Initial commit
This commit is contained in:
lordwelch
commit
d8bec448ad
7
.dockerignore
Normal file
7
.dockerignore
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
freepydius.py
|
||||||
|
venv
|
||||||
|
def
|
||||||
|
policies
|
||||||
|
requirements.txt
|
||||||
|
*.ipt
|
||||||
|
*.acl
|
||||||
4
.flake8
Normal file
4
.flake8
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
[flake8]
|
||||||
|
max-line-length = 120
|
||||||
|
extend-ignore = E203, E501, E722
|
||||||
|
extend-exclude = venv
|
||||||
262
.gitignore
vendored
Normal file
262
.gitignore
vendored
Normal file
@ -0,0 +1,262 @@
|
|||||||
|
*~
|
||||||
|
|
||||||
|
# temporary files which can be created if a process still has a handle open of a deleted file
|
||||||
|
.fuse_hidden*
|
||||||
|
|
||||||
|
# KDE directory preferences
|
||||||
|
.directory
|
||||||
|
|
||||||
|
# Linux trash folder which might appear on any partition or disk
|
||||||
|
.Trash-*
|
||||||
|
|
||||||
|
# .nfs files are created when an open file is removed but is still being accessed
|
||||||
|
.nfs*
|
||||||
|
|
||||||
|
# Windows thumbnail cache files
|
||||||
|
Thumbs.db
|
||||||
|
Thumbs.db:encryptable
|
||||||
|
ehthumbs.db
|
||||||
|
ehthumbs_vista.db
|
||||||
|
|
||||||
|
# Dump file
|
||||||
|
*.stackdump
|
||||||
|
|
||||||
|
# Folder config file
|
||||||
|
[Dd]esktop.ini
|
||||||
|
|
||||||
|
# Recycle Bin used on file shares
|
||||||
|
$RECYCLE.BIN/
|
||||||
|
|
||||||
|
# Windows Installer files
|
||||||
|
*.cab
|
||||||
|
*.msi
|
||||||
|
*.msix
|
||||||
|
*.msm
|
||||||
|
*.msp
|
||||||
|
|
||||||
|
# Windows shortcuts
|
||||||
|
*.lnk
|
||||||
|
|
||||||
|
# General
|
||||||
|
.DS_Store
|
||||||
|
.AppleDouble
|
||||||
|
.LSOverride
|
||||||
|
|
||||||
|
# Icon must end with two \r
|
||||||
|
Icon
|
||||||
|
|
||||||
|
# Thumbnails
|
||||||
|
._*
|
||||||
|
|
||||||
|
# Files that might appear in the root of a volume
|
||||||
|
.DocumentRevisions-V100
|
||||||
|
.fseventsd
|
||||||
|
.Spotlight-V100
|
||||||
|
.TemporaryItems
|
||||||
|
.Trashes
|
||||||
|
.VolumeIcon.icns
|
||||||
|
.com.apple.timemachine.donotpresent
|
||||||
|
|
||||||
|
# Directories potentially created on remote AFP share
|
||||||
|
.AppleDB
|
||||||
|
.AppleDesktop
|
||||||
|
Network Trash Folder
|
||||||
|
Temporary Items
|
||||||
|
.apdisk
|
||||||
|
|
||||||
|
# Cache files for Sublime Text
|
||||||
|
*.tmlanguage.cache
|
||||||
|
*.tmPreferences.cache
|
||||||
|
*.stTheme.cache
|
||||||
|
|
||||||
|
# Workspace files are user-specific
|
||||||
|
*.sublime-workspace
|
||||||
|
|
||||||
|
# Project files should be checked into the repository, unless a significant
|
||||||
|
# proportion of contributors will probably not be using Sublime Text
|
||||||
|
# *.sublime-project
|
||||||
|
|
||||||
|
# SFTP configuration file
|
||||||
|
sftp-config.json
|
||||||
|
sftp-config-alt*.json
|
||||||
|
|
||||||
|
# Package control specific files
|
||||||
|
Package Control.last-run
|
||||||
|
Package Control.ca-list
|
||||||
|
Package Control.ca-bundle
|
||||||
|
Package Control.system-ca-bundle
|
||||||
|
Package Control.cache/
|
||||||
|
Package Control.ca-certs/
|
||||||
|
Package Control.merged-ca-bundle
|
||||||
|
Package Control.user-ca-bundle
|
||||||
|
oscrypto-ca-bundle.crt
|
||||||
|
bh_unicode_properties.cache
|
||||||
|
|
||||||
|
# Sublime-github package stores a github token in this file
|
||||||
|
# https://packagecontrol.io/packages/sublime-github
|
||||||
|
GitHub.sublime-settings
|
||||||
|
|
||||||
|
# Byte-compiled / optimized / DLL files
|
||||||
|
__pycache__/
|
||||||
|
*.py[cod]
|
||||||
|
*$py.class
|
||||||
|
|
||||||
|
# C extensions
|
||||||
|
*.so
|
||||||
|
|
||||||
|
# Distribution / packaging
|
||||||
|
.Python
|
||||||
|
build/
|
||||||
|
develop-eggs/
|
||||||
|
dist/
|
||||||
|
downloads/
|
||||||
|
eggs/
|
||||||
|
.eggs/
|
||||||
|
lib/
|
||||||
|
lib64/
|
||||||
|
parts/
|
||||||
|
sdist/
|
||||||
|
var/
|
||||||
|
wheels/
|
||||||
|
share/python-wheels/
|
||||||
|
*.egg-info/
|
||||||
|
.installed.cfg
|
||||||
|
*.egg
|
||||||
|
MANIFEST
|
||||||
|
|
||||||
|
# PyInstaller
|
||||||
|
# Usually these files are written by a python script from a template
|
||||||
|
# before PyInstaller builds the exe, so as to inject date/other infos into it.
|
||||||
|
*.manifest
|
||||||
|
*.spec
|
||||||
|
|
||||||
|
# Installer logs
|
||||||
|
pip-log.txt
|
||||||
|
pip-delete-this-directory.txt
|
||||||
|
|
||||||
|
# Unit test / coverage reports
|
||||||
|
htmlcov/
|
||||||
|
.tox/
|
||||||
|
.nox/
|
||||||
|
.coverage
|
||||||
|
.coverage.*
|
||||||
|
.cache
|
||||||
|
nosetests.xml
|
||||||
|
coverage.xml
|
||||||
|
*.cover
|
||||||
|
*.py,cover
|
||||||
|
.hypothesis/
|
||||||
|
.pytest_cache/
|
||||||
|
cover/
|
||||||
|
|
||||||
|
# Translations
|
||||||
|
*.mo
|
||||||
|
*.pot
|
||||||
|
|
||||||
|
# Django stuff:
|
||||||
|
*.log
|
||||||
|
local_settings.py
|
||||||
|
db.sqlite3
|
||||||
|
db.sqlite3-journal
|
||||||
|
|
||||||
|
# Flask stuff:
|
||||||
|
instance/
|
||||||
|
.webassets-cache
|
||||||
|
|
||||||
|
# Scrapy stuff:
|
||||||
|
.scrapy
|
||||||
|
|
||||||
|
# Sphinx documentation
|
||||||
|
docs/_build/
|
||||||
|
|
||||||
|
# PyBuilder
|
||||||
|
.pybuilder/
|
||||||
|
target/
|
||||||
|
|
||||||
|
# Jupyter Notebook
|
||||||
|
.ipynb_checkpoints
|
||||||
|
|
||||||
|
# IPython
|
||||||
|
profile_default/
|
||||||
|
ipython_config.py
|
||||||
|
|
||||||
|
# pyenv
|
||||||
|
# For a library or package, you might want to ignore these files since the code is
|
||||||
|
# intended to run in multiple environments; otherwise, check them in:
|
||||||
|
# .python-version
|
||||||
|
|
||||||
|
# pipenv
|
||||||
|
# According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
|
||||||
|
# However, in case of collaboration, if having platform-specific dependencies or dependencies
|
||||||
|
# having no cross-platform support, pipenv may install dependencies that don't work, or not
|
||||||
|
# install all needed dependencies.
|
||||||
|
#Pipfile.lock
|
||||||
|
|
||||||
|
# poetry
|
||||||
|
# Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
|
||||||
|
# This is especially recommended for binary packages to ensure reproducibility, and is more
|
||||||
|
# commonly ignored for libraries.
|
||||||
|
# https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
|
||||||
|
#poetry.lock
|
||||||
|
|
||||||
|
# pdm
|
||||||
|
# Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
|
||||||
|
#pdm.lock
|
||||||
|
# pdm stores project-wide configurations in .pdm.toml, but it is recommended to not include it
|
||||||
|
# in version control.
|
||||||
|
# https://pdm.fming.dev/#use-with-ide
|
||||||
|
.pdm.toml
|
||||||
|
|
||||||
|
# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
|
||||||
|
__pypackages__/
|
||||||
|
|
||||||
|
# Celery stuff
|
||||||
|
celerybeat-schedule
|
||||||
|
celerybeat.pid
|
||||||
|
|
||||||
|
# SageMath parsed files
|
||||||
|
*.sage.py
|
||||||
|
|
||||||
|
# Environments
|
||||||
|
.env
|
||||||
|
.venv
|
||||||
|
env/
|
||||||
|
venv/
|
||||||
|
ENV/
|
||||||
|
env.bak/
|
||||||
|
venv.bak/
|
||||||
|
|
||||||
|
# Spyder project settings
|
||||||
|
.spyderproject
|
||||||
|
.spyproject
|
||||||
|
|
||||||
|
# Rope project settings
|
||||||
|
.ropeproject
|
||||||
|
|
||||||
|
# mkdocs documentation
|
||||||
|
/site
|
||||||
|
|
||||||
|
# mypy
|
||||||
|
.mypy_cache/
|
||||||
|
.dmypy.json
|
||||||
|
dmypy.json
|
||||||
|
|
||||||
|
# Pyre type checker
|
||||||
|
.pyre/
|
||||||
|
|
||||||
|
# pytype static type analyzer
|
||||||
|
.pytype/
|
||||||
|
|
||||||
|
# Cython debug symbols
|
||||||
|
cython_debug/
|
||||||
|
|
||||||
|
# PyCharm
|
||||||
|
# JetBrains specific template is maintained in a separate JetBrains.gitignore that can
|
||||||
|
# be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
|
||||||
|
# and can be added to the global gitignore or merged into this file. For a more nuclear
|
||||||
|
# option (not recommended) you can uncomment the following to ignore the entire idea folder.
|
||||||
|
.idea/
|
||||||
|
|
||||||
|
# acl files
|
||||||
|
*.acl
|
||||||
|
*.ipt
|
||||||
36
Dockerfile
Normal file
36
Dockerfile
Normal file
@ -0,0 +1,36 @@
|
|||||||
|
FROM ghcr.io/linuxserver/baseimage-alpine:3.15
|
||||||
|
|
||||||
|
# set version label
|
||||||
|
ARG BUILD_DATE
|
||||||
|
ARG VERSION
|
||||||
|
ARG FREERADIUS_VERSION
|
||||||
|
LABEL build_version="Linuxserver.io version:- ${VERSION} Build-date:- ${BUILD_DATE}"
|
||||||
|
LABEL maintainer="lordwelch"
|
||||||
|
|
||||||
|
# install packages
|
||||||
|
RUN \
|
||||||
|
apk add --no-cache --upgrade \
|
||||||
|
freeradius-python3 py3-paho-mqtt py3-netaddr && \
|
||||||
|
sed -i -e 's@/etc@/config@g' -e '/\suser =\|\sgroup =/s/^/#/g' -e 's@/var/log@/config/log/freeradius@g'\
|
||||||
|
/etc/raddb/radiusd.conf
|
||||||
|
|
||||||
|
|
||||||
|
##DO STUFF HERE
|
||||||
|
## END EACH LINE WITH && \
|
||||||
|
## EXCEPT THE LAST LINE OF THE BLOCK
|
||||||
|
|
||||||
|
|
||||||
|
# add local files
|
||||||
|
COPY root/ /
|
||||||
|
|
||||||
|
# ports and volumes
|
||||||
|
EXPOSE 1812/udp 1813/udp
|
||||||
|
VOLUME /config
|
||||||
|
|
||||||
|
## NOTES ##
|
||||||
|
## Delete files\folders not needed
|
||||||
|
## The User abc, should be running everything, give that permission in any case you need it.
|
||||||
|
## When creating init's Use 10's where posible, its to allow add stuff in between when needed. also, do not be afraid to split custom code into several little ones.
