Things to fix:
The banned_users file is readable by everyone by default. Only root
should be allowed to read this file, but I'm not sure if it will be
as simple as just changing the permissions on the file. Depending on
how "acua verify" is intended to be used, it may have to be seperated
into it's own command and made suid root, but maybe not. This will be
fixed in the official, non-beta v3.04 release of ACUA.
Look into locking user accounts in /etc/passed or /etc/shadow, when the
acua lock command is used. This looks to be easy. Will be implemented
in the official, non-beta v3.04 release of ACUA.
ACUA Revision History.
ACUA v3.04
Items Fixed/Added:
o Added support for PPPoE connections. This will be handy for
Businesses, Schools, Office Blocks, Hotels/Motels, and even
serving ADSL connections for clients. You could even use it
to monitor that neighbours Internet connection (you know, the
neighbour that pays the other half of your cable bill, and uses
that ethernet cable running over the back fence?)
o User database format changed. You will need to use the
acua202-304 utility to convert your old acua202 format
database to the ACUA304 format.
o Fixed many little bugs all over the place, re-wrote a lot of
code, probably introduced some new bugs as well.
o Updated ALL of the documentation, added examples to most of it
as well. And I added some colour to it, just to make it look a
little less dull.
o acua_login was basically re-written. acua_login now uses different
command-line syntax.
o acua_logout was basically re-written. acua_logout now uses different
command-line syntax.
o The killing of user processes has been re-written. It used to take
approximately 5 seconds to kill all user processes, thats 5 seconds
per user. Now it takes less than 1 second - depending on CPU speed
and if a user process honours the HUP or TERM signals. If it does
not honour the HUP or TERM signals, then a KILL signal will be sent.
- CIPE VPN monitoring is now supported. I added support for this
just because I could. I don't need it, however I do use CIPE.
- Ethernet card monitoring is now supported. Again, I don't need
this but because of the new code, it is easy to implement new
interface types. Traffic to/from an IP addresses is not monitored
though, just the Ethernet device as a whole. If you want to monitor
traffic based on an IP Address over an Ethernet connection, I suggest
you use the PPPoE support in ACUA for that. I will have a look into
adding support for IP-based accountancy in the future some time.
o The manpages in the doc directory are now gone as I've decided not
to persue that line of documentation. As handy as it would be to
have for some users, the HTML documentation is all I will maintain
in the future.
o ACUA now installs it's documentation to /usr/share/doc/acua.
The "make install" command will overwrite any old documentation
in /usr/share/doc/acua. You can change where the documentation
gets installed to by editing the Makefile.
o Made it possible to add more than just the username to the
acua_adduser script. You can now add extra options to the
acua_adduser script that will then be added to the useradd
command in the script. You should however make sure that
/usr/sbin/acua_adduser will work properley before you do this.
ACUA v3.03
Items Fixed/Added:
o Can't be bothered maintaining history.html because I'd rather
focus my efforts in the C code than in the HTML code. From now
on this is the ACUA history file you'll be reading, which was
previously called history-detailed.txt but is now a HTML file.
o Compiled ACUA with GCC v3.0.2, compiled successfully.
o Starting to wonder if my brain has gone to mush
as I seem to be forgetting stuff, but that could be because
I'm usually in a programming mood at around 3am, I guess I'm
in denial now :)
o Took out some debug code I accidently left in v3.02.
o Added the ACUA v3.02 entry below as I forgot to put it
into ACUA v3.02.
o Fixed a problem in PPPupdate() where I didn't remember to
close a file descriptor.
o Fixed a problem of having two slightly different PPPupdate
definitions in acua_updated.cc.
o Added a safe-guard to stop ACUA from ever deleting the
root account. A message will be logged via syslog, and
may be sent to local terminals as well.
ACUA v3.02
Items Fixed/Added:
o Corrected a few things to allow ACUA to work properley on
Linux Kernel 2.4.x, with ppp driver version 2.4.1.
ACUA v3.01-2
Items Fixed/Added:
o Fixed a problem that would cause acua_updated to have a
segmentation fault at 3am. The problem has been 'fixed'
by reverting back to code from ACUA v3.00. I'll fix the
new code when I have some more time.
o Fixed a small documentation glitch where a standard txt file
had a html extention which caused web browsers to display the
file as one continuous line of text.
ACUA v3.01
Items Fixed/Added:
o Added "minUID" option to clean_proc.config, which will tell
the clean_proc program to not kill any process with a UID lower
than minUID. The default value has been set to 500 in the
ACUA code.
o Documentation Update - Added some unfinished manpages I've
been working on.
o Documentation update - A filename was wrong, so I fixed it.
