From cf595511ff9e55b5f10a3273575980d6bb39d67a Mon Sep 17 00:00:00 2001 From: Karl MacMillan Date: Wed, 12 Dec 2007 18:06:39 -0500 Subject: Move radius server components into a separate package. --- Makefile | 28 +- ipa-python/ipautil.py | 1 + ipa-python/radius_util.py | 2 +- ipa-radius-server/Makefile | 20 ++ ipa-radius-server/ipa-radius-install | 73 ++++++ ipa-radius-server/ipa-radius-server.spec | 50 ++++ ipa-radius-server/ipa-radius-server.spec.in | 50 ++++ ipa-radius-server/plugins/__init__.py | 1 + ipa-radius-server/plugins/radiusinstance.py | 173 +++++++++++++ .../share/radius.radiusd.conf.template | 285 +++++++++++++++++++++ ipa-server/ipa-install/Makefile.am | 1 - ipa-server/ipa-install/ipa-radius-install | 72 ------ ipa-server/ipa-install/share/Makefile.am | 1 - .../ipa-install/share/radius.radiusd.conf.template | 285 --------------------- ipa-server/ipa-server.spec | 1 - ipa-server/ipa-server.spec.in | 1 - ipa-server/ipaserver/Makefile.am | 1 - ipa-server/ipaserver/radiusinstance.py | 171 ------------- 18 files changed, 680 insertions(+), 536 deletions(-) create mode 100644 ipa-radius-server/Makefile create mode 100644 ipa-radius-server/ipa-radius-install create mode 100755 ipa-radius-server/ipa-radius-server.spec create mode 100755 ipa-radius-server/ipa-radius-server.spec.in create mode 100644 ipa-radius-server/plugins/__init__.py create mode 100644 ipa-radius-server/plugins/radiusinstance.py create mode 100644 ipa-radius-server/share/radius.radiusd.conf.template delete mode 100644 ipa-server/ipa-install/ipa-radius-install delete mode 100644 ipa-server/ipa-install/share/radius.radiusd.conf.template delete mode 100644 ipa-server/ipaserver/radiusinstance.py diff --git a/Makefile b/Makefile index 0461144a..25af8533 100644 --- a/Makefile +++ b/Makefile @@ -1,4 +1,4 @@ -SUBDIRS=ipa-server ipa-admintools ipa-python ipa-client +SUBDIRS=ipa-server ipa-admintools ipa-python ipa-client ipa-radius-server PRJ_PREFIX=ipa @@ -35,6 +35,13 @@ CLI_VERSION=$(CLI_MAJOR).$(CLI_MINOR).$(CLI_RELEASE) CLI_TARBALL_PREFIX=$(PRJ_PREFIX)-client-$(CLI_VERSION) CLI_TARBALL=$(CLI_TARBALL_PREFIX).tgz +RADIUS_SERVER_MAJOR=0 +RADIUS_SERVER_MINOR=5 +RADIUS_SERVER_RELEASE=0 +RADIUS_SERVER_VERSION=$(RADIUS_SERVER_MAJOR).$(RADIUS_SERVER_MINOR).$(RADIUS_SERVER_RELEASE) +RADIUS_SERVER_TARBALL_PREFIX=$(PRJ_PREFIX)-radius-server-$(RADIUS_SERVER_VERSION) +RADIUS_SERVER_TARBALL=$(RADIUS_SERVER_TARBALL_PREFIX).tgz + LIBDIR ?= /usr/lib all: bootstrap-autogen @@ -77,6 +84,9 @@ version-update: sed s/VERSION/$(CLI_VERSION)/ ipa-client/ipa-client.spec.in \ > ipa-client/ipa-client.spec + sed s/VERSION/$(RADIUS_SERVER_VERSION)/ ipa-radius-server/ipa-radius-server.spec.in \ + > ipa-radius-server/ipa-radius-server.spec + archive: -mkdir -p dist @@ -120,6 +130,13 @@ tarballs: cd dist; tar cfz sources/$(CLI_TARBALL) $(CLI_TARBALL_PREFIX) rm -fr dist/$(CLI_TARBALL_PREFIX) + # ipa-radius-server + mv dist/ipa/ipa-radius-server dist/$(RADIUS_SERVER_TARBALL_PREFIX) + rm -f dist/sources/$(RADIUS_SERVER_TARBALL) + cd dist; tar cfz sources/$(RADIUS_SERVER_TARBALL) $(RADIUS_SERVER_TARBALL_PREFIX) + rm -fr dist/$(RADIUS_SERVER_TARBALL_PREFIX) + + rpmroot: mkdir -p $(RPMBUILD)/BUILD mkdir -p $(RPMBUILD)/RPMS @@ -155,7 +172,14 @@ rpm-ipa-client: cp rpmbuild/RPMS/*/$(PRJ_PREFIX)-client-$(CLI_VERSION)-*.rpm dist/rpms/ cp rpmbuild/SRPMS/$(PRJ_PREFIX)-client-$(CLI_VERSION)-*.src.rpm dist/srpms/ -rpms: rpmroot rpmdistdir rpm-ipa-server rpm-ipa-admin rpm-ipa-python rpm-ipa-client +rpm-ipa-radius-server: + cp dist/sources/$(RADIUS_SERVER_TARBALL) $(RPMBUILD)/SOURCES/. + rpmbuild --define "_topdir $(RPMBUILD)" -ba ipa-radius-server/ipa-radius-server.spec + cp rpmbuild/RPMS/noarch/$(PRJ_PREFIX)-radius-server-$(RADIUS_SERVER_VERSION)-*.rpm dist/rpms/ + cp rpmbuild/SRPMS/$(PRJ_PREFIX)-radius-server-$(RADIUS_SERVER_VERSION)-*.src.rpm dist/srpms/ + + +rpms: rpmroot rpmdistdir rpm-ipa-server rpm-ipa-admin rpm-ipa-python rpm-ipa-client rpm-ipa-radius-server repodata: -createrepo -p dist diff --git a/ipa-python/ipautil.py b/ipa-python/ipautil.py index 3c2b37f7..c617854e 100644 --- a/ipa-python/ipautil.py +++ b/ipa-python/ipautil.py @@ -18,6 +18,7 @@ # SHARE_DIR = "/usr/share/ipa/" +PLUGINS_SHARE_DIR = "/usr/share/ipa/plugins" import string import tempfile diff --git a/ipa-python/radius_util.py b/ipa-python/radius_util.py index 1f6e7902..40b0bd25 100644 --- a/ipa-python/radius_util.py +++ b/ipa-python/radius_util.py @@ -79,7 +79,7 @@ RADIUS_USER = 'radiusd' RADIUS_IPA_KEYTAB_FILEPATH = os.path.join(RADIUS_PKG_CONFIG_DIR, 'ipa.keytab') RADIUS_LDAP_ATTR_MAP_FILEPATH = os.path.join(RADIUS_PKG_CONFIG_DIR, 'ldap.attrmap') RADIUSD_CONF_FILEPATH = os.path.join(RADIUS_PKG_CONFIG_DIR, 'radiusd.conf') -RADIUSD_CONF_TEMPLATE_FILEPATH = os.path.join(ipautil.SHARE_DIR, 'radius.radiusd.conf.template') +RADIUSD_CONF_TEMPLATE_FILEPATH = os.path.join(ipautil.PLUGINS_SHARE_DIR, 'radius.radiusd.conf.template') RADIUSD = '/usr/sbin/radiusd' diff --git a/ipa-radius-server/Makefile b/ipa-radius-server/Makefile new file mode 100644 index 00000000..7de51b46 --- /dev/null +++ b/ipa-radius-server/Makefile @@ -0,0 +1,20 @@ +PLUGINS_SHARE = $(DESTDIR)/usr/share/ipa/plugins +PLUGINS_PYTHON = $(DESTDIR)/usr/share/ipa/ipaserver/plugins +SBINDIR = $(DESTDIR)/usr/sbin + +all: + +install: + -mkdir -p $(PLUGINS_SHARE) + -mkdir -p $(PLUGINS_PYTHON) + -mkdir -p $(PLUGINS_SBINDIR) + install -m 644 plugins/*.py $(PLUGINS_PYTHON) + install -m 644 share/*.template $(PLUGINS_SHARE) + install -m 755 ipa-radius-install $(SBINDIR) + +clean: + rm -fr *.pyc *~ + +distclean: clean + +test: \ No newline at end of file diff --git a/ipa-radius-server/ipa-radius-install b/ipa-radius-server/ipa-radius-install new file mode 100644 index 00000000..3e759d8d --- /dev/null +++ b/ipa-radius-server/ipa-radius-install @@ -0,0 +1,73 @@ +#! /usr/bin/python -E +# Authors: Karl MacMillan +# +# Copyright (C) 2007 Red Hat +# see file 'COPYING' for use and warranty information +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation; version 2 only +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +import sys +sys.path.append("/usr/share/ipa") + +import traceback, logging, krbV + +from ipaserver import installutils +from ipaserver.plugins import radiusinstance + +from ipa import ipautil + +def get_host_name(): + hostname = installutils.get_fqdn() + try: + installutils.verify_fqdn(hostname) + except RuntimeError, e: + logging.error(str(e)) + sys.exit(1) + + return hostname + +def get_realm_name(): + c = krbV.default_context() + return c.default_realm + +def main(): + if not ipautil.file_exists("/etc/ipa/ipa.conf"): + print "This system does not appear to have IPA configured." + print "Has ipa-server-install been run?" + yesno = raw_input("Continue with radius install [y/N]? ") + if yesno.lower() != "y": + sys.exit(1) + + installutils.standard_logging_setup("iparadius-install.log", False) + + host_name = get_host_name() + + realm_name = get_realm_name() + + # Create a radius instance + radius = radiusinstance.RadiusInstance() + # FIXME: ldap_server should be derived, not hardcoded to localhost, also should it be a URL? + radius.create_instance(realm_name, host_name, 'localhost') + + +try: + main() +except Exception, e: + message = "Unexpected error - see iparadius-install.log for details:\n %s" % str(e) + print message + message = str(e) + for str in traceback.format_tb(sys.exc_info()[2]): + message = message + "\n" + str + logging.debug(message) diff --git a/ipa-radius-server/ipa-radius-server.spec b/ipa-radius-server/ipa-radius-server.spec new file mode 100755 index 00000000..2b8b6162 --- /dev/null +++ b/ipa-radius-server/ipa-radius-server.spec @@ -0,0 +1,50 @@ +Name: ipa-radius-server +Version: 0.5.0 +Release: 1%{?dist} +Summary: IPA authentication server - radius plugin + +Group: System Environment/Base +License: GPL +URL: http://www.freeipa.org +Source0: %{name}-%{version}.tgz +BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) +BuildArch: noarch + +Requires: python +Requires: ipa-server +Requires: freeradius + +%description +Radius plugin for an IPA server + +%prep +%setup -q + +%install +rm -rf %{buildroot} +mkdir -p %{buildroot}%{_sbindir} + +make install DESTDIR=%{buildroot} + + +%clean +rm -rf %{buildroot} + + +%files +%defattr(-,root,root,-) +%{_sbindir}/ipa* + +%dir %{_usr}/share/ipa/plugins +%{_usr}/share/ipa/plugins/* + +%dir %{_usr}/share/ipa/ipaserver/plugins +%{_usr}/share/ipa/ipaserver/plugins/* + +%changelog +* Wed Dec 12 2007 Karl MacMillan - 0.5.0-1 +- Initial version + + + + diff --git a/ipa-radius-server/ipa-radius-server.spec.in b/ipa-radius-server/ipa-radius-server.spec.in new file mode 100755 index 00000000..5937d3b1 --- /dev/null +++ b/ipa-radius-server/ipa-radius-server.spec.in @@ -0,0 +1,50 @@ +Name: ipa-radius-server +Version: VERSION +Release: 1%{?dist} +Summary: IPA authentication server - radius plugin + +Group: System Environment/Base +License: GPL +URL: http://www.freeipa.org +Source0: %{name}-%{version}.tgz +BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) +BuildArch: noarch + +Requires: python +Requires: ipa-server +Requires: freeradius + +%description +Radius plugin for an IPA server + +%prep +%setup -q + +%install +rm -rf %{buildroot} +mkdir -p %{buildroot}%{_sbindir} + +make install DESTDIR=%{buildroot} + + +%clean +rm -rf %{buildroot} + + +%files +%defattr(-,root,root,-) +%{_sbindir}/ipa* + +%dir %{_usr}/share/ipa/plugins +%{_usr}/share/ipa/plugins/* + +%dir %{_usr}/share/ipa/ipaserver/plugins +%{_usr}/share/ipa/ipaserver/plugins/* + +%changelog +* Wed Dec 12 2007 Karl MacMillan - 0.5.0-1 +- Initial version + + + + diff --git a/ipa-radius-server/plugins/__init__.py b/ipa-radius-server/plugins/__init__.py new file mode 100644 index 00000000..636bc1a8 --- /dev/null +++ b/ipa-radius-server/plugins/__init__.py @@ -0,0 +1 @@ +# intentionally empty diff --git a/ipa-radius-server/plugins/radiusinstance.py b/ipa-radius-server/plugins/radiusinstance.py new file mode 100644 index 00000000..743a1d8a --- /dev/null +++ b/ipa-radius-server/plugins/radiusinstance.py @@ -0,0 +1,173 @@ +#! /usr/bin/python -E +# Authors: John Dennis +# +# Copyright (C) 2007 Red Hat +# see file 'COPYING' for use and warranty information +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation; version 2 or later +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +import sys +sys.path.append("/usr/share/ipa") + +import subprocess +import string +import tempfile +import shutil +import logging +import pwd +import time +import sys +from ipa.ipautil import * +from ipa import radius_util + +from ipaserver import service + +import os +import re + +IPA_RADIUS_VERSION = '0.0.0' + +# FIXME there should a utility to get the user base dn +from ipaserver.funcs import DefaultUserContainer, DefaultGroupContainer + +#------------------------------------------------------------------------------- + +def ldap_mod(fd, dn, pwd): + args = ["/usr/bin/ldapmodify", "-h", "127.0.0.1", "-xv", "-D", dn, "-w", pwd, "-f", fd.name] + run(args) + +def get_radius_version(): + version = None + try: + p = subprocess.Popen([radius_util.RADIUSD, '-v'], stdout=subprocess.PIPE, + stderr=subprocess.PIPE) + stdout, stderr = p.communicate() + status = p.returncode + + if status == 0: + match = re.search("radiusd: FreeRADIUS Version (.+), for host", stdout) + if match: + version = match.group(1) + except Exception, e: + pass + return version + + +#------------------------------------------------------------------------------- + +class RadiusInstance(service.Service): + def __init__(self): + service.Service.__init__(self, "radiusd") + self.fqdn = None + self.realm = None + self.principal = None + + def create_instance(self, realm_name, host_name, ldap_server): + self.realm = realm_name.upper() + self.suffix = realm_to_suffix(self.realm) + self.fqdn = host_name + self.ldap_server = ldap_server + self.principal = "%s/%s@%s" % (radius_util.RADIUS_SERVICE_NAME, self.fqdn, self.realm) + self.basedn = self.suffix + self.user_basedn = "%s,%s" % (DefaultUserContainer, self.basedn) # FIXME, should be utility to get this + self.radius_version = get_radius_version() + self.start_creation(4, "Configuring radiusd") + + try: + self.stop() + except: + # It could have been not running + pass + + self.__create_radius_keytab() + self.__radiusd_conf() + + try: + self.step("starting radiusd") + self.start() + except: + logging.error("radiusd service failed to start") + + self.step("configuring radiusd to start on boot") + self.chkconfig_on() + + + def __radiusd_conf(self): + self.step('configuring radiusd.conf for radius instance') + + version = 'IPA_RADIUS_VERSION=%s FREE_RADIUS_VERSION=%s' % (IPA_RADIUS_VERSION, self.radius_version) + sub_dict = {'CONFIG_FILE_VERSION_INFO' : version, + 'LDAP_SERVER' : self.ldap_server, + 'RADIUS_KEYTAB' : radius_util.RADIUS_IPA_KEYTAB_FILEPATH, + 'RADIUS_PRINCIPAL' : self.principal, + 'RADIUS_USER_BASE_DN' : self.user_basedn, + 'ACCESS_ATTRIBUTE' : '', + 'ACCESS_ATTRIBUTE_DEFAULT' : 'TRUE', + 'CLIENTS_BASEDN' : radius_util.radius_clients_basedn(None, self.suffix), + 'SUFFIX' : self.suffix, + } + try: + radiusd_conf = template_file(radius_util.RADIUSD_CONF_TEMPLATE_FILEPATH, sub_dict) + radiusd_fd = open(radius_util.RADIUSD_CONF_FILEPATH, 'w+') + radiusd_fd.write(radiusd_conf) + radiusd_fd.close() + except Exception, e: + logging.error("could not create %s: %s", radius_util.RADIUSD_CONF_FILEPATH, e) + + def __create_radius_keytab(self): + self.step("creating a keytab for radiusd") + try: + if file_exists(radius_util.RADIUS_IPA_KEYTAB_FILEPATH): + os.remove(radius_util.RADIUS_IPA_KEYTAB_FILEPATH) + except