X-Git-Url: http://git.freeside.biz/gitweb/?a=blobdiff_plain;f=FS%2FFS%2Fsvc_acct.pm;h=7fcfd35dfb2e6ffb0835ac9dd6d95f125247bfe2;hb=1290c097176adcd62d48b1250233d53adb4b50a5;hp=16270f9cc54e5966b0650c49d061b8d0353b1d8e;hpb=6991d4986df7fb3a6c7c49b5ae1b3713e87a16c4;p=freeside.git

diff --git a/FS/FS/svc_acct.pm b/FS/FS/svc_acct.pm
index 16270f9cc..7fcfd35df 100644
--- a/FS/FS/svc_acct.pm
+++ b/FS/FS/svc_acct.pm
@@ -1,16 +1,17 @@
 package FS::svc_acct;
 
 use strict;
-use vars qw( @ISA $nossh_hack $conf $dir_prefix @shells $usernamemin
+use vars qw( @ISA $noexport_hack $conf
+             $dir_prefix @shells $usernamemin
              $usernamemax $passwordmin $passwordmax
              $username_ampersand $username_letter $username_letterfirst
              $username_noperiod $username_uppercase
-             $shellmachine $useradd $usermod $userdel $mydomain
-             $cyrus_server $cyrus_admin_user $cyrus_admin_pass
+             $mydomain
              $dirhash
-             $icradius_dbh
-             @saltset @pw_set);
+             @saltset @pw_set );
 use Carp;
+use Fcntl qw(:flock);
+use FS::UID qw( datasrc );
 use FS::Conf;
 use FS::Record qw( qsearch qsearchs fields dbh );
 use FS::svc_Common;
@@ -22,6 +23,8 @@ use FS::cust_main_invoice;
 use FS::svc_domain;
 use FS::raddb;
 use FS::queue;
+use FS::radius_usergroup;
+use FS::Msgcat qw(gettext);
 
 @ISA = qw( FS::svc_Common );
 
@@ -30,67 +33,23 @@ $FS::UID::callback{'FS::svc_acct'} = sub {
   $conf = new FS::Conf;
   $dir_prefix = $conf->config('home');
   @shells = $conf->config('shells');
-  $shellmachine = $conf->config('shellmachine');
   $usernamemin = $conf->config('usernamemin') || 2;
   $usernamemax = $conf->config('usernamemax');
   $passwordmin = $conf->config('passwordmin') || 6;
   $passwordmax = $conf->config('passwordmax') || 8;
-  if ( $shellmachine ) {
-    if ( $conf->exists('shellmachine-useradd') ) {
-      $useradd = join("\n", $conf->config('shellmachine-useradd') )
-                 || 'cp -pr /etc/skel $dir; chown -R $uid.$gid $dir';
-    } else {
-      $useradd = 'useradd -d $dir -m -s $shell -u $uid $username';
-    }
-    if ( $conf->exists('shellmachine-userdel') ) {
-      $userdel = join("\n", $conf->config('shellmachine-userdel') )
-                 || 'rm -rf $dir';
-    } else {
-      $userdel = 'userdel $username';
-    }
-    $usermod = join("\n", $conf->config('shellmachine-usermod') )
-               || '[ -d $old_dir ] && mv $old_dir $new_dir || ( '.
-                    'chmod u+t $old_dir; mkdir $new_dir; cd $old_dir; '.
-                    'find . -depth -print | cpio -pdm $new_dir; '.
-                    'chmod u-t $new_dir; chown -R $uid.$gid $new_dir; '.
-                    'rm -rf $old_dir'.
-                  ')';
-  }
   $username_letter = $conf->exists('username-letter');
   $username_letterfirst = $conf->exists('username-letterfirst');
   $username_noperiod = $conf->exists('username-noperiod');
   $username_uppercase = $conf->exists('username-uppercase');
   $username_ampersand = $conf->exists('username-ampersand');
   $mydomain = $conf->config('domain');
-  if ( $conf->exists('cyrus') ) {
-    ($cyrus_server, $cyrus_admin_user, $cyrus_admin_pass) =
-      $conf->config('cyrus');
-    eval "use Cyrus::IMAP::Admin;"
-  } else {
-    $cyrus_server = '';
-    $cyrus_admin_user = '';
-    $cyrus_admin_pass = '';
-  }
-  if ( $conf->exists('icradiusmachines') ) {
-    if ( $conf->exists('icradius_secrets') ) {
-      #need some sort of late binding so it's only connected to when
-      # actually used, hmm
-      $icradius_dbh = DBI->connect($conf->config('icradius_secrets'))
-        or die $DBI::errstr;
-    } else {
-      $icradius_dbh = dbh;
-    }
-  } else {
-    $icradius_dbh = '';
-  }
+
   $dirhash = $conf->config('dirhash') || 0;
 };
 
