3 # $Id: svc_acct.export,v 1.23 2001-08-17 10:57:40 ivan Exp $
5 # Create and export password, radius and vpopmail password files:
6 # passwd, passwd.adjunct, shadow, acp_passwd, acp_userinfo, acp_dialup
7 # users/assign, domains/vdomain/vpasswd
8 # Also export sendmail and qmail config files.
19 use FS::UID qw(adminsuidsetup datasrc dbh);
20 use FS::Record qw(qsearch qsearchs fields);
25 my $user = shift or die &usage;
30 my $userpolicy = $conf->config('username_policy')
31 if $conf->exists('username_policy');
33 my @shellmachines = $conf->config('shellmachines')
34 if $conf->exists('shellmachines');
36 my @bsdshellmachines = $conf->config('bsdshellmachines')
37 if $conf->exists('bsdshellmachines');
39 my @nismachines = $conf->config('nismachines')
40 if $conf->exists('nismachines');
42 my @erpcdmachines = $conf->config('erpcdmachines')
43 if $conf->exists('erpcdmachines');
45 my @radiusmachines = $conf->config('radiusmachines')
46 if $conf->exists('radiusmachines');
48 my $icradiusmachines = $conf->exists('icradiusmachines');
49 my @icradiusmachines = $conf->config('icradiusmachines') if $icradiusmachines;
50 my $icradius_mysqldest =
51 $conf->config('icradius_mysqldest') || "/usr/local/var/"
53 my $icradius_mysqlsource =
54 $conf->config('icradius_mysqlsource') || "/usr/local/var/freeside"
57 if ( $icradiusmachines && $conf->exists('icradius_secrets') ) {
58 $icradius_dbh = DBI->connect($conf->config('icradius_secrets'))
64 my $textradiusprepend =
65 $conf->exists('textradiusprepend')
66 ? $conf->config('textradiusprepend')
69 warn "using depriciated textradiusprepend file" if $textradiusprepend;
71 my @vpopmailmachines = $conf->config('vpopmailmachines')
72 if $conf->exists('vpopmailmachines');
74 my ($machine, $vpopdir, $vpopuid, $vpopgid) = split (/\s+/, $vpopmailmachines[0]);
76 my($shellmachine, @qmailmachines);
77 if ( $conf->exists('qmailmachines') ) {
78 $shellmachine = $conf->config('shellmachine');
79 @qmailmachines = $conf->config('qmailmachines');
82 my(@sendmailmachines, $sendmailconfigpath, $sendmailrestart);
83 if ( $conf->exists('sendmailmachines') ) {
84 @sendmailmachines = $conf->config('sendmailmachines');
85 $sendmailconfigpath = $conf->config('sendmailconfigpath') || '/etc';
86 $sendmailrestart = $conf->config('sendmailrestart');
89 my $mydomain = $conf->config('domain') if $conf->exists('domain');
94 my(@saltset)= ( 'a'..'z' , 'A'..'Z' , '0'..'9' , '.' , '/' );
95 require 5.004; #srand(time|$$);
97 my $spooldir = "/usr/local/etc/freeside/export.". datasrc;
98 my $spoollock = "/usr/local/etc/freeside/svc_acct.export.lock.". datasrc;
100 open(EXPORT,"+>>$spoollock") or die "Can't open $spoollock: $!";
101 select(EXPORT); $|=1; select(STDOUT);
102 unless ( flock(EXPORT,LOCK_EX|LOCK_NB) ) {
106 #no reason to start lots of blocking processes
107 die "Is another export process running under pid $pid?\n";
110 print EXPORT $$,"\n";
112 my(@svc_domain)=qsearch('svc_domain',{});
114 ( open(MASTER,">$spooldir/master.passwd")
115 and flock(MASTER,LOCK_EX|LOCK_NB)
116 ) or die "Can't open $spooldir/.master.passwd: $!";
117 ( open(PASSWD,">$spooldir/passwd")
118 and flock(PASSWD,LOCK_EX|LOCK_NB)
119 ) or die "Can't open $spooldir/passwd: $!";
120 ( open(SHADOW,">$spooldir/shadow")
121 and flock(SHADOW,LOCK_EX|LOCK_NB)
122 ) or die "Can't open $spooldir/shadow: $!";
