Adapt host configuration
Adapt the configuration of the test hosts to the new Debian-based system.
This commit is contained in:
Reto Buerki
committed by
Tobias Brunner
Tobias Brunner
parent
108040800d
commit
766466b8d1
@@ -1 +0,0 @@
|
||||
HOSTNAME=alice
|
||||
@@ -1,12 +0,0 @@
|
||||
# /etc/conf.d/net:
|
||||
|
||||
# This is basically the ifconfig argument without the ifconfig $iface
|
||||
#
|
||||
config_eth0=( "PH_IP_ALICE broadcast 10.1.255.255 netmask 255.255.0.0"
|
||||
"PH_IP6_ALICE/16" )
|
||||
config_eth1=( "PH_IP_ALICE1 broadcast 192.168.0.255 netmask 255.255.255.0"
|
||||
"PH_IP6_ALICE1/16" )
|
||||
|
||||
# For setting the default gateway
|
||||
#
|
||||
routes_eth0=( "default via PH_IP_MOON1" )
|
||||
@@ -0,0 +1,4 @@
|
||||
client 10.1.0.1 {
|
||||
secret = gv6URkSs
|
||||
shortname = moon
|
||||
}
|
||||
@@ -0,0 +1,32 @@
|
||||
#
|
||||
# This is the master dictionary file, which references the
|
||||
# pre-defined dictionary files included with the server.
|
||||
#
|
||||
# Any new/changed attributes MUST be placed in this file, as
|
||||
# the pre-defined dictionaries SHOULD NOT be edited.
|
||||
#
|
||||
# $Id$
|
||||
#
|
||||
|
||||
#
|
||||
# The filename given here should be an absolute path.
|
||||
#
|
||||
$INCLUDE /usr/local/share/freeradius/dictionary
|
||||
|
||||
#
|
||||
# Place additional attributes or $INCLUDEs here. They will
|
||||
# over-ride the definitions in the pre-defined dictionaries.
|
||||
#
|
||||
# See the 'man' page for 'dictionary' for information on
|
||||
# the format of the dictionary files.
|
||||
|
||||
#
|
||||
# If you want to add entries to the dictionary file,
|
||||
# which are NOT going to be placed in a RADIUS packet,
|
||||
# add them here. The numbers you pick should be between
|
||||
# 3000 and 4000.
|
||||
#
|
||||
|
||||
#ATTRIBUTE My-Local-String 3000 string
|
||||
#ATTRIBUTE My-Local-IPAddr 3001 ipaddr
|
||||
#ATTRIBUTE My-Local-Integer 3002 integer
|
||||
@@ -0,0 +1,120 @@
|
||||
# radiusd.conf -- FreeRADIUS server configuration file.
|
||||
|
||||
prefix = /usr
|
||||
exec_prefix = ${prefix}
|
||||
sysconfdir = /etc
|
||||
localstatedir = /var
|
||||
sbindir = ${exec_prefix}/sbin
|
||||
logdir = ${localstatedir}/log/freeradius
|
||||
raddbdir = ${sysconfdir}/freeradius
|
||||
radacctdir = ${logdir}/radacct
|
||||
|
||||
# name of the running server. See also the "-n" command-line option.
|
||||
name = freeradius
|
||||
|
||||
# Location of config and logfiles.
|
||||
confdir = ${raddbdir}
|
||||
run_dir = ${localstatedir}/run
|
||||
|
||||
# Should likely be ${localstatedir}/lib/radiusd
|
||||
db_dir = ${raddbdir}
|
||||
|
||||
# libdir: Where to find the rlm_* modules.
|
||||
libdir = ${exec_prefix}/lib
|
||||
|
||||
# pidfile: Where to place the PID of the RADIUS server.
|
||||
pidfile = ${run_dir}/${name}.pid
|
||||
|
||||
# max_request_time: The maximum time (in seconds) to handle a request.
|
||||
max_request_time = 30
|
||||
|
||||
# cleanup_delay: The time to wait (in seconds) before cleaning up
|
||||
cleanup_delay = 5
|
||||
|
||||
# max_requests: The maximum number of requests which the server keeps
|
||||
max_requests = 1024
|
||||
|
||||
# listen: Make the server listen on a particular IP address, and send
|
||||
listen {
|
||||
type = auth
|
||||
ipaddr = 10.1.0.10
|
||||
port = 0
|
||||
}
|
||||
|
||||
# This second "listen" section is for listening on the accounting
|
||||
# port, too.
|
||||
#
|
||||
listen {
|
||||
type = acct
|
||||
ipaddr = 10.1.0.10
|
||||
port = 0
|
||||
}
|
||||
|
||||
