From 5d97f33775e539da678d2c893c68520ef3c72618 Mon Sep 17 00:00:00 2001
From: Jonathan Bauer
Date: Tue, 6 Dec 2011 17:23:02 +0100
Subject: eduroam plugin base (working for kdm)

---
 .../plugins/eduroam/OpenSLX/OSPlugin/eduroam.pm    | 138 +++++++++++++++++++++
 src/os-plugins/plugins/eduroam/XX_eduroam.sh       |  40 ++++++
 .../plugins/eduroam/files/etc/pam.d/radius-auth    |  31 +++++
 .../plugins/eduroam/files/etc/pam_radius_auth.conf |  30 +++++
 .../eduroam/files/lib/security/pam_script.so       | Bin 0 -> 9548 bytes
 .../files/usr/share/libpam-script/pam_script_auth  |  60 +++++++++
 .../usr/share/libpam-script/pam_script_ses_close   |  37 ++++++
 .../usr/share/libpam-script/pam_script_ses_open    |  20 +++
 8 files changed, 356 insertions(+)
 create mode 100644 src/os-plugins/plugins/eduroam/OpenSLX/OSPlugin/eduroam.pm
 create mode 100644 src/os-plugins/plugins/eduroam/XX_eduroam.sh
 create mode 100644 src/os-plugins/plugins/eduroam/files/etc/pam.d/radius-auth
 create mode 100644 src/os-plugins/plugins/eduroam/files/etc/pam_radius_auth.conf
 create mode 100644 src/os-plugins/plugins/eduroam/files/lib/security/pam_script.so
 create mode 100755 src/os-plugins/plugins/eduroam/files/usr/share/libpam-script/pam_script_auth
 create mode 100755 src/os-plugins/plugins/eduroam/files/usr/share/libpam-script/pam_script_ses_close
 create mode 100755 src/os-plugins/plugins/eduroam/files/usr/share/libpam-script/pam_script_ses_open

(limited to 'src/os-plugins/plugins')

diff --git a/src/os-plugins/plugins/eduroam/OpenSLX/OSPlugin/eduroam.pm b/src/os-plugins/plugins/eduroam/OpenSLX/OSPlugin/eduroam.pm
new file mode 100644
index 00000000..c5c74c17
--- /dev/null
+++ b/src/os-plugins/plugins/eduroam/OpenSLX/OSPlugin/eduroam.pm
@@ -0,0 +1,138 @@
+# Copyright (c) 2007..2011 - OpenSLX GmbH
+#
+# This program is free software distributed under the GPL version 2.
+# See http://openslx.org/COPYING
+#
+# If you have any feedback please consult http://openslx.org/feedback and
+# send your suggestions, praise, or complaints to feedback@openslx.org
+#
+# General information about OpenSLX can be found at http://openslx.org/
+# -----------------------------------------------------------------------------
+# eduroam.pm
+# -----------------------------------------------------------------------------
+package OpenSLX::OSPlugin::eduroam;
+
+use strict;
+use warnings;
+
+use base qw(OpenSLX::OSPlugin::Base);
+
+use File::Path;
+
+use OpenSLX::Basics;
+use OpenSLX::Utils;
+use OpenSLX::DistroUtils;
+
+sub new
+{
+    my $class = shift;
+
+    my $self = {
+        name => 'eduroam',
+    };
+
+    return bless $self, $class;
+}
+
+sub getInfo
+{
+    my $self = shift;
+
+    return {
+        description => unshiftHereDoc(<<'        End-of-Here'),
+            Splashscreen for the boot process using eduroam.
+        End-of-Here
+        precedence => 30,
+    };
+}
+
+sub getAttrInfo
+{
+    my $self = shift;
+
+    return {
+        'eduroam::active' => {
+            applies_to_systems => 1,
+            applies_to_clients => 1,
+            description => unshiftHereDoc(<<'            End-of-Here'),
+                should the eduroam-plugin be executed during boot?
