ldap and radius manage scripts

This commit is contained in:
Serghei Mihai 2015-05-04 17:17:16 +02:00
parent d597367fdb
commit 17f6c75c43
13 changed files with 1159 additions and 11 deletions

View File

@ -20,6 +20,7 @@ Package: u-auth
Architecture: all
Depends: ${misc:Depends},
python-uauth (= ${binary:Version}),
gunicorn, slapd, freeradius-ldap
gunicorn, slapd, freeradius-ldap,
ldapvi
Recommends: nginx, postgresql
Description: Captive potail in the Cloud

80
lib/reset-slapd Executable file
View File

@ -0,0 +1,80 @@
#!/bin/sh
# initial configuration of slapd
set -e
LDIFDIR=/usr/share/u-auth
SERVICE="/usr/sbin/service slapd"
echo ""
echo " *************"
echo " * * La configuration et toutes les données"
echo " * ATTENTION * de l'annuaire LDAP vont être définitivement"
echo " * * effacées. Avez-vous fait un backup ?"
echo " *************"
echo ""
echo "Confirmez la MISE A ZÉRO COMPLÈTE de l'annuaire LDAP."
echo ""
echo -n "Tapez oui en toutes lettres : "
read ok
if [ "x$ok" != "xoui" ]; then
exit 3
fi
${SERVICE} stop || true
BACKUPDIR="/var/backup/reset-ldap-`date +%Y%m%dT%H:%M:%S`"
mkdir -p "$BACKUPDIR"
echo Old configuration saved in $BACKUPDIR
cp -R /var/lib/ldap /etc/ldap/slapd.d/ "$BACKUPDIR"
echo -n "Effacement de la configuration"
rm -rf /etc/ldap/slapd.d/*
echo -n " et des données .."
rm -rf /var/lib/ldap/*
echo "ok"
if ! grep "^\s*profile\s\+config\s*$" /etc/ldapvi.conf > /dev/null 2>&1; then
echo "(ajout du 'profile config' dans /etc/ldapvi.conf)"
cat << EOLDAPVI >> /etc/ldapvi.conf
profile config
host: ldapi://
sasl-mech: EXTERNAL
base: cn=config
EOLDAPVI
fi
mkdir /var/lib/ldap/config-accesslog/
echo "Installation de la nouvelle configuration .. "
slapadd -n0 -F/etc/ldap/slapd.d -l${LDIFDIR}/config.ldif
echo "ok"
echo "Installation des schémas .. "
slapadd -n0 -F/etc/ldap/slapd.d -l/etc/ldap/schema/core.ldif
slapadd -n0 -F/etc/ldap/slapd.d -l/etc/ldap/schema/cosine.ldif
slapadd -n0 -F/etc/ldap/slapd.d -l/etc/ldap/schema/inetorgperson.ldif
echo "ok"
chown -R openldap:openldap /etc/ldap/slapd.d /var/lib/ldap
if [ ! -s /etc/ldap/ssl/slapd.pem -o ! -s /etc/ldap/ssl/slapd.key ]; then
echo "Pose de certificats SSL par défaut (invalides)"
mkdir -p /etc/ldap/ssl
cp -v ${LDIFDIR}/ssl.pem /etc/ldap/ssl/slapd.pem
cp -v ${LDIFDIR}/ssl.key /etc/ldap/ssl/slapd.key
chown -R root:openldap /etc/ldap/ssl
chmod 0755 /etc/ldap/ssl
chmod 0644 /etc/ldap/ssl/slapd.pem
chmod 0640 /etc/ldap/ssl/slapd.key
echo "ok"
fi
${SERVICE} start

4
lib/reset-slapd.help Normal file
View File

@ -0,0 +1,4 @@
mise à zéro complète
Attention, cela efface complétement la configuration et
les données actuelles du serveur LDAP (slapd).

18
lib/setup-radius Executable file
View File

@ -0,0 +1,18 @@
#!/bin/sh
# Do initial configuration of freeradius
set -e
CONF_DIR = '/etc/freeradius'
BASEDIR=`dirname $0`
service freeradius stop
cp "$CONF_DIR/sites-available/default" "$CONF_DIR/sites-available/default.backup"
cp "$BASEDIR/radius-default.conf" "$CONF_DIR/sites-available/default"
service freeradius start