|
||||||
|
## user abc and folders /app /config /defaults are all created by baseimage
|
||||||
|
## the first available init script is 30<your script>
|
||||||
|
## you can comment the beginning of each new RUN block but you cannot comment between commands in each RUN block.
|
||||||
205
def/NETWORK.net
Normal file
205
def/NETWORK.net
Normal file
@ -0,0 +1,205 @@
|
|||||||
|
#
|
||||||
|
# Sample naming defintions for network objects
|
||||||
|
#
|
||||||
|
RFC1918 = 10.0.0.0/8 # non-public
|
||||||
|
172.16.0.0/12 # non-public
|
||||||
|
192.168.0.0/16 # non-public
|
||||||
|
|
||||||
|
INTERNAL = RFC1918
|
||||||
|
|
||||||
|
LOOPBACK = 127.0.0.0/8 # loopback
|
||||||
|
::1/128 # ipv6 loopback
|
||||||
|
|
||||||
|
RFC_3330 = 169.254.0.0/16 # special use IPv4 addresses - netdeploy
|
||||||
|
|
||||||
|
RFC_6598 = 100.64.0.0/10 # Shared Address Space
|
||||||
|
|
||||||
|
LINKLOCAL = FE80::/10 # IPv6 link-local
|
||||||
|
|
||||||
|
SITELOCAL = FEC0::/10 # Ipv6 Site-local
|
||||||
|
|
||||||
|
MULTICAST = 224.0.0.0/4 # IP multicast
|
||||||
|
FF00::/8 # IPv6 multicast
|
||||||
|
|
||||||
|
CLASS-E = 240.0.0.0/4
|
||||||
|
|
||||||
|
RESERVED = 0.0.0.0/8 # reserved
|
||||||
|
RFC1918
|
||||||
|
LOOPBACK
|
||||||
|
RFC_3330
|
||||||
|
RFC_6598
|
||||||
|
MULTICAST
|
||||||
|
CLASS-E
|
||||||
|
0000::/8 # reserved by IETF
|
||||||
|
0100::/8 # reserved by IETF
|
||||||
|
0200::/7 # reserved by IETF
|
||||||
|
0400::/6 # reserved by IETF
|
||||||
|
0800::/5 # reserved by IETF
|
||||||
|
1000::/4 # reserved by IETF
|
||||||
|
4000::/3 # reserved by IETF
|
||||||
|
6000::/3 # reserved by IETF
|
||||||
|
8000::/3 # reserved by IETF
|
||||||
|
A000::/3 # reserved by IETF
|
||||||
|
C000::/3 # reserved by IETF
|
||||||
|
E000::/4 # reserved by IETF
|
||||||
|
F000::/5 # reserved by IETF
|
||||||
|
F800::/6 # reserved by IETF
|
||||||
|
FC00::/7 # unique local unicast
|
||||||
|
FE00::/9 # reserved by IETF
|
||||||
|
LINKLOCAL # link local unicast
|
||||||
|
SITELOCAL # IPv6 site-local
|
||||||
|
|
||||||
|
PUBLIC = 1.0.0.0/8
|
||||||
|
2.0.0.0/7
|
||||||
|
4.0.0.0/6
|
||||||
|
8.0.0.0/7
|
||||||
|
11.0.0.0/8
|
||||||
|
12.0.0.0/6
|
||||||
|
16.0.0.0/4
|
||||||
|
32.0.0.0/3
|
||||||
|
64.0.0.0/3
|
||||||
|
96.0.0.0/6
|
||||||
|
100.0.0.0/10
|
||||||
|
100.128.0.0/9
|
||||||
|
101.0.0.0/8
|
||||||
|
102.0.0.0/7
|
||||||
|
104.0.0.0/5
|
||||||
|
112.0.0.0/5
|
||||||
|
120.0.0.0/6
|
||||||
|
124.0.0.0/7
|
||||||
|
126.0.0.0/8
|
||||||
|
128.0.0.0/3
|
||||||
|
160.0.0.0/5
|
||||||
|
168.0.0.0/8
|
||||||
|
169.0.0.0/9
|
||||||
|
169.128.0.0/10
|
||||||
|
169.192.0.0/11
|
||||||
|
169.224.0.0/12
|
||||||
|
169.240.0.0/13
|
||||||
|
169.248.0.0/14
|
||||||
|
169.252.0.0/15
|
||||||
|
169.255.0.0/16
|
||||||
|
170.0.0.0/7
|
||||||
|
172.0.0.0/12
|
||||||
|
172.32.0.0/11
|
||||||
|
172.64.0.0/10
|
||||||
|
172.128.0.0/9
|
||||||
|
173.0.0.0/8
|
||||||
|
174.0.0.0/7
|
||||||
|
176.0.0.0/4
|
||||||
|
192.0.1.0/24
|
||||||
|
192.0.3.0/24
|
||||||
|
192.0.4.0/22
|
||||||
|
192.0.8.0/21
|
||||||
|
192.0.16.0/20
|
||||||
|
192.0.32.0/19
|
||||||
|
192.0.64.0/18
|
||||||
|
192.0.128.0/17
|
||||||
|
192.1.0.0/16
|
||||||
|
192.2.0.0/15
|
||||||
|
192.4.0.0/14
|
||||||
|
192.8.0.0/13
|
||||||
|
192.16.0.0/12
|
||||||
|
192.32.0.0/11
|
||||||
|
192.64.0.0/10
|
||||||
|
192.128.0.0/11
|
||||||
|
192.160.0.0/13
|
||||||
|
192.169.0.0/16
|
||||||
|
192.170.0.0/15
|
||||||
|
192.172.0.0/14
|
||||||
|
192.176.0.0/12
|
||||||
|
192.192.0.0/10
|
||||||
|
193.0.0.0/8
|
||||||
|
194.0.0.0/7
|
||||||
|
196.0.0.0/7
|
||||||
|
198.0.0.0/12
|
||||||
|
198.16.0.0/15
|
||||||
|
198.20.0.0/14
|
||||||
|
198.24.0.0/13
|
||||||
|
198.32.0.0/12
|
||||||
|
198.48.0.0/15
|
||||||
|
198.50.0.0/16
|
||||||
|
198.51.0.0/18
|
||||||
|
198.51.64.0/19
|
||||||
|
198.51.96.0/22
|
||||||
|
198.51.101.0/24
|
||||||
|
198.51.102.0/23
|
||||||
|
198.51.104.0/21
|
||||||
|
198.51.112.0/20
|
||||||
|
198.51.128.0/17
|
||||||
|
198.52.0.0/14
|
||||||
|
198.56.0.0/13
|
||||||
|
198.64.0.0/10
|
||||||
|
198.128.0.0/9
|
||||||
|
199.0.0.0/8
|
||||||
|
200.0.0.0/7
|
||||||
|
202.0.0.0/8
|
||||||
|
203.0.0.0/18
|
||||||
|
203.0.64.0/19
|
||||||
|
203.0.96.0/20
|
||||||
|
203.0.112.0/24
|
||||||
|
203.0.114.0/23
|
||||||
|
203.0.116.0/22
|
||||||
|
203.0.120.0/21
|
||||||
|
203.0.128.0/17
|
||||||
|
203.1.0.0/16
|
||||||
|
203.2.0.0/15
|
||||||
|
203.4.0.0/14
|
||||||
|
203.8.0.0/13
|
||||||
|
203.16.0.0/12
|
||||||
|
203.32.0.0/11
|
||||||
|
203.64.0.0/10
|
||||||
|
203.128.0.0/9
|
||||||
|
204.0.0.0/6
|
||||||
|
208.0.0.0/4
|
||||||
|
|
||||||
|
ANY = 0.0.0.0/0
|
||||||
|
|
||||||
|
ANY_V6 = ::/0
|
||||||
|
|
||||||
|
ANY_MIXED = ANY
|
||||||
|
ANY_V6
|
||||||
|
|
||||||
|
# http://www.team-cymru.org/Services/Bogons/bogon-bn-agg.txt
|
||||||
|
# 22-Apr-2011
|
||||||
|
BOGON = 0.0.0.0/8
|
||||||
|
192.0.0.0/24
|
||||||
|
192.0.2.0/24
|
||||||
|
198.18.0.0/15
|
||||||
|
198.51.100.0/24
|
||||||
|
203.0.113.0/24
|
||||||
|
MULTICAST
|
||||||
|
CLASS-E
|
||||||
|
3FFE::/16 # 6bone
|
||||||
|
5F00::/8 # 6bone
|
||||||
|
2001:DB8::/32 # IPv6 documentation prefix
|
||||||
|
|
||||||
|
GOOGLE_PUBLIC_DNS_ANYCAST = 8.8.4.4/32 # IPv4 Anycast
|
||||||
|
8.8.8.8/32 # IPv4 Anycast
|
||||||
|
2001:4860:4860::8844/128 # IPv6 Anycast
|
||||||
|
2001:4860:4860::8888/128 # IPv6 Anycast
|
||||||
|
GOOGLE_DNS = GOOGLE_PUBLIC_DNS_ANYCAST
|
||||||
|
|
||||||
|
|
||||||
|
# The following are sample entires intended for us in the included
|
||||||
|
# sample policy file. These should be removed.
|
||||||
|
|
||||||
|
MANAGEMENT_SERVERS = 192.168.0.1/32
|
||||||
|
192.168.0.44/32
|
||||||
|
192.168.0.46/32
|
||||||
|
|
||||||
|
MAIL_SERVERS = 200.1.1.4/32 # Example mail server 1
|
||||||
|