+            End-of-Here
+            content_regex => qr{^(0|1)$},
+            content_descr => '1 means active - 0 means inactive',
+            default => '1',
+        },
+    };
+}
+
+sub suggestAdditionalKernelParams
+{
+    my $self                = shift;
+    my $makeInitRamFSEngine = shift;
+
+    my @suggestedParams;
+
+    return @suggestedParams;
+}
+
+sub suggestAdditionalKernelModules
+{
+    my $self                = shift;
+    my $makeInitRamFSEngine = shift;
+
+    my @suggestedModules;
+
+    return @suggestedModules;
+}
+
+sub installationPhase
+{
+    my $self = shift;
+    my $info = shift;
+
+    my $engine = $self->{'os-plugin-engine'};
+    my @installedPackages = $engine->getInstalledPackages();
+    my $found = 0;
+    foreach (@installedPackages) {
+        if ($_ eq "libpam-radius-auth") {
+            $found = 1;
+        }
+    }
+    # if not found, install it
+    if ($found == 0) {
+        vlog(0, _tr("Missing package 'libpam-radius-auth', installing...\n"));
+        $engine->installPackages('libpam-radius-auth');
+    }
+
+    $self->{pluginRepositoryPath} = $info->{'plugin-repo-path'};
+    $self->{openslxBasePath} = $info->{'openslx-base-path'};
+
+    my $eduroamFilesPath = "$self->{openslxBasePath}/lib/plugins/eduroam/files";
+    my $pluginRepoPath = "$self->{pluginRepositoryPath}";
+
+    copyDir("$eduroamFilesPath", "$pluginRepoPath");
+    #copyDir("$eduroamFilesPath/lib", "$pluginRepoPath");
+    #copyDir("$eduroamFilesPath/etc", "$pluginRepoPath");
+
+    return;
+}
+
+sub removalPhase
+{
+    my $self = shift;
+    my $info = shift;
+
+    return;
+}
+
+
+sub copyRequiredFilesIntoInitramfs
+{
+    my $self                = shift;
+    my $targetPath          = shift;
+    my $attrs               = shift;
+    my $makeInitRamFSEngine = shift;
+
+    return;
+}
+
+1;
diff --git a/src/os-plugins/plugins/eduroam/XX_eduroam.sh b/src/os-plugins/plugins/eduroam/XX_eduroam.sh
new file mode 100644
index 00000000..fe8bcef6
--- /dev/null
+++ b/src/os-plugins/plugins/eduroam/XX_eduroam.sh
@@ -0,0 +1,40 @@
+# Copyright (c) 2007..2008 - RZ Uni Freiburg
+# Copyright (c) 2008 - 2009 OpenSLX GmbH
+#
+# This program/file is free software distributed under the GPL version 2.
+# See http://openslx.org/COPYING
+#
+# If you have any feedback please consult http://openslx.org/feedback and
+# send your feedback to feedback@openslx.org
+#
+# General information about OpenSLX can be found at http://openslx.org
+#
+# stage3 part of 'eduroam' plugin
+#
+# script is included from init via the "." load function - thus it has all
+# variables and functions available
+
+if [ -e /initramfs/plugin-conf/eduroam.conf ]; then
+  . /initramfs/plugin-conf/eduroam.conf
+  if [ $eduroam_active -ne 0 ]; then
+    [ $DEBUGLEVEL -gt 0 ] && echo "executing the 'eduroam' plugin...";
+
+    # copy files
+    
+    cp /mnt/opt/openslx/plugin-repo/eduroam/files/lib/security/pam_script.so \
+       /mnt/lib/security
+    cp /mnt/opt/openslx/plugin-repo/eduroam/files/etc/pam_radius_auth.conf \
+       /mnt/etc
+    cp /mnt/opt/openslx/plugin-repo/eduroam/files/etc/pam.d/radius-auth \
+       /mnt/etc/pam.d
+    cp -r /mnt/opt/openslx/plugin-repo/eduroam/files/usr/share \
+          /mnt/usr/share
+
+    # activate eduroam in kdm
+    # TODO: for other desktop managers
+    sed 's/@include common-auth/@include radius-auth/g' -i /mnt/etc/pam.d/kdm
+    
+    [ $DEBUGLEVEL -gt 0 ] && echo "done with the 'eduroam' plugin...";
+  fi
+fi
+
diff --git a/src/os-plugins/plugins/eduroam/files/etc/pam.d/radius-auth b/src/os-plugins/plugins/eduroam/files/etc/pam.d/radius-auth
new file mode 100644
index 00000000..97f005f4
--- /dev/null
+++ b/src/os-plugins/plugins/eduroam/files/etc/pam.d/radius-auth
@@ -0,0 +1,31 @@
+#
+# /etc/pam.d/common-auth - authentication settings common to all services
+#
+# This file is included from other service-specific PAM config files,
+# and should contain a list of the authentication modules that define
+# the central authentication scheme for use on the system
+# (e.g., /etc/shadow, LDAP, Kerberos, etc.).  The default is to use the
+# traditional Unix authentication mechanisms.
