ldap and radius manage scripts
This commit is contained in:
parent
d597367fdb
commit
17f6c75c43
3
control
3
control
|
@ -20,6 +20,7 @@ Package: u-auth
|
|||
Architecture: all
|
||||
Depends: ${misc:Depends},
|
||||
python-uauth (= ${binary:Version}),
|
||||
gunicorn, slapd, freeradius-ldap
|
||||
gunicorn, slapd, freeradius-ldap,
|
||||
ldapvi
|
||||
Recommends: nginx, postgresql
|
||||
Description: Captive potail in the Cloud
|
||||
|
|
|
@ -0,0 +1,80 @@
|
|||
#!/bin/sh
|
||||
# initial configuration of slapd
|
||||
|
||||
set -e
|
||||
|
||||
LDIFDIR=/usr/share/u-auth
|
||||
SERVICE="/usr/sbin/service slapd"
|
||||
|
||||
echo ""
|
||||
echo " *************"
|
||||
echo " * * La configuration et toutes les données"
|
||||
echo " * ATTENTION * de l'annuaire LDAP vont être définitivement"
|
||||
echo " * * effacées. Avez-vous fait un backup ?"
|
||||
echo " *************"
|
||||
|
||||
echo ""
|
||||
echo "Confirmez la MISE A ZÉRO COMPLÈTE de l'annuaire LDAP."
|
||||
echo ""
|
||||
echo -n "Tapez oui en toutes lettres : "
|
||||
read ok
|
||||
if [ "x$ok" != "xoui" ]; then
|
||||
exit 3
|
||||
fi
|
||||
|
||||
${SERVICE} stop || true
|
||||
|
||||
|
||||
BACKUPDIR="/var/backup/reset-ldap-`date +%Y%m%dT%H:%M:%S`"
|
||||
mkdir -p "$BACKUPDIR"
|
||||
echo Old configuration saved in $BACKUPDIR
|
||||
cp -R /var/lib/ldap /etc/ldap/slapd.d/ "$BACKUPDIR"
|
||||
|
||||
echo -n "Effacement de la configuration"
|
||||
rm -rf /etc/ldap/slapd.d/*
|
||||
echo -n " et des données .."
|
||||
rm -rf /var/lib/ldap/*
|
||||
echo "ok"
|
||||
|
||||
if ! grep "^\s*profile\s\+config\s*$" /etc/ldapvi.conf > /dev/null 2>&1; then
|
||||
echo "(ajout du 'profile config' dans /etc/ldapvi.conf)"
|
||||
cat << EOLDAPVI >> /etc/ldapvi.conf
|
||||
|
||||
profile config
|
||||
host: ldapi://
|
||||
sasl-mech: EXTERNAL
|
||||
base: cn=config
|
||||
|
||||
EOLDAPVI
|
||||
fi
|
||||
|
||||
|
||||
|
||||
mkdir /var/lib/ldap/config-accesslog/
|
||||
|
||||
echo "Installation de la nouvelle configuration .. "
|
||||
slapadd -n0 -F/etc/ldap/slapd.d -l${LDIFDIR}/config.ldif
|
||||
echo "ok"
|
||||
|
||||
echo "Installation des schémas .. "
|
||||
slapadd -n0 -F/etc/ldap/slapd.d -l/etc/ldap/schema/core.ldif
|
||||
slapadd -n0 -F/etc/ldap/slapd.d -l/etc/ldap/schema/cosine.ldif
|
||||
slapadd -n0 -F/etc/ldap/slapd.d -l/etc/ldap/schema/inetorgperson.ldif
|
||||
echo "ok"
|
||||
|
||||
chown -R openldap:openldap /etc/ldap/slapd.d /var/lib/ldap
|
||||
|
||||
if [ ! -s /etc/ldap/ssl/slapd.pem -o ! -s /etc/ldap/ssl/slapd.key ]; then
|
||||
echo "Pose de certificats SSL par défaut (invalides)"
|
||||
mkdir -p /etc/ldap/ssl
|
||||
cp -v ${LDIFDIR}/ssl.pem /etc/ldap/ssl/slapd.pem
|
||||
cp -v ${LDIFDIR}/ssl.key /etc/ldap/ssl/slapd.key
|
||||
chown -R root:openldap /etc/ldap/ssl
|
||||
chmod 0755 /etc/ldap/ssl
|
||||
chmod 0644 /etc/ldap/ssl/slapd.pem
|
||||
chmod 0640 /etc/ldap/ssl/slapd.key
|
||||
echo "ok"
|
||||
fi
|
||||
|
||||
${SERVICE} start
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
mise à zéro complète
|
||||
|
||||
Attention, cela efface complétement la configuration et
|
||||
les données actuelles du serveur LDAP (slapd).
