net/tac_plus4: Be explicit about the runtime user

It occurred to me that the tacacs user is set only at build time.  So,
if someone assigned a different uid to their runtime tacacs user, the
daemon would, by default, run under uid 559. So, add a default
"-U tacacs" to the flags.

While here, fix a typo in the man page.

net/tac_plus4: Move man pages to share/man

Approved by:	portmgr (blanket)

Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)

Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

net: remove 'Created by' lines

A big Thank You to the original contributors of these ports:

  *  <ports@c0decafe.net>
  *  Aaron Dalton <aaron@FreeBSD.org>
  *  Aaron Straup Cope <ascope@cpan.org>
  *  Aaron Zauner <az_mail@gmx.at>
  *  Adam Jette <jettea46@yahoo.com>
  *  Adam Weinberger <adamw@FreeBSD.org>
  *  Alan Eldridge <alane@geeksrus.net>
  *  Alex Bakhtin <Alex.Bakhtin@gmail.com>
  *  Alex Deiter <Alex.Deiter@Gmail.COM>
  *  Alex Dupre <ale@FreeBSD.org>
  *  Alex Dupre <sysadmin@alexdupre.com>

*/*: Remove redundant '-[0-9]*' from CONFLICTS

The conflict checks compare the patterns first against the package
names without version (as reported by "pkg query "%n"), then - if
there was no match - agsinst the full package names including the
version (as reported by "pkg query "%n-%v").

Many CONFLICTS definitions used patterns like "bash-[0-9]*" to filter
for the bash package in any version. But that pattern is functionally
identical with just "bash".

Approved by:	portmgr (blanket)

net/tac_plus4: Add CPE information

Approved by:    portmgr (blanket)

all: Remove all other $FreeBSD keywords.

Remove # $FreeBSD$ from Makefiles.

Convert to UCL & cleanup pkg-message (categories n)

(and missed 3 missed files from previous categories.)

- Update tac_plus4 to 4.0.4.28
- Regenerate patches to make portlint happy
- Other minor changes to Makefile for portlint happiness
- Updates the description to reflect a bit more the current state:
- The original FTP site from Cisco isn't reachable anymore, nor
  is 2.x in the ports tree these days.
- Update/add the URL, though the one from Cisco still works, but
  this is the version from Shrubbery Networks. (there are others around)
- Add a pkg-message

PR:		204683
Submitted by:	Mathieu Simon <freebsd@simweb.ch>

- Update tac_plus4 to 4.0.4.28
- Regenerate patches to make portlint happy
- Other minor changes to Makefile for portlint happiness
- Updates the description to reflect a bit more the current state:
- The original FTP site from Cisco isn't reachable anymore, nor
  is 2.x in the ports tree these days.
- Update/add the URL, though the one from Cisco still works, but
  this is the version from Shrubbery Networks. (there are others around)
- Add a pkg-message

PR:		204683
Submitted by:	Mathieu Simon <freebsd@simweb.ch>

Cleanup plist

Add DOCS option for ports with PORTDOCS in plist.

Support LIBS like LDFLAGS.

- Add LIBS="${LIBS}" to MAKE_ENV and CONFIGURE_ENV.
- Add an option helper for LIBS.
- Adjust all ports that already use LIBS.  Also remove references to
  PTHREAD_CFLAGS and PTHREAD_LIBS while here.
- Some ports did not support having a LIBS environment variable and
  required additional patches.

Somewhat simplified a linker command line looks like:

${CC} ${src_LDFLAGS} ${LDFLAGS} ${src_LIBS} ${LIBS}

where src_LDFLAGS and src_LIBS are controlled by upstream and LDFLAGS and
LIBS can be controlled by us.  If possible -L and -l flags need to be

Update to 4.0.4.27a, and add USES=libtool.

PR:		189780

* Add STAGE support
* Use the USERS/GROUPS framework to create the tacacs user
* Apparently, MAKE_JOB_UNSAFE is needed on i386 as well as amd64

PR:		182616
Submitted by:	ohauer

Add NO_STAGE all over the place in preparation for the staging support (cat:
net)

- convert to the new perl5 framework
- convert USE_GMAKE to Uses

Approved by:	portmgr (bapt@, blanket)

Mark MAKE_JOBS_UNSAFE on amd64.

