-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
-# $Id$
+# $Id$
#######################################################################
#
#
#
-# sql { ... }:: See `sql` documentation.
+# sql { ... }:: See `sql` documentation.
#
sql psksql {
#
- # driver:: Database driver.
+ # driver:: Database driver.
#
driver = "rlm_sql_sqlite"
#
- # sqlite { ... }:: Database statement based on `driver` setting.
+ # sqlite { ... }:: Database statement based on `driver` setting.
#
sqlite {
filename = "/var/lib/trust_router/keys"
-# -*- text -*-
+# -*- text -*-
+#
+# :toc:
#
-# :toc:
-#
# $Id$
#######################################################################
# | `noop` | Simulate a no-op.
# | `updated` | Indicate that the request has been updated.
# |===
- #
+ #
# rcode = <value>
-
+
#
- # simulcount::
+ # simulcount::
#
# If an instance of this module is listed in a `session {}`
# section, this simulates a user having `<integer>` number of sessions.
# simulcount = <integer>
#
- # mpp::
+ # mpp::
#
# If an instance is listed in a `session {}` section, this
# simulates the user having multilink sessions.
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
# The `key` to use for filter the packets.
#
# key = "<value>"
-
+
#
- # filename::
+ # filename::
#
# The `filename` with the attributes to filter.
#
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
#
#
-# ## Default instance
+# ## Default instance
#
cache {
#
- # driver::
+ # driver::
#
# The current backend datastore used to store the cache entries are:
#
#
update {
#
- # <list>:<attribute> <op> <value>::
+ #
<list>:<attribute> <op> <value>::
#
- # Cache all instances of `Reply-Message in the reply list.
+ # Cache all instances of `Reply-Message in the reply list.
&reply:Reply-Message := &reply:Reply-Message
- # Add our own to show when the cache was last updated.
+ # Add our own to show when the cache was last updated.
&reply:Reply-Message := "Cache last updated at %t"
- # Add your own value for `Class`.
+ # Add your own value for `Class`.
&reply:Class := "%{randstr:ssssssssssssssssssssssssssssssss}"
}
# [options="header,autowidth"]
# |===
# | Condition | Description
- # | `Cache-TTL` of > `0` | Set the TTL of the entry to the new value
+ # | `Cache-TTL` of > `0` | Set the TTL of the entry to the new value
# (and reset the expiry timer).
- # | `Cache-TTL` of < `0` | Expire the existing entry and create a new
+ # | `Cache-TTL` of < `0` | Expire the existing entry and create a new
# one with TTL set to `Cache-TTL` * `-1`.
# | `Cache-TTL` of `0` | Expire the existing entry and create a new one.
# |===
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
#
cache cache_eap {
#
- # key:: Cache key.
+ # key:: Cache key.
#
key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"
#
- # ttl:: TTL for cache entries.
+ # ttl:: TTL for cache entries.
#
ttl = 15
#
- # update <section> { ... }::
+ # update <section> { ... }::
#
update reply {
&reply: += &reply:
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
#
#
-# ### TLS Session Configuration
+# ### TLS Session Configuration
#
cache cache_tls_session {
#
- # driver:: `cache` driver.
+ # driver:: `cache` driver.
#
driver = "rlm_cache_rbtree"
#
- # key:: The `cache` key.
+ # key:: The `cache` key.
#
key = &TLS-Session-Id
#
- # ttl:: TTL for `cache` entries.
+ # ttl:: TTL for `cache` entries.
#
ttl = 3600 # 60 mins
#
- # update <section> { ... }::
+ # update <section> { ... }::
#
update {
&session-state:TLS-Session-Data := &session-state:TLS-Session-Data
}
#
-# ### OCSP Session Configuration
+# ### OCSP Session Configuration
#
-# In addition to TLS sessions, the OCSP queries can be cached.
+# In addition to TLS sessions, the OCSP queries can be cached.
#
cache cache_ocsp {
#
- # driver:: `cache` driver.
+ # driver:: `cache` driver.
#
driver = "rlm_cache_rbtree"
#
- # key:: `cache` key.
+ # key:: `cache` key.
#
key = &session-state:TLS-Client-Cert-Serial
#
- # update <section> { ... }::
+ # update <section> { ... }::
#
update {
&control:TLS-OCSP-Cert-Valid := &TLS-OCSP-Cert-Valid
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
#
#
-# ## Default instances
+# ## Default instances
#
cipher {
#
}
#
- # signature_digest::
+ # signature_digest::
#
- # Digest used to ingest the plaintext before signing or verification.
+ # Digest used to ingest the plaintext before signing or verification.
#
# signature_digest = "sha256"
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
#######################################################################
#
-# = Couchbase Module
+# = Couchbase Module
#
-# The `couchbase` module is used to provides connections to a `Couchbase` database.
+# The `couchbase` module is used to provides connections to a `Couchbase` database.
#
#
-# ## Default instance
+# ## Default instance
#
couchbase {
#
- # server:: List of Couchbase hosts (hosts may be space, tab, comma or semi-colon separated).
- # Ports are optional if servers are listening on the standard port.
- #
- # NOTE: Complete pool urls are preferred.
+ # server:: List of Couchbase hosts (hosts may be space, tab, comma or semi-colon separated).
+ # Ports are optional if servers are listening on the standard port.
+ #
+ # NOTE: Complete pool urls are preferred.
#
server = "http://cb01.example.org:8091/ http://cb02.example.org:8091/"
#
- # bucket:: Couchbase bucket name.
+ # bucket:: Couchbase bucket name.
#
bucket = "radius"
#
- # password:: Couchbase bucket password (optional).
+ # password:: Couchbase bucket password (optional).
