From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Tue, 9 Sep 2014 01:56:28 +0000 (-0400)
Subject: Generate snakeoil certs on package install (debian)
X-Git-Tag: release_3_0_5~589
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=481e0f2a2ad2532bd2000785a21ae2525257d1d9;p=thirdparty%2Ffreeradius-server.git

Generate snakeoil certs on package install (debian)
---

diff --git a/debian/freeradius-config.postinst b/debian/freeradius-config.postinst
index 87d645556be..6dc9156d3f4 100644
--- a/debian/freeradius-config.postinst
+++ b/debian/freeradius-config.postinst
@@ -18,6 +18,9 @@ case "$1" in
           if ! dpkg-statoverride --list | grep -qw /etc/freeradius/dictionary$; then
             dpkg-statoverride --add --update root freerad 0644 /etc/freeradius/dictionary
           fi
+
+          # Create snakoil certificates on initial install
+          make -C /etc/freeradius/certs/
         fi
         ;;
 esac
diff --git a/debian/freeradius.postinst b/debian/freeradius.postinst
index 7d05d1aa6f4..4265cac223d 100755
--- a/debian/freeradius.postinst
+++ b/debian/freeradius.postinst
@@ -66,62 +66,13 @@ case "$1" in
           done
         fi
 
-	# Create stub SSL certificate file that became necessary in 2.1.8,
-	# with analogous disclaimers, because the admin may yet choose to
-	# switch to /usr/share/doc/freeradius/examples/certs/ stuff.
-        if [ -z "$2" ] || dpkg --compare-versions "$2" lt 2.1.8+dfsg-1; then
-          if egrep -q '^[ 	]*\$INCLUDE eap.conf' /etc/freeradius/radiusd.conf && \
-             egrep -q '^[ 	]*certdir = \${confdir}/certs' /etc/freeradius/modules/eap && \
-             egrep -q '^[ 	]*cadir = \${confdir}/certs' /etc/freeradius/modules/eap
-          then
-            echo "Updating default SSL certificate settings, if any..." >&2
-            test -d /etc/freeradius/certs || mkdir /etc/freeradius/certs
-            if test ! -e /etc/ssl/certs/ssl-cert-snakeoil.pem || \
-               test ! -e /etc/ssl/private/ssl-cert-snakeoil.key
-            then
-               make-ssl-cert generate-default-snakeoil
-            fi
-            if egrep -q '^[ 	]*certificate_file = \${certdir}/server.pem' /etc/freeradius/modules/eap && \
-               test ! -f /etc/freeradius/certs/server.pem
-            then
-              serverpem=wasnotthere
-	      ln -s /etc/ssl/certs/ssl-cert-snakeoil.pem /etc/freeradius/certs/server.pem
-	    fi
-            if egrep -q '^[ 	]*private_key_file = \${certdir}/server.pem' /etc/freeradius/modules/eap && \
-               [ "$serverpem" = "wasnotthere" ]
-            then
-	      ln -s /etc/ssl/private/ssl-cert-snakeoil.key /etc/freeradius/certs/server.key
-	      sed -i -e 's,^\([ 	]*private_key_file = \${certdir}\)/server.pem$,\1/server.key,' /etc/freeradius/modules/eap
-	      if getent group ssl-cert >/dev/null; then
-                # freeradius-common dependency also provides us with adduser
-	        adduser --quiet freerad ssl-cert
-	      fi
-	    fi
-            if egrep -q '^[ 	]*ca_file = \${cadir}/ca.pem' /etc/freeradius/modules/eap && \
-               test ! -f /etc/freeradius/certs/ca.pem
-            then
-	      ln -s /etc/ssl/certs/ca.pem /etc/freeradius/certs/ca.pem
-	    fi
-            if egrep -q '^[ 	]*random_file = \${certdir}/random' /etc/freeradius/modules/eap && \
-               test ! -f /etc/freeradius/certs/random
-            then
-	      ln -s /dev/urandom /etc/freeradius/certs/random
-	    fi
-            if egrep -q '^[ 	]*dh_file = \${certdir}/dh' /etc/freeradius/modules/eap && \
-               test ! -f /etc/freeradius/certs/dh
-            then
-              # ssl-cert dependency also provides us with openssl
-	      openssl dhparam -out /etc/freeradius/certs/dh 1024
-	    fi
-	  fi
-	fi
-
         if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
           invoke-rc.d freeradius $action || true
         else
           /etc/init.d/freeradius $action
         fi
         ;;
+
   abort-upgrade)
         if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
           invoke-rc.d freeradius restart || true
@@ -129,6 +80,7 @@ case "$1" in
           /etc/init.d/freeradius restart
         fi
         ;;
+
   abort-remove)
         if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
           invoke-rc.d freeradius start || true
@@ -136,6 +88,7 @@ case "$1" in
           /etc/init.d/freeradius start
         fi
         ;;
+
   abort-deconfigure)
         ;;
 esac
diff --git a/debian/rules b/debian/rules
index cdfc1d0cf85..cd816dbe2fe 100755
--- a/debian/rules
+++ b/debian/rules
@@ -145,7 +145,7 @@ install-arch: build-arch-stamp
 	dh_installdirs
 	test -d $(freeradius_dir)/usr/lib/freeradius || mkdir -p $(freeradius_dir)/usr/lib/freeradius
 	ln -fs rlm_sql.so $(freeradius_dir)/usr/lib/freeradius/librlm_sql.so
-	$(MAKE) install R=$(freeradius_dir)
+	$(MAKE) install R=$(freeradius_dir) PACKAGE='debian'
 
 	# rename radius binary to play nicely with others
 	mv $(freeradius_dir)/usr/sbin/radiusd $(freeradius_dir)/usr/sbin/$(package)
diff --git a/raddb/all.mk b/raddb/all.mk
index 87301a99b3c..25602a890da 100644
--- a/raddb/all.mk
+++ b/raddb/all.mk
@@ -112,6 +112,7 @@ $(R)$(raddbdir)/users: $(R)$(modconfdir)/files/authorize
 	@[ -e $@ ] || echo LN-S $(patsubst $(R)$(raddbdir)/%,raddb/%,$@)
 	@[ -e $@ ] || ln -s $(patsubst $(R)$(raddbdir)/%,./%,$<) $@
 
+ifeq ("$(PACKAGE)","")
 $(LOCAL_CERT_PRODUCTS):
 	@echo BOOTSTRAP raddb/certs/
 	@$(MAKE) -C $(R)$(raddbdir)/certs/
@@ -120,6 +121,11 @@ $(LOCAL_CERT_PRODUCTS):
 $(R)$(raddbdir)/certs/bootstrap: | raddb/certs/bootstrap $(LOCAL_CERT_PRODUCTS)
 	@echo INSTALL $(patsubst $(R)$(raddbdir)/%,raddb/%,$@)
 	@$(INSTALL) -m 750 $(patsubst $(R)$(raddbdir)/%,raddb/%,$@) $@
+else
+$(R)$(raddbdir)/certs/bootstrap:
+	@echo INSTALL $(patsubst $(R)$(raddbdir)/%,raddb/%,$@)
+	@$(INSTALL) -m 750 $(patsubst $(R)$(raddbdir)/%,raddb/%,$@) $@
+endif
 
 #  List directories before the file targets.
 #  It's not clear why GNU Make doesn't deal well with this.