123 ( open(ACP_PASSWD,">$spooldir/acp_passwd")
124 and flock(ACP_PASSWD,LOCK_EX|LOCK_NB)
125 ) or die "Can't open $spooldir/acp_passwd: $!";
126 ( open(ACP_DIALUP,">$spooldir/acp_dialup")
127 and flock(ACP_DIALUP,LOCK_EX|LOCK_NB)
128 ) or die "Can't open $spooldir/acp_dialup: $!";
129 ( open(USERS,">$spooldir/users")
130 and flock(USERS,LOCK_EX|LOCK_NB)
131 ) or die "Can't open $spooldir/users: $!";
133 ( open(ASSIGN,">$spooldir/assign")
134 and flock(ASSIGN,LOCK_EX|LOCK_NB)
135 ) or die "Can't open $spooldir/assign: $!";
136 ( open(RCPTHOSTS,">$spooldir/rcpthosts")
137 and flock(RCPTHOSTS,LOCK_EX|LOCK_NB)
138 ) or die "Can't open $spooldir/rcpthosts: $!";
139 ( open(VPOPRCPTHOSTS,">$spooldir/vpoprcpthosts")
140 and flock(VPOPRCPTHOSTS,LOCK_EX|LOCK_NB)
141 ) or die "Can't open $spooldir/rcpthosts: $!";
142 ( open(RECIPIENTMAP,">$spooldir/recipientmap")
143 and flock(RECIPIENTMAP,LOCK_EX|LOCK_NB)
144 ) or die "Can't open $spooldir/recipientmap: $!";
145 ( open(VIRTUALDOMAINS,">$spooldir/virtualdomains")
146 and flock(VIRTUALDOMAINS,LOCK_EX|LOCK_NB)
147 ) or die "Can't open $spooldir/virtualdomains: $!";
148 ( open(VPOPVIRTUALDOMAINS,">$spooldir/vpopvirtualdomains")
149 and flock(VPOPVIRTUALDOMAINS,LOCK_EX|LOCK_NB)
150 ) or die "Can't open $spooldir/virtualdomains: $!";
151 ( open(VIRTUSERTABLE,">$spooldir/virtusertable")
152 and flock(VIRTUSERTABLE,LOCK_EX|LOCK_NB)
153 ) or die "Can't open $spooldir/virtusertable: $!";
154 ( open(SENDMAIL_CW,">$spooldir/sendmail.cw")
155 and flock(SENDMAIL_CW,LOCK_EX|LOCK_NB)
156 ) or die "Can't open $spooldir/sendmail.cw: $!";
160 chmod 0644, "$spooldir/passwd",
161 "$spooldir/acp_dialup",
163 "$spooldir/sendmail.cw",
164 "$spooldir/virtusertable",
165 "$spooldir/rcpthosts",
166 "$spooldir/vpoprcpthosts",
167 "$spooldir/recipientmap",
168 "$spooldir/virtualdomains",
169 "$spooldir/vpopvirtualdomains",
172 chmod 0600, "$spooldir/master.passwd",
173 "$spooldir/acp_passwd",
178 rmtree"$spooldir/domains", 0, 1;
179 mkdir "$spooldir/domains", 0700;
181 if ( $icradiusmachines ) {
182 my $sth = $icradius_dbh->prepare("DELETE FROM radcheck");
183 $sth->execute or die "Can't reset radcheck table: ". $sth->errstr;
184 my $sth2 = $icradius_dbh->prepare("DELETE FROM radreply");
185 $sth2->execute or die "Can't reset radreply table: ". $sth2->errstr;
190 my %usernames; ## this hack helps keep the passwd files sane
194 foreach $svc_domain (sort {$a->domain cmp $b->domain} @svc_domain) {
196 my($domain)=$svc_domain->domain;
197 print RCPTHOSTS "$domain\n.$domain\n";
198 print VPOPRCPTHOSTS "$domain\n";
199 print SENDMAIL_CW "$domain\n";
202 # FORMAT OF THE ASSIGN/USERS FILE HERE
203 print ASSIGN join(":",
208 $vpopdir . "/domains/" . $domain,
214 (mkdir "$spooldir/domains/" . $domain, 0700)
215 or die "Can't create $spooldir/domains/" . $domain .": $!";
217 ( open(QMAILDEFAULT,">$spooldir/domains/" . $domain . "/.qmail-default")
218 and flock(QMAILDEFAULT,LOCK_EX|LOCK_NB)
219 ) or die "Can't open $spooldir/domains/" . $domain . "/.qmail-default: $!";
221 ( open(VPASSWD,">$spooldir/domains/" . $domain . "/vpasswd")
222 and flock(VPASSWD,LOCK_EX|LOCK_NB)
223 ) or die "Can't open $spooldir/domains/" . $domain . "/vpasswd: $!";
227 if ($svc_domain->catchall) {
228 $svc_acct = qsearchs('svc_acct', {'svcnum' => $svc_domain->catchall});
229 die "Cannot find catchall account for domain $domain\n" unless $svc_acct;
231 my $username = $svc_acct->username;
232 push @sendmail, "\@$domain\t$username\n";
233 print VIRTUALDOMAINS "$domain:$username-$domain\n",
234 ".$domain:$username-$domain\n",
238 # FORMAT OF THE .QMAIL-DEFAULT FILE HERE
239 print QMAILDEFAULT "| $vpopdir/bin/vdelivermail \"\" $username\@$domain\n";
243 # FORMAT OF THE .QMAIL-DEFAULT FILE HERE
244 print QMAILDEFAULT "| $vpopdir/bin/vdelivermail \"\" bounce-no-mailbox\n";
247 print VPOPVIRTUALDOMAINS "$domain:$domain\n";
249 foreach $svc_acct (qsearch('svc_acct', {'domsvc' => $svc_domain->svcnum})) {
250 my($password)=$svc_acct->getfield('_password');
251 my($cpassword,$rpassword);
252 if ( ( length($password) <= 8 )
253 && ( $password ne '*' )
254 && ( $password ne '!!' )
255 && ( $password ne '' )
257 $cpassword=crypt($password,
258 $saltset[int(rand(64))].$saltset[int(rand(64))]
260 $rpassword=$password;
262 $cpassword=$password;
268 if ($mydomain && ($mydomain eq $svc_domain->domain)) {
269 $username=$svc_acct->username;
270 } elsif ($userpolicy =~ /^prepend domsvc$/) {
271 $username=$svc_acct->domsvc . $svc_acct->username;
272 } elsif ($userpolicy =~ /^append domsvc$/) {
273 $username=$svc_acct->username . $svc_acct->domsvc;
274 } elsif ($userpolicy =~ /^append domain$/) {
275 $username=$svc_acct->username . $svc_domain->domain;
277 die "Unknown policy in username_policy\n";
280 if ($svc_acct->dir ne '/dev/null' || $svc_acct->slipip ne '') {
281 if ($usernames{$username}++) {
282 die "Duplicate username detected: $username\n";
286 if ( $svc_acct->uid =~ /^(\d+)$/ ) {
288 die "Non-root user ". $svc_acct->username. " has 0 UID!"
289 if $svc_acct->uid == 0 && $svc_acct->username ne 'root';
291 if ( $svc_acct->dir ne "/dev/null") {
294 # FORMAT OF FreeBSD MASTER PASSWD FILE HERE
295 print MASTER join(":",
296 $username, # User name
297 $cpassword, # Encrypted password
298 $svc_acct->uid, # User ID
299 $svc_acct->gid, # Group ID
301 "0", # Password Change Time
302 "0", # Password Expiration Time
303 $svc_acct->finger, # Users name
304 $svc_acct->dir, # Users home directory
305 $svc_acct->shell, # shell
310 # FORMAT OF THE PASSWD FILE HERE
311 print PASSWD join(":",
313 'x', # "##". $username,
322 # FORMAT OF THE SHADOW FILE HERE
323 print SHADOW join(":",
337 # FORMAT OF THE VPASSWD FILE HERE
338 print VPASSWD join(":",
344 "$vpopdir/domains/" . $svc_domain->domain ."/" . $svc_acct->username,
350 if ( $svc_acct->slipip ne '' ) {
353 # FORMAT OF THE ACP_* FILES HERE
354 print ACP_PASSWD join(":",
364 my($ip)=$svc_acct->slipip;
366 unless ( $ip eq '0.0.0.0' || $svc_acct->slipip eq '0e0' ) {
367 print ACP_DIALUP $username, "\t*\t", $svc_acct->slipip, "\n";
370 my %radreply = $svc_acct->radius_reply;
371 my %radcheck = $svc_acct->radius_check;
373 my $radcheck = join ", ", map { qq($_ = "$radcheck{$_}") } keys %radcheck;
374 $radcheck .= ", " if $radcheck;
377 # FORMAT OF THE USERS FILE HERE
380 qq(\t${textradiusprepend}),
382 qq(Password = "$rpassword"\n\t),
383 join ",\n\t", map { qq($_ = "$radreply{$_}") } keys %radreply;
385 if ( $ip && $ip ne '0e0' ) {
386 #print USERS qq(,\n\tFramed-Address = "$ip"\n\n);
387 print USERS qq(,\n\tFramed-IP-Address = "$ip"\n\n);
389 print USERS qq(\n\n);
394 if ( $icradiusmachines ) {
396 my $sth = $icradius_dbh->prepare(
397 "INSERT INTO radcheck ( id, UserName, Attribute, Value ) VALUES ( ".
398 join(", ", map { $icradius_dbh->quote( $_ ) } (
402 $svc_acct->_password,
405 $sth->execute or die "Can't insert into radcheck table: ". $sth->errstr;
407 foreach my $attribute ( keys %radcheck ) {
408 my $sth = $icradius_dbh->prepare(
409 "INSERT INTO radcheck ( id, UserName, Attribute, Value ) VALUES ( ".
410 join(", ", map { $icradius_dbh->quote( $_ ) } (
414 $radcheck{$attribute},
417 $sth->execute or die "Can't insert into radcheck table: ". $sth->errstr; }
419 foreach my $attribute ( keys %radreply ) {
420 my $sth = $icradius_dbh->prepare(
421 "INSERT INTO radreply (id, UserName, Attribute, Value) VALUES ( ".
422 join(", ", map { $icradius_dbh->quote( $_ ) } (
426 $radreply{$attribute},
429 $sth->execute or die "Can't insert into radreply table: ". $sth->errstr; }
434 # vpopmail directory structure creation
436 (mkdir "$spooldir/domains/" . $svc_domain->domain . "/" . $svc_acct->username, 0700)
437 or die "Can't create $spooldir/domains/" . $svc_domain->domain . "/" . $svc_acct->username . ": $!";
438 (mkdir "$spooldir/domains/" . $svc_domain->domain . "/" . $svc_acct->username . "/Maildir", 0700)
439 or die "Can't create $spooldir/domains/" . $svc_domain->domain . "/" . $svc_acct->username . " /Maildir: $!";
440 (mkdir "$spooldir/domains/" . $svc_domain->domain . "/" . $svc_acct->username . "/Maildir/cur", 0700)
441 or die "Can't create $spooldir/domains/" . $svc_domain->domain . "/" . $svc_acct->username . " /Maildir/cur: $!";
442 (mkdir "$spooldir/domains/" . $svc_domain->domain . "/" . $svc_acct->username . "/Maildir/new", 0700)
443 or die "Can't create $spooldir/domains/" . $svc_domain->domain . "/" . $svc_acct->username . " /Maildir/new: $!";
444 (mkdir "$spooldir/domains/" . $svc_domain->domain . "/" . $svc_acct->username . "/Maildir/tmp", 0700)
445 or die "Can't create $spooldir/domains/" . $svc_domain->domain . "/" . $svc_acct->username . " /Maildir/tmp: $!";
447 ( open(DOTQMAIL,">$spooldir/domains/" . $svc_domain->domain . "/" . $svc_acct->username . "/.qmail")
448 and flock(DOTQMAIL,LOCK_EX|LOCK_NB)
449 ) or die "Can't open $spooldir/domains/" . $svc_domain->domain . "/" . $svc_acct->username . "/.qmail: $!";
452 foreach $svc_forward (qsearch('svc_forward', {'srcsvc' => $svc_acct->svcnum})) {
454 if ($svc_forward->dstsvc) {
455 my $dst_acct = qsearchs('svc_acct', {'svcnum' => $svc_forward->dstsvc});
456 my $dst_domain = qsearchs('svc_domain', {'svcnum' => $dst_acct->domsvc});
457 $destination = $dst_acct->username . '@' . $dst_domain->domain;
459 if ($dst_domain->domain eq $mydomain) {
460 print VIRTUSERTABLE $svc_acct->username . "@" . $svc_domain->domain .