200.1.1.5/32 # Example mail server 2
|
||||||
|
|
||||||
|
PUBLIC_NAT = 200.1.1.3/32 # Example company NAT address
|
||||||
|
|
||||||
|
NTP_SERVERS = 10.0.0.1/32 # Example NTP server
|
||||||
|
10.0.0.2/32 # Example NTP server
|
||||||
|
|
||||||
|
TACACS_SERVERS = 10.1.0.1/32 # Example tacacs server
|
||||||
|
10.1.0.2/32 # Example tacacs server
|
||||||
|
|
||||||
|
PUBLIC_IPV6_SERVERS = 2606:700:e:550:b01a::b00a # Example public web server
|
||||||
|
|
||||||
|
WEB_IPV6_SERVERS = 2620:15c:2c4:202:b0e7:158f:6a7a:3188/128 # Example web server
|
||||||
|
|
||||||
64
def/SERVICES.svc
Normal file
64
def/SERVICES.svc
Normal file
@ -0,0 +1,64 @@
|
|||||||
|
#
|
||||||
|
# Sample naming service definitions
|
||||||
|
#
|
||||||
|
WHOIS = 43/udp
|
||||||
|
SSH = 22/tcp
|
||||||
|
TELNET = 23/tcp
|
||||||
|
SMTP = 25/tcp
|
||||||
|
MAIL_SERVICES = SMTP
|
||||||
|
ESMTP
|
||||||
|
SMTP_SSL
|
||||||
|
POP_SSL
|
||||||
|
TIME = 37/tcp 37/udp
|
||||||
|
TACACS = 49/tcp
|
||||||
|
DNS = 53/tcp 53/udp
|
||||||
|
BOOTPS = 67/udp # BOOTP server
|
||||||
|
BOOTPC = 68/udp # BOOTP client
|
||||||
|
DHCP = BOOTPS
|
||||||
|
BOOTPC
|
||||||
|
TFTP = 69/tcp 69/udp
|
||||||
|
HTTP = 80/tcp
|
||||||
|
WEB_SERVICES = HTTP HTTPS
|
||||||
|
POP3 = 110/tcp
|
||||||
|
RPC = 111/udp
|
||||||
|
IDENT = 113/tcp 113/udp
|
||||||
|
NNTP = 119/tcp
|
||||||
|
NTP = 123/tcp 123/udp
|
||||||
|
MS_RPC_EPMAP = 135/udp 135/tcp
|
||||||
|
MS_137 = 137/udp
|
||||||
|
MS_138 = 138/udp
|
||||||
|
MS_139 = 139/tcp
|
||||||
|
IMAP = 143/tcp
|
||||||
|
SNMP = 161/udp
|
||||||
|
SNMP_TRAP = 162/udp
|
||||||
|
BGP = 179/tcp
|
||||||
|
IMAP3 = 220/tcp
|
||||||
|
LDAP = 389/tcp
|
||||||
|
LDAP_SERVICE = LDAP
|
||||||
|
LDAPS
|
||||||
|
HTTPS = 443/tcp
|
||||||
|
MS_445 = 445/tcp
|
||||||
|
SMTP_SSL = 465/tcp
|
||||||
|
IKE = 500/udp
|
||||||
|
SYSLOG = 514/udp
|
||||||
|
RTSP = 554/tcp
|
||||||
|
ESMTP = 587/tcp
|
||||||
|
LDAPS = 636/tcp
|
||||||
|
IMAPS = 993/tcp
|
||||||
|
POP_SSL = 995/tcp
|
||||||
|
HIGH_PORTS = 1024-65535/tcp 1024-65535/udp
|
||||||
|
MSSQL = 1433/tcp
|
||||||
|
MSSQL_MONITOR = 1434/tcp
|
||||||
|
RADIUS = 1812/tcp 1812/udp
|
||||||
|
HSRP = 1985/udp
|
||||||
|
NFSD = 2049/tcp 2049/udp
|
||||||
|
NETFLOW = 2056/udp
|
||||||
|
SQUID_PROXY = 3128/tcp
|
||||||
|
MYSQL = 3306/tcp
|
||||||
|
RDP = 3389/tcp
|
||||||
|
IPSEC = 4500/udp
|
||||||
|
POSTGRESQL = 5432/tcp
|
||||||
|
TRACEROUTE = 33434-33534/udp
|
||||||
|
|
||||||
|
|
||||||
|
MGMT = SSH 23/tcp 441/tcp 442/tcp
|
||||||
125
freepydius.py
Normal file
125
freepydius.py
Normal file
@ -0,0 +1,125 @@
|
|||||||
|
import json
|
||||||
|
import os
|
||||||
|
import os.path
|
||||||
|
from collections import defaultdict
|
||||||
|
|
||||||
|
import netaddr
|
||||||
|
import paho.mqtt.client as mqtt
|
||||||
|
import radiusd
|
||||||
|
|
||||||
|
|
||||||
|
def log(level, s):
|
||||||
|
"""Log function."""