|
|
@ -0,0 +1,18 @@
|
|||
#!/bin/sh
|
||||
# Do initial configuration of freeradius
|
||||
|
||||
set -e
|
||||
|
||||
CONF_DIR = '/etc/freeradius'
|
||||
BASEDIR=`dirname $0`
|
||||
|
||||
service freeradius stop
|
||||
|
||||
cp "$CONF_DIR/sites-available/default" "$CONF_DIR/sites-available/default.backup"
|
||||
cp "$BASEDIR/radius-default.conf" "$CONF_DIR/sites-available/default"
|
||||
|
||||
service freeradius start
|
||||
|
||||
|
||||
|
||||
|
|
@ -0,0 +1 @@
|
|||
activation et parametrage du module ldap dans radius
|
|
@ -0,0 +1,309 @@
|
|||
#!/bin/sh
|
||||
# Do initial configuration of slapd
|
||||
|
||||
set -e
|
||||
|
||||
LDIFDIR=/usr/share/u-auth
|
||||
|
||||
BACKUPDIR="/var/backup/reset-ldap-`date +%Y%m%dT%H:%M:%S`"
|
||||
mkdir -p "$BACKUPDIR"
|
||||
echo Old configuration saved in $BACKUPDIR
|
||||
cp -R /var/lib/ldap /etc/ldap/slapd.d/ "$BACKUPDIR"
|
||||
rm -rf /var/lib/ldap/*
|
||||
mkdir /var/lib/ldap/config-accesslog/
|
||||
|
||||
echo Load overlay modules, configure auditlog for cn=config
|
||||
slapadd -n0 -F/etc/ldap/slapd.d -l${LDIFDIR}/radius.ldif
|
||||
|
||||
echo "Suffixe de la base à créer (exemple : dc=univ-psl,dc=fr) :"
|
||||
echo -n "-> "
|
||||
read SUFFIX
|
||||
echo
|
||||
|
||||
if [ -d "/var/lib/ldap/$SUFFIX" ]; then
|
||||
echo "ERR: le répertoire '/var/lib/ldap/$SUFFIX' existe déjà" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if ldapsearch -H ldapi:// -Y EXTERNAL -b cn=config olcSuffix=$SUFFIX 2>/dev/null | grep -q '^result: [1-9]'; then
|
||||
echo "ERR: le suffixe $SUFFIX existe déjà" >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
echo "Choisir un mot de passe administrateur (uid=admin,ou=people,$SUFFIX) :"
|
||||
echo -n "-> "
|
||||
stty -echo
|
||||
read PASSWORD
|
||||
stty echo
|
||||
echo
|
||||
echo "Une nouvelle fois :"
|
||||
echo -n "-> "
|
||||
stty -echo
|
||||
read PASSWORD2
|
||||
stty echo
|
||||
echo
|
||||
if [ x"$PASSWORD" != x"$PASSWORD2" ]; then
|
||||
echo "ERR: mots de passe différents" >&2
|
||||
exit 3
|
||||
fi
|
||||
echo
|
||||
|
||||
echo "Nom de l'organisation (ou=...) :"
|
||||
echo "uniquement des majuscules, sans accent"
|
||||
echo "Exemple: ENS"
|
||||
echo -n "-> "
|
||||
read ORGANIZATION
|
||||
echo
|
||||
|
||||
|
||||
echo "Récapitulatif :"
|
||||
echo " Suffixe : $SUFFIX"
|
||||
echo " Nom : $ORGANIZATION"
|
||||
echo "DN établissement : ou=$ORGANIZATION,$SUFFIX"
|
||||
echo
|
||||
echo "Créer cette base ? (taper oui)"
|
||||
echo -n "-> "
|
||||
read OK
|
||||
echo
|
||||
|
||||
if [ "x$OK" != "xoui" ]; then
|
||||
exit 4
|
||||
fi
|
||||
|
||||
DC=`echo $SUFFIX | sed 's/dc=\([^,]*\).*/\1/'`
|
||||
|
||||
DBDIR=/var/lib/ldap/$SUFFIX
|
||||
DBACCESSLOGDIR=/var/lib/ldap/$SUFFIX/accesslog/
|
||||
|
||||
mkdir -p "$DBDIR" "$DBACCESSLOGDIR"
|
||||
|
||||
chown -R openldap:openldap /etc/ldap/slapd.d /var/lib/ldap
|
||||
|
||||
LDIF=`tempfile --prefix=newdb --suffix=.ldif`
|
||||
cat << EOF > $LDIF
|
||||
# LDAPVI syntax
|
||||
add olcDatabase={1}mdb,cn=config
|
||||
objectClass: olcDatabaseConfig
|
||||
objectClass: olcMdbConfig
|
||||
olcDatabase: {1}mdb
|
||||
olcSuffix: $SUFFIX
|
||||
olcDbDirectory: /var/lib/ldap/$SUFFIX/
|
||||
olcRootDN: uid=admin,ou=people,$SUFFIX
|
||||
olcRootPW: $PASSWORD
|
||||
olcLastMod: TRUE
|
||||
olcAddContentACL: FALSE
|
||||
olcMonitoring: TRUE
|
||||
olcSyncUseSubentry: FALSE
|
||||
olcMaxDerefDepth: 0
|
||||
olcLimits: {0}dn.exact="uid=admin,ou=people,$SUFFIX" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited
|
||||
olcLimits: {1}dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited
|
||||
olcReadOnly: FALSE
|
||||
# Index
|
||||
olcDbIndex: objectClass,member,owner eq
|
||||
olcDbIndex: mail,givenName,uid,cn,sn,displayName pres,eq,approx,sub
|
||||
# Accès super-utilisateur
|
||||
olcAccess: {0}to *
|
||||
by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
|
||||
by group.exact="cn=admin,ou=groups,$SUFFIX" manage
|
||||
by * break
|
||||
# Branche people
|
||||
olcAccess: {1}to dn.regex="uid=[^,]+,ou=people,$SUFFIX" attrs=userPassword,labeledURI
|
||||
by self write
|
||||
by * break
|
||||
# Les accès aux autres attributs utilisateurs
|
||||
olcAccess: {2}to dn.one="ou=people,$SUFFIX"
|
||||
by users read
