From: Alan T. DeKok Date: Thu, 9 Jul 2026 19:37:38 +0000 (-0400) Subject: run "make format.raddb" X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=332f9ae7cf723ba187f9366bbdf80d7b33e4c7b6;p=thirdparty%2Ffreeradius-server.git run "make format.raddb" The configuration files have been reformatted, and the debian "diff" regenerated. The only changes should be indentation, and wrapping of text which is inside of comment blocks. --- diff --git a/raddb/clients.conf b/raddb/clients.conf index 0b54a83a1c9..8849723c52e 100644 --- a/raddb/clients.conf +++ b/raddb/clients.conf @@ -7,44 +7,45 @@ # # = Client Definitions # -# The `clients.conf` file defines global clients. These clients are -# systems which are permitted to send packets to the server. For +# The `clients.conf` file defines global clients. These clients are +# systems which are permitted to send packets to the server. For # security, packets from other IP addresses are ignored. # # # == Client subsection # -# A client is defined via a section called `client NAME { ... }`. -# The NAME field is mandatory, and is used as the "short name" of the +# A client is defined via a section called `client NAME { ... }`. The +# NAME field is mandatory, and is used as the "short name" of the # client. # # The default configuration allows packets from 127.0.0.1, and no -# other IP address. This configuration is to allow testing of the -# server after an initial installation. If you are not going to be +# other IP address. This configuration is to allow testing of the +# server after an initial installation. If you are not going to be # permitting RADIUS queries from localhost, we suggest that you # delete, or comment out, the 'localhost' entry. # client localhost { # - # ipaddr:: define the unique IP address (or network) for this client. + # ipaddr:: define the unique IP address (or network) for this + # client. # - # NOTE: Only *one* of ipaddr, ipv4addr, ipv6addr may be - # specified for a client. + # NOTE: Only *one* of ipaddr, ipv4addr, ipv6addr may be specified + # for a client. # # IPv4 or IPv6 addresses with optional CIDR notation `/` to # specify ranges can be used. `ipaddr` will also accept domain # names, e.g. `example.org`, and will resolve the name via DNS # (however, see note of recommendation below). # - # If both A and AAAA records are found, A records will be - # used in preference to AAAA. + # If both A and AAAA records are found, A records will be used in + # preference to AAAA. # ipaddr = 127.0.0.1 # - # ipv4addr:: Similar to `ipaddr`, but only allows v4 - # addresses. Looks up A record for domain names. + # ipv4addr:: Similar to `ipaddr`, but only allows v4 addresses. + # Looks up A record for domain names. # # * `*` is "any" address. # * `127.0.0.1` is localhost. @@ -52,8 +53,8 @@ client localhost { # ipv4addr = * # - # ipv6addr:: Similar to `ipaddr` but only allows v6 - # addresses. Looks up AAAA record for domain names. + # ipv6addr:: Similar to `ipaddr` but only allows v6 addresses. Looks + # up AAAA record for domain names. # # * `::` is "any" address. # * `::1` is localhost. @@ -61,31 +62,29 @@ client localhost { # ipv6addr = :: # - # NOTE: We *strongly* recommend using IP addresses instead of - # host names. Using host names means that the server will do - # DNS lookups when it starts, making it dependent on DNS. - # i.e. If anything goes wrong with DNS, the server won't - # start! + # NOTE: We *strongly* recommend using IP addresses instead of host + # names. Using host names means that the server will do DNS lookups + # when it starts, making it dependent on DNS. i.e. If anything goes + # wrong with DNS, the server won't start! # - # The server also looks up the IP address from DNS once, and - # only once, when it starts. If the DNS record is later - # updated, the server *will not* see that update. + # The server also looks up the IP address from DNS once, and only + # once, when it starts. If the DNS record is later updated, the + # server *will not* see that update. # # # proto:: The transport protocol used by this client. # - # If unspecified, defaults to "udp", which is the traditional - # RADIUS transport. It may also be "tcp", in which case the - # server will accept connections from this client *only* over TCP. + # If unspecified, defaults to "udp", which is the traditional RADIUS + # transport. It may also be "tcp", in which case the server will + # accept connections from this client *only* over TCP. # proto = * # - # secret:: The shared secret use to "encrypt" and "sign" - # packets between the NAS and FreeRADIUS. You *must* - # change this secret from the default, otherwise it's not - # a secret any more! + # secret:: The shared secret use to "encrypt" and "sign" packets + # between the NAS and FreeRADIUS. You *must* change this secret from + # the default, otherwise it's not a secret any more! # # The secret can be any string, up to 8k characters in length. # @@ -101,68 +100,66 @@ client localhost { # # `secret = """foo"bar""" # - # A note on security: The security of the RADIUS protocol - # depends COMPLETELY on this secret! We recommend using a - # shared secret that at LEAST 16 characters long. It should - # preferably be 32 characters in length. The secret MUST be - # random, and should not be words, phrase, or anything else - # that is recognisable. - # - # Computing power has increased enormously since RADIUS was - # first defined. A hobbyist with a high-end GPU can try ALL - # of the 8-character shared secrets in about a day. The - # security of shared secrets increases MUCH more with the - # length of the shared secret, than with number of different - # characters used in it. So don't bother trying to use - # "special characters" or anything else in an attempt to get - # un-guessable secrets. Instead, just get data from a secure - # random number generator, and use that. + # A note on security: The security of the RADIUS protocol depends + # COMPLETELY on this secret! We recommend using a shared secret that + # at LEAST 16 characters long. It should preferably be 32 characters + # in length. The secret MUST be random, and should not be words, + # phrase, or anything else that is recognisable. + # + # Computing power has increased enormously since RADIUS was first + # defined. A hobbyist with a high-end GPU can try ALL of the + # 8-character shared secrets in about a day. The security of shared + # secrets increases MUCH more with the length of the shared secret, + # than with number of different characters used in it. So don't + # bother trying to use "special characters" or anything else in an + # attempt to get un-guessable secrets. Instead, just get data from a + # secure random number generator, and use that. # # You should create shared secrets using a method like this: # # dd if=/dev/random bs=1 count=24 | base64 # - # This process will give output which takes 24 random bytes, - # and converts them to 32 characters of ASCII. The output - # should be accepted by all RADIUS clients. + # This process will give output which takes 24 random bytes, and + # converts them to 32 characters of ASCII. The output should be + # accepted by all RADIUS clients. # - # You should NOT create shared secrets by hand. They will - # not be random. They will will be trivial to crack. + # You should NOT create shared secrets by hand. They will not be + # random. They will will be trivial to crack. # - # The default secret below is only for testing, and should - # not be used in any real environment. + # The default secret below is only for testing, and should not be + # used in any real environment. # secret = testing123 # - # require_message_authenticator::Require Message-Authenticator in Access-Requests. + # require_message_authenticator::Require Message-Authenticator in + # Access-Requests. # - # RFC 5080 suggests that all clients *should* include it in - # an Access-Request. The configuration item below allows the - # server to require it. If a client is required to include a - # `Message-Authenticator` and it does not, then the packet - # will be silently discarded. + # RFC 5080 suggests that all clients *should* include it in an + # Access-Request. The configuration item below allows the server to + # require it. If a client is required to include a + # `Message-Authenticator` and it does not, then the packet will be + # silently discarded. # - # If value is` auto`, then when an `Access-Request` packet from - # the client contains a valid `Message-Authenticator` - # attribute, the server will then require that it exist in - # all future `Access-Request` packets from that client. + # If value is` auto`, then when an `Access-Request` packet from the + # client contains a valid `Message-Authenticator` attribute, the + # server will then require that it exist in all future + # `Access-Request` packets from that client. # - # This flag exists solely for legacy clients which do not - # send `Message-Authenticator` in all `Access-Request` - # packets. We do not recommend setting it to `no`, as that - # may allow the BlastRADIUS attack to take place. + # This flag exists solely for legacy clients which do not send + # `Message-Authenticator` in all `Access-Request` packets. We do not + # recommend setting it to `no`, as that may allow the BlastRADIUS + # attack to take place. # - # The number one way to protect yourself from the BlastRADIUS - # attack is to update all RADIUS servers, and then set this - # flag to `yes`. If all RADIUS servers are updated, and if - # all of them have this flag set to `yes` for all clients, - # then your network is safe. You can then upgrade the - # clients when it is convenient, instead of rushing the - # upgrades. + # The number one way to protect yourself from the BlastRADIUS attack + # is to update all RADIUS servers, and then set this flag to `yes`. + # If all RADIUS servers are updated, and if all of them have this + # flag set to `yes` for all clients, then your network is safe. You + # can then upgrade the clients when it is convenient, instead of + # rushing the upgrades. # - # NOTE: This per-client setting overrides the identically - # named configuration item in the `listen` section. + # NOTE: This per-client setting overrides the identically named + # configuration item in the `listen` section. # # Allowed values: yes, no, auto # @@ -172,11 +169,12 @@ client localhost { # # limit_proxy_state:: Control whether Proxy-State is allowed in - # packets from this client which do not have a `Message-Authenticator`. + # packets from this client which do not have a + # `Message-Authenticator`. # # The BlastRADIUS attack allows an attacker to manipulate the - # contents of responses to `Access-Request` packets, without - # knowing the shared secret. + # contents of responses to `Access-Request` packets, without knowing + # the shared secret. # # The attack relies on controlling a portion of the data sent back # in the response by the RADIUS server. As Proxy-State is always @@ -184,27 +182,25 @@ client localhost { # manipulate the data sent back from the server and facilitate the # attack. # - # The attack also relies on deficiencies in the original - # RADIUS standards which do not provide xintegrity protection - # for `Access-Request`s. + # The attack also relies on deficiencies in the original RADIUS + # standards which do not provide xintegrity protection for + # `Access-Request`s. # # The attack is mitigated by requiring the Message-Authenticator, # which contains a HMAC over the entire request, preventing # modification of the request by the attacker. # - # If value is` auto`, then when an `Access-Request` packet - # from the client contains does not contain a `Proxy-State` - # attribute, the server will the discard `Access-Request` - # packets from the client which contain `Proxy-State`, but no - # `Message-Authenticator. + # If value is` auto`, then when an `Access-Request` packet from the + # client contains does not contain a `Proxy-State` attribute, the + # server will the discard `Access-Request` packets from the client + # which contain `Proxy-State`, but no `Message-Authenticator. # - # This provides some level of protection against the - # blastradius attack, without requiring - # `Message-Authenticator` in all packets, or breaking - # existing deployments. + # This provides some level of protection against the blastradius + # attack, without requiring `Message-Authenticator` in all packets, + # or breaking existing deployments. # - # NOTE: This setting overrides the identically named config item in the - # radius `listen` section. + # NOTE: This setting overrides the identically named config item in + # the radius `listen` section. # # Allowed values: yes, no, auto # @@ -216,12 +212,12 @@ client localhost { # shortname:: The short name is used as an alias for the fully # qualified domain name, or the IP address. # - # It is accepted for compatibility with 1.x, but it is no - # longer necessary in >= 2.0. + # It is accepted for compatibility with 1.x, but it is no longer + # necessary in >= 2.0. # - # By default, `shortname` is set to the name of the subsection. - # e.g. if we have `client localhost {...}`, then `shortname` - # is set to `localhost`. + # By default, `shortname` is set to the name of the subsection. e.g. + # if we have `client localhost {...