1
lib/setup-radius.help Normal file
View File

@ -0,0 +1 @@
activation et parametrage du module ldap dans radius

309
lib/setup-slapd Executable file
View File

@ -0,0 +1,309 @@
#!/bin/sh
# Do initial configuration of slapd
set -e
LDIFDIR=/usr/share/u-auth
BACKUPDIR="/var/backup/reset-ldap-`date +%Y%m%dT%H:%M:%S`"
mkdir -p "$BACKUPDIR"
echo Old configuration saved in $BACKUPDIR
cp -R /var/lib/ldap /etc/ldap/slapd.d/ "$BACKUPDIR"
rm -rf /var/lib/ldap/*
mkdir /var/lib/ldap/config-accesslog/
echo Load overlay modules, configure auditlog for cn=config
slapadd -n0 -F/etc/ldap/slapd.d -l${LDIFDIR}/radius.ldif
echo "Suffixe de la base à créer (exemple : dc=univ-psl,dc=fr) :"
echo -n "-> "
read SUFFIX
echo
if [ -d "/var/lib/ldap/$SUFFIX" ]; then
echo "ERR: le répertoire '/var/lib/ldap/$SUFFIX' existe déjà" >&2
exit 1
fi
if ldapsearch -H ldapi:// -Y EXTERNAL -b cn=config olcSuffix=$SUFFIX 2>/dev/null | grep -q '^result: [1-9]'; then
echo "ERR: le suffixe $SUFFIX existe déjà" >&2
exit 2
fi
echo "Choisir un mot de passe administrateur (uid=admin,ou=people,$SUFFIX) :"
echo -n "-> "
stty -echo
read PASSWORD
stty echo
echo
echo "Une nouvelle fois :"
echo -n "-> "
stty -echo
read PASSWORD2
stty echo
echo
if [ x"$PASSWORD" != x"$PASSWORD2" ]; then
echo "ERR: mots de passe différents" >&2
exit 3
fi
echo
echo "Nom de l'organisation (ou=...) :"
echo "uniquement des majuscules, sans accent"
echo "Exemple: ENS"
echo -n "-> "
read ORGANIZATION
echo
echo "Récapitulatif :"
echo " Suffixe : $SUFFIX"
echo " Nom : $ORGANIZATION"
echo "DN établissement : ou=$ORGANIZATION,$SUFFIX"
echo
echo "Créer cette base ? (taper oui)"
echo -n "-> "
read OK
echo
if [ "x$OK" != "xoui" ]; then
exit 4
fi
DC=`echo $SUFFIX | sed 's/dc=\([^,]*\).*/\1/'`
DBDIR=/var/lib/ldap/$SUFFIX
DBACCESSLOGDIR=/var/lib/ldap/$SUFFIX/accesslog/
mkdir -p "$DBDIR" "$DBACCESSLOGDIR"
chown -R openldap:openldap /etc/ldap/slapd.d /var/lib/ldap
LDIF=`tempfile --prefix=newdb --suffix=.ldif`
cat << EOF > $LDIF
# LDAPVI syntax
add olcDatabase={1}mdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcMdbConfig
olcDatabase: {1}mdb
olcSuffix: $SUFFIX
olcDbDirectory: /var/lib/ldap/$SUFFIX/
olcRootDN: uid=admin,ou=people,$SUFFIX
olcRootPW: $PASSWORD
olcLastMod: TRUE
olcAddContentACL: FALSE
olcMonitoring: TRUE
olcSyncUseSubentry: FALSE
olcMaxDerefDepth: 0
olcLimits: {0}dn.exact="uid=admin,ou=people,$SUFFIX" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited
olcLimits: {1}dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited
olcReadOnly: FALSE
# Index
olcDbIndex: objectClass,member,owner eq
olcDbIndex: mail,givenName,uid,cn,sn,displayName pres,eq,approx,sub
# Accès super-utilisateur
olcAccess: {0}to *
by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
by group.exact="cn=admin,ou=groups,$SUFFIX" manage
by * break
# Branche people
olcAccess: {1}to dn.regex="uid=[^,]+,ou=people,$SUFFIX" attrs=userPassword,labeledURI
by self write
by * break
# Les accès aux autres attributs utilisateurs
olcAccess: {2}to dn.one="ou=people,$SUFFIX"
by users read
by anonymous auth
by * none
# Branche groups
# Le propriétaire du groupe
olcAccess: {3}to dn.one="ou=groups,$SUFFIX"
by set="this/owner & user" manage
by * break
# Les utilisateurs en général sur les attributs descriptifs
olcAccess: {4}to dn.one="ou=groups,$SUFFIX" attrs=cn,description,owner
by users read
by * break
# Create accesslog DIT
add olcDatabase={1}mdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcMdbConfig
olcSuffix: cn=accesslog,$SUFFIX
olcDbDirectory: /var/lib/ldap/$SUFFIX/accesslog/
olcAccess: {0}to *
by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage
by group=cn=admin,ou=groupes,$SUFFIX manage
by * break
add olcOverlay={0}syncprov,olcDatabase={1}mdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: {0}syncprov
olcSpCheckpoint: 100 10
olcSpSessionlog: 100
# Log all writes to the db
add olcOverlay={1}accesslog,olcDatabase={2}mdb,cn=config
objectClass: olcAccesslogConfig
objectClass: olcOverlayConfig
objectClass: olcConfig
objectClass: top
olcOverlay: {1}accesslog
olcAccessLogDB: cn=accesslog,$SUFFIX
olcAccessLogOps: writes
# log are conserved one year and purged every day
olcAccessLogPurge: 365+00:00 1+00:00
# Keep a copy of everything
olcAccessLogOld: objectClass=*
add olcOverlay={2}refint,olcDatabase={2}mdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcRefintConfig
olcOverlay: {2}refint
olcRefintAttribute: member
olcRefintNothing: $SUFFIX
add olcOverlay={3}constraint,olcDatabase={2}mdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcConstraintConfig
olcOverlay: {3}constraint
# un seul cn pour les utilisateurs
olcConstraintAttribute: cn count 1 restrict="ldap:///ou=people,$SUFFIX??sub?(objectClass=*)"
#olcConstraintAttribute: cn regex "^[-A-Z' ]*$" restrict="ldap:///ou=people,$SUFFIX??sub?(objectClass=*)"
olcConstraintAttribute: cn regex "^[-A-Za-z0-9 ]*$" restrict="ldap:///ou=groups,$SUFFIX??sub?(objectClass=*)"
olcConstraintAttribute: cn regex "^[-A-Za-z0-9 ]*$" restrict="ldap:///$SUFFIX??base?(objectClass=*)"
olcConstraintAttribute: dc regex "^[a-z0-9-]*$"
olcConstraintAttribute: mail count 1
olcConstraintAttribute: mail
regex "^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,4}$"
# olcConstraintAttribute: mailForwardingAddress
regex "^([a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,4}|[a-zA-Z0-9]+)$" # mail ou uid
add $SUFFIX
objectClass: organization
objectClass: dcObject
dc: $DC
o: $ORGANIZATION
add ou=people,$SUFFIX
objectClass: organizationalUnit
ou: people
add uid=admin,ou=people,$SUFFIX
objectClass: inetOrgPerson
uid: admin
cn: Administrateur annuaire
displayName: Administrateur annuaire
givenName: Administrateur
sn: annuaire
userPassword: $PASSWORD
add ou=$ORGANIZATION,$SUFFIX
objectClass: organizationalUnit
ou: $ORGANIZATION
EOF
echo "Chargement de la définition de la nouvelle base annuaire ($LDIF) :"
ldapvi --verbose --profile config --ldapmodify --ldapvi --add $LDIF
# slapadd -n0 -F/etc/ldap/slapd.d -l${LDIF}
echo "OK"
chown -R openldap.openldap /etc/ldap/slapd.d /var/lib/ldap
LDAP_SETUP=`tempfile --prefix=ldap --suffix=.conf`
cat << EOF > $LDAP_SETUP
ldap {
#
# Note that this needs to match the name in the LDAP
# server certificate, if you're using ldaps.
server = "localhost"
identity = "uid=admin,ou=people,$SUFFIX"
password = "$PASSWORD"
basedn = "$ORGANIZATION,$SUFFIX"
filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
#base_filter = "(objectclass=radiusprofile)"
ldap_connections_number = 5
# How many times the connection can be used before
# being re-established. This is useful for things
# like load balancers, which may exhibit sticky
# behaviour without it. (0) is unlimited.
max_uses = 0
# Port to connect on, defaults to 389. Setting this to
# 636 will enable LDAPS if start_tls (see below) is not
# able to be used.
#port = 389
# seconds to wait for LDAP query to finish. default: 20
timeout = 4
# seconds LDAP server has to process the query (server-side
# time limit). default: 20
#
# LDAP_OPT_TIMELIMIT is set to this value.
timelimit = 3
#
# seconds to wait for response of the server. (network
# failures) default: 10
#
# LDAP_OPT_NETWORK_TIMEOUT is set to this value.
net_timeout = 1
# Mapping of RADIUS dictionary attributes to LDAP
# directory attributes.
dictionary_mapping = ${confdir}/ldap.attrmap
# Un-comment the following to disable Novell
# eDirectory account policy check and intruder
# detection. This will work *only if* FreeRADIUS is
# configured to build with --with-edir option.
#
edir_account_policy_check = no
# By default, if the packet contains a User-Password,
# and no other module is configured to handle the
# authentication, the LDAP module sets itself to do
# LDAP bind for authentication.
#
# THIS WILL ONLY WORK FOR PAP AUTHENTICATION.
#
# THIS WILL NOT WORK FOR CHAP, MS-CHAP, or 802.1x (EAP).
#
# You can disable this behavior by setting the following
# configuration entry to "no".
#
# allowed values: {no, yes}
# set_auth_type = yes
# Keepalive configuration. This MAY NOT be supported by your
# LDAP library. If these configuration entries appear in the
# output of "radiusd -X", then they are supported. Otherwise,
# they are unsupported, and changing them will do nothing.
#
keepalive {
# LDAP_OPT_X_KEEPALIVE_IDLE
idle = 60
# LDAP_OPT_X_KEEPALIVE_PROBES
probes = 3
# LDAP_OPT_X_KEEPALIVE_INTERVAL
interval = 3
}
}
EOF
service freeradius stop
cp /etc/freeradius/modules/ldap /etc/freeradius/modules/ldap.backup
mv $LDAP_SETUP /etc/freeradius/modules/ldap
service freeradius start

3
lib/setup-slapd.help Normal file
View File

@ -0,0 +1,3 @@
création d'une nouvelle base, avec un nouveau suffixe
Paramètrage de freeradius pour la connexion à cette base

46
lib/u-auth Executable file
View File

@ -0,0 +1,46 @@
#!/bin/sh
ME=`basename $0`
COMMANDDIR=`dirname $0`/lib
test -d ${COMMANDDIR} || COMMANDDIR=/usr/lib/`basename $0`
help() {
msg="$1"
test -n "$msg" && echo $msg
echo "syntaxe: $ME commande ..."
echo ""
echo "commandes disponibles:"
echo " help cette aide"
for fcom in $COMMANDDIR/*.help
do
com=`basename $fcom .help`
descr=`head -1 $fcom`
echo " "$com" "$descr
done
test -n "$msg" && exit 1
exit 0
}
helpcmd() {
command=$1
xcommand=$COMMANDDIR/$command
test -x $xcommand || help "ERR: commande inconnue ($command)"
echo "$ME $command"
cat $xcommand.help
}
command=$1
test -z $command && help "ERR: commande manquante"
shift
case $command in
help)
test -z "$1" && help
helpcmd $1
;;
*)
xcommand=$COMMANDDIR/$command
test -x $xcommand || help "ERR: commande inconnue ($command)"
$xcommand "$@"
;;
esac

76
share/config.ldif Normal file
View File

@ -0,0 +1,76 @@
dn: cn=config
objectClass: olcGlobal
cn: config
olcArgsFile: /var/run/slapd/slapd.args
olcPidFile: /var/run/slapd/slapd.pid
olcToolThreads: 1
olcLogLevel: none
olcServerId: 1
dn: cn=module{0},cn=config
objectClass: olcModuleList
cn: module{0}
olcModulePath: /usr/lib/ldap
olcModuleLoad: {0}back_hdb
olcModuleLoad: {1}back_monitor
olcModuleLoad: {2}back_mdb
olcModuleLoad: {3}accesslog
olcModuleLoad: {4}unique
olcModuleLoad: {5}refint
olcModuleLoad: {6}constraint
olcModuleLoad: {7}syncprov
dn: cn=schema,cn=config
objectClass: olcSchemaConfig
cn: schema
dn: olcDatabase={-1}frontend,cn=config
objectClass: olcDatabaseConfig
objectClass: olcFrontendConfig
olcDatabase: {-1}frontend
olcAccess: {0}to *
by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage
by * break
olcAccess: {1}to dn.exact="" by * read
olcAccess: {2}to dn.base="cn=Subschema" by * read
olcSizeLimit: 500
dn: olcDatabase={0}config,cn=config
objectClass: olcDatabaseConfig
olcDatabase: {0}config
olcAccess: {0}to *
by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage
by * break
olcRootDN: cn=admin,cn=config
dn: olcDatabase={1}mdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcMdbConfig
olcSuffix: cn=config-accesslog
olcDbDirectory: /var/lib/ldap/config-accesslog/
# Allow reading accesslog only by root
olcAccess: {0}to *
by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
by * break
dn: olcDatabase={1}monitor,cn=config
objectClass: olcDatabaseConfig
objectClass: olcMonitorConfig
olcDatabase: {1}monitor
# Allow reading monitoring only by root
olcAccess: {0}to *
by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
by * break
# Log all writes to the configuration
dn: olcOverlay={0}accesslog,olcDatabase={0}config,cn=config
objectClass: olcAccesslogConfig
objectClass: olcOverlayConfig
objectClass: olcConfig
objectClass: top
olcOverlay: {0}accesslog
olcAccessLogDB: cn=config-accesslog
olcAccessLogOps: writes
# log are conserved one year and purged every day
olcAccessLogPurge: 365+00:00 1+00:00
olcAccessLogOld: objectClass=olcConfig