|
||||
by anonymous auth
|
||||
by * none
|
||||
# Branche groups
|
||||
# Le propriétaire du groupe
|
||||
olcAccess: {3}to dn.one="ou=groups,$SUFFIX"
|
||||
by set="this/owner & user" manage
|
||||
by * break
|
||||
# Les utilisateurs en général sur les attributs descriptifs
|
||||
olcAccess: {4}to dn.one="ou=groups,$SUFFIX" attrs=cn,description,owner
|
||||
by users read
|
||||
by * break
|
||||
|
||||
# Create accesslog DIT
|
||||
add olcDatabase={1}mdb,cn=config
|
||||
objectClass: olcDatabaseConfig
|
||||
objectClass: olcMdbConfig
|
||||
olcSuffix: cn=accesslog,$SUFFIX
|
||||
olcDbDirectory: /var/lib/ldap/$SUFFIX/accesslog/
|
||||
olcAccess: {0}to *
|
||||
by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage
|
||||
by group=cn=admin,ou=groupes,$SUFFIX manage
|
||||
by * break
|
||||
|
||||
add olcOverlay={0}syncprov,olcDatabase={1}mdb,cn=config
|
||||
objectClass: olcOverlayConfig
|
||||
objectClass: olcSyncProvConfig
|
||||
olcOverlay: {0}syncprov
|
||||
olcSpCheckpoint: 100 10
|
||||
olcSpSessionlog: 100
|
||||
|
||||
# Log all writes to the db
|
||||
add olcOverlay={1}accesslog,olcDatabase={2}mdb,cn=config
|
||||
objectClass: olcAccesslogConfig
|
||||
objectClass: olcOverlayConfig
|
||||
objectClass: olcConfig
|
||||
objectClass: top
|
||||
olcOverlay: {1}accesslog
|
||||
olcAccessLogDB: cn=accesslog,$SUFFIX
|
||||
olcAccessLogOps: writes
|
||||
# log are conserved one year and purged every day
|
||||
olcAccessLogPurge: 365+00:00 1+00:00
|
||||
# Keep a copy of everything
|
||||
olcAccessLogOld: objectClass=*
|
||||
|
||||
add olcOverlay={2}refint,olcDatabase={2}mdb,cn=config
|
||||
objectClass: olcOverlayConfig
|
||||
objectClass: olcRefintConfig
|
||||
olcOverlay: {2}refint
|
||||
olcRefintAttribute: member
|
||||
olcRefintNothing: $SUFFIX
|
||||
|
||||
add olcOverlay={3}constraint,olcDatabase={2}mdb,cn=config
|
||||
objectClass: olcOverlayConfig
|
||||
objectClass: olcConstraintConfig
|
||||
olcOverlay: {3}constraint
|
||||
# un seul cn pour les utilisateurs
|
||||
olcConstraintAttribute: cn count 1 restrict="ldap:///ou=people,$SUFFIX??sub?(objectClass=*)"
|
||||
#olcConstraintAttribute: cn regex "^[-A-Z' ]*$" restrict="ldap:///ou=people,$SUFFIX??sub?(objectClass=*)"
|
||||
olcConstraintAttribute: cn regex "^[-A-Za-z0-9 ]*$" restrict="ldap:///ou=groups,$SUFFIX??sub?(objectClass=*)"
|
||||
olcConstraintAttribute: cn regex "^[-A-Za-z0-9 ]*$" restrict="ldap:///$SUFFIX??base?(objectClass=*)"
|
||||
olcConstraintAttribute: dc regex "^[a-z0-9-]*$"
|
||||
olcConstraintAttribute: mail count 1
|
||||
olcConstraintAttribute: mail
|
||||
regex "^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,4}$"
|
||||
# olcConstraintAttribute: mailForwardingAddress
|
||||
regex "^([a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,4}|[a-zA-Z0-9]+)$" # mail ou uid
|
||||
|
||||
add $SUFFIX
|
||||
objectClass: organization
|
||||
objectClass: dcObject
|
||||
dc: $DC
|
||||
o: $ORGANIZATION
|
||||
|
||||
add ou=people,$SUFFIX
|
||||
objectClass: organizationalUnit
|
||||
ou: people
|
||||
|
||||
add uid=admin,ou=people,$SUFFIX
|
||||
objectClass: inetOrgPerson
|
||||
uid: admin
|
||||
cn: Administrateur annuaire
|
||||
displayName: Administrateur annuaire
|
||||
givenName: Administrateur
|
||||
sn: annuaire
|
||||
userPassword: $PASSWORD
|
||||
|
||||
add ou=$ORGANIZATION,$SUFFIX
|
||||
objectClass: organizationalUnit
|
||||
ou: $ORGANIZATION
|
||||
|
||||
EOF
|
||||
|
||||
|
||||
echo "Chargement de la définition de la nouvelle base annuaire ($LDIF) :"
|
||||
ldapvi --verbose --profile config --ldapmodify --ldapvi --add $LDIF
|
||||
# slapadd -n0 -F/etc/ldap/slapd.d -l${LDIF}
|
||||
echo "OK"
|
||||
|
||||
chown -R openldap.openldap /etc/ldap/slapd.d /var/lib/ldap
|
||||
|
||||
LDAP_SETUP=`tempfile --prefix=ldap --suffix=.conf`
|
||||
cat << EOF > $LDAP_SETUP
|
||||
ldap {
|
||||
#
|
||||
# Note that this needs to match the name in the LDAP
|
||||
# server certificate, if you're using ldaps.
|
||||
server = "localhost"
|
||||
identity = "uid=admin,ou=people,$SUFFIX"
|
||||
password = "$PASSWORD"
|
||||
basedn = "$ORGANIZATION,$SUFFIX"
|
||||
filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
|
||||
#base_filter = "(objectclass=radiusprofile)"
