aboutsummaryrefslogtreecommitdiffstats
path: root/config/freeradius2/freeradius.inc
diff options
context:
space:
mode:
Diffstat (limited to 'config/freeradius2/freeradius.inc')
-rw-r--r--config/freeradius2/freeradius.inc127
1 files changed, 109 insertions, 18 deletions
diff --git a/config/freeradius2/freeradius.inc b/config/freeradius2/freeradius.inc
index 7ef5f749..11aa4b3b 100644
--- a/config/freeradius2/freeradius.inc
+++ b/config/freeradius2/freeradius.inc
@@ -71,7 +71,7 @@ function freeradius_install_command() {
exec("chown -R root:wheel /usr/local/lib/freeradius-2.1.12");
exec("touch /var/log/radutmp && touch /var/log/radwtmp");
exec("chown -R root:wheel /var/log");
-
+
// creating a backup file of the original policy.conf no matter if user checked this or not
if (!file_exists("/usr/local/etc/raddb/policy.conf.backup")) {
@@ -432,7 +432,7 @@ if (is_array($arrusers) && !empty($arrusers)) {
$varuserscheckitemsadditionaloptions = explode("|", ($users['varuserscheckitemsadditionaloptions']));
$varusersadditionaloptionscheckitems .= '';
foreach ($varuserscheckitemsadditionaloptions as $checkitemtmp) {
- $varusersadditionaloptionscheckitems .= $checkitemtmp;
+ $varusersadditionaloptionscheckitems .= "$checkitemtmp" . " ";
}
}
@@ -585,7 +585,7 @@ if (is_array($arrmacs) && !empty($arrmacs)) {
$varmacscheckitemsadditionaloptions = explode("|", ($macs['varmacscheckitemsadditionaloptions']));
$varmacsadditionaloptionscheckitems .= '';
foreach ($varmacscheckitemsadditionaloptions as $checkitemtmp) {
- $varmacsadditionaloptionscheckitems .= $checkitemtmp;
+ $varmacsadditionaloptionscheckitems .= "$checkitemtmp" . " ";
}
}
@@ -2857,9 +2857,100 @@ function freeradius_modulesldap_resync() {
$varmodulesldap2timelimit = ($arrmodulesldap['varmodulesldap2timelimit']?$arrmodulesldap['varmodulesldap2timelimit']:'3');
$varmodulesldap2nettimeout = ($arrmodulesldap['varmodulesldap2nettimeout']?$arrmodulesldap['varmodulesldap2nettimeout']:'1');
- // Variables for TLS / Certificates - will be added later
+ // Variables for TLS / Certificates - ldap1
+ $varmodulesldaprequirecert = ($arrmodulesldap['varmodulesldaprequirecert']?$arrmodulesldap['varmodulesldaprequirecert']:'never');
+
+// if enabled then create the certs in ../raddb/certs/ and enable "Start_tls" in ldap1 module
+if($arrmodulesldap['varmodulesldapenabletlssupport'] == 'on') {
+
+ $ca_cert = lookup_ca($arrmodulesldap["ssl_ca_cert1"]);
+ if ($ca_cert != false) {
+ if(base64_decode($ca_cert['prv'])) {
+ file_put_contents(RADDB . "/certs/ca_ldap1_key.pem",
+ base64_decode($ca_cert['prv']));
+ $conf['ssl_ca_key'] = RADDB . '/certs/ca_ldap1_key.pem';
+ }
+ if(base64_decode($ca_cert['crt'])) {
+ file_put_contents(RADDB . "/certs/ca_ldap1_cert.pem",
+ base64_decode($ca_cert['crt']));
+ $conf['ssl_ca_cert1'] = RADDB . "/certs/ca_ldap1_cert.pem";
+ }
+
+
+ $svr_cert = lookup_cert($arrmodulesldap["ssl_server_cert1"]);
+ if ($svr_cert != false) {
+ if(base64_decode($svr_cert['prv'])) {
+ file_put_contents(RADDB . "/certs/radius_ldap1_cert.key",
+ base64_decode($svr_cert['prv']));
+ $conf['ssl_key'] = RADDB . '/certs/radius_ldap1_cert.key';
+ }
+ }
+
+
+ if(base64_decode($svr_cert['crt'])) {
+ file_put_contents(RADDB . "/certs/radius_ldap1_cert.crt",
+ base64_decode($svr_cert['crt']));
+ $conf['ssl_server_cert1'] = RADDB . "/certs/radius_ldap1_cert.crt";
+ }
+
+
+ $conf['ssl_cert_dir'] = RADDB . '/certs';
+ }
+ $varmodulesldapstarttls = "yes";
+}
+else {
+ $varmodulesldapstarttls = "no";
+}
+
+ // Variables for TLS / Certificates - ldap2
+ $varmodulesldap2requirecert = ($arrmodulesldap['varmodulesldap2requirecert']?$arrmodulesldap['varmodulesldap2requirecert']:'never');
+
+// if enabled then create the certs in ../raddb/certs/ and enable "Start_tls" in ldap2 module
+if($arrmodulesldap['varmodulesldap2enabletlssupport'] == 'on') {
+
+ $ca_cert = lookup_ca($arrmodulesldap["ssl_ca_cert2"]);
+ if ($ca_cert != false) {
+ if(base64_decode($ca_cert['prv'])) {
+ file_put_contents(RADDB . "/certs/ca_ldap2_key.pem",
+ base64_decode($ca_cert['prv']));
+ $conf['ssl_ca_key'] = RADDB . '/certs/ca_ldap2_key.pem';
+ }
+
+
+ if(base64_decode($ca_cert['crt'])) {
+ file_put_contents(RADDB . "/certs/ca_ldap2_cert.pem",
+ base64_decode($ca_cert['crt']));
+ $conf['ssl_ca_cert2'] = RADDB . "/certs/ca_ldap2_cert.pem";
+ }
+
+
+ $svr_cert = lookup_cert($arrmodulesldap["ssl_server_cert2"]);
+ if ($svr_cert != false) {
+ if(base64_decode($svr_cert['prv'])) {
+ file_put_contents(RADDB . "/certs/radius_ldap2_cert.key",
+ base64_decode($svr_cert['prv']));
+ $conf['ssl_key'] = RADDB . '/certs/radius_ldap2_cert.key';
+ }
+ }
+
+
+ if(base64_decode($svr_cert['crt'])) {
+ file_put_contents(RADDB . "/certs/radius_ldap2_cert.crt",
+ base64_decode($svr_cert['crt']));
+ $conf['ssl_server_cert2'] = RADDB . "/certs/radius_ldap2_cert.crt";
+ }
+
+
+ $conf['ssl_cert_dir'] = RADDB . '/certs';
+ }
+ $varmodulesldap2starttls = "yes";
+}
+else {
+ $varmodulesldap2starttls = "no";
+}
+
// Miscellaneous Configuration + MS Active Directory Compatibility ldap1
$varmodulesldapmsadcompatibilityenable = ($arrmodulesldap['varmodulesldapmsadcompatibilityenable']?$arrmodulesldap['varmodulesldapmsadcompatibilityenable']:'Disable');
if ($arrmodulesldap['varmodulesldapmsadcompatibilityenable'] == 'Disable') {
@@ -3054,13 +3145,13 @@ ldap {
# The StartTLS operation is supposed to be
# used with normal ldap connections instead of
# using ldaps (port 689) connections
- start_tls = no
+ start_tls = $varmodulesldapstarttls
- # cacertfile = /path/to/cacert.pem
- # cacertdir = /path/to/ca/dir/
- # certfile = /path/to/radius.crt
- # keyfile = /path/to/radius.key
- # randfile = /path/to/rnd
+ cacertfile = /usr/local/etc/raddb/certs/ca_ldap1_cert.pem
+ cacertdir = /usr/local/etc/raddb/certs/
+ certfile = /usr/local/etc/raddb/certs/radius_ldap1_cert.crt
+ keyfile = /usr/local/etc/raddb/certs/radius_ldap1_cert.key
+ randfile = /usr/local/etc/raddb/certs/random
# Certificate Verification requirements. Can be:
# "never" (don't even bother trying)
@@ -3069,7 +3160,7 @@ ldap {
# "demand" (fail if the certificate doesn't verify.)
#
# The default is "allow"
- # require_cert = "demand"
+ require_cert = "$varmodulesldaprequirecert"
}
$varmodulesldapdefaultprofile
@@ -3213,13 +3304,13 @@ ldap ldap2{
# The StartTLS operation is supposed to be
# used with normal ldap connections instead of
# using ldaps (port 689) connections
- start_tls = no
+ start_tls = $varmodulesldap2starttls
- # cacertfile = /path/to/cacert.pem
- # cacertdir = /path/to/ca/dir/
- # certfile = /path/to/radius.crt
- # keyfile = /path/to/radius.key
- # randfile = /path/to/rnd
+ cacertfile = /usr/local/etc/raddb/certs/ca_ldap2_cert.pem
+ cacertdir = /usr/local/etc/raddb/certs/
+ certfile = /usr/local/etc/raddb/certs/radius_ldap2_cert.crt
+ keyfile = /usr/local/etc/raddb/certs/radius_ldap2_cert.key
+ randfile = /usr/local/etc/raddb/certs/random
# Certificate Verification requirements. Can be:
# "never" (don't even bother trying)
@@ -3228,7 +3319,7 @@ ldap ldap2{
# "demand" (fail if the certificate doesn't verify.)
#
# The default is "allow"
- # require_cert = "demand"
+ require_cert = "$varmodulesldap2requirecert"
}
$varmodulesldap2defaultprofile
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-15 21:36:57 +0000