Chrooting freeradius 2.1.6
Hi, what exactly should be placed in directory which freeradius 2.1 chroots to? I tried to configure chrooted environment for freeradius and I had to place all rlm_*.so (along with dependencies) and dictionary.* files inside chroot directory because chroot() is called earlier than these files are read. Even if I put modules names in instantiate section, it doesn't help. Also, putting these files under current directory is not a solution due to modules dependencies. Am I doing something wrong or it is impossible to jail freeradius into empty (or containing only /dev/log and /dev/urandom devices) directory? IMHO, it would be more logical to chroot after all initialization work was done and all files have been read. Regards.
Adam Osuchowski wrote:
what exactly should be placed in directory which freeradius 2.1 chroots to? I tried to configure chrooted environment for freeradius and I had to place all rlm_*.so (along with dependencies) and dictionary.* files inside chroot directory because chroot() is called earlier than these files are read.
Yes.
Even if I put modules names in instantiate section, it doesn't help. Also, putting these files under current directory is not a solution due to modules dependencies. Am I doing something wrong or it is impossible to jail freeradius into empty (or containing only /dev/log and /dev/urandom devices) directory?
The server needs a lot of files in order for it to work properly. Deleting *everything* in a chroot is just too problematic.
IMHO, it would be more logical to chroot after all initialization work was done and all files have been read.
Great. Fix it, and send a patch. Alan DeKok.
Hi,
doesn't help. Also, putting these files under current directory is not a solution due to modules dependencies. Am I doing something wrong or it is impossible to jail freeradius into empty (or containing only /dev/log and /dev/urandom devices) directory?
The server needs a lot of files in order for it to work properly. Deleting *everything* in a chroot is just too problematic.
aye. if you follow the standard guides for, for example chroot'd named (BIND) or ISC dhcpd you can do the same with FreeRADIUS. you need to ensure you have a local copy of all the libraries that FR used - use eg 'ldd radiusd' to find all the libraries that FR needs. however, If you really want to chroot then i'd suggest that you build with static, not dynamic libraries...then more is ready to go (less to be hived). alan
participants (3)
-
Adam Osuchowski -
Alan Buxey -
Alan DeKok