}`, then `shortname` is set to + # `localhost`. # # shortname = localhost @@ -238,25 +234,24 @@ client localhost { # max_connections:: Limit the number of simultaneous TCP # connections from a client. # - # The default is 16. - # Setting this to 0 means "no limit". + # The default is 16. Setting this to 0 means "no limit". # max_connections = 16 # The per-socket "max_requests" option does not exist. # - # lifetime:: The lifetime, in seconds, of a TCP connection. - # After this lifetime, the connection will be closed. + # lifetime:: The lifetime, in seconds, of a TCP connection. After + # this lifetime, the connection will be closed. # # Setting this to 0 means "forever". # lifetime = 0 # - # idle_timeout:: The idle timeout, in seconds, of a TCP - # connection. If no packets have been received over the - # connection for this time, the connection will be closed. + # idle_timeout:: The idle timeout, in seconds, of a TCP connection. + # If no packets have been received over the connection for this + # time, the connection will be closed. # # Setting this to 0 means "no timeout". # @@ -271,7 +266,8 @@ client localhost { # # -# Defining an IPv6 client for `localhost` using the `ipv6addr` option. +# Defining an IPv6 client for `localhost` using the `ipv6addr` +# option. # client localhost_ipv6 { ipv6addr = ::1 @@ -281,31 +277,31 @@ client localhost_ipv6 { # # All IPv6 Site-local clients # -#client sitelocal_ipv6 { +# client sitelocal_ipv6 { # ipv6addr = fe80::/16 # secret = testing123 -#} +# } # -# Client that uses a DNS hostname. -# (See important note on the use of hostname above.) +# Client that uses a DNS hostname. (See important note on the use of +# hostname above.) # -#client example.org { +# client example.org { # ipaddr = radius.example.org # secret = testing123 -#} +# } # -# You can specify one secret for a network of clients. -# When a client request comes in, the *best* match is chosen, -# i.e. the entry from the smallest possible network. +# You can specify one secret for a network of clients. When a client +# request comes in, the *best* match is chosen, i.e. the entry from +# the smallest possible network. # -#client private-network-1 { +# client private-network-1 { # ipaddr = 192.0.2.0/24 # secret = testing123-1 -#} +# } -#client private-network-2 { +# client private-network-2 { # ipaddr = 198.51.100.0/24 # secret = testing123-2 -#} +# } diff --git a/raddb/debug.conf b/raddb/debug.conf index 163b66454d0..2124704dcf1 100644 --- a/raddb/debug.conf +++ b/raddb/debug.conf @@ -7,8 +7,8 @@ # # = Debugging configuration # -# This is a minimal configuration file used when debugging the -# source code. +# This is a minimal configuration file used when debugging the source +# code. # # This file should not be installed by `make install`, or by any # packaging system. It is only for developers. diff --git a/raddb/dictionary b/raddb/dictionary index ceb4c79b14c..b41e25afc85 100644 --- a/raddb/dictionary +++ b/raddb/dictionary @@ -7,9 +7,9 @@ # # = Local dictionary definitions # -# This is the local dictionary file which can be -# edited by local administrators. It will be loaded -# *after* the main dictionary files are loaded. +# This is the local dictionary file which can be edited by local +# administrators. It will be loaded *after* the main dictionary files +# are loaded. # # # NOTE: We recommend using local variables inside of "unlang" @@ -33,44 +33,43 @@ # # FreeRADIUS will automatically load the main dictionary files from: # -# ${prefix}/share/freeradius/dictionary +# ${prefix}/share/freeradius/dictionary # # It is no longer necessary for this file to `$INCLUDE` the main -# dictionaries from this file. However, if the `$INCLUDE` line is +# dictionaries from this file. However, if the `$INCLUDE` line is # here, nothing bad will happen. # # == Dictionaries per Virtual Server # # v4 also supports a `dictionary { ... }` subsection in a virtual -# server. If the attributes are used only in one virtual server, -# they should be defined there. +# server. If the attributes are used only in one virtual server, they +# should be defined there. # # # == Editing the dictionary # -# Any new/changed attributes *must* be placed in this file. -# The pre-defined dictionaries *should not* be edited. -# See `man dictionary` for documentation on how dictionary -# entries should be formatted. +# Any new/changed attributes *must* be placed in this file. The +# pre-defined dictionaries *should not* be edited. See `man +# dictionary` for documentation on how dictionary entries should be +# formatted. # -# All local attributes and `$INCLUDE` directives should -# go into this files. +# All local attributes and `$INCLUDE` directives should go into this +# files. # -# The attribute definitions here should use `DEFINE`, not `ATTRIBUTE`. -# The `DEFINE` keyword is exactly like `ATTRIBUTE`, except it does not -# require an attribute number. +# The attribute definitions here should use `DEFINE`, not +# `ATTRIBUTE`. The `DEFINE` keyword is exactly like `ATTRIBUTE`, +# except it does not require an attribute number. # # As a result, there is no need to manually manage numbers. # # Any attribute `DEFINE`d here will not go into a packet. # -# If you do want attributes to go into a RADIUS packet, you -# will need to use VSAs. This means requesting allocation -# of a Private Enterprise Code from https://www.iana.org/. We -# strongly suggest doing that *only* if you are a vendor of -# RADIUS equipment. +# If you do want attributes to go into a RADIUS packet, you will need +# to use VSAs. This means requesting allocation of a Private +# Enterprise Code from https://www.iana.org/. We strongly suggest +# doing that *only* if you are a vendor of RADIUS equipment. # # See RFC 6158 for more details: # http://ietf.org/rfc/rfc6158.txt @@ -82,52 +81,50 @@ # required, or add your own. # -#DEFINE My-Local-String string -#DEFINE My-Local-IPAddr ipaddr -#DEFINE My-Local-Integer integer +# DEFINE My-Local-String string DEFINE My-Local-IPAddr ipaddr DEFINE +# My-Local-Integer integer # # == v3 Compatibility and Migration # -# By default, the server does NOT load the v3 names. While this +# By default, the server does NOT load the v3 names. While this # behavior is done to simplify the server configuration, it can also # make migration more difficult. # # If your system is using Vendor-Specific attributes from a -# particular vendor, you can list those dictionaries below. The +# particular vendor, you can list those dictionaries below. The # server will then load the version 3 names, which makes migration # much simpler. # -# For v4, all of the attributes have been renamed from v3. This -# change was necessary in order to support new functionality. The +# For v4, all of the attributes have been renamed from v3. This +# change was necessary in order to support new functionality. The # unfortunate side effect of this change is that all of the attribute # names used by v3 in the SQL, LDAP, and "files" module are # incompatible with v4. # # The problem with v3 was that names were all in flat lists, so that -# User-Name appeared in the same list as Cisco-AVPAir. This +# User-Name appeared in the same list as Cisco-AVPAir. This # organization was simple enough to work for 25 years, but its time -# has come. The new names are hierarchical, which means they are +# has come. The new names are hierarchical, which means they are # organized into a tree-like structure. # -# For v4, the Cisco-AVPair attribute is now called "AVPair". It -# lives inside of the "Cisco" namespace, which in turn lives inside -# of the "Vendor-Specific" namespace. So the new name for -# `Cisco-AVPair` is `Vendor-Specific.Cisco.AVPair`. +# For v4, the Cisco-AVPair attribute is now called "AVPair". It lives +# inside of the "Cisco" namespace, which in turn lives inside of the +# "Vendor-Specific" namespace. So the new name for `Cisco-AVPair` is +# `Vendor-Specific.Cisco.AVPair`. # # These changes have been made for many hundreds of dictionary files, # and many thousands of Vendor-Specific attributes. # # In the interest of compatibility, is possible to use the old names -# with v4. There are some limitations, but it will generally work. +# with v4. There are some limitations, but it will generally work. # The main reason for enabling the old names is to try out v4 with a -# database that is also used by v3. This lets you test that v4 -# works, without going through a complex process to upgrade -# everything. +# database that is also used by v3. This lets you test that v4 works, +# without going through a complex process to upgrade everything. # # The old v3 names are in "v3" dictionaries, in the `${dictdir}` -# directory. To find out where this directory is on your local -# system, run "radiusd -h" or "radclient -h". Then look for the "-D" +# directory. To find out where this directory is on your local +# system, run "radiusd -h" or "radclient -h". Then look for the "-D" # command-line option, and it will tell you where the dictionary # files are located. # @@ -139,38 +136,39 @@ # The default v4 dictionaries do not enable all of v3 compatibility # names. # -# We recognize that this process is a bit of work. However, we -# wish to encourage everyone using v4 to upgrade to using the new v4 -# features. Our experience shows that if we automatically enable +# We recognize that this process is a bit of work. However, we wish +# to encourage everyone using v4 to upgrade to using the new v4 +# features. Our experience shows that if we automatically enable # "compatibility functions", then those compatibility functions will -# be used for a decade. So we need to find a balance between -# upgrades and ongoing support. Easy upgrades will mean complex -# ongoing support. Complex upgrades make ongoing support easier, but -# also make it less likely that people will upgrade. +# be used for a decade. So we need to find a balance between upgrades +# and ongoing support. Easy upgrades will mean complex ongoing +# support. Complex upgrades make ongoing support easier, but also +# make it less likely that people will upgrade. # # Note that if you over-write the "v3/dictionary.VENDOR" files with a -# copy of the v3 dictionary, then it won't work. Migrations across +# copy of the v3 dictionary, then it won't work. Migrations across # major version numbers means that the configuration files are *not* # 100% compatible. This includes the dictionaries! # -# The v3 compatibility names are in the RADIUS namespace. -# There are no aliases for DHCPv4. +# The v3 compatibility names are in the RADIUS namespace. There are +# no aliases for DHCPv4. # -#BEGIN-PROTOCOL RADIUS -#$INCLUDE ${dictdir}/radius/v3/dictionary.cisco -#$INCLUDE ${dictdir}/radius/v3/dictionary.aruba -#END-PROTOCOL RADIUS +# BEGIN-PROTOCOL RADIUS $INCLUDE +# ${dictdir}/radius/v3/dictionary.cisco $INCLUDE +# ${dictdir}/radius/v3/dictionary.aruba END-PROTOCOL RADIUS # -# This dictionary includes v3-compatible names like "Cleartext-Password", -# or "NT-Password". +# This dictionary includes v3-compatible names like +# "Cleartext-Password", or "NT-Password". # -#$INCLUDE ${dictdir}/freeradius/v3/dictionary.freeradius.internal +# $INCLUDE ${dictdir}/freeradius/v3/dictionary.freeradius.internal # -# Any local dictionaries can be added in the `dictionary.d` subdirectory. +# Any local dictionaries can be added in the `dictionary.d` +# subdirectory. # # The server will load all files in that directory, but will skip -# editor backup files, and others which are known to not be real files. +# editor backup files, and others which are known to not be real +# files. # $INCLUDE- dictionary.d/ diff --git a/raddb/global.d/ldap b/raddb/global.d/ldap index e4cb87defc5..519a3a350a8 100644 --- a/raddb/global.d/ldap +++ b/raddb/global.d/ldap @@ -6,9 +6,11 @@ ldap { # # ldap_debug:: Debug flags for libldap (see OpenLDAP documentation). - # Set this to enable debugging output from different code areas within libldap. + # Set this to enable debugging output from different code areas + # within libldap. # - # NOTE: These debugging options can produce significant amounts of logging output. + # NOTE: These debugging options can produce significant amounts of + # logging output. # # [options="header,autowidth"] # |=== diff --git a/raddb/global.d/python b/raddb/global.d/python index 29432cc0e85..e059e49cbe5 100644 --- a/raddb/global.d/python +++ b/raddb/global.d/python @@ -2,15 +2,15 @@ python { # # path:: # - # The search path for Python modules. It must include the path to your - # Python module. + # The search path for Python modules. It must include the path to + # your Python module. # # path = ${modconfdir}/${.:name} # # path_include_default:: # - # If "yes", retain the default search path. Any additional search + # If "yes", retain the default search path. Any additional search # path components will be prepended to the default search path. # # path_include_default = "yes" diff --git a/raddb/mods-available/always b/raddb/mods-available/always index ab5e011e469..ccf7e8b003a 100644 --- a/raddb/mods-available/always +++ b/raddb/mods-available/always @@ -8,53 +8,53 @@ # = Always Module # # The `always` module simply returns the same result, always, without -# doing anything else. It is here for use in complex policies. +# doing anything else. It is here for use in complex policies. # -# The main configuration item is `rcode`, which sets the return code that -# this instantiation of the module will return. The default, if none -# specified, is 'fail'. +# The main configuration item is `rcode`, which sets the return code +# that this instantiation of the module will return. The default, if +# none specified, is 'fail'. # # # == Syntax # ##always { - # - # rcode:: Return code. - # - # The `rcode` may be one of the following values: - # - # [options="header,autowidth"] - # |=== - # | Parameter | Description - # | `reject` | Reject the user. - # | `fail` | Simulate or indicate a failure. - # | `ok` | Simulate or indicate a success. - # | `handled` | Indicate that the request has been handled, - # stop processing, and send response if set. - # | `invalid` | Indicate that the request is invalid. - # | `disallow` | Indicate that the user account has been - # locked out. - # | `notfound` | Indicate that a user account can't be found. - # | `noop` | Simulate a no-op. - # | `updated` | Indicate that the request has been updated. - # |=== - # +# +# rcode:: Return code. +# +# The `rcode` may be one of the following values: +# +# [options="header,autowidth"] +# |=== +# | Parameter | Description +# | `reject` | Reject the user. +# | `fail` | Simulate or indicate a failure. +# | `ok` | Simulate or indicate a success. +# | `handled` | Indicate that the request has been handled, +# stop processing, and send response if set. +# | `invalid` | Indicate that the request is invalid. +# | `disallow` | Indicate that the user account has been +# locked out. +# | `notfound` | Indicate that a user account can't be found. +# | `noop` | Simulate a no-op. +# | `updated` | Indicate that the request has been updated. +# |=== +# ## rcode = # # simulcount:: # - # If an instance of this module is listed in a `session {}` - # section, this simulates a user having `` number of sessions. + # If an instance of this module is listed in a `session {}` section, + # this simulates a user having `` number of sessions. # ## simulcount = # # mpp:: # - # If an instance is listed in a `session {}` section, this - # simulates the user having multilink sessions. + # If an instance is listed in a `session {}` section, this simulates + # the user having multilink sessions. # ## mpp = ##} @@ -62,8 +62,8 @@ # # == xlat for peeking and poking the status # -# An xlat based on the instance name can be called to change the status -# returned by the instance. +# An xlat based on the instance name can be called to change the +# status returned by the instance. # # .Example # @@ -74,8 +74,9 @@ # ... # ``` # -# The above xlats expand to the current status of the module. To fetch the -# current status without affecting it call the xlat with an empty argument: +# The above xlats expand to the current status of the module. To +# fetch the current status without affecting it call the xlat with an +# empty argument: # # .Example # diff --git a/raddb/mods-available/attr_filter b/raddb/mods-available/attr_filter index 8e12e3177f9..7306a6ca809 100644 --- a/raddb/mods-available/attr_filter +++ b/raddb/mods-available/attr_filter @@ -6,21 +6,22 @@ # # = Attr_filter Module # -# The `attr_filter` module exists for filtering certain attributes and -# values in received (or transmitted) radius packets. It gives the -# server a flexible framework to filter the attributes we send to or -# receive from home servers or NASes. This makes sense, for example, -# in an out-sourced dialup situation to various policy decisions, such as -# restricting a client to certain ranges of `Idle-Timeout` or `Session-Time-out`. -# -# Filter rules are normally defined and applied on a per-realm basis, Filter -# rules can optionally be applied using another attribute, by editing the key -# configuration for this module. -# -# The rules for each entry are parsed to top to bottom, and an attribute -# must pass *all* the rules which affect it in order to make it past the filter. -# Order of the rules is important. -# The operators and their purpose in defining the rules are as follows: +# The `attr_filter` module exists for filtering certain attributes +# and values in received (or transmitted) radius packets. It gives +# the server a flexible framework to filter the attributes we send to +# or receive from home servers or NASes. This makes sense, for +# example, in an out-sourced dialup situation to various policy +# decisions, such as restricting a client to certain ranges of +# `Idle-Timeout` or `Session-Time-out`. +# +# Filter rules are normally defined and applied on a per-realm basis, +# Filter rules can optionally be applied using another attribute, by +# editing the key configuration for this module. +# +# The rules for each entry are parsed to top to bottom, and an +# attribute must pass *all* the rules which affect it in order to +# make it past the filter. Order of the rules is important. The +# operators and their purpose in defining the rules are as follows: # # [options="header", cols="10%,90%"] # |=== @@ -43,9 +44,10 @@ # | < | Less Than. # |=== # -# If regular expressions are enabled the following operators are also possible. -# (Regular Expressions are included by default unless your system doesn't support -# them, which should be rare). The value field uses standard regular expression syntax. +# If regular expressions are enabled the following operators are also +# possible. (Regular Expressions are included by default unless your +# system doesn't support them, which should be rare). The value field +# uses standard regular expression syntax. # # [options="header", cols="10%,90%"] # |=== @@ -59,14 +61,14 @@ # The configuration items are: # ##attr_filter attr_filter.
{ - # - # key:: The `key` to use for filter the packets. - # +# +# key:: The `key` to use for filter the packets. +# ## key = "" # - # relaxed:: Only move attribute if it passed all rules, or if the config says we - # should copy unmatched attributes. + # relaxed:: Only move attribute if it passed all rules, or if the + # config says we should copy unmatched attributes. # ## relaxed = no @@ -85,8 +87,8 @@ # # === pre-proxy # -# Filters the attributes in the packets we send to -# the RADIUS home servers. +# Filters the attributes in the packets we send to the RADIUS home +# servers. # # Add this before calling rlm_radius for proxying. # @@ -98,9 +100,9 @@ attr_filter attr_filter.pre-proxy { # # === post-proxy # -# Filters the attributes received in replies from proxied -# servers, to make sure we send back to our RADIUS client -# only allowed attributes. +# Filters the attributes received in replies from proxied servers, to +# make sure we send back to our RADIUS client only allowed +# attributes. # # Add this after calling `rlm_radius` for proxying. # @@ -135,8 +137,8 @@ attr_filter attr_filter.access_challenge { # === accounting_response # # Enforce RFC requirements on the contents of the -# `Accounting-Response` packets. Called from the -# `send Accounting-Response` section. +# `Accounting-Response` packets. Called from the `send +# Accounting-Response` section. # attr_filter attr_filter.accounting_response { key = User-Name diff --git a/raddb/mods-available/brotli b/raddb/mods-available/brotli index a774e1c1a40..5d32ba9fbe8 100644 --- a/raddb/mods-available/brotli +++ b/raddb/mods-available/brotli @@ -71,7 +71,8 @@ brotli { } # - # large_window:: Allow window sizes outside of the range permitted by RFC 7932 + # large_window:: Allow window sizes outside of the range permitted + # by RFC 7932 # # Changes the behaviour of both the compressor and decompressor. # diff --git a/raddb/mods-available/cache b/raddb/mods-available/cache index ad4a4df1bd0..59e4db24a43 100644 --- a/raddb/mods-available/cache +++ b/raddb/mods-available/cache @@ -7,12 +7,13 @@ # # = Cache Module # -# The `cache` module is used to cache attributes. The idea is that you can look -# up information in a database, and then cache it. Repeated requests for the same -# information will then have the cached values added to the request. +# The `cache` module is used to cache attributes. The idea is that +# you can look up information in a database, and then cache it. +# Repeated requests for the same information will then have the +# cached values added to the request. # -# The module can cache a fixed set of attributes per key. -# It can be listed in any `recv` or `send` section. +# The module can cache a fixed set of attributes per key. It can be +# listed in any `recv` or `send` section. # # NOTE: If you want to have different things cached for different # sections, you will need to define multiple instances of the module, @@ -57,8 +58,9 @@ cache { # driver = "rbtree" # - # NOTE: Some drivers accept specific options, to set them a config section with the - # the name as the driver should be added to the cache instance. + # NOTE: Some drivers accept specific options, to set them a config + # section with the the name as the driver should be added to the + # cache instance. # # Driver specific options are: # @@ -163,26 +165,27 @@ cache { } # - # key:: The `key` used to index the cache. It is dynamically expanded at run time. + # key:: The `key` used to index the cache. It is dynamically + # expanded at run time. # key = %{User-Name} # # ttl:: # - # The TTL of cache entries, in seconds. Entries older than this - # will be expired. + # The TTL of cache entries, in seconds. Entries older than this will + # be expired. # # This value should be between `10` and `86400`. # ttl = 10 # - # NOTE: You can flush the cache via - # `radmin -e "set module config cache epoch 123456789"` - # Where last value is a 32-bit Unix timestamp. Cache entries older - # than this are expired, as new entries added. - # You should never set the "epoch" configuration item in this file. + # NOTE: You can flush the cache via `radmin -e "set module config + # cache epoch 123456789"` Where last value is a 32-bit Unix + # timestamp. Cache entries older than this are expired, as new + # entries added. You should never set the "epoch" configuration item + # in this file. # # add_stats:: @@ -205,57 +208,55 @@ cache { # # Each key gets the same set of cached attributes. # - # The operation of the `update` section is a little different - # from normal `update` sections. This is because we need to - # both reference the attributes which we want to store in the - # cache, and also to describe where those attributes are - # written to when the cache entry is read. + # The operation of the `update` section is a little different from + # normal `update` sections. This is because we need to both + # reference the attributes which we want to store in the cache, and + # also to describe where those attributes are written to when the + # cache entry is read. # - # The solution (albeit an imperfect one) is that the cache - # does not store attributes, it stores `update` sections. - # The `update` section given below is used as a template - # for the cache entry. + # The solution (albeit an imperfect one) is that the cache does not + # store attributes, it stores `update` sections. The `update` + # section given below is used as a template for the cache entry. # - # When the cache entry is created, the right-hand side of - # each attribute assignment line is expanded. The left-hand - # side of the attribute assignment is left alone. + # When the cache entry is created, the right-hand side of each + # attribute assignment line is expanded. The left-hand side of the + # attribute assignment is left alone. # - # Once all of the right-hand side values are expanded, the - # result is an `update` section with left-hand side - # assignments, and right-hand side values. That `update` - # section is then cached, indexed by the `key` + # Once all of the right-hand side values are expanded, the result is + # an `update` section with left-hand side assignments, and + # right-hand side values. That `update` section is then cached, + # indexed by the `key` # - # When the cache entry is read, it is looked up by the `key`, - # and the cached `update` section is found. This cache entry - # now has left-hand side assignments, and right-hand side - # values. It is then applied to the current request. + # When the cache entry is read, it is looked up by the `key`, and + # the cached `update` section is found. This cache entry now has + # left-hand side assignments, and right-hand side values. It is then + # applied to the current request. # - # For example, if the `cache` module is configured with the - # block below: + # For example, if the `cache` module is configured with the block + # below: # # update { # reply.Reply-Message := "Hello %{User-Name}" # } # - # When the cache entry is created, the module will expand the - # right side of the entry, using the attributes from the - # packet. In this case, the string could expand to `"Hello bob"`. + # When the cache entry is created, the module will expand the right + # side of the entry, using the attributes from the packet. In this + # case, the string could expand to `"Hello bob"`. # - # Once all of the right-hand values are expanded, the - # resulting cache entry will look like this: + # Once all of the right-hand values are expanded, the resulting + # cache entry will look like this: # # update { # reply.Reply-Message := "Hello bob" # } # - # When the cache module is read, this `update` section is - # applied just as if it had been specified in a configuration - # file. + # When the cache module is read, this `update` section is applied + # just as if it had been specified in a configuration file. # - # NOTE: Only `request`, `reply`, `control` and - # `session-state` lists are available for the left side of - # cache entries. Attempting to reference other lists will - # raise an error during config validation. + # NOTE: Only `request`, `reply`, `control` and `session-state` lists + # are available for the left side of cache entries. Attempting to + # reference other lists will raise an error during config + # validation. # update { # @@ -281,7 +282,7 @@ cache { # represented by attributes in the `control.