# hostname_lookups: Log the names of clients or just their IP addresses
|
||||
hostname_lookups = no
|
||||
|
||||
# Core dumps are a bad thing. This should only be set to 'yes'
|
||||
allow_core_dumps = no
|
||||
|
||||
# Regular expressions
|
||||
regular_expressions = yes
|
||||
extended_expressions = yes
|
||||
|
||||
# Logging section. The various "log_*" configuration items
|
||||
log {
|
||||
destination = files
|
||||
file = ${logdir}/radius.log
|
||||
syslog_facility = daemon
|
||||
stripped_names = no
|
||||
auth = yes
|
||||
auth_badpass = yes
|
||||
auth_goodpass = yes
|
||||
}
|
||||
|
||||
# The program to execute to do concurrency checks.
|
||||
checkrad = ${sbindir}/checkrad
|
||||
|
||||
# Security considerations
|
||||
security {
|
||||
max_attributes = 200
|
||||
reject_delay = 1
|
||||
status_server = yes
|
||||
}
|
||||
|
||||
# PROXY CONFIGURATION
|
||||
proxy_requests = yes
|
||||
$INCLUDE proxy.conf
|
||||
|
||||
# CLIENTS CONFIGURATION
|
||||
$INCLUDE clients.conf
|
||||
|
||||
# THREAD POOL CONFIGURATION
|
||||
thread pool {
|
||||
start_servers = 5
|
||||
max_servers = 32
|
||||
min_spare_servers = 3
|
||||
max_spare_servers = 10
|
||||
max_requests_per_server = 0
|
||||
}
|
||||
|
||||
# MODULE CONFIGURATION
|
||||
modules {
|
||||
$INCLUDE ${confdir}/modules/
|
||||
$INCLUDE eap.conf
|
||||
$INCLUDE sql.conf
|
||||
$INCLUDE sql/mysql/counter.conf
|
||||
}
|
||||
|
||||
# Instantiation
|
||||
instantiate {
|
||||
exec
|
||||
expr
|
||||
expiration
|
||||
logintime
|
||||
}
|
||||
|
||||
# Policies
|
||||
$INCLUDE policy.conf
|
||||
|
||||
# Include all enabled virtual hosts
|
||||
$INCLUDE sites-enabled/
|
||||
@@ -0,0 +1 @@
|
||||
alice
|
||||
@@ -1,74 +0,0 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Foundation
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
opts="start stop reload"
|
||||
|
||||
depend() {
|
||||
before net
|
||||
need logger
|
||||
}
|
||||
|
||||
start() {
|
||||
ebegin "Starting firewall"
|
||||
|
||||
# default policy is DROP
|
||||
/sbin/iptables -P INPUT DROP
|
||||
/sbin/iptables -P OUTPUT DROP
|
||||
/sbin/iptables -P FORWARD DROP
|
||||
|
||||
# allow IKE
|
||||
iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
|
||||
iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
|
||||
|
||||
# allow NAT-T
|
||||
iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
|
||||
iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
|
||||
|
||||
|
||||
# allow crl fetch from winnetou
|
||||
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
|
||||
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
|
||||
|
||||
# allow ssh
|
||||
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
|
||||
|
||||
eend $?
|
||||
}
|
||||
|
||||
stop() {
|
||||
ebegin "Stopping firewall"
|
||||
for a in `cat /proc/net/ip_tables_names`; do
|
||||
/sbin/iptables -F -t $a
|
||||
/sbin/iptables -X -t $a
|
||||
|
||||
if [ $a == nat ]; then
|
||||
/sbin/iptables -t nat -P PREROUTING ACCEPT
|
||||
/sbin/iptables -t nat -P POSTROUTING ACCEPT
|
||||
/sbin/iptables -t nat -P OUTPUT ACCEPT
|
||||
elif [ $a == mangle ]; then
|
||||
/sbin/iptables -t mangle -P PREROUTING ACCEPT
|
||||
/sbin/iptables -t mangle -P INPUT ACCEPT
|
||||
/sbin/iptables -t mangle -P FORWARD ACCEPT
|
||||
/sbin/iptables -t mangle -P OUTPUT ACCEPT
|
||||
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
|
||||
elif [ $a == filter ]; then
|
||||
/sbin/iptables -t filter -P INPUT ACCEPT
|
||||
/sbin/iptables -t filter -P FORWARD ACCEPT
|
||||
/sbin/iptables -t filter -P OUTPUT ACCEPT
|
||||
fi
|
||||
done
|
||||
eend $?