|
||||
|
||||
ldap_connections_number = 5
|
||||
|
||||
# How many times the connection can be used before
|
||||
# being re-established. This is useful for things
|
||||
# like load balancers, which may exhibit sticky
|
||||
# behaviour without it. (0) is unlimited.
|
||||
max_uses = 0
|
||||
|
||||
# Port to connect on, defaults to 389. Setting this to
|
||||
# 636 will enable LDAPS if start_tls (see below) is not
|
||||
# able to be used.
|
||||
#port = 389
|
||||
|
||||
# seconds to wait for LDAP query to finish. default: 20
|
||||
timeout = 4
|
||||
|
||||
# seconds LDAP server has to process the query (server-side
|
||||
# time limit). default: 20
|
||||
#
|
||||
# LDAP_OPT_TIMELIMIT is set to this value.
|
||||
timelimit = 3
|
||||
|
||||
#
|
||||
# seconds to wait for response of the server. (network
|
||||
# failures) default: 10
|
||||
#
|
||||
# LDAP_OPT_NETWORK_TIMEOUT is set to this value.
|
||||
net_timeout = 1
|
||||
|
||||
# Mapping of RADIUS dictionary attributes to LDAP
|
||||
# directory attributes.
|
||||
dictionary_mapping = ${confdir}/ldap.attrmap
|
||||
|
||||
# Un-comment the following to disable Novell
|
||||
# eDirectory account policy check and intruder
|
||||
# detection. This will work *only if* FreeRADIUS is
|
||||
# configured to build with --with-edir option.
|
||||
#
|
||||
edir_account_policy_check = no
|
||||
|
||||
# By default, if the packet contains a User-Password,
|
||||
# and no other module is configured to handle the
|
||||
# authentication, the LDAP module sets itself to do
|
||||
# LDAP bind for authentication.
|
||||
#
|
||||
# THIS WILL ONLY WORK FOR PAP AUTHENTICATION.
|
||||
#
|
||||
# THIS WILL NOT WORK FOR CHAP, MS-CHAP, or 802.1x (EAP).
|
||||
#
|
||||
# You can disable this behavior by setting the following
|
||||
# configuration entry to "no".
|
||||
#
|
||||
# allowed values: {no, yes}
|
||||
# set_auth_type = yes
|
||||
|
||||
|
||||
# Keepalive configuration. This MAY NOT be supported by your
|
||||
# LDAP library. If these configuration entries appear in the
|
||||
# output of "radiusd -X", then they are supported. Otherwise,
|
||||
# they are unsupported, and changing them will do nothing.
|
||||
#
|
||||
keepalive {
|
||||
# LDAP_OPT_X_KEEPALIVE_IDLE
|
||||
idle = 60
|
||||
|
||||
# LDAP_OPT_X_KEEPALIVE_PROBES
|
||||
probes = 3
|
||||
|
||||
# LDAP_OPT_X_KEEPALIVE_INTERVAL
|
||||
interval = 3
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
|
||||
service freeradius stop
|
||||
|
||||
cp /etc/freeradius/modules/ldap /etc/freeradius/modules/ldap.backup
|
||||
mv $LDAP_SETUP /etc/freeradius/modules/ldap
|
||||
|
||||
service freeradius start
|
|
@ -0,0 +1,3 @@
|
|||
création d'une nouvelle base, avec un nouveau suffixe
|
||||
|
||||
Paramètrage de freeradius pour la connexion à cette base
|
|
@ -0,0 +1,46 @@
|
|||
#!/bin/sh
|
||||
|
||||
ME=`basename $0`
|
||||
COMMANDDIR=`dirname $0`/lib
|
||||
test -d ${COMMANDDIR} || COMMANDDIR=/usr/lib/`basename $0`
|
||||
|
||||
help() {
|
||||
msg="$1"
|
||||
test -n "$msg" && echo $msg
|
||||
echo "syntaxe: $ME commande ..."
|
||||
echo ""
|
||||
echo "commandes disponibles:"
|
||||
echo " help cette aide"
|
||||
for fcom in $COMMANDDIR/*.help
|
||||
do
|
||||
com=`basename $fcom .help`
|
||||
descr=`head -1 $fcom`
|
||||
echo " "$com" "$descr
|
||||
done
|
||||
test -n "$msg" && exit 1
|
||||
exit 0
|
||||
}
|
||||
|
||||
helpcmd() {
|
||||
command=$1
|
||||
xcommand=$COMMANDDIR/$command
|
||||
test -x $xcommand || help "ERR: commande inconnue ($command)"
|
||||
echo "$ME $command"
|
||||
cat $xcommand.help
|
||||
}
|
||||
|
||||
command=$1
|
||||
test -z $command && help "ERR: commande manquante"
|
||||
shift
|
||||
|
||||
case $command in
|
||||
help)
|
||||
test -z "$1" && help
|
||||
helpcmd $1
|
||||
;;
|
||||
*)
|
||||
xcommand=$COMMANDDIR/$command
|
||||
test -x $xcommand || help "ERR: commande inconnue ($command)"
|
||||
$xcommand "$@"
|
||||
;;