` list. # # control.Cache-TTL:: Sets the TTL of an entry to be created, or - # modifies the TTL of an existing entry. + # modifies the TTL of an existing entry. # # [options="header,autowidth"] # |=== @@ -299,38 +300,37 @@ cache { # prevent a new entry from being created, and existing entries from # being merged. It will also alter the module's return codes. # - # * The module will return `ok` if a cache entry was found. - # * The module will return `notfound` if no cache entry was found. + # * The module will return `ok` if a cache entry was found. + # * The module will return `notfound` if no cache entry was found. # - # NOTE: If this is set to `yes`, no other cache control attributes will - # be honoured, but they will still be cleared. + # NOTE: If this is set to `yes`, no other cache control attributes + # will be honoured, but they will still be cleared. # # control.Cache-Allow-Insert:: If present and set to `no` will - # prevent a new entry from being created. If not present or set - # to `yes`, and no entry exists, a new one will be created. - # This is evaluated after `Cache-TTL`, so expired entries may be - # recreated. + # prevent a new entry from being created. If not present or set to + # `yes`, and no entry exists, a new one will be created. This is + # evaluated after `Cache-TTL`, so expired entries may be recreated. # # control.Cache-Allow-Merge:: If present and set to `no` will - # prevent existing entries from being merged. If not present or - # set to `yes`, and an entry exists (and is valid), it will be - # merged with the current request. - # This is evaluated before `Cache-TTL`, so entries being expired - # may first be merged. + # prevent existing entries from being merged. If not present or set + # to `yes`, and an entry exists (and is valid), it will be merged + # with the current request. This is evaluated before `Cache-TTL`, so + # entries being expired may first be merged. # - # control.Cache-Merge-New:: If present and set to `yes` will merge new - # cache entries into the current request. Useful if results of execs or - # expansions are stored directly in the cache. + # control.Cache-Merge-New:: If present and set to `yes` will merge + # new cache entries into the current request. Useful if results of + # execs or expansions are stored directly in the cache. # # - # NOTE: All runtime configuration attributes will be removed from the - # `control.` list after the cache module is called. + # NOTE: All runtime configuration attributes will be removed from + # the `control.` list after the cache module is called. # # === Methods # # The cache module also allows handling the cache using the methods. # - # cache.status:: Verify if an entry already exists without load the entries. + # cache.status:: Verify if an entry already exists without load the + # entries. # # [options="header,autowidth"] # |=== @@ -340,7 +340,8 @@ cache { # | `fail` | if the cache was unavailable. # |=== # - # cache.load:: Load an existing cache entry and merge it into the request. + # cache.load:: Load an existing cache entry and merge it into the + # request. # # [options="header,autowidth"] # |=== @@ -350,7 +351,8 @@ cache { # | `fail` | if the cache was unavailable. # |=== # - # cache.update:: Perform an upsert against the data store, updating the entry TTL + # cache.update:: Perform an upsert against the data store, updating + # the entry TTL # # [options="header,autowidth"] # |=== @@ -359,8 +361,8 @@ cache { # | `fail` | if the cache was unavailable. # |=== # - # cache.store:: Inserts data into the cache if, and only if, it is not already present - # Will not update the entry TTL. + # cache.store:: Inserts data into the cache if, and only if, it is + # not already present Will not update the entry TTL. # # [options="header,autowidth"] # |=== @@ -370,8 +372,8 @@ cache { # | `fail` | if the cache was unavailable. # |=== # - # cache.clear:: Delete cache entry from the data store without checking if the entry - # already exists. + # cache.clear:: Delete cache entry from the data store without + # checking if the entry already exists. # # [options="header,autowidth"] # |=== @@ -391,7 +393,7 @@ cache { # | `fail` | if the cache was unavailable. # |=== # - # ### Examples + # === Examples # # ``` # # Add a cache entry diff --git a/raddb/mods-available/cache_eap b/raddb/mods-available/cache_eap index 5c3928b70cb..5e9320f4c1d 100644 --- a/raddb/mods-available/cache_eap +++ b/raddb/mods-available/cache_eap @@ -11,30 +11,30 @@ # # This module should be listed in the `send Access-Challenge` and # `send Access-Accept` sections to write the cache, and in `recv -# Access-Request` to read the cache. When it runs, it will cache the +# Access-Request` to read the cache. When it runs, it will cache the # current reply for an EAP session. # -# The "rbtree" cache back-end is an "in memory" cache. Which means -# that the TLS session cache will be lost if the server restarts. -# The TLS session cache can be preserved by using an external -# back-end, such as "memcached" or "redis". +# The "rbtree" cache back-end is an "in memory" cache. Which means +# that the TLS session cache will be lost if the server restarts. The +# TLS session cache can be preserved by using an external back-end, +# such as "memcached" or "redis". # # When EAP packets are being proxied, they sometimes are sent through -# a series of proxies. When that happens, a failover "upstream" -# means that one packet from the EAP session can be received via -# proxy 1, and the next packet from proxy 2. The server can -# generally handle this case. +# a series of proxies. When that happens, a failover "upstream" means +# that one packet from the EAP session can be received via proxy 1, +# and the next packet from proxy 2. The server can generally handle +# this case. # # What's worse is when an upstream server retransmits the packet -# through a different proxy. In that case, FreeRADIUS replies to -# proxy 1, which doesn't send the packet upstream. The next -# retransmit comes from proxy 2. In that case, FreeRADIUS should not +# through a different proxy. In that case, FreeRADIUS replies to +# proxy 1, which doesn't send the packet upstream. The next +# retransmit comes from proxy 2. In that case, FreeRADIUS should not # process the EAP data in the packet, it should just retransmit the # previous reply. # -# These retransmits are not duplicate packets as per RFC 5080 Section 2.2.2, -# so the "duplicate detection cache" in the server cannot send -# a duplicate reply packet. Instead, it has to send a different +# These retransmits are not duplicate packets as per RFC 5080 Section +# 2.2.2, so the "duplicate detection cache" in the server cannot send +# a duplicate reply packet. Instead, it has to send a different # packet (i.e. different RADIUS packet header, different src/dst # IP/port), but with the same contents. # diff --git a/raddb/mods-available/cache_tls b/raddb/mods-available/cache_tls index 8fef680faa4..8820e478f9e 100644 --- a/raddb/mods-available/cache_tls +++ b/raddb/mods-available/cache_tls @@ -11,20 +11,20 @@ # # This module should be listed in a `send Access-Accept` section to # write the cache, and in `recv Access-Request` to read the cache. -# When it runs, it will cache the current TLS session. That cache +# When it runs, it will cache the current TLS session. That cache # allows for fast session resumption. # -# The `rbtree` cache back-end is an "in memory" cache. Which means -# that the TLS session cache will be lost if the server restarts. -# The TLS session cache can be preserved by using an external -# back-end, such as `memcached` or `redis`. +# The `rbtree` cache back-end is an "in memory" cache. Which means +# that the TLS session cache will be lost if the server restarts. The +# TLS session cache can be preserved by using an external back-end, +# such as `memcached` or `redis`. # # Also, if an external backend is used, then the TLS session cache -# can be shared across multiple RADIUS servers. That makes for -# simple load balancing with full session resumption. +# can be shared across multiple RADIUS servers. That makes for simple +# load balancing with full session resumption. # -# NOTE: Please see the `cache` module for full documentation on the cache -# configuration. +# NOTE: Please see the `cache` module for full documentation on the +# cache configuration. # # diff --git a/raddb/mods-available/chap b/raddb/mods-available/chap index 9edc3dae28a..1f97dfd4d31 100644 --- a/raddb/mods-available/chap +++ b/raddb/mods-available/chap @@ -7,15 +7,17 @@ # # = CHAP # -# This module authenticates requests containing a `CHAP-Password` attribute. +# This module authenticates requests containing a `CHAP-Password` +# attribute. # -# NOTE: You should never send CHAP-Password in RADIUS/UDP packets. CHAP -# is secure ONLY when used inside of TTLS. +# NOTE: You should never send CHAP-Password in RADIUS/UDP packets. +# CHAP is secure ONLY when used inside of TTLS. # -# CHAP authentication requires access to the Password.Cleartext for the user. +# CHAP authentication requires access to the Password.Cleartext for +# the user. # -# Standard Unix system authentication or passwords encrypted via `crypt()` -# are not compatible with CHAP. +# Standard Unix system authentication or passwords encrypted via +# `crypt()` are not compatible with CHAP. # # == Configuration Settings # diff --git a/raddb/mods-available/cipher b/raddb/mods-available/cipher index 944e3e2b6d0..8bdcfd5cccb 100644 --- a/raddb/mods-available/cipher +++ b/raddb/mods-available/cipher @@ -7,8 +7,8 @@ # # = Cipher Module # -# The `cipher` module is used to transform plaintext in some way that is dependent -# on a key or key pair, producing encrypted ciphertext. +# The `cipher` module is used to transform plaintext in some way that +# is dependent on a key or key pair, producing encrypted ciphertext. # # Registers the following expansions: # @@ -25,9 +25,10 @@ # | `%.certificate(not_after)` | Retrieves the notAfter time from `certificate_file`. # |=== # -# NOTE: `` and `` are ingested and excreted to in their raw form. -# You should use armouring expansions i.e. `%base64.encode(...)`, `%base64.decode(...)` if the values -# are to be passed outside of FreeRADIUS. +# NOTE: `` and `` are ingested and excreted to +# in their raw form. You should use armouring expansions i.e. +# `%base64.encode(...)`, `%base64.decode(...)` if the values are to +# be passed outside of FreeRADIUS. # # e.g: # @@ -36,24 +37,25 @@ # %cipher_decrypt(%base64.decode()) # ``` # -# NOTE: The supported versions are determined _entirely_ by the version of OpenSSL used, FreeRADIUS -# simply passes the name of the digest off to OpenSSL and it tells _us_ whether it's valid/supported -# or not. +# NOTE: The supported versions are determined _entirely_ by the +# version of OpenSSL used, FreeRADIUS simply passes the name of the +# digest off to OpenSSL and it tells _us_ whether it's +# valid/supported or not. # # OpenSSL should support at least: # -# * `md2` (not recommended) -# * `md4` (not recommended) -# * `md5` (not recommended) -# * `sha1` (widely used but deprecated) -# * `sha224` -# * `sha256` (the default) -# * `sha384` -# * `sha512` -# * `sha3_224` -# * `sha3_256` -# * `sha3_384` -# * `sha3_512` +# * `md2` (not recommended) +# * `md4` (not recommended) +# * `md5` (not recommended) +# * `sha1` (widely used but deprecated) +# * `sha224` +# * `sha256` (the default) +# * `sha384` +# * `sha512` +# * `sha3_224` +# * `sha3_256` +# * `sha3_384` +# * `sha3_512` # # @@ -83,17 +85,18 @@ cipher { # # certificate_file:: # - # The PEM encoded certificate used for encrypting data and verifying signatures. + # The PEM encoded certificate used for encrypting data and + # verifying signatures. # certificate_file = ${certdir}/rsa/server.pem # # verify_mode:: How we verify certificate_file on startup # - # After reading the certificate file from disk and parsing it we can - # apply other checks to ensure it is valid. Currently we check - # the `notBefore` and `notAfter` fields to ensure the certificate is - # temporally valid. Key use checks may be added in future. + # After reading the certificate file from disk and parsing it we + # can apply other checks to ensure it is valid. Currently we check + # the `notBefore` and `notAfter` fields to ensure the certificate + # is temporally valid. Key use checks may be added in future. # # [options="header,autowidth"] # |=== @@ -121,7 +124,8 @@ cipher { # # signature_digest:: # - # Digest used to ingest the plaintext before signing or verification. + # Digest used to ingest the plaintext before signing or + # verification. # # signature_digest = "sha256" diff --git a/raddb/mods-available/client b/raddb/mods-available/client index 0a6d72259df..58154ce9624 100644 --- a/raddb/mods-available/client +++ b/raddb/mods-available/client @@ -7,20 +7,21 @@ # # = Client Module # -# The `client` module loads RADIUS clients as needed, rather than when the server -# starts. +# The `client` module loads RADIUS clients as needed, rather than +# when the server starts. # -# This module is listed in the `new client { ... }` section of a virtual server to read -# client definitions from FreeRADIUS config files transforming them into attributes. -# These attributes are then used by the server to create internal client definitions. +# This module is listed in the `new client { ... }` section of a +# virtual server to read client definitions from FreeRADIUS config +# files transforming them into attributes. These attributes are then +# used by the server to create internal client definitions. # -# This indirection is necessary as client definitions can be provided by many different -# modules (`ldap`, `sql`, etc...), all of which emit client data in -# attribute form. Treating static configuration files specially would increase code -# complexity. +# This indirection is necessary as client definitions can be provided +# by many different modules (`ldap`, `sql`, etc...), all of which +# emit client data in attribute form. Treating static configuration +# files specially would increase code complexity. # -# There are no configuration entries for this module. Instead, it relies on the `client` -# configuration. +# There are no configuration entries for this