radiusd: Create rundir via SMF method script.

[sjorge]

No description provided.

[sjorge]

All looking good:

=> Creating /home/pbulk/build/net/freeradius/work/.smf_manifest.xml
/opt/local/bin/bsdinstall -c -o root -g root -m 644 /home/pbulk/build/net/freeradius/work/.smf_manifest.xml /home/pbulk/build/net/freeradius/work/.destdir/opt/local/lib/svc/manifest/freeradius.xml
=> Creating /home/pbulk/build/net/freeradius/work/.smf_radiusd
/usr/bin/rm -f /home/pbulk/build/net/freeradius/work/.destdir/opt/local/lib/*.a /home/pbulk/build/net/freeradius/work/.destdir/opt/local/lib/*.la
=> Generating CTF data
=> Automatic stripping of debug information
=> Automatic manual page handling
=> Generating post-install file lists
=> Checking file-check results for freeradius-3.0.20nb1
=> Checking for non-existent script interpreters in freeradius-3.0.20nb1
=> Checking file permissions in freeradius-3.0.20nb1
=> Checking for missing run-time search paths in freeradius-3.0.20nb1
=> Checking for SSP in freeradius-3.0.20nb1
=> Checking for work-directory references in freeradius-3.0.20nb1
=> Creating binary package /home/pbulk/build/net/freeradius/work/.packages/freeradius-3.0.20nb1.tgz
=> Copying CTF data
=> Copying CTF failures
===> Building binary package for freeradius-3.0.20nb1
=> Creating binary package /data/packages/SmartOS/trunk/x86_64/All/freeradius-3.0.20nb1.tgz

[sjorge]

Had a type on the var name so it did not get replaced, rebuilding

[sjorge]

Script looks good now but freeradius still fails to start, because it runs as radiusd user via smf:

mkdir: "/var/run/radiusd": Permission denied
chmod: WARNING: can't access /var/run/radiusd
chown: /var/run/radiusd: No such file or directory

    <method_context>
      <method_credential user='@RADIUS_USER@' group='@RADIUS_GROUP@' />
    </method_context>

freeradius can drop privilages if configured to do so (It does not by default)

security {
        user = radiusd
        group = radiusd
}

Looking at the netbsd rc scripts, it looks like the run radiusd as root:root, perhaps we should just do the same and let it up to the user to configure the security options. The way we do it now via smf does no allow the user to change the user in the via radiusd.conf as it will fail to change uid/gid while starting.

[sjorge]

Build went smooth, freeradius now starts as root and the svc script creates /var/run/radiusd after a reboot.

Settings (or some other user)

security {
        user = radiusd
        group = radiusd
}

Now also works and radiusd drops privilages to the configured user/group combo.

[sjorge]

feedback from jperkin on IRC:

• patch default config to use RADIUS_{USER,GROUP} (see mosquitto for example)

[sjorge]

nbb$ sudo egrep '(user|group) =' /usr/pkg/etc/raddb/radiusd.conf
        #  'group = shadow' for the server to be able to read the
        user = radiusd
        group = radiusd

(I removed the eap config, as I did not want to spend time setting up a ca/server/client certs)

nbb$ sudo /usr/pkg/share/examples/rc.d/radiusd start
Starting radiusd.
nbb$ ps aux | grep rad
radiusd 14429  0.0  1.9 223792 80460 ?     Ssl  12:34PM 0:00.11 /usr/pkg/sbin/radiusd

[jperkin]

Merged, thanks!