|
||||
esac
|
|
@ -0,0 +1,76 @@
|
|||
dn: cn=config
|
||||
objectClass: olcGlobal
|
||||
cn: config
|
||||
olcArgsFile: /var/run/slapd/slapd.args
|
||||
olcPidFile: /var/run/slapd/slapd.pid
|
||||
olcToolThreads: 1
|
||||
olcLogLevel: none
|
||||
olcServerId: 1
|
||||
|
||||
dn: cn=module{0},cn=config
|
||||
objectClass: olcModuleList
|
||||
cn: module{0}
|
||||
olcModulePath: /usr/lib/ldap
|
||||
olcModuleLoad: {0}back_hdb
|
||||
olcModuleLoad: {1}back_monitor
|
||||
olcModuleLoad: {2}back_mdb
|
||||
olcModuleLoad: {3}accesslog
|
||||
olcModuleLoad: {4}unique
|
||||
olcModuleLoad: {5}refint
|
||||
olcModuleLoad: {6}constraint
|
||||
olcModuleLoad: {7}syncprov
|
||||
|
||||
dn: cn=schema,cn=config
|
||||
objectClass: olcSchemaConfig
|
||||
cn: schema
|
||||
|
||||
dn: olcDatabase={-1}frontend,cn=config
|
||||
objectClass: olcDatabaseConfig
|
||||
objectClass: olcFrontendConfig
|
||||
olcDatabase: {-1}frontend
|
||||
olcAccess: {0}to *
|
||||
by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage
|
||||
by * break
|
||||
olcAccess: {1}to dn.exact="" by * read
|
||||
olcAccess: {2}to dn.base="cn=Subschema" by * read
|
||||
olcSizeLimit: 500
|
||||
|
||||
dn: olcDatabase={0}config,cn=config
|
||||
objectClass: olcDatabaseConfig
|
||||
olcDatabase: {0}config
|
||||
olcAccess: {0}to *
|
||||
by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage
|
||||
by * break
|
||||
olcRootDN: cn=admin,cn=config
|
||||
|
||||
dn: olcDatabase={1}mdb,cn=config
|
||||
objectClass: olcDatabaseConfig
|
||||
objectClass: olcMdbConfig
|
||||
olcSuffix: cn=config-accesslog
|
||||
olcDbDirectory: /var/lib/ldap/config-accesslog/
|
||||
# Allow reading accesslog only by root
|
||||
olcAccess: {0}to *
|
||||
by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
|
||||
by * break
|
||||
|
||||
dn: olcDatabase={1}monitor,cn=config
|
||||
objectClass: olcDatabaseConfig
|
||||
objectClass: olcMonitorConfig
|
||||
olcDatabase: {1}monitor
|
||||
# Allow reading monitoring only by root
|
||||
olcAccess: {0}to *
|
||||
by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
|
||||
by * break
|
||||
|
||||
# Log all writes to the configuration
|
||||
dn: olcOverlay={0}accesslog,olcDatabase={0}config,cn=config
|
||||
objectClass: olcAccesslogConfig
|
||||
objectClass: olcOverlayConfig
|
||||
objectClass: olcConfig
|
||||
objectClass: top
|
||||
olcOverlay: {0}accesslog
|
||||
olcAccessLogDB: cn=config-accesslog
|
||||
olcAccessLogOps: writes
|
||||
# log are conserved one year and purged every day
|
||||
olcAccessLogPurge: 365+00:00 1+00:00
|
||||
olcAccessLogOld: objectClass=olcConfig
|
|
@ -0,0 +1,605 @@
|
|||
# Authorization. First preprocess (hints and huntgroups files),
|
||||
# then realms, and finally look in the "users" file.
|
||||
#
|
||||
# Any changes made here should also be made to the "inner-tunnel"
|
||||
# virtual server.
|
||||
#
|
||||
# The order of the realm modules will determine the order that
|
||||
# we try to find a matching realm.
|
||||
#
|
||||
# Make *sure* that 'preprocess' comes before any realm if you
|
||||
# need to setup hints for the remote radius server
|
||||
authorize {
|
||||
|
||||
#
|
||||
# Security settings. Take a User-Name, and do some simple
|
||||
# checks on it, for spaces and other invalid characters. If
|
||||
# it looks like the user is trying to play games, reject it.
|
||||
#
|
||||
# This should probably be enabled by default.
|
||||
#
|
||||
# See policy.conf for the definition of the filter_username policy.
|
||||
#
|
||||
# filter_username
|
||||
|
||||
#
|
||||
# The preprocess module takes care of sanitizing some bizarre
|
||||
# attributes in the request, and turning them into attributes
|
||||
# which are more standard.
|
||||
#
|
||||
# It takes care of processing the 'raddb/hints' and the
|
||||
# 'raddb/huntgroups' files.
|
||||
preprocess
|
||||
|
||||
#
|
||||
# If you want to have a log of authentication requests,
|
||||
# un-comment the following line, and the 'detail auth_log'
|
||||
# section, above.
|
||||
auth_log
|
||||
|
||||
ldap
|
||||
|
||||
#
|
||||
# The chap module will set 'Auth-Type := CHAP' if we are
|
||||
# handling a CHAP request and Auth-Type has not already been set
|
||||
chap
|
||||
|
||||
#
|
||||
# If the users are logging in with an MS-CHAP-Challenge
|
||||
# attribute for authentication, the mschap module will find
|
||||
# the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP'
|
||||
# to the request, which will cause the server to then use
|
||||
# the mschap module for authentication.
|
||||
mschap
|
||||
|
||||
#
|
||||
# If you have a Cisco SIP server authenticating against
|
||||
# FreeRADIUS, uncomment the following line, and the 'digest'
|
||||
# line in the 'authenticate' section.
|
||||
digest
|
||||
|
||||
#
|
||||
# The WiMAX specification says that the Calling-Station-Id
|
||||
# is 6 octets of the MAC. This definition conflicts with
|
||||
# RFC 3580, and all common RADIUS practices. Un-commenting
|
||||
# the "wimax" module here means that it will fix the
|
||||
# Calling-Station-Id attribute to the normal format as
|
||||
# specified in RFC 3580 Section 3.21
|
||||
# wimax
|
||||
|
||||
#
|
||||
# Look for IPASS style 'realm/', and if not found, look for
|
||||
# '@realm', and decide whether or not to proxy, based on
|
||||
# that.
|
||||
# IPASS
|
||||
|
||||
#
|
||||
# If you are using multiple kinds of realms, you probably
|
||||
# want to set "ignore_null = yes" for all of them.
|
||||
# Otherwise, when the first style of realm doesn't match,
|
||||
# the other styles won't be checked.
|
||||
#
|
||||
suffix
|
||||
# ntdomain
|
||||
|
||||
#
|
||||
# This module takes care of EAP-MD5, EAP-TLS, and EAP-LEAP
|
||||
# authentication.
|
||||
#
|
||||
# It also sets the EAP-Type attribute in the request
|
||||
# attribute list to the EAP type from the packet.
|
||||
#
|
||||
# As of 2.0, the EAP module returns "ok" in the authorize stage
|
||||
# for TTLS and PEAP. In 1.x, it never returned "ok" here, so
|
||||
# this change is compatible with older configurations.
|
||||
#
|
||||
# The example below uses module failover to avoid querying all
|
