From: Reto Buerki Date: Mon, 19 Nov 2012 16:17:38 +0000 (+0100) Subject: Adapt host configuration X-Git-Tag: 5.0.2rc1~1^2~101 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=766466b8d114e6e594955198fa848536b8fd88ae;p=thirdparty%2Fstrongswan.git Adapt host configuration Adapt the configuration of the test hosts to the new Debian-based system. --- diff --git a/testing/hosts/alice/etc/conf.d/hostname b/testing/hosts/alice/etc/conf.d/hostname deleted file mode 100644 index 2012e0451a..0000000000 --- a/testing/hosts/alice/etc/conf.d/hostname +++ /dev/null @@ -1 +0,0 @@ -HOSTNAME=alice diff --git a/testing/hosts/alice/etc/conf.d/net b/testing/hosts/alice/etc/conf.d/net deleted file mode 100644 index 41e8887c47..0000000000 --- a/testing/hosts/alice/etc/conf.d/net +++ /dev/null @@ -1,12 +0,0 @@ -# /etc/conf.d/net: - -# This is basically the ifconfig argument without the ifconfig $iface -# -config_eth0=( "PH_IP_ALICE broadcast 10.1.255.255 netmask 255.255.0.0" - "PH_IP6_ALICE/16" ) -config_eth1=( "PH_IP_ALICE1 broadcast 192.168.0.255 netmask 255.255.255.0" - "PH_IP6_ALICE1/16" ) - -# For setting the default gateway -# -routes_eth0=( "default via PH_IP_MOON1" ) diff --git a/testing/hosts/alice/etc/freeradius/clients.conf b/testing/hosts/alice/etc/freeradius/clients.conf new file mode 100644 index 0000000000..5fb47a2add --- /dev/null +++ b/testing/hosts/alice/etc/freeradius/clients.conf @@ -0,0 +1,4 @@ +client 10.1.0.1 { + secret = gv6URkSs + shortname = moon +} diff --git a/testing/hosts/alice/etc/freeradius/dictionary b/testing/hosts/alice/etc/freeradius/dictionary new file mode 100644 index 0000000000..59a874b3e9 --- /dev/null +++ b/testing/hosts/alice/etc/freeradius/dictionary @@ -0,0 +1,32 @@ +# +# This is the master dictionary file, which references the +# pre-defined dictionary files included with the server. +# +# Any new/changed attributes MUST be placed in this file, as +# the pre-defined dictionaries SHOULD NOT be edited. +# +# $Id$ +# + +# +# The filename given here should be an absolute path. +# +$INCLUDE /usr/local/share/freeradius/dictionary + +# +# Place additional attributes or $INCLUDEs here. They will +# over-ride the definitions in the pre-defined dictionaries. +# +# See the 'man' page for 'dictionary' for information on +# the format of the dictionary files. + +# +# If you want to add entries to the dictionary file, +# which are NOT going to be placed in a RADIUS packet, +# add them here. The numbers you pick should be between +# 3000 and 4000. +# + +#ATTRIBUTE My-Local-String 3000 string +#ATTRIBUTE My-Local-IPAddr 3001 ipaddr +#ATTRIBUTE My-Local-Integer 3002 integer diff --git a/testing/hosts/alice/etc/freeradius/radiusd.conf b/testing/hosts/alice/etc/freeradius/radiusd.conf new file mode 100644 index 0000000000..e4f7217380 --- /dev/null +++ b/testing/hosts/alice/etc/freeradius/radiusd.conf @@ -0,0 +1,120 @@ +# radiusd.conf -- FreeRADIUS server configuration file. + +prefix = /usr +exec_prefix = ${prefix} +sysconfdir = /etc +localstatedir = /var +sbindir = ${exec_prefix}/sbin +logdir = ${localstatedir}/log/freeradius +raddbdir = ${sysconfdir}/freeradius +radacctdir = ${logdir}/radacct + +# name of the running server. See also the "-n" command-line option. +name = freeradius + +# Location of config and logfiles. +confdir = ${raddbdir} +run_dir = ${localstatedir}/run + +# Should likely be ${localstatedir}/lib/radiusd +db_dir = ${raddbdir} + +# libdir: Where to find the rlm_* modules. +libdir = ${exec_prefix}/lib + +# pidfile: Where to place the PID of the RADIUS server. +pidfile = ${run_dir}/${name}.pid + +# max_request_time: The maximum time (in seconds) to handle a request. +max_request_time = 30 + +# cleanup_delay: The time to wait (in seconds) before cleaning up +cleanup_delay = 5 + +# max_requests: The maximum number of requests which the server keeps +max_requests = 1024 + +# listen: Make the server listen on a particular IP address, and send +listen { + type = auth + ipaddr = 10.1.0.10 + port = 0 +} + +# This second "listen" section is for listening on the accounting +# port, too. +# +listen { + type = acct + ipaddr = 