When changing the debug mode via `-X` in /etc/default/freeradius the following traceback occurs in journalctl -u freeradius.service when executing the tests (e.g. 45_radius/02_eap_test.py): Traceback (most recent call last): File "/usr/bin/univention-radius-ntlm-auth", line 78, in <module> sys.exit(main()) ^^^^^^ File "/usr/bin/univention-radius-ntlm-auth", line 63, in main networkAccess = NetworkAccess(options.username, options.station_id, logfile=LOGFIILE) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3/dist-packages/univention/radius/networkaccess.py", line 104, in __init__ self.ldapConnection = get_ldapConnection() ^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3/dist-packages/univention/radius/networkaccess.py", line 70, in get_ldapConnection return univention.uldap.getMachineConnection(ldap_master=False, reconnect=False) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3/dist-packages/univention/uldap.py", line 172, in getMachineConnection bindpw = open(secret_file).read().rstrip('\n') ^^^^^^^^^^^^^^^^^ PermissionError: [Errno 13] Permission denied: '/etc/machine.secret' For this we have the setuid wrapper (services/univention-radius/univention-radius-ntlm-auth-suidwrapper.c) but the upstream systemd /usr/lib/systemd/system/freeradius.service definition changed and disallows user change: NoNewPrivileges=true ProtectControlGroups=true ProtectKernelModules=true ProtectKernelTunables=true SystemCallArchitectures=native → we have to either adjust the service or need a machine.secret readable by the freeradius user.
Changing only the secret file is not enough: Traceback (most recent call last): File "/usr/bin/univention-radius-ntlm-auth", line 78, in <module> sys.exit(main()) ^^^^^^ File "/usr/bin/univention-radius-ntlm-auth", line 63, in main networkAccess = NetworkAccess(options.username, options.station_id, logfile=LOGFIILE) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3/dist-packages/univention/radius/networkaccess.py", line 109, in __init__ self._setup_logger(loglevel, logfile) File "/usr/lib/python3/dist-packages/univention/radius/networkaccess.py", line 125, in _setup_logger log_handler = logging.FileHandler(logfile) # type: logging.Handler ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.11/logging/__init__.py", line 1181, in __init__ StreamHandler.__init__(self, self._open()) ^^^^^^^^^^^^ File "/usr/lib/python3.11/logging/__init__.py", line 1213, in _open return open_func(self.baseFilename, self.mode, ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ PermissionError: [Errno 13] Permission denied: '/var/log/univention/radius_ntlm_auth.log'
QA: Code: OK Changelog: OK
univention-radius (8.0.4) 3509a3e02ed9 | fix(radius): add /etc/freeradius.secret credentials file