||||
# of the following modules if the EAP module returns "ok".
|
||||
# Therefore, your LDAP and/or SQL servers will not be queried
|
||||
# for the many packets that go back and forth to set up TTLS
|
||||
# or PEAP. The load on those servers will therefore be reduced.
|
||||
#
|
||||
eap {
|
||||
ok = return
|
||||
}
|
||||
|
||||
#
|
||||
# Pull crypt'd passwords from /etc/passwd or /etc/shadow,
|
||||
# using the system API's to get the password. If you want
|
||||
# to read /etc/passwd or /etc/shadow directly, see the
|
||||
# passwd module in radiusd.conf.
|
||||
#
|
||||
# unix
|
||||
|
||||
#
|
||||
# Read the 'users' file
|
||||
# files
|
||||
|
||||
#
|
||||
# Look in an SQL database. The schema of the database
|
||||
# is meant to mirror the "users" file.
|
||||
#
|
||||
# See "Authorization Queries" in sql.conf
|
||||
# sql
|
||||
|
||||
#
|
||||
# If you are using /etc/smbpasswd, and are also doing
|
||||
# mschap authentication, the un-comment this line, and
|
||||
# configure the 'smbpasswd' module.
|
||||
# smbpasswd
|
||||
|
||||
exec
|
||||
#
|
||||
# The ldap module will set Auth-Type to LDAP if it has not
|
||||
# already been set
|
||||
|
||||
#
|
||||
# Enforce daily limits on time spent logged in.
|
||||
# daily
|
||||
|
||||
#
|
||||
# Use the checkval module
|
||||
# checkval
|
||||
|
||||
expiration
|
||||
logintime
|
||||
|
||||
#
|
||||
# If no other module has claimed responsibility for
|
||||
# authentication, then try to use PAP. This allows the
|
||||
# other modules listed above to add a "known good" password
|
||||
# to the request, and to do nothing else. The PAP module
|
||||
# will then see that password, and use it to do PAP
|
||||
# authentication.
|
||||
#
|
||||
# This module should be listed last, so that the other modules
|
||||
# get a chance to set Auth-Type for themselves.
|
||||
#
|
||||
pap
|
||||
|
||||
#
|
||||
# If "status_server = yes", then Status-Server messages are passed
|
||||
# through the following section, and ONLY the following section.
|
||||
# This permits you to do DB queries, for example. If the modules
|
||||
# listed here return "fail", then NO response is sent.
|
||||
#
|
||||
# Autz-Type Status-Server {
|
||||
#
|
||||
# }
|
||||
}
|
||||
|
||||
|
||||
# Authentication.
|
||||
#
|
||||
#
|
||||
# This section lists which modules are available for authentication.
|
||||
# Note that it does NOT mean 'try each module in order'. It means
|
||||
# that a module from the 'authorize' section adds a configuration
|
||||
# attribute 'Auth-Type := FOO'. That authentication type is then
|
||||
# used to pick the apropriate module from the list below.
|
||||
#
|
||||
|
||||
# In general, you SHOULD NOT set the Auth-Type attribute. The server
|
||||
# will figure it out on its own, and will do the right thing. The
|
||||
# most common side effect of erroneously setting the Auth-Type
|
||||
# attribute is that one authentication method will work, but the
|
||||
# others will not.
|
||||
#
|
||||
# The common reasons to set the Auth-Type attribute by hand
|
||||
# is to either forcibly reject the user (Auth-Type := Reject),
|
||||
# or to or forcibly accept the user (Auth-Type := Accept).
|
||||
#
|
||||
# Note that Auth-Type := Accept will NOT work with EAP.
|
||||
#
|
||||
# Please do not put "unlang" configurations into the "authenticate"
|
||||
# section. Put them in the "post-auth" section instead. That's what
|
||||
# the post-auth section is for.
|
||||
#
|
||||
authenticate {
|
||||
#
|
||||
# PAP authentication, when a back-end database listed
|
||||
# in the 'authorize' section supplies a password. The
|
||||
# password can be clear-text, or encrypted.
|
||||
Auth-Type PAP {
|
||||
pap
|
||||
}
|
||||
|
||||
#
|
||||
# Most people want CHAP authentication
|
||||
# A back-end database listed in the 'authorize' section
|
||||
# MUST supply a CLEAR TEXT password. Encrypted passwords
|
||||
# won't work.
|
||||
Auth-Type CHAP {
|
||||
chap
|
||||
}
|
||||
|
||||
#
|
||||
# MSCHAP authentication.
|
||||
Auth-Type MS-CHAP {
|
||||
mschap
|
||||
}
|
||||
|
||||
#
|
||||
# If you have a Cisco SIP server authenticating against
|
||||
# FreeRADIUS, uncomment the following line, and the 'digest'
|
||||
# line in the 'authorize' section.
|
||||
digest
|
||||
|
||||
#
|
||||
# Pluggable Authentication Modules.
|
||||
# pam
|
||||
|
||||
#
|
||||
# See 'man getpwent' for information on how the 'unix'
|
||||
# module checks the users password. Note that packets
|
||||
# containing CHAP-Password attributes CANNOT be authenticated
|
||||
# against /etc/passwd! See the FAQ for details.
|
||||
#
|
||||
# For normal "crypt" authentication, the "pap" module should
|
||||
# be used instead of the "unix" module. The "unix" module should
|
||||
# be used for authentication ONLY for compatibility with legacy
|
||||
# FreeRADIUS configurations.
|
||||
#
|
||||
unix
|
||||
|
||||
# Uncomment it if you want to use ldap for authentication
|
||||
#
|
||||
# Note that this means "check plain-text password against
|
||||
# the ldap database", which means that EAP won't work,
|
||||
# as it does not supply a plain-text password.
|
||||
Auth-Type LDAP {
|
||||
ldap
|
||||
}
|
||||
|
||||
#
|
||||
# Allow EAP authentication.
|
||||
eap
|
||||
|
||||
#
|
||||
# The older configurations sent a number of attributes in
|
||||
# Access-Challenge packets, which wasn't strictly correct.
|
||||
# If you want to filter out these attributes, uncomment
|
||||
# the following lines.
|
||||
#
|
||||
# Auth-Type eap {
|
||||
# eap {
|
||||
# handled = 1
|
||||
# }
|
||||
# if (handled && (Response-Packet-Type == Access-Challenge)) {
|
||||
# attr_filter.access_challenge.post-auth
|
||||
# handled # override the "updated" code from attr_filter
|
||||
# }
|
||||
# }
|
||||
}
|
||||
|
||||
|
||||
#
|
||||
# Pre-accounting. Decide which accounting type to use.
|
||||
#
|
||||
preacct {
|
||||
preprocess
|
||||
|
||||
#
|
||||
# Session start times are *implied* in RADIUS.
|
||||
# The NAS never sends a "start time". Instead, it sends
|
||||
# a start packet, *possibly* with an Acct-Delay-Time.
|