605
share/radius-default.conf Normal file
View File

@ -0,0 +1,605 @@
# Authorization. First preprocess (hints and huntgroups files),
# then realms, and finally look in the "users" file.
#
# Any changes made here should also be made to the "inner-tunnel"
# virtual server.
#
# The order of the realm modules will determine the order that
# we try to find a matching realm.
#
# Make *sure* that 'preprocess' comes before any realm if you
# need to setup hints for the remote radius server
authorize {
#
# Security settings. Take a User-Name, and do some simple
# checks on it, for spaces and other invalid characters. If
# it looks like the user is trying to play games, reject it.
#
# This should probably be enabled by default.
#
# See policy.conf for the definition of the filter_username policy.
#
# filter_username
#
# The preprocess module takes care of sanitizing some bizarre
# attributes in the request, and turning them into attributes
# which are more standard.
#
# It takes care of processing the 'raddb/hints' and the
# 'raddb/huntgroups' files.
preprocess
#
# If you want to have a log of authentication requests,
# un-comment the following line, and the 'detail auth_log'
# section, above.
auth_log
ldap
#
# The chap module will set 'Auth-Type := CHAP' if we are
# handling a CHAP request and Auth-Type has not already been set
chap
#
# If the users are logging in with an MS-CHAP-Challenge
# attribute for authentication, the mschap module will find
# the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP'
# to the request, which will cause the server to then use
# the mschap module for authentication.
mschap
#
# If you have a Cisco SIP server authenticating against
# FreeRADIUS, uncomment the following line, and the 'digest'
# line in the 'authenticate' section.
digest
#
# The WiMAX specification says that the Calling-Station-Id
# is 6 octets of the MAC. This definition conflicts with
# RFC 3580, and all common RADIUS practices. Un-commenting
# the "wimax" module here means that it will fix the
# Calling-Station-Id attribute to the normal format as
# specified in RFC 3580 Section 3.21
# wimax
#
# Look for IPASS style 'realm/', and if not found, look for
# '@realm', and decide whether or not to proxy, based on
# that.
# IPASS
#
# If you are using multiple kinds of realms, you probably
# want to set "ignore_null = yes" for all of them.
# Otherwise, when the first style of realm doesn't match,
# the other styles won't be checked.
#
suffix
# ntdomain
#
# This module takes care of EAP-MD5, EAP-TLS, and EAP-LEAP
# authentication.
#
# It also sets the EAP-Type attribute in the request
# attribute list to the EAP type from the packet.
#
# As of 2.0, the EAP module returns "ok" in the authorize stage
# for TTLS and PEAP. In 1.x, it never returned "ok" here, so
# this change is compatible with older configurations.
#
# The example below uses module failover to avoid querying all
# of the following modules if the EAP module returns "ok".
# Therefore, your LDAP and/or SQL servers will not be queried
# for the many packets that go back and forth to set up TTLS
# or PEAP. The load on those servers will therefore be reduced.
#
eap {
ok = return
}
#
# Pull crypt'd passwords from /etc/passwd or /etc/shadow,
# using the system API's to get the password. If you want
# to read /etc/passwd or /etc/shadow directly, see the
# passwd module in radiusd.conf.
#
# unix
#
# Read the 'users' file
# files
#
# Look in an SQL database. The schema of the database
# is meant to mirror the "users" file.
#
# See "Authorization Queries" in sql.conf
# sql
#
# If you are using /etc/smbpasswd, and are also doing
# mschap authentication, the un-comment this line, and
# configure the 'smbpasswd' module.
# smbpasswd
exec
#
# The ldap module will set Auth-Type to LDAP if it has not
# already been set
#
# Enforce daily limits on time spent logged in.
# daily
#
# Use the checkval module
# checkval
expiration
logintime
#
# If no other module has claimed responsibility for
# authentication, then try to use PAP. This allows the
# other modules listed above to add a "known good" password
# to the request, and to do nothing else. The PAP module
# will then see that password, and use it to do PAP
# authentication.
#
# This module should be listed last, so that the other modules
# get a chance to set Auth-Type for themselves.
#
pap
#
# If "status_server = yes", then Status-Server messages are passed
# through the following section, and ONLY the following section.
# This permits you to do DB queries, for example. If the modules
# listed here return "fail", then NO response is sent.
#
# Autz-Type Status-Server {
#
# }
}
# Authentication.
#
#
# This section lists which modules are available for authentication.
# Note that it does NOT mean 'try each module in order'. It means
# that a module from the 'authorize' section adds a configuration
# attribute 'Auth-Type := FOO'. That authentication type is then
# used to pick the apropriate module from the list below.
#
# In general, you SHOULD NOT set the Auth-Type attribute. The server
# will figure it out on its own, and will do the right thing. The
# most common side effect of erroneously setting the Auth-Type
# attribute is that one authentication method will work, but the
# others will not.
#
# The common reasons to set the Auth-Type attribute by hand
# is to either forcibly reject the user (Auth-Type := Reject),
# or to or forcibly accept the user (Auth-Type := Accept).
#
# Note that Auth-Type := Accept will NOT work with EAP.
#
# Please do not put "unlang" configurations into the "authenticate"
# section. Put them in the "post-auth" section instead. That's what
# the post-auth section is for.
#
authenticate {
#
# PAP authentication, when a back-end database listed
# in the 'authorize' section supplies a password. The
# password can be clear-text, or encrypted.
Auth-Type PAP {
pap
}
#
# Most people want CHAP authentication
# A back-end database listed in the 'authorize' section
# MUST supply a CLEAR TEXT password. Encrypted passwords
# won't work.
Auth-Type CHAP {
chap
}
#
# MSCHAP authentication.
Auth-Type MS-CHAP {
mschap
}
#
# If you have a Cisco SIP server authenticating against
# FreeRADIUS, uncomment the following line, and the 'digest'
# line in the 'authorize' section.
digest
#
# Pluggable Authentication Modules.
# pam
#
# See 'man getpwent' for information on how the 'unix'
# module checks the users password. Note that packets
# containing CHAP-Password attributes CANNOT be authenticated
# against /etc/passwd! See the FAQ for details.
#
# For normal "crypt" authentication, the "pap" module should
# be used instead of the "unix" module. The "unix" module should
# be used for authentication ONLY for compatibility with legacy
# FreeRADIUS configurations.
#
unix
# Uncomment it if you want to use ldap for authentication
#
# Note that this means "check plain-text password against
# the ldap database", which means that EAP won't work,
# as it does not supply a plain-text password.
Auth-Type LDAP {
ldap
}
#
# Allow EAP authentication.
eap
#
# The older configurations sent a number of attributes in
# Access-Challenge packets, which wasn't strictly correct.
# If you want to filter out these attributes, uncomment
# the following lines.
#
# Auth-Type eap {
# eap {
# handled = 1
# }
# if (handled && (Response-Packet-Type == Access-Challenge)) {
# attr_filter.access_challenge.post-auth
# handled # override the "updated" code from attr_filter
# }
# }
}
#
# Pre-accounting. Decide which accounting type to use.
#
preacct {
preprocess
#
# Session start times are *implied* in RADIUS.
# The NAS never sends a "start time". Instead, it sends
# a start packet, *possibly* with an Acct-Delay-Time.
# The server is supposed to conclude that the start time
# was "Acct-Delay-Time" seconds in the past.
#
# The code below creates an explicit start time, which can
# then be used in other modules.
#
# The start time is: NOW - delay - session_length
#
# update request {
# FreeRADIUS-Acct-Session-Start-Time = "%{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}}"
# }
#
# Ensure that we have a semi-unique identifier for every
# request, and many NAS boxes are broken.
acct_unique
#
# Look for IPASS-style 'realm/', and if not found, look for
# '@realm', and decide whether or not to proxy, based on
# that.
#
# Accounting requests are generally proxied to the same
# home server as authentication requests.
# IPASS
suffix
# ntdomain
#
# Read the 'acct_users' file
files
}
#
# Accounting. Log the accounting data.
#
accounting {
#
# Create a 'detail'ed log of the packets.
# Note that accounting requests which are proxied
# are also logged in the detail file.
detail
# daily
# Update the wtmp file
#
# If you don't use "radlast", you can delete this line.
# unix
#
# For Simultaneous-Use tracking.
#
# Due to packet losses in the network, the data here
# may be incorrect. There is little we can do about it.
# radutmp
# sradutmp
# Return an address to the IP Pool when we see a stop record.
# main_pool
#
# Log traffic to an SQL database.
#
# See "Accounting queries" in sql.conf
# sql
#
# If you receive stop packets with zero session length,
# they will NOT be logged in the database. The SQL module
# will print a message (only in debugging mode), and will
# return "noop".
#
# You can ignore these packets by uncommenting the following
# three lines. Otherwise, the server will not respond to the
# accounting request, and the NAS will retransmit.
#
# if (noop) {
# ok
# }
#
# Instead of sending the query to the SQL server,
# write it into a log file.
#
# sql_log
# Cisco VoIP specific bulk accounting
# pgsql-voip
# For Exec-Program and Exec-Program-Wait
exec
# Filter attributes from the accounting response.
attr_filter.accounting_response
#
# See "Autz-Type Status-Server" for how this works.
#
# Acct-Type Status-Server {
#
# }
}
# Session database, used for checking Simultaneous-Use. Either the radutmp
# or rlm_sql module can handle this.
# The rlm_sql module is *much* faster
session {
radutmp
#
# See "Simultaneous Use Checking Queries" in sql.conf
# sql
}
# Post-Authentication
# Once we KNOW that the user has been authenticated, there are
# additional steps we can take.
post-auth {
# Get an address from the IP Pool.
# main_pool
#
# If you want to have a log of authentication replies,
# un-comment the following line, and the 'detail reply_log'
# section, above.
# reply_log
#
# After authenticating the user, do another SQL query.
#
# See "Authentication Logging Queries" in sql.conf
# sql
#
# Instead of sending the query to the SQL server,
# write it into a log file.
#
# sql_log
#
# Un-comment the following if you have set
# 'edir_account_policy_check = yes' in the ldap module sub-section of
# the 'modules' section.
#
# ldap
# For Exec-Program and Exec-Program-Wait
exec
