Bash Script not exec-uting in Daemon Mode
Hi, Strange doings executing a bash script from the 'exec' module in v.3.0.21 on Debian 11.3. Everything works fine in debug mode ('-X'), but script execution fails in daemon mode. This used to work before a recent upgrade from v.3.0.17. Any pointers greatly appreciated! Mike <--- rlm_exec exec failmail { wait = no input_pairs = request shell_escape = no timeout = 1 program = "/etc/freeradius/3.0/execscripts/mailbot.sh %{User-Name}" } ---> <--- ls -al ../execscripts drwxr-xr-x 2 freerad freerad 4096 Mar 29 23:46 . drwxr-xr-x 10 freerad freerad 4096 Mar 25 20:18 .. -rwxr-x--x 1 freerad freerad 1503 Mar 28 18:47 mailbot.sh -rw-r----- 1 freerad freerad 428 Feb 29 2020 template.mail --->
On Mar 30, 2022, at 12:38 AM, Mike Ruebner <freeradius@machichemicals.com> wrote:
Strange doings executing a bash script from the 'exec' module in v.3.0.21 on Debian 11.3. Everything works fine in debug mode ('-X'), but script execution fails in daemon mode. This used to work before a recent upgrade from v.3.0.17. Any pointers greatly appreciated! Mike
And... anything in the logs? Have you tried running it as the "freeradi" user from the command line? Have you instrumented the script to see if it's running? Can you have the script write logs to /tmp, or to syslog? Something changed. The server still executes scripts fine for everyone else. So it's something on your local system. i.e. you have a number of options for debugging it locally. We have none. Which means that there's very little we can do to help. Alan DeKok.
Well, I didn't expect someone to take this personally. Neither was that my intent. And, yes, something changed. After some digging, I found this nugget in '/lib/systemd/system/freeradius.service': # We shouldn't be writing to the configuration directory ReadOnlyDirectories=/etc/freeradius/ Defeats any attempt to write to a sub-directory & explains why my script stopped performing in daemon mode. No idea when this was introduced, or whether the package maintainer came up with this brilliant idea. Wouldn't hurt to document this somewhere, though. Anyway, my system, my rules. Directive commented out, and my script is working as expected again. Bests, Mike
And... anything in the logs? Have you tried running it as the "freeradi" user from the command line? Have you instrumented the script to see if it's running? Can you have the script write logs to /tmp, or to syslog?
Something changed. The server still executes scripts fine for everyone else. So it's something on your local system.
i.e. you have a number of options for debugging it locally. We have none. Which means that there's very little we can do to help.
Alan DeKok.
On Mar 30, 2022, at 12:38 AM, Mike Ruebner <freeradius@machichemicals.com> wrote: Strange doings executing a bash script from the 'exec' module in v.3.0.21 on Debian 11.3. Everything works fine in debug mode ('-X'), but script execution fails in daemon mode. This used to work before a recent upgrade from v.3.0.17. Any pointers greatly appreciated! Mike
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mar 31, 2022, at 1:47 AM, Mike Ruebner <freeradius@machichemicals.com> wrote:
Well, I didn't expect someone to take this personally. Neither was that my intent.
Unfortunately, such childish responses look worse for you than for me. Your reply shows that you've chosen to take offence when any normal person would see that none was given. Your original message made it clear that you hadn't done anything yourself to debug the problem. Instead, you just posted a nearly content-free message to the list, and expected the geniuses here to figure it out. Then after being given detailed technical advice for debugging this issue, you respond with a complaint that you're the victim. The underlying offending act is that my message implied that you did something wrong. That's personally traumatic for you. So you have to respond as if my clear, polite, response was somehow personally offensive. Well, you're not the victim here. You're the one causing problems.
And, yes, something changed. After some digging, I found this nugget in '/lib/systemd/system/freeradius.service':
# We shouldn't be writing to the configuration directory ReadOnlyDirectories=/etc/freeradius/
Defeats any attempt to write to a sub-directory & explains why my script stopped performing in daemon mode. No idea when this was introduced, or whether the package maintainer came up with this brilliant idea. Wouldn't hurt to document this somewhere, though. Anyway, my system, my rules. Directive commented out, and my script is working as expected again.
