RADIUS 2.x - modules not loaded correctly
Hi all I want to inform the community about a mistake I run into and wish that nobody run into this after me. It's my style to copy an original file to a backup version before modifying it. Therefore I copied the ${confdir}/modules/mschap to ${confdir}/modules/mschap.ori and edited the ${confdir}/modules/mschap. Watching radiusd -xX I saw that my modifications to mschap did not work. It took me hours to figure out the following: All files (matching the regex /[a-zA-Z0-9_.]+/) in directory ${confdir}/modules are loaded into radiusd at startup time. ${confdir}/mschap.ori is loaded previous to ${confdir}/modules/mschap [I don't know why] and gives the old settings to the radiusd. After renaming ${confdir}/mschap.ori to ${confdir}/mschap-ori everything worked well. Because the minus sign don't match /[a-zA-Z0-9_.]+/ My warning: Beware of having private files in ${confdir}/modules. -- To the developers: I propose to name the module files with static suffix (like .mod or .rlm) and load only files with this suffix via $INCLUDE ${confdir}/modules/*.mod. Best regards Axel Vogel
Interesting... I often do similar renaming so now I wonder if a similar issue is causing me problems on my test system.... Thanks for the FYI. G -----Original Message----- From: freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org [mailto:freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.or g] On Behalf Of Axel Vogel Sent: Monday, December 14, 2009 12:14 PM To: FreeRadius users mailing list Subject: RADIUS 2.x - modules not loaded correctly Hi all I want to inform the community about a mistake I run into and wish that nobody run into this after me. It's my style to copy an original file to a backup version before modifying it. Therefore I copied the ${confdir}/modules/mschap to ${confdir}/modules/mschap.ori and edited the ${confdir}/modules/mschap. Watching radiusd -xX I saw that my modifications to mschap did not work. It took me hours to figure out the following: All files (matching the regex /[a-zA-Z0-9_.]+/) in directory ${confdir}/modules are loaded into radiusd at startup time. ${confdir}/mschap.ori is loaded previous to ${confdir}/modules/mschap [I don't know why] and gives the old settings to the radiusd. After renaming ${confdir}/mschap.ori to ${confdir}/mschap-ori everything worked well. Because the minus sign don't match /[a-zA-Z0-9_.]+/ My warning: Beware of having private files in ${confdir}/modules. -- To the developers: I propose to name the module files with static suffix (like .mod or .rlm) and load only files with this suffix via $INCLUDE ${confdir}/modules/*.mod. Best regards Axel Vogel - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>
hi, dont leave the unwanted/old modules in the modules directory. make a new directory called modules-available and put them into there. better still, emulate the method used for virtual servers and move modules to modules-available and then make a directory called modules and synlink the required files from modules-available (it would be good if the server did modules-enabled/ etc like the virtual servers...) be aware, too, that if you 'make install' over a previous version it will write files that are non-existant into place...eg if you didnt need modules/detail and blew it away or renamed it then it'll put the normal original copy into place. either way, how the system works means you cannot just leave the originals lying around. the same is very very much true with apache 2.x and its ocnfig files.... especially those with eg Fedora/RHEL where it'll read /etc/httpd/conf.d/* (indeed, same issue with just moving files out the way and then 'yum update' etc) alan
Hi Alan, your proposals are very good. I will not make my mistake a second time. But think of me as an administrator who takes a LINUX distribution with precompiled freeradiusd and who reads all the manuals and FAQs and then modifies the configuration files in an old-fashioned way and - nothing works like expected. Wouldn't it be better to make configuration easy to use for (only)administrators? Please look at the configuration of virtual hosts in apache2. The httpd.conf incudes only files with a well defined suffix vhosts.d/*.conf I think that they know why ... Axel Alan Buxey:
hi,
dont leave the unwanted/old modules in the modules directory. make a new directory called modules-available and put them into there.
better still, emulate the method used for virtual servers and move modules to modules-available and then make a directory called modules and synlink the required files from modules-available
(it would be good if the server did modules-enabled/ etc like the virtual servers...)