module. Instead, it +# relies on the `client` configuration. # # You must: # @@ -34,40 +35,45 @@ # The default example already does this. # # 5. Put files into the above directory, one per IP. e.g. file `192.0.2.1` should contain -# a normal client definition -# for a client with IP address `192.0.2.1`. +# a normal client definition for a client with IP address +# `192.0.2.1`. # -# NOTE: For more documentation, see the file `sites-available/dynamic-clients` +# NOTE: For more documentation, see the file +# `sites-available/dynamic-clients` # # # == Client Configuration # -# In addition to loading `client` definitions in from flat files, the clients module can -# also be used to access data from previously defined clients. +# In addition to loading `client` definitions in from flat files, the +# clients module can also be used to access data from previously +# defined clients. # # # === Attribute Mapping # -# Maps arbitrary fields from a client definition to attributes in the current request. +# Maps arbitrary fields from a client definition to attributes in the +# current request. # # [source,unlang] -# --- -# map client [] { // <1> +# --- map client [] { // <1> # Foo = 'nas_type' // <2> # Bar := 'shortname' // <3> # Baz += 'groups' // <4> -# } -# --- +# } --- # -# <1> By default `map client { ... }` will operate on the current client, but alternative +# <1> By default `map client { ... }` will operate on the current +# client, but alternative # clients can by specified by ``. -# <2> Assigns the value of the `nas_type` field from the client definition to +# <2> Assigns the value of the `nas_type` field from the client +# definition to # `Foo` if the `Foo` attribute does not exist. -# <3> Assigns the value of the `shortname` field from the client definition to +# <3> Assigns the value of the `shortname` field from the client +# definition to # `Bar`. -# <4> Creates multiple `Baz` attributes from a custom group field associated +# <4> Creates multiple `Baz` attributes from a custom group field +# associated # with the client. # diff --git a/raddb/mods-available/crl b/raddb/mods-available/crl index 6c969f471d8..f876dfa829a 100644 --- a/raddb/mods-available/crl +++ b/raddb/mods-available/crl @@ -21,10 +21,11 @@ crl { # # virtual_server:: Name of the virtual server used to fetch CRLs. # - # This virtual server must use the 'crl' namespace and provide - # a `recv CRL-Fetch` section to fetch CRLs. + # This virtual server must use the 'crl' namespace and provide a + # `recv CRL-Fetch` section to fetch CRLs. # - # A suitable example virtual server is provided in sites-available/crl + # A suitable example virtual server is provided in + # sites-available/crl # virtual_server = crl @@ -36,13 +37,12 @@ crl { # If a given CRL has not already been fetched when a certificate # requires verification, then it will be fetched. # - # If the CRL distribution points which will be needed are known - # then they can be configured using one or more instance of this - # option. + # If the CRL distribution points which will be needed are known then + # they can be configured using one or more instance of this option. # # These distribution points will be fetched during server startup. # - # Only base CRL distribution points should be listed here. Deltas + # Only base CRL distribution points should be listed here. Deltas # which they refer to will automatically be fetched. # ## url = http://example.com/ca.crl diff --git a/raddb/mods-available/csv b/raddb/mods-available/csv index c1716d22eb3..3afbc4d3d4a 100644 --- a/raddb/mods-available/csv +++ b/raddb/mods-available/csv @@ -13,7 +13,8 @@ # # WARNING: Multi-line fields are NOT allowed. # -# The CSV map can be used in a `map` section, as in the following example. +# The CSV map can be used in a `map` section, as in the following +# example. # # ``` # map csv User-Name { @@ -23,10 +24,10 @@ # } # ``` # -# The argument to "map" is dynamically expanded. The result is taken -# as a string, and is used as the value of the "key". The key is -# then looked up in the cached CSV file. The fields are then mapped -# to the attributes on the left side of the map. +# The argument to "map" is dynamically expanded. The result is taken +# as a string, and is used as the value of the "key". The key is then +# looked up in the cached CSV file. The fields are then mapped to the +# attributes on the left side of the map. # # == Configuration Settings # @@ -44,9 +45,9 @@ csv { # # header:: Whether or not there is a one-line header in the file. # - # If the value is set to 'yes', then the CSV file MUST contain - # a header as the first line of the file. That header line - # must contain the field names. + # If the value is set to 'yes', then the CSV file MUST contain a + # header as the first line of the file. That header line must + # contain the field names. # header = no @@ -56,27 +57,26 @@ csv { # # The default is `no`. # - # If set to `yes`, then multiple entries are allowed. When a - # key matches, each entry is applied in the order it appears - # in the file. + # If set to `yes`, then multiple entries are allowed. When a key + # matches, each entry is applied in the order it appears in the + # file. # allow_multiple_keys = no # # fields:: A string which defines field names. # - # This configuration item is used only when `header = no`. - # The content of the `fields` item must be the same as in RFC 4180. - # That is, a list of field names, separated by the `delimiter` - # character. + # This configuration item is used only when `header = no`. The + # content of the `fields` item must be the same as in RFC 4180. That + # is, a list of field names, separated by the `delimiter` character. # - # The `csv` module can be used to read files such as `/etc/group` - # By setting `delimiter = ":"`, and by using `fields = "group:::,user"` + # The `csv` module can be used to read files such as `/etc/group` By + # setting `delimiter = ":"`, and by using `fields = "group:::,user"` # - # The special character `,` can be used *only* for the `key` - # field, and *only* if the `key` field is the last field. - # This special syntax means "add multiple entries for this - # line, one for each `key`". + # The special character `,` can be used *only* for the `key` field, + # and *only* if the `key` field is the last field. This special + # syntax means "add multiple entries for this line, one for each + # `key`". # # [NOTE] # ===== @@ -94,53 +94,52 @@ csv { # # It can be any one of the field names defined above. # - # The CSV rows are normally placed into a binary tree, - # indexed by this field. A binary tree allows for fast - # lookups, no matter the size of the CSV file. + # The CSV rows are normally placed into a binary tree, indexed by + # this field. A binary tree allows for fast lookups, no matter the + # size of the CSV file. # - # When looking up entries in the binary tree, the key must match - # the `index_field` exactly. + # When looking up entries in the binary tree, the key must match the + # `index_field` exactly. # - # If `data_type` is an IP address type, then the CSV rows are - # placed into a prefix trie, indexed by this field. The - # prefix trie allows for fast prefix lookups. + # If `data_type` is an IP address type, then the CSV rows are placed + # into a prefix trie, indexed by this field. The prefix trie allows + # for fast prefix lookups. # - # When looking up entries in a prefix trie, the closest - # enclosing prefix is matched. This prefix match allows you - # to place `192.0.2/24` as an index field in the file, and - # then lookups of `192.0.2.1` will return that row. + # When looking up entries in a prefix trie, the closest enclosing + # prefix is matched. This prefix match allows you to place + # `192.0.2/24` as an index field in the file, and then lookups of + # `192.0.2.1` will return that row. # index_field = "name" # - # key:: The key string used to look up entries via the `index_field`. + # key:: The key string used to look up entries via the + # `index_field`. # - # When the `csv` module is listed in a processing section, - # the `key` is used to find the appropriate entry. The `update` - # section below is then applied. + # When the `csv` module is listed in a processing section, the `key` + # is used to find the appropriate entry. The `update` section below + # is then applied. # - # The data type of the key is used to determine the type - # of structure used to store the `index_field` values. + # The data type of the key is used to determine the type of + # structure used to store the `index_field` values. # # When the key data type is one of: `ipaddr`, `ipv4prefix`, - # `ipv6addr`, or `ipv6prefix`, then the rows are stored in a - # prefix trie. + # `ipv6addr`, or `ipv6prefix`, then the rows are stored in a prefix + # trie. # # For all other key data types, the rows are stored in a binary # tree. # - # If a data type other than the native type of `key` expression - # is needed, the casting operator can be used. - # For example: - # a key value of `(ipv4addr) reply.Reply-Message`. - # would result in a prefix trie being used for lookups, and the - # `string` value of the `Reply-Message` attribute being parsed as - # CIDR notation. + # If a data type other than the native type of `key` expression is + # needed, the casting operator can be used. For example: a key value + # of `(ipv4addr) reply.Reply-Message`. would result in a prefix trie + # being used for lookups, and the `string` value of the + # `Reply-Message` attribute being parsed as CIDR notation. # - # Note that the individual fields of the CSV file do not have - # data types. They are stored internally as strings, and are - # parsed to the final data type only when the `csv` module - # is run, either in-place, or as a `map`. + # Note that the individual fields of the CSV file do not have data + # types. They are stored internally as strings, and are parsed to + # the final data type only when the `csv` module is run, either + # in-place, or as a `map`. # key = User-Name @@ -170,11 +169,11 @@ csv { # |=== # # Request and list qualifiers may be placed after the `update` - # section name to set default destination requests/lists - # for `s` with no list qualifiers. + # section name to set default destination requests/lists for `s` with no list qualifiers. # - # NOTE: CSV field names should be single quoted unless you want - # the name to be derived from an xlat expansion, or an attribute ref. + # NOTE: CSV field names should be single quoted unless you want the + # name to be derived from an xlat expansion, or an attribute ref. # # update { ... }:: # @@ -189,22 +188,21 @@ csv { # map cvs { ... } # # Where `csv` is the name of the module, and `key` is an expansion - # as given the key` field above. For example, the map could - # look like this: + # as given the key` field above. For example, the map could look + # like this: # # ``` # map csv User-Name { # reply.Reply-Message := 'color' # my-integer := 'count' - # } + # } # ``` # - # This map does the same operations as the key / update - # fields given above. The benefit here is that the key can - # be dynamically changed, depending on the needs of the - # current section. + # This map does the same operations as the key / update fields given + # above. The benefit here is that the key can be dynamically + # changed, depending on the needs of the current section. # - # If the key is not found in the CSV file, then the `map` - # does nothing. + # If the key is not found in the CSV file, then the `map` does + # nothing. # } diff --git a/raddb/mods-available/cui b/raddb/mods-available/cui index 5bfa2ce8c1f..87e5859667a 100644 --- a/raddb/mods-available/cui +++ b/raddb/mods-available/cui @@ -8,8 +8,8 @@ # = CUI Module # # The module `cui` (`Chargeable-User-Identity`) writes -# `Chargeable-User-Identity` log to an SQL database. It uses the `sql` -# module to do the bulk of the work, but has custom schemas and +# `Chargeable-User-Identity` log to an SQL database. It uses the +# `sql` module to do the bulk of the work, but has custom schemas and # queries. # # * Schema is in `sql/cui//schema.sql` @@ -21,8 +21,8 @@ # sql cuisql { # - # dialect:: The dialect of SQL you want to use, this should usually match - # the driver below. + # dialect:: The dialect of SQL you want to use, this should usually + # match the driver below. # # NOTE: If you're using rlm_sql_null, then it should be the type of # database the logged queries are going to be executed against. @@ -30,8 +30,8 @@ sql cuisql { dialect = "sqlite" # - # driver:: The sub-module to use to execute queries. This should match - # the database you're attempting to connect to. + # driver:: The sub-module to use to execute queries. This should + # match the database you're attempting to connect to. # # There are CUI queries available for: # @@ -49,7 +49,8 @@ sql cuisql { # # [NOTE] # ==== - # For dialect `mysql` and `postgresql` the following information should be provided: + # For dialect `mysql` and `postgresql` the following information + # should be provided: # ## server = "localhost" ## port = 3306 @@ -90,10 +91,11 @@ sql cuisql { cui_table = "cui" # - # sql_user_name:: `SQL-User-Name` is used as the user for SQL queries. - # Normally it is the same as `User-Name`, but sometimes it needs to be different. - # Then instead of editing `User-Name` (*which we don't recommend*), you can - # set `SQL-User-Name` to the new value. + # sql_user_name:: `SQL-User-Name` is used as the user for SQL + # queries. Normally it is the same as `User-Name`, but sometimes it + # needs to be different. Then instead of editing `User-Name` (*which + # we don't recommend*), you can set `SQL-User-Name` to the new + # value. # sql_user_name = "%{User-Name}" diff --git a/raddb/mods-available/date b/raddb/mods-available/date index 6795b26621a..f904d404698 100644 --- a/raddb/mods-available/date +++ b/raddb/mods-available/date @@ -10,13 +10,13 @@ # The `date` module parses dates, and prints them. # # The server will normally print dates in its own pre-defined format. -# It will also parse dates in a few limited formats. However, these -# operations are for full dates (e.g. January 1, 2020 12:34pm). The +# It will also parse dates in a few limited formats. However, these +# operations are for full dates (e.g. January 1, 2020 12:34pm). The # server does not print dates in other formats, and does not parse # dates in other formats. # -# The `date` module adds that functionality. It allows you to print -# dates in almost any format you want. It allows you to parse dates +# The `date` module adds that functionality. It allows you to print +# dates in almost any format you want. It allows you to parse dates # in almost any format, so long as you know what the fields are, and # how they are defined. # @@ -28,16 +28,16 @@ date { # # format:: Formatting of the output string. # - # The format arguments are the same as for the system - # `strftime` call. See `man strftime` for documentation. + # The format arguments are the same as for the system `strftime` + # call. See `man strftime` for documentation. # format = "%b %e %Y %H:%M:%S %Z" # # utc:: Whether conversions are in UTC or local time. # - # If `utc` is enabled then any conversions will be made - # as UTC, not localtime. + # If `utc` is enabled then any conversions will be made as UTC, not + # localtime. # # .Default is to use localtime. # @@ -61,17 +61,17 @@ date date_iso { # # === xlat expansions # -# The `date` module defines an expansion `%date()` When the -# expansion is not passed an argument, it returns the current date -# printed according to the `format` string defined above. +# The `date` module defines an expansion `%date()` When the expansion +# is not passed an argument, it returns the current date printed +# according to the `format` string defined above. # # ."Attribute" mode: # # If the argument to `%date(...)` is an attribute of `date` or # `integer` type, the date used will be the time given by the -# relevant attribute. If the attributes is of type `string`, the -# string will be parsed according to the `format` configuration, -# and a Unix date will be returned, as integer seconds since the epoch. +# relevant attribute. If the attributes is of type `string`, the +# string will be parsed according to the `format` configuration, and +# a Unix date will be returned, as integer seconds since the epoch. # # For example, `%date('Event-Timestamp')` will use the date from the # `Event-Timestamp` attribute as the source of the date for printing. @@ -82,8 +82,8 @@ date date_iso { # time the current request packet arrived according to the format # string, and return it as a string. # -# If the input is the string `now`, the `xlat` will behave as -# above, for the current time. +# If the input is the string `now`, the `xlat` will behave as above, +# for the current time. # # If the input string begins with `+`, then the remainder of the # string is interpreted as if the string had been given in the @@ -91,14 +91,14 @@ date date_iso { # # For example `%date('+%A')` will return `Monday` if today is Monday. # -# Note that the `%` character is special for xlat expansions, and therefore -# either has to be "protected" by string quotation, or the `%` character has -# to be escaped itself, as in `%date(+%%A)` +# Note that the `%` character is special for xlat expansions, and +# therefore either has to be "protected" by string quotation, or the +# `%` character has to be escaped itself, as in `%date(+%%A)` # # ."Integer output" # # In some cases, it is useful for the module to parse dates instead -# of printing them. In this mode, the format string is ignored. +# of printing them. In this mode, the format string is ignored. # Instead, the input arguments are parsed, and the output is an # integer containing the requested value. # diff --git a/raddb/mods-available/delay b/raddb/mods-available/delay index e7acad5f655..13b1fcab875 100644 --- a/raddb/mods-available/delay +++ b/raddb/mods-available/delay @@ -14,8 +14,8 @@ # Instead of having a specific "reject delay" configuration, it is # instead possible to have a policy that delays the response. # -# TIP: The module can also be used to introduce artificial jitter into -# responses by adding random delays. +# TIP: The module can also be used to introduce artificial jitter +# into responses by adding random delays. # # == xlat for delays # @@ -23,7 +23,9 @@ # # %delay(...) # -# This function takes a time-delta argument (or data which is converted to a time-delta), and will delay the given number of seconds. +# This function takes a time-delta argument (or data which is +# converted to a time-delta), and will delay the given number of +# seconds. # # .Example # @@ -47,24 +49,22 @@ delay { delay = 1.0s # - # force_reschedule:: Whether the request should be rescheduled even if no - # delay is needed. + # force_reschedule:: Whether the request should be rescheduled even + # if no delay is needed. # - # Rescheduling the request pauses it momentarily, and - # introduces a small delay. It allows for processing of - # other requests ahead of this one. The result is a small - # amount of "jitter" in responses, which can help avoid some - # deterministic timings in the network. + # Rescheduling the request pauses it momentarily, and introduces a + # small delay. It allows for processing of other requests ahead of + # this one. The result is a small amount of "jitter" in responses, + # which can help avoid some deterministic timings in the network. # # force_reschedule = no # - # relative:: Whether delay should be calculated relative to when - # the request was received. + # relative:: Whether delay should be calculated relative to when the + # request was received. # - # This configuration can be useful for rate limiting, as most - # NAS will only allow a limited number of requests to be in - # flight. + # This configuration can be useful for rate limiting, as most NAS + # will only allow a limited number of requests to be in flight. # # The default is `no`, which means that. # @@ -72,18 +72,18 @@ delay { # # rcode:: Which rcode the delay module should return when it resumes - # this can be useful for detecting whether a `timeout { ... }` section - # expired, whilst the delay module was waiting. + # this can be useful for detecting whether a `timeout { ... }` + # section expired, whilst the delay module was waiting. # # The default is `notset`, which means that the delay module will be # transparent and not alter the section rcode. # # [NOTE] # ==== - # The default section `rcode` in many places is `fail`. Care should be - # taken to set the `rcode` for the section a delay module appears in, if - # this configuration item is not set, and no other modules are present - # in the section. + # The default section `rcode` in many places is `fail`. Care should + # be taken to set the `rcode` for the section a delay module appears + # in, if this configuration item is not set, and no other modules + # are present in the section. # ==== # # rcode = 'notset' @@ -93,18 +93,18 @@ delay { # === Delaying Access-Reject packets # # The `delay_reject` module should be used in a `send Access-Reject` -# section, as the last module in that section. When `delay_reject` -# is used there, the reject will be delayed for either -# FreeRADIUS-Response-Delay seconds, or if that attribute does -# not exist, then one second. +# section, as the last module in that section. When `delay_reject` is +# used there, the reject will be delayed for either +# FreeRADIUS-Response-Delay seconds, or if that attribute does not +# exist, then one second. # # While the response is delayed, the server will continue processing -# other requests. It will simply set a timer to wake up and send the +# other requests. It will simply set a timer to wake up and send the # response after the delay. # -# NOTE: We set `relative = yes` here. That setting ensures that -# if the server takes more than one second to process the request, -# then the `delay_reject` module will not add *additional* delays. +# NOTE: We set `relative = yes` here. That setting ensures that if +# the server takes more than one second to process the request, then +# the `delay_reject` module will not add *additional* delays. # Instead, this module will ensure that the `Access-Reject` is sent # no earlier than one second after the `Access-Request` had been # received. diff --git a/raddb/mods-available/detail b/raddb/mods-available/detail index d9c14713a86..744e1219c41 100644 --- a/raddb/mods-available/detail +++ b/raddb/mods-available/detail @@ -22,15 +22,14 @@ detail { # # filename:: The filename used when creating `detail` files. # - # The default configuration creates a new `detail` file for - # every radius client (by IP address or hostname). In - # addition, a new detail file is created every day, so that - # the `detail` file doesn't have to go through a 'log - # rotation'. + # The default configuration creates a new `detail` file for every + # radius client (by IP address or hostname). In addition, a new + # detail file is created every day, so that the `detail` file + # doesn't have to go through a 'log rotation'. # - # If your detail files are large, you may also want to - # add a `:%H` (see `doc/unlang/xlat_character.adoc`) to - # the end of it, to create a new detail file every hour. + # If your detail files are large, you may also want to add a `:%H` + # (see `doc/unlang/xlat_character.adoc`) to the end of it, to create + # a new detail file every hour. # # e.g.: # @@ -39,66 +38,64 @@ detail { # This will create a new `detail` file for every hour. # # If you are reading detail files via the `listen { ... }` section - # (e.g. as in `sites-available/robust-proxy-accounting`), - # you MUST use a unique directory for each combination of a `detail` - # file writer, and reader. + # (e.g. as in `sites-available/robust-proxy-accounting`), you MUST + # use a unique directory for each combination of a `detail` file + # writer, and reader. # - # That is, only *one* `listen { ... }` section can read - # detail files from a particular directory. + # That is, only *one* `listen { ... }` section can read detail files + # from a particular directory. # filename = "${radacctdir}/%{Net.Src.IP}/detail-%Y-%m-%d" # - # NOTE: If you are using `radrelay`, delete the above line for `file`, - # and use this one instead: + # NOTE: If you are using `radrelay`, delete the above line for + # `file`, and use this one instead: # # filename = ${radacctdir}/detail # - # escape_filenames:: Whether or not to escape "special" - # characters in filenames. + # escape_filenames:: Whether or not to escape "special" characters + # in filenames. # # Most file systems can handle nearly the full range of UTF-8 - # characters. Ones that can deal with a limited range should - # set this to `yes`. + # characters. Ones that can deal with a limited range should set + # this to `yes`. # escape_filenames = no # # permissions:: The Unix permissions on the `detail` file. # - # NOTE: The detail file often contains secret or private - # information about users. The file permissions should be - # restrictive, so that unwanted people are prevented from - # seeing any secret information. + # NOTE: The detail file often contains secret or private information + # about users. The file permissions should be restrictive, so that + # unwanted people are prevented from seeing any secret information. # permissions = 0600 # # group:: The Unix group of the log file. # - # NOTE: The user that the server runs as must be in the - # specified system group otherwise the server will not have - # permission to change the group ownership of the file. + # NOTE: The user that the server runs as must be in the specified + # system group otherwise the server will not have permission to + # change the group ownership of the file. # # group = ${security.group} # # header:: The header of a `detail` file entry. # - # Every entry in the detail file has a header which is a - # timestamp. - # By default, we use the ctime format (see `man 3 ctime` for details). + # Every entry in the detail file has a header which is a timestamp. + # By default, we use the ctime format (see `man 3 ctime` for + # details). # - # The header can be customised by editing this string. - # See `doc/unlang/xlat.adoc` for a description - # of what can be put here. + # The header can be customised by editing this string. See + # `doc/unlang/xlat.adoc` for a description of what can be put here. # header = "%t" # - # locking:: Whether or not we should lock the detail file - # before writing to it. + # locking:: Whether or not we should lock the detail file before + # writing to it. # # Mainly used if the detail file reader is to be reading this file. # @@ -107,18 +104,18 @@ detail { # # log_packet_header::: Log the Packet src/dst IP/port. # - # This is disabled by default, as that information isn't used - # by many people. + # This is disabled by default, as that information isn't used by + # many people. # # log_packet_header = yes # - # suppress { ... }:: Suppress "secret" information from appearing in the `detail` file. + # suppress { ... }:: Suppress "secret" information from appearing in + # the `detail` file. # - # Certain attributes such as `User-Password` may be - # "sensitive", so they should not be printed in the detail - # file. This section lists the attributes that should be - # suppressed. + # Certain attributes such as `User-Password` may be "sensitive", so + # they should not be printed