 @saltset = ( 'a'..'z' , 'A'..'Z' , '0'..'9' , '.' , '/' );
 @pw_set = ( 'a'..'z', 'A'..'Z', '0'..'9', '(', ')', '#', '!', '.', ',' );
 
-#not needed in 5.004 #srand($$|time);
-
 sub _cache {
   my $self = shift;
   my ( $hashref, $cache ) = @_;
@@ -155,6 +114,8 @@ FS::svc_Common.  The following fields are currently supported:
 
 =item _password - generated if blank
 
+=item sec_phrase - security phrase
+
 =item popnum - Point of presence (see L<FS::svc_acct_pop>)
 
 =item uid
@@ -177,8 +138,6 @@ FS::svc_Common.  The following fields are currently supported:
 
 =item radius_I<Radius_Attribute> - I<Radius-Attribute>
 
-=item domsvc - service number of svc_domain with which to associate
-
 =back
 
 =head1 METHODS
@@ -201,25 +160,13 @@ otherwise returns false.
 The additional fields pkgnum and svcpart (see L<FS::cust_svc>) should be 
 defined.  An FS::cust_svc record will be created and inserted.
 
-If the configuration value (see L<FS::Conf>) shellmachine exists, and the 
-username, uid, and dir fields are defined, the command(s) specified in
-the shellmachine-useradd configuration are added to the job queue (see
-L<FS::queue> and L<freeside-queued>) to be exectued on shellmachine via ssh.
-This behaviour can be surpressed by setting $FS::svc_acct::nossh_hack true.
-If the shellmachine-useradd configuration file does not exist,
+The additional field I<usergroup> can optionally be defined; if so it should
+contain an arrayref of group names.  See L<FS::radius_usergroup>.  (used in
+sqlradius export only)
 
-  useradd -d $dir -m -s $shell -u $uid $username
+(TODOC: L<FS::queue> and L<freeside-queued>)
 
-is the default.  If the shellmachine-useradd configuration file exists but
-it empty,
-
-  cp -pr /etc/skel $dir; chown -R $uid.$gid $dir
-
-is the default instead.  Otherwise the contents of the file are treated as
-a double-quoted perl string, with the following variables available:
-$username, $uid, $gid, $dir, and $shell.
-
-(TODOC: cyrus config file, L<FS::queue> and L<freeside-queued>)
+(TODOC: new exports! $noexport_hack)
 
 =cut
 
@@ -238,16 +185,24 @@ sub insert {
   local $FS::UID::AutoCommit = 0;
   my $dbh = dbh;
 
-  my $amount = 0;
-
   $error = $self->check;
   return $error if $error;
 
-  return "Username ". $self->username. " in use"
+  return gettext('username_in_use'). ": ". $self->username
     if qsearchs( 'svc_acct', { 'username' => $self->username,
                                'domsvc'   => $self->domsvc,
                              } );
 
