Line 1... |
Line 1... |
1 |
<?php
|
1 |
<?php
|
2 |
/* written by steweb57 */
|
2 |
/* written by steweb57 & Rexy */
|
3 |
require_once("lib/alcasar/freeradius/siteconfig.php");
|
- |
|
4 |
require_once("lib/alcasar/freeradius/ldapconfig.php");
|
- |
|
5 |
/************************************************************************
|
3 |
/************************************************
|
6 |
* CONSTANTES AVEC CHEMINS DES FICHIERS DE CONFIGURATION *
|
4 |
* CONF FILES *
|
7 |
*************************************************************************/
|
5 |
*************************************************/
|
8 |
|
6 |
|
9 |
define ("ALCASAR_RADIUS_SITE", "/etc/raddb/sites-available/alcasar");
|
7 |
define ("ALCASAR_RADIUS_SITE", "/etc/raddb/sites-enabled/alcasar");
|
10 |
define ("ALCASAR_RADIUS_MODULE_LDAP", "/etc/raddb/modules/ldap");
|
8 |
define ("ALCASAR_RADIUS_MODULE_LDAP", "/etc/raddb/mods-available/ldap");
|
11 |
define ("ALCASAR_CONF_FILE", "/usr/local/etc/alcasar.conf");
|
9 |
define ("ALCASAR_CONF_FILE", "/usr/local/etc/alcasar.conf");
|
12 |
|
10 |
|
13 |
/****************************************************************
|
11 |
/****************************************************************
|
14 |
* FONCTION ERREUR *
|
12 |
* ERROR FONCTION *
|
15 |
*****************************************************************/
|
13 |
*****************************************************************/
|
16 |
|
14 |
|
17 |
function erreur($er){
|
15 |
function erreur($er){
|
18 |
header('Location:ldap.php?erreur=$er');
|
16 |
header('Location:ldap.php?erreur=$er');
|
19 |
exit();
|
17 |
exit();
|
20 |
}
|
18 |
}
|
21 |
|
19 |
|
22 |
/****************************************************************
|
20 |
/********************************************************
|
23 |
* VARIABLES DE FORMULAIRE *
|
21 |
* FORM VARIABLES *
|
24 |
*****************************************************************/
|
22 |
*********************************************************/
|
25 |
|
23 |
|
26 |
//Récupération des variables de formulaire
|
24 |
//Récupération des variables de formulaire
|
27 |
if (isset($_POST['auth_enable'])) $auth_enable = $_POST['auth_enable']; else erreur('Erreur de variable auth_enable');
|
25 |
if (isset($_POST['auth_enable'])) $auth_enable = $_POST['auth_enable']; else erreur('Erreur de variable auth_enable');
|
28 |
if ($auth_enable == "1"){ //test $auth_enable
|
26 |
if ($auth_enable == "1"){ //test $auth_enable
|
29 |
if (isset($_POST['ldap_server'])) $ldap_server = $_POST['ldap_server']; else erreur('Erreur de variable ldap_server');
|
27 |
if (isset($_POST['ldap_server'])) $ldap_server = $_POST['ldap_server']; else erreur('Erreur de variable ldap_server');
|
Line 53... |
Line 51... |
53 |
}
|
51 |
}
|
54 |
if (!file_exists(ALCASAR_RADIUS_MODULE_LDAP)){
|
52 |
if (!file_exists(ALCASAR_RADIUS_MODULE_LDAP)){
|
55 |
exit("Fichier de configuration du module ldap pour freeradius non présent");
|
53 |
exit("Fichier de configuration du module ldap pour freeradius non présent");
|
56 |
}
|
54 |
}
|
57 |
if (!is_writable(ALCASAR_RADIUS_SITE)){
|
55 |
if (!is_writable(ALCASAR_RADIUS_SITE)){
|
58 |
exit("Vous n'avez pas les droits d'écriture sur le fichier /etc/raddb/sites-available/alcasar");
|
56 |