Reported by:	ohauer

Update to 4.0.4.26

PR:             177833
Submitted by:   Mike Stupalov <landy2005@gmail.com>

Convert USE_BISON to USES= bison

It brings bison as a build dependency in case it is set the following way:
USES= bison or USES= bison:build

it brings bison as a run dependency in case it is set the following way:
USES= bison:run

it brings bison both as a run and build dependency in case it the set the
following way:
USES= bison:both

While here trim some headers
Convert some USE_GNOME= gnomehack to USES= pathfix

In the rc.d scripts, change assignments to rcvar to use the
literal name_enable wherever possible, and ${name}_enable
when it's not, to prepare for the demise of set_rcvar().

In cases where I had to hand-edit unusual instances also
modify formatting slightly to be more uniform (and in
some cases, correct). This includes adding some $FreeBSD$
tags, and most importantly moving rcvar= to right after
name= so it's clear that one is derived from the other.

The vast majority of pkg-descr files had the following format when they
had both lines:

Author: ...
WWW: ....

So standardize on that, and move them to the end of the file when necessary.

Also fix some more whitespace, and remove more "signature tags" of varying
forms, like -- name, etc.

s/AUTHOR/Author/

A few other various formatting issues

- Get Rid MD5 support

Begin the process of deprecating sysutils/rc_subr by
s#. %%RC_SUBR%%#. /etc/rc.subr#

Fix the build with utmpx.h.

Submitted by:   ed (based on)

Add a missing USE_BISON=build.

Reported by:    QAT

Update to F4.0.4.19.

Update to F4.0.4.18, and add support for TACACS+ profiles to the rc.d
scripts.

PR:             134768 (profile support)
Submitted by:   Ryan T.Dean <rtdean@cytherianage.net> (profile support)

Update CONFIGURE_ARGS for how we pass CONFIGURE_TARGET to configure script.
Specifically, newer autoconf (> 2.13) has different semantic of the
configure target. In short, one should use --build=CONFIGURE_TARGET
instead of CONFIGURE_TARGET directly. Otherwise, you will get a warning
and the old semantic may be removed in later autoconf releases.

To workaround this issue, many ports hack the CONFIGURE_TARGET variable
so that it contains the ``--build='' prefix.

To solve this issue, under the fact that some ports still have
configure script generated by the old autoconf, we use runtime detection
in the do-configure target so that the proper argument can be used.

Changes to Mk/*:
 - Add runtime detection magic in bsd.port.mk

Update to F4.0.4.15.  Changes include:

* Check data lengths in debugging functions
* Fix syslog facility selection
* Add -G/foreground option

Fix a typo.

Update to F4.0.4.14.

* Add notes about PAM to the user guide and tac_plus.conf(5)
* Log login failures with the username, NAS address and NAS tty
* ACLs were not applied through the default authentication
  (ie: user=DEFAULT) path

* Update to F4.0.4.13
* Configure tac_plus to run as the user tacacs after starting up [1]
* Convert to USE_RC_SUBR

Requested by:   Ryan Steinmetz <rpsfa@rit.edu>

Remove USE_REINPLACE from all categories starting with N

Remove the FreeBSD KEYWORD from all rc.d scripts where it appears.
We have not checked for this KEYWORD for a long time now, so this
is a complete noop, and thus no PORTREVISION bump. Removing it at
this point is mostly for pedantic reasons, and partly to avoid
perpetuating this anachronism by copy and paste to future scripts.

SHA256ify

Approved by: krion@

Update to F4.0.4.8.

* if -B is used, add the bind address in the PID filename - from Ian Dickinson
* "acl" is an AV pair for service exec.  Within service attribute
  parsing, do not parse "acl" as the acl (or connection ACL) keyword.
  This is a hack; the parser is rather lame - noted by Bryce Kahle
* fix md4 for LP64
* do not accept skey keywords unless compiled with skey support
* fix skey enable password type - bit from Ed Ravin
* skey prompt ("challenge") is "S/Key challenge", not "Password"
* make "daemon" the default syslog facility and add a syslog config
  statement
* add support for user authentication via PAM

At Kris's request, back out the MACHINE_ARCH spelling correction until
after 5.4-RELEASE.

