debian/freeradius.postinst

   1 #! /bin/sh
   2
   3 set -e
   4
   5 case "$1" in
   6   configure)
   7         if [ -z "$2" ]; then
   8           # Changed in 1.1.5-1 for new installs (we used to start at S50
   9           # and stop at K50)  We now start at S50 and stop at K19 so we
  10           # start after services which may be used and stop before them.
  11           update-rc.d freeradius start 50 2 3 4 5 . stop 19 0 1 6 . >/dev/null
  12
  13           # Set up initial permissions on all the freeradius directories
  14
  15           if ! dpkg-statoverride --list | grep -q /var/run/freeradius$; then
  16             dpkg-statoverride --add --update freerad freerad 0755 /var/run/freeradius
  17           fi
  18
  19           if ! dpkg-statoverride --list | grep -q /var/log/freeradius$; then
  20             dpkg-statoverride --add --update freerad freerad 0750 /var/log/freeradius
  21           fi
  22
  23           for file in radius.log radwtmp; do
  24             [ ! -f "/var/log/freeradius/${file}" ] && install -o freerad -g freerad -m 644 /dev/null /var/log/freeradius/${file}
  25           done
  26
  27           for file in /etc/freeradius/preproxy_users \
  28             /etc/freeradius/experimental.conf \
  29             /etc/freeradius/huntgroups \
  30             /etc/freeradius/proxy.conf \
  31             /etc/freeradius/attrs.pre-proxy \
  32             /etc/freeradius/hints \
  33             /etc/freeradius/attrs \
  34             /etc/freeradius/policy.txt \
  35             /etc/freeradius/attrs.accounting_response \
  36             /etc/freeradius/attrs.access_reject \
  37             /etc/freeradius/attrs.access_challenge \
  38             /etc/freeradius/clients.conf \
  39             /etc/freeradius/acct_users
  40           do
  41             if ! dpkg-statoverride --list | grep -qw $file$; then
  42               dpkg-statoverride --add --update root freerad 0640 $file
  43             fi
  44           done
  45
  46           for dir in /etc/freeradius/certs/ \
  47             /etc/freeradius/sites-available/ \
  48             /etc/freeradius/sites-enabled/ \
  49             /etc/freeradius/policy.d/
  50           do
  51             if ! dpkg-statoverride --list | grep -qw $dir$; then
  52               dpkg-statoverride --add --update freerad freerad 2751 $dir
  53             fi
  54           done
  55
  56           action="start"
  57         else
  58           action="restart"
  59         fi
  60
  61         # Create links for default sites, but only if this is an initial
  62         # install or an upgrade from before there were links; users may
  63         # want to remove them...
  64         if [ -z "$2" ] || dpkg --compare-versions "$2" lt 2.0.4+dfsg-4; then
  65           for site in default inner-tunnel; do
  66             if [ ! -e /etc/freeradius/sites-enabled/$site ]; then
  67               ln -s ../sites-available/$site /etc/freeradius/sites-enabled/$site
  68             fi
  69           done
  70         fi
  71
  72         # Create stub SSL certificate file that became necessary in 2.1.8,
  73         # with analogous disclaimers, because the admin may yet choose to
  74         # switch to /usr/share/doc/freeradius/examples/certs/ stuff.
  75         if [ -z "$2" ] || dpkg --compare-versions "$2" lt 2.1.8+dfsg-1; then
  76           if egrep -q '^[       ]*\$INCLUDE eap.conf' /etc/freeradius/radiusd.conf && \
  77              egrep -q '^[       ]*certdir = \${confdir}/certs' /etc/freeradius/modules/eap && \
  78              egrep -q '^[       ]*cadir = \${confdir}/certs' /etc/freeradius/modules/eap
  79           then
  80             echo "Updating default SSL certificate settings, if any..." >&2
  81             test -d /etc/freeradius/certs || mkdir /etc/freeradius/certs
  82             if test ! -e /etc/ssl/certs/ssl-cert-snakeoil.pem || \
  83                test ! -e /etc/ssl/private/ssl-cert-snakeoil.key
  84             then
  85                make-ssl-cert generate-default-snakeoil
  86             fi
  87             if egrep -q '^[     ]*certificate_file = \${certdir}/server.pem' /etc/freeradius/modules/eap && \
  88                test ! -f /etc/freeradius/certs/server.pem
  89             then
  90               serverpem=wasnotthere
  91               ln -s /etc/ssl/certs/ssl-cert-snakeoil.pem /etc/freeradius/certs/server.pem
  92             fi
  93             if egrep -q '^[     ]*private_key_file = \${certdir}/server.pem' /etc/freeradius/modules/eap && \
  94                [ "$serverpem" = "wasnotthere" ]
  95             then
  96               ln -s /etc/ssl/private/ssl-cert-snakeoil.key /etc/freeradius/certs/server.key
  97               sed -i -e 's,^\([         ]*private_key_file = \${certdir}\)/server.pem$,\1/server.key,' /etc/freeradius/modules/eap
  98               if getent group ssl-cert >/dev/null; then
  99                 # freeradius-common dependency also provides us with adduser
 100                 adduser --quiet freerad ssl-cert
 101               fi
 102             fi
 103             if egrep -q '^[     ]*CA_file = \${cadir}/ca.pem' /etc/freeradius/modules/eap && \
 104                test ! -f /etc/freeradius/certs/ca.pem
 105             then
 106               ln -s /etc/ssl/certs/ca.pem /etc/freeradius/certs/ca.pem
 107             fi
 108             if egrep -q '^[     ]*random_file = \${certdir}/random' /etc/freeradius/modules/eap && \
 109                test ! -f /etc/freeradius/certs/random
 110             then
 111               ln -s /dev/urandom /etc/freeradius/certs/random
 112             fi
 113             if egrep -q '^[     ]*dh_file = \${certdir}/dh' /etc/freeradius/modules/eap && \
 114                test ! -f /etc/freeradius/certs/dh
 115             then
 116               # ssl-cert dependency also provides us with openssl
 117               openssl dhparam -out /etc/freeradius/certs/dh 1024
 118             fi
 119           fi
 120         fi
 121
 122         if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
 123           invoke-rc.d freeradius $action || true
 124         else
 125           /etc/init.d/freeradius $action
 126         fi
 127         ;;
 128   abort-upgrade)
 129         if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
 130           invoke-rc.d freeradius restart || true
 131         else
 132           /etc/init.d/freeradius restart
 133         fi
 134         ;;
 135   abort-remove)
 136         if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
 137           invoke-rc.d freeradius start || true
 138         else
 139           /etc/init.d/freeradius start
 140         fi
 141         ;;
 142   abort-deconfigure)
 143         ;;
 144 esac
 145
 146 #DEBHELPER#
 147
 148 exit 0