|
||||||
|
radiusd.radlog(level, __name__ + ": " + s)
|
||||||
|
|
||||||
|
|
||||||
|
# The callback for when the client receives a CONNACK response from the server.
|
||||||
|
def on_connect(client, userdata, flags, rc):
|
||||||
|
print("Connected with result code " + str(rc))
|
||||||
|
|
||||||
|
# Subscribing in on_connect() means that if we lose the connection and
|
||||||
|
# reconnect then subscriptions will be renewed.
|
||||||
|
client.subscribe("router7/#")
|
||||||
|
|
||||||
|
|
||||||
|
def get_leases():
|
||||||
|
msgs = defaultdict(lambda: defaultdict(str))
|
||||||
|
|
||||||
|
# The callback for when a PUBLISH message is received from the server.
|
||||||
|
def on_message(client, userdata, msg):
|
||||||
|
lease = json.loads(msg.payload)
|
||||||
|
lease["identifier"] = os.path.basename(msg.topic)
|
||||||
|
msgs[lease["identifier"]] = defaultdict(str, lease)
|
||||||
|
|
||||||
|
client = mqtt.Client()
|
||||||
|
client.username_pw_set(os.getenv("MQTT_USERNAME"), os.getenv("MQTT_PASSWORD"))
|
||||||
|
client.on_connect = on_connect
|
||||||
|
client.on_message = on_message
|
||||||
|
|
||||||
|
client.connect("hassio.narnian.us", 1883, 60)
|
||||||
|
|
||||||
|
cont = True
|
||||||
|
count = 0
|
||||||
|
while cont:
|
||||||
|
client.loop(timeout=0.5)
|
||||||
|
client.loop(timeout=0.5)
|
||||||
|
client.loop(timeout=0.5)
|
||||||
|
client.loop(timeout=0.5)
|
||||||
|
if count == len(msgs):
|
||||||
|
break
|
||||||
|
count = len(msgs)
|
||||||
|
return msgs
|
||||||
|
|
||||||
|
|
||||||
|
def select_acls(lease):
|
||||||
|
acls = []
|
||||||
|
if lease["vendor_identifier"].contains("PS4"):
|
||||||
|
acls.append("DENY")
|
||||||
|
acls.append("WEB")
|
||||||
|
|
||||||
|
return acls
|
||||||
|
|
||||||
|
|
||||||
|
def ciscoize_acl_names(acls):
|
||||||
|
cisco = []
|
||||||
|
for acl in acls:
|
||||||
|
cisco.append(
|
||||||
|
tuple(
|
||||||
|
"Cisco-AVPair",
|
||||||
|
"+=",
|
||||||
|
f"ACS:CiscoSecure-Defined-ACL=#ACSACL#-${acl}-fuckcisc",
|
||||||
|
)
|
||||||
|
)
|
||||||
|
return cisco
|
||||||
|
|
||||||
|
|
||||||
|
def deciscoize_acl_name(acl_name):
|
||||||
|
return acl_name.split("#ACSACL#-")[1][0:-9]
|
||||||
|
|
||||||
|
|
||||||
|
def get_acl(acl_name):
|
||||||
|
with open(acl_name, encoding="utf-8") as f:
|
||||||
|
return f.read()
|
||||||
|
|
||||||
|
|
||||||
|
def authorize(p):
|
||||||
|
os.chdir(os.path.dirname(__file__))
|
||||||
|
log(radiusd.L_INFO, str(p))
|
||||||
|
print("*** authorize ***")
|
||||||
|
print("")
|
||||||
|
radiusd.radlog(radiusd.L_INFO, "*** radlog call in authorize ***")
|
||||||
|
print("")
|
||||||
|
print(p)
|
||||||
|
print("")
|
||||||
|
print(radiusd.config)
|
||||||
|
print("")
|
||||||
|
request = defaultdict(str, p["request"])
|
||||||
|
reply = [
|
||||||
|
("User-Name", request["User-Name"]),
|
||||||
|
]
|
||||||
|
|
||||||
|
if netaddr.valid_mac(request["User-Name"]):
|
||||||
|
leases = get_leases()
|
||||||
|
|
||||||
|
reply.extend(ciscoize_acl_names(select_acls(leases[request["User-Name"]])))
|
||||||
|
elif "#ACSACL#" in request["User-Name"]:
|
||||||
|
deciscoize_acl_name(request["User-Name"])
|
||||||
|
|
||||||
|
conf = [
|
||||||
|
("Auth-Type", "Accept"),
|
||||||
|
]
|
||||||
|
|
||||||
|
log(radiusd.L_INFO, str(reply))
|
||||||
|
log(radiusd.L_INFO, str(conf))
|
||||||
|
return (radiusd.RLM_MODULE_OK, tuple(reply), tuple(conf))
|
||||||
|
|
||||||
|
|
||||||
|
def authenticate(p):
|
||||||
|
os.chdir(os.path.dirname(__file__))
|
||||||
|
log(radiusd.L_INFO, str(p))
|
||||||
|
radiusd.radlog(radiusd.L_INFO, "*** radlog call in authenticate ***")
|
||||||
|
print("")
|
||||||
|
print(p)
|
||||||
|
print("")
|
||||||
|
print(radiusd.config)
|
||||||
|
return radiusd.RLM_MODULE_OK
|
||||||
114
policies/pol/sample_multitarget.pol
Normal file
114
policies/pol/sample_multitarget.pol
Normal file
@ -0,0 +1,114 @@
|
|||||||
|
#
|
||||||
|
# This is an example policy for capirca
|
||||||
|
#
|
||||||
|
header {
|
||||||
|
comment:: "this is a sample edge input filter that generates"
|
||||||
|
comment:: "multiple output formats."