#
# password = "password"
#
- # acct_key:: Couchbase accounting document key.
+ # acct_key:: Couchbase accounting document key.
#
# This key is dynamically expanded at run time.
#
acct_key = "radacct_%{%{Acct-Unique-Session-Id}:-%{Acct-Session-Id}}"
#
- # doctype:: Value for the 'docType' element in the json body for accounting documents.
+ # doctype:: Value for the 'docType' element in the json body for accounting documents.
#
doctype = "radacct"
#
- # expire:: Accounting document expire time in seconds (0 = never).
+ # expire:: Accounting document expire time in seconds (0 = never).
#
expire = 2592000
#
- # update { ... }:: Map attribute names to json element names for accounting.
+ # update { ... }:: Map attribute names to json element names for accounting.
#
- # Configuration items are in the format `<radius attribute> = '<element name>'`
+ # Configuration items are in the format `<radius attribute> = '<element name>'`
#
- # NOTE: Element names should be *single quoted*.
- # Attributes not in this map will not be recorded.
+ # NOTE: Element names should be *single quoted*.
+ # Attributes not in this map will not be recorded.
#
update {
&Acct-Session-Id = 'sessionId'
}
#
- # user_key:: Couchbase document key for user documents (`unlang` supported).
+ # user_key:: Couchbase document key for user documents (`unlang` supported).
#
user_key = "raduser_%{md5:%{tolower:%{%{Stripped-User-Name}:-%{User-Name}}}}"
#
- # read_clients:: Set to `yes` to read radius clients from the Couchbase view specified below.
- # NOTE: Clients will *ONLY* be read on server *startup*.
+ # read_clients:: Set to `yes` to read radius clients from the Couchbase view specified below.
+ # NOTE: Clients will *ONLY* be read on server *startup*.
#
# read_clients = no
#
- # client { ... }:: `Map` attribute names to jSON element names when loading clients.
+ # client { ... }:: `Map` attribute names to jSON element names when loading clients.
#
- # Configuration follows the same rules as the accounting `map` above.
+ # Configuration follows the same rules as the accounting `map` above.
#
client {
#
- # view:: Couchbase view that should return all available client documents.
+ # view:: Couchbase view that should return all available client documents.
#
view = "_design/client/_view/by_id"
#
- # template { ... }:: Sets default values (not obtained from couchbase) for new client entries.
+ # template { ... }:: Sets default values (not obtained from couchbase) for new client entries.
#
template {
# login = 'test'
}
#
- # attribute { ... }:: Sets the client mappings following the format: `<client attribute> = '<element name>'`.
+ # attribute { ... }:: Sets the client mappings following the format: `<client attribute> = '<element name>'`.
#
- # The following attributes are required:
+ # The following attributes are required:
#
# [options="header,autowidth"]
# |===
# | `secret` | RADIUS shared secret.
# |===
#
- # NOTE: All attributes usually supported in a `client` definition are also
- # supported here. Element names *should be single quoted*.
+ # NOTE: All attributes usually supported in a `client` definition are also
+ # supported here. Element names *should be single quoted*.
#
attribute {
ipaddr = 'clientIdentifier'
}
#
- # pool { ... }:: The connection pool is new for >= `3.0`, and will be used in many
- # modules, for all kinds of connection-related activity.
+ # pool { ... }:: The connection pool is new for >= `3.0`, and will be used in many
+ # modules, for all kinds of connection-related activity.
#
pool {
#
# start:: Connections to create during module instantiation.
- # If the server cannot create specified number of connections
+ # If the server cannot create specified number of connections
# during instantiation it will exit.
# Set to `0` to allow the server to start without the couchbase
# being available.
#
connect_timeout = 3.0
- # [WARNING]
- # ====
+ # [WARNING]
+ # ====
# All configuration settings are enforced. If a
# connection is closed because of `idle_timeout`,
# `uses`, or `lifetime`, then the total number of
#
# The solution is to either lower the `min` connections,
# or increase `lifetime`/`idle_timeout`.
- # ====
+ # ====
}
}
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
#
# WARNING: Multi-line fields are NOT allowed.
#
-# ## Default instance
+# ## Default instance
#
csv {
#
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
# ====
#
- # sqlite { ... }:: SQLite configuration.
+ # sqlite { ... }:: SQLite configuration.
#
sqlite {
filename = ${radacctdir}/cui.sqlite
}
#
- # logfile:: Write CUI queries to a logfile. Useful for debugging.
+ # logfile:: Write CUI queries to a logfile. Useful for debugging.
#
# logfile = ${logdir}/cuilog.sql
#
- # pool { ... }:: persistent connections to external resources.
+ # pool { ... }:: persistent connections to external resources.
#
pool {
start = 5
}
#
- # cui_table:: The name of the database table to use for store.
+ # cui_table:: The name of the database table to use for store.
#
cui_table = "cui"
#
- # sql_user_name:: `SQL-User-Name` is used as the user for SQL queries.
- # Normally it is the same as `User-Name`, but sometimes it needs to be different.
- # Then instead of editing `User-Name` (*which we dont' recommend*), you can
- # set `SQL-User-Name` to the new value.
+ # sql_user_name:: `SQL-User-Name` is used as the user for SQL queries.
+ # Normally it is the same as `User-Name`, but sometimes it needs to be different.
+ # Then instead of editing `User-Name` (*which we dont' recommend*), you can
+ # set `SQL-User-Name` to the new value.
#
sql_user_name = "%{User-Name}"
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
#######################################################################
#
-# = Date Module
+# = Date Module
#
-# The `date` module xlat does convert time formats.
+# The `date` module xlat does convert time formats.
#
#
-# ## Default instance
+# ## Default instance
#
#
-# ### Simple date
+# ### Simple date
#
date {
#
- # format::
+ # format::
#
# The `xlat` performs in three modes depending on the input it
# is passed.
format = "%b %e %Y %H:%M:%S %Z"
#
- # utc::
+ # utc::
#
- # If `utc` is enabled then any conversions from a date
- # attribute to a `string` will be made as UTC, not localtime.
+ # If `utc` is enabled then any conversions from a date
+ # attribute to a `string` will be made as UTC, not localtime.
#
- # .Default is to use localtime.
+ # .Default is to use localtime.
#
# utc = no
}
#
-# ### ISO format
+# ### ISO format
#
# The core `xlat`, `%T` returns the request timestamp in `ISO` format
# including milliseconds. This expansion returns it without the
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
#######################################################################
#
-# = Delay Module
+# = Delay Module
#
# The `delay` module delays the processing of a request in a
# non-blocking fashion.
#
#
-# ## Default instance
+# ## Default instance
#
#
-# ### Simple delay
+# ### Simple delay
#
delay {
#
}
#
-# ### Delaying Access-Reject packets
+# ### Delaying Access-Reject packets
#
# The `delay_reject` module should be used in a `send Access-Reject` section, as
# the last module in that section. When `delay_reject` is used
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
# corner cases.
#
-# ## Default instance
+# ## Default instance
#
detail detail.example.com {
filename = ${radacctdir}/detail.example.com/detail-%Y-%m-%dT%H:%G:00
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
#
sqlippool dhcp_sqlippool {
#
- # See the `sqlippool` module for common configuration explanation.
+ # See the `sqlippool` module for common configuration explanation.
#
sql_module_instance = "sql"
lease_duration = 7200
#
- # NOTE: Client's MAC address is mapped to `Calling-Station-Id` in `policy.conf`.
+ # NOTE: Client's MAC address is mapped to `Calling-Station-Id` in `policy.conf`.
#
pool_key = "%{Calling-Station-Id}"
attribute_name = DHCP-Your-IP-Address
- #
- # The current sample is prepared to work with MySQL.
+ #
+ # The current sample is prepared to work with MySQL.
#
$INCLUDE ${modconfdir}/sql/ippool-dhcp/mysql/queries.conf
- #
- # NOTE: To use sqlite you need to add `%` to `safe_characters` in
- # `raddb/mods-config/sql/main/sqlite/queries.conf.`
+ #
+ # NOTE: To use sqlite you need to add `%` to `safe_characters` in
+ # `raddb/mods-config/sql/main/sqlite/queries.conf.`
#
# $INCLUDE ${modconfdir}/sql/ippool-dhcp/sqlite/queries.conf
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
# OCSP response to pass back to the TLS client.
#
# staple { ... }::
- #
+ #
# This allows TLS clients to check for certificate revocation before
# divulging credentials to a (possibly rogue) server, that may be
# presenting a compromised certificate.
}
#
- # ### EAP-TLS
+ # ### EAP-TLS
#
# As of Version 3.0, the TLS configuration for `TLS-based`
# EAP types is above in the `tls-config { ... }` section.
#
tls {
- # Point to the common TLS configuration
+ # Point to the common TLS configuration
tls = tls-common
#
pac_opaque_key = "0123456789abcdef0123456789ABCDEF"
#
- # virtual_server:: Same as for `TTLS`, `PEAP`, etc.
+ # virtual_server:: Same as for `TTLS`, `PEAP`, etc.
#
virtual_server = inner-tunnel
}
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
#
#
-# ## Default instance
+# ## Default instance
#
exec echo {
#
#
# program:: The name of the program to execute, and it's
- # arguments.
- #
+ # arguments.
+ #
# Dynamic translation is done on this field, so things like
# the following example will work.
#
#
# output_pairs::: Where to place the output attributes (if any) from
- # the executed program.
- #
+ # the executed program.
+ #
# The values allowed, and the restrictions as to availability, are the
# same as for the `input_pairs`.
#
#
# Default is `10` seconds, which should be plenty for nearly
# anything. Range is `1` to `30` seconds.
- #
+ #
# WARNING: You are strongly encouraged to NOT increase this value.
# Decreasing can be used to cause authentication to fail sooner
# when you know it's going to fail anyway due to the time taken,
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
#
# program:: The name of the program to execute, and it's
- # arguments.
- #
+ # arguments.
+ #
# Dynamic translation is done on this field, so things like
# the following example will work.
#
#
# output_pairs::: Where to place the output attributes (if any) from
- # the executed program.
- #
+ # the executed program.
+ #
# The values allowed, and the restrictions as to availability, are the
# same as for the `input_pairs`.
#
#
# Default is `10` seconds, which should be plenty for nearly
# anything. Range is `1` to `30` seconds.
- #
+ #
# WARNING: You are strongly encouraged to NOT increase this
# value. In fact, you are much better off decreasing it to a
# lower value. Doing so will improve network stability and
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
#######################################################################
#
-# = Expiration Module
+# = Expiration Module
#
-# The `expiration` module manages the `Expiration` attribute.
+# The `expiration` module manages the `Expiration` attribute.
#
-# It should be included in the *end* of the `recv` section in order to
-# handle user `Expiration`. It should also be included in the `instantiate`
-# section in order to register the `Expiration` compare function.
+# It should be included in the *end* of the `recv` section in order to
+# handle user `Expiration`. It should also be included in the `instantiate`
+# section in order to register the `Expiration` compare function.
#
#
-# ## Default instance
+# ## Default instance
#
-# This module takes no configuration.
+# This module takes no configuration.
#
expiration {
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
#
files {
#
- # moddir:: Search for files in a subdirectory of mods-config which
- # matches this instance of the files module.