||||
# The server is supposed to conclude that the start time
|
||||
# was "Acct-Delay-Time" seconds in the past.
|
||||
#
|
||||
# The code below creates an explicit start time, which can
|
||||
# then be used in other modules.
|
||||
#
|
||||
# The start time is: NOW - delay - session_length
|
||||
#
|
||||
|
||||
# update request {
|
||||
# FreeRADIUS-Acct-Session-Start-Time = "%{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}}"
|
||||
# }
|
||||
|
||||
|
||||
#
|
||||
# Ensure that we have a semi-unique identifier for every
|
||||
# request, and many NAS boxes are broken.
|
||||
acct_unique
|
||||
|
||||
#
|
||||
# Look for IPASS-style 'realm/', and if not found, look for
|
||||
# '@realm', and decide whether or not to proxy, based on
|
||||
# that.
|
||||
#
|
||||
# Accounting requests are generally proxied to the same
|
||||
# home server as authentication requests.
|
||||
# IPASS
|
||||
suffix
|
||||
# ntdomain
|
||||
|
||||
#
|
||||
# Read the 'acct_users' file
|
||||
files
|
||||
}
|
||||
|
||||
#
|
||||
# Accounting. Log the accounting data.
|
||||
#
|
||||
accounting {
|
||||
#
|
||||
# Create a 'detail'ed log of the packets.
|
||||
# Note that accounting requests which are proxied
|
||||
# are also logged in the detail file.
|
||||
detail
|
||||
# daily
|
||||
|
||||
# Update the wtmp file
|
||||
#
|
||||
# If you don't use "radlast", you can delete this line.
|
||||
# unix
|
||||
|
||||
#
|
||||
# For Simultaneous-Use tracking.
|
||||
#
|
||||
# Due to packet losses in the network, the data here
|
||||
# may be incorrect. There is little we can do about it.
|
||||
# radutmp
|
||||
# sradutmp
|
||||
|
||||
# Return an address to the IP Pool when we see a stop record.
|
||||
# main_pool
|
||||
|
||||
#
|
||||
# Log traffic to an SQL database.
|
||||
#
|
||||
# See "Accounting queries" in sql.conf
|
||||
# sql
|
||||
|
||||
#
|
||||
# If you receive stop packets with zero session length,
|
||||
# they will NOT be logged in the database. The SQL module
|
||||
# will print a message (only in debugging mode), and will
|
||||
# return "noop".
|
||||
#
|
||||
# You can ignore these packets by uncommenting the following
|
||||
# three lines. Otherwise, the server will not respond to the
|
||||
# accounting request, and the NAS will retransmit.
|
||||
#
|
||||
# if (noop) {
|
||||
# ok
|
||||
# }
|
||||
|
||||
#
|
||||
# Instead of sending the query to the SQL server,
|
||||
# write it into a log file.
|
||||
#
|
||||
# sql_log
|
||||
|
||||
# Cisco VoIP specific bulk accounting
|
||||
# pgsql-voip
|
||||
|
||||
# For Exec-Program and Exec-Program-Wait
|
||||
exec
|
||||
|
||||
# Filter attributes from the accounting response.
|
||||
attr_filter.accounting_response
|
||||
|
||||
#
|
||||
# See "Autz-Type Status-Server" for how this works.
|
||||
#
|
||||
# Acct-Type Status-Server {
|
||||
#
|
||||
# }
|
||||
}
|
||||
|
||||
|
||||
# Session database, used for checking Simultaneous-Use. Either the radutmp
|
||||
# or rlm_sql module can handle this.
|
||||
# The rlm_sql module is *much* faster
|
||||
session {
|
||||
radutmp
|
||||
|
||||
#
|
||||
# See "Simultaneous Use Checking Queries" in sql.conf
|
||||
# sql
|
||||
}
|
||||
|
||||
|
||||
# Post-Authentication
|
||||
# Once we KNOW that the user has been authenticated, there are
|
||||
# additional steps we can take.
|
||||
post-auth {
|
||||
# Get an address from the IP Pool.
|
||||
# main_pool
|
||||
|
||||
#
|
||||
# If you want to have a log of authentication replies,
|
||||
# un-comment the following line, and the 'detail reply_log'
|
||||
# section, above.
|
||||
# reply_log
|
||||
|
||||
#
|
||||
# After authenticating the user, do another SQL query.
|
||||
#
|
||||
# See "Authentication Logging Queries" in sql.conf
|
||||
# sql
|
||||
|
||||
#
|
||||
# Instead of sending the query to the SQL server,
|
||||
# write it into a log file.
|
||||
#
|
||||
# sql_log
|
||||
|
||||
#
|
||||
# Un-comment the following if you have set
|
||||
# 'edir_account_policy_check = yes' in the ldap module sub-section of
|
||||
# the 'modules' section.
|
||||
#
|
||||
# ldap
|
||||
|
||||
# For Exec-Program and Exec-Program-Wait
|
||||
exec
|
||||
|
||||
#
|
||||
# Calculate the various WiMAX keys. In order for this to work,
|
||||
# you will need to define the WiMAX NAI, usually via
|
||||
#
|
||||
# update request {
|
||||
# WiMAX-MN-NAI = "%{User-Name}"
|
||||
# }
|
||||
#
|
||||
# If you want various keys to be calculated, you will need to
|
||||
# update the reply with "template" values. The module will see
|
||||
# this, and replace the template values with the correct ones
|
||||
# taken from the cryptographic calculations. e.g.
|
||||
#
|
||||
# update reply {
|
||||
# WiMAX-FA-RK-Key = 0x00
|
||||
# WiMAX-MSK = "%{EAP-MSK}"
|
||||
# }
|
||||
#
|
||||
# You may want to delete the MS-MPPE-*-Keys from the reply,
|
||||
# as some WiMAX clients behave badly when those attributes
|
||||
# are included. See "raddb/modules/wimax", configuration
|
||||
# entry "delete_mppe_keys" for more information.
|
||||
#
|
||||
# wimax
|
||||
|
||||
# If there is a client certificate (EAP-TLS, sometimes PEAP
|
||||
# and TTLS), then some attributes are filled out after the
|
||||
# certificate verification has been performed. These fields
|
||||
# MAY be available during the authentication, or they may be
|
||||
# available only in the "post-auth" section.
|
||||
#
|
||||
# The first set of attributes contains information about the
|
||||
# issuing certificate which is being used. The second
|
||||
# contains information about the client certificate (if
|
||||
# available).
|
||||
#
|
||||
# update reply {
|
||||
# Reply-Message += "%{TLS-Cert-Serial}"
|
||||
# Reply-Message += "%{TLS-Cert-Expiration}"
|
||||
# Reply-Message += "%{TLS-Cert-Subject}"
|
||||
# Reply-Message += "%{TLS-Cert-Issuer}"
|
||||
# Reply-Message += "%{TLS-Cert-Common-Name}"
|
||||
# Reply-Message += "%{TLS-Cert-Subject-Alt-Name-Email}"
|
||||
#
|
||||
# Reply-Message += "%{TLS-Client-Cert-Serial}"
|
||||
# Reply-Message += "%{TLS-Client-Cert-Expiration}"
|
||||
# Reply-Message += "%{TLS-Client-Cert-Subject}"
|