#
# Calculate the various WiMAX keys. In order for this to work,
# you will need to define the WiMAX NAI, usually via
#
# update request {
# WiMAX-MN-NAI = "%{User-Name}"
# }
#
# If you want various keys to be calculated, you will need to
# update the reply with "template" values. The module will see
# this, and replace the template values with the correct ones
# taken from the cryptographic calculations. e.g.
#
# update reply {
# WiMAX-FA-RK-Key = 0x00
# WiMAX-MSK = "%{EAP-MSK}"
# }
#
# You may want to delete the MS-MPPE-*-Keys from the reply,
# as some WiMAX clients behave badly when those attributes
# are included. See "raddb/modules/wimax", configuration
# entry "delete_mppe_keys" for more information.
#
# wimax
# If there is a client certificate (EAP-TLS, sometimes PEAP
# and TTLS), then some attributes are filled out after the
# certificate verification has been performed. These fields
# MAY be available during the authentication, or they may be
# available only in the "post-auth" section.
#
# The first set of attributes contains information about the
# issuing certificate which is being used. The second
# contains information about the client certificate (if
# available).
#
# update reply {
# Reply-Message += "%{TLS-Cert-Serial}"
# Reply-Message += "%{TLS-Cert-Expiration}"
# Reply-Message += "%{TLS-Cert-Subject}"
# Reply-Message += "%{TLS-Cert-Issuer}"
# Reply-Message += "%{TLS-Cert-Common-Name}"
# Reply-Message += "%{TLS-Cert-Subject-Alt-Name-Email}"
#
# Reply-Message += "%{TLS-Client-Cert-Serial}"
# Reply-Message += "%{TLS-Client-Cert-Expiration}"
# Reply-Message += "%{TLS-Client-Cert-Subject}"
# Reply-Message += "%{TLS-Client-Cert-Issuer}"
# Reply-Message += "%{TLS-Client-Cert-Common-Name}"
# Reply-Message += "%{TLS-Client-Cert-Subject-Alt-Name-Email}"
# }
# MacSEC requires the use of EAP-Key-Name. However, we don't
# want to send it for all EAP sessions. Therefore, the EAP
# modules put required data into the EAP-Session-Id attribute.
# This attribute is never put into a request or reply packet.
#
# Uncomment the next few lines to copy the required data into
# the EAP-Key-Name attribute
# if (reply:EAP-Session-Id) {
# update reply {
# EAP-Key-Name := "%{reply:EAP-Session-Id}"
# }
# }
# If the WiMAX module did it's work, you may want to do more
# things here, like delete the MS-MPPE-*-Key attributes.
#
# if (updated) {
# update reply {
# MS-MPPE-Recv-Key !* 0x00
# MS-MPPE-Send-Key !* 0x00
# }
# }
#
# Access-Reject packets are sent through the REJECT sub-section of the
# post-auth section.
#
# Add the ldap module name (or instance) if you have set
# 'edir_account_policy_check = yes' in the ldap module configuration
#
Post-Auth-Type REJECT {
# log failed authentications in SQL, too.
# sql
attr_filter.access_reject
}
}
#
# When the server decides to proxy a request to a home server,
# the proxied request is first passed through the pre-proxy
# stage. This stage can re-write the request, or decide to
# cancel the proxy.
#
# Only a few modules currently have this method.
#
pre-proxy {
# attr_rewrite
# Uncomment the following line if you want to change attributes
# as defined in the preproxy_users file.
# files
# Uncomment the following line if you want to filter requests
# sent to remote servers based on the rules defined in the
# 'attrs.pre-proxy' file.
# attr_filter.pre-proxy
# If you want to have a log of packets proxied to a home
# server, un-comment the following line, and the
# 'detail pre_proxy_log' section, above.
# pre_proxy_log
}
#
# When the server receives a reply to a request it proxied
# to a home server, the request may be massaged here, in the
# post-proxy stage.
#
post-proxy {
# If you want to have a log of replies from a home server,
# un-comment the following line, and the 'detail post_proxy_log'
# section, above.
# post_proxy_log
# attr_rewrite
# Uncomment the following line if you want to filter replies from
# remote proxies based on the rules defined in the 'attrs' file.
# attr_filter.post-proxy
#
# If you are proxying LEAP, you MUST configure the EAP
# module, and you MUST list it here, in the post-proxy
# stage.
#
# You MUST also use the 'nostrip' option in the 'realm'
# configuration. Otherwise, the User-Name attribute
# in the proxied request will not match the user name
# hidden inside of the EAP packet, and the end server will
# reject the EAP request.
#
eap
#
# If the server tries to proxy a request and fails, then the
# request is processed through the modules in this section.
#
# The main use of this section is to permit robust proxying
# of accounting packets. The server can be configured to
# proxy accounting packets as part of normal processing.
# Then, if the home server goes down, accounting packets can
# be logged to a local "detail" file, for processing with
# radrelay. When the home server comes back up, radrelay
# will read the detail file, and send the packets to the
# home server.
#
# With this configuration, the server always responds to
# Accounting-Requests from the NAS, but only writes
# accounting packets to disk if the home server is down.
#
# Post-Proxy-Type Fail {
# detail
# }
}