+ # moddir:: Search for files in a subdirectory of mods-config which
+ # matches this instance of the files module.
#
moddir = ${modconfdir}/${.:instance}
#
- # key:: The default key attribute to use for matches.
+ # key:: The default key attribute to use for matches.
#
- # The content of this attribute is used to match the `name` of the entry.
+ # The content of this attribute is used to match the `name` of the entry.
#
# key = "%{%{Stripped-User-Name}:-%{User-Name}}"
#
- # filename:: The old `users` style file is now located here.
+ # filename:: The old `users` style file is now located here.
#
filename = ${moddir}/authorize
#
- # usersfile:: This is accepted for backwards compatibility
- # It will be removed in a future release.
+ # usersfile:: This is accepted for backwards compatibility
+ # It will be removed in a future release.
#
# usersfile = ${moddir}/authorize
#
- # WARNING: These are accepted for backwards compatibility.
- # They will be renamed in a future release.
+ # WARNING: These are accepted for backwards compatibility.
+ # They will be renamed in a future release.
#
acctusersfile = ${moddir}/accounting
preproxy_usersfile = ${moddir}/pre-proxy
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
#
# = JSON Module
#
-# The `json` module registers a `map` function to allow mapping fields
-# from JSON structures to attributes.
-#
-# The path through the JSON document's tree is specified with FR jpath,
-# which is the FreeRADIUS implementation of the jpath grammar described
-# at http://goessner.net/articles/JsonPath/
-#
-# Selectors currently implemented are:
-#
-# [options="header,autowidth"]
-# |===
-# | Selector | Description
-# | $ | Root node (only valid at the start of the path).
-# | @ | Current node (only valid at the start of the path).
-# | .<name> | A field within an object.
-# | [<idx>] | Index within an array.
-# | [<start>:<end>[:<step>]] | A slice within an array (identical to the Python syntax).
-# | [<idx>,<start>:<end>] | Multiple indexes/slices within an array.
-# | .* | All the children of the current node.
-# | .. | Recursive descent.
-# |===
-#
-# [NOTE]
-# ====
-# * Automatic casting will occur between JSON and attribute types where possible.
-# * Assignment of JSON objects/arrays to strings is supported, in which case the
+# The `json` module registers a `map` function to allow mapping fields
+# from JSON structures to attributes.
+#
+# The path through the JSON document's tree is specified with FR jpath,
+# which is the FreeRADIUS implementation of the jpath grammar described
+# at http://goessner.net/articles/JsonPath/
+#
+# Selectors currently implemented are:
+#
+# [options="header,autowidth"]
+# |===
+# | Selector | Description
+# | $ | Root node (only valid at the start of the path).
+# | @ | Current node (only valid at the start of the path).
+# | .<name> | A field within an object.
+# | [<idx>] | Index within an array.
+# | [<start>:<end>[:<step>]] | A slice within an array (identical to the Python syntax).
+# | [<idx>,<start>:<end>] | Multiple indexes/slices within an array.
+# | .* | All the children of the current node.
+# | .. | Recursive descent.
+# |===
+#
+# [NOTE]
+# ====
+# * Automatic casting will occur between JSON and attribute types where possible.
+# * Assignment of JSON objects/arrays to strings is supported, in which case the
# JSON serialized form of the object/array is used.
-# * If a jpath matches multiple nodes, unless the map includes the `+=` operator
-# * only the first node's value will be used.
-# * If the map uses `+=` then multiple instances of the attribute will be created,
+# * If a jpath matches multiple nodes, unless the map includes the `+=` operator
+# * only the first node's value will be used.
+# * If the map uses `+=` then multiple instances of the attribute will be created,
# each holding a different node value.
-# ====
+# ====
#
#
-# ## Default instance
+# ## Default instance
#
-# This module takes no configuration.
+# This module takes no configuration.
#
json {
}
#
-# ## Sample
+# ## Sample
#
-# Assuming that you have the url http://example.org/api/user/$username
-# service replying some JSON content as below.
+# Assuming that you have the url http://example.org/api/user/$username
+# service replying some JSON content as below.
#
-# [source, json]
-# ----
-# {
+# [source, json]
+# ----
+# {
# "user": "bob",
# "account number": 7124503,
# "groups": {
# "bob"
# }
# }
-# }
-# ----
+# }
+# ----
#
-# Then, you can call using the module `rest` and access the JSON fields as below example.
+# Then, you can call using the module `rest` and access the JSON fields as below example.
#
-# [source, unlang]
-# ----
-# map json "%{rest:GET http://example.org/api/user/%{User-Name}" {
+# [source, unlang]
+# ----
+# map json "%{rest:GET http://example.org/api/user/%{User-Name}" {
# &Tmp-Integer-0 := '$.account number'
# &Group += '$.groups.*'
-# }
-# ----
+# }
+# ----
#
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
#
# You can configure the module with the following parameters:
#
-# [source, unlang]
-# ----
-# krb5 {
+# [source, unlang]
+# ----
+# krb5 {
# # Keytab containing the key used by rlm_krb5
# keytab = /path/to/keytab
#
# # Principal that is used by rlm_krb5
# service_principal = radius/some.host.com
-# }
-# ----
+# }
+# ----
#
# Make sure the keytab is readable by the user that is used to run `radiusd` and
# that your authorization configuration really uses `krb5` to do the
# authentication. You will need to add the following to the `authenticate`
# section of your `radiusd.conf` file:
#
-# [source, unlang]
-# Auth-Type Kerberos {
+# [source, unlang]
+# Auth-Type Kerberos {
# krb5
-# }
-# ----
+# }
+# ----
#
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
#
sasl {
#
- # mech:: SASL mechanism.