+  if ( $self->svcnum ) {
+    my $cust_svc = qsearchs('cust_svc',{'svcnum'=>$self->svcnum});
+    unless ( $cust_svc ) {
+      $dbh->rollback if $oldAutoCommit;
+      return "no cust_svc record found for svcnum ". $self->svcnum;
+    }
+    $self->pkgnum($cust_svc->pkgnum);
+    $self->svcpart($cust_svc->svcpart);
+  }
+
   my $part_svc = qsearchs( 'part_svc', { 'svcpart' => $self->svcpart } );
   return "Unknown svcpart" unless $part_svc;
   return "uid in use"
@@ -262,144 +217,36 @@ sub insert {
     return $error;
   }
 
-  my( $username, $uid, $gid, $dir, $shell ) = (
-    $self->username,
-    $self->uid,
-    $self->gid,
-    $self->dir,
-    $self->shell,
-  );
-  if ( $username && $uid && $dir && $shellmachine && ! $nossh_hack ) {
-    my $queue = new FS::queue { 'job' => 'FS::svc_acct::ssh' };
-    $error = $queue->insert("root\@$shellmachine", eval qq("$useradd") );
-    if ( $error ) {
-      $dbh->rollback if $oldAutoCommit;
-      return "queueing job (transaction rolled back): $error";
-    }
-  }
-
-  if ( $cyrus_server ) {
-    my $queue = new FS::queue { 'job' => 'FS::svc_acct::cyrus_insert' };
-    $error = $queue->insert($self->username, $self->quota);
-    if ( $error ) {
-      $dbh->rollback if $oldAutoCommit;
-      return "queueing job (transaction rolled back): $error";
+  if ( $self->usergroup ) {
+    foreach my $groupname ( @{$self->usergroup} ) {
+      my $radius_usergroup = new FS::radius_usergroup ( {
+        svcnum    => $self->svcnum,
+        groupname => $groupname,
+      } );
+      my $error = $radius_usergroup->insert;
+      if ( $error ) {
+        $dbh->rollback if $oldAutoCommit;
+        return $error;
+      }
     }
   }
-  if ( $icradius_dbh ) {
-
-    my $radcheck_queue =
-      new FS::queue { 'job' => 'FS::svc_acct::icradius_rc_insert' };
-    $error = $radcheck_queue->insert( $self->username,
-                                      $self->_password,
-                                      $self->radius_check
-                                    );
-    if ( $error ) {
-      $dbh->rollback if $oldAutoCommit;
-      return "queueing job (transaction rolled back): $error";
-    }
 
-    my $radreply_queue =
-      new FS::queue { 'job' => 'FS::svc_acct::icradius_rr_insert' };
-    $error = $radreply_queue->insert( $self->username,
-                                      $self->_password,
-                                      $self->radius_reply
-                                    );
-    if ( $error ) {
-      $dbh->rollback if $oldAutoCommit;
-      return "queueing job (transaction rolled back): $error";
+  #new-style exports!
+  unless ( $noexport_hack ) {
+    foreach my $part_export ( $self->cust_svc->part_svc->part_export ) {
+      my $error = $part_export->export_insert($self);
+      if ( $error ) {
+        $dbh->rollback if $oldAutoCommit;
+        return "exporting to ". $part_export->exporttype.
+               " (transaction rolled back): $error";
+      }
     }
-
   }
 