|
||||
}
|
||||
|
||||
reload() {
|
||||
ebegin "Flushing firewall"
|
||||
for a in `cat /proc/net/ip_tables_names`; do
|
||||
/sbin/iptables -F -t $a
|
||||
/sbin/iptables -X -t $a
|
||||
done;
|
||||
eend $?
|
||||
start
|
||||
}
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -1,64 +0,0 @@
|
||||
#!/sbin/runscript
|
||||
|
||||
opts="${opts} reload"
|
||||
|
||||
depend() {
|
||||
need net
|
||||
use dns
|
||||
}
|
||||
|
||||
checkconfig() {
|
||||
# set the location of log files
|
||||
if ! cd /var/log/radius ; then
|
||||
eerror "Failed to change current directory to /var/log/radius"
|
||||
return 1
|
||||
fi
|
||||
|
||||
if [ ! -d /var/run/radiusd ] && ! mkdir /var/run/radiusd ; then
|
||||
eerror "Failed to create /var/run/radiusd"
|
||||
return 1
|
||||
fi
|
||||
|
||||
if [ ! -f /etc/raddb/radiusd.conf ] ; then
|
||||
eerror "No /etc/raddb/radiusd.conf file exists!"
|
||||
return 1
|
||||
fi
|
||||
|
||||
RADIUSD_OPTS="-xx"
|
||||
RADIUSD_USER=`grep '^ *user *=' /etc/raddb/radiusd.conf | cut -d ' ' -f 3`
|
||||
RADIUSD_GROUP=`grep '^ *group *=' /etc/raddb/radiusd.conf | cut -d ' ' -f 3`
|
||||
if [ -n "${RADIUSD_USER}" ] && ! getent passwd ${RADIUSD_USER} > /dev/null ; then
|
||||
eerror "${RADIUSD_USER} user missing!"
|
||||
return 1
|
||||
fi
|
||||
if [ -n "${RADIUSD_GROUP}" ] && ! getent group ${RADIUSD_GROUP} > /dev/null ; then
|
||||
eerror "${RADIUSD_GROUP} group missing!"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# radius.log is created before privileges are dropped - need to set proper permissions on it
|
||||
[ -f radius.log ] || touch radius.log || return 1
|
||||
|
||||
chown -R "${RADIUSD_USER:-root}:${RADIUSD_GROUP:-root}" . /var/run/radiusd && \
|
||||
chmod -R u+rwX,g+rX . /var/run/radiusd || return 1
|
||||
}
|
||||
|
||||
start() {
|
||||
checkconfig || return 1
|
||||
|
||||
ebegin "Starting radiusd"
|
||||
start-stop-daemon --start --quiet --exec /usr/sbin/radiusd -- ${RADIUSD_OPTS} >/dev/null
|
||||
eend $?
|
||||
}
|
||||
|
||||
stop () {
|
||||
ebegin "Stopping radiusd"
|
||||
start-stop-daemon --stop --quiet --pidfile=/var/run/radiusd/radiusd.pid
|
||||
eend $?
|
||||
}
|
||||
|
||||
reload () {
|
||||
ebegin "Reloading radiusd"
|
||||
kill -HUP `</var/run/radiusd/radiusd.pid`
|
||||
eend $?
|
||||
}
|
||||
Executable → Regular
+1
-1
@@ -13,7 +13,7 @@ conn nat-t
|
||||
leftcert=aliceCert.pem
|
||||
[email protected]
|
||||
leftfirewall=yes
|
||||
right=PH_IP_SUN
|
||||
right=192.168.0.2
|
||||
[email protected]
|
||||
rightsubnet=10.2.0.0/16
|
||||
auto=add
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
auto lo
|
||||
iface lo inet loopback
|
||||
|
||||
auto eth0
|
||||
iface eth0 inet static
|
||||
address PH_IP_ALICE
|
||||
netmask 255.255.0.0
|
||||
broadcast 10.1.255.255
|
||||
gateway 10.1.0.1
|
||||
iface eth0 inet6 static
|
||||
address PH_IP6_ALICE
|
||||
netmask 16
|
||||
|
||||
iface eth1 inet static
|
||||
address PH_IP_ALICE1
|
||||
netmask 255.255.255.0
|
||||
broadcast 192.168.0.255
|
||||
iface eth1 inet6 static
|
||||
address PH_IP6_ALICE1
|
||||
netmask 16
|
||||
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user