summaryrefslogtreecommitdiffstats
path: root/ipa-server/ipa-install
diff options
context:
space:
mode:
authorKarl MacMillan <kmacmill@redhat.com>2007-12-12 18:06:39 -0500
committerKarl MacMillan <kmacmill@redhat.com>2007-12-12 18:06:39 -0500
commitcf595511ff9e55b5f10a3273575980d6bb39d67a (patch)
tree61e2f2e39ce7a15f219ce1c8037d1260d84b0da5 /ipa-server/ipa-install
parentcecbca1a84579c6aaf20ab7979aee1ae483f32c6 (diff)
downloadfreeipa-cf595511ff9e55b5f10a3273575980d6bb39d67a.tar.gz
freeipa-cf595511ff9e55b5f10a3273575980d6bb39d67a.tar.xz
freeipa-cf595511ff9e55b5f10a3273575980d6bb39d67a.zip
Move radius server components into a separate package.
Diffstat (limited to 'ipa-server/ipa-install')
-rw-r--r--ipa-server/ipa-install/Makefile.am1
-rw-r--r--ipa-server/ipa-install/ipa-radius-install72
-rw-r--r--ipa-server/ipa-install/share/Makefile.am1
-rw-r--r--ipa-server/ipa-install/share/radius.radiusd.conf.template285
4 files changed, 0 insertions, 359 deletions
diff --git a/ipa-server/ipa-install/Makefile.am b/ipa-server/ipa-install/Makefile.am
index 37dd325e8..8a3e4a975 100644
--- a/ipa-server/ipa-install/Makefile.am
+++ b/ipa-server/ipa-install/Makefile.am
@@ -9,7 +9,6 @@ sbin_SCRIPTS = \
ipa-replica-install \
ipa-replica-prepare \
ipa-server-certinstall \
- ipa-radius-install \
$(NULL)
EXTRA_DIST = \
diff --git a/ipa-server/ipa-install/ipa-radius-install b/ipa-server/ipa-install/ipa-radius-install
deleted file mode 100644
index 84e10e426..000000000
--- a/ipa-server/ipa-install/ipa-radius-install
+++ /dev/null
@@ -1,72 +0,0 @@
-#! /usr/bin/python -E
-# Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
-#
-# Copyright (C) 2007 Red Hat
-# see file 'COPYING' for use and warranty information
-#
-# This program is free software; you can redistribute it and/or
-# modify it under the terms of the GNU General Public License as
-# published by the Free Software Foundation; version 2 only
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
-#
-
-import sys
-sys.path.append("/usr/share/ipa")
-
-import traceback, logging, krbV
-
-from ipaserver import radiusinstance, installutils
-
-from ipa import ipautil
-
-def get_host_name():
- hostname = installutils.get_fqdn()
- try:
- installutils.verify_fqdn(hostname)
- except RuntimeError, e:
- logging.error(str(e))
- sys.exit(1)
-
- return hostname
-
-def get_realm_name():
- c = krbV.default_context()
- return c.default_realm
-
-def main():
- if not ipautil.file_exists("/etc/ipa/ipa.conf"):
- print "This system does not appear to have IPA configured."
- print "Has ipa-server-install been run?"
- yesno = raw_input("Continue with radius install [y/N]? ")
- if yesno.lower() != "y":
- sys.exit(1)
-
- installutils.standard_logging_setup("iparadius-install.log", False)
-
- host_name = get_host_name()
-
- realm_name = get_realm_name()
-
- # Create a radius instance
- radius = radiusinstance.RadiusInstance()
- # FIXME: ldap_server should be derived, not hardcoded to localhost, also should it be a URL?
