configure freeradius to send no response if LDAP database fails

[Alan DeKok]

On May 1, 2018, at 1:33 PM, Matthew Almen <malmen at polartel.com> wrote:
> 
> Hello, I am trying to find out if there is a way to configure freeradius to exit or not send a response to queries if the local LDAP database becomes unavailable after the radius server is started.  The radiusd service will not start if it cannot connect to the local LDAP database which I would expect.  If I stop the LDAP service while freeradius is running I see from the debugging output pf /usr/sbin/radiusd -X that it fails to contact the LDAP server over and over and just keeps sending access-rejects back to our NAS router.  Our router is configured to test the radius server with a test username but it will not mark the server as dead and move onto the next server in the server-group if it receives any response from the radius server.  Even if an access-reject is received that still satisfies the test and the server does not get marked as dead.  I need the server to be marked as dead if LDAP is down and radius is replying with an access-reject for everything.  Any help would be appreciated.  Thanks, Matt

  do this:

	ldap {
		fail = 1
	}
	if (fail) {
		do_not_respond
	}

  That should do it.

  The magic "fail = 1" prevents it from leaving the "authorize" section if the LDAP module fails.

  It then checks for "fail" and runs the "do_not_respond" policy from raddb/policy.d/control.  If you don't have that policy there, upgrade.

  Alan DeKok.