exit("Vous n'avez pas les droits d'écriture sur le fichier /etc/raddb/sites-enabled/alcasar");
|
59 |
}
|
57 |
}
|
60 |
if (!is_writable(ALCASAR_RADIUS_MODULE_LDAP)){
|
58 |
if (!is_writable(ALCASAR_RADIUS_MODULE_LDAP)){
|
61 |
exit("Vous n'avez pas les droits d'écriture sur le fichier /etc/raddb/modules/ldap");
|
59 |
exit("Vous n'avez pas les droits d'écriture sur le fichier /etc/raddb/mods-available/ldap");
|
62 |
}
|
60 |
}
|
63 |
|
61 |
|
64 |
/****************************************************************
|
62 |
/****************************************************************
|
65 |
* Fichier ALCASAR_RADIUS_SITE *
|
63 |
* File sites-enabled/alcasar *
|
66 |
*****************************************************************/
|
64 |
*****************************************************************/
|
67 |
$site = new siteConfig();
|
- |
|
68 |
$site->load(ALCASAR_RADIUS_SITE);
|
- |
|
69 |
if ($auth_enable == "1"){ //test $auth_enable
|
- |
|
70 |
/*
|
65 |
/*
|
71 |
ON ACTIVE LE LDAP
|
66 |
ON ACTIVE LE LDAP
|
72 |
*/
|
67 |
*/
|
73 |
/*
|
68 |
/*
|
74 |
Configure autorize section with:
|
69 |
Configure autorize section with:
|
75 |
ldap {
|
70 |
ldap {
|
76 |
fail=1
|
71 |
fail=1
|
77 |
}
|
72 |
}
|
78 |
*/
|
73 |
*/
|
79 |
if ($site->authorize->ldap === false){ // always test before update
|
- |
|
80 |
$site->authorize->addSection('ldap');
|
- |
|
81 |
$site->authorize->ldap->addPair('fail','1');
|
- |
|
82 |
}else{
|
- |
|
83 |
if ($site->authorize->ldap->fail === false){ // always test before update
|
- |
|
84 |
$site->authorize->ldap->addPair('fail','1');
|
- |
|
85 |
}
|
- |
|
86 |
}
|
- |
|
87 |
/*
|
74 |
/*
|
88 |
Configure authenticate section with
|
75 |
Configure authenticate section with
|
89 |
Auth-Type LDAP {
|
76 |
Auth-Type LDAP {
|
90 |
ldap
|
77 |
ldap
|
91 |
}
|
78 |
}
|
92 |
*/
|
79 |
*/
|
93 |
if ($site->authenticate->getSectionInstance('Auth-Type','LDAP')===false){ // always test before update
|
- |
|
94 |
$site->authenticate->addSection('Auth-Type', 'LDAP');
|
- |
|
95 |
$site->authenticate->getSectionInstance('Auth-Type','LDAP')->addSection('ldap');
|
- |
|
96 |
}
|
- |
|
97 |
} else {
|
- |
|
98 |
/*
|
80 |
/*
|
99 |
ON DESACTIVE LE LDAP
|
- |
|
100 |
*/
|
- |
|
101 |
if ($site->authorize->ldap !== false){ // always test before update
|
- |
|
102 |
$site->authorize->deleteSection("ldap");
|
- |
|
103 |
}
|
- |
|
104 |
if ($site->authenticate->getSectionInstance('Auth-Type','LDAP')!==false){ // always test before update
|
- |
|
105 |
$site->authenticate->deleteSection('Auth-Type','LDAP');
|
- |
|
106 |
}
|
- |
|
107 |
}
|
- |
|
108 |
//Sauvegarde du /etc/raddb/sites-available/alcasar
|
- |
|
109 |
$site->save(ALCASAR_RADIUS_SITE);
|
- |
|
110 |
|
81 |
|
111 |
/****************************************************************
|
82 |
/****************************************************************
|
112 |
* Fichier ALCASAR_RADIUS_MODULE_LDAP *
|
83 |
* File mods/available/ldap *
|
113 |
*****************************************************************/
|
84 |
*****************************************************************/
|
114 |
//on ne modifie ALCASAR_RADIUS_MODULE_LDAP uniquement si l'authentification ldap est active
|
- |
|
115 |
if ($auth_enable == "1"){ //test $auth_enable
|
- |
|
116 |
// chargement de la configuration courante
|
- |
|
117 |