- radius.create_instance(realm_name, host_name, 'localhost')
-
-
-try:
- main()
-except Exception, e:
- message = "Unexpected error - see iparadius-install.log for details:\n %s" % str(e)
- print message
- message = str(e)
- for str in traceback.format_tb(sys.exc_info()[2]):
- message = message + "\n" + str
- logging.debug(message)
diff --git a/ipa-server/ipa-install/share/Makefile.am b/ipa-server/ipa-install/share/Makefile.am
index 36837356d..5d117dec5 100644
--- a/ipa-server/ipa-install/share/Makefile.am
+++ b/ipa-server/ipa-install/share/Makefile.am
@@ -20,7 +20,6 @@ app_DATA = \
krbrealm.con.template \
ntp.conf.server.template \
preferences.html.template \
- radius.radiusd.conf.template \
referint-conf.ldif \
dna-posix.ldif \
master-entry.ldif \
diff --git a/ipa-server/ipa-install/share/radius.radiusd.conf.template b/ipa-server/ipa-install/share/radius.radiusd.conf.template
deleted file mode 100644
index 3bc4927dd..000000000
--- a/ipa-server/ipa-install/share/radius.radiusd.conf.template
+++ /dev/null
@@ -1,285 +0,0 @@
-#
-# WARNING: This file is automatically generated, do not edit
-#
-# $CONFIG_FILE_VERSION_INFO
-#
-prefix = /usr
-exec_prefix = /usr
-sysconfdir = /etc
-localstatedir = /var
-sbindir = /usr/sbin
-logdir = $${localstatedir}/log/radius
-raddbdir = $${sysconfdir}/raddb
-radacctdir = $${logdir}/radacct
-confdir = $${raddbdir}
-run_dir = $${localstatedir}/run/radiusd
-db_dir = $${localstatedir}/lib/radiusd
-log_file = $${logdir}/radius.log
-libdir = /usr/lib
-pidfile = $${run_dir}/radiusd.pid
-user = radiusd
-group = radiusd
-max_request_time = 30
-delete_blocked_requests = no
-cleanup_delay = 5
-max_requests = 1024
-bind_address = *
-port = 0
-hostname_lookups = no
-allow_core_dumps = no
-regular_expressions = yes
-extended_expressions = yes
-log_stripped_names = no
-log_auth = no
-log_auth_badpass = no
-log_auth_goodpass = no
-usercollide = no
-lower_user = no
-lower_pass = no
-nospace_user = no
-nospace_pass = no
-checkrad = $${sbindir}/checkrad
-security {
- max_attributes = 200
- reject_delay = 1
- status_server = no
-}
-proxy_requests = yes
-$$INCLUDE $${confdir}/proxy.conf
-$$INCLUDE $${confdir}/clients.conf
-snmp = no
-$$INCLUDE $${confdir}/snmp.conf
-thread pool {
- start_servers = 5
- max_servers = 32
- min_spare_servers = 3
- max_spare_servers = 10
- max_requests_per_server = 0
-}
-modules {
- chap {
- authtype = CHAP
- }
- pam {
- pam_auth = radiusd
- }
- unix {
- cache = no
- cache_reload = 600
- shadow = /etc/shadow
- radwtmp = $${logdir}/radwtmp
- }
-$$INCLUDE $${confdir}/eap.conf
- mschap {
- }
- ldap {
- server = "$LDAP_SERVER"
- use_sasl = yes
- sasl_mech = "GSSAPI"
- krb_keytab = "$RADIUS_KEYTAB"
- krb_principal = "$RADIUS_PRINCIPAL"
- basedn = "$RADIUS_USER_BASE_DN"
- filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
- base_filter = "(objectclass=radiusprofile)"
- start_tls = no
- profile_attribute = "radiusProfileDn"
- default_profile = "uid=ipa_default,cn=profiles,cn=radius,cn=services,cn=etc,$SUFFIX
- # FIXME: we'll want to toggle the access_attr feature on/off,
- # but it needs a control, so disable it for now.