be aware, too, that if you
'make install'
over a previous version it will write files that are non-existant into place...eg if you didnt need modules/detail and blew it away or renamed it then it'll put the normal original copy into place.
either way, how the system works means you cannot just leave the originals lying around. the same is very very much true with apache 2.x and its ocnfig files.... especially those with eg Fedora/RHEL where it'll read /etc/httpd/conf.d/* (indeed, same issue with just moving files out the way and then 'yum update' etc)
alan
-- Axel Vogel Network/Operations | Bundesamt fuer Kartographie und Geodaesie | Tel.: +49 341 5634 203 Aussenstelle Leipzig | Fax: +49 341 5634 1984 Karl-Rothe-Str. 10-14 | D-04105 Leipzig | 012deg 22' 26.75" E Federal Republic of Germany | 51deg 21' 14.50" N
Alan DeKok wrote:
Axel Vogel wrote:
Please look at the configuration of virtual hosts in apache2. The httpd.conf incudes only files with a well defined suffix vhosts.d/*.conf
Sure. Send a patch.
Alan DeKok.
I would do if I would know how. My 1st intention was to inform the community and my 2nd intention was to inspire a discussion about usability of configurations. :-) Axel
On Tue, Dec 15, 2009 at 09:03:33AM +0100, Alan DeKok wrote:
Axel Vogel wrote:
Please look at the configuration of virtual hosts in apache2. The httpd.conf incudes only files with a well defined suffix vhosts.d/*.conf
Sure. Send a patch.
I was thinking we should use the mods-{available,enabled}, also mimicking apache2 and sites-*. That way we can worry less about the admin editing and leaving junk in one directory, when only the other one is supposed to be clean. Something like this? git mv raddb/modules raddb/mods-available patch -p1 < mods.diff # attached -- 2. That which causes joy or happiness.
Hi,
I was thinking we should use the mods-{available,enabled}, also mimicking apache2 and sites-*. That way we can worry less about the admin editing and leaving junk in one directory, when only the other one is supposed to be clean. Something like this?
git mv raddb/modules raddb/mods-available patch -p1 < mods.diff # attached
that makes the modules go into modules-available - but then you need to create the modules-enabled directory and put links into there... by default the server needs at least a handful of the modules to be present for its default config to load/work - i know - i've looked at this in the past. you'll also need to patch the radiusd.conf to read in modules-enabled/* alan
On Mon, Dec 21, 2009 at 03:39:24PM +0000, Alan Buxey wrote:
that makes the modules go into modules-available - but then you need to create the modules-enabled directory and put links into there... by default the server needs at least a handful of the modules to be present for its default config to load/work - i know - i've looked at this in the past. you'll also need to patch the radiusd.conf to read in modules-enabled/*
Yes, of course, I just sent the patch as the preliminary intro into the idea (OP's idea instead had no separate directories and symlinks in mind, it talked of suffixes). As it stands, all entries in current modules/ are harmless when enabled (by default), so that part could stay as is, functionally. -- 2. That which causes joy or happiness.
Josip Rodin wrote:
I was thinking we should use the mods-{available,enabled}, also mimicking apache2 and sites-*. That way we can worry less about the admin editing and leaving junk in one directory, when only the other one is supposed to be clean. Something like this?
For 2.2.0, yes. Alan DeKok.
Alan Buxey <A.L.M.Buxey@lboro.ac.uk> writes:
hi,
dont leave the unwanted/old modules in the modules directory. make a new directory called modules-available and put them into there.
Leaving config there for modules which are not used won't hurt.
better still, emulate the method used for virtual servers and move modules to modules-available and then make a directory called modules and synlink the required files from modules-available
(it would be good if the server did modules-enabled/ etc like the virtual servers...)
be aware, too, that if you
'make install'
over a previous version it will write files that are non-existant into place...eg if you didnt need modules/detail and blew it away or renamed it then it'll put the normal original copy into place.
My approach is running the server with "-d dir", and place my tuned config in dir instead of where the install puts it. Default configuration is included by using symlinks. Bjørn
participants (6)
-
Alan Buxey -
Alan DeKok -
Axel Vogel -
Bjørn Mork -
Gary Gatten -
Josip Rodin