For a while I've been using FreeRADIUS with a set of includes.d-style directories that I can drop modules, virtual sites, etc into. This works well - until today. So far I've only had one included policy file in use, and the stock policy.conf is commented out. Today I tried to add another new virtual site which also has a policy file. Although radiusd -X clearly shows that the new policy file is being read, my virtual server is unable to call upon policies defined in the file. On a FreeRADIUS server with no other sites/policies, the new site and policy work fine, so it appears to be some kind of namespace issue. I've been through both policy files and there are no namespace clashes. Each policy file has its own name, e.g. policy eduroam {} and policy rainbow {}. Unusually, the debug log doesn't seem to be that helpful (it says that the files have been loaded, and that the policy can't be found by name). Apologies for the naming scheme - the various sites, modules and policies we currently manage have been inherited from various authors and I'm working on overhauling it. "debug-working.log" is from a FreeRADIUS server using only the new virtual site, which works. "debug-not-working.log" is from a full development FreeRADIUS server with other sites and policies, which does not work. "policies" is the policy file used with the existing (eduroam) sites "rainbow.conf" is the new policy that works on its own, but not in conjunction with other policies. Can anyone spare a few minutes to cast an eye over the debug output and see if I've missed something? I spent all yesterday afternoon looking and this problem and didn't make much progress. Thanks, Jonathan
On 9 Aug 2013, at 10:40, Jonathan Gazeley <jonathan.gazeley@bristol.ac.uk> wrote:
For a while I've been using FreeRADIUS with a set of includes.d-style directories that I can drop modules, virtual sites, etc into. This works well - until today. So far I've only had one included policy file in use, and the stock policy.conf is commented out. Today I tried to add another new virtual site which also has a policy file.
Whilst making up features is a fun pastime it's not very productive. There is one global policy section at the top level. Virtual servers do not have different policy name spaces. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
On 09/08/13 10:52, Arran Cudbard-Bell wrote:
Whilst making up features is a fun pastime it's not very productive.
There is one global policy section at the top level. Virtual servers do not have different policy name spaces.
Hi Arran, Thanks for this. So you're saying that there can only be one policy {} section in the whole server, and if I wish to load two sets of policies I will have to merge the two files? Thanks, Jonathan
On Fri, Aug 09, 2013 at 11:05:47AM +0100, Jonathan Gazeley wrote:
On 09/08/13 10:52, Arran Cudbard-Bell wrote:
Whilst making up features is a fun pastime it's not very productive.
There is one global policy section at the top level. Virtual servers do not have different policy name spaces.
Thanks for this. So you're saying that there can only be one policy {} section in the whole server, and if I wish to load two sets of policies I will have to merge the two files?
You should be able to do policy { $INCLUDE /path/to/policy/dir } in radiusd.conf, then just put policies in that directory (without the policy { } wrapper of course). That's how it is now done by default in version 3. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
On 09/08/13 11:18, Matthew Newton wrote:
On Fri, Aug 09, 2013 at 11:05:47AM +0100, Jonathan Gazeley wrote:
On 09/08/13 10:52, Arran Cudbard-Bell wrote:
Whilst making up features is a fun pastime it's not very productive.
There is one global policy section at the top level. Virtual servers do not have different policy name spaces. Thanks for this. So you're saying that there can only be one policy {} section in the whole server, and if I wish to load two sets of policies I will have to merge the two files? You should be able to do
policy { $INCLUDE /path/to/policy/dir }
in radiusd.conf, then just put policies in that directory (without the policy { } wrapper of course).
That's how it is now done by default in version 3.
Matthew
Thanks for this. I've implemented this solution using our config management system (Puppet) which is handling all the includes stuff. Happy weekend everyone, Jonathan
Hi,
Thanks for this. So you're saying that there can only be one policy {} section in the whole server, and if I wish to load two sets of policies I will have to merge the two files?
each policy has its own name/tag - in FR 3, there is a policy.d directory in which policy files get put...each containing names/actions. (all in unlang) alan
participants (4)
-
A.L.M.Buxey@lboro.ac.uk -
Arran Cudbard-Bell -
Jonathan Gazeley -
Matthew Newton