0

I have set up FreeRADIUS 2.1.12 on Debian for authentication in a WPA2-Enterprise environment. Now I'd like to jail it with chroot. There is a parameter in radiusd.conf configuration file pointing to the chroot location:

#chroot = /opt/jail/freeradius

But with the documentation inside of radiusd.conf I can't figure out what files and dirs needs to be inside the chroot directory.

I have figured out that I need /var/run/freeradius, /var/log/freeradius and the /etc/freeradius directory containing the configuration files and modules. Do I really need to put the latter into the jail or can they stay outside and be read on freeradius startup before the chroot is performed? If not, do I need all files or only those being actually used in my deployment? As pointed out before, I am only using authentication features.

Has anybody done that before and can provide some details? Thanks a lot!

1 Answer 1

0

Chroot is done after:

  • Reading the main configuration
  • Reading the module configurations
  • Reading the virtual servers
  • Reading the dictionaries

But before:

  • Initialising modules. Which means things like the users file would need to be inside the chroot dir, as would any unix sockets, or other file based resources used by modules.
  • Processing requests. Which means logfiles must be inside the chroot'd directory.
2
  • Thanks for clarification! I figured it out step by step, works now. As we use certificates for authentication I needed to create some more directories, links and adjust permissions. Also devices null and urandom needed to be bind-mounted. May 4, 2015 at 14:59
  • And in future versions of the server, the syslog socket too. May 4, 2015 at 18:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .