projects/aports·blob master · refs

181 lines · 5.6 KiB

1From f37bee486aca3de86b594770f0b2b3ff8e96596a Mon Sep 17 00:00:00 2001
2From: Jakub Jirutka <[email protected]>
3Date: Tue, 18 May 2021 14:10:00 +0000
4Subject: [PATCH] Adjust default config
5
6- Fix default location of db_dir and run_dir.
7- Remove pidfile - this is handled by OpenRC.
8- Change default sqlite db path to a reasonable location.
9- Change default cui sqlite location to $db_dir/.
10- Change default cache paths to /var/cache/radiusd.
11
12---
13 raddb/mods-available/cui | 2 +-
14 raddb/mods-available/eap | 11 +++--------
15 raddb/mods-available/sql | 4 ++--
16 raddb/radiusd.conf.in | 21 +++++----------------
17 raddb/sites-available/abfab-tls | 4 ++--
18 raddb/sites-available/tls | 4 ++--
19 6 files changed, 15 insertions(+), 31 deletions(-)
20
21diff --git a/raddb/mods-available/cui b/raddb/mods-available/cui
22index b72aa30..0dc4e1c 100644
23--- a/raddb/mods-available/cui
24+++ b/raddb/mods-available/cui
25@@ -29,7 +29,7 @@ sql cuisql {
26 driver = "rlm_sql_${dialect}"
27
28 sqlite {
29- filename = ${radacctdir}/cui.sqlite
30+ filename = ${db_dir}/cui.sqlite
31 bootstrap = ${modconfdir}/${..:name}/cui/sqlite/schema.sql
32 }
33
34diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
35index 239ac4c..66d59b4 100644
36--- a/raddb/mods-available/eap
37+++ b/raddb/mods-available/eap
38@@ -534,20 +534,15 @@ eap {
39 # state and the cached VPs. This will persist session
40 # across server restarts.
41 #
42- # The default directory is ${logdir}, for historical
43- # reasons. You should ${db_dir} instead. And check
44- # the value of db_dir in the main radiusd.conf file.
45- # It should not point to ${raddb}
46- #
47 # The server will need write perms, and the directory
48 # should be secured from anyone else. You might want
49 # a script to remove old files from here periodically:
50 #
51- # find ${logdir}/tlscache -mtime +2 -exec rm -f {} \;
52+ # find ${cachedir}/tlscache -mtime +2 -exec rm -f {} \;
53 #
54 # This feature REQUIRES "name" option be set above.
55 #
56- # persist_dir = "${logdir}/tlscache"
57+ # persist_dir = "${cachedir}/tlscache"
58
59 #
60 # As of 3.0.20, it is possible to partially
61@@ -616,7 +611,7 @@ eap {
62 # deleted by the server when the command
63 # returns.
64 #
65- # client = "/path/to/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}"
66+ # client = "/usr/bin/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}"
67 }
68
69 # OCSP Configuration
70diff --git a/raddb/mods-available/sql b/raddb/mods-available/sql
71index cfeac63..7ff51dd 100644
72--- a/raddb/mods-available/sql
73+++ b/raddb/mods-available/sql
74@@ -69,7 +69,7 @@ sql {
75 #
76 sqlite {
77 # Path to the sqlite database
78- filename = "/tmp/freeradius.db"
79+ filename = "${db_dir}/freeradius.db"
80
81 # How long to wait for write locks on the database to be
82 # released (in ms) before giving up.
83@@ -84,7 +84,7 @@ sql {
84 mysql {
85 # If any of the files below are set, TLS encryption is enabled
86 tls {
87- ca_file = "/etc/ssl/certs/my_ca.crt"
88+ ca_file = "/etc/ssl/certs/ca-certificates.crt"
89 ca_path = "/etc/ssl/certs/"
90 certificate_file = "/etc/ssl/certs/private/client.crt"
91 private_key_file = "/etc/ssl/certs/private/client.key"
92diff --git a/raddb/radiusd.conf.in b/raddb/radiusd.conf.in
93index 61cc3a4..29f716a 100644
94--- a/raddb/radiusd.conf.in
95+++ b/raddb/radiusd.conf.in
96@@ -98,10 +98,10 @@ confdir = ${raddbdir}
97 modconfdir = ${confdir}/mods-config
98 certdir = ${confdir}/certs
99 cadir = ${confdir}/certs
100-run_dir = ${localstatedir}/run/${name}
101+run_dir = /run/${name}
102
103-# Should likely be ${localstatedir}/lib/radiusd
104-db_dir = ${raddbdir}
105+db_dir = ${localstatedir}/lib/radiusd
106+cachedir = ${localstatedir}/cache/radiusd
107
108 #
109 # libdir: Where to find the rlm_* modules.
110@@ -137,17 +137,6 @@ db_dir = ${raddbdir}
111 #
112 libdir = @libdir@
113
114-# pidfile: Where to place the PID of the RADIUS server.
115-#
116-# The server may be signalled while it's running by using this
117-# file.
118-#
119-# This file is written when ONLY running in daemon mode.
120-#
121-# e.g.: kill -HUP `cat /var/run/radiusd/radiusd.pid`
122-#
123-pidfile = ${run_dir}/${name}.pid
124-
125 #
126 # correct_escapes: use correct backslash escaping
127 #
128@@ -520,8 +509,8 @@ security {
129 # member. This can allow for some finer-grained access
130 # controls.
131 #
132-# user = radius
133-# group = radius
134+ user = radius
135+ group = radius
136
137 # Core dumps are a bad thing. This should only be set to
138 # 'yes' if you're debugging a problem with the server.
139diff --git a/raddb/sites-available/abfab-tls b/raddb/sites-available/abfab-tls
140index b8d0626..4eba0a3 100644
141--- a/raddb/sites-available/abfab-tls
142+++ b/raddb/sites-available/abfab-tls
143@@ -25,7 +25,7 @@ listen {
144 enable = no
145 lifetime = 24 # hours
146 name = "abfab-tls"
147- # persist_dir = ${logdir}/abfab-tls
148+ # persist_dir = ${cachedir}/abfab-tls
149 }
150 require_client_cert = yes
151 verify {
152@@ -63,7 +63,7 @@ listen {
153 enable = no
154 lifetime = 24 # hours
155 name = "abfab-tls"
156- # persist_dir = ${logdir}/abfab-tls
157+ # persist_dir = ${cachedir}/abfab-tls
158 }
159 require_client_cert = yes
160 verify {
161diff --git a/raddb/sites-available/tls b/raddb/sites-available/tls
162index 8c8e06a..9f55b74 100644
163--- a/raddb/sites-available/tls
164+++ b/raddb/sites-available/tls
165@@ -366,11 +366,11 @@ listen {
166 # should be secured from anyone else. You might want
167 # a script to remove old files from here periodically:
168 #
169- # find ${logdir}/tlscache -mtime +2 -exec rm -f {} \;
170+ # find ${cachedir}/tlscache -mtime +2 -exec rm -f {} \;
171 #
172 # This feature REQUIRES "name" option be set above.
173 #
174- #persist_dir = "${logdir}/tlscache"
175+ #persist_dir = "${cachedir}/tlscache"
176 }
177
178 #
179--
1802.31.1
181