1. Virtual Servers.
- FreeRADIUS 2.0 supports virtual servers. This is probably the
+ FreeRADIUS 4.0 supports virtual servers. This is probably the
single largest change that is NOT backwards compatible with 1.x.
The virtual servers do NOT have to be set up with the
recv Access-Request {
...
}
- process Access-Request {
+ authenticate pap {
...
}
...
pap
}
- process Access-Request {
+ authenticate pap {
pap
}
}
logintime
}
-process Access-Request {
+authenticate eap {
#
# Allow EAP authentication.
eap
}
-# Post-Authentication
-# Once we KNOW that the user has been authenticated, there are
-# additional steps we can take.
-post-auth {
+#
+# Run these rules when sending an Access-Accept
+#
+send Access-Accept {
#
# For EAP-TTLS and PEAP, add the cached attributes to the reply.
# The "session-state" attributes are automatically cached when
# For Exec-Program and Exec-Program-Wait
exec
+
# Remove reply message if the response contains an EAP-Message
remove_reply_message_if_eap
- # Access-Reject packets are sent through the REJECT sub-section of the
- # post-auth section.
- #
- # Add the ldap module name (or instance) if you have set
- # 'edir_account_policy_check = yes' in the ldap module configuration
- #
- Post-Auth-Type REJECT {
- # log failed authentications in SQL, too.
- -sql
- attr_filter.access_reject
-
- # Insert EAP-Failure message if the request was
- # rejected by policy instead of because of an
- # authentication failure And already has an EAP message
- # For non-ABFAB, we insert the failure all the time, but for ABFAB
- # It's more desirable to preserve reply-message when we can
- if (&reply:Eap-Message) {
- eap
- }
-
- # Remove reply message if the response contains an EAP-Message
- remove_reply_message_if_eap
+}
+
+#
+# Run these rules for sending an Access-Reject
+#
+# Add the ldap module name (or instance) if you have set
+# 'edir_account_policy_check = yes' in the ldap module configuration
+#
+send Access-Reject {
+ # log failed authentications in SQL, too.
+ -sql
+ attr_filter.access_reject
+
+ # Insert EAP-Failure message if the request was
+ # rejected by policy instead of because of an
+ # authentication failure And already has an EAP message
+ # For non-ABFAB, we insert the failure all the time, but for ABFAB
+ # It's more desirable to preserve reply-message when we can
+ if (&reply:Eap-Message) {
+ eap
}
+
+ # Remove reply message if the response contains an EAP-Message
+ remove_reply_message_if_eap
+
}
#
# When the server decides to proxy a request to a home server,
#
# Accounting. Log the accounting data.
#
- process Accounting-Request {
+ send Accounting-Response {
#
# Log traffic to an SQL database.
#
}
}
-process Access-Request {
- Auth-Type Step1 {
- # If the password doesn't match, the user is rejected
- # immediately.
- pap
- #
- # Set the random number to save.
- #
- update session-state {
- Tmp-Integer-0 := "%{randstr:n}"
- }
- update reply {
- Reply-Message := &session-state:Tmp-Integer-0
- }
+authenticate Step1 {
+ # If the password doesn't match, the user is rejected
+ # immediately.
+ pap
- #
- # Send an Access-Challenge.
- # See raddb/policy.d/control for the definition
- # of "challenge"
- #
- challenge
+ #
+ # Set the random number to save.
+ #
+ update session-state {
+ Tmp-Integer-0 := "%{randstr:n}"
}
-
- Auth-Type Step2 {
- #
- # Do PAP authentication with the password.
- #
- pap
+ update reply {
+ Reply-Message := &session-state:Tmp-Integer-0
}
+
+ #
+ # Send an Access-Challenge.
+ # See raddb/policy.d/control for the definition
+ # of "challenge"
+ #
+ challenge
+}
+
+authenticate Step2 {
+ #
+ # Do PAP authentication with the password.