461 "\t" . $dst_acct->username . "\n";
462 print RECIPIENTMAP $svc_acct->username . "@" . $svc_domain->domain .
466 $destination = $svc_forward->dst;
470 # FORMAT OF .QMAIL FILES HERE
471 print DOTQMAIL "$destination\n";
474 flock(DOTQMAIL,LOCK_UN);
479 flock(VPASSWD,LOCK_UN);
480 flock(QMAILDEFAULT,LOCK_UN);
487 # FORMAT OF THE ASSIGN/USERS FILE FINAL LINE HERE
490 print VIRTUSERTABLE @sendmail;
492 flock(MASTER,LOCK_UN);
493 flock(PASSWD,LOCK_UN);
494 flock(SHADOW,LOCK_UN);
495 flock(ACP_DIALUP,LOCK_UN);
496 flock(ACP_PASSWD,LOCK_UN);
497 flock(USERS,LOCK_UN);
498 flock(ASSIGN,LOCK_UN);
499 flock(SENDMAIL_CW,LOCK_UN);
500 flock(VIRTUSERTABLE,LOCK_UN);
501 flock(RCPTHOSTS,LOCK_UN);
502 flock(VPOPRCPTHOSTS,LOCK_UN);
503 flock(RECIPIENTMAP,LOCK_UN);
504 flock(VPOPVIRTUALDOMAINS,LOCK_UN);
518 close VPOPVIRTUALDOMAINS;
525 foreach $ashellmachine (@shellmachines) {
526 my $scp = new Net::SCP;
527 $scp->scp("$spooldir/passwd","root\@$ashellmachine:/etc/passwd.new")
528 or die "scp error: ". $scp->{errstr};
529 $scp->scp("$spooldir/shadow","root\@$ashellmachine:/etc/shadow.new")
530 or die "scp error: ". $scp->{errstr};
531 ssh("root\@$ashellmachine",
533 "mv /etc/passwd.new /etc/passwd; ".
534 "mv /etc/shadow.new /etc/shadow; ".
537 == 0 or die "ssh error: $!";
540 my($bsdshellmachine);
541 foreach $bsdshellmachine (@bsdshellmachines) {
542 my $scp = new Net::SCP;
543 $scp->scp("$spooldir/passwd","root\@$bsdshellmachine:/etc/passwd.new")
544 or die "scp error: ". $scp->{errstr};
545 $scp->scp("$spooldir/master.passwd","root\@$bsdshellmachine:/etc/master.passwd.new")
546 or die "scp error: ". $scp->{errstr};
547 ssh("root\@$bsdshellmachine",
549 "mv /etc/passwd.new /etc/passwd; ".
550 "mv /etc/master.passwd.new /etc/master.passwd; ".
553 == 0 or die "ssh error: $!";
557 foreach $nismachine (@nismachines) {
558 my $scp = new Net::SCP;
559 $scp->scp("$spooldir/passwd","root\@$nismachine:/etc/global/passwd")
560 or die "scp error: ". $scp->{errstr};
561 $scp->scp("$spooldir/shadow","root\@$nismachine:/etc/global/shadow")
562 or die "scp error: ". $scp->{errstr};
563 ssh("root\@$nismachine",
565 "cd /var/yp; make; ".
568 == 0 or die "ssh error: $!";
572 foreach $erpcdmachine (@erpcdmachines) {
573 my $scp = new Net::SCP;
574 $scp->scp("$spooldir/acp_passwd","root\@$erpcdmachine:/usr/annex/acp_passwd")
575 or die "scp error: ". $scp->{errstr};
576 $scp->scp("$spooldir/acp_dialup","root\@$erpcdmachine:/usr/annex/acp_dialup")
577 or die "scp error: ". $scp->{errstr};
578 ssh("root\@$erpcdmachine",
580 "kill -USR1 \`cat /usr/annex/erpcd.pid\'".
