#
# = Yubikey Module
#
-# This module decrypts and validates Yubikey static and dynamic
-# OTP tokens.
+# The `yubikey` module decrypts and validates Yubikey static and
+# dynamic One-Time Password (OTP) tokens.
+#
+# For more information about Yubikey, please see:
+#
+# https://www.yubico.com/
#
#
# split = yes
#
- # decrypt:: Tokens will be decrypted and processed locally.
+ # decrypt:: Whether tokens will be decrypted and processed locally.
#
# In the `authorize` section, this module should be placed before the
# persistent storage module.
# Each account will need a password added (either using attribute `Cleartext-Password`,
# `SSHA-Password`, etc.).
#
- # The module itself does not provide persistent storage as this would be duplicative of
- # functionality already in the server.
+ # The module itself does not provide persistent storage as
+ # this would duplicate functionality already in the server.
#
# Yubikey authentication needs two attributes retrieved from persistent storage:
#
}
}
+ listen {
+ type = Access-Request
+ type = Status-Server
+
+ transport = tcp
+
+ tcp {
+ #
+ # As with v3, "ipaddr", "ipv4addr", and "ipv6addr"
+ # are all allowed.
+ #
+ ipaddr = *
+ port = 1812
+
+ #
+ # Whether or not we allow dynamic clients.
+ #
+ # If set to true, then packets from unknown
+ # clients are passed through the "new client"
+ # subsection below. See that section for
+ # more information.
+ #
+# dynamic_clients = true
+
+ #
+ # If dynamic clients are allowed, then limit
+ # them to only a small set of source
+ # networks.
+ #
+ # If dynamic clients are not allowed, then
+ # this section is ignored.
+ #
+ networks {
+ #
+ # Allow packets from these networks
+ # to define dynamic clients.
+ #
+ # Packets from all other sources will
+ # be rejected.
+ #
+ # Even if a packet is from an allowed
+ # network, it still must be allowed
+ # by the "new client" subsection.
+ #
+ # There is no limit to the number of
+ # networks which can be listed here.
+ #
+ allow = 127/8
+ allow = 192.0.2/24
+# deny = 127.0.0/24
+ }
+ }
+
+ #
+ # #### Access-Request subsection
+ #
+ # This section contains configuration which is
+ # specific to processing `Access-Request` packets.
+ #
+ # Similar sections can be added, but are not
+ # necessary for Accounting-Request (and other)
+ # packets. At this time, there is no configuration
+ # needed for other packet types.
+ #
+ Access-Request {
+ #
+ # log:: Logging configuration for `Access-Request` packets
+ #
+ # In v3, the `Access-Request` logging was
+ # configured in the main `radiusd.conf` file,
+ # in the main `log` subsection. That
+ # limitation meant that the configuration was
+ # global to FreeRADIUS. i.e. you could not
+ # have different `Access-Request` logging for
+ # different virtual server.
+ #
+ # The extra configuration in v4 allows for
+ # increased flexibility.
+ #
+ log {
+ # stripped_names:: Log the full
+ # `User-Name` attribute, as it was
+ # found in the request.
+ #
+ # allowed values: {no, yes}
+ #
+ stripped_names = no
+
+ # auth:: Log authentication requests
+ # to the log file.
+ #
+ # allowed values: {no, yes}
+ #
+ auth = no
+
+ # auth_goodpass:: Log "good"
+ # passwords with the authentication
+ # requests.
+ #
+ # allowed values: {no, yes}
+ #
+ auth_badpass = no
+
+ # auth_badpass:: Log "bad"
+ # passwords with the authentication
+ # requests.
+ #
+ # allowed values: {no, yes}
+ #
+ auth_goodpass = no
+
+ # Log additional text at the end of the "Login OK" messages.
+ # for these to work, the "auth" and "auth_goodpass" or "auth_badpass"
+ # configurations above have to be set to "yes".
+ #
+ # The strings below are dynamically expanded, which means that
+ # you can put anything you want in them. However, note that
+ # this expansion can be slow, and can negatively impact server
+ # performance.
+ #
+# msg_goodpass = ""
+# msg_badpass = ""
+
+ # The message when the user exceeds the Simultaneous-Use limit.
+ #
+ msg_denied = "You are already logged in - access denied"
+ }
+
+ #
+ # session:: Controls how ongoing
+ # (multi-round) sessions are handled
+ #
+ # This section is primarily useful for EAP.
+ # It controls the number of EAP
+ # authentication attempts that can occur
+ # concurrently.
+ #
+ session {
+ #
+ # max:: The maximum number of ongoing sessions
+ #
+# max = 4096
+
+ # timeout:: How long to wait before expiring a
+ # session.
+ #
+ # The timer starts when a response
+ # with a state value is sent. The
+ # timer stops when a request
+ # containing the previously sent
+ # state value is received.
+ #
+# timeout = 15
+ }
+ }
+ }
+
#
# ### Listen for Accounting-Request packets
#
#
filter_username
+# if (!&Proxy-State) {
+# radius
+# }
+
+
+ update reply {
+ &DHCP-Client-FQDN := "example.org"
+ }
+
#
# Some broken equipment sends passwords with embedded
# zeros, i.e. the debug output will show:
projects / thirdparty / freeradius-server.git / commitdiff