+ #
+ pap
}
}
#
# Accounting. Log the accounting data.
#
- process Accounting-Request {
+ send Accounting-Response {
#
# Since we're proxying, we don't log anything
# locally. Ensure that the accounting section
# Any "listen" section that listens on an accounting port should
# set "virtual_server = write-detail.example.com
server write_detail.example.com {
- process Accounting-Request {
+ recv Accounting-Request {
#
# Write the "detail" files.
#
#
# Accounting. Log the accounting data.
#
-process Accounting-Request {
+send Accounting-Response {
#
# Create a 'detail'ed log of the packets.
# Note that accounting requests which are proxied
reject
}
- process Access-Request {
+ send Access-Accept {
}
- post-auth {
-
- Post-Auth-Type Reject {
- update reply {
- &Reply-Message = 'This is only an example.'
- }
+ send Access-Reject {
+ update reply {
+ &Reply-Message = 'This is only an example.'
}
}
#
# NB You cannot forcibly accept an EAP authentication!
-process Access-Request {
- #
- # PAP authentication, when a back-end database listed
- # in the 'authorize' section supplies a password. The
- # password can be clear-text, or encrypted.
- Auth-Type PAP {
- pap
- }
+#
+# PAP authentication, when a back-end database listed
+# in the 'authorize' section supplies a password. The
+# password can be clear-text, or encrypted.
+authenticate PAP {
+ pap
+}
- #
- # Most people want CHAP authentication
- # A back-end database listed in the 'authorize' section
- # MUST supply a CLEAR TEXT password. Encrypted passwords
- # won't work.
- Auth-Type CHAP {
- chap
- }
+#
+# Most people want CHAP authentication
+# A back-end database listed in the 'authorize' section
+# MUST supply a CLEAR TEXT password. Encrypted passwords
+# won't work.
+authenticate CHAP {
+ chap
+}
- #
- # MSCHAP authentication.
- Auth-Type MS-CHAP {
- mschap
- }
+#
+# MSCHAP authentication.
+authenticate MS-CHAP {
+ mschap
+}
- #
- # Pluggable Authentication Modules.
-# pam
+#
+# Pluggable Authentication Modules.
+authenticate pam {
+ pam
+}
- # Uncomment it if you want to use ldap for authentication
- #
- # Note that this means "check plain-text password against
- # the ldap database", which means that EAP won't work,
- # as it does not supply a plain-text password.
- #
- # We do NOT recommend using this. LDAP servers are databases.
- # They are NOT authentication servers. FreeRADIUS is an
- # authentication server, and knows what to do with authentication.
- # LDAP servers do not.
- #
-# Auth-Type LDAP {
-# ldap
-# }
+# Uncomment it if you want to use ldap for authentication
+#
+# Note that this means "check plain-text password against
+# the ldap database", which means that EAP won't work,
+# as it does not supply a plain-text password.
+#
+# We do NOT recommend using this. LDAP servers are databases.
+# They are NOT authentication servers. FreeRADIUS is an
+# authentication server, and knows what to do with authentication.
+# LDAP servers do not.
+#
+authenticate LDAP {
+ ldap
+}
- #
- # Allow EAP authentication.
- eap
+#
+# Allow EAP authentication.
+authenticate eap {
+ eap
}
######################################################################
# If you need to send a reply attribute in the outer session,
# the ONLY safe way is to set "use_tunneled_reply = yes", and
# then update the inner-tunnel reply.
-post-auth {
+send Access-Accept {
# If you want privacy to remain, see the
# Chargeable-User-Identity attribute from RFC 4372.
# If you want to use it just uncomment the line below.
&outer.session-state: += &reply:
}
}
+}
#
# Access-Reject packets are sent through the REJECT sub-section of the
# Add the ldap module name (or instance) if you have set
# 'edir_account_policy_check = yes' in the ldap module configuration
#
- Post-Auth-Type REJECT {
- # log failed authentications in SQL, too.
- -sql
- attr_filter.access_reject
+send Access-Reject {
+ # log failed authentications in SQL, too.
+ -sql
+ attr_filter.access_reject
- #
- # Let the outer session know which module failed, and why.
- #
- update outer.session-state {
- &Module-Failure-Message := &request:Module-Failure-Message
- }
+ #
+ # Let the outer session know which module failed, and why.
