From: Alan T. DeKok Date: Thu, 14 Feb 2019 02:39:26 +0000 (-0500) Subject: word smithing X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=307cb24aa6997ab640fb7539b937a8a8341af64d;p=thirdparty%2Ffreeradius-server.git word smithing --- diff --git a/raddb/mods-available/unpack b/raddb/mods-available/unpack index 9af0370804f..53f3c9fafaf 100644 --- a/raddb/mods-available/unpack +++ b/raddb/mods-available/unpack @@ -48,9 +48,9 @@ # # if we have `Class = 0x00000001020304`, then # -# %{unpack:&Class 4 short} +# %{unpack:&Class 4 uint16} # -# will unpack octets `4` and `5` as a `short`, which has value `0x0304`. +# will unpack octets `4` and `5` as a `uint16`, which has value `0x0304`. # # diff --git a/raddb/mods-available/wimax b/raddb/mods-available/wimax index aa1355afe3e..109f249bd62 100644 --- a/raddb/mods-available/wimax +++ b/raddb/mods-available/wimax @@ -8,13 +8,14 @@ # # = WiMAX Module # -# The `winmax` module implements WiMAX authentication over RADIUS. +# The `winmax` module implements the WiMAX attributes as defined in +# NWG_R1_V1.2.1-Stage-3.pdf # # It should be listed in the `authorize` and `preacct` sections. # -# NOTE: This enables the module to fix the horrible binary version -# of `Calling-Station-Id` to the normal format, as specified in -# RFC 3580, Section 3.21. +# NOTE: The module will change the horrible binary version of +# `Calling-Station-Id` to the normal format, as specified in RFC +# 3580, Section 3.21. # # In order to calculate the various WiMAX keys, the module should # be listed in the `post-auth` section. If EAP authentication diff --git a/raddb/mods-available/yubikey b/raddb/mods-available/yubikey index 93a576eeb2e..79799e6801a 100644 --- a/raddb/mods-available/yubikey +++ b/raddb/mods-available/yubikey @@ -8,8 +8,12 @@ # # = Yubikey Module # -# This module decrypts and validates Yubikey static and dynamic -# OTP tokens. +# The `yubikey` module decrypts and validates Yubikey static and +# dynamic One-Time Password (OTP) tokens. +# +# For more information about Yubikey, please see: +# +# https://www.yubico.com/ # # @@ -34,7 +38,7 @@ yubikey { # split = yes # - # decrypt:: Tokens will be decrypted and processed locally. + # decrypt:: Whether tokens will be decrypted and processed locally. # # In the `authorize` section, this module should be placed before the # persistent storage module. @@ -55,8 +59,8 @@ yubikey { # Each account will need a password added (either using attribute `Cleartext-Password`, # `SSHA-Password`, etc.). # - # The module itself does not provide persistent storage as this would be duplicative of - # functionality already in the server. + # The module itself does not provide persistent storage as + # this would duplicate functionality already in the server. # # Yubikey authentication needs two attributes retrieved from persistent storage: # diff --git a/raddb/sites-available/control-socket b/raddb/sites-available/control-socket index d4d1707b927..a3371fd8541 100644 --- a/raddb/sites-available/control-socket +++ b/raddb/sites-available/control-socket @@ -46,7 +46,8 @@ server control { # if it doesn't exist and set the appropriate ownership and # permissions. # - filename = ${run_dir}/control/${name}.sock +# filename = ${run_dir}/control/${name}.sock + filename = ${confdir}/radiusd.sock # # Peercred is enabled by default, and offers an additional layer @@ -87,7 +88,7 @@ server control { # ro = read only access (default) # rw = read/write access. # -# mode = rw + mode = rw } } diff --git a/raddb/sites-available/default b/raddb/sites-available/default index 6f73bee1a38..f8a0477c358 100644 --- a/raddb/sites-available/default +++ b/raddb/sites-available/default @@ -489,6 +489,163 @@ server default { } } + listen { + type = Access-Request + type = Status-Server + + transport = tcp + + tcp { + # + # As with v3, "ipaddr", "ipv4addr", and "ipv6addr" + # are all allowed. + # + ipaddr = * + port = 1812 + + # + # Whether or not we allow dynamic clients. + # + # If set to true, then packets from unknown + # clients are passed through the "new client" + # subsection below. See that section for + # more information. + # +# dynamic_clients = true + + # + # If dynamic clients are allowed, then limit + # them to only a small set of source + # networks. + # + # If dynamic clients are not allowed, then + # this section is ignored. + # + networks { + # + # Allow packets from these networks + # to define dynamic clients. + # + # Packets from all other sources will + # be rejected. + # + # Even if a packet is from an allowed + # network, it still must be allowed + # by the "new client" subsection. + # + # There is no limit to the number of + # networks which can be listed here. + # + allow = 127/8 + allow = 192.0.2/24 +# deny = 127.0.0/24 + } + } + + # + # #### Access-Request subsection + # + # This section contains configuration which is + # specific to processing `Access-Request` packets. + # + # Similar sections can be added, but are not + # necessary for Accounting-Request (and other) + # packets. At this time, there is no configuration + # needed for other packet types. + # + Access-Request { + # + # log:: Logging configuration for `Access-Request` packets + # + # In v3, the `Access-Request` logging was + # configured in the main `radiusd.conf` file, + # in the main `log` subsection. That + # limitation meant that the configuration was + # global to FreeRADIUS. i.e. you could not + # have different `Access-Request` logging for + # different virtual server. + # + # The extra configuration in v4 allows for + # increased flexibility. + # + log { + # stripped_names:: Log the full + # `User-Name` attribute, as it was + # found in the request. + # + # allowed values: {no, yes} + # + stripped_names = no + + # auth:: Log authentication requests + # to the log file. + # + # allowed values: {no, yes} + # + auth = no + + # auth_goodpass:: Log "good" + # passwords with the authentication + # requests. + # + # allowed values: {no, yes} + # + auth_badpass = no + + # auth_badpass:: Log "bad" + # passwords with the authentication + # requests. + # + # allowed values: {no, yes} + # + auth_goodpass = no + + # Log additional text at the end of the "Login OK" messages. + # for these to work, the "auth" and "auth_goodpass" or "auth_badpass" + # configurations above have to be set to "yes". + # + # The strings below are dynamically expanded, which means that + # you can put anything you want in them. However, note that + # this expansion can be slow, and can negatively impact server + # performance. + # +# msg_goodpass = "" +# msg_badpass = "" + + # The message when the user exceeds the Simultaneous-Use limit. + # + msg_denied = "You are already logged in - access denied" + } + + # + # session:: Controls how ongoing + # (multi-round) sessions are handled + # + # This section is primarily useful for EAP. + # It controls the number of EAP + # authentication attempts that can occur + # concurrently. + # + session { + # + # max:: The maximum number of ongoing sessions + # +# max = 4096 + + # timeout:: How long to wait before expiring a + # session. + # + # The timer starts when a response + # with a state value is sent. The + # timer stops when a request + # containing the previously sent + # state value is received. + # +# timeout = 15 + } + } + } + # # ### Listen for Accounting-Request packets # @@ -553,6 +710,15 @@ recv Access-Request { # filter_username +# if (!&Proxy-State) { +# radius +# } + + + update reply { + &DHCP-Client-FQDN := "example.org" + } + # # Some broken equipment sends passwords with embedded # zeros, i.e. the debug output will show: