V001:Initial login
This commit is contained in:
Yatmesh
Submodule
+1
Submodule hospital_wifi added at b631b53a66
@@ -0,0 +1,343 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
set -Eeuo pipefail
|
||||||
|
umask 077
|
||||||
|
|
||||||
|
# FreeRADIUS 3 + MariaDB installer for Ubuntu 22.04/24.04.
|
||||||
|
# Run as root. Values can be overridden as environment variables; see --help.
|
||||||
|
|
||||||
|
DB_NAME="${DB_NAME:-radius}"
|
||||||
|
# Use a service-specific variable. Generic DB_USER is commonly exported by
|
||||||
|
# applications and previously caused FreeRADIUS to be configured as "hotspot".
|
||||||
|
RADIUS_DB_USER="${RADIUS_DB_USER:-radius}"
|
||||||
|
DB_USER="$RADIUS_DB_USER"
|
||||||
|
DB_PASSWORD="${DB_PASSWORD:-}"
|
||||||
|
RADIUS_CLIENT_NETWORK="${RADIUS_CLIENT_NETWORK:-127.0.0.2/32}"
|
||||||
|
RADIUS_CLIENT_SECRET="${RADIUS_CLIENT_SECRET:-}"
|
||||||
|
TEST_USERNAME="${TEST_USERNAME:-shree}"
|
||||||
|
TEST_PASSWORD="${TEST_PASSWORD:-test}"
|
||||||
|
CREATE_TEST_USER="${CREATE_TEST_USER:-yes}"
|
||||||
|
CREDENTIAL_FILE="${CREDENTIAL_FILE:-/root/freeradius-db-credentials}"
|
||||||
|
API_DOMAIN="${API_DOMAIN:-}"
|
||||||
|
API_PORT="${API_PORT:-}"
|
||||||
|
LE_EMAIL="${LE_EMAIL:-}"
|
||||||
|
|
||||||
|
usage() {
|
||||||
|
cat <<'EOF'
|
||||||
|
Usage: sudo [VAR=value ...] ./install_freeradius_mariadb.sh
|
||||||
|
|
||||||
|
Optional environment variables:
|
||||||
|
DB_NAME MariaDB database name (default: radius)
|
||||||
|
RADIUS_DB_USER MariaDB user, restricted to localhost (default: radius)
|
||||||
|
DB_PASSWORD Database password (random when omitted)
|
||||||
|
RADIUS_CLIENT_NETWORK Allowed NAS IP/CIDR (default: 127.0.0.2/32)
|
||||||
|
RADIUS_CLIENT_SECRET NAS shared secret (random when omitted)
|
||||||
|
CREATE_TEST_USER Create a test RADIUS user: yes/no (default: yes)
|
||||||
|
TEST_USERNAME SQL-backed test username (default: shree)
|
||||||
|
TEST_PASSWORD SQL-backed test password (default: test)
|
||||||
|
CREDENTIAL_FILE Root-only result file
|
||||||
|
API_DOMAIN Public API domain (prompted when omitted)
|
||||||
|
API_PORT Local API port (prompted; default: 8000)
|
||||||
|
LE_EMAIL Let's Encrypt email (prompted when omitted)
|
||||||
|
|
||||||
|
Example:
|
||||||
|
sudo RADIUS_CLIENT_NETWORK=10.10.0.0/24 \
|
||||||
|
RADIUS_CLIENT_SECRET='replace-with-a-long-secret' \
|
||||||
|
./install_freeradius_mariadb.sh
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
log() { printf '\n\033[1;34m==>\033[0m %s\n' "$*"; }
|
||||||
|
die() { printf '\nERROR: %s\n' "$*" >&2; exit 1; }
|
||||||
|
sql_escape() {
|
||||||
|
local escaped="${1//\\/\\\\}"
|
||||||
|
printf '%s' "${escaped//\'/\'\'}"
|
||||||
|
}
|
||||||
|
ini_escape() {
|
||||||
|
# Escape characters that are special in a double-quoted FreeRADIUS value or
|
||||||
|
# in the pipe-delimited sed replacement used below.
|
||||||
|
printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g; s/&/\\\&/g; s/|/\\|/g'
|
||||||
|
}
|
||||||
|
generate_secret() { openssl rand -base64 36 | tr -d '\n'; }
|
||||||
|
|
||||||
|
[[ "${1:-}" != "--help" && "${1:-}" != "-h" ]] || { usage; exit 0; }
|
||||||
|
[[ $EUID -eq 0 ]] || die "Run this script as root (sudo)."
|
||||||
|
[[ -r /etc/os-release ]] || die "Cannot identify the operating system."
|
||||||
|
# shellcheck disable=SC1091
|
||||||
|
. /etc/os-release
|
||||||
|
[[ "${ID:-}" == "ubuntu" ]] || die "This installer supports Ubuntu only."
|
||||||
|
[[ "$DB_NAME" =~ ^[A-Za-z0-9_]+$ ]] || die "DB_NAME may contain only letters, numbers, and underscores."
|
||||||
|
[[ "$DB_USER" =~ ^[A-Za-z0-9_]+$ ]] ||
|
||||||
|
die "RADIUS_DB_USER may contain only letters, numbers, and underscores."
|
||||||
|
[[ "$CREATE_TEST_USER" == "yes" || "$CREATE_TEST_USER" == "no" ]] ||
|
||||||
|
die "CREATE_TEST_USER must be yes or no."
|
||||||
|
[[ "$DB_PASSWORD$RADIUS_CLIENT_SECRET$TEST_USERNAME$TEST_PASSWORD" != *$'\n'* ]] ||
|
||||||
|
die "Credentials and usernames must not contain newline characters."
|
||||||
|
|
||||||
|
[[ -n "$API_DOMAIN" ]] || read -r -p "API domain name (example: api.example.com): " API_DOMAIN
|
||||||
|
[[ -n "$API_PORT" ]] || read -r -p "Local API port [8000]: " API_PORT
|
||||||
|
API_PORT="${API_PORT:-8000}"
|
||||||
|
[[ -n "$LE_EMAIL" ]] || read -r -p "Email for Let's Encrypt notices: " LE_EMAIL
|
||||||
|
API_DOMAIN="${API_DOMAIN,,}"
|
||||||
|
[[ "$API_DOMAIN" =~ ^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$ ]] ||
|
||||||
|
die "Enter a valid public domain name."
|
||||||
|
[[ "$API_PORT" =~ ^[0-9]+$ ]] && (( API_PORT >= 1 && API_PORT <= 65535 )) ||
|
||||||
|
die "API port must be between 1 and 65535."
|
||||||
|
[[ "$LE_EMAIL" =~ ^[^[:space:]@]+@[^[:space:]@]+\.[^[:space:]@]+$ ]] ||
|
||||||
|
die "Enter a valid email address."
|
||||||
|
|
||||||
|
export DEBIAN_FRONTEND=noninteractive
|
||||||
|
log "Installing FreeRADIUS, MariaDB, Nginx, Certbot, and supporting packages"
|
||||||
|
apt-get update
|
||||||
|
apt-get install -y freeradius freeradius-mysql freeradius-utils mariadb-server \
|
||||||
|
openssl ca-certificates nginx certbot python3-certbot-nginx
|
||||||
|
systemctl enable --now mariadb
|
||||||
|
|
||||||
|
DB_PASSWORD="${DB_PASSWORD:-$(generate_secret)}"
|
||||||
|
RADIUS_CLIENT_SECRET="${RADIUS_CLIENT_SECRET:-$(generate_secret)}"
|
||||||
|
if [[ "$CREATE_TEST_USER" == "yes" ]]; then
|
||||||
|
TEST_PASSWORD="${TEST_PASSWORD:-test}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
db_password_sql="$(sql_escape "$DB_PASSWORD")"
|
||||||
|
test_username_sql="$(sql_escape "$TEST_USERNAME")"
|
||||||
|
test_password_sql="$(sql_escape "$TEST_PASSWORD")"
|
||||||
|
|
||||||
|
log "Creating the MariaDB database and localhost-only service account"
|
||||||
|
mariadb <<SQL
|
||||||
|
CREATE DATABASE IF NOT EXISTS \`$DB_NAME\`
|
||||||
|
CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
|
||||||
|
CREATE USER IF NOT EXISTS '$DB_USER'@'localhost' IDENTIFIED BY '$db_password_sql';
|
||||||
|
ALTER USER '$DB_USER'@'localhost' IDENTIFIED BY '$db_password_sql';
|
||||||
|
GRANT SELECT, INSERT, UPDATE, DELETE ON \`$DB_NAME\`.* TO '$DB_USER'@'localhost';
|
||||||
|
FLUSH PRIVILEGES;
|
||||||
|
SQL
|
||||||
|
|
||||||
|
log "Verifying the FreeRADIUS MariaDB service account"
|
||||||
|
if ! MYSQL_PWD="$DB_PASSWORD" mariadb --protocol=socket \
|
||||||
|
--user="$DB_USER" --database="$DB_NAME" --batch --skip-column-names \
|
||||||
|
--execute="SELECT 1" | grep -qx 1; then
|
||||||
|
die "MariaDB login verification failed for '$DB_USER'@'localhost'."
|
||||||
|
fi
|
||||||
|
|
||||||
|
FR_DIR="/etc/freeradius/3.0"
|
||||||
|
SQL_SCHEMA="$FR_DIR/mods-config/sql/main/mariadb/schema.sql"
|
||||||
|
[[ -f "$SQL_SCHEMA" ]] || SQL_SCHEMA="/etc/freeradius/3.0/mods-config/sql/main/mysql/schema.sql"
|
||||||
|
[[ -f "$SQL_SCHEMA" ]] || die "FreeRADIUS MariaDB/MySQL schema was not installed."
|
||||||
|
|
||||||
|
if ! mariadb "$DB_NAME" -Nse "SHOW TABLES LIKE 'radcheck'" | grep -qx radcheck; then
|
||||||
|
log "Importing the official FreeRADIUS SQL schema"
|
||||||
|
mariadb "$DB_NAME" < "$SQL_SCHEMA"
|
||||||
|
else
|
||||||
|
log "FreeRADIUS SQL tables already exist; leaving them intact"
|
||||||
|
fi
|
||||||
|
|
||||||
|
sql_password_ini="$(ini_escape "$DB_PASSWORD")"
|
||||||
|
SQL_CONFIG="$FR_DIR/mods-available/sql"
|
||||||
|
[[ -e "$SQL_CONFIG" ]] || die "FreeRADIUS SQL module configuration was not found."
|
||||||
|
if [[ ! -e "${SQL_CONFIG}.before-aaa-installer" ]]; then
|
||||||
|
cp -a "$SQL_CONFIG" "${SQL_CONFIG}.before-aaa-installer"
|
||||||
|
fi
|
||||||
|
|
||||||
|
log "Configuring and enabling the FreeRADIUS SQL module"
|
||||||
|
sed -Ei \
|
||||||
|
-e 's|^[[:space:]]*dialect[[:space:]]*=.*|dialect = "mysql"|' \
|
||||||
|
-e 's|^[[:space:]]*driver[[:space:]]*=.*|driver = "rlm_sql_${dialect}"|' \
|
||||||
|
-e 's|^[[:space:]]*server[[:space:]]*=.*|server = "localhost"|' \
|
||||||
|
-e 's|^[[:space:]]*port[[:space:]]*=.*|port = 3306|' \
|
||||||
|
-e "s|^[[:space:]]*login[[:space:]]*=.*|login = \"$DB_USER\"|" \
|
||||||
|
-e "s|^[[:space:]]*password[[:space:]]*=.*|password = \"$sql_password_ini\"|" \
|
||||||
|
-e "s|^[[:space:]]*radius_db[[:space:]]*=.*|radius_db = \"$DB_NAME\"|" \
|
||||||
|
-e 's|^[[:space:]]*#[[:space:]]*read_clients[[:space:]]*=.*|read_clients = yes|' \
|
||||||
|
-e 's|^[[:space:]]*read_clients[[:space:]]*=.*|read_clients = yes|' \
|
||||||
|
"$SQL_CONFIG"
|
||||||
|
# MariaDB is localhost-only, so disable the sample SQL TLS block. This does not
|
||||||
|
# change RADIUS EAP/TLS. Use verified TLS instead if MariaDB is moved off-host.
|
||||||
|
sed -Ei '/^[[:space:]]*tls[[:space:]]*\{[[:space:]]*$/,/^[[:space:]]*\}[[:space:]]*$/ {
|
||||||
|
/^[[:space:]]*#/! s/^/#/
|
||||||
|
}' "$SQL_CONFIG"
|
||||||
|
ln -sfn ../mods-available/sql "$FR_DIR/mods-enabled/sql"
|
||||||
|
|
||||||
|
if ! grep -Fqx "login = \"$DB_USER\"" "$SQL_CONFIG" ||
|
||||||
|
! grep -Fqx "radius_db = \"$DB_NAME\"" "$SQL_CONFIG"; then
|
||||||
|
die "FreeRADIUS SQL login/database settings were not written correctly."
|
||||||
|
fi
|
||||||
|
enabled_sql_target="$(readlink -f "$FR_DIR/mods-enabled/sql")"
|
||||||
|
[[ "$enabled_sql_target" == "$(readlink -f "$SQL_CONFIG")" ]] ||
|
||||||
|
die "mods-enabled/sql does not point to the configured SQL module."
|
||||||
|
|
||||||
|
for site in "$FR_DIR/sites-enabled/default" "$FR_DIR/sites-enabled/inner-tunnel"; do
|
||||||
|
[[ -f "$site" ]] || continue
|
||||||
|
[[ -e "${site}.before-aaa-installer" ]] || cp -a "$site" "${site}.before-aaa-installer"
|
||||||
|
# Enable existing SQL calls in authorize/accounting/session/post-auth sections.
|
||||||
|
sed -Ei 's/^([[:space:]]*)-sql([[:space:]]*(#.*)?)$/\1sql\2/' "$site"
|
||||||
|
done
|
||||||
|
|
||||||
|
# Bind the public/default virtual server to every IPv4 interface. Do not expose
|
||||||
|
# inner-tunnel, which is intentionally a localhost-only internal listener.
|
||||||
|
sed -Ei 's/^([[:space:]]*)ipaddr[[:space:]]*=.*/\1ipaddr = */' \
|
||||||
|
"$FR_DIR/sites-enabled/default"
|
||||||
|
|
||||||
|
install -d -m 0750 "$FR_DIR/clients.d"
|
||||||
|
cat > "$FR_DIR/clients.d/aaa-installer.conf" <<EOF
|
||||||
|
# Managed by install_freeradius_mariadb.sh
|
||||||
|
# NAS clients are loaded from the MariaDB nas table by the SQL module.
|
||||||
|
EOF
|
||||||
|
chmod 0640 "$FR_DIR/clients.d/aaa-installer.conf"
|
||||||
|
|
||||||
|
if ! grep -Eq '^[[:space:]]*\$INCLUDE[[:space:]]+clients\.d/' "$FR_DIR/clients.conf"; then
|
||||||
|
printf '\n$INCLUDE clients.d/\n' >> "$FR_DIR/clients.conf"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ "$CREATE_TEST_USER" == "yes" ]]; then
|
||||||
|
log "Creating or updating the SQL-backed test user"
|
||||||
|
mariadb "$DB_NAME" <<SQL
|
||||||
|
DELETE FROM radcheck
|
||||||
|
WHERE username = '$test_username_sql' AND attribute = 'Cleartext-Password';
|
||||||
|
INSERT INTO radcheck (username, attribute, op, value)
|
||||||
|
VALUES ('$test_username_sql', 'Cleartext-Password', ':=', '$test_password_sql');
|
||||||
|
SQL
|
||||||
|
fi
|
||||||
|
|
||||||
|
log "Creating or updating SQL-backed NAS clients"
|
||||||
|
radius_client_network_sql="$(sql_escape "$RADIUS_CLIENT_NETWORK")"
|
||||||
|
radius_client_secret_sql="$(sql_escape "$RADIUS_CLIENT_SECRET")"
|
||||||
|
mariadb "$DB_NAME" <<SQL
|
||||||
|
DELETE FROM nas WHERE shortname IN ('aaa_nas_network', 'aaa_local_database_test');
|
||||||
|
INSERT INTO nas (nasname, shortname, type, ports, secret, server, community, description)
|
||||||
|
VALUES ('$radius_client_network_sql', 'aaa_nas_network', 'other', NULL,
|
||||||
|
'$radius_client_secret_sql', NULL, NULL, 'NAS network managed by installer');
|
||||||
|
SQL
|
||||||
|
if [[ "$RADIUS_CLIENT_NETWORK" != "127.0.0.2/32" ]]; then
|
||||||
|
mariadb "$DB_NAME" <<SQL
|
||||||
|
INSERT INTO nas (nasname, shortname, type, ports, secret, server, community, description)
|
||||||
|
VALUES ('127.0.0.2', 'aaa_local_database_test', 'other', NULL,
|
||||||
|
'$radius_client_secret_sql', NULL, NULL, 'Local SQL client loading test');
|
||||||
|
SQL
|
||||||
|
fi
|
||||||
|
|
||||||
|
log "Validating configuration and starting FreeRADIUS"
|
||||||
|
freeradius -XC
|
||||||
|
systemctl enable freeradius
|
||||||
|
systemctl restart freeradius
|
||||||
|
systemctl --no-pager --full is-active freeradius
|
||||||
|
ss -lunp | grep -E ':(1812|1813)[[:space:]]' ||
|
||||||
|
die "FreeRADIUS is running but UDP 1812/1813 listeners were not detected."
