Failed reading certificate file error with freeradius container.
Hi, I'm having an issue when I try to run freeradius in a docker container. In the output that I pasted below, you will notice that I copied the "/etc/freeradius" directory on my host and that I mount the configuration directory $(pwd)/etc/freeradius on the container to make my configuration persistent. The problem is that no matter the permission I set on the $(pwd)/etc/freeradius/certs/server.pem file, I'm always getting an error when I launch the container: tls: (TLS) Failed reading certificate file "/etc/freeradius/certs/server.pem" Do you have an idea? How to reproduce: [root@dockerhost01 ~]# mkdir my-radius [root@dockerhost01 ~]# cd my-radius [root@dockerhost01 my-radius]# [root@dockerhost01 my-radius]# docker run --privileged --rm --name freeradius -t -d \
-p 1822-1823:1812-1813/udp \ -p 1822-1823:1812-1813/tcp \ freeradius/freeradius-server:3.2.3 -X cd01803e38363c512a67a47998401e180c76d2cbbc34713a527a2e61a74462a1 [root@dockerhost01 my-radius]# [root@dockerhost01 my-radius]# [root@dockerhost01 my-radius]# mkdir etc [root@dockerhost01 my-radius]# docker cp -a freeradius:/etc/freeradius etc/freeradius Successfully copied 1.35MB to /root/my-radius/etc/freeradius [root@dockerhost01 my-radius]# docker stop freeradius freeradius [root@dockerhost01 my-radius]# [root@dockerhost01 my-radius]# [root@dockerhost01 my-radius]# ls -ls etc/freeradius/ total 148 4 drwxr-s--x. 2 root root 4096 May 26 2023 certs 12 -rw-r-----. 1 root root 8323 May 26 2023 clients.conf 4 -rw-r--r--. 1 root root 1420 May 26 2023 dictionary 4 -rw-r-----. 1 root root 2661 May 26 2023 experimental.conf 0 lrwxrwxrwx. 1 root root 28 May 26 2023 hints -> mods-config/preprocess/hints 0 lrwxrwxrwx. 1 root root 33 May 26 2023 huntgroups -> mods-config/preprocess/huntgroups 4 drwxr-xr-x. 2 root root 4096 May 26 2023 mods-available 0 drwxr-xr-x. 11 root root 154 May 26 2023 mods-config 4 drwxr-xr-x. 2 root root 4096 May 26 2023 mods-enabled 4 -rw-r--r--. 1 root root 52 May 26 2023 panic.gdb 4 drwxr-s--x. 2 root root 4096 May 26 2023 policy.d 32 -rw-r-----. 1 root root 29779 May 26 2023 proxy.conf 32 -rw-r-----. 1 root root 30769 May 26 2023 radiusd.conf 24 -rw-r--r--. 1 root root 20754 May 26 2023 README.rst 4 drwxr-s--x. 2 root root 4096 May 26 2023 sites-available 0 drwxr-s--x. 2 root root 41 May 26 2023 sites-enabled 4 -rw-r--r--. 1 root root 3470 May 26 2023 templates.conf 12 -rw-r--r--. 1 root root 8536 May 26 2023 trigger.conf 0 lrwxrwxrwx. 1 root root 27 May 26 2023 users -> mods-config/files/authorize [root@dockerhost01 my-radius]# [root@dockerhost01 my-radius]# [root@dockerhost01 my-radius]# docker run --privileged --rm --name freeradius -t \ -p 1822-1823:1812-1813/udp \ -p 1822-1823:1812-1813/tcp \ -v $(pwd)/etc/freeradius:/etc/freeradius \ freeradius/freeradius-server:3.2.3 -X FreeRADIUS Version 3.2.3 Copyright (C) 1999-2022 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A -----OUTPUT OMMITED----- ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } tls: (TLS) Failed reading certificate file "/etc/freeradius/certs/server.pem" tls: (TLS) error:8000000D:system library::Permission denied tls: (TLS) error:10080002:BIO routines::system lib tls: (TLS) error:0A080002:SSL routines::system lib rlm_eap_tls: Failed initializing SSL context rlm_eap (EAP): Failed to initialise rlm_eap_tls /etc/freeradius/mods-enabled/eap[14]: Instantiation failed for module "eap" [root@dockerhost01 my-radius]#
On Jan 29, 2024, at 12:12 PM, Jonathan Gregoire <jonathan763@hotmail.com> wrote:
I'm having an issue when I try to run freeradius in a docker container. In the output that I pasted below, you will notice that I copied the "/etc/freeradius" directory on my host and that I mount the configuration directory $(pwd)/etc/freeradius on the container to make my configuration persistent.
