Improvements to FreeRADIUS

- Better crypto-policies (previous commit)
- Better logrotation
- Better bootstrap

Signed-off-by: Alexander Scheel <ascheel@redhat.com>

freeradius-bootstrap-create-only.patch

@@ -0,0 +1,100 @@
+From d38836ca4158b42c27f4d7f474e64f4f10aed16d Mon Sep 17 00:00:00 2001
+From: Alexander Scheel <ascheel@redhat.com>
+Date: Wed, 8 May 2019 10:29:08 -0400
+Subject: [PATCH] Don't clobber existing files on bootstrap
+
+Signed-off-by: Alexander Scheel <ascheel@redhat.com>
+---
+ raddb/certs/bootstrap | 39 ++++++++++++---------------------------
+ 1 file changed, 12 insertions(+), 27 deletions(-)
+
+diff --git a/raddb/certs/bootstrap b/raddb/certs/bootstrap
+index 0f719aafd4..be81a2d697 100755
+--- a/raddb/certs/bootstrap
++++ b/raddb/certs/bootstrap
+@@ -13,17 +13,6 @@
+ umask 027
+ cd `dirname $0`
+ 
+-make -h > /dev/null 2>&1
+-
+-#
+-#  If we have a working "make", then use it.  Otherwise, run the commands
+-#  manually.
+-#
+-if [ "$?" = "0" ]; then
+-  make all
+-  exit $?
+-fi
+-
+ #
+ #  The following commands were created by running "make -n", and edited
+ #  to remove the trailing backslash, and to add "exit 1" after the commands.
+@@ -31,52 +20,48 @@ fi
+ #  Don't edit the following text.  Instead, edit the Makefile, and
+ #  re-generate these commands.
+ #
+-if [ ! -f dh ]; then
++if [ ! -e dh ]; then
+   openssl dhparam -out dh 2048 || exit 1
+-  if [ -e /dev/urandom ] ; then
+-	ln -sf /dev/urandom random
+-  else
+-	date > ./random;
+-  fi
++  ln -sf /dev/urandom random
+ fi
+ 
+-if [ ! -f server.key ]; then
++if [ ! -e server.key ]; then
+   openssl req -new  -out server.csr -keyout server.key -config ./server.cnf || exit 1
+ fi
+ 
+-if [ ! -f ca.key ]; then
++if [ ! -e ca.key ]; then
+   openssl req -new -x509 -keyout ca.key -out ca.pem -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf || exit 1
+ fi
+ 
+-if [ ! -f index.txt ]; then
++if [ ! -e index.txt ]; then
+   touch index.txt
+ fi
+ 
+-if [ ! -f serial ]; then
++if [ ! -e serial ]; then
+   echo '01' > serial
+ fi
+ 
+-if [ ! -f server.crt ]; then
++if [ ! -e server.crt ]; then
+   openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr  -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf || exit 1
+ fi
+ 
+-if [ ! -f server.p12 ]; then
++if [ ! -e server.p12 ]; then
+   openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12  -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1
+ fi
+ 
+-if [ ! -f server.pem ]; then
++if [ ! -e server.pem ]; then
+   openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1
+   openssl verify -CAfile ca.pem server.pem || exit 1
+ fi
+ 
+-if [ ! -f ca.der ]; then
++if [ ! -e ca.der ]; then
+   openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der || exit 1
+ fi
+ 
+-if [ ! -f client.key ]; then
++if [ ! -e client.key ]; then
+   openssl req -new  -out client.csr -keyout client.key -config ./client.cnf
+ fi
+ 
+-if [ ! -f client.crt ]; then
++if [ ! -e client.crt ]; then
+   openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr  -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf
+ fi
+-- 
+2.21.0
+

freeradius-logrotate

@@ -14,6 +14,7 @@
 	nocreate
 	missingok
 	compress
+	su radiusd radiusd
 }
 
 /var/log/radius/checkrad.log {
@@ -22,6 +23,7 @@
 	create
 	missingok
 	compress
+	su radiusd radiusd
 }
 
 /var/log/radius/radius.log {
@@ -30,6 +32,7 @@
 	create
 	missingok
 	compress
+	su radiusd radiusd
 	postrotate
 		/usr/bin/systemctl reload-or-try-restart radiusd
 	endscript
@@ -41,6 +44,7 @@
 	create
 	compress
 	missingok
+	su radiusd radiusd
 }
 /var/log/radius/sqltrace.sql {
         monthly
@@ -48,4 +52,5 @@
         create
         compress
         missingok
+	su radiusd radiusd
 }

freeradius.spec

@@ -1,7 +1,7 @@
 Summary: High-performance and highly configurable free RADIUS server
 Name: freeradius
 Version: 3.0.19
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: GPLv2+ and LGPLv2+
 URL: http://www.freeradius.org/
 
@@ -22,6 +22,7 @@ Source104: freeradius-tmpfiles.conf
 
 Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch
 Patch2: freeradius-Use-system-crypto-policy-by-default.patch
+Patch3: freeradius-bootstrap-create-only.patch
 
 %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}}
 
@@ -128,6 +129,7 @@ BuildRequires: perl(ExtUtils::Embed)
 %description perl
 This plugin provides the Perl support for the FreeRADIUS server project.
 
+%if 0%{?fedora} <= 30
 %package -n python2-freeradius
 Summary: Python support for freeradius
 Requires: %{name} = %{version}-%{release}
@@ -140,6 +142,7 @@ Obsoletes: %{name}-python < %{version}-%{release}
 
 %description -n python2-freeradius
 This plugin provides the Python support for the FreeRADIUS server project.
+%endif
 
 %package mysql
 Summary: MySQL support for freeradius
@@ -188,6 +191,7 @@ This plugin provides the REST support for the FreeRADIUS server project.
 # mistakenly includes the backup files, especially problematic for raddb config files.
 %patch1 -p1
 %patch2 -p1
+%patch3 -p1
 
 %build
 # Force compile/link options, extra security for network facing daemon
@@ -782,6 +786,11 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest
 
 %changelog
+* Wed May 08 2019 Alexander Scheel <ascheel@redhat.com> - 3.0.19-2
+- Updated crypto-policies patch
+- Updated /etc/raddb/certs/bootstrap to only create certificates if missing
+- Updated logrotate definitions to run as radiusd:radiusd
+
 * Wed Apr 10 2019 Alexander Scheel <ascheel@redhat.com> - 3.0.19-1
 - Rebased to 3.0.19
 

radiusd.service

@@ -6,7 +6,7 @@ After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.serv
 Type=forking
 PIDFile=/var/run/radiusd/radiusd.pid
 ExecStartPre=-/bin/chown -R radiusd.radiusd /var/run/radiusd
-ExecStartPre=/bin/sh /etc/raddb/certs/bootstrap
+ExecStartPre=/bin/sh /etc/raddb/certs/bootstrap create-only
 ExecStartPre=/bin/chgrp -R radiusd /etc/raddb/certs/
 ExecStartPre=/usr/sbin/radiusd -C
 ExecStart=/usr/sbin/radiusd -d /etc/raddb