debian/freeradius.postinst

   1 #! /bin/sh
   2
   3 set -e
   4
   5 case "$1" in
   6   configure)
   7         if [ -z "$2" ]; then
   8           # Changed in 1.1.5-1 for new installs (we used to start at S50
   9           # and stop at K50)  We now start at S50 and stop at K19 so we
  10           # start after services which may be used and stop before them.
  11           update-rc.d freeradius start 50 2 3 4 5 . stop 19 0 1 6 . >/dev/null
  12
  13           # Set up initial permissions on all the freeradius directories
  14
  15           if ! dpkg-statoverride --list | grep -q /var/run/freeradius$; then
  16             dpkg-statoverride --add --update freerad freerad 0755 /var/run/freeradius
  17           fi
  18
  19           if ! dpkg-statoverride --list | grep -q /var/log/freeradius$; then
  20             dpkg-statoverride --add --update freerad freerad 0750 /var/log/freeradius
  21           fi
  22
  23           for file in radius.log radwtmp; do
  24             [ ! -f "/var/log/freeradius/${file}" ] && install -o freerad -g freerad -m 644 /dev/null /var/log/freeradius/${file}
  25           done
  26
  27           for file in /etc/freeradius/preproxy_users \
  28             /etc/freeradius/policy.conf \
  29             /etc/freeradius/experimental.conf \
  30             /etc/freeradius/huntgroups \
  31             /etc/freeradius/proxy.conf \
  32             /etc/freeradius/attrs.pre-proxy \
  33             /etc/freeradius/hints \
  34             /etc/freeradius/ldap.attrmap \
  35             /etc/freeradius/attrs \
  36             /etc/freeradius/policy.txt \
  37             /etc/freeradius/attrs.accounting_response \
  38             /etc/freeradius/attrs.access_reject \
  39             /etc/freeradius/attrs.access_challenge \
  40             /etc/freeradius/clients.conf \
  41             /etc/freeradius/acct_users
  42           do
  43             if ! dpkg-statoverride --list | grep -qw $file$; then
  44               dpkg-statoverride --add --update root freerad 0640 $file
  45             fi
  46           done
  47
  48           for dir in /etc/freeradius/certs/ \
  49             /etc/freeradius/sites-available/ \
  50             /etc/freeradius/sites-enabled/
  51           do
  52             if ! dpkg-statoverride --list | grep -qw $dir$; then
  53               dpkg-statoverride --add --update freerad freerad 2751 $dir
  54             fi
  55           done
  56
  57           action="start"
  58         else
  59           action="restart"
  60         fi
  61
  62         # Create links for default sites, but only if this is an initial
  63         # install or an upgrade from before there were links; users may
  64         # want to remove them...
  65         if [ -z "$2" ] || dpkg --compare-versions "$2" lt 2.0.4+dfsg-4; then
  66           for site in default inner-tunnel; do
  67             if [ ! -e /etc/freeradius/sites-enabled/$site ]; then
  68               ln -s ../sites-available/$site /etc/freeradius/sites-enabled/$site
  69             fi
  70           done
  71         fi
  72
  73         # Create stub SSL certificate file that became necessary in 2.1.8,
  74         # with analogous disclaimers, because the admin may yet choose to
  75         # switch to /usr/share/doc/freeradius/examples/certs/ stuff.
  76         if [ -z "$2" ] || dpkg --compare-versions "$2" lt 2.1.8+dfsg-1; then
  77           if egrep -q '^[       ]*\$INCLUDE eap.conf' /etc/freeradius/radiusd.conf && \
  78              egrep -q '^[       ]*certdir = \${confdir}/certs' /etc/freeradius/modules/eap && \
  79              egrep -q '^[       ]*cadir = \${confdir}/certs' /etc/freeradius/modules/eap
  80           then
  81             echo "Updating default SSL certificate settings, if any..." >&2
  82             test -d /etc/freeradius/certs || mkdir /etc/freeradius/certs
  83             if test ! -e /etc/ssl/certs/ssl-cert-snakeoil.pem || \
  84                test ! -e /etc/ssl/private/ssl-cert-snakeoil.key
  85             then
  86                make-ssl-cert generate-default-snakeoil
  87             fi
  88             if egrep -q '^[     ]*certificate_file = \${certdir}/server.pem' /etc/freeradius/modules/eap && \
  89                test ! -f /etc/freeradius/certs/server.pem
  90             then
  91               serverpem=wasnotthere
  92               ln -s /etc/ssl/certs/ssl-cert-snakeoil.pem /etc/freeradius/certs/server.pem
  93             fi
  94             if egrep -q '^[     ]*private_key_file = \${certdir}/server.pem' /etc/freeradius/modules/eap && \
  95                [ "$serverpem" = "wasnotthere" ]
  96             then
  97               ln -s /etc/ssl/private/ssl-cert-snakeoil.key /etc/freeradius/certs/server.key
  98               sed -i -e 's,^\([         ]*private_key_file = \${certdir}\)/server.pem$,\1/server.key,' /etc/freeradius/modules/eap
  99               if getent group ssl-cert >/dev/null; then
 100                 # freeradius-common dependency also provides us with adduser
 101                 adduser --quiet freerad ssl-cert
 102               fi
 103             fi
 104             if egrep -q '^[     ]*CA_file = \${cadir}/ca.pem' /etc/freeradius/modules/eap && \
 105                test ! -f /etc/freeradius/certs/ca.pem
 106             then
 107               ln -s /etc/ssl/certs/ca.pem /etc/freeradius/certs/ca.pem
 108             fi
 109             if egrep -q '^[     ]*random_file = \${certdir}/random' /etc/freeradius/modules/eap && \
 110                test ! -f /etc/freeradius/certs/random
 111             then
 112               ln -s /dev/urandom /etc/freeradius/certs/random
 113             fi
 114             if egrep -q '^[     ]*dh_file = \${certdir}/dh' /etc/freeradius/modules/eap && \
 115                test ! -f /etc/freeradius/certs/dh
 116             then
 117               # ssl-cert dependency also provides us with openssl
 118               openssl dhparam -out /etc/freeradius/certs/dh 1024
 119             fi
 120           fi
 121         fi
 122
 123         if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
 124           invoke-rc.d freeradius $action || true
 125         else
 126           /etc/init.d/freeradius $action
 127         fi
 128         ;;
 129   abort-upgrade)
 130         if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
 131           invoke-rc.d freeradius restart || true
 132         else
 133           /etc/init.d/freeradius restart
 134         fi
 135         ;;
 136   abort-remove)
 137         if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
 138           invoke-rc.d freeradius start || true
 139         else
 140           /etc/init.d/freeradius start
 141         fi
 142         ;;
 143   abort-deconfigure)
 144         ;;
 145 esac
 146
 147 #DEBHELPER#
 148
 149 exit 0