+ # mech:: SASL mechanism.
#
# mech = 'PLAIN'
#
- # proxy:: SASL authorisation identity to proxy.
+ # proxy:: SASL authorisation identity to proxy.
#
# proxy = 'autz_id'
#
- # realm:: SASL realm. Used for kerberos.
+ # realm:: SASL realm. Used for kerberos.
#
# realm = 'example.org'
}
#
tls {
#
- # start_tls:: Set this to `yes` to use TLS encrypted connections
- # to the LDAP database by using the StartTLS extended operation.
+ # start_tls:: Set this to `yes` to use TLS encrypted connections
+ # to the LDAP database by using the StartTLS extended operation.
#
- # The StartTLS operation is supposed to be used with normal ldap connections
- # instead of using ldaps (port 636) connections
+ # The StartTLS operation is supposed to be used with normal ldap connections
+ # instead of using ldaps (port 636) connections
#
# start_tls = yes
#
- # NOTE: If `start_tls = yes`, then fill up those such options with the certificate information.
+ # NOTE: If `start_tls = yes`, then fill up those such options with the certificate information.
#
# ca_file = ${certdir}/cacert.pem
# ca_path = ${certdir}
# random_file = /dev/urandom
#
- # require_cert:: Certificate Verification requirements.
+ # require_cert:: Certificate Verification requirements.
#
- # Can be:
+ # Can be:
#
# [options="header,autowidth"]
# |===
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
Accounting-On = "NAS %{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}} (%{%{NAS-IP-Address}:-%{NAS-IPv6-Address}}) just came online"
Accounting-Off = "NAS %{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}} (%{%{NAS-IP-Address}:-%{NAS-IPv6-Address}}) just went offline"
- # Don't log anything for other `Acct-Status-Type` 's.
+ # Don't log anything for other `Acct-Status-Type` 's.
unknown = "NAS %{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}} (%{%{NAS-IP-Address}:-%{NAS-IPv6-Address}}) sent unknown Acct-Status-Type %{Acct-Status-Type}"
}
}
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
# $Id$
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
#
# You can also try setting the user name as:
#
- # `... --username=%{mschap:User-Name} ...`
+ # `... --username=%{mschap:User-Name} ...`
#
# In that case, the `mschap` module will look at the `User-Name`
# attribute, and do prefix/suffix checks in order to obtain the _best_
}
#
- # .Pass Change
+ # .Pass Change
#
passchange {
#
- # ntlm_auth:: Path and arguments to ntlm_auth for password change.
+ # ntlm_auth:: Path and arguments to ntlm_auth for password change.
#
- # ntlm_auth_username:: The user name for ntlm_auth password change.
+ # ntlm_auth_username:: The user name for ntlm_auth password change.
#
- # ntlm_auth_domain:: The domain name for ntlm_auth password change.
+ # ntlm_auth_domain:: The domain name for ntlm_auth password change.
#
- # This module support `MS-CHAPv2` (not v1) password
- # change requests. See `doc/modules/mschap.rst` for
- # some IMPORTANT information.
+ # This module support `MS-CHAPv2` (not v1) password
+ # change requests. See `doc/modules/mschap.rst` for
+ # some IMPORTANT information.
#
- # Samba/ntlm_auth - if you are using `ntlm_auth` to validate
- # passwords, you will need to use `ntlm_auth` to change passwords.
+ # Samba/ntlm_auth - if you are using `ntlm_auth` to validate
+ # passwords, you will need to use `ntlm_auth` to change passwords.
#
- # Uncomment the three lines below, and change the path to `ntlm_auth.
+ # Uncomment the three lines below, and change the path to `ntlm_auth.
#
# ntlm_auth = "/usr/bin/ntlm_auth --helper-protocol=ntlm-change-password-1"
# ntlm_auth_username = "username: %{mschap:User-Name}"
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
#
# WARNING: The symbols `\0` and `\n` are not allowed.
#
- # The Default is `:`
+ # The Default is `:`
#
# delimiter = ":"
format = "*User-Name:Crypt-Password:"
#
- # hash_size::
+ # hash_size::
#
# A future version of the server will have the module automatically
# determine the hash size. Having it set manually should not be
# necessary. It should be set to 50% of the number of lines in the file.
- #
+ #
# WARNING: The value must be larger than zero.
#
hash_size = 100
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
#
# The interface between FreeRADIUS and Perl is mostly strings.
#
-# Attributes of type `string` are copied to Perl as-is.
+# Attributes of type `string` are copied to Perl as-is.
# They are not escaped or interpreted.
#
# Attributes of type `octets` are copied to Perl as-is.
# FreeRADIUS server.
#
perl_flags = "-T"
-
+
#
# List of functions in the module to call. Uncomment and change if you
# want to use function names other than the defaults.
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
#
# config { ... }::
- #
+ #
# You can define configuration items (and nested sub-sections) in python `config { ... }`
# section. These items will be accessible in the python script through `radiusd.config`
# dict for instance:
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
# ## Packets
#
# Each packet can have it's own retransmission timers.
- #
+ #
# The sections are named for each packet type. The contents
# are the same for all packet types. Only the relevant ones
# are parsed (see `type` above).
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
# ====
# All configuration settings are enforced. If a connection is closed because of
# `idle_timeout`, `uses`, or `lifetime`, then the total number of connections MAY
- # fall below `min`.
+ # fall below `min`.
#
# When that happens, it will open a new connection. It will also log a *WARNING*
# message.
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
#
#
-# # Default instance
+# # Default instance
#
# If you want different instances of `rest`, just replicate the section
# and give a name.
# [source,unlang]
# ----
# rest backend_check {
-# ...
+# ...
# }
# ----
#
#
tls {
#
- # .Set options about the certificate.