   $dbh->commit or die $dbh->errstr if $oldAutoCommit;
   ''; #no error
 }
 
-sub cyrus_insert {
-  my( $username, $quota ) = @_;
-
-  warn "cyrus_insert: starting for user $username, quota $quota\n";
-
-  warn "cyrus_insert: connecting to $cyrus_server\n";
-  my $client = Cyrus::IMAP::Admin->new($cyrus_server);
-
-  warn "cyrus_insert: authentication as $cyrus_admin_user\n";
-  $client->authenticate(
-    -user      => $cyrus_admin_user,
-    -mechanism => "login",       
-    -password  => $cyrus_admin_pass
-  );
-
-  warn "cyrus_insert: creating user.$username\n";
-  my $rc = $client->create("user.$username");
-  my $error = $client->error;
-  die "cyrus_insert: error creating user.$username: $error" if $error;
-
-  warn "cyrus_insert: setacl user.$username, $username => all\n";
-  $rc = $client->setacl("user.$username", $username => 'all' );
-  $error = $client->error;
-  die "cyrus_insert: error setacl user.$username: $error" if $error;
-
-  if ( $quota ) {
-    warn "cyrus_insert: setquota user.$username, STORAGE => $quota\n";
-    $rc = $client->setquota("user.$username", 'STORAGE' => $quota );
-    $error = $client->error;
-    die "cyrus_insert: error setquota user.$username: $error" if $error;
-  }
-
-  1;
-}
-
-sub icradius_rc_insert {
-  my( $username, $password, %radcheck ) = @_;
-  
-  my $sth = $icradius_dbh->prepare(
-    "INSERT INTO radcheck ( id, UserName, Attribute, Value ) VALUES ( ".
-    join(", ", map { $icradius_dbh->quote($_) } (
-      '',
-      $username,
-      "Password",
-      $password,
-    ) ). " )"
-  );
-  $sth->execute or die "can't insert into radcheck table: ". $sth->errstr;
-
-  foreach my $attribute ( keys %radcheck ) {
-    my $sth = $icradius_dbh->prepare(
-      "INSERT INTO radcheck ( id, UserName, Attribute, Value ) VALUES ( ".
-      join(", ", map { $icradius_dbh->quote($_) } (
-        '',
-        $username,
-        $attribute,
-        $radcheck{$attribute},
-      ) ). " )"
-    );
-    $sth->execute or die "can't insert into radcheck table: ". $sth->errstr;
-  }
-
-  1;
-}
-
-sub icradius_rr_insert {
-  my( $username, $password, %radreply ) = @_;
-  
-  foreach my $attribute ( keys %radreply ) {
-    my $sth = $icradius_dbh->prepare(
-      "INSERT INTO radreply ( id, UserName, Attribute, Value ) VALUES ( ".
-      join(", ", map { $icradius_dbh->quote($_) } (
-        '',
-        $username,
-        $attribute,
-        $radreply{$attribute},
-      ) ). " )"
-    );
-    $sth->execute or die "can't insert into radreply table: ". $sth->errstr;
-  }
-
-  1;
-}
-
 =item delete
 
 Deletes this account from the database.  If there is an error, returns the
@@ -407,25 +254,7 @@ error, otherwise returns false.
 
 The corresponding FS::cust_svc record will be deleted as well.
 
-If the configuration value (see L<FS::Conf>) shellmachine exists, the
-command(s) specified in the shellmachine-userdel configuration file are
-added to the job queue (see L<FS::queue> and L<freeside-queued>) to be executed
-on shellmachine via ssh.  This behavior can be surpressed by setting
-$FS::svc_acct::nossh_hack true.  If the shellmachine-userdel configuration
-file does not exist,
-
-  userdel $username
-
-is the default.  If the shellmachine-userdel configuration file exists but
-is empty,
-
-  rm -rf $dir
-
-is the default instead.  Otherwise the contents of the file are treated as a
-double-quoted perl string, with the following variables available:
-$username and $dir.
-
-(TODOC: cyrus config file)
+(TODOC: new exports! $noexport_hack)
 
 =cut
 
@@ -446,7 +275,7 @@ sub delete {
   return "Can't delete an account with (svc_www) web service!"
     if qsearch( 'svc_www', { 'usersvc' => $self->usersvc } );
 
-  # what about records in session ?
+  # what about records in session ? (they should refer to history table)
 
   local $SIG{HUP} = 'IGNORE';
   local $SIG{INT} = 'IGNORE';
@@ -489,127 +318,48 @@ sub delete {
     }
   }
 