Assist getting more ports working on AMD64 by obeying the
Ports Collection documentation and use 'ARCH' rather than 'MACHINE_ARCH'.

Adjust PORTVERSION as this is really F4.0.4.7, and not F4.0.4_7.

Update to F4.0.4.7.  Code changes in this release include:

* Conversion to autofoo
* Man pahe improvements
* MD5 fixes for 64-bit platforms
* generated_password has been renamed to tac_pwd
* A tac_plus.config.5 man page has been added
* User-specific enable password support

Port changes in this release include:

* Default IOS version has been changed from 11.x to 12.x
* tac_plus.sh script has been converted to rcNG
* PORTDOCS is properly respected
* Portlint fixes

SIZEify

Submitted by:   trevor

Add CONFLICTS for ports that install files with the same name.

Submitted by:   Oliver Eikemeier <eikemeier@fillmore-labs.com>

Make portlint(1) happy by changing strip to ${STRIP_CMD}

Submitted by:   Oleg Karachevtsev <ok@etrust.ru>
PR:             56998

Fix a problem with authentication not working on 64-bit platforms.

Submitted by:   Ivan Dolezal <Ivan.Dolezal@vsb.cz>

De-pkg-comment.

Install the generate_passwd program mentioned in the users guide.  This tool
can be used to generate DES passwords for use in tac_plus.conf.

Submitted by:   John <strgout@unixjunkie.com>

Fix build on -CURRENT by conditionalizing S/Key support and adding OPIE
support.

Reported by:    bento

Fix WWW link.

Reported by:    fenner's sweep

Hand maintainership over to someone who cares about this port.
Thanks Joe.

Resolve some portlint bogons.

I'm looking after these ports for Andreas for a while so I've   changed the
MAINTAINER line to an email alias that directs mail to   us both.    

From Sergey:   "Using tacacs I found that ckfinger() function from maxsess.c
module    returns wrong count of current sessions for users with "maxsess"   
parameter established in tac_plus.conf. It happens if Cisco access    server
works with IOS v 12.x.    On the other hand ckfinger() works well with IOS v
11.x    Here are patches for both maxsess.c and port's Makefile to fix    this
problem (but it is just workaround, ckfinger() should be    fully rewritten)."  
From me:    changed variable name by prepending string "TAC_", so that tacacs+  
 ports variables follow an unique scheme.   Please note: this doesn't compile
with the new TAC_IOS_VERSION variable   if you have CFLAGS redefined in
/etc/make.conf as:   CFLAGS=-pipe -O (or whatever)   You have to use  
CFLAGS+=-pipe -O (or whatever)   Mailed to -developers. Am really not sure,
what's the culprit here.   Fact is, that a part of CFLAGS get lost when
compiling the port,   if you redefine CFLAGS in /etc/make.conf without the "+"
sign ...   I personally removed my CFLAGS define in /etc/make.conf as it  
defaults to -pipe -O, which is fine for me.    

From Sergey:   "The tac_plus user guide says that when passwd(5) file is used
for user    authentication, the expiry date checks against shell field of
password file.    Maybe it is OK for custom passwd files, but not for system
password file.    

Convert category net to new layout.  

Rename ${FILESDIR}/patch-* to ${PATCHDIR}/extra-patch-*.    

patch submission, cisco got a copy.    

- update from F4.0.3 to F4.0.4   - contains security fix     Damir Rajnovic
<gaus@CISCO.COM> on bugtraq:     "We updated our unsupported version of TACACS+
server so it is no longer      vulnerable to oversized T+ packets."   - took
again maintainership of port, actually I never wanted to quit     was a committ
failure when using port submission from PR    

As threatened on freebsd-ports: all startup scripts know about the two   options
`start' and `stop' now (unless I have forgotten any). This allows   us to call
the scripts from /etc/rc.shutdown with the correct option.