Unable to start freerad with sudo
Hi, I can`t start freerad with sudo under lxc Under debug mode server is started: sudo -u www-data /usr/sbin/freeradius -f -X Listening on auth address * port 5000 bound to server test_local_pppoe_services Listening on acct address * port 1813 bound to server test_local_pppoe_services Listening on proxy address * port 52599 Ready to process requests but in the service command server failed sudo -u www-data /usr/sbin/freeradius -f radiusd: ERROR - Cannot initialize supplementary group list for user freerad: Operation not permitted sudo -u www-data /usr/sbin/service freeradius start Failed to start freeradius.service: Access denied See system logs and 'systemctl status freeradius.service' for details. I went through all the logs, but I can't find anywhere if the problem is in radius, systemd, lxc or apparmor. Thanks for tips Regards SL
Hi Stanislav, On Thu, Jul 20, 2023 at 07:57:55AM +0200, Stanislav Lorenc wrote:
sudo -u www-data /usr/sbin/freeradius -f radiusd: ERROR - Cannot initialize supplementary group list for user freerad: Operation not permitted
sudo -u www-data /usr/sbin/service freeradius start Failed to start freeradius.service: Access denied See system logs and 'systemctl status freeradius.service' for details.
What are the details saying? You could try "su www-data" or "su www-data -" and then start the freeradius server to see which of the two steps fail. BTW: Using www-data as freeradius user looks very strange to me. Greetings Hermann -- Administration/Zentrale Dienste, Interdiziplinaeres Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg IWR; INF 205; 69120 Heidelberg; Tel: (06221)54-14405 Fax: -14427 Email: Hermann.Lauer@iwr.uni-heidelberg.de
Hi Hermann, I add bash for www-data with same result strace output for : strace /usr/sbin/freeradius -f newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=494, ...}, 0) = 0 newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=494, ...}, 0) = 0 openat(AT_FDCWD, "/etc/group", O_RDONLY|O_CLOEXEC) = 3 newfstatat(3, "", {st_mode=S_IFREG|0644, st_size=726, ...}, AT_EMPTY_PATH) = 0 lseek(3, 0, SEEK_SET) = 0 read(3, "root:x:0:\ndaemon:x:1:\nbin:x:2:\ns"..., 4096) = 726 read(3, "", 4096) = 0 close(3) = 0 *setgroups(4, [111, 33, 42, 108]) = -1 EPERM (Operation not permitted)* futex(0x7f5c918ebd20, FUTEX_WAKE_PRIVATE, 2147483647) = 0 write(2, "radiusd: ERROR - Cannot initiali"..., 102radiusd: ERROR - Cannot initialize supplementary group list for user freerad: Operation not permitted ) = 102 capget({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, NULL) = 0 capget({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, {effective=0, permitted=0, inheritable=0}) = 0 futex(0x7f5c9187d5d8, FUTEX_WAKE_PRIVATE, 2147483647) = 0 exit_group(1) = ? +++ exited with 1 +++ Thanks
Hi Stanislav,
On Thu, Jul 20, 2023 at 07:57:55AM +0200, Stanislav Lorenc wrote:
sudo -u www-data /usr/sbin/freeradius -f radiusd: ERROR - Cannot initialize supplementary group list for user freerad: Operation not permitted
sudo -u www-data /usr/sbin/service freeradius start Failed to start freeradius.service: Access denied See system logs and 'systemctl status freeradius.service' for details. What are the details saying?
You could try "su www-data" or "su www-data -" and then start the freeradius server to see which of the two steps fail.
BTW: Using www-data as freeradius user looks very strange to me.
