Bug 1672284

Description of problem:
FreeRADIUS currently generates a self-signed CA certificate as well as subordinate certificates and some passwords while installing the freeradius package. This is against the Fedora Packaging Guidelines[1] for several good reasons:

1) If freeradius is installed via kickstart, the certificates may be generated at a time when entropy on the system is insufficient, resulting in either a failed installation (scriptlet returns non-zero) or a less-secure certificate.

2) The package cannot easily be built as part of an image (such as a container or ostree image) because the package installation occurs on the builder machine, not the target machine and thus all instances of it that are spawned from the image will have the same certificate information.

3) It makes it difficult for an end-user to generate a common VM in their environment. They can remove the certificates manually, but there's no simple way to regenerate them on the cloned children. The user must know how to do this themselves, manually.

Fedora packaging guidelines[1] now mandate that the behavior here should be that this certificate generation does not occur in an RPM scriptlet, but that it instead takes place as part of a systemd unit that is launched prior to (and blocks the start of) the main service unit for the package. Specific details on how to accomplish this are provided on the guidelines page. I am also available to help with the implementation if needed.

Moving the auto-generation from the scriptlet to the systemd unit addresses all three of the issues mentioned above.



Version-Release number of selected component (if applicable):

freeradius-3.0.17-4.fc30


How reproducible:
Every time

Steps to Reproduce:
1. Install the `freeradius` package in Fedora
2. Check the contents of /etc/raddb/certs


Actual results:
ca.pem, server.crt and many other certificates are present.

Expected results:
The certificates should not be present until the first time the service is launched.


Additional info:

[1] Fedora Packaging Guidelines:
https://fedoraproject.org/wiki/Packaging:Initial_Service_Setup