The problem is that no matter the permission I set on the $(pwd)/etc/freeradius/certs/server.pem file, I'm always getting an error when I launch the container: tls: (TLS) Failed reading certificate file "/etc/freeradius/certs/server.pem"
Do you have an idea?
It's OS / docker / file system permissions issues, and has nothing to do with FreeRADIUS. The files are owned by root, and then in the docket image, FreeRADIUS is running as ??? what user? Alan DeKok.
Hi Alan, In Freeradius container, it is the "freerad" user that run the freeradius service: root@0cf44bf1e244:/# ps -au USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND freerad 1 0.1 0.0 18488 13796 pts/0 Ss+ 19:58 0:00 freeradius -f -X root 8 0.0 0.0 4624 3832 pts/1 Ss 19:58 0:00 bash root 19 0.0 0.0 7060 1548 pts/1 R+ 19:58 0:00 ps -au On my host, the freerad user doesn't exist. So I created it and also a group called "freerad" just in case. [root@dockerhost01 my-radius]# chown freerad:freerad -R etc/ [root@dockerhost01 my-radius]# ls -ls etc/freeradius/ total 148 4 drwxr-s--x. 2 freerad freerad 4096 May 26 2023 certs 12 -rw-r-----. 1 freerad freerad 8323 May 26 2023 clients.conf 4 -rw-r--r--. 1 freerad freerad 1420 May 26 2023 dictionary 4 -rw-r-----. 1 freerad freerad 2661 May 26 2023 experimental.conf 0 lrwxrwxrwx. 1 freerad freerad 28 May 26 2023 hints -> mods-config/preprocess/hints 0 lrwxrwxrwx. 1 freerad freerad 33 May 26 2023 huntgroups -> mods-config/preprocess/huntgroups 4 drwxr-xr-x. 2 freerad freerad 4096 May 26 2023 mods-available 0 drwxr-xr-x. 11 freerad freerad 154 May 26 2023 mods-config 4 drwxr-xr-x. 2 freerad freerad 4096 May 26 2023 mods-enabled 4 -rw-r--r--. 1 freerad freerad 52 May 26 2023 panic.gdb 4 drwxr-s--x. 2 freerad freerad 4096 May 26 2023 policy.d 32 -rw-r-----. 1 freerad freerad 29779 May 26 2023 proxy.conf 32 -rw-r-----. 1 freerad freerad 30769 May 26 2023 radiusd.conf 24 -rw-r--r--. 1 freerad freerad 20754 May 26 2023 README.rst 4 drwxr-s--x. 2 freerad freerad 4096 May 26 2023 sites-available 0 drwxr-s--x. 2 freerad freerad 41 May 26 2023 sites-enabled 4 -rw-r--r--. 1 freerad freerad 3470 May 26 2023 templates.conf 12 -rw-r--r--. 1 freerad freerad 8536 May 26 2023 trigger.conf 0 lrwxrwxrwx. 1 freerad freerad 27 May 26 2023 users -> mods-config/files/authorize I'm getting the same permission error when I launch the container: [root@dockerhost01 my-radius]# docker run --privileged --rm --name freeradius -t -v $(pwd)/etc/freeradius:/etc/freeradius -p 1822-1823:1812-1813/udp freeradius/freeradius-server -X =====output ommited===== tls: (TLS) Failed reading certificate file "/etc/freeradius/certs/server.pem" tls: (TLS) error:8000000D:system library::Permission denied Thanks, Joleking ________________________________ From: Freeradius-Users <freeradius-users-bounces+jonathan763=hotmail.com@lists.freeradius.org> on behalf of Alan DeKok <aland@deployingradius.com> Sent: January 29, 2024 14:32 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Failed reading certificate file error with freeradius container. On Jan 29, 2024, at 12:12 PM, Jonathan Gregoire <jonathan763@hotmail.com> wrote:
I'm having an issue when I try to run freeradius in a docker container. In the output that I pasted below, you will notice that I copied the "/etc/freeradius" directory on my host and that I mount the configuration directory $(pwd)/etc/freeradius on the container to make my configuration persistent.