Greetings Hermann
Hi , how user and group options configured in radiusd.conf ? On Thu, Jul 20, 2023 at 2:17 PM Stanislav Lorenc < stanislav.lorenc@cernovice.net> wrote:
Hi Hermann,
I add bash for www-data with same result strace output for : strace /usr/sbin/freeradius -f
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=494, ...}, 0) = 0 newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=494, ...}, 0) = 0 openat(AT_FDCWD, "/etc/group", O_RDONLY|O_CLOEXEC) = 3 newfstatat(3, "", {st_mode=S_IFREG|0644, st_size=726, ...}, AT_EMPTY_PATH) = 0 lseek(3, 0, SEEK_SET) = 0 read(3, "root:x:0:\ndaemon:x:1:\nbin:x:2:\ns"..., 4096) = 726 read(3, "", 4096) = 0 close(3) = 0 *setgroups(4, [111, 33, 42, 108]) = -1 EPERM (Operation not permitted)* futex(0x7f5c918ebd20, FUTEX_WAKE_PRIVATE, 2147483647) = 0 write(2, "radiusd: ERROR - Cannot initiali"..., 102radiusd: ERROR - Cannot initialize supplementary group list for user freerad: Operation not permitted ) = 102 capget({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, NULL) = 0 capget({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, {effective=0, permitted=0, inheritable=0}) = 0 futex(0x7f5c9187d5d8, FUTEX_WAKE_PRIVATE, 2147483647) = 0 exit_group(1) = ? +++ exited with 1 +++
Thanks
Hi Stanislav,
On Thu, Jul 20, 2023 at 07:57:55AM +0200, Stanislav Lorenc wrote:
sudo -u www-data /usr/sbin/freeradius -f radiusd: ERROR - Cannot initialize supplementary group list for user freerad: Operation not permitted
sudo -u www-data /usr/sbin/service freeradius start Failed to start freeradius.service: Access denied See system logs and 'systemctl status freeradius.service' for details. What are the details saying?
You could try "su www-data" or "su www-data -" and then start the freeradius server to see which of the two steps fail.
BTW: Using www-data as freeradius user looks very strange to me.
Greetings Hermann
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
From radiusd.conf
user = freerad group = freerad
Hi Stanislav,
On Thu, Jul 20, 2023 at 07:57:55AM +0200, Stanislav Lorenc wrote:
sudo -u www-data /usr/sbin/freeradius -f radiusd: ERROR - Cannot initialize supplementary group list for user freerad: Operation not permitted
sudo -u www-data /usr/sbin/service freeradius start Failed to start freeradius.service: Access denied See system logs and 'systemctl status freeradius.service' for details. What are the details saying?
You could try "su www-data" or "su www-data -" and then start the freeradius server to see which of the two steps fail.
BTW: Using www-data as freeradius user looks very strange to me.
Greetings Hermann
Change it to www-data \ AK
On 20 Jul 2023, at 17:42, Stanislav Lorenc <stanislav.lorenc@cernovice.net> wrote:
From radiusd.conf
user = freerad group = freerad
Hi Stanislav,
On Thu, Jul 20, 2023 at 07:57:55AM +0200, Stanislav Lorenc wrote: sudo -u www-data /usr/sbin/freeradius -f radiusd: ERROR - Cannot initialize supplementary group list for user freerad: Operation not permitted
sudo -u www-data /usr/sbin/service freeradius start Failed to start freeradius.service: Access denied See system logs and 'systemctl status freeradius.service' for details. What are the details saying?
You could try "su www-data" or "su www-data -" and then start the freeradius server to see which of the two steps fail.
BTW: Using www-data as freeradius user looks very strange to me.
Greetings Hermann
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
this error you got, is because user www-data do not have permissions to run fr with user freerad \ AK
On 20 Jul 2023, at 17:42, Stanislav Lorenc <stanislav.lorenc@cernovice.net> wrote:
From radiusd.conf
user = freerad group = freerad
Hi Stanislav,
On Thu, Jul 20, 2023 at 07:57:55AM +0200, Stanislav Lorenc wrote: sudo -u www-data /usr/sbin/freeradius -f radiusd: ERROR - Cannot initialize supplementary group list for user freerad: Operation not permitted
sudo -u www-data /usr/sbin/service freeradius start Failed to start freeradius.service: Access denied See system logs and 'systemctl status freeradius.service' for details. What are the details saying?