-  my $error = $self->SUPER::delete;
-  if ( $error ) {
-    $dbh->rollback if $oldAutoCommit;
-    return $error;
-  }
-
-  my( $username, $dir ) = (
-    $self->username,
-    $self->dir,
-  );
-  if ( $username && $shellmachine && ! $nossh_hack ) {
-    my $queue = new FS::queue { 'job' => 'FS::svc_acct::ssh' };
-    $error = $queue->insert("root\@$shellmachine", eval qq("$userdel") );
+  foreach my $radius_usergroup (
+    qsearch('radius_usergroup', { 'svcnum' => $self->svcnum } )
+  ) {
+    my $error = $radius_usergroup->delete;
     if ( $error ) {
       $dbh->rollback if $oldAutoCommit;
-      return "queueing job (transaction rolled back): $error";
+      return $error;
     }
-
   }
 
-  if ( $cyrus_server ) {
-    my $queue = new FS::queue { 'job' => 'FS::svc_acct::cyrus_delete' };
-    $error = $queue->insert($self->username);
-    if ( $error ) {
-      $dbh->rollback if $oldAutoCommit;
-      return "queueing job (transaction rolled back): $error";
-    }
-  }
-  if ( $icradius_dbh ) {
+  my $part_svc = $self->cust_svc->part_svc;
 
-    my $radcheck_queue =
-      new FS::queue { 'job' => 'FS::svc_acct::icradius_rc_delete' };
-    $error = $radcheck_queue->insert( $self->username );
-    if ( $error ) {
-      $dbh->rollback if $oldAutoCommit;
-      return "queueing job (transaction rolled back): $error";
-    }
+  my $error = $self->SUPER::delete;
+  if ( $error ) {
+    $dbh->rollback if $oldAutoCommit;
+    return $error;
+  }
 
-    my $radreply_queue =
-      new FS::queue { 'job' => 'FS::svc_acct::icradius_rr_delete' };
-    $error = $radreply_queue->insert( $self->username );
-    if ( $error ) {
-      $dbh->rollback if $oldAutoCommit;
-      return "queueing job (transaction rolled back): $error";
+  #new-style exports!
+  unless ( $noexport_hack ) {
+    foreach my $part_export ( $part_svc->part_export ) {
+      my $error = $part_export->export_delete($self);
+      if ( $error ) {
+        $dbh->rollback if $oldAutoCommit;
+        return "exporting to ". $part_export->exporttype.
+               " (transaction rolled back): $error";
+      }
     }
-
   }
 
   $dbh->commit or die $dbh->errstr if $oldAutoCommit;
   '';
 }
 
-sub cyrus_delete {
-  my $username = shift; 
-
-  my $client = Cyrus::IMAP::Admin->new($cyrus_server);
-  $client->authenticate(
-    -user      => $cyrus_admin_user,
-    -mechanism => "login",       
-    -password  => $cyrus_admin_pass
-  );
-
-  my $rc = $client->setacl("user.$username", $cyrus_admin_user => 'all' );
-  my $error = $client->error;
-  die $error if $error;
-
-  $rc = $client->delete("user.$username");
-  $error = $client->error;
-  die $error if $error;
-
-  1;
-}
-
-sub icradius_rc_delete {
-  my $username = shift;
-  
-  my $sth = $icradius_dbh->prepare(
-    'DELETE FROM radcheck WHERE UserName = ?'
-  );
-  $sth->execute($username)
-    or die "can't delete from radcheck table: ". $sth->errstr;
-
-  1;
-}
-
-sub icradius_rr_delete {
-  my $username = shift;
-  
-  my $sth = $icradius_dbh->prepare(
-    'DELETE FROM radreply WHERE UserName = ?'
-  );
-  $sth->execute($username)
-    or die "can't delete from radreply table: ". $sth->errstr;
-
-  1;
-}
-
 =item replace OLD_RECORD
 
 Replaces OLD_RECORD with this one in the database.  If there is an error,
 returns the error, otherwise returns false.
 