in the detail file. This section lists + # the attributes that should be suppressed. # # NOTE: The attributes should be listed one to a line. # diff --git a/raddb/mods-available/detail.example.com b/raddb/mods-available/detail.example.com index 3b8e32e5e0a..b2f3b82ca20 100644 --- a/raddb/mods-available/detail.example.com +++ b/raddb/mods-available/detail.example.com @@ -14,21 +14,20 @@ # * `sites-available/robust-proxy-accounting` # * `sites-available/decoupled-accounting` # -# NOTE: This module can write detail files that are read by -# only ONE `listen { ... }` section. If you use BOTH of the examples -# above, you will need to define TWO "detail" modules. +# NOTE: This module can write detail files that are read by only ONE +# `listen { ... }` section. If you use BOTH of the examples above, +# you will need to define TWO "detail" modules. # # e.g. `detail1.example.com` && `detail2.example.com` # -# We write *multiple* detail files here. They will be processed -# by the detail `listen { ... }` section in the order that they were -# created. The directory containing these files should NOT be -# used for any other purposes, i.e. it should have NO other -# files in it. +# We write *multiple* detail files here. They will be processed by +# the detail `listen { ... }` section in the order that they were +# created. The directory containing these files should NOT be used +# for any other purposes, i.e. it should have NO other files in it. # # TIP: Writing multiple detail enables the server to process the -# pieces in smaller chunks. This helps in certain catastrophic -# corner cases. +# pieces in smaller chunks. This helps in certain catastrophic corner +# cases. # # == Configuration Settings diff --git a/raddb/mods-available/detail.log b/raddb/mods-available/detail.log index e4a05e761ee..bb41c487943 100644 --- a/raddb/mods-available/detail.log +++ b/raddb/mods-available/detail.log @@ -9,8 +9,8 @@ # # More examples of doing detail logs. # -# NOTE: For a full explanation of the configuration options, -# please see the `detail` module. +# NOTE: For a full explanation of the configuration options, please +# see the `detail` module. # # @@ -32,7 +32,8 @@ detail auth_log { permissions = 0600 # - # suppress { ... }:: This will stop passwords being written to the log. + # suppress { ... }:: This will stop passwords being written to the + # log. # suppress { User-Password @@ -42,8 +43,8 @@ detail auth_log { # # === Access-Accept # -# This module logs authentication reply packets sent to a NAS. -# Both `Access-Accept` and `Access-Reject` packets are logged. +# This module logs authentication reply packets sent to a NAS. Both +# `Access-Accept` and `Access-Reject` packets are logged. # # NOTE: You will also need to un-comment the 'reply_log' line in the # `send Access-Accept` section of `sites-enabled/default`. diff --git a/raddb/mods-available/dhcpv4 b/raddb/mods-available/dhcpv4 index 590839efb10..34f1a18f90b 100644 --- a/raddb/mods-available/dhcpv4 +++ b/raddb/mods-available/dhcpv4 @@ -18,24 +18,24 @@ # relay. # # Packets MUST also have a `Gateway-IP-Address` option, otherwise -# they will be dropped. This module does not (yet) support receiving -# replies from the DHCPv4 server. Any packets sent to the outgoing +# they will be dropped. This module does not (yet) support receiving +# replies from the DHCPv4 server. Any packets sent to the outgoing # socket will be discarded. # dhcpv4 { # # ipaddr:: The IP address we use for sending packets. # - # This MUST be an IPv4 address. IPv6 addresses are not - # supported for DHCPv4. + # This MUST be an IPv4 address. IPv6 addresses are not supported for + # DHCPv4. # ipaddr = 127.0.0.1 # # port:: The port we use for sending packets. # - # The default DHCPv4 client port is 68. It should be changed - # from this only for testing. + # The default DHCPv4 client port is 68. It should be changed from + # this only for testing. # # port = 68 diff --git a/raddb/mods-available/dict b/raddb/mods-available/dict index 61b1c3ffe39..7ca017f8c2c 100644 --- a/raddb/mods-available/dict +++ b/raddb/mods-available/dict @@ -7,7 +7,8 @@ # # = Dict Module # -# The `dict` module registers expansions which query the dictionaries. +# The `dict` module registers expansions which query the +# dictionaries. # # == Expansions @@ -16,7 +17,8 @@ # # === %dict.attr(__) # -# Takes an attribute name, and returns the canonicalized name of the attribute. +# Takes an attribute name, and returns the canonicalized name of the +# attribute. # # If the attribute does not exist, nothing is returned. # @@ -37,15 +39,16 @@ # # If the attribute does not exist, nothing is returned. # -# Note that only the _final_ attribute number is returned. For example, the OID -# for `Vendor-Specific.Cisco.AVPair` is `26.9.1`. This function will return -# `1`, and not the full OID. +# Note that only the _final_ attribute number is returned. For +# example, the OID for `Vendor-Specific.Cisco.AVPair` is `26.9.1`. +# This function will return `1`, and not the full OID. # # .Return: _uint32_ # # === %dict.attr.type(__) # -# Takes an attribute name, and returns the data type of the attribute. +# Takes an attribute name, and returns the data type of the +# attribute. # # If the attribute does not exist, nothing is returned. # @@ -53,7 +56,8 @@ # # === %dict.vendor(__) # -# Takes an vendor name, and returns the canonicalized name of the vendor. +# Takes an vendor name, and returns the canonicalized name of the +# vendor. # # If the vendor does not exist, nothing is returned. # @@ -61,7 +65,8 @@ # # === %dict.vendor.by.num(__) # -# Takes an vendor number, and returns the canonicalized name of the vendor. +# Takes an vendor number, and returns the canonicalized name of the +# vendor. # # If the vendor does not exist, nothing is returned. # diff --git a/raddb/mods-available/digest b/raddb/mods-available/digest index 829e66dd2c6..e218dfa8ab6 100644 --- a/raddb/mods-available/digest +++ b/raddb/mods-available/digest @@ -7,11 +7,13 @@ # # = Digest Module # -# The `digest` module is used for performing authentication against a Cisco SIP server. +# The `digest` module is used for performing authentication against a +# Cisco SIP server. # -# TIP: Digest authentication is standardized in `RFC 5090`. However, most implementations -# do not use that. Instead, they implement the draft -# as can be seen at `draft-sterman-aaa-sip-01` for more details. +# TIP: Digest authentication is standardized in `RFC 5090`. However, +# most implementations do not use that. Instead, they implement the +# draft as can be seen at `draft-sterman-aaa-sip-01` for more +# details. # # diff --git a/raddb/mods-available/dpsk b/raddb/mods-available/dpsk index 6aa425313e8..b265627914a 100644 --- a/raddb/mods-available/dpsk +++ b/raddb/mods-available/dpsk @@ -18,14 +18,17 @@ # * FreeRADIUS-802.1X-Anonce - from the AP # * FreeRADIUS-802.1X-EAPoL-Key-Msg - from the AP # -# The attributes where data is found can be amened using configuration options -# below, e.g. if you need to use different VSAs for the anonce and EAPoL key msg. +# The attributes where data is found can be amened using +# configuration options below, e.g. if you need to use different VSAs +# for the anonce and EAPoL key msg. # -# Note that you MUST run the "rewrite_called_station_id" policy before calling this module. +# Note that you MUST run the "rewrite_called_station_id" policy +# before calling this module. # # That policy MUST also create the Called-Station-MAC attribute. # -# Then place the following configuration into the "recv Access-Request" section: +# Then place the following configuration into the "recv +# Access-Request" section: # # ``` # recv Access-Request { @@ -41,15 +44,16 @@ # ``` # # Alternatively, you can read control.PSK-Identity and -# control.Pre-Shared-Key from a database. Just do that before -# running the "authenticate" section. You can do the database lookup -# after running the "dpsk" module in the "recv Access-Request" section. +# control.Pre-Shared-Key from a database. Just do that before running +# the "authenticate" section. You can do the database lookup after +# running the "dpsk" module in the "recv Access-Request" section. # # The database should look up the User-Name (i.e. MAC), and then set -# control,PSK-Identity and control.Pre-Shared-Key. In general, it -# is easiest to just set PSK-Identity to be same as the User-Name. +# control,PSK-Identity and control.Pre-Shared-Key. In general, it is +# easiest to just set PSK-Identity to be same as the User-Name. # -# Then create an "authenticate dpsk" section which calls the "dpsk" module: +# Then create an "authenticate dpsk" section which calls the "dpsk" +# module: # # ``` # authenticate dpsk { @@ -91,14 +95,14 @@ # We STRONGLY RECOMMEND THAT NO ONE USE THIS MODULE. # # While it works, it needs to use a brute-force method to match MAC -# to PSK. That process is extremely slow, and scales very poorly. +# to PSK. That process is extremely slow, and scales very poorly. # -# i.e. if you have 10 PSKs, it's not too bad. If you have 10,000 -# PSKs, then the module can consume 100% of CPU trying to -# brute-force every PSK. +# i.e. if you have 10 PSKs, it's not too bad. If you have 10,000 +# PSKs, then the module can consume 100% of CPU trying to brute-force +# every PSK. # -# This is a limitation of how DPSK works. There is no way to make it -# better. The only thing we've done is to add a cache which can help +# This is a limitation of how DPSK works. There is no way to make it +# better. The only thing we've done is to add a cache which can help # to minimise the amount of brute-force attempts. # # @@ -112,12 +116,12 @@ dpsk { # # The cache is keyed by (supplicant MAC + SSID) # - # The cache entry is the PSK-Identity and Pre-Shared-Key, - # and/or the PMK which are used to verify the information in - # the Access-Request. + # The cache entry is the PSK-Identity and Pre-Shared-Key, and/or the + # PMK which are used to verify the information in the + # Access-Request. # - # Caching entries can help, even when using a database. It - # is very slow to calculate the PMK from the PSK. + # Caching entries can help, even when using a database. It is very + # slow to calculate the PMK from the PSK. # cache_size = 1024 @@ -132,83 +136,83 @@ dpsk { # filename:: # # - # PSKs can also be stored in a CSV file. The format of the file is: + # PSKs can also be stored in a CSV file. The format of the file is: # # ``` # identity,psk,mac # ``` # - # If there are commas in a field, then the field can be - # double quoted: "psk". + # If there are commas in a field, then the field can be double + # quoted: "psk". # - # The mac field is optional. If it exists, then that PSK - # will be used. It is highly recommended that the MAC *not* be placed - # into the CSV file. Instead, the MAC and PSK should be placed into a - # database. The server can then be configured to look up the MAC in the - # database, which returns the PSK. That way this module will only ever - # check one PSK, which is fast. + # The mac field is optional. If it exists, then that PSK will be + # used. It is highly recommended that the MAC *not* be placed into + # the CSV file. Instead, the MAC and PSK should be placed into a + # database. The server can then be configured to look up the MAC in + # the database, which returns the PSK. That way this module will + # only ever check one PSK, which is fast. # - # i.e. the CSV file should only contain the small number of PSKs where - # you do not yet know the MAC. As soon as you know the MAC, you should - # put the MAC and PSK into a database, and then remove the MAC and PSK - # from the CSV file. + # i.e. the CSV file should only contain the small number of PSKs + # where you do not yet know the MAC. As soon as you know the MAC, + # you should put the MAC and PSK into a database, and then remove + # the MAC and PSK from the CSV file. # - # NOTE: the file is opened and read from top to bottom for every - # new request which comes in. This process can be very slow! + # NOTE: the file is opened and read from top to bottom for every new + # request which comes in. This process can be very slow! # # However, opening the file for every new request means that the - # server does not have to be reloaded when the file changes. Instead, - # the file can be generated, and then moved into place atomically: + # server does not have to be reloaded when the file changes. + # Instead, the file can be generated, and then moved into place + # atomically: # # ``` # create csv file > psk.csv.new # mv psk.csv.new psk.csv # ``` # - # Any process which writes a new "psk.csv" file MUST NOT - # write to the file directly, as that will cause the dpsk - # module to read partial entries and fail. Instead, use "mv" - # to atomically overwrite the old file with a new one. + # Any process which writes a new "psk.csv" file MUST NOT write to + # the file directly, as that will cause the dpsk module to read + # partial entries and fail. Instead, use "mv" to atomically + # overwrite the old file with a new one. # - # Both "cache_size" and "filename" can be configured at the - # same time, which is recommended. When an entry in the file - # is found, the identity, PSK, and MAC are saved in the cache. + # Both "cache_size" and "filename" can be configured at the same + # time, which is recommended. When an entry in the file is found, + # the identity, PSK, and MAC are saved in the cache. # # If a cache entry is found, then the filename is NOT read. # - # The resulting combination of features means that the module - # should be as fast as possible, given the limitations of DPSK. + # The resulting combination of features means that the module should + # be as fast as possible, given the limitations