View File

@ -1,8 +1,5 @@
# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 283edc8d
# Put this file to /etc/ldap/schema/ and then execute the following
# comand to add this schema:
# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/radius.ldif
# CRC32 f395ae99
dn: cn=radius,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: radius
@ -211,4 +208,3 @@ olcObjectClasses: {0}( 1.3.6.1.4.1.3317.4.3.2.1 NAME 'radiusprofile' DESC ''
olcObjectClasses: {1}( 1.3.6.1.4.1.3317.4.3.2.2 NAME 'radiusObjectProfile' D
ESC 'A Container Objectclass to be used for creating radius profile object'
SUP top STRUCTURAL MUST cn MAY ( uid $ userPassword $ description ) )

View File

@ -1,4 +1,10 @@
debian/u-auth-manage /usr/bin
debian/settings.py /etc/u-auth
debian/debian_config.py /usr/lib/u-auth
debian/schema /usr/lib/u-auth
debian/u-auth-manage /usr/bin
debian/lib/u-auth /usr/lib/u-auth/
debian/lib/setup-radius /usr/lib/u-auth/
debian/lib/setup-slapd /usr/lib/u-auth/
debian/lib/reset-slapd /usr/lib/u-auth/
debian/share/config.ldif /usr/share/u-auth
debian/share/radius-default.conf /usr/share/u-auth
debian/share/radius.ldif /usr/share/u-auth
debian/settings.py /etc/u-auth
debian/debian_config.py /usr/lib/u-auth

View File

@ -29,6 +29,9 @@ case "$1" in
chown root:$GROUP $SECRET_FILE
chmod 0440 $SECRET_FILE
fi
/usr/lib/u-auth setup-slapd
/usr/lib/u-auth setup-radius
;;
abort-upgrade|abort-remove|abort-deconfigure)
@ -42,4 +45,4 @@ esac
#DEBHELPER#
exit 0
exit 0