+ #
+ update outer.session-state {
+ &Module-Failure-Message := &request:Module-Failure-Message
}
}
}
}
-process Access-Request {
+authenticate eap {
#
# This is necessary so that the inner tunnel EAP-MSCHAPv2
# method can be called. That method takes care of turning
#
# When the home servers come back up, the packets are forwarded,
# and the detail file processed as normal.
- process Accounting-Request {
+ recv Accounting-Request {
# You may want accounting policies here...
update control {
send Authorization {
}
- recv process Accounting-Request {
+ recv Accounting-Request {
update config {
&Auth-Type = Accept
}
}
- send process Accounting-Request {
+ send Accounting-Response {
}
# Proxying of TACACS+ requests is NOT supported.
- process MSCHAP {
+ authenticate MSCHAP {
mschap
}
- process CHAP {
+ authenticate CHAP {
chap
}
- process PAP {
+ authenticate PAP {
pap
}
}
# insert policies here
}
-process Access-Request {
+send Access-Accept {
# insert policies here
}
goto setup_send;
}
- unlang = cf_section_find(request->server_cs, "process", dv->alias);
+ unlang = cf_section_find(request->server_cs, "authenticate", dv->alias);
if (!unlang) {
- REDEBUG2("No 'process %s' section found: rejecting the user", dv->alias);
+ REDEBUG2("No 'authenticate %s' section found: rejecting the user", dv->alias);
request->reply->code = FR_CODE_ACCESS_REJECT;
goto setup_send;
}
- RDEBUG("Running 'process %s' from file %s", cf_section_name2(unlang), cf_filename(unlang));
+ RDEBUG("Running 'authenticate %s' from file %s", cf_section_name2(unlang), cf_filename(unlang));
unlang_push_section(request, unlang, RLM_MODULE_NOTFOUND);
request->request_state = REQUEST_PROCESS;
rcode = auth_compile_section(server_cs, "send", "Access-Challenge", MOD_POST_AUTH);
if (rcode < 0) return rcode;
- while ((subcs = cf_section_find_next(server_cs, subcs, "process", NULL))) {
+ while ((subcs = cf_section_find_next(server_cs, subcs, "authenticate", NULL))) {
char const *name2;
name2 = cf_section_name2(subcs);
if (!name2) {
- cf_log_err(subcs, "Cannot compile 'process { ... }' section");
+ cf_log_err(subcs, "An name is required for the 'authenticate { ... }' section");
return -1;
}
- cf_log_debug(subcs, "Loading process %s {...}", name2);
+ cf_log_debug(subcs, "Loading authenticate %s {...}", name2);
if (unlang_compile(subcs, MOD_AUTHENTICATE) < 0) {
- cf_log_err(subcs, "Failed compiling 'process %s { ... }' section", name2);
+ cf_log_err(subcs, "Failed compiling 'authenticate %s { ... }' section", name2);
return -1;
}
}
return -1;
}
- while ((subcs = cf_section_find_next(server_cs, subcs, "process", CF_IDENT_ANY))) {
+ while ((subcs = cf_section_find_next(server_cs, subcs, "authenticate", CF_IDENT_ANY))) {
char const *name2;
fr_value_box_t value = { .type = FR_TYPE_UINT32 };
fr_dict_enum_t *dv;
name2 = cf_section_name2(subcs);
if (!name2) {
- cf_log_err(subcs, "Invalid 'process { ... }' section, it must have a name");
+ cf_log_err(subcs, "Invalid 'authenticate { ... }' section, it must have a name");
return -1;
}
if (auth_listen_compile(server_cs, listen_cs) < 0) return -1;
- while ((subcs = cf_section_find_next(server_cs, subcs, "process", CF_IDENT_ANY))) {
+ while ((subcs = cf_section_find_next(server_cs, subcs, "authenticate", CF_IDENT_ANY))) {
int rcode;
char const *name2;
name2 = cf_section_name2(subcs);
if (!name2) {
- cf_log_err(subcs, "Invalid 'process { ... }' section, it must have a name");
+ cf_log_err(subcs, "Invalid 'authenticate { ... }' section, it must have a name");
return -1;
}
- rcode = auth_compile_section(server_cs, "process", name2, MOD_AUTHENTICATE);
+ rcode = auth_compile_section(server_cs, "authenticate", name2, MOD_AUTHENTICATE);
if (rcode < 0) {
- cf_log_err(subcs, "Failed compiling 'process %s { ... }' section", name2);
+ cf_log_err(subcs, "Failed compiling 'authenticate %s { ... }' section", name2);
return -1;
}
}
projects / thirdparty / freeradius-server.git / commitdiff