-If the configuration value (see L<FS::Conf>) shellmachine exists, and the 
-dir field has changed, the command(s) specified in the shellmachine-usermod
-configuraiton file are added to the job queue (see L<FS::queue> and
-L<freeside-queued>) to be executed on shellmachine via ssh.  This behavior can
-be surpressed by setting $FS::svc-acct::nossh_hack true.  If the
-shellmachine-userdel configuration file does not exist or is empty,
-
-  [ -d $old_dir ] && mv $old_dir $new_dir || (
-    chmod u+t $old_dir;
-    mkdir $new_dir;
-    cd $old_dir;
-    find . -depth -print | cpio -pdm $new_dir;
-    chmod u-t $new_dir;
-    chown -R $uid.$gid $new_dir;
-    rm -rf $old_dir
-  )
-
-is the default.  This behaviour can be surpressed by setting
-$FS::svc_acct::nossh_hack true.
+The additional field I<usergroup> can optionally be defined; if so it should
+contain an arrayref of group names.  See L<FS::radius_usergroup>.  (used in
+sqlradius export only)
 
 =cut
 
@@ -628,9 +378,6 @@ sub replace {
     return "Can't change uid!" if $old->uid != $new->uid;
   }
 
-  return "can't change username using Cyrus"
-    if $cyrus_server && $old->username ne $new->username;
-
   #change homdir when we change username
   $new->setfield('dir', '') if $old->username ne $new->username;
 
@@ -651,29 +398,49 @@ sub replace {
     return $error if $error;
   }
 
-  my ( $old_dir, $new_dir, $uid, $gid ) = (
-    $old->getfield('dir'),
-    $new->getfield('dir'),
-    $new->getfield('uid'),
-    $new->getfield('gid'),
-  );
-  if ( $old_dir && $new_dir && $old_dir ne $new_dir && ! $nossh_hack ) {
-    my $queue = new FS::queue { 'job' => 'FS::svc_acct::ssh' };
-    $error = $queue->insert("root\@$shellmachine", eval qq("$usermod") );
-    if ( $error ) {
-      $dbh->rollback if $oldAutoCommit;
-      return "queueing job (transaction rolled back): $error";
+  $old->usergroup( [ $old->radius_groups ] );
+  if ( $new->usergroup ) {
+    #(sorta) false laziness with FS::part_export::sqlradius::_export_replace
+    my @newgroups = @{$new->usergroup};
+    foreach my $oldgroup ( @{$old->usergroup} ) {
+      if ( grep { $oldgroup eq $_ } @newgroups ) {
+        @newgroups = grep { $oldgroup ne $_ } @newgroups;
+        next;
+      }
+      my $radius_usergroup = qsearchs('radius_usergroup', {
+        svcnum    => $old->svcnum,
+        groupname => $oldgroup,
+      } );
+      my $error = $radius_usergroup->delete;
+      if ( $error ) {
+        $dbh->rollback if $oldAutoCommit;
+        return "error deleting radius_usergroup $oldgroup: $error";
+      }
     }
+
+    foreach my $newgroup ( @newgroups ) {
+      my $radius_usergroup = new FS::radius_usergroup ( {
+        svcnum    => $new->svcnum,
+        groupname => $newgroup,
+      } );
+      my $error = $radius_usergroup->insert;
+      if ( $error ) {
+        $dbh->rollback if $oldAutoCommit;
+        return "error adding radius_usergroup $newgroup: $error";
+      }
+    }
+
   }
 
-  if ( $icradius_dbh ) {
-    my $queue = new FS::queue { 'job' => 'FS::svc_acct::icradius_rc_replace' };
-    $error = $queue->insert( $new->username,
-                             $new->_password,
-                           );
-    if ( $error ) {
-      $dbh->rollback if $oldAutoCommit;
-      return "queueing job (transaction rolled back): $error";
+  #new-style exports!
+  unless ( $noexport_hack ) {
+    foreach my $part_export ( $new->cust_svc->part_svc->part_export ) {
+      my $error = $part_export->export_replace($new,$old);
+      if ( $error ) {
+        $dbh->rollback if $oldAutoCommit;
+        return "exporting to ". $part_export->exporttype.
+               " (transaction rolled back): $error";
+      }
     }
   }
 