os.error: + logging.error("Failed to remove %s", radius_util.RADIUS_IPA_KEYTAB_FILEPATH) + + (kwrite, kread, kerr) = os.popen3("/usr/kerberos/sbin/kadmin.local") + kwrite.write("addprinc -randkey %s\n" % (self.principal)) + kwrite.flush() + kwrite.write("ktadd -k %s %s\n" % (radius_util.RADIUS_IPA_KEYTAB_FILEPATH, self.principal)) + kwrite.flush() + kwrite.close() + kread.close() + kerr.close() + + # give kadmin time to actually write the file before we go on + retry = 0 + while not file_exists(radius_util.RADIUS_IPA_KEYTAB_FILEPATH): + time.sleep(1) + retry += 1 + if retry > 15: + print "Error timed out waiting for kadmin to finish operations\n" + sys.exit(1) + try: + pent = pwd.getpwnam(radius_util.RADIUS_USER) + os.chown(radius_util.RADIUS_IPA_KEYTAB_FILEPATH, pent.pw_uid, pent.pw_gid) + except Exception, e: + logging.error("could not chown on %s to %s: %s", radius_util.RADIUS_IPA_KEYTAB_FILEPATH, radius_util.RADIUS_USER, e) + + #FIXME, should use IPAdmin method + def __set_ldap_encrypted_attributes(self): + ldif_file = 'encrypted_attribute.ldif' + self.step("setting ldap encrypted attributes") + ldif_txt = template_file(SHARE_DIR + ldif_file, {'ENCRYPTED_ATTRIBUTE':'radiusClientSecret'}) + ldif_fd = write_tmp_file(ldif_txt) + try: + ldap_mod(ldif_fd, "cn=Directory Manager", self.dm_password) + except subprocess.CalledProcessError, e: + logging.critical("Failed to load %s: %s" % (ldif_file, str(e))) + ldif_fd.close() + +#------------------------------------------------------------------------------- + diff --git a/ipa-radius-server/share/radius.radiusd.conf.template b/ipa-radius-server/share/radius.radiusd.conf.template new file mode 100644 index 00000000..3bc4927d --- /dev/null +++ b/ipa-radius-server/share/radius.radiusd.conf.template @@ -0,0 +1,285 @@ +# +# WARNING: This file is automatically generated, do not edit +# +# $CONFIG_FILE_VERSION_INFO +# +prefix = /usr +exec_prefix = /usr +sysconfdir = /etc +localstatedir = /var +sbindir = /usr/sbin +logdir = $${localstatedir}/log/radius +raddbdir = $${sysconfdir}/raddb +radacctdir = $${logdir}/radacct +confdir = $${raddbdir} +run_dir = $${localstatedir}/run/radiusd +db_dir = $${localstatedir}/lib/radiusd +log_file = $${logdir}/radius.log +libdir = /usr/lib +pidfile = $${run_dir}/radiusd.pid +user = radiusd +group = radiusd +max_request_time = 30 +delete_blocked_requests = no +cleanup_delay = 5 +max_requests = 1024 +bind_address = * +port = 0 +hostname_lookups = no +allow_core_dumps = no +regular_expressions = yes +extended_expressions = yes +log_stripped_names = no +log_auth = no +log_auth_badpass = no +log_auth_goodpass = no +usercollide = no +lower_user = no +lower_pass = no +nospace_user = no +nospace_pass = no +checkrad = $${sbindir}/checkrad +security { + max_attributes = 200 + reject_delay = 1 + status_server = no +} +proxy_requests = yes +$$INCLUDE $${confdir}/proxy.conf +$$INCLUDE $${confdir}/clients.conf +snmp = no +$$INCLUDE $${confdir}/snmp.conf +thread pool { + start_servers = 5 + max_servers = 32 + min_spare_servers = 3 + max_spare_servers = 10 + max_requests_per_server = 0 +} +modules { + chap { + authtype = CHAP + } + pam { + pam_auth = radiusd + } + unix { + cache = no + cache_reload = 600 + shadow = /etc/shadow + radwtmp = $${logdir}/radwtmp + } +$$INCLUDE $${confdir}/eap.conf + mschap { + } + ldap { + server = "$LDAP_SERVER" + use_sasl = yes + sasl_mech = "GSSAPI" + krb_keytab = "$RADIUS_KEYTAB" + krb_principal = "$RADIUS_PRINCIPAL" + basedn = "$RADIUS_USER_BASE_DN" + filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" + base_filter = "(objectclass=radiusprofile)" + start_tls = no + profile_attribute = "radiusProfileDn" + default_profile = "uid=ipa_default,cn=profiles,cn=radius,cn=services,cn=etc,$SUFFIX + # FIXME: we'll want to toggle the access_attr feature on/off, + # but it needs a control, so disable it for now. + #access_attr = "$ACCESS_ATTRIBUTE" + #access_attr_used_for_allow = "$ACCESS_ATTRIBUTE_DEFAULT" + dictionary_mapping = $${raddbdir}/ldap.attrmap + ldap_connections_number = 5 + edir_account_policy_check=no + timeout = 4 + timelimit = 3 + net_timeout = 1 + clients_basedn = "$CLIENTS_BASEDN" + } + realm IPASS { + format = prefix + delimiter = "/" + ignore_default = no + ignore_null = no + } + realm suffix { + format = suffix + delimiter = "@" + ignore_default = no + ignore_null = no + } + realm realmpercent { + format = suffix + delimiter = "%" + ignore_default = no + ignore_null = no + } + realm ntdomain { + format = prefix + delimiter = "\\" + ignore_default = no + ignore_null = no + } + checkval { + item-name = Calling-Station-Id + check-name = Calling-Station-Id + data-type = string + } + preprocess { + huntgroups = $${confdir}/huntgroups + hints = $${confdir}/hints + with_ascend_hack = no + ascend_channels_per_line = 23 + with_ntdomain_hack = no + with_specialix_jetstream_hack = no + with_cisco_vsa_hack = no + } + files { + usersfile = $${confdir}/users + acctusersfile = $${confdir}/acct_users + preproxy_usersfile = $${confdir}/preproxy_users + compat = no + } + detail { + detailfile = $${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d + detailperm = 0600 + } + acct_unique { + key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" + } + radutmp { + filename = $${logdir}/radutmp + username = %{User-Name} + case_sensitive = yes + check_with_nas = yes + perm = 0600 + callerid = "yes" + } + radutmp sradutmp { + filename = $${logdir}/sradutmp + perm = 0644 + callerid = "no" + } + attr_filter { + attrsfile = $${confdir}/attrs + } + counter daily { + filename = $${db_dir}/db.daily + key = User-Name + count-attribute = Acct-Session-Time + reset = daily + counter-name = Daily-Session-Time + check-name = Max-Daily-Session + allowed-servicetype = Framed-User + cache-size = 5000 + } + sqlcounter dailycounter { + counter-name = Daily-Session-Time + check-name = Max-Daily-Session + reply-name = Session-Timeout + sqlmod-inst = sql + key = User-Name + reset = daily + query = "SELECT SUM(AcctSessionTime - \ + GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ + FROM radacct WHERE UserName='%{%k}' AND \ + UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" + } + sqlcounter monthlycounter { + counter-name = Monthly-Session-Time + check-name = Max-Monthly-Session + reply-name = Session-Timeout + sqlmod-inst = sql + key = User-Name + reset = monthly + query = "SELECT SUM(AcctSessionTime - \ + GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ + FROM radacct WHERE UserName='%{%k}' AND \ + UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" + } + always fail { + rcode = fail + } + always reject { + rcode = reject + } + always ok { + rcode = ok + simulcount = 0 + mpp = no + } + expr { + } + digest { + } + exec { + wait = yes + input_pairs = request + } + exec echo { + wait = yes + program = "/bin/echo %{User-Name}" + input_pairs = request + output_pairs = reply + } + ippool main_pool { + range-start = 192.168.1.1 + range-stop = 192.168.3.254 + netmask = 255.255.255.0 + cache-size = 800 + session-db = $${db_dir}/db.ippool + ip-index = $${db_dir}/db.ipindex + override = no + maximum-timeout = 0 + } + krb5 { + keytab = "$RADIUS_KEYTAB" + service_principal = "$RADIUS_PRINCIPAL" + } +} +instantiate { + exec + expr +} +authorize { + preprocess + chap + mschap + suffix + eap + #files + ldap +} +authenticate { + Auth-Type CHAP { + chap + } + Auth-Type MS-CHAP { + mschap + } + eap + Auth-Type Kerberos { + krb5 + } +} +preacct { + preprocess + acct_unique + suffix + files +} +accounting { + detail + unix + radutmp +} +session { + radutmp +} +post-auth { +} +pre-proxy { +} +post-proxy { + eap +} diff --git a/ipa-server/ipa-install/Makefile.am b/ipa-server/ipa-install/Makefile.am index 37dd325e..8a3e4a97 100644 --- a/ipa-server/ipa-install/Makefile.am +++ b/ipa-server/ipa-install/Makefile.am @@ -9,7 +9,6 @@ sbin_SCRIPTS = \ ipa-replica-install \ ipa-replica-prepare \ ipa-server-certinstall \ - ipa-radius-install \ $(NULL) EXTRA_DIST = \ diff --git a/ipa-server/ipa-install/ipa-radius-install b/ipa-server/ipa-install/ipa-radius-install deleted file mode 100644 index 84e10e42..00000000 --- a/ipa-server/ipa-install/ipa-radius-install +++ /dev/null @@ -1,72 +0,0 @@ -#! /usr/bin/python -E -# Authors: Karl MacMillan -# -# Copyright (C) 2007 Red Hat -# see file 'COPYING' for use and warranty information -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation; version 2 only -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA -# - -import sys -sys.path.append("/usr/share/ipa") - -import traceback, logging, krbV - -from ipaserver import radiusinstance, installutils - -from ipa import ipautil - -def get_host_name(): - hostname = installutils.get_fqdn() - try: - installutils.verify_fqdn(hostname) - except RuntimeError, e: - logging.error(str(e)) - sys.exit(1) - - return hostname - -def get_realm_name(): - c = krbV.default_context() - return c.default_realm - -def main(): - if not ipautil.file_exists("/etc/ipa/ipa.conf"): - print "This system does not appear to have IPA configured." - print "Has ipa-server-install been run?" - yesno = raw_input("Continue with radius install [y/N]? ") - if yesno.lower() != "y": - sys.exit(1) - - installutils.standard_logging_setup("iparadius-install.log", False) - - host_name = get_host_name() - - realm_name = get_realm_name() - - # Create a radius instance - radius = radiusinstance.RadiusInstance() - # FIXME: ldap_server should be derived, not hardcoded to localhost, also should it be a URL? - radius.create_instance(realm_name, host_name, 'localhost') - - -try: - main() -except Exception, e: - message = "Unexpected error - see iparadius-install.log for details:\n %s" % str(e) - print message - message = str(e) - for str in traceback.format_tb(sys.exc_info()[2]): - message = message + "\n" + str - logging.debug(message) diff --git a/ipa-server/ipa-install/share/Makefile.am b/ipa-server/ipa-install/share/Makefile.am index 36837356..5d117dec 100644 --- a/ipa-server/ipa-install/share/Makefile.am +++ b/ipa-server/ipa-install/share/Makefile.am @@ -20,7 +20,6 @@ app_DATA = \ krbrealm.con.template \ ntp.conf.server.template \ preferences.html.template \ - radius.radiusd.conf.template \ referint-conf.ldif \ dna-posix.ldif \ master-entry.ldif \ diff --git a/ipa-server/ipa-install/share/radius.radiusd.conf.template b/ipa-server/ipa-install/share/radius.radiusd.conf.template deleted file mode 100644 index 3bc4927d..00000000 --- a/ipa-server/ipa-install/share/radius.radiusd.conf.template +++ /dev/null @@ -1,285 +0,0 @@ -# -# WARNING: This file is automatically generated, do not edit -# -# $CONFIG_FILE_VERSION_INFO -# -prefix = /usr -exec_prefix = /usr -sysconfdir = /etc -localstatedir = /var -sbindir = /usr/sbin -logdir = $${localstatedir}/log/radius -raddbdir = $${sysconfdir}/raddb -radacctdir = $${logdir}/radacct -confdir = $${raddbdir} -run_dir = $${localstatedir}/run/radiusd -db_dir = $${localstatedir}/lib/radiusd -log_file = $${logdir}/radius.log -libdir = /usr/lib -pidfile = $${run_dir}/radiusd.pid -user = radiusd -group = radiusd -max_request_time = 30 -delete_blocked_requests = no -cleanup_delay = 5 -max_requests = 1024 -bind_address = * -port = 0 -hostname_lookups = no -allow_core_dumps = no -regular_expressions = yes -extended_expressions = yes -log_stripped_names = no -log_auth = no -log_auth_badpass = no -log_auth_goodpass = no -usercollide = no -lower_user = no -lower_pass = no -nospace_user = no -nospace_pass = no -checkrad = $${sbindir}/checkrad -security { - max_attributes = 200 - reject_delay = 1 - status_server = no -} -proxy_requests = yes -$$INCLUDE $${confdir}/proxy.conf -$$INCLUDE $${confdir}/clients.conf -snmp = no -$$INCLUDE $${confdir}/snmp.conf -thread pool { - start_servers = 5 - max_servers = 32 - min_spare_servers = 3 - max_spare_servers = 10 - max_requests_per_server = 0 -} -modules { - chap { - authtype = CHAP - } - pam { - pam_auth = radiusd - } - unix { - cache = no - cache_reload = 600 - shadow = /etc/shadow - radwtmp = $${logdir}/radwtmp - } -$$INCLUDE $${confdir}/eap.conf - mschap { - } - ldap { - server = "$LDAP_SERVER" - use_sasl = yes - sasl_mech = "GSSAPI" - krb_keytab = "$RADIUS_KEYTAB" - krb_principal = "$RADIUS_PRINCIPAL" - basedn = "$RADIUS_USER_BASE_DN" - filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" - base_filter = "(objectclass=radiusprofile)" - start_tls = no - profile_attribute = "radiusProfileDn" - default_profile = "uid=ipa_default,cn=profiles,cn=radius,cn=services,cn=etc,$SUFFIX - # FIXME: we'll want to toggle the access_attr feature on/off, - # but it needs a control, so disable it for now. - #access_attr = "$ACCESS_ATTRIBUTE" - #access_attr_used_for_allow = "$ACCESS_ATTRIBUTE_DEFAULT" - dictionary_mapping = $${raddbdir}/ldap.attrmap - ldap_connections_number = 5 - edir_account_policy_check=no - timeout = 4 - timelimit = 3 - net_timeout = 1 - clients_basedn = "$CLIENTS_BASEDN" - } - realm IPASS { - format = prefix - delimiter = "/" - ignore_default = no - ignore_null = no - } - realm suffix { - format = suffix - delimiter = "@" - ignore_default = no - ignore_null = no - } - realm realmpercent { - format = suffix - delimiter = "%" - ignore_default = no - ignore_null = no - } - realm ntdomain { - format = prefix - delimiter = "\\" - ignore_default = no - ignore_null = no - } - checkval { - item-name = Calling-Station-Id - check-name = Calling-Station-Id - data-type = string - } - preprocess { - huntgroups = $${confdir}/huntgroups - hints = $${confdir}/hints - with_ascend_hack = no - ascend_channels_per_line = 23 - with_ntdomain_hack = no - with_specialix_jetstream_hack = no - with_cisco_vsa_hack = no - } - files { - usersfile = $${confdir}/users - acctusersfile = $${confdir}/acct_users - preproxy_usersfile = $${confdir}/preproxy_users - compat = no - } - detail { - detailfile = $${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d - detailperm = 0600 - } - acct_unique { - key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" - } - radutmp { - filename = $${logdir}/radutmp - username = %{User-Name} - case_sensitive = yes - check_with_nas = yes - perm = 0600 - callerid = "yes" - } - radutmp sradutmp { - filename = $${logdir}/sradutmp - perm = 0644 - callerid = "no" - } - attr_filter { - attrsfile = $${confdir}/attrs - } - counter daily { - filename = $${db_dir}/db.daily - key = User-Name - count-attribute = Acct-Session-Time - reset = daily - counter-name = Daily-Session-Time - check-name = Max-Daily-Session - allowed-servicetype = Framed-User - cache-size = 5000 - } - sqlcounter dailycounter { - counter-name = Daily-Session-Time - check-name = Max-Daily-Session - reply-name = Session-Timeout - sqlmod-inst = sql - key = User-Name - reset = daily - query = "SELECT SUM(AcctSessionTime - \ - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ - FROM radacct WHERE UserName='%{%k}' AND \ - UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" - } - sqlcounter monthlycounter { - counter-name = Monthly-Session-Time - check-name = Max-Monthly-Session - reply-name = Session-Timeout - sqlmod-inst = sql - key = User-Name - reset = monthly - query = "SELECT SUM(AcctSessionTime - \ - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ - FROM radacct WHERE UserName='%{%k}' AND \ - UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" - } - always fail { - rcode = fail - } - always reject { - rcode = reject - } - always ok { - rcode = ok - simulcount = 0 - mpp = no - } - expr { - } - digest { - } - exec { - wait = yes - input_pairs = request - } - exec echo { - wait = yes - program = "/bin/echo %{User-Name}" - input_pairs = request - output_pairs = reply - } - ippool main_pool { - range-start = 192.168.1.1 - range-stop = 192.168.3.254 - netmask = 255.255.255.0 - cache-size = 800 - session-db = $${db_dir}/db.ippool - ip-index = $${db_dir}/db.ipindex - override = no - maximum-timeout = 0 - } - krb5 { - keytab = "$RADIUS_KEYTAB" - service_principal = "$RADIUS_PRINCIPAL" - } -} -instantiate { - exec - expr -} -authorize { - preprocess - chap - mschap - suffix - eap - #files - ldap -} -authenticate { - Auth-Type CHAP { - chap - } - Auth-Type MS-CHAP { - mschap - } - eap - Auth-Type Kerberos { - krb5 - } -} -preacct { - preprocess - acct_unique - suffix - files -} -accounting { - detail - unix - radutmp -} -session { - radutmp -} -post-auth { -} -pre-proxy { -} -post-proxy { - eap -} diff --git a/ipa-server/ipa-server.spec b/ipa-server/ipa-server.spec index 8c8df82e..910f4627 100755 --- a/ipa-server/ipa-server.spec +++ b/ipa-server/ipa-server.spec @@ -37,7 +37,6 @@ Requires: python-krbV Requires: TurboGears Requires: python-tgexpandingformwidget Requires: acl -Requires: freeradius Requires: pyasn1 Requires: libcap diff --git a/ipa-server/ipa-server.spec.in b/ipa-server/ipa-server.spec.in index 21f46556..b0c13c06 100644 --- a/ipa-server/ipa-server.spec.in +++ b/ipa-server/ipa-server.spec.in @@ -37,7 +37,6 @@ Requires: python-krbV Requires: TurboGears Requires: python-tgexpandingformwidget Requires: acl -Requires: freeradius Requires: pyasn1 Requires: libcap diff --git a/ipa-server/ipaserver/Makefile.am b/ipa-server/ipaserver/Makefile.am index f1c094b3..b1d00a80 100644 --- a/ipa-server/ipaserver/Makefile.am +++ b/ipa-server/ipaserver/Makefile.am @@ -9,7 +9,6 @@ app_PYTHON = \ krbinstance.py \ httpinstance.py \ ntpinstance.py \ - radiusinstance.py \ webguiinstance.py \ service.py \ installutils.py \ diff --git a/ipa-server/ipaserver/radiusinstance.py b/ipa-server/ipaserver/radiusinstance.py deleted file mode 100644 index 4250b4bd..00000000 --- a/ipa-server/ipaserver/radiusinstance.py +++ /dev/null @@ -1,171 +0,0 @@ -#! /usr/bin/python -E -# Authors: John Dennis -# -# Copyright (C) 2007 Red Hat -# see file 'COPYING' for use and warranty information -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation; version 2 or later -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA -# - -import sys -import subprocess -import string -import tempfile -import shutil -import logging -import pwd -import time -import sys -from ipa.ipautil import * -from ipa import radius_util - -import service - -import os -import re - -IPA_RADIUS_VERSION = '0.0.0' - -# FIXME there should a utility to get the user base dn -from ipaserver.funcs import DefaultUserContainer, DefaultGroupContainer - -#------------------------------------------------------------------------------- - -def ldap_mod(fd, dn, pwd): - args = ["/usr/bin/ldapmodify", "-h", "127.0.0.1", "-xv", "-D", dn, "-w", pwd, "-f", fd.name] - run(args) - -def get_radius_version(): - version = None - try: - p = subprocess.Popen([radius_util.RADIUSD, '-v'], stdout=subprocess.PIPE, - stderr=subprocess.PIPE) - stdout, stderr = p.communicate() - status = p.returncode - - if status == 0: - match = re.search("radiusd: FreeRADIUS Version (.+), for host", stdout) - if match: - version = match.group(1) - except Exception, e: - pass - return version - - -#------------------------------------------------------------------------------- - -class RadiusInstance(service.Service): - def __init__(self): - service.Service.__init__(self, "radiusd") - self.fqdn = None - self.realm = None - self.principal = None - - def create_instance(self, realm_name, host_name, ldap_server): - self.realm = realm_name.upper() - self.suffix = realm_to_suffix(self.realm) - self.fqdn = host_name - self.ldap_server = ldap_server - self.principal = "%s/%s@%s" % (radius_util.RADIUS_SERVICE_NAME, self.fqdn, self.realm) - self.basedn = self.suffix - self.user_basedn = "%s,%s" % (DefaultUserContainer, self.basedn) # FIXME, should be utility to get this - self.radius_version = get_radius_version() - self.start_creation(4, "Configuring radiusd") - - try: - self.stop() - except: - # It could have been not running - pass - - self.__create_radius_keytab() - self.__radiusd_conf() - - try: - self.step("starting radiusd") - self.start() - except: - logging.error("radiusd service failed to start") - - self.step("configuring radiusd to start on boot") - self.chkconfig_on() - - - def __radiusd_conf(self): - self.step('configuring radiusd.conf for radius instance') - - version = 'IPA_RADIUS_VERSION=%s FREE_RADIUS_VERSION=%s' % (IPA_RADIUS_VERSION, self.radius_version) - sub_dict = {'CONFIG_FILE_VERSION_INFO' : version, - 'LDAP_SERVER' : self.ldap_server, - 'RADIUS_KEYTAB' : radius_util.RADIUS_IPA_KEYTAB_FILEPATH, - 'RADIUS_PRINCIPAL' : self.principal, - 'RADIUS_USER_BASE_DN' : self.user_basedn, - 'ACCESS_ATTRIBUTE' : '', - 'ACCESS_ATTRIBUTE_DEFAULT' : 'TRUE', - 'CLIENTS_BASEDN' : radius_util.radius_clients_basedn(None, self.suffix), - 'SUFFIX' : self.suffix, - } - try: - radiusd_conf = template_file(radius_util.RADIUSD_CONF_TEMPLATE_FILEPATH, sub_dict) - radiusd_fd = open(radius_util.RADIUSD_CONF_FILEPATH, 'w+') - radiusd_fd.write(radiusd_conf) - radiusd_fd.close() - except Exception, e: - logging.error("could not create %s: %s", radius_util.RADIUSD_CONF_FILEPATH, e) - - def __create_radius_keytab(self): - self.step("creating a keytab for radiusd") - try: - if file_exists(radius_util.RADIUS_IPA_KEYTAB_FILEPATH): - os.remove(radius_util.RADIUS_IPA_KEYTAB_FILEPATH) - except os.error: - logging.error("Failed to remove %s", radius_util.RADIUS_IPA_KEYTAB_FILEPATH) - - (kwrite, kread, kerr) = os.popen3("/usr/kerberos/sbin/kadmin.local") - kwrite.write("addprinc -randkey %s\n" % (self.principal)) - kwrite.flush() - kwrite.write("ktadd -k %s %s\n" % (radius_util.RADIUS_IPA_KEYTAB_FILEPATH, self.principal)) - kwrite.flush() - kwrite.close() - kread.close() - kerr.close() - - # give kadmin time to actually write the file before we go on - retry = 0 - while not file_exists(radius_util.RADIUS_IPA_KEYTAB_FILEPATH): - time.sleep(1) - retry += 1 - if retry > 15: - print "Error timed out waiting for kadmin to finish operations\n" - sys.exit(1) - try: - pent = pwd.getpwnam(radius_util.RADIUS_USER) - os.chown(radius_util.RADIUS_IPA_KEYTAB_FILEPATH, pent.pw_uid, pent.pw_gid) - except Exception, e: - logging.error("could not chown on %s to %s: %s", radius_util.RADIUS_IPA_KEYTAB_FILEPATH, radius_util.RADIUS_USER, e) - - #FIXME, should use IPAdmin method - def __set_ldap_encrypted_attributes(self): - ldif_file = 'encrypted_attribute.ldif' - self.step("setting ldap encrypted attributes") - ldif_txt = template_file(SHARE_DIR + ldif_file, {'ENCRYPTED_ATTRIBUTE':'radiusClientSecret'}) - ldif_fd = write_tmp_file(ldif_txt) - try: - ldap_mod(ldif_fd, "cn=Directory Manager", self.dm_password) - except subprocess.CalledProcessError, e: - logging.critical("Failed to load %s: %s" % (ldif_file, str(e))) - ldif_fd.close() - -#------------------------------------------------------------------------------- - -- cgit