+ # .Set options about the certificate.
#
# ca_file = ${certdir}/cacert.pem
# ca_path = ${certdir}
# The values of those attributes should be in the format:
#
# <attribute>: <value>
- #
+ #
# `control:REST-HTTP-Header` attributes will be consumed after each call
# to the rest module, and each `%{rest:}` expansion.
#
# "op":"+="
# }
# }
- # ----
+ # ----
#
# [NOTE]
# ====
# ====
# All configuration settings are enforced. If a connection is closed because of
# `idle_timeout`, `uses`, or `lifetime`, then the total number of connections MAY
- # fall below `min`.
+ # fall below `min`.
#
# When that happens, it will open a new connection. It will also log a *WARNING*
# message.
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
# dhcp:: If enabled, It will do SoH over DHCP.
#
# Default is `no`.
- #
+ #
dhcp = yes
}
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
#
sql {
#
- # dialect:: The dialect of SQL you want to use.
+ # dialect:: The dialect of SQL you want to use.
#
- # NOTE: If you're using `rlm_sql_null`, then it should be the type of
- # database the logged queries are going to be executed against.
+ # NOTE: If you're using `rlm_sql_null`, then it should be the type of
+ # database the logged queries are going to be executed against.
#
dialect = "sqlite"
#
- # driver:: The sub-module to use to execute queries. This should match
- # the database you're attempting to connect to.
+ # driver:: The sub-module to use to execute queries. This should match
+ # the database you're attempting to connect to.
#
# * rlm_sql_cassandra
# * rlm_sql_db2
driver = "rlm_sql_${dialect}"
#
- # $-INCLUDE:: Include driver specific configuration file if one
- # exists. These are in a separate configuration file
- # in mods-config/sql/driver/<driver>.
+ # $-INCLUDE:: Include driver specific configuration file if one
+ # exists. These are in a separate configuration file
+ # in mods-config/sql/driver/<driver>.
#
$-INCLUDE ${modconfdir}/sql/driver/${dialect}
#
- # .Connection info:
+ # .Connection info:
#
# server = "localhost"
# port = 3306
# password = "radpass"
#
- # radius_db:: Database table configuration for everything.
+ # radius_db:: Database table configuration for everything.
#
- # WARNING: Except for Oracle database.
+ # WARNING: Except for Oracle database.
#
radius_db = "radius"
#
- # .If you are using `Oracle` then use this instead.
+ # .If you are using `Oracle` then use this instead.
#
# radius_db = "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=localhost)(PORT=1521))(CONNECT_DATA=(SID=your_sid)))"
#
- # .If you're using `postgresql` this can also be used instead of the connection info parameters.
+ # .If you're using `postgresql` this can also be used instead of the connection info parameters.
#
# radius_db = "dbname=radius host=localhost user=radius password=raddpass"
#
- # .If you're using `postgresql` this can also be used instead of the connection info parameters.
+ # .If you're using `postgresql` this can also be used instead of the connection info parameters.
#
# radius_db = "dbname=radius host=localhost user=radius password=raddpass"
#
- # NOTE: Postgreql doesn't take `tls{}` options in its module config like mysql does,
- # if you want to use SSL connections then use this form of connection info parameter.
+ # NOTE: Postgreql doesn't take `tls{}` options in its module config like mysql does,
+ # if you want to use SSL connections then use this form of connection info parameter.
#
# radius_db = "host=localhost port=5432 dbname=radius user=radius password=raddpass sslmode=verify-full sslcert=/etc/ssl/client.crt sslkey=/etc/ssl/client.key sslrootcert=/etc/ssl/ca.crt"
#
- # acct_table1::
- # acct_table2::
+ # acct_table1::
+ # acct_table2::
#
- # If you want both stop and start records logged to the same SQL table, leave this as is.
- # If you want them in different tables, put the start table in `acct_table1` and stop
- # table in `acct_table2`.
+ # If you want both stop and start records logged to the same SQL table, leave this as is.
+ # If you want them in different tables, put the start table in `acct_table1` and stop
+ # table in `acct_table2`.
#
acct_table1 = "radacct"
acct_table2 = "radacct"
#
- # postauth_table:: Allow for storing data after authentication.
+ # postauth_table:: Allow for storing data after authentication.
#
postauth_table = "radpostauth"
#
- # authcheck_table::
- # groupcheck_table::
+ # authcheck_table::
+ # groupcheck_table::
#
- # Tables containing `check` items.
+ # Tables containing `check` items.
#
authcheck_table = "radcheck"
groupcheck_table = "radgroupcheck"
#
- # authreply_table::
- # groupreply_table::
+ # authreply_table::
+ # groupreply_table::
#
- # Tables containing `reply` items.
+ # Tables containing `reply` items.
#
authreply_table = "radreply"
groupreply_table = "radgroupreply"
#
- # usergroup_table:: Table to keep group info.
+ # usergroup_table:: Table to keep group info.
#
usergroup_table = "radusergroup"
#
- # read_groups:: Read the groups from the database.
+ # read_groups:: Read the groups from the database.
#
- # If set to `yes`, we read the group tables unless `Fall-Through = no` in the reply table.
- # If set to `no`, we do not read the group tables unless `Fall-Through = yes` in the
- # reply table.
+ # If set to `yes`, we read the group tables unless `Fall-Through = no` in the reply table.
+ # If set to `no`, we do not read the group tables unless `Fall-Through = yes` in the
+ # reply table.
#
- # Default is `yes`.
+ # Default is `yes`.
#
# read_groups = yes
#
- # read_profiles:: Read the profiles from the database.
+ # read_profiles:: Read the profiles from the database.