@@ -681,18 +448,6 @@ sub replace {
   ''; #no error
 }
 
-sub icradius_rc_replace {
-  my( $username, $new_password ) = @_;
- 
-   my $sth = $icradius_dbh->prepare(
-     "UPDATE radcheck SET Value = ? WHERE UserName = ? and Attribute = ?"
-   );
-   $sth->execute($new_password, $username, 'Password' )
-     or die "can't update radcheck table: ". $sth->errstr;
-
-  1;
-}
-
 =item suspend
 
 Suspends this account by prefixing *SUSPENDED* to the password.  If there is an
@@ -762,32 +517,38 @@ sub check {
   return $x unless ref($x);
   my $part_svc = $x;
 
+  if ( $part_svc->part_svc_column('usergroup')->columnflag eq "F" ) {
+    $self->usergroup(
+      [ split(',', $part_svc->part_svc_column('usergroup')->columnvalue) ] );
+  }
+
   my $error = $self->ut_numbern('svcnum')
               || $self->ut_number('domsvc')
+              || $self->ut_textn('sec_phrase')
   ;
   return $error if $error;
 
   my $ulen = $usernamemax || $self->dbdef_table->column('username')->length;
   if ( $username_uppercase ) {
     $recref->{username} =~ /^([a-z0-9_\-\.\&]{$usernamemin,$ulen})$/i
-      or return "Illegal username: ". $recref->{username};
+      or return gettext('illegal_username'). ": ". $recref->{username};
     $recref->{username} = $1;
   } else {
     $recref->{username} =~ /^([a-z0-9_\-\.\&]{$usernamemin,$ulen})$/
-      or return "Illegal username: ". $recref->{username};
+      or return gettext('illegal_username'). ": ". $recref->{username};
     $recref->{username} = $1;
   }
 
   if ( $username_letterfirst ) {
-    $recref->{username} =~ /^[a-z]/ or return "Illegal username";
+    $recref->{username} =~ /^[a-z]/ or return gettext('illegal_username');
   } elsif ( $username_letter ) {
-    $recref->{username} =~ /[a-z]/ or return "Illegal username";
+    $recref->{username} =~ /[a-z]/ or return gettext('illegal_username');
   }
   if ( $username_noperiod ) {
-    $recref->{username} =~ /\./ and return "Illegal username";
+    $recref->{username} =~ /\./ and return gettext('illegal_username');
   }
   unless ( $username_ampersand ) {
-    $recref->{username} =~ /\&/ and return "Illegal username";
+    $recref->{username} =~ /\&/ and return gettext('illegal_username');
   }
 
   $recref->{popnum} =~ /^(\d*)$/ or return "Illegal popnum: ".$recref->{popnum};
@@ -903,7 +664,7 @@ sub check {
     $recref->{_password} = '!!';
   } else {
     #return "Illegal password";
-    return "Illegal password: ". $recref->{_password};
+    return gettext('illegal_password'). ": ". $recref->{_password};
   }
 
   ''; #no error
@@ -951,19 +712,22 @@ sub radius_reply {
 Returns key/value pairs, suitable for assigning to a hash, for any RADIUS
 check attributes of this record.
 
-Accessing RADIUS attributes directly is not supported and will break in the
-future.
+Note that this is now the preferred method for reading RADIUS attributes - 
+accessing the columns directly is discouraged, as the column names are
+expected to change in the future.
 
 =cut
 
 sub radius_check {
   my $self = shift;
-  map {
-    /^(rc_(.*))$/;
-    my($column, $attrib) = ($1, $2);
-    #$attrib =~ s/_/\-/g;
-    ( $FS::raddb::attrib{lc($attrib)}, $self->getfield($column) );
-  } grep { /^rc_/ && $self->getfield($_) } fields( $self->table );
+  ( 'Password' => $self->_password,
+    map {
+      /^(rc_(.*))$/;
+      my($column, $attrib) = ($1, $2);
+      #$attrib =~ s/_/\-/g;
+      ( $FS::raddb::attrib{lc($attrib)}, $self->getfield($column) );
+    } grep { /^rc_/ && $self->getfield($_) } fields( $self->table )
+  );
 }
 
 =item domain
@@ -1034,44 +798,72 @@ sub seconds_since {
   $self->cust_svc->seconds_since(@_);
 }
 
-=item ssh
+=item radius_groups
+
+Returns all RADIUS groups for this account (see L<FS::radius_usergroup>).
 