(acua_timeleft.html -> acua_timeLeft.html).
o Fixed a problem that would cause acua_updated to die during
it's maintenance period.
o By default ACUA now accepts long usernames up to and including 16
charactors in length. This has only been crudely tested, could
someone please test it more for me and give me the results? All
I've done is added a user with a long username, subscribed them,
modified their record here and there. I havn't attempted to login
as the user yet. Also, does anyone know the actual length limit of
a Linux username? If I find this out, then I'll just hard code it
into ACUA as a default.
o Manually added a patch by Kirk Reiser to allow for pts/pty support.
o Looked into why my system would have commas after the
"Hi" in the emails acua_updated would send. I knew where
it was coming from, so since it's working now I should document
it properley somewhere.
The original file in question is acua_updated.header, the line
starts with:
Hi $gecos0.
The 0 is actually an option to tell it to print the whole
"full name" field out of the users entry in /etc/passwd.
The below line will fix this (on Debian boxes for example
where if you use the adduser script it will add extra stuff
seperated by commas):
Hi $gecos.
(no zero on the end)
o Added new config directive - MailUser
This is so you can configure what user the mail process will
run as. Thus, using this feature, you can have mails to appear
from accounts@your.isp.com, instead of root@your.isp.com.
Example: MailUser accounts
Example: MailUser 1000
As you may have guessed, the param to MailUser can be either the
login name or the UID.
o Added new config directive - MailWait
This directive is so you can specify how long to wait (in
seconds) for a mailout process to finish before we consider
it crashed and kill it with a SIGKILL
Example: MailWait 10
o Added a default path to "mail" if none was specified of
/usr/bin/mail
o Rewrote mail procedure in acua_updated (again!)
It's back down to one page of code and pipes are
no longer used, and is less CPU intensive.
One of the reasons for the rewrite was a possible
database corruption problem, but it's unconfirmed,
on our production system (that runs radacua) there
were corruption problems when the mail section was
taken from the normal acua and put into radacua, when
the mail section was put back to normal, the corruption
problems were solved. If your using ACUA v3.01b2 I would
_really_ suggest you upgrade to ACUA v3.01b4, just as a
precaution measure. I have been running ACUA v3.01b2 with
no corruption problems.
o Added a new command to the 'acua' executable: version
example: acua ve or acua version
o NOTE: There was never a ACUA v3.01b3 release. If you see one,
dont use it.
o Added a new flag called NOUNSUB. When this flag is set, ACUA
will run /usr/sbin/acua_nounsub instead of unsubscribing the
user. This can be used for many things, for example, automatically
renewing certain accounts when they run out, sending a mail to an
admin, etc. Look at the documentation or in the example script that
comes with ACUA for more information.
o MailProg config file directive. You can specify the program
to use for the mailing of messages. You NEED to set this
otherwise mailing will NOT work. In acua.config add something
similar to this:
MailProg /usr/bin/mail
o The mailing code has all been re-written. I've tested this
pretty well I think, and I havn't had any problems.
o Some more security vulnerabilitys have been fixed up, there
is no doubt more, it's just a matter of me finding them and
you reporting the ones I miss.
o I think I broke CC'ing from the WarnExpireCC part of acua.config,
so it's been fixed. It probably would have caused a Segmentation
fault under some conditions.
o Added a Segmentation fault handler to acua_updated, not that
acua_updated sufferes from them if everything is in order.
o Added a credits html file.
o You can have multiple people get CC'd the expiry messages.
This feature has been there for a while, just not documented.
o Eliminated all system() calls.
o ACUA uses malloc() a bit more, which in some areas saves a tad
of memory, in others it's paranoia, and others it's just because
I felt like it, some will also be removed later on.
o The acua_adduser and acua_deluser scripts have been updated to
use useradd and userdel instead of the previous methods.
o Modified acua_viewRec to use a safe tempory file.
o "acua delrec" and "acua unBan" used to use /bin/mv, this has
been replaced with rename().
o Some more error checking code added here and there.
o You now have to be root to have ACUA take notice of the
environment variables ACUA_CONFIG, ACUA_USERS and ACUA_BANNED_USERS.
o Fixed what I believe to be a bug in "acua ban" that would allow
you to ban a user who doesn't have a phone number to ban, so from
what I gather, that would be pointless.
o Added some y2k bugs just for kicks (kidding).
Please mail all bug reports to acua@acua.ebbs.com.au