|
||||||
|
|
||||||
|
if [[ "$CREATE_TEST_USER" == "yes" ]]; then
|
||||||
|
log "Testing database-loaded NAS and SQL user authentication with radclient"
|
||||||
|
RADTEST_OUTPUT="$(
|
||||||
|
printf 'User-Name = "%s"\nUser-Password = "%s"\n' "$TEST_USERNAME" "$TEST_PASSWORD" |
|
||||||
|
radclient -x -i 127.0.0.2 127.0.0.1 auth "$RADIUS_CLIENT_SECRET" 2>&1
|
||||||
|
)" || {
|
||||||
|
printf '%s\n' "$RADTEST_OUTPUT" >&2
|
||||||
|
die "radclient failed. Inspect logs with: journalctl -u freeradius -n 100"
|
||||||
|
}
|
||||||
|
printf '%s\n' "$RADTEST_OUTPUT"
|
||||||
|
grep -q "Access-Accept" <<< "$RADTEST_OUTPUT" ||
|
||||||
|
die "SQL authentication test did not return Access-Accept."
|
||||||
|
printf 'SQL authentication test: PASS (Access-Accept for %s)\n' "$TEST_USERNAME"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if command -v ufw >/dev/null 2>&1 && ufw status | grep -q '^Status: active'; then
|
||||||
|
log "Opening RADIUS authentication/accounting ports in active UFW"
|
||||||
|
ufw allow from "$RADIUS_CLIENT_NETWORK" to any port 1812 proto udp
|
||||||
|
ufw allow from "$RADIUS_CLIENT_NETWORK" to any port 1813 proto udp
|
||||||
|
fi
|
||||||
|
|
||||||
|
log "Configuring Nginx and requesting a Let's Encrypt certificate"
|
||||||
|
LE_WEBROOT="/var/www/letsencrypt"
|
||||||
|
NGINX_SITE="/etc/nginx/sites-available/hotspot-otp-api"
|
||||||
|
install -d -m 0755 "$LE_WEBROOT"
|
||||||
|
cat > "$NGINX_SITE" <<EOF
|
||||||
|
server {
|
||||||
|
listen 80;
|
||||||
|
listen [::]:80;
|
||||||
|
server_name $API_DOMAIN;
|
||||||
|
location /.well-known/acme-challenge/ { root $LE_WEBROOT; }
|
||||||
|
location / {
|
||||||
|
proxy_pass http://127.0.0.1:$API_PORT;
|
||||||
|
proxy_set_header Host \$host;
|
||||||
|
proxy_set_header X-Real-IP \$remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto \$scheme;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
ln -sfn "$NGINX_SITE" /etc/nginx/sites-enabled/hotspot-otp-api
|
||||||
|
rm -f /etc/nginx/sites-enabled/default
|
||||||
|
nginx -t
|
||||||
|
systemctl enable --now nginx
|
||||||
|
systemctl reload nginx
|
||||||
|
if command -v ufw >/dev/null 2>&1 && ufw status | grep -q '^Status: active'; then
|
||||||
|
ufw allow 'Nginx Full'
|
||||||
|
fi
|
||||||
|
certbot certonly --webroot -w "$LE_WEBROOT" -d "$API_DOMAIN" \
|
||||||
|
--email "$LE_EMAIL" --agree-tos --no-eff-email --non-interactive
|
||||||
|
|
||||||
|
cat > "$NGINX_SITE" <<EOF
|
||||||
|
limit_req_zone \$binary_remote_addr zone=hotspot_api_ip:10m rate=10r/m;
|
||||||
|
upstream hotspot_otp_api {
|
||||||
|
server 127.0.0.1:$API_PORT;
|
||||||
|
keepalive 16;
|
||||||
|
}
|
||||||
|