It's terrible practice to allow the server (or any program started by the server) to write to the configuration files / directories. The default configuration has prevented this for well over a decade. The only reason your script worked at all is that you changed the default file permissions to allow an insecure configuration. Oh, and my list, my rules. If you complain about my reply here, you will be unsubscribed from the list and permanently banned. We don't put up with nonsense like "I'm the victim for being given technical advice". Or nonsense like "I'm the victim for being asked to provide useful information about the problem". Or "I'm the victim for being asked to read the documentation and follow its instructions". All of those attitudes are inappropriate, and are not accepted here. They will result in a ban. This is your only warning. Alan DeKok.
Whoa! I had to sit on my response for a while, because I wasn't quite sure whether to feel flattered or concerned :) During my years of lurking on this list, I have seen you going from eccentric novelty to vindictive petty bourgeoise asshole to full-blown mental. (I am complaining about being a 'victim' & causing 'problems'. Seriously?) There was enough information in my posting to point towards the obvious solution. If that rubbed you the wrong way, you could have just ignored it. Instead, you chose to jump right in to spew your usual paranoid drivel. So, yes, please go ahead and expel me from your little fiefdom. For the benefit of quality content on this list, may I recommend you follow suit? Mike ----- Original Message ----- From: "Alan DeKok" <aland@deployingradius.com> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Thursday, March 31, 2022 9:22:54 AM Subject: Re: Bash Script not exec-uting in Daemon Mode On Mar 31, 2022, at 1:47 AM, Mike Ruebner <freeradius@machichemicals.com> wrote:
Well, I didn't expect someone to take this personally. Neither was that my intent.
Unfortunately, such childish responses look worse for you than for me. Your reply shows that you've chosen to take offence when any normal person would see that none was given. Your original message made it clear that you hadn't done anything yourself to debug the problem. Instead, you just posted a nearly content-free message to the list, and expected the geniuses here to figure it out. Then after being given detailed technical advice for debugging this issue, you respond with a complaint that you're the victim. The underlying offending act is that my message implied that you did something wrong. That's personally traumatic for you. So you have to respond as if my clear, polite, response was somehow personally offensive. Well, you're not the victim here. You're the one causing problems.
And, yes, something changed. After some digging, I found this nugget in '/lib/systemd/system/freeradius.service':
# We shouldn't be writing to the configuration directory ReadOnlyDirectories=/etc/freeradius/
Defeats any attempt to write to a sub-directory & explains why my script stopped performing in daemon mode. No idea when this was introduced, or whether the package maintainer came up with this brilliant idea. Wouldn't hurt to document this somewhere, though. Anyway, my system, my rules. Directive commented out, and my script is working as expected again.
It's terrible practice to allow the server (or any program started by the server) to write to the configuration files / directories. The default configuration has prevented this for well over a decade. The only reason your script worked at all is that you changed the default file permissions to allow an insecure configuration. Oh, and my list, my rules. If you complain about my reply here, you will be unsubscribed from the list and permanently banned. We don't put up with nonsense like "I'm the victim for being given technical advice". Or nonsense like "I'm the victim for being asked to provide useful information about the problem". Or "I'm the victim for being asked to read the documentation and follow its instructions". All of those attitudes are inappropriate, and are not accepted here. They will result in a ban. This is your only warning. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mar 31, 2022, at 11:54 PM, Mike Ruebner via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
There was enough information in my posting to point towards the obvious solution.
So... we're idiots for not solving the problem? A problem you couldn't solve? So you had to ask us for help? Congratulations for calling yourself an idiot for not being able to solve the problem.
If that rubbed you the wrong way, you could have just ignored it.
Hmm... if only you had exercised similar self-control when replying to my first message. Oh well. Rules for us, not for you, I guess. Well, he's gone. He's shown that even under his own rules, he's unable to exercise sufficient self control to be allowed out in public. Alan DeKok.
participants (2)
-
Alan DeKok -
Mike Ruebner