- #access_attr = "$ACCESS_ATTRIBUTE"
- #access_attr_used_for_allow = "$ACCESS_ATTRIBUTE_DEFAULT"
- dictionary_mapping = $${raddbdir}/ldap.attrmap
- ldap_connections_number = 5
- edir_account_policy_check=no
- timeout = 4
- timelimit = 3
- net_timeout = 1
- clients_basedn = "$CLIENTS_BASEDN"
- }
- realm IPASS {
- format = prefix
- delimiter = "/"
- ignore_default = no
- ignore_null = no
- }
- realm suffix {
- format = suffix
- delimiter = "@"
- ignore_default = no
- ignore_null = no
- }
- realm realmpercent {
- format = suffix
- delimiter = "%"
- ignore_default = no
- ignore_null = no
- }
- realm ntdomain {
- format = prefix
- delimiter = "\\"
- ignore_default = no
- ignore_null = no
- }
- checkval {
- item-name = Calling-Station-Id
- check-name = Calling-Station-Id
- data-type = string
- }
- preprocess {
- huntgroups = $${confdir}/huntgroups
- hints = $${confdir}/hints
- with_ascend_hack = no
- ascend_channels_per_line = 23
- with_ntdomain_hack = no
- with_specialix_jetstream_hack = no
- with_cisco_vsa_hack = no
- }
- files {
- usersfile = $${confdir}/users
- acctusersfile = $${confdir}/acct_users
- preproxy_usersfile = $${confdir}/preproxy_users
- compat = no
- }
- detail {
- detailfile = $${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d
- detailperm = 0600
- }
- acct_unique {
- key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
- }
- radutmp {
- filename = $${logdir}/radutmp
- username = %{User-Name}
- case_sensitive = yes
- check_with_nas = yes
- perm = 0600
- callerid = "yes"
- }
- radutmp sradutmp {
- filename = $${logdir}/sradutmp
- perm = 0644
- callerid = "no"
- }
- attr_filter {
- attrsfile = $${confdir}/attrs
- }
- counter daily {
- filename = $${db_dir}/db.daily
- key = User-Name
- count-attribute = Acct-Session-Time
- reset = daily
- counter-name = Daily-Session-Time
- check-name = Max-Daily-Session
- allowed-servicetype = Framed-User
- cache-size = 5000
- }
- sqlcounter dailycounter {
- counter-name = Daily-Session-Time
- check-name = Max-Daily-Session
- reply-name = Session-Timeout
- sqlmod-inst = sql
- key = User-Name
- reset = daily
- query = "SELECT SUM(AcctSessionTime - \
- GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \
- FROM radacct WHERE UserName='%{%k}' AND \
- UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'"
- }
- sqlcounter monthlycounter {
- counter-name = Monthly-Session-Time
- check-name = Max-Monthly-Session
- reply-name = Session-Timeout
- sqlmod-inst = sql
- key = User-Name
- reset = monthly
- query = "SELECT SUM(AcctSessionTime - \
- GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \
- FROM radacct WHERE UserName='%{%k}' AND \
- UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'"
- }
- always fail {
- rcode = fail
- }
- always reject {
- rcode = reject
- }
- always ok {
- rcode = ok
- simulcount = 0
- mpp = no
- }
- expr {
- }
- digest {
- }
- exec {
- wait = yes
- input_pairs = request
- }
- exec echo {
- wait = yes
- program = "/bin/echo %{User-Name}"
- input_pairs = request
- output_pairs = reply
- }
- ippool main_pool {
- range-start = 192.168.1.1
- range-stop = 192.168.3.254
- netmask = 255.255.255.0
- cache-size = 800
- session-db = $${db_dir}/db.ippool
- ip-index = $${db_dir}/db.ipindex
- override = no
- maximum-timeout = 0
- }
- krb5 {
- keytab = "$RADIUS_KEYTAB"
- service_principal = "$RADIUS_PRINCIPAL"
- }
-}
-instantiate {
- exec
- expr
-}
-authorize {
- preprocess
- chap
- mschap
- suffix
- eap
- #files
- ldap
-}
-authenticate {
- Auth-Type CHAP {
- chap
- }
- Auth-Type MS-CHAP {
- mschap
- }
- eap
- Auth-Type Kerberos {
- krb5
- }
-}
-preacct {
- preprocess
- acct_unique
- suffix
- files
-}
-accounting {
- detail
- unix
- radutmp
-}
-session {
- radutmp
-}
-post-auth {
-}
-pre-proxy {
-}
-post-proxy {
- eap
-}