|
||||||
|
# NOTES: iptables produces filter 'lines' that must be used as args to the
|
||||||
|
# '$ iptables' cmd, while Speedway produces stateful iptables filters
|
||||||
|
# compatible with iptables-restore (most people will prefer speedway)
|
||||||
|
target:: cisco default-web extended
|
||||||
|
target:: speedway INPUT
|
||||||
|
}
|
||||||
|
|
||||||
|
# #include 'includes/untrusted-networks-blocking.inc'
|
||||||
|
|
||||||
|
|
||||||
|
term permit-web-services {
|
||||||
|
# destination-address:: WEB_SERVERS
|
||||||
|
protocol:: tcp
|
||||||
|
destination-port:: WEB_SERVICES
|
||||||
|
action:: accept
|
||||||
|
}
|
||||||
|
|
||||||
|
header {
|
||||||
|
target:: cisco windows extended
|
||||||
|
}
|
||||||
|
|
||||||
|
term accept-dhcp {
|
||||||
|
comment:: "Optional - allow DHCP requests."
|
||||||
|
destination-port:: DHCP
|
||||||
|
protocol:: udp
|
||||||
|
action:: accept
|
||||||
|
}
|
||||||
|
|
||||||
|
term accept-dns {
|
||||||
|
destination-port:: DNS
|
||||||
|
protocol:: tcp udp
|
||||||
|
action:: accept
|
||||||
|
}
|
||||||
|
|
||||||
|
term accept-icmp {
|
||||||
|
protocol:: icmp
|
||||||
|
action:: accept
|
||||||
|
}
|
||||||
|
|
||||||
|
term default-deny {
|
||||||
|
action:: deny
|
||||||
|
}
|
||||||
|
|
||||||
|
header {
|
||||||
|
|
||||||
|
target:: cisco accept-internal-ssh extended
|
||||||
|
}
|
||||||
|
|
||||||
|
term accept-public-ssh {
|
||||||
|
destination-address:: PUBLIC
|
||||||
|
protocol:: tcp
|
||||||
|
destination-port:: SSH
|
||||||
|
action:: accept
|
||||||
|
}
|
||||||
|
|
||||||
|
header {
|
||||||
|
|
||||||
|
target:: cisco accept-internal-ssh extended
|
||||||
|
}
|
||||||
|
|
||||||
|
term allow-internal-ssh {
|
||||||
|
destination-address:: INTERNAL
|
||||||
|
protocol:: tcp
|
||||||
|
destination-port:: SSH
|
||||||
|
action:: accept
|
||||||
|
}
|
||||||
|
|
||||||
|
header {
|
||||||
|
|
||||||
|
target:: cisco accept-mgmt-ssh extended
|
||||||
|
}
|
||||||
|
|
||||||
|
term allow-mgmt-ssh {
|
||||||
|
destination-address:: MANAGEMENT_SERVERS
|
||||||
|
protocol:: tcp
|
||||||
|
destination-port:: MGMT
|
||||||
|
action:: accept
|
||||||
|
}
|
||||||
|
|
||||||
|
# term permit-tcp-established {
|
||||||
|
# destination-address:: MAIL_SERVERS WEB_SERVERS PUBLIC_NAT
|
||||||
|
# protocol:: tcp
|
||||||
|
# option:: tcp-established
|
||||||
|
# action:: accept
|
||||||
|
# }
|
||||||
|
|
||||||
|
# term permit-udp-established {
|
||||||
|
# destination-address:: MAIL_SERVERS WEB_SERVERS PUBLIC_NAT
|
||||||
|
# protocol:: udp
|
||||||
|
# source-port:: HIGH_PORTS
|
||||||
|
# action:: accept
|
||||||
|
# }
|
||||||
|
|
||||||
|
|
||||||
|
# header {
|
||||||
|
# comment:: "this is a sample output filter"
|
||||||
|
# target:: cisco edge-outbound extended
|
||||||
|
# target:: speedway OUTPUT
|
||||||
|
# }
|
||||||
|
|
||||||
|
# term deny-to-bad-destinations {
|
||||||
|
# destination-address:: RFC1918 BOGON RESERVED
|
||||||
|
# action:: deny
|
||||||
|
# }
|
||||||
|
|
||||||
|
# term default-accept {
|
||||||
|
# action:: accept
|
||||||
|
# }
|
||||||
12
pyproject.toml
Normal file
12
pyproject.toml
Normal file
@ -0,0 +1,12 @@
|
|||||||
|
[tool.black]
|
||||||
|
line-length = 120
|
||||||
|
|
||||||
|
[tool.isort]
|
||||||
|
line_length = 120
|
||||||
|
profile = "black"
|
||||||
|
|
||||||
|
[tool.pylint.messages_control]
|
||||||
|
disable = "C0330, C0326, C0115, C0116, C0103"
|