#
- # If set to `yes`, we read profiles unless `Fall-Through = no` in the groupreply table.
- # If set to `no` we do not read profiles unless `Fall-Through = yes` in the groupreply table.
+ # If set to `yes`, we read profiles unless `Fall-Through = no` in the groupreply table.
+ # If set to `no` we do not read profiles unless `Fall-Through = yes` in the groupreply table.
#
- # Default is `yes`.
+ # Default is `yes`.
#
# read_profiles = yes
#
- # logfile:: Write SQL queries to a logfile.
+ # logfile:: Write SQL queries to a logfile.
#
- # This is potentially useful for tracing issues with authorization queries.
- # See also `logfile` directives in `mods-config/sql/main/*/queries.conf`.
- # You can enable per-section logging by enabling `logfile` there, or global logging by
- # enabling `logfile` here.
+ # This is potentially useful for tracing issues with authorization queries.
+ # See also `logfile` directives in `mods-config/sql/main/*/queries.conf`.
+ # You can enable per-section logging by enabling `logfile` there, or global logging by
+ # enabling `logfile` here.
#
- # Per-section logging can be disabled by setting "logfile = ''"
+ # Per-section logging can be disabled by setting "logfile = ''"
#
# logfile = ${logdir}/sqllog.sql
#
- # query_timeout:: Set the maximum query duration for `rlm_sql_mysql` and `rlm_sql_cassandra`.
+ # query_timeout:: Set the maximum query duration for `rlm_sql_mysql` and `rlm_sql_cassandra`.
#
# query_timeout = 5
#
- # pool { ... }::
+ # pool { ... }::
#
- # The connection pool is new for 3.0, and will be used in many modules, for all kinds of
- # connection-related activity.
+ # The connection pool is new for 3.0, and will be used in many modules, for all kinds of
+ # connection-related activity.
#
- # When the server is not threaded, the connection pool limits are ignored, and only one
- # connection is used.
+ # When the server is not threaded, the connection pool limits are ignored, and only one
+ # connection is used.
#
- # [NOTE]
- # ====
- # If you want to have multiple SQL modules re-use the same connection pool, use `pool = name`
- # instead of a `pool` section.
+ # [NOTE]
+ # ====
+ # If you want to have multiple SQL modules re-use the same connection pool, use `pool = name`
+ # instead of a `pool` section.
#
- # e.g:
+ # e.g:
#
- # [source,sql]
- # ----
- # sql1 {
+ # [source,sql]
+ # ----
+ # sql1 {
# ...
# pool {
# ...
# }
- # }
+ # }
#
- # # sql2 will use the connection pool from sql1
- # sql2 {
+ # # sql2 will use the connection pool from sql1
+ # sql2 {
# ...
# pool = sql1
- # }
- # ----
- # ====
+ # }
+ # ----
+ # ====
#
pool {
#
retry_delay = 30
#
- # lifetime:: The lifetime (in seconds) of the connection.
+ # lifetime:: The lifetime (in seconds) of the connection.
#
lifetime = 0
}
#
- # group_attribute:: The group attribute specific to this instance of `rlm_sql`.
+ # group_attribute:: The group attribute specific to this instance of `rlm_sql`.
#
group_attribute = "${.:instance}-Group"
#
- # .Read database-specific queries.
+ # .Read database-specific queries.
#
- # Not all drivers ship with `query.conf` or `schema.sql` files. For those which don't,
- # please create them and contribute them back to the project.
+ # Not all drivers ship with `query.conf` or `schema.sql` files. For those which don't,
+ # please create them and contribute them back to the project.
#
$INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf
}
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
-# -*- text -*-
+# -*- text -*-
#
-# :toc:
+# :toc:
#
# $Id$
#
# * Using `NAS-Port` gives behaviour similar to `rlm_ippool` and ACS. (default).
# * Using `Calling-Station-Id` works for NAS that send fixed `NAS-Port`.
- #
+ #
# WARNING: ONLY change this if you know what you are doing!
#
pool_key = "%{NAS-Port}"
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
#
# = sRadutmp Module
#
-# The `sradutmp` module is a _Safe Radutmp_.
+# The `sradutmp` module is a _Safe Radutmp_.
#
-# It does not contain caller ID, so it can be world-readable, and `radwho`
-# can work for normal users, without exposing any information that isn't
-# already exposed by who(1).
+# It does not contain caller ID, so it can be world-readable, and `radwho`
+# can work for normal users, without exposing any information that isn't
+# already exposed by who(1).
#
-# This is another _instance_ of the `radutmp` module, but it is given
-# then name `sradutmp` to identify it later in the `accounting`
-# section.
+# This is another _instance_ of the `radutmp` module, but it is given
+# then name `sradutmp` to identify it later in the `accounting`
+# section.
#
#
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
# input / output packets.
#
# When listed in a `recv Status-Server` section, it will add global
-# server statistics to the packet.
+# server statistics to the packet.
#
# See `dictionary.freeradius`, and the `FreeRADIUS-Stats4` attributes,
# for a list of which attributes it adds.
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
# ## Default instance
#
unbound dns {
- # filename = "${raddbdir}/mods-config/unbound/default.conf"
- # timeout = 3000
+ # filename = "${raddbdir}/mods-config/unbound/default.conf"
+ # timeout = 3000
}
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
# `FA-HA` = H(HA-RK, "FA-HA" | HA-IPv4 | FA-CoAv4 | SPI)
#
# where `HA-IPv4` is as above.
-#
+#
# and `FA-CoAv4` address of the `FA` as seen by the `HA`
# and `SPI` is the relevant `SPI` for the `HA-RK`.
#
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
#
# = WinModule
#
-# The `winbind` module authenticate PAP users against Microsoft Active
-# Directory or Samba, via `winbind`.