+#
+# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
+# To take advantage of this, it is recommended that you configure any
+# local modules either before or after the default block, and use
+# pam-auth-update to manage selection of other modules.  See
+# pam-auth-update(8) for details.
+
+# try to authenticate with radius, if succeeds create local user.
+auth	optional	pam_script.so	radius
+auth	[success=ok user_unknown=1 default=1]	pam_radius_auth.so debug
+auth	[success=3 default=ignore]	pam_script.so	create_user
+auth	optional	pam_script.so	unix
+auth	[success=1 new_authtok_reqd=ok user_unknown=die default=ignore]	pam_unix.so nullok_secure debug try_first_pass
+
+# here's the fallback if no module succeeds
+auth	requisite			pam_deny.so
+# prime the stack with a positive return value if there isn't one already;
+# this avoids us returning an error just because nothing sets a success code
+# since the modules above will each just jump around
+auth	required			pam_permit.so
+# and here are more per-package modules (the "Additional" block)
+#auth	optional	pam_mount.so 
+# end of pam-auth-update config
diff --git a/src/os-plugins/plugins/eduroam/files/etc/pam_radius_auth.conf b/src/os-plugins/plugins/eduroam/files/etc/pam_radius_auth.conf
new file mode 100644
index 00000000..5f3de0a5
--- /dev/null
+++ b/src/os-plugins/plugins/eduroam/files/etc/pam_radius_auth.conf
@@ -0,0 +1,30 @@
+#  pam_radius_auth configuration file.  Copy to: /etc/raddb/server
+#
+#  For proper security, this file SHOULD have permissions 0600,
+#  that is readable by root, and NO ONE else.  If anyone other than
+#  root can read this file, then they can spoof responses from the server!
+#
+#  There are 3 fields per line in this file.  There may be multiple
+#  lines.  Blank lines or lines beginning with '#' are treated as
+#  comments, and are ignored.  The fields are:
+#
+#  server[:port] secret [timeout]
+#
+#  the port name or number is optional.  The default port name is
+#  "radius", and is looked up from /etc/services The timeout field is
+#  optional.  The default timeout is 3 seconds.
+#
+#  If multiple RADIUS server lines exist, they are tried in order.  The
+#  first server to return success or failure causes the module to return
+#  success or failure.  Only if a server fails to response is it skipped,
+#  and the next server in turn is used.
+#
+#  The timeout field controls how many seconds the module waits before
+#  deciding that the server has failed to respond.
+#
+# server[:port]	shared_secret      timeout (s)
+
+#
+# having localhost in your radius configuration is a Good Thing.
+#
+# See the INSTALL file for pam.conf hints.
diff --git a/src/os-plugins/plugins/eduroam/files/lib/security/pam_script.so b/src/os-plugins/plugins/eduroam/files/lib/security/pam_script.so
new file mode 100644
index 00000000..f1af8245
Binary files /dev/null and b/src/os-plugins/plugins/eduroam/files/lib/security/pam_script.so differ
diff --git a/src/os-plugins/plugins/eduroam/files/usr/share/libpam-script/pam_script_auth b/src/os-plugins/plugins/eduroam/files/usr/share/libpam-script/pam_script_auth
new file mode 100755
index 00000000..6f3e7ec6
--- /dev/null
+++ b/src/os-plugins/plugins/eduroam/files/usr/share/libpam-script/pam_script_auth
@@ -0,0 +1,60 @@
+#!/bin/bash
+# pam_script_auth
+
+# file to write authentification method to
+file=/var/run/eduroam_auth_method
+
+# check given argument
+case "$1" in
+
+  "radius" )
+  # auth method, write it to file
+  echo "[$PAM_TYPE] Verifying credentials (through $1)..."
+  #echo "$1" > $file.$PAM_USER
+  ;;
+
+  "create_user" )
+  # create user
+  # check if user exists
+  if [ "x$(cat /etc/passwd | grep ^$PAM_USER | wc -l)" == "x1" ]
+  then
+    # user exists
+    echo "[$PAM_TYPE] User $PAM_USER exists already."               
+  else
+    # user does not exists, create it.
+    echo "[$PAM_TYPE] User $PAM_USER does not exist."
+    echo "[$PAM_TYPE] Creating user $PAM_USER ..."
