippool module , and base config of freeradius in radiusd.conf , vars point to /etc/freeradius folder, that folder is writable by freerad user.
See the comments in radiusd.conf. You can change db_dir to point somewhere else. If you install the server from a package, then db_dir will point to a writeable location, like /var. If you install from source, then the default uses ${raddb}, with a comment to change it. Alan DeKok.
Thanks, I resolved my issue: Debian12Bookworm In /etc/freeradius/radiusd.conf file , I reedit commenting and adding this: /localstatedir = /var/ /... / /# Should likely be ${localstatedir}/lib/radiusd #db_dir = ${raddbdir} db_dir = ${localstatedir}/lib/radiusd/ As the packet dont build the folder , I need to create it mannually and change owner , (if not freerad user in the system cant write): # ll /var/lib | grep radius drwxr-xr-x 2 freerad freerad 4096 Jul 10 19:19 radiusd Now , the service run successfully. Thanks El 10/7/24 a las 15:24, Alan DeKok escribió:
On Jul 10, 2024, at 8:38 AM, Rubenb<rubenb@verdnatura.es> wrote:
I dont know if there is a issue , but as you can see: ... I have not configured to write in /etc , this is by default , as you can see example config file ippool module , and base config of freeradius in radiusd.conf , vars point to /etc/freeradius folder, that folder is writable by freerad user. See the comments in radiusd.conf. You can change db_dir to point somewhere else.
If you install the server from a package, then db_dir will point to a writeable location, like /var. If you install from source, then the default uses ${raddb}, with a comment to change it.
Alan DeKok.
- List info/subscribe/unsubscribe? Seehttp://www.freeradius.org/list/users.html
--
participants (2)
-
Alan DeKok -
Rubenb