You could try "su www-data" or "su www-data -" and then start the freeradius server to see which of the two steps fail.
BTW: Using www-data as freeradius user looks very strange to me.
Greetings Hermann
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Why would you start freeradius as user www-data? Please explain what are you trying to achieve? Igor On 20.7.23. 07:57, Stanislav Lorenc wrote:
Hi,
I can`t start freerad with sudo under lxc
Under debug mode server is started:
sudo -u www-data /usr/sbin/freeradius -f -X Listening on auth address * port 5000 bound to server test_local_pppoe_services Listening on acct address * port 1813 bound to server test_local_pppoe_services Listening on proxy address * port 52599 Ready to process requests
but in the service command server failed
sudo -u www-data /usr/sbin/freeradius -f radiusd: ERROR - Cannot initialize supplementary group list for user freerad: Operation not permitted
sudo -u www-data /usr/sbin/service freeradius start Failed to start freeradius.service: Access denied See system logs and 'systemctl status freeradius.service' for details.
I went through all the logs, but I can't find anywhere if the problem is in radius, systemd, lxc or apparmor.
Thanks for tips
Regards
SL - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi Igor, i need to manage freeradius via web app. The web service must be able to handle the radius. Thanks Why would you start freeradius as user www-data?
Please explain what are you trying to achieve?
Igor
On 20.7.23. 07:57, Stanislav Lorenc wrote:
Hi,
I can`t start freerad with sudo under lxc
Under debug mode server is started:
sudo -u www-data /usr/sbin/freeradius -f -X Listening on auth address * port 5000 bound to server test_local_pppoe_services Listening on acct address * port 1813 bound to server test_local_pppoe_services Listening on proxy address * port 52599 Ready to process requests
but in the service command server failed
sudo -u www-data /usr/sbin/freeradius -f radiusd: ERROR - Cannot initialize supplementary group list for user freerad: Operation not permitted
sudo -u www-data /usr/sbin/service freeradius start Failed to start freeradius.service: Access denied See system logs and 'systemctl status freeradius.service' for details.
I went through all the logs, but I can't find anywhere if the problem is in radius, systemd, lxc or apparmor.
Thanks for tips
Regards
SL - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 20/07/2023 09:07, Stanislav Lorenc wrote:
i need to manage freeradius via web app. The web service must be able to handle the radius.
Running FreeRADIUS as the www-data user is really not a good idea. Permitting www-data to even restart FreeRADIUS is likely unwise, but you definitely don't need to run FreeRADIUS as the www-data user to do that. The simplest way is to set up a script that sudo can run as www-data to restart the radiusd service. But really the question is why you would want to do that. If you need the web application to manage FreeRADIUS, have it write into a database, and get FreeRADIUS to query the data from there. Neither need to interact with each other in any other way. Don't run FreeRADIUS as www-data. It won't help, and will open up all sorts of possible security issues. -- Matthew
Hi, On Thu, Jul 20, 2023 at 10:07:10AM +0200, Stanislav Lorenc wrote:
i need to manage freeradius via web app. The web service must be able to handle the radius.
Please explain what you mean with "handle".
Why would you start freeradius as user www-data?
Please explain what are you trying to achieve?
Me too. Please explain/rethink before starting to mangle the systems freeradius setup! Greetings Hermann -- Administration/Zentrale Dienste, Interdiziplinaeres Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg IWR; INF 205; 69120 Heidelberg; Tel: (06221)54-14405 Fax: -14427 Email: Hermann.Lauer@iwr.uni-heidelberg.de
participants (7)
-
Anatoliy -
Anatoliy Kushner
-
Hermann Lauer -
Hermann.Lauer＠uni-heidelberg.de
-
Igor Smitran -
Matthew Newton -
Stanislav Lorenc