||||
# Reply-Message += "%{TLS-Client-Cert-Issuer}"
|
||||
# Reply-Message += "%{TLS-Client-Cert-Common-Name}"
|
||||
# Reply-Message += "%{TLS-Client-Cert-Subject-Alt-Name-Email}"
|
||||
# }
|
||||
|
||||
# MacSEC requires the use of EAP-Key-Name. However, we don't
|
||||
# want to send it for all EAP sessions. Therefore, the EAP
|
||||
# modules put required data into the EAP-Session-Id attribute.
|
||||
# This attribute is never put into a request or reply packet.
|
||||
#
|
||||
# Uncomment the next few lines to copy the required data into
|
||||
# the EAP-Key-Name attribute
|
||||
# if (reply:EAP-Session-Id) {
|
||||
# update reply {
|
||||
# EAP-Key-Name := "%{reply:EAP-Session-Id}"
|
||||
# }
|
||||
# }
|
||||
|
||||
# If the WiMAX module did it's work, you may want to do more
|
||||
# things here, like delete the MS-MPPE-*-Key attributes.
|
||||
#
|
||||
# if (updated) {
|
||||
# update reply {
|
||||
# MS-MPPE-Recv-Key !* 0x00
|
||||
# MS-MPPE-Send-Key !* 0x00
|
||||
# }
|
||||
# }
|
||||
|
||||
#
|
||||
# Access-Reject packets are sent through the REJECT sub-section of the
|
||||
# post-auth section.
|
||||
#
|
||||
# Add the ldap module name (or instance) if you have set
|
||||
# 'edir_account_policy_check = yes' in the ldap module configuration
|
||||
#
|
||||
Post-Auth-Type REJECT {
|
||||
# log failed authentications in SQL, too.
|
||||
# sql
|
||||
attr_filter.access_reject
|
||||
}
|
||||
}
|
||||
|
||||
#
|
||||
# When the server decides to proxy a request to a home server,
|
||||
# the proxied request is first passed through the pre-proxy
|
||||
# stage. This stage can re-write the request, or decide to
|
||||
# cancel the proxy.
|
||||
#
|
||||
# Only a few modules currently have this method.
|
||||
#
|
||||
pre-proxy {
|
||||
# attr_rewrite
|
||||
|
||||
# Uncomment the following line if you want to change attributes
|
||||
# as defined in the preproxy_users file.
|
||||
# files
|
||||
|
||||
# Uncomment the following line if you want to filter requests
|
||||
# sent to remote servers based on the rules defined in the
|
||||
# 'attrs.pre-proxy' file.
|
||||
# attr_filter.pre-proxy
|
||||
|
||||
# If you want to have a log of packets proxied to a home
|
||||
# server, un-comment the following line, and the
|
||||
# 'detail pre_proxy_log' section, above.
|
||||
# pre_proxy_log
|
||||
}
|
||||
|
||||
#
|
||||
# When the server receives a reply to a request it proxied
|
||||
# to a home server, the request may be massaged here, in the
|
||||
# post-proxy stage.
|
||||
#
|
||||
post-proxy {
|
||||
|
||||
# If you want to have a log of replies from a home server,
|
||||
# un-comment the following line, and the 'detail post_proxy_log'
|
||||
# section, above.
|
||||
# post_proxy_log
|
||||
|
||||
# attr_rewrite
|
||||
|
||||
# Uncomment the following line if you want to filter replies from
|
||||
# remote proxies based on the rules defined in the 'attrs' file.
|
||||
# attr_filter.post-proxy
|
||||
|
||||
#
|
||||
# If you are proxying LEAP, you MUST configure the EAP
|
||||
# module, and you MUST list it here, in the post-proxy
|
||||
# stage.
|
||||
#
|
||||
# You MUST also use the 'nostrip' option in the 'realm'
|
||||
# configuration. Otherwise, the User-Name attribute
|
||||
# in the proxied request will not match the user name
|
||||
# hidden inside of the EAP packet, and the end server will
|
||||
# reject the EAP request.
|
||||
#
|
||||
eap
|
||||
|
||||
#
|
||||
# If the server tries to proxy a request and fails, then the
|
||||
# request is processed through the modules in this section.
|
||||
#
|
||||
# The main use of this section is to permit robust proxying
|
||||
# of accounting packets. The server can be configured to
|
||||
# proxy accounting packets as part of normal processing.
|
||||
# Then, if the home server goes down, accounting packets can
|
||||
# be logged to a local "detail" file, for processing with
|
||||
# radrelay. When the home server comes back up, radrelay
|
||||
# will read the detail file, and send the packets to the
|
||||
# home server.
|
||||
#
|
||||
# With this configuration, the server always responds to
|
||||
# Accounting-Requests from the NAS, but only writes
|
||||
# accounting packets to disk if the home server is down.
|
||||
#
|
||||
# Post-Proxy-Type Fail {
|
||||
# detail
|
||||
# }
|
||||
}
|
|
@ -1,8 +1,5 @@
|
|||
# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
|
||||
# CRC32 283edc8d
|
||||
# Put this file to /etc/ldap/schema/ and then execute the following
|
||||
# comand to add this schema:
|
||||
# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/radius.ldif
|
||||
# CRC32 f395ae99
|
||||
dn: cn=radius,cn=schema,cn=config
|
||||
objectClass: olcSchemaConfig
|
||||
cn: radius
|
||||
|
@ -211,4 +208,3 @@ olcObjectClasses: {0}( 1.3.6.1.4.1.3317.4.3.2.1 NAME 'radiusprofile' DESC ''
|
|||
olcObjectClasses: {1}( 1.3.6.1.4.1.3317.4.3.2.2 NAME 'radiusObjectProfile' D
|
||||
ESC 'A Container Objectclass to be used for creating radius profile object'
|
||||
SUP top STRUCTURAL MUST cn MAY ( uid $ userPassword $ description ) )
|
||||
|
|
@ -1,4 +1,10 @@
|
|||
debian/u-auth-manage /usr/bin
|
||||
debian/settings.py /etc/u-auth
|
||||
debian/debian_config.py /usr/lib/u-auth
|
||||
debian/schema /usr/lib/u-auth
|
||||
debian/u-auth-manage /usr/bin
|
||||
debian/lib/u-auth /usr/lib/u-auth/
|
||||
debian/lib/setup-radius /usr/lib/u-auth/
|
||||
debian/lib/setup-slapd /usr/lib/u-auth/
|
||||
debian/lib/reset-slapd /usr/lib/u-auth/
|
||||
debian/share/config.ldif /usr/share/u-auth
|
||||
debian/share/radius-default.conf /usr/share/u-auth
|
||||
debian/share/radius.ldif /usr/share/u-auth
|
||||
debian/settings.py /etc/u-auth
|
||||
debian/debian_config.py /usr/lib/u-auth
|
|
@ -29,6 +29,9 @@ case "$1" in
|
|||
chown root:$GROUP $SECRET_FILE
|
||||
chmod 0440 $SECRET_FILE
|
||||
fi
|
||||
|
||||
/usr/lib/u-auth setup-slapd
|
||||
/usr/lib/u-auth setup-radius
|
||||
;;
|
||||
|
||||
abort-upgrade|abort-remove|abort-deconfigure)
|
||||
|
@ -42,4 +45,4 @@ esac
|
|||
|
||||
#DEBHELPER#
|
||||
|
||||
exit 0
|
||||
exit 0
|
||||
|
|
Reference in New Issue