Use Painless Security signing key

[freeradius.git] / debian / freeradius.postinst

diff --git a/debian/freeradius.postinst b/debian/freeradius.postinst
old mode 100755 (executable)
new mode 100644 (file)
index 83ffb74..4fb2af3
--- a/debian/freeradius.postinst
+++ b/debian/freeradius.postinst
@@ -2,81 +2,84 @@
 
 set -e
 
-new_install()
-{
-       # On a fresh install, add the necessary user and group.
-       if ! id freerad >/dev/null 2>&1; then
-               addgroup --system freerad || true
-               groups freerad 2>/dev/null || adduser --system --no-create-home --home /etc/freeradius --ingroup freerad --disabled-password freerad
+case "$1" in
+  configure)
+        if [ -z "$2" ]; then
+          # Changed in 1.1.5-1 for new installs (we used to start at S50
+          # and stop at K50)  We now start at S50 and stop at K19 so we
+          # start after services which may be used and stop before them.
+          update-rc.d freeradius start 50 2 3 4 5 . stop 19 0 1 6 . >/dev/null
 
-               # Put user freerad in group shadow, so the daemon can auth
-               # locally. Only do this on fresh install as the admin may not
-               # want freerad in shadow group if authenticating by another
-               # mechanism.
-               adduser freerad shadow
-       fi
+          # Set up initial permissions on all the freeradius directories
 
-       # Changed in 1.1.5-1 for new installs (we used to start at S50
-       # and stop at K50)  We now start at S50 and stop at K19 so we
-       # start after services which may be used and stop before them.
-       update-rc.d freeradius start 50 2 3 4 5 . stop 19 0 1 6 . >/dev/null
+          if ! dpkg-statoverride --list | grep -q /var/run/freeradius$; then
+            mkdir -p /var/run/freeradius
+            dpkg-statoverride --add --update freerad freerad 0755 /var/run/freeradius
+          fi
 
-       # Set up initial permissions on all the FreeRADIUS directories.
-       if [ ! -d /var/log/freeradius ]; then
-               mkdir -p /var/log/freeradius
-       fi
+          if ! dpkg-statoverride --list | grep -q /var/log/freeradius$; then
+            mkdir -p /var/log/freeradius
+            dpkg-statoverride --add --update freerad freerad 0750 /var/log/freeradius
+          fi
 
-       if [ ! -f /var/log/freeradius/radius.log ]; then
-               touch /var/log/freeradius/radius.log
-       fi
+          for file in radius.log radwtmp; do
+            [ ! -f "/var/log/freeradius/${file}" ] && install -o freerad -g freerad -m 644 /dev/null /var/log/freeradius/${file}
+          done
 
-       if [ ! -f /var/log/freeradius/radwtmp ]; then
-               touch /var/log/freeradius/radwtmp
-       fi
+          for file in /etc/freeradius/mods-config/files/pre-proxy \
+            /etc/freeradius/mods-config/files/accounting \
+            /etc/freeradius/mods-config/preprocess/huntgroups \
+            /etc/freeradius/mods-config/preprocess/hints \
+            /etc/freeradius/experimental.conf \
+            /etc/freeradius/proxy.conf \
+            /etc/freeradius/clients.conf
+          do
+            if ! dpkg-statoverride --list | grep -qw $file$; then
+              dpkg-statoverride --add --update root freerad 0640 $file
+            fi
+          done
 
-       if [ ! -d /var/run/freeradius ]; then
-               mkdir /var/run/freeradius
-       fi
+          for dir in /etc/freeradius/certs \
+            /etc/freeradius/sites-available \
+            /etc/freeradius/sites-enabled \
+            /etc/freeradius/mods-config/attr_filter \
+            /etc/freeradius/policy.d
+          do
+            if ! dpkg-statoverride --list | grep -qw $dir$; then
+              dpkg-statoverride --add --update freerad freerad 2751 $dir
+            fi
+          done
 
-       chown -R freerad:freerad /var/log/freeradius
-       chown -R freerad:freerad /var/run/freeradius
-       chgrp -R freerad /etc/freeradius
-       find /etc/freeradius -type d -print0 | xargs -0 chmod 2750
-       find /etc/freeradius -type f -print0 | xargs -0 chmod 0640
+          action="start"
+        else
+          action="restart"
+        fi
 
-       # Relax permissions on local dictionary: it should not contain
-       # secrets, and this allows to run radclient with a non-privileged
-       # user. At any rate, only do it on fresh install.
-       chmod 2751 /etc/freeradius
-       chmod 0644 /etc/freeradius/dictionary
-}
+        if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+          invoke-rc.d freeradius $action || true
+        else
+          /etc/init.d/freeradius $action
+        fi
+        ;;
 
-case "$1" in
-  configure)
-       if [ -z "$2" ]; then
-               new_install
-               action="start"
-       else
-               action="restart"
-       fi
-
-       if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
-               invoke-rc.d freeradius $action || true
-       else
-               /etc/init.d/freeradius $action
-       fi
-       ;;
   abort-upgrade)
-       ;;
+        if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+          invoke-rc.d freeradius restart || true
+        else
+          /etc/init.d/freeradius restart
+        fi
+        ;;
+
   abort-remove)
-       if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
-               invoke-rc.d freeradius start || true
-       else
-               /etc/init.d/freeradius start
-       fi
-       ;;
+        if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+          invoke-rc.d freeradius start || true
+        else
+          /etc/init.d/freeradius start
+        fi
+        ;;
+
   abort-deconfigure)
-       ;;
+        ;;
 esac
 
 #DEBHELPER#