10.1.0.10 + port = 0 +} + +# hostname_lookups: Log the names of clients or just their IP addresses +hostname_lookups = no + +# Core dumps are a bad thing. This should only be set to 'yes' +allow_core_dumps = no + +# Regular expressions +regular_expressions = yes +extended_expressions = yes + +# Logging section. The various "log_*" configuration items +log { + destination = files + file = ${logdir}/radius.log + syslog_facility = daemon + stripped_names = no + auth = yes + auth_badpass = yes + auth_goodpass = yes +} + +# The program to execute to do concurrency checks. +checkrad = ${sbindir}/checkrad + +# Security considerations +security { + max_attributes = 200 + reject_delay = 1 + status_server = yes +} + +# PROXY CONFIGURATION +proxy_requests = yes +$INCLUDE proxy.conf + +# CLIENTS CONFIGURATION +$INCLUDE clients.conf + +# THREAD POOL CONFIGURATION +thread pool { + start_servers = 5 + max_servers = 32 + min_spare_servers = 3 + max_spare_servers = 10 + max_requests_per_server = 0 +} + +# MODULE CONFIGURATION +modules { + $INCLUDE ${confdir}/modules/ + $INCLUDE eap.conf + $INCLUDE sql.conf + $INCLUDE sql/mysql/counter.conf +} + +# Instantiation +instantiate { + exec + expr + expiration + logintime +} + +# Policies +$INCLUDE policy.conf + +# Include all enabled virtual hosts +$INCLUDE sites-enabled/ diff --git a/testing/hosts/alice/etc/hostname b/testing/hosts/alice/etc/hostname new file mode 100644 index 0000000000..c9fc40bfbf --- /dev/null +++ b/testing/hosts/alice/etc/hostname @@ -0,0 +1 @@ +alice diff --git a/testing/hosts/alice/etc/init.d/iptables b/testing/hosts/alice/etc/init.d/iptables deleted file mode 100755 index 1097ac5a44..0000000000 --- a/testing/hosts/alice/etc/init.d/iptables +++ /dev/null @@ -1,74 +0,0 @@ -#!/sbin/runscript -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -opts="start stop reload" - -depend() { - before net - need logger -} - -start() { - ebegin "Starting firewall" - - # default policy is DROP - /sbin/iptables -P INPUT DROP - /sbin/iptables -P OUTPUT DROP - /sbin/iptables -P FORWARD DROP - - # allow IKE - iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT - - # allow NAT-T - iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT - iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT - - - # allow crl fetch from winnetou - iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT - - # allow ssh - iptables -A INPUT -p tcp --dport 22 -j ACCEPT - iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT - - eend $? -} - -stop() { - ebegin "Stopping firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - - if [ $a == nat ]; then - /sbin/iptables -t nat -P PREROUTING ACCEPT - /sbin/iptables -t nat -P POSTROUTING ACCEPT - /sbin/iptables -t nat -P OUTPUT ACCEPT - elif [ $a == mangle ]; then - /sbin/iptables -t mangle -P PREROUTING ACCEPT - /sbin/iptables -t mangle -P INPUT ACCEPT - /sbin/iptables -t mangle -P FORWARD ACCEPT - /sbin/iptables -t mangle -P OUTPUT ACCEPT - /sbin/iptables -t mangle -P POSTROUTING ACCEPT - elif [ $a == filter ]; then - /sbin/iptables -t filter -P INPUT ACCEPT - /sbin/iptables -t filter -P FORWARD ACCEPT - /sbin/iptables -t filter -P OUTPUT ACCEPT - fi - done - eend $? -} - -reload() { - ebegin "Flushing firewall" - for a in `cat /proc/net/ip_tables_names`; do - /sbin/iptables -F -t $a - /sbin/iptables -X -t $a - done; - eend $? - start -} - diff --git a/testing/hosts/alice/etc/init.d/net.eth0 b/testing/hosts/alice/etc/init.d/net.eth0 deleted file mode 100755 index 92b3851cf4..0000000000 --- a/testing/hosts/alice/etc/init.d/net.eth0 +++ /dev/null @@ -1,1124 +0,0 @@ -#!/sbin/runscript -# Copyright (c) 2004-2006 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -# Contributed by Roy Marples (uberlord@gentoo.org) -# Many thanks to Aron Griffis (agriffis@gentoo.org) -# for help, ideas and patches - -#NB: Config is in /etc/conf.d/net - -# For pcmcia users. note that pcmcia must be added to the same -# runlevel as the net.* script that needs it. -depend() { - need localmount - after bootmisc hostname - use isapnp isdn pcmcia usb wlan - - # Load any custom depend functions for the given interface - # For example, br0 may need eth0 and eth1 - local iface="${SVCNAME#*.