+# The `winbind` module authenticate PAP users against Microsoft Active
+# Directory or Samba, via `winbind`.
#
-# This module is for PAP authentication (where plaintext passwords
-# are sent in the `User-Password` attribute) only. For authenticating
-# `mschap` requests against AD/Samba see the options available in the
-# `rlm_mschap` module.
+# This module is for PAP authentication (where plaintext passwords
+# are sent in the `User-Password` attribute) only. For authenticating
+# `mschap` requests against AD/Samba see the options available in the
+# `rlm_mschap` module.
#
-# NOTE: Samba version 4.2.1 or higher is required to use this module.
+# NOTE: Samba version 4.2.1 or higher is required to use this module.
#
#
#
winbind {
#
- # winbind_username:: The username to pass to `winbind` for authentication.
+ # winbind_username:: The username to pass to `winbind` for authentication.
#
winbind_username = "%{%{Stripped-User-Name}:-%{User-Name}}"
#
- # winbind_domain:: The windows domain.
+ # winbind_domain:: The windows domain.
#
- # While not required to be set, it is likely authentication will fail
- # if it is not set correctly.
+ # While not required to be set, it is likely authentication will fail
+ # if it is not set correctly.
#
- # This configuration option, as the username above, is also expanded before use.
+ # This configuration option, as the username above, is also expanded before use.
#
- # If unset then winbind will be queried for the correct value. If you
- # actually want it blank it should be explicitly set here.
+ # If unset then winbind will be queried for the correct value. If you
+ # actually want it blank it should be explicitly set here.
#
# winbind_domain = ""
#
- # group { ... }:: Group membership checking.
+ # group { ... }:: Group membership checking.
#
group {
#
- # group_search_username:: AD username to search for group searches.
+ # group_search_username:: AD username to search for group searches.
#
- # This should generally not include a realm, so `Stripped-User-Name`
- # is likely the best attribute if it exists.
+ # This should generally not include a realm, so `Stripped-User-Name`
+ # is likely the best attribute if it exists.
#
group_search_username = "%{%{Stripped-User-Name}:-%{User-Name}}"
#
- # group_add_domain:: Include the domain in group searches.
+ # group_add_domain:: Include the domain in group searches.
#
- # When this is enabled, winbind_domain is prepended to the
- # username (as `domain\username`) before searching. This is
- # generally required.
+ # When this is enabled, winbind_domain is prepended to the
+ # username (as `domain\username`) before searching. This is
+ # generally required.
#
# group_add_domain = yes
#
- # group_attribute:: Attribute to use for group comparisons.
+ # group_attribute:: Attribute to use for group comparisons.
#
- # This will normally be `Winbind-Group` if this instance is
- # unnamed, otherwise it will be `name-Winbind-Group`. The
- # name of this attribute can be overridden here.
+ # This will normally be `Winbind-Group` if this instance is
+ # unnamed, otherwise it will be `name-Winbind-Group`. The
+ # name of this attribute can be overridden here.
#
# group_attribute = "Winbind-Group"
}
#
- # pool { ... }::
+ # pool { ... }::
#
- # Information for the `winbind` connection pool.
+ # Information for the `winbind` connection pool.
#
- # The configuration items below are the same for all modules which
- # use the new connection pool.
+ # The configuration items below are the same for all modules which
+ # use the new connection pool.
#
pool {
#
#
# [NOTE]
# ====
- # All configuration settings are enforced. If a connection is closed because of
+ # All configuration settings are enforced. If a connection is closed because of
# `idle_timeout`, `uses`, or `lifetime`, then the total
# number of connections MAY fall below `min`.
#
-# -*- text -*-
+# -*- text -*-
#
# :toc:
#
# Each account will need a password added (either using attribute `Cleartext-Password`,
# `SSHA-Password`, etc.).
#
- # The module itself does not provide persistent storage as this would be duplicative of
+ # The module itself does not provide persistent storage as this would be duplicative of
# functionality already in the server.
#
# Yubikey authentication needs two attributes retrieved from persistent storage:
# |===
# | Attributes | Description
# | `&control:Yubikey-Key` | The AES key used to decrypt the OTP data.
- # The `Yubikey-Public-Id` and/or User-Name
+ # The `Yubikey-Public-Id` and/or User-Name
# attributes may be used to retrieve the key.
# The value is a `16-byte` binary blob.
# | `&control:Yubikey-Counter` | This is compared with the counter in the OTP
# data and used to prevent replay attacks.
# This attribute will also be available in
# the request list after successful decryption.
- # |===
+ # |===
#
# NOTE: `Yubikey-Counter` isn't strictly required, but the server will generate
# warnings if it's not present when `yubikey.authenticate` is called.
idle_timeout = 60
#
- # spread:: Enable LRU (Least Recently Used).
+ # spread:: Enable LRU (Least Recently Used).
#
- # The `yubico` library uses `curl` multihandles. If the multihandle is reused
- # before all requests are completed the connections are re-established.
+ # The `yubico` library uses `curl` multihandles. If the multihandle is reused
+ # before all requests are completed the connections are re-established.
#
- # The cost of re-establishing the connections is greater than the benefit of
- # maintaining a small pool of connections or optimising for link latency.
+ # The cost of re-establishing the connections is greater than the benefit of
+ # maintaining a small pool of connections or optimising for link latency.
#
spread = yes
#
# [NOTE]
# ====
- # All configuration settings are enforced. If a connection is closed because of
+ # All configuration settings are enforced. If a connection is closed because of
# `idle_timeout`, `uses`, or `lifetime`, then the total
# number of connections MAY fall below `min`.
#
projects / thirdparty / freeradius-server.git / commitdiff
