From ab22b18a7870e6fa476b87b7c109915e80bea3fb Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 8 May 2019 10:37:04 -0400 Subject: [PATCH] Improvements to FreeRADIUS - Better crypto-policies (previous commit) - Better logrotation - Better bootstrap Signed-off-by: Alexander Scheel --- freeradius-bootstrap-create-only.patch | 100 +++++++++++++++++++++++++ freeradius-logrotate | 5 ++ freeradius.spec | 11 ++- radiusd.service | 2 +- 4 files changed, 116 insertions(+), 2 deletions(-) create mode 100644 freeradius-bootstrap-create-only.patch diff --git a/freeradius-bootstrap-create-only.patch b/freeradius-bootstrap-create-only.patch new file mode 100644 index 0000000..5c3e1ac --- /dev/null +++ b/freeradius-bootstrap-create-only.patch @@ -0,0 +1,100 @@ +From d38836ca4158b42c27f4d7f474e64f4f10aed16d Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Wed, 8 May 2019 10:29:08 -0400 +Subject: [PATCH] Don't clobber existing files on bootstrap + +Signed-off-by: Alexander Scheel +--- + raddb/certs/bootstrap | 39 ++++++++++++--------------------------- + 1 file changed, 12 insertions(+), 27 deletions(-) + +diff --git a/raddb/certs/bootstrap b/raddb/certs/bootstrap +index 0f719aafd4..be81a2d697 100755 +--- a/raddb/certs/bootstrap ++++ b/raddb/certs/bootstrap +@@ -13,17 +13,6 @@ + umask 027 + cd `dirname $0` + +-make -h > /dev/null 2>&1 +- +-# +-# If we have a working "make", then use it. Otherwise, run the commands +-# manually. +-# +-if [ "$?" = "0" ]; then +- make all +- exit $? +-fi +- + # + # The following commands were created by running "make -n", and edited + # to remove the trailing backslash, and to add "exit 1" after the commands. +@@ -31,52 +20,48 @@ fi + # Don't edit the following text. Instead, edit the Makefile, and + # re-generate these commands. + # +-if [ ! -f dh ]; then ++if [ ! -e dh ]; then + openssl dhparam -out dh 2048 || exit 1 +- if [ -e /dev/urandom ] ; then +- ln -sf /dev/urandom random +- else +- date > ./random; +- fi ++ ln -sf /dev/urandom random + fi + +-if [ ! -f server.key ]; then ++if [ ! -e server.key ]; then + openssl req -new -out server.csr -keyout server.key -config ./server.cnf || exit 1 + fi + +-if [ ! -f ca.key ]; then ++if [ ! -e ca.key ]; then + openssl req -new -x509 -keyout ca.key -out ca.pem -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf || exit 1 + fi + +-if [ ! -f index.txt ]; then ++if [ ! -e index.txt ]; then + touch index.txt + fi + +-if [ ! -f serial ]; then ++if [ ! -e serial ]; then + echo '01' > serial + fi + +-if [ ! -f server.crt ]; then ++if [ ! -e server.crt ]; then + openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf || exit 1 + fi + +-if [ ! -f server.p12 ]; then ++if [ ! -e server.p12 ]; then + openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1 + fi + +-if [ ! -f server.pem ]; then ++if [ ! -e server.pem ]; then + openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1 + openssl verify -CAfile ca.pem server.pem || exit 1 + fi + +-if [ ! -f ca.der ]; then ++if [ ! -e ca.der ]; then + openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der || exit 1 + fi + +-if [ ! -f client.key ]; then ++if [ ! -e client.key ]; then + openssl req -new -out client.csr -keyout client.key -config ./client.cnf + fi + +-if [ ! -f client.crt ]; then ++if [ ! -e client.crt ]; then + openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf + fi +-- +2.21.0 + diff --git a/freeradius-logrotate b/freeradius-logrotate index 1c3c5b9..c962254 100644 --- a/freeradius-logrotate +++ b/freeradius-logrotate @@ -14,6 +14,7 @@ nocreate missingok compress + su radiusd radiusd } /var/log/radius/checkrad.log { @@ -22,6 +23,7 @@ create missingok compress + su radiusd radiusd } /var/log/radius/radius.log { @@ -30,6 +32,7 @@ create missingok compress + su radiusd radiusd postrotate /usr/bin/systemctl reload-or-try-restart radiusd endscript @@ -41,6 +44,7 @@ create compress missingok + su radiusd radiusd } /var/log/radius/sqltrace.sql { monthly @@ -48,4 +52,5 @@ create compress missingok + su radiusd radiusd } diff --git a/freeradius.spec b/freeradius.spec index f93e045..9efc114 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.19 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -22,6 +22,7 @@ Source104: freeradius-tmpfiles.conf Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch Patch2: freeradius-Use-system-crypto-policy-by-default.patch +Patch3: freeradius-bootstrap-create-only.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -128,6 +129,7 @@ BuildRequires: perl(ExtUtils::Embed) %description perl This plugin provides the Perl support for the FreeRADIUS server project. +%if 0%{?fedora} <= 30 %package -n python2-freeradius Summary: Python support for freeradius Requires: %{name} = %{version}-%{release} @@ -140,6 +142,7 @@ Obsoletes: %{name}-python < %{version}-%{release} %description -n python2-freeradius This plugin provides the Python support for the FreeRADIUS server project. +%endif %package mysql Summary: MySQL support for freeradius @@ -188,6 +191,7 @@ This plugin provides the REST support for the FreeRADIUS server project. # mistakenly includes the backup files, especially problematic for raddb config files. %patch1 -p1 %patch2 -p1 +%patch3 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -782,6 +786,11 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed May 08 2019 Alexander Scheel - 3.0.19-2 +- Updated crypto-policies patch +- Updated /etc/raddb/certs/bootstrap to only create certificates if missing +- Updated logrotate definitions to run as radiusd:radiusd + * Wed Apr 10 2019 Alexander Scheel - 3.0.19-1 - Rebased to 3.0.19 diff --git a/radiusd.service b/radiusd.service index 133788a..894e8aa 100644 --- a/radiusd.service +++ b/radiusd.service @@ -6,7 +6,7 @@ After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.serv Type=forking PIDFile=/var/run/radiusd/radiusd.pid ExecStartPre=-/bin/chown -R radiusd.radiusd /var/run/radiusd -ExecStartPre=/bin/sh /etc/raddb/certs/bootstrap +ExecStartPre=/bin/sh /etc/raddb/certs/bootstrap create-only ExecStartPre=/bin/chgrp -R radiusd /etc/raddb/certs/ ExecStartPre=/usr/sbin/radiusd -C ExecStart=/usr/sbin/radiusd -d /etc/raddb