The problem is that no matter the permission I set on the $(pwd)/etc/freeradius/certs/server.pem file, I'm always getting an error when I launch the container: tls: (TLS) Failed reading certificate file "/etc/freeradius/certs/server.pem"
Do you have an idea?
It's OS / docker / file system permissions issues, and has nothing to do with FreeRADIUS. The files are owned by root, and then in the docket image, FreeRADIUS is running as ??? what user? Alan DeKok. - List info/subscribe/unsubscribe? See https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=05%7C02%7C%7C6d0ba0a8f6524ec6298708dc21011f97%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C638421535914892866%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=2XBDiGHquNRwtfMMxw5QwmtQ5AwgIUchWbYHQhNDq%2BA%3D&reserved=0<http://www.freeradius.org/list/users.html>
On Jan 29, 2024, at 3:06 PM, Jonathan Gregoire <jonathan763@hotmail.com> wrote:
In Freeradius container, it is the "freerad" user that run the freeradius service: ... On my host, the freerad user doesn't exist. So I created it and also a group called "freerad" just in case.
All I can say is that it's a docker / OS / file system issue. FreeRADIUS runs just fine if the file permissions let it read the files. Since FreeRADIUS doesn't control the file permissions, there isn't a lot it can do to fix this issue. If you change the files to be "a+r", then it will work. Which tells you even more that it's a file system issue. On a normal OS, the default install creates the correct files with the correct permissions, and it just works. There's some docker magic required to get the permissions correct. I really don't use docker, so I can't say much else here. Aan DeKok.
It works, I have changed the file permissions on my host to "a+r" as suggested. I will dig on the docker side to see how I can restrict permissions to the minimum required and post my finding here later. Joleking ________________________________ From: Freeradius-Users <freeradius-users-bounces+jonathan763=hotmail.com@lists.freeradius.org> on behalf of Alan DeKok <aland@deployingradius.com> Sent: January 29, 2024 15:20 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Failed reading certificate file error with freeradius container. On Jan 29, 2024, at 3:06 PM, Jonathan Gregoire <jonathan763@hotmail.com> wrote:
In Freeradius container, it is the "freerad" user that run the freeradius service: ... On my host, the freerad user doesn't exist. So I created it and also a group called "freerad" just in case.
All I can say is that it's a docker / OS / file system issue. FreeRADIUS runs just fine if the file permissions let it read the files. Since FreeRADIUS doesn't control the file permissions, there isn't a lot it can do to fix this issue. If you change the files to be "a+r", then it will work. Which tells you even more that it's a file system issue. On a normal OS, the default install creates the correct files with the correct permissions, and it just works. There's some docker magic required to get the permissions correct. I really don't use docker, so I can't say much else here. Aan DeKok. - List info/subscribe/unsubscribe? See https://emea01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=05%7C02%7C%7Ca182d14748284b370cfc08dc2107cada%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C638421564556509845%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=umTyn0KZhWbquttMK0iR41K57PK%2BuZKia2Es9MYfpOI%3D&reserved=0<http://www.freeradius.org/list/users.html> J
participants (2)
-
Alan DeKok -
Jonathan Gregoire