 =cut
 
-sub ssh {
-  my ( $host, @cmd_and_args ) = @_;
+sub radius_groups {
+  my $self = shift;
+  map { $_->groupname }
+    qsearch('radius_usergroup', { 'svcnum' => $self->svcnum } );
+}
 
-  use IO::File;
-  my $reader = IO::File->new();
-  my $writer = IO::File->new();
-  my $error = IO::File->new();
+=back
 
-  &Net::SSH::sshopen3( $host, $reader, $writer, $error, @cmd_and_args) or die $!;
+=head1 SUBROUTINES
 
-  local $/ = undef;
-  my $output_stream = <$writer>;
-  my $error_stream = <$error>;
-  if ( length $error_stream ) {
-    #warn "[FS::svc_acct::ssh] STDERR $error_stream";
-    die "[FS::svc_acct::ssh] STDERR $error_stream";
-  }
-  if ( length $output_stream ) {
-    warn "[FS::svc_acct::ssh] STDOUT $output_stream";
-  }
+=item radius_usergroup_selector GROUPS_ARRAYREF [ SELECTNAME ]
 
-#  &Net::SSH::ssh(@args,">>/usr/local/etc/freeside/sshoutput 2>&1");
-}
+=cut
 
-=back
+sub radius_usergroup_selector {
+  my $sel_groups = shift;
+  my %sel_groups = map { $_=>1 } @$sel_groups;
 
-=head1 VERSION
+  my $selectname = shift || 'radius_usergroup';
 
-$Id: svc_acct.pm,v 1.64 2002-01-29 16:33:15 ivan Exp $
+  my $dbh = dbh;
+  my $sth = $dbh->prepare(
+    'SELECT DISTINCT(groupname) FROM radius_usergroup ORDER BY groupname'
+  ) or die $dbh->errstr;
+  $sth->execute() or die $sth->errstr;
+  my @all_groups = map { $_->[0] } @{$sth->fetchall_arrayref};
+
+  my $html = <<END;
+    <SCRIPT>
+    function ${selectname}_doadd(object) {
+      var myvalue = object.${selectname}_add.value;
+      var optionName = new Option(myvalue,myvalue,false,true);
+      var length = object.$selectname.length;
+      object.$selectname.options[length] = optionName;
+      object.${selectname}_add.value = "";
+    }
+    </SCRIPT>
+    <SELECT MULTIPLE NAME="$selectname">
+END
+
+  foreach my $group ( @all_groups ) {
+    $html .= '<OPTION';
+    if ( $sel_groups{$group} ) {
+      $html .= ' SELECTED';
+      $sel_groups{$group} = 0;
+    }
+    $html .= ">$group</OPTION>\n";
+  }
+  foreach my $group ( grep { $sel_groups{$_} } keys %sel_groups ) {
+    $html .= "<OPTION SELECTED>$group</OPTION>\n";
+  };
+  $html .= '</SELECT>';
 
-=head1 BUGS
+  $html .= qq!<BR><INPUT TYPE="text" NAME="${selectname}_add">!.
+           qq!<INPUT TYPE="button" VALUE="Add new group" onClick="${selectname}_doadd(this.form)">!;
 
-The bits which ssh should fork before doing so (or maybe queue jobs for a
-daemon).
+  $html;
+}
+
+=head1 BUGS
 
 The $recref stuff in sub check should be cleaned up.
 
@@ -1079,6 +871,9 @@ The suspend, unsuspend and cancel methods update the database, but not the
 current object.  This is probably a bug as it's unexpected and
 counterintuitive.
 
+radius_usergroup_selector?  putting web ui components in here?  they should
+probably live somewhere else...
+
 =head1 SEE ALSO
 
 L<FS::svc_Common>, edit/part_svc.cgi from an installed web interface,