583 == 0 or die "ssh error: $!";
587 foreach $radiusmachine (@radiusmachines) {
588 my $scp = new Net::SCP;
589 $scp->scp("$spooldir/users","root\@$radiusmachine:/etc/raddb/users")
590 or die "scp error: ". $scp->{errstr};
591 ssh("root\@$radiusmachine",
596 == 0 or die "ssh error: $!";
599 foreach my $icradiusmachine ( @icradiusmachines ) {
600 my( $machine, $db, $user, $pass ) = split(/\s+/, $icradiusmachine);
601 chdir $icradius_mysqlsource or die "Can't cd $icradius_mysqlsource: $!";
602 open(WRITER,"|ssh root\@$machine mysql -v --user=$user -p $db");
603 my $oldfh = select WRITER; $|=1; select $oldfh;
604 print WRITER "$pass\n";
606 print WRITER "LOCK TABLES radcheck WRITE, radreply WRITE;\n";
607 foreach my $file ( glob("radcheck.*") ) {
608 my $scp = new Net::SCP;
609 $scp->scp($file,"root\@$machine:$icradius_mysqldest/$db/$file")
610 or die "scp error: ". $scp->{errstr};
612 foreach my $file ( glob("radreply.*") ) {
613 my $scp = new Net::SCP;
614 $scp->scp($file,"root\@$machine:$icradius_mysqldest/$db/$file")
615 or die "scp error: ". $scp->{errstr};
620 my @args = ("/bin/tar", "c", "--force-local", "-C", "$spooldir", "-f", "$spooldir/vpoptarball", "domains");
622 system {$args[0]} @args;
624 my($vpopmailmachine);
625 foreach $vpopmailmachine (@vpopmailmachines) {
626 my ($machine, $vpopdir, $vpopuid, $vpopgid) = split (/\s+/, $vpopmailmachine);
627 my $scp = new Net::SCP;
628 $scp->scp("$spooldir/vpoptarball","root\@$machine:vpoptarball")
629 or die "scp error: ". $scp->{errstr};
630 ssh("root\@$machine",
632 "tar xf vpoptarball; ".
633 "chown -R $vpopuid:$vpopgid domains; ".
634 "tar cf vpoptarball domains; ".
636 "tar xf ~/vpoptarball; ".
639 == 0 or die "ssh error: $!";
641 $scp->scp("$spooldir/assign","root\@$machine:/var/qmail/users/assign")
642 or die "scp error: ". $scp->{errstr};
643 $scp->scp("$spooldir/vpopvirtualdomains","root\@$machine:/var/qmail/control/virtualdomains")
644 or die "scp error: ". $scp->{errstr};
645 $scp->scp("$spooldir/vpoprcpthosts","root\@$machine:/var/qmail/control/rcpthosts")
646 or die "scp error: ". $scp->{errstr};
649 my($sendmailmachine);
650 foreach $sendmailmachine (@sendmailmachines) {
651 my $scp = new Net::SCP;
652 $scp->scp("$spooldir/sendmail.cw","root\@$sendmailmachine:$sendmailconfigpath/sendmail.cw.new")
653 or die "scp error: ". $scp->{errstr};
654 $scp->scp("$spooldir/virtusertable","root\@$sendmailmachine:$sendmailconfigpath/virtusertable.new")
655 or die "scp error: ". $scp->{errstr};
656 ssh("root\@$sendmailmachine",
658 "mv $sendmailconfigpath/sendmail.cw.new $sendmailconfigpath/sendmail.cw; ".
659 "mv $sendmailconfigpath/virtusertable.new $sendmailconfigpath/virtusertable; ".
663 == 0 or die "ssh error: $!";
667 foreach $qmailmachine (@qmailmachines) {
668 my $scp = new Net::SCP;
669 $scp->scp("$spooldir/recipientmap","root\@$qmailmachine:/var/qmail/control/recipientmap")
670 or die "scp error: ". $scp->{errstr};
671 $scp->scp("$spooldir/virtualdomains","root\@$qmailmachine:/var/qmail/control/virtualdomains")
672 or die "scp error: ". $scp->{errstr};
673 $scp->scp("$spooldir/rcpthosts","root\@$qmailmachine:/var/qmail/control/rcpthosts")
674 or die "scp error: ". $scp->{errstr};
675 #ssh("root\@$qmailmachine","/etc/init.d/qmail restart")
676 # == 0 or die "ssh error: $!";
680 flock(EXPORT,LOCK_UN);
686 die "Usage:\n\n svc_acct.export user\n";