I ran into an issue where proxy.conf was globally readable for some reason, freeradius wouldn't start because of this and this wasn't picked up by radiusd -C. Can this check be added?
* globally writable I mean On Tue, Nov 27, 2012 at 8:55 AM, James Devine <fxmulder@gmail.com> wrote:
I ran into an issue where proxy.conf was globally readable for some reason, freeradius wouldn't start because of this and this wasn't picked up by radiusd -C. Can this check be added?
James Devine wrote:
* globally writable I mean
It already checks that. $ chmod a+w raddb/proxy.con $ radiusd -XC ... Configuration file ./raddb//proxy.conf is globally writable. Refusing to start due to insecure configuration. Errors reading or parsing ./raddb//debug.conf If you don't see this, it's because you're running a very old version without that check, or raddb/proxy.conf isn't actually globally writable. Alan DeKok.
radiusd -XC seems to produce what I was looking for, thanks. On Tue, Nov 27, 2012 at 9:10 AM, Alan DeKok <aland@deployingradius.com>wrote:
James Devine wrote:
* globally writable I mean
It already checks that.
$ chmod a+w raddb/proxy.con $ radiusd -XC ... Configuration file ./raddb//proxy.conf is globally writable. Refusing to start due to insecure configuration. Errors reading or parsing ./raddb//debug.conf
If you don't see this, it's because you're running a very old version without that check, or raddb/proxy.conf isn't actually globally writable.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
James Devine wrote:
I ran into an issue where proxy.conf was globally readable for some reason,
proxy.conf should NEVER be globally readable.
freeradius wouldn't start because of this and this wasn't picked up by radiusd -C. Can this check be added?
File permissions are enforced by the operating system, not by FreeRADIUS. If radiusd runs as user "radiusd", but you do the check as "root", there isn't much that the server can do. You need to do the check as the user running radius. e.g.: su radiusd radiusd -C instead of radiusd -C Alan DeKok.
participants (2)
-
Alan DeKok -
James Devine