server {
|
||||||
|
listen 80;
|
||||||
|
listen [::]:80;
|
||||||
|
server_name $API_DOMAIN;
|
||||||
|
location /.well-known/acme-challenge/ { root $LE_WEBROOT; }
|
||||||
|
location / { return 301 https://\$host\$request_uri; }
|
||||||
|
}
|
||||||
|
server {
|
||||||
|
listen 443 ssl http2;
|
||||||
|
listen [::]:443 ssl http2;
|
||||||
|
server_name $API_DOMAIN;
|
||||||
|
ssl_certificate /etc/letsencrypt/live/$API_DOMAIN/fullchain.pem;
|
||||||
|
ssl_certificate_key /etc/letsencrypt/live/$API_DOMAIN/privkey.pem;
|
||||||
|
ssl_protocols TLSv1.2 TLSv1.3;
|
||||||
|
ssl_session_cache shared:SSL:10m;
|
||||||
|
ssl_session_timeout 1d;
|
||||||
|
ssl_session_tickets off;
|
||||||
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||||
|
add_header X-Content-Type-Options nosniff always;
|
||||||
|
client_max_body_size 16k;
|
||||||
|
location / {
|
||||||
|
limit_req zone=hotspot_api_ip burst=10 nodelay;
|
||||||
|
proxy_pass http://hotspot_otp_api;
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
proxy_set_header Host \$host;
|
||||||
|
proxy_set_header X-Real-IP \$remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto \$scheme;
|
||||||
|
proxy_set_header X-Correlation-ID \$request_id;
|
||||||
|
proxy_connect_timeout 5s;
|
||||||
|
proxy_read_timeout 15s;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
nginx -t
|
||||||
|
systemctl reload nginx
|
||||||
|
systemctl enable --now certbot.timer
|
||||||
|
|
||||||
|
cat > "$CREDENTIAL_FILE" <<EOF
|
||||||
|
Created: $(date --iso-8601=seconds)
|
||||||
|
MariaDB database: $DB_NAME
|
||||||
|
MariaDB user: $DB_USER
|
||||||
|
MariaDB password: $DB_PASSWORD
|
||||||
|
MariaDB host: localhost
|
||||||
|
Allowed RADIUS client network: $RADIUS_CLIENT_NETWORK
|
||||||
|
RADIUS client shared secret: $RADIUS_CLIENT_SECRET
|
||||||
|
Test user created: $CREATE_TEST_USER
|
||||||
|
Test username: $([[ "$CREATE_TEST_USER" == "yes" ]] && printf '%s' "$TEST_USERNAME" || printf 'N/A')
|
||||||
|
Test password: $([[ "$CREATE_TEST_USER" == "yes" ]] && printf '%s' "$TEST_PASSWORD" || printf 'N/A')
|
||||||
|
API URL: https://$API_DOMAIN
|
||||||
|
API local port: $API_PORT
|
||||||
|
EOF
|
||||||
|
chmod 0600 "$CREDENTIAL_FILE"
|
||||||
|
|
||||||
|
log "Installation completed"
|
||||||
|
printf 'Credentials were saved root-only at: %s\n' "$CREDENTIAL_FILE"
|
||||||
|
if [[ "$CREATE_TEST_USER" == "yes" ]]; then
|
||||||
|
printf 'Repeat the test using the radclient command documented in README.md.\n'
|
||||||
|
fi
|
||||||
|
printf 'Logs: journalctl -u freeradius -f\n'
|
||||||
|
printf 'API URL: https://%s\n' "$API_DOMAIN"
|
||||||
Reference in New Issue
Block a user