Generate snakeoil certs on package install (debian)

diff --git a/debian/freeradius-config.postinst b/debian/freeradius-config.postinst
index 87d645556be5f586b807b7e9c12ccc8d85227286..6dc9156d3f43db501acaa92539ffc2f541a5bbe8 100644 (file)
--- a/debian/freeradius-config.postinst
+++ b/debian/freeradius-config.postinst
@@ -18,6 +18,9 @@ case "$1" in
           if ! dpkg-statoverride --list | grep -qw /etc/freeradius/dictionary$; then
             dpkg-statoverride --add --update root freerad 0644 /etc/freeradius/dictionary
           fi
+
+          # Create snakoil certificates on initial install
+          make -C /etc/freeradius/certs/
         fi
         ;;
 esac

diff --git a/debian/freeradius.postinst b/debian/freeradius.postinst
index 7d05d1aa6f46d0b0d46c8ad72a7993e094163565..4265cac223d14335eca2e635eb4d066f2db4d623 100755 (executable)
--- a/debian/freeradius.postinst
+++ b/debian/freeradius.postinst
@@ -66,62 +66,13 @@ case "$1" in
           done
         fi
 
-       # Create stub SSL certificate file that became necessary in 2.1.8,
-       # with analogous disclaimers, because the admin may yet choose to
-       # switch to /usr/share/doc/freeradius/examples/certs/ stuff.
-        if [ -z "$2" ] || dpkg --compare-versions "$2" lt 2.1.8+dfsg-1; then
-          if egrep -q '^[      ]*\$INCLUDE eap.conf' /etc/freeradius/radiusd.conf && \
-             egrep -q '^[      ]*certdir = \${confdir}/certs' /etc/freeradius/modules/eap && \
-             egrep -q '^[      ]*cadir = \${confdir}/certs' /etc/freeradius/modules/eap
-          then
-            echo "Updating default SSL certificate settings, if any..." >&2
-            test -d /etc/freeradius/certs || mkdir /etc/freeradius/certs
-            if test ! -e /etc/ssl/certs/ssl-cert-snakeoil.pem || \
-               test ! -e /etc/ssl/private/ssl-cert-snakeoil.key
-            then
-               make-ssl-cert generate-default-snakeoil
-            fi
-            if egrep -q '^[    ]*certificate_file = \${certdir}/server.pem' /etc/freeradius/modules/eap && \
-               test ! -f /etc/freeradius/certs/server.pem
-            then
-              serverpem=wasnotthere
-             ln -s /etc/ssl/certs/ssl-cert-snakeoil.pem /etc/freeradius/certs/server.pem
-           fi
-            if egrep -q '^[    ]*private_key_file = \${certdir}/server.pem' /etc/freeradius/modules/eap && \
-               [ "$serverpem" = "wasnotthere" ]
-            then
-             ln -s /etc/ssl/private/ssl-cert-snakeoil.key /etc/freeradius/certs/server.key
-             sed -i -e 's,^\([         ]*private_key_file = \${certdir}\)/server.pem$,\1/server.key,' /etc/freeradius/modules/eap
-             if getent group ssl-cert >/dev/null; then
-                # freeradius-common dependency also provides us with adduser
-               adduser --quiet freerad ssl-cert
-             fi
-           fi
-            if egrep -q '^[    ]*ca_file = \${cadir}/ca.pem' /etc/freeradius/modules/eap && \
-               test ! -f /etc/freeradius/certs/ca.pem
-            then
-             ln -s /etc/ssl/certs/ca.pem /etc/freeradius/certs/ca.pem
-           fi
-            if egrep -q '^[    ]*random_file = \${certdir}/random' /etc/freeradius/modules/eap && \
-               test ! -f /etc/freeradius/certs/random
-            then
-             ln -s /dev/urandom /etc/freeradius/certs/random
-           fi
-            if egrep -q '^[    ]*dh_file = \${certdir}/dh' /etc/freeradius/modules/eap && \
-               test ! -f /etc/freeradius/certs/dh
-            then
-              # ssl-cert dependency also provides us with openssl
-             openssl dhparam -out /etc/freeradius/certs/dh 1024
-           fi
-         fi
-       fi
-
         if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
           invoke-rc.d freeradius $action || true
         else
           /etc/init.d/freeradius $action
         fi
         ;;
+
   abort-upgrade)
         if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
           invoke-rc.d freeradius restart || true
@@ -129,6 +80,7 @@ case "$1" in
           /etc/init.d/freeradius restart
         fi
         ;;
+
   abort-remove)
         if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
           invoke-rc.d freeradius start || true
@@ -136,6 +88,7 @@ case "$1" in
           /etc/init.d/freeradius start
         fi
         ;;
+
   abort-deconfigure)
         ;;
 esac

diff --git a/debian/rules b/debian/rules
index cdfc1d0cf85e0dc35837b74e9cc7aa54771a5c78..cd816dbe2fe87957e815e329b1141b0118a3b4c3 100755 (executable)
--- a/debian/rules
+++ b/debian/rules
@@ -145,7 +145,7 @@ install-arch: build-arch-stamp
        dh_installdirs
        test -d $(freeradius_dir)/usr/lib/freeradius || mkdir -p $(freeradius_dir)/usr/lib/freeradius
        ln -fs rlm_sql.so $(freeradius_dir)/usr/lib/freeradius/librlm_sql.so
-       $(MAKE) install R=$(freeradius_dir)
+       $(MAKE) install R=$(freeradius_dir) PACKAGE='debian'
 
        # rename radius binary to play nicely with others
        mv $(freeradius_dir)/usr/sbin/radiusd $(freeradius_dir)/usr/sbin/$(package)

diff --git a/raddb/all.mk b/raddb/all.mk
index 87301a99b3cc75533115d01ac9ff0ca179b29781..25602a890da9562856fc7c456a52a41f864c7d53 100644 (file)
--- a/raddb/all.mk
+++ b/raddb/all.mk
@@ -112,6 +112,7 @@ $(R)$(raddbdir)/users: $(R)$(modconfdir)/files/authorize
        @[ -e $@ ] || echo LN-S $(patsubst $(R)$(raddbdir)/%,raddb/%,$@)
        @[ -e $@ ] || ln -s $(patsubst $(R)$(raddbdir)/%,./%,$<) $@
 
+ifeq ("$(PACKAGE)","")
 $(LOCAL_CERT_PRODUCTS):
        @echo BOOTSTRAP raddb/certs/
        @$(MAKE) -C $(R)$(raddbdir)/certs/
@@ -120,6 +121,11 @@ $(LOCAL_CERT_PRODUCTS):
 $(R)$(raddbdir)/certs/bootstrap: | raddb/certs/bootstrap $(LOCAL_CERT_PRODUCTS)
        @echo INSTALL $(patsubst $(R)$(raddbdir)/%,raddb/%,$@)
        @$(INSTALL) -m 750 $(patsubst $(R)$(raddbdir)/%,raddb/%,$@) $@
+else
+$(R)$(raddbdir)/certs/bootstrap:
+       @echo INSTALL $(patsubst $(R)$(raddbdir)/%,raddb/%,$@)
+       @$(INSTALL) -m 750 $(patsubst $(R)$(raddbdir)/%,raddb/%,$@) $@
+endif
 
 #  List directories before the file targets.
 #  It's not clear why GNU Make doesn't deal well with this.