}" - [[ $(type -t "depend_${iface}") == "function" ]] && depend_${iface} - - if [[ ${iface} != "lo" && ${iface} != "lo0" ]] ; then - after net.lo net.lo0 - - # Support new style RC_NEED and RC_USE in one net file - local x="RC_NEED_${iface}" - [[ -n ${!x} ]] && need ${!x} - x="RC_USE_${iface}" - [[ -n ${!x} ]] && use ${!x} - fi - - return 0 -} - -# Define where our modules are -MODULES_DIR="${svclib}/net" - -# Make some wrappers to fudge after/before/need/use depend flags. -# These are callbacks so MODULE will be set. -after() { - eval "${MODULE}_after() { echo \"$*\"; }" -} -before() { - eval "${MODULE}_before() { echo \"$*\"; }" -} -need() { - eval "${MODULE}_need() { echo \"$*\"; }" -} -installed() { - # We deliberately misspell this as _installed will probably be used - # at some point - eval "${MODULE}_instlled() { echo \"$*\"; }" -} -provide() { - eval "${MODULE}_provide() { echo \"$*\"; }" -} -functions() { - eval "${MODULE}_functions() { echo \"$*\"; }" -} -variables() { - eval "${MODULE}_variables() { echo \"$*\"; }" -} - -is_loopback() { - [[ $1 == "lo" || $1 == "lo0" ]] -} - -# char* interface_device(char *iface) -# -# Gets the base device of the interface -# Can handle eth0:1 and eth0.1 -# Which returns eth0 in this case -interface_device() { - local dev="${1%%.*}" - [[ ${dev} == "$1" ]] && dev="${1%%:*}" - echo "${dev}" -} - -# char* interface_type(char* iface) -# -# Returns the base type of the interface -# eth, ippp, etc -interface_type() { - echo "${1%%[0-9]*}" -} - -# int calculate_metric(char *interface, int base) -# -# Calculates the best metric for the interface -# We use this when we add routes so we can prefer interfaces over each other -calculate_metric() { - local iface="$1" metric="$2" - - # Have we already got a metric? - local m=$(awk '$1=="'${iface}'" && $2=="00000000" { print $7 }' \ - /proc/net/route) - if [[ -n ${m} ]] ; then - echo "${m}" - return 0 - fi - - local i= dest= gw= flags= ref= u= m= mtu= metrics= - while read i dest gw flags ref u m mtu ; do - # Ignore lo - is_loopback "${i}" && continue - # We work out metrics from default routes only - [[ ${dest} != "00000000" || ${gw} == "00000000" ]] && continue - metrics="${metrics}\n${m}" - done < /proc/net/route - - # Now, sort our metrics - metrics=$(echo -e "${metrics}" | sort -n) - - # Now, find the lowest we can use - local gotbase=false - for m in ${metrics} ; do - [[ ${m} -lt ${metric} ]] && continue - [[ ${m} == ${metric} ]] && ((metric++)) - [[ ${m} -gt ${metric} ]] && break - done - - echo "${metric}" -} - -# int netmask2cidr(char *netmask) -# -# Returns the CIDR of a given netmask -netmask2cidr() { - local binary= i= bin= - - for i in ${1//./ }; do - bin="" - while [[ ${i} != "0" ]] ; do - bin=$[${i}%2]${bin} - (( i=i>>1 )) - done - binary="${binary}${bin}" - done - binary="${binary%%0*}" - echo "${#binary}" -} - - -# bool is_function(char* name) -# -# Returns 0 if the given name is a shell function, otherwise 1 -is_function() { - [[ -z $1 ]] && return 1 - [[ $(type -t "$1") == "function" ]] -} - -# void function_wrap(char* source, char* target) -# -# wraps function calls - for example function_wrap(this, that) -# maps function names this_* to that_* -function_wrap() { - local i= - - is_function "${2}_depend" && return - - for i in $(typeset -f | grep -o '^'"${1}"'_[^ ]*'); do - eval "${2}${i#${1}}() { ${i} \"\$@\"; }" - done -} - -# char[] * expand_parameters(char *cmd) -# -# Returns an array after expanding parameters. For example -# "192.168.{1..3}.{1..3}/24 brd +" -# will return -# "192.168.1.1/24 brd +" -# "192.168.1.2/24 brd +" -# "192.168.1.3/24 brd +" -# "192.168.2.1/24 brd +" -# "192.168.2.2/24 brd +" -# "192.168.2.3/24 brd +" -# "192.168.3.1/24 brd +" -# "192.168.3.2/24 brd +" -# "192.168.3.3/24 brd +" -expand_parameters() { - local x=$(eval echo ${@// /_}) - local -a a=( ${x} ) - - a=( "${a[@]/#/\"}" ) - a=( "${a[@]/%/\"}" ) - echo "${a[*]//_/ }" -} - -# void configure_variables(char *interface, char *option1, [char *option2]) -# -# Maps configuration options from _