+
+    uid_file=/var/run/eduroam_lastuid
+    # check for /var/run/eduroam_lastuid
+    [ ! -f $uid_file ] && echo "234299000" > $uid_file
+
+    # set user information
+    uid=$(($(cat $uid_file)+1))
+    gid=1001
+    homedir=/home/$PAM_USER
+    uinfo="Eduroam Guest"
+    ushell=/bin/bash
+
+    # create home directory
+    mkdir $homedir
+    chown $uid:$gid $homedir
+
+    # create /etc/passwd entry
+    echo "$PAM_USER:x:$uid:$gid:$uinfo:$homedir:$ushell" >> /etc/passwd
+
+    # create /etc/shadow entry
+    # set today's date for last pw change
+    pwlastchange=$(($(date +%s) / 60 / 60 / 24))
+    echo "$PAM_USER:x:$pwlastchange:0:99999:7:::" >> /etc/shadow
+
+    # user creation done, adjust uid_file
+    echo "$uid" > $uid_file
+  fi
+  ;;
+
+  * )
+  echo "[$PAM_TYPE] $0 unrecognized parameter: $1 (ignoring)."
+  ;;
+
+esac
diff --git a/src/os-plugins/plugins/eduroam/files/usr/share/libpam-script/pam_script_ses_close b/src/os-plugins/plugins/eduroam/files/usr/share/libpam-script/pam_script_ses_close
new file mode 100755
index 00000000..0568fd64
--- /dev/null
+++ b/src/os-plugins/plugins/eduroam/files/usr/share/libpam-script/pam_script_ses_close
@@ -0,0 +1,37 @@
+#!/bin/bash
+# pam_script_ses_close
+# ran by root after user closes session
+
+echo "[$PAM_TYPE] Closing session for $PAM_USER..."
+# minimal uid: users with uid under this wont get deleted.
+MIN_UID=234299000
+
+# remove local user & home dir
+# only execute for uid > MIN_UID
+#if [ $(id -u $PAM_USER) -gt $MIN_UID -a "x$(cat /var/run/eduroam_auth_method.$PAM_USER)" == "xradius" ]
+if [ $(id -u $PAM_USER) -gt $MIN_UID ]
+then
+  #[ -f /var/run/eduroam_auth_method.$PAM_USER ] && rm /var/run/eduroam_auth_method.$PAM_USER
+  
+  # decrement session
+  session_counter=/tmp/$PAM_USER.sessioncount
+  session_count=$(cat $session_counter)
+  echo "$(($session_count-1))" > $session_counter  
+  
+  # home dir ugly purge ... (log to debug...)
+  log=/var/log/eduroam
+  [ -f $log ] && rm $log
+  if [ -d /home/$PAM_USER ] 
+  then
+    umount -fl /home/$PAM_USER/.gvfs &>> $log
+    chown -R root:root /home/$PAM_USER &>> $log
+    chmod -R a+rwx /home/$PAM_USER &>> $log
+    rm -rf /home/$PAM_USER &>> $log
+  fi
+  find /tmp -user $PAM_USER -delete
+  sed -i "/^$PAM_USER/d" /etc/passwd
+  sed -i "/^$PAM_USER/d" /etc/shadow
+  echo "[$PAM_TYPE] Local user deleted." 
+fi
+
+echo "[$PAM_TYPE] Hope you enjoyed your stay $PAM_USER."
diff --git a/src/os-plugins/plugins/eduroam/files/usr/share/libpam-script/pam_script_ses_open b/src/os-plugins/plugins/eduroam/files/usr/share/libpam-script/pam_script_ses_open
new file mode 100755
index 00000000..4ca474b9
--- /dev/null
+++ b/src/os-plugins/plugins/eduroam/files/usr/share/libpam-script/pam_script_ses_open
@@ -0,0 +1,20 @@
+#!/bin/bash
+# pam_script session open script.
+# This script is executed by root when a new session is opened.
+echo "[$PAM_TYPE] Creating new session for $PAM_USER."
+
+min_uid=234299000
+[ $(id -u $PAM_USER) -gt $min_uid ] || exit 0
+
+session_counter=/tmp/$PAM_USER.sessioncount
+num_user_proc=$(ps aux|grep $PAM_USER -c|grep -v grep)
+
+if [ $num_user_proc -eq 0 ]
+then
+  # no running session, write 1 since we are creating a new session.
+  echo "1" > $session_counter
+else
+  # running session, increment
+  current_count=$(cat $session_counter)
+  echo "$(($current_count+1))" > $session_counter
+fi
-- 
cgit v1.2.3-55-g7522