||||||
|
|
||||||
|
[tool.pylint.format]
|
||||||
|
max-line-length=120
|
||||||
6
requirements.txt
Normal file
6
requirements.txt
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
isort>=5.10
|
||||||
|
black>=22
|
||||||
|
flake8==4.*
|
||||||
|
flake8-encodings
|
||||||
|
netaddr==0.8.*
|
||||||
|
paho-mqtt==1.6.*
|
||||||
7
root/etc/cont-init.d/11-folders
Normal file
7
root/etc/cont-init.d/11-folders
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
#!/usr/bin/with-contenv bash
|
||||||
|
|
||||||
|
# make folders
|
||||||
|
mkdir -p \
|
||||||
|
/config/log/freeradius \
|
||||||
|
/config/raddb/
|
||||||
|
chown -R abc:abc /config/log
|
||||||
42
root/etc/cont-init.d/12-freeradius
Normal file
42
root/etc/cont-init.d/12-freeradius
Normal file
@ -0,0 +1,42 @@
|
|||||||
|
#!/usr/bin/with-contenv bash
|
||||||
|
|
||||||
|
migrate(){
|
||||||
|
local OLD_LOCATION="${1}"
|
||||||
|
local NEW_LOCATION="${2}"
|
||||||
|
|
||||||
|
if [[ -e ${OLD_LOCATION} ]];then
|
||||||
|
if [[ ! -e ${NEW_LOCATION} ]];then
|
||||||
|
echo "moving to ${NEW_LOCATION}"
|
||||||
|
cp -drT "${OLD_LOCATION}" "${NEW_LOCATION}"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
migrate_dir(){
|
||||||
|
local OLD_LOCATION="${1}"
|
||||||
|
local NEW_LOCATION="${2}"
|
||||||
|
mkdir -p "${NEW_LOCATION}"
|
||||||
|
|
||||||
|
for f in "${OLD_LOCATION}/"*; do
|
||||||
|
migrate "${f}" "${NEW_LOCATION}/${f#$OLD_LOCATION/}"
|
||||||
|
done
|
||||||
|
}
|
||||||
|
|
||||||
|
migrate /etc/raddb/README.rst /config/raddb/README.rst
|
||||||
|
migrate /etc/raddb/clients.conf /config/raddb/clients.conf
|
||||||
|
migrate /etc/raddb/dictionary /config/raddb/dictionary
|
||||||
|
migrate /etc/raddb/panic.gdb /config/raddb/panic.gdb
|
||||||
|
migrate /etc/raddb/proxy.conf /config/raddb/proxy.conf
|
||||||
|
migrate /etc/raddb/radiusd.conf /config/raddb/radiusd.conf
|
||||||
|
migrate /etc/raddb/templates.conf /config/raddb/templates.conf
|
||||||
|
migrate /etc/raddb/trigger.conf /config/raddb/trigger.conf
|
||||||
|
|
||||||
|
migrate /etc/raddb/mods-enabled /config/raddb/mods-enabled
|
||||||
|
migrate /etc/raddb/sites-enabled /config/raddb/sites-enabled
|
||||||
|
|
||||||
|
migrate_dir /etc/raddb/certs /config/raddb/certs
|
||||||
|
migrate_dir /etc/raddb/policy.d /config/raddb/policy.d
|
||||||
|
migrate_dir /etc/raddb/mods-available /config/raddb/mods-available
|
||||||
|
migrate_dir /etc/raddb/mods-config /config/raddb/mods-config
|
||||||
|
migrate_dir /etc/raddb/sites-available /config/raddb/sites-available
|
||||||
|
|
||||||
|
chown -R abc:abc /config
|
||||||
5
root/etc/services.d/freeradius3/finish
Executable file
5
root/etc/services.d/freeradius3/finish
Executable file
@ -0,0 +1,5 @@
|
|||||||
|
#!/usr/bin/execlineb -S1
|
||||||
|
if { s6-test ${1} -ne 0 }
|
||||||
|
if { s6-test ${1} -ne 256 }
|
||||||
|
|
||||||
|
s6-svscanctl -t /var/run/s6/services
|
||||||
10
root/etc/services.d/freeradius3/run
Executable file
10
root/etc/services.d/freeradius3/run
Executable file
@ -0,0 +1,10 @@
|
|||||||
|
#!/usr/bin/with-contenv bash
|
||||||
|
|
||||||
|
# parse env vars to options
|
||||||
|
OPTIONS=""
|
||||||
|
if [[ ${FREERADIUS_DEBUG} && ${FREERADIUS_DEBUG-x} ]]; then
|
||||||
|
OPTIONS+="-X "
|
||||||
|
fi
|
||||||
|
|
||||||
|
exec \
|
||||||
|
s6-setuidgid abc /usr/sbin/radiusd -l stdout -f -d /config/raddb ${OPTIONS}
|
||||||
Loading…
x
Reference in New Issue
Block a user