Skip to content

Latest commit

 

History

History
139 lines (100 loc) · 5.85 KB

UPGRADE.asciidoc

File metadata and controls

139 lines (100 loc) · 5.85 KB

PacketFence Upgrade Guide

Notes on upgrading from an older release.

Upgrading from a version prior to 4.1.0

Database schema update

The category column in the temporary_password should not be mandatory.

Also, the access_level of the temporary_password table is now a string instead of a bit string.

Make sure you run the following to update your schema:

mysql -u root -p pf -v < db/upgrade-4.0.0-4.1.0.sql

Configuration changes

The parameters trapping.redirecturl and trapping.always_use_redirecturl from pf.conf (or pf.conf.defaults) were moved to the default portal profile in profiles.conf.

The action set_access_level of authentication sources in authentication.conf must now match one of the admin roles defined in adminroles.conf. The previous level 4294967295 must be replaced by ALL and the level 0 by NONE.

Adjust your configuration files accordingly.

Upgrading from a version prior to 4.0.6

Changes to authentication API

The method pf::authentication::authenticate now expects an array of pf::authentication::Source objects instead of an array of source IDs.

The methods getSourceByType, getInternalSources, and getExternalSources of the module pf::Portal::Profile now return pf::authentication::Source objects instead of source IDs.

Upgrading from a version prior to 4.0.5

This release adds a new dependency on the Perl module Apache::SSLLookup. Once installed, update the file /usr/local/pf/conf/currently-at to match the new release number.

Upgrading from a version prior to 4.0.4

The parameter guest_self_reg in the profiles.conf file is no longer necessary. The self-registration is now automatically enabled if at least one external authentication source is selected (Email, SMS, SponsorEmail, or Oauth2).

Upgrading from a version prior to 4.0.3

You need to downgrade the version of perl-Net-DNS and perl-Net-DNS-Nameserver to version 0.65-4 in order to fix the issue with pfdns crashing.

Upgrading from a version prior to 4.0.2

This release only fixes various bugs and doesn’t need the database schema to be modified. Simply update the file /usr/local/pf/conf/currently-at to match the new release number.

LDAP SSL and STARTTLS is now correctly implemented. Make sure the server you specify in authentication.conf supports the encryption type requested on the port configured. Failure to do so will break LDAP and Active Directory authentication.

Upgrading from a version prior to 4.0.1

This release only fixes various bugs and doesn’t need the database schema to be modified. Simply update the file /usr/local/pf/conf/currently-at to match the new release number.

Upgrading from a version prior to 4.0.0

Upgrading an old version of PacketFence to v4 will be quite an endeavor. While it’s entirely possible if done meticulously, we suggest you start from scratch and move your customizations and nodes information over to your new installation.

Database schema update

The temporary password table has been extended to include roles information. Moreover, an "admin" user is now automatically created. The default password is also "admin". Finally, a new table has been added for saved searches in the new Web administrative interface.

mysql -u root -p pf -v < db/upgrade-3.6.1-4.0.0.sql

Other important changes

PacketFence v4 received a major overhaul, especially regarding the authentication sources. Authentication modules found in conf/authentication/ are no longer being used and have been replaced by the conf/authentication.conf file. While this file can be hand-edited, you should create your authentication sources and perform roles-mapping using the Configuation > Users > Sources page from PacketFence’s Web administrative interface.

Also, in PacketFence v4, the VLANs can be assigned in conf/switches.conf by constructing the parameter names from the VLAN names and the Vlan suffix. The VLAN names must match one of the default names (registration, isolation, macDetection, inline, and voice) or one of the defined roles. If you were using custom VLANs, you must create a new role per VLAN and assign them accordingly.

Other key changes were done, such as:

  • moved remediation templates in html/captive-portal/templates/violations and converted them to Template Toolkit

  • dropped guests_admin_registration.category

  • dropped guests_self_registration.access_duration

  • dropped guests_self_registration.category

  • dropped guests_self_registration.sponsor_authentication

  • dropped guests_self_registration.sponsors_only_from_localdomain

  • dropped ports.listeners

  • dropped registration.auth and registration.default_auth

  • dropped registration.maxnodes

  • dropped registration.expire_* and registration.skip_*

  • dropped trapping.blacklist

  • dropped support for resetVlanAllPort in bin/pfcmd_vlan

  • dropped sbin/pfredirect binary

  • splitted the httpd services in three: httpd.admin, httpd.portal and httpd.webservices

  • domain-name is no longer required in each section of networks.conf

For all parameters related to authentication (categories, access duration, sponsor authentication, etc.), you should now set proper actions in the conf/authentication.conf file.

Finally, the pf must be sudoer access to the /sbin/ip (and others) binary. As root, please do:

echo "pf ALL=NOPASSWD: /sbin/iptables, /usr/sbin/ipset, /sbin/ip, /sbin/vconfig, /sbin/route, /sbin/service, /usr/bin/tee, /usr/local/pf/sbin/pfdhcplistener, /bin/kill, /usr/sbin/dhcpd, /usr/sbin/radiusd" >> /etc/sudoers