$ldap = new ldapConfig();
|
- |
|
118 |
$ldap->load(ALCASAR_RADIUS_MODULE_LDAP);
|
- |
|
119 |
// mise à jours des données
|
- |
|
120 |
//$ldap->server = $ldap_server;
|
- |
|
121 |
$ldap->host = $ldap_server;
|
85 |
//$ldap->host = $ldap_server;
|
122 |
$ldap->identity = $ldap_user;
|
86 |
//$ldap->identity = $ldap_user;
|
123 |
$ldap->password = $ldap_password;
|
87 |
//$ldap->password = $ldap_password;
|
124 |
$ldap->basedn = $ldap_base_dn;
|
88 |
//$ldap->basedn = $ldap_base_dn;
|
125 |
//$ldap->filter = $ldap_filter;
|
89 |
//$ldap->filter = $ldap_filter;
|
126 |
$ldap->uid = $ldap_filter;
|
90 |
//$ldap->uid = $ldap_filter;
|
127 |
$ldap->base_filter = $ldap_base_filter;
|
91 |
//$ldap->base_filter = $ldap_base_filter;
|
128 |
//sauvegarde du fichier /etc/raddb/modules/ldap
|
- |
|
129 |
$ldap->save(ALCASAR_RADIUS_MODULE_LDAP);
|
- |
|
130 |
} //test $auth_enable
|
- |
|
131 |
|
92 |
|
132 |
/********************************************************
|
93 |
/********************************************************
|
133 |
* Redémarage des service *
|
94 |
* File modification & services restart *
|
134 |
*********************************************************/
|
95 |
*********************************************************/
|
- |
|
96 |
//test d'accès au serveur
|
135 |
|
97 |
//si réussite
|
- |
|
98 |
// - écriture config ldap complète dans alcasar.conf
|
- |
|
99 |
// - appel script-shell (alcasar-ldap.sh)
|
- |
|
100 |
// - modif des 2 fichier ci-dessus
|
- |
|
101 |
// - actions si dessous
|
136 |
if ($auth_enable == "1") {
|
102 |
if ($auth_enable == "1") {
|
137 |
file_put_contents(ALCASAR_CONF_FILE, str_replace('LDAP=off', 'LDAP=on', file_get_contents(ALCASAR_CONF_FILE)));
|
103 |
file_put_contents(ALCASAR_CONF_FILE, str_replace('LDAP=off', 'LDAP=on', file_get_contents(ALCASAR_CONF_FILE)));
|
138 |
exec("sed -i \"s/^LDAP_IP=.*/LDAP_IP=$ldap_server/g\" ".ALCASAR_CONF_FILE);
|
104 |
exec("sed -i \"s/^LDAP_IP=.*/LDAP_IP=$ldap_server/g\" ".ALCASAR_CONF_FILE);
|
- |
|
105 |
exec("ln -s /etc/raddb/mods-available/ldap /etc/raddb/mods-enabled/ldap");
|
139 |
}
|
106 |
}
|
140 |
else {
|
107 |
else {
|
141 |
file_put_contents(ALCASAR_CONF_FILE, str_replace('LDAP=on', 'LDAP=off', file_get_contents(ALCASAR_CONF_FILE)));
|
108 |
file_put_contents(ALCASAR_CONF_FILE, str_replace('LDAP=on', 'LDAP=off', file_get_contents(ALCASAR_CONF_FILE)));
|
142 |
exec("sed -i \"s/^LDAP_IP=.*/LDAP_IP=0.0.0.0/g\" ".ALCASAR_CONF_FILE);
|
109 |
exec("sed -i \"s/^LDAP_IP=.*/LDAP_IP=0.0.0.0/g\" ".ALCASAR_CONF_FILE);
|
- |
|
110 |
exec("rm -f /etc/raddb/mods-enabled/ldap");
|
143 |
}
|
111 |
}
|
144 |
exec("sudo /usr/local/bin/alcasar-iptables.sh");
|
112 |
#exec("sudo /usr/local/bin/alcasar-iptables.sh");
|
145 |
exec("sudo /usr/bin/systemctl restart radiusd");
|
113 |
#exec("sudo /usr/bin/systemctl restart radiusd");
|
146 |
|
114 |
|
147 |
/****************************************************************
|
115 |
/****************************************************************
|
148 |
* Redirection vers la page de configuration LDAP *
|
116 |
* Redirection vers la page de configuration LDAP *
|
149 |
*****************************************************************/
|
117 |
*****************************************************************/
|
150 |
|
118 |
|