Improvements to FreeRADIUS
- Better crypto-policies (previous commit) - Better logrotation - Better bootstrap Signed-off-by: Alexander Scheel <ascheel@redhat.com>
This commit is contained in:
Alexander Scheel
parent
60fac0135f
commit
ab22b18a78
100
freeradius-bootstrap-create-only.patch
Normal file
100
freeradius-bootstrap-create-only.patch
Normal file
@ -0,0 +1,100 @@
|
||||
From d38836ca4158b42c27f4d7f474e64f4f10aed16d Mon Sep 17 00:00:00 2001
|
||||
From: Alexander Scheel <ascheel@redhat.com>
|
||||
Date: Wed, 8 May 2019 10:29:08 -0400
|
||||
Subject: [PATCH] Don't clobber existing files on bootstrap
|
||||
|
||||
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
|
||||
---
|
||||
raddb/certs/bootstrap | 39 ++++++++++++---------------------------
|
||||
1 file changed, 12 insertions(+), 27 deletions(-)
|
||||
|
||||
diff --git a/raddb/certs/bootstrap b/raddb/certs/bootstrap
|
||||
index 0f719aafd4..be81a2d697 100755
|
||||
--- a/raddb/certs/bootstrap
|
||||
+++ b/raddb/certs/bootstrap
|
||||
@@ -13,17 +13,6 @@
|
||||
umask 027
|
||||
cd `dirname $0`
|
||||
|
||||
-make -h > /dev/null 2>&1
|
||||
-
|
||||
-#
|
||||
-# If we have a working "make", then use it. Otherwise, run the commands
|
||||
-# manually.
|
||||
-#
|
||||
-if [ "$?" = "0" ]; then
|
||||
- make all
|
||||
- exit $?
|
||||
-fi
|
||||
-
|
||||
#
|
||||
# The following commands were created by running "make -n", and edited
|
||||
# to remove the trailing backslash, and to add "exit 1" after the commands.
|
||||
@@ -31,52 +20,48 @@ fi
|
||||
# Don't edit the following text. Instead, edit the Makefile, and
|
||||
# re-generate these commands.
|
||||
#
|
||||
-if [ ! -f dh ]; then
|
||||
+if [ ! -e dh ]; then
|
||||
openssl dhparam -out dh 2048 || exit 1
|
||||
- if [ -e /dev/urandom ] ; then
|
||||
- ln -sf /dev/urandom random
|
||||
- else
|
||||
- date > ./random;
|
||||
- fi
|
||||
+ ln -sf /dev/urandom random
|
||||
fi
|
||||
|
||||
-if [ ! -f server.key ]; then
|
||||
+if [ ! -e server.key ]; then
|
||||
openssl req -new -out server.csr -keyout server.key -config ./server.cnf || exit 1
|
||||
fi
|
||||
|
||||
-if [ ! -f ca.key ]; then
|
||||
+if [ ! -e ca.key ]; then
|
||||
openssl req -new -x509 -keyout ca.key -out ca.pem -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf || exit 1
|
||||
fi
|
||||
|
||||
-if [ ! -f index.txt ]; then
|
||||
+if [ ! -e index.txt ]; then
|
||||
touch index.txt
|
||||
fi
|
||||
|
||||
-if [ ! -f serial ]; then
|
||||
+if [ ! -e serial ]; then
|
||||
echo '01' > serial
|
||||
fi
|
||||
|
||||
-if [ ! -f server.crt ]; then
|
||||
+if [ ! -e server.crt ]; then
|
||||
openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf || exit 1
|
||||
fi
|
||||
|
||||
-if [ ! -f server.p12 ]; then
|
||||
+if [ ! -e server.p12 ]; then
|
||||
openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1
|
||||
fi
|
||||
|
||||
-if [ ! -f server.pem ]; then
|
||||
+if [ ! -e server.pem ]; then
|
||||
openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1
|
||||
openssl verify -CAfile ca.pem server.pem || exit 1
|
||||
fi
|
||||
|
||||
-if [ ! -f ca.der ]; then
|
||||
+if [ ! -e ca.der ]; then
|
||||
openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der || exit 1
|
||||
fi
|
||||
|
||||
-if [ ! -f client.key ]; then
|
||||
+if [ ! -e client.key ]; then
|
||||
openssl req -new -out client.csr -keyout client.key -config ./client.cnf
|
||||
fi
|
||||
|
||||
-if [ ! -f client.crt ]; then
|
||||
+if [ ! -e client.crt ]; then
|
||||
openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf
|
||||
fi
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -14,6 +14,7 @@
|
||||
nocreate
|
||||
missingok
|
||||
compress
|
||||
su radiusd radiusd
|
||||
}
|
||||
|
||||
/var/log/radius/checkrad.log {
|
||||
@ -22,6 +23,7 @@
|
||||
create
|
||||
missingok
|
||||
compress
|
||||
su radiusd radiusd
|
||||
}
|
||||
|
||||
/var/log/radius/radius.log {
|
||||
@ -30,6 +32,7 @@
|
||||
create
|
||||
missingok
|
||||
compress
|
||||
su radiusd radiusd
|
||||
postrotate
|
||||
/usr/bin/systemctl reload-or-try-restart radiusd
|
||||
endscript
|
||||
@ -41,6 +44,7 @@
|
||||
create
|
||||
compress
|
||||
missingok
|
||||
su radiusd radiusd
|
||||
}
|
||||
/var/log/radius/sqltrace.sql {
|
||||
monthly
|
||||
@ -48,4 +52,5 @@
|
||||
create
|
||||
compress
|
||||
missingok
|
||||
su radiusd radiusd
|
||||
}
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
Summary: High-performance and highly configurable free RADIUS server
|
||||
Name: freeradius
|
||||
Version: 3.0.19
|
||||
Release: 1%{?dist}
|
||||
Release: 2%{?dist}
|
||||
License: GPLv2+ and LGPLv2+
|
||||
URL: http://www.freeradius.org/
|
||||
|
||||
@ -22,6 +22,7 @@ Source104: freeradius-tmpfiles.conf
|
||||
|
||||
Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch
|
||||
Patch2: freeradius-Use-system-crypto-policy-by-default.patch
|
||||
Patch3: freeradius-bootstrap-create-only.patch
|
||||
|
||||
%global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}}
|
||||
|
||||
@ -128,6 +129,7 @@ BuildRequires: perl(ExtUtils::Embed)
|
||||
%description perl
|
||||
This plugin provides the Perl support for the FreeRADIUS server project.
|
||||
|
||||
%if 0%{?fedora} <= 30
|
||||
%package -n python2-freeradius
|
||||
Summary: Python support for freeradius
|
||||
Requires: %{name} = %{version}-%{release}
|
||||
@ -140,6 +142,7 @@ Obsoletes: %{name}-python < %{version}-%{release}
|
||||
|
||||
%description -n python2-freeradius
|
||||
This plugin provides the Python support for the FreeRADIUS server project.
|
||||
%endif
|
||||
|
||||
%package mysql
|
||||
Summary: MySQL support for freeradius
|
||||
@ -188,6 +191,7 @@ This plugin provides the REST support for the FreeRADIUS server project.
|
||||
# mistakenly includes the backup files, especially problematic for raddb config files.
|
||||
%patch1 -p1
|
||||
%patch2 -p1
|
||||
%patch3 -p1
|
||||
|
||||
%build
|
||||
# Force compile/link options, extra security for network facing daemon
|
||||
@ -782,6 +786,11 @@ exit 0
|
||||
%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest
|
||||
|
||||
%changelog
|
||||
* Wed May 08 2019 Alexander Scheel <ascheel@redhat.com> - 3.0.19-2
|
||||
- Updated crypto-policies patch
|
||||
- Updated /etc/raddb/certs/bootstrap to only create certificates if missing
|
||||
- Updated logrotate definitions to run as radiusd:radiusd
|
||||
|
||||
* Wed Apr 10 2019 Alexander Scheel <ascheel@redhat.com> - 3.0.19-1
|
||||
- Rebased to 3.0.19
|
||||
|
||||
|
||||
@ -6,7 +6,7 @@ After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.serv
|
||||
Type=forking
|
||||
PIDFile=/var/run/radiusd/radiusd.pid
|
||||
ExecStartPre=-/bin/chown -R radiusd.radiusd /var/run/radiusd
|
||||
ExecStartPre=/bin/sh /etc/raddb/certs/bootstrap
|
||||
ExecStartPre=/bin/sh /etc/raddb/certs/bootstrap create-only
|
||||
ExecStartPre=/bin/chgrp -R radiusd /etc/raddb/certs/
|
||||
ExecStartPre=/usr/sbin/radiusd -C
|
||||
ExecStart=/usr/sbin/radiusd -d /etc/raddb
|
||||
|
||||
Loading…
Reference in New Issue
Block a user