of DPSK. # - # NOTE: Tests show that the module can do ~100K PSK / DPSK - # checks per second. This means that if you have 10,000 - # users and 10 packets a second, the system will be 100% busy - # checking PSKs. Similarly, of you have 100K DPSKs in the file, - # the one packet will take 1 second of CPU time to verify! + # NOTE: Tests show that the module can do ~100K PSK / DPSK checks + # per second. This means that if you have 10,000 users and 10 + # packets a second, the system will be 100% busy checking PSKs. + # Similarly, of you have 100K DPSKs in the file, the one packet will + # take 1 second of CPU time to verify! # - # As a result, the DPSK functionality scales poorly. It - # should be used only with a small number of PSKs (100s - # perhaps), and only at low packet rates. If the server is - # getting 1000 packets per second, then it can only handle - # 100 PSKs before running out of CPU. + # As a result, the DPSK functionality scales poorly. It should be + # used only with a small number of PSKs (100s perhaps), and only at + # low packet rates. If the server is getting 1000 packets per + # second, then it can only handle 100 PSKs before running out of + # CPU. # - # Using the cache will help substantially. But the cache is - # only in memory, which means that all cache entries are lost - # when the server restarts. As a result, the combination of - # number of PSKs and packet rates should be kept as low as - # possible. + # Using the cache will help substantially. But the cache is only in + # memory, which means that all cache entries are lost when the + # server restarts. As a result, the combination of number of PSKs + # and packet rates should be kept as low as possible. # - # The filename is dynamically expanded, so it can reference - # other attributes. This expansion lets you split up DPSK - # files by location, which can drastically reduce the overall - # search space, and thus the CPU requirements. + # The filename is dynamically expanded, so it can reference other + # attributes. This expansion lets you split up DPSK files by + # location, which can drastically reduce the overall search space, + # and thus the CPU requirements. # # filename = "${modconfdir}/${.:name}/psk.csv" # # pre_shared_key:: # - # Attribute containing the PSK for the user, as retrieved from - # a data store + # Attribute containing the PSK for the user, as retrieved from a + # data store # # pre_shared_key = control.Pre-Shared-Key @@ -223,8 +227,8 @@ dpsk { # # pairwise_master_key:: # - # Attribute containing the pairwise master key for the user. - # This is used in preference to the PSK if set. + # Attribute containing the pairwise master key for the user. This is + # used in preference to the PSK if set. # # pairwise_master_key = control.Pairwise-Master-Key @@ -253,7 +257,8 @@ dpsk { # # username:: # - # Attribute containing the supplicant MAC address in hex format, e.g. "abcdef012345". + # Attribute containing the supplicant MAC address in hex format, + # e.g. "abcdef012345". # # username = User-name @@ -262,8 +267,8 @@ dpsk { # # Attribute containing the AP MAC in binary # - # Typically this is extracted from Called-Station-Id using a modified version - # of the "rewrite_called_station_id" policy. + # Typically this is extracted from Called-Station-Id using a + # modified version of the "rewrite_called_station_id" policy. # # called_station = Called-Station-MAC diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap index 4d28fd7ea43..45c82c78cf5 100644 --- a/raddb/mods-available/eap +++ b/raddb/mods-available/eap @@ -7,15 +7,16 @@ # # = EAP Module # -# The `eap` module takes care of all EAP authentication as described in RFC 3579. +# The `eap` module takes care of all EAP authentication as described +# in RFC 3579. # # [WARNING] # ==== -# Whatever you do, do NOT set 'Auth-Type := ::EAP'. The server is smart enough -# to figure this out on its own. +# Whatever you do, do NOT set 'Auth-Type := ::EAP'. The server is +# smart enough to figure this out on its own. # -# The most common side effect of setting 'Auth-Type := ::EAP' is that the users -# then cannot use ANY other authentication method. +# The most common side effect of setting 'Auth-Type := ::EAP' is that +# the users then cannot use ANY other authentication method. # ==== # @@ -24,49 +25,51 @@ # eap { # - # require_identity_realm:: Require the EAP Identity provided contains - # a realm. + # require_identity_realm:: Require the EAP Identity provided + # contains a realm. # - # If `require_identity_realm` is `nai`, the EAP identity provided must - # end with `@.[.]`, i.e. an '@' followed by at least - # two DNS labels. + # If `require_identity_realm` is `nai`, the EAP identity provided + # must end with `@.[.]`, i.e. an '@' + # followed by at least two DNS labels. # - # If `require_identity_realm` is `yes`, the EAP identity provided must - # either match the NAI format described above, or a `Stripped-User-Domain` - # attribute must be present in the request list. - # This validation mode is intended to be user where Windows machine - # authentication is intermixed with user authentication. + # If `require_identity_realm` is `yes`, the EAP identity provided + # must either match the NAI format described above, or a + # `Stripped-User-Domain` attribute must be present in the request + # list. This validation mode is intended to be user where Windows + # machine authentication is intermixed with user authentication. # - # If `require_identity_realm` is `no`, no identity format checks are performed. - # It is NOT recommended to use this value. Future security standards will - # key off the NAI realm to validate the certificate we (the EAP server) present. - # If you do not require an NAI realm be present in the EAP identity string, - # your users will not be able to take advantage of this added security when - # it is enabled by OS and device vendors. + # If `require_identity_realm` is `no`, no identity format checks are + # performed. It is NOT recommended to use this value. Future + # security standards will key off the NAI realm to validate the + # certificate we (the EAP server) present. If you do not require an + # NAI realm be present in the EAP identity string, your users will + # not be able to take advantage of this added security when it is + # enabled by OS and device vendors. # # require_identity_realm = nai # - # Session tracking has moved to the `session` section of a virtual server. + # Session tracking has moved to the `session` section of a virtual + # server. # * timer_expire --> timeout # * max_sessions --> max # * dedup_key --> dedup_key # # - # default_eap_type:: The default EAP submodule to invoke when an `EAP-Identity` - # response is received. + # default_eap_type:: The default EAP submodule to invoke when an + # `EAP-Identity` response is received. # - # If a `default_eap_type` value is not provided, enabled EAP submodules will be - # queried to determine if they recognise the provided EAP-Identity. - # If no submodules recognise the identity, the first `type` value listed below - # will be used. + # If a `default_eap_type` value is not provided, enabled EAP + # submodules will be queried to determine if they recognise the + # provided EAP-Identity. If no submodules recognise the identity, + # the first `type` value listed below will be used. # - # If the `control.EAP-Type` attribute is set, then that EAP type takes precedence - # over any configured or inferred EAP-Type. + # If the `control.EAP-Type` attribute is set, then that EAP type + # takes precedence over any configured or inferred EAP-Type. # - # It is generally recommended to NOT set `default_eap_type`, and instead order - # the `type` configuration items appropriately. + # It is generally recommended to NOT set `default_eap_type`, and + # instead order the `type` configuration items appropriately. # # default_eap_type = md5 @@ -74,35 +77,38 @@ eap { # ignore_unknown_eap_types:: # # There are many EAP types, but the server has support for only a - # limited subset. If the server receives a request for an EAP type it - # does not support, then it normally rejects the request. By setting - # this configuration to `yes`, you can tell the server to instead keep - # processing the request. Another module MUST then be configured to - # proxy the request to another RADIUS server which supports that EAP - # type. + # limited subset. If the server receives a request for an EAP type + # it does not support, then it normally rejects the request. By + # setting this configuration to `yes`, you can tell the server to + # instead keep processing the request. Another module MUST then be + # configured to proxy the request to another RADIUS server which + # supports that EAP type. # - # NOTE: If another module is NOT configured to handle the request, then the - # request will still end up being rejected. + # NOTE: If another module is NOT configured to handle the request, + # then the request will still end up being rejected. # ignore_unknown_eap_types = no # # == Allowed EAP-types # - # type:: Only EAP types listed below with a `type = ` pair will be allowed. + # type:: Only EAP types listed below with a `type = ` pair + # will be allowed. # - # In addition, setting `type = md5` will load the configuration section `md5 { ... }`. - # There is no need to "comment out" the entire configuration section for EAP types - # which are not used. Instead, simply comment out or delete the `type = ..` entry - # for that EAP method, and the entire configuration section will be ignored. + # In addition, setting `type = md5` will load the configuration + # section `md5 { ... }`. There is no need to "comment out" the + # entire configuration section for EAP types which are not used. + # Instead, simply comment out or delete the `type = ..` entry for + # that EAP method, and the entire configuration section will be + # ignored. # - # If the `control.EAP-Type` attribute is set, then that is used to form the list of - # allowed EAP types, with the first instance being the default type and others also - # being allowed. + # If the `control.EAP-Type` attribute is set, then that is used to + # form the list of allowed EAP types, with the first instance being + # the default type and others also being allowed. # - # Setting an EAP type in `control.EAP-Type` which is not allowed below, will not have - # any effect, since this list determines which methods are loaded and potentially - # available. + # Setting an EAP type in `control.EAP-Type` which is not allowed + # below, will not have any effect, since this list determines which + # methods are loaded and potentially available. # type = md5 # type = pwd @@ -119,7 +125,7 @@ eap { # === EAP-MD5 # # WARNING: EAP-MD5 authentication cannot be used for wireless - # connections. It is insecure, and does not provide for dynamic WEP + # connections. It is insecure, and does not provide for dynamic WEP # keys or WPA enterprise. # md5 { @@ -128,9 +134,10 @@ eap { # # === EAP-PWD (Secure password-based authentication) # - # In v4, the "known good" password is taken from the `request.control.Password.Cleartext` list, - # as is done by other modules. The change from v3 is that the `inner-tunnel` virtual server - # is not used. + # In v4, the "known good" password is taken from the + # `request.control.Password.Cleartext` list, as is done by other + # modules. The change from v3 is that the `inner-tunnel` virtual + # server is not used. # pwd { group = 19 @@ -146,12 +153,13 @@ eap { # # === Generic Token Card # - # Currently, this is only permitted inside of `EAP-TTLS`, or `EAP-PEAP`. - # The module `challenges` the user with text, and the response from the - # user is taken to be the `User-Password`. + # Currently, this is only permitted inside of `EAP-TTLS`, or + # `EAP-PEAP`. The module `challenges` the user with text, and the + # response from the user is taken to be the `User-Password`. # - # WARNING: Proxying the tunneled `EAP-GTC` session is a bad idea, the users - # password will go over the wire in plain-text, for anyone to see. + # WARNING: Proxying the tunneled `EAP-GTC` session is a bad idea, + # the users password will go over the wire in plain-text, for anyone + # to see. # gtc { # @@ -164,12 +172,12 @@ eap { # # The plain-text response which comes back is put into a # `User-Password` attribute, and passed to another module for - # authentication. This allows the `EAP-GTC` response to be - # checked against plain-text, or crypt'd passwords. + # authentication. This allows the `EAP-GTC` response to be checked + # against plain-text, or crypt'd passwords. # - # If you say "Local" instead of "PAP", then the module will - # look for a `User-Password` configured for the request, and do - # the authentication itself. + # If you say "Local" instead of "PAP", then the module will look + # for a `User-Password` configured for the request, and do the + # authentication itself. # auth_type = PAP } @@ -179,12 +187,12 @@ eap { # # See `certs/index.adoc` for additional comments on certificates. # - # If OpenSSL was not found at the time the server was built, the `tls`, - # `ttls`, and `peap` sections will be ignored. + # If OpenSSL was not found at the time the server was built, the + # `tls`, `ttls`, and `peap` sections will be ignored. # - # If you do not currently have certificates signed by a trusted CA you - # may use the 'snakeoil' certificates. Included with the server in - # `certs`. + # If you do not currently have certificates signed by a trusted CA + # you may use the 'snakeoil' certificates. Included with the server + # in `certs`. # # If these certificates have not been auto-generated: # @@ -192,21 +200,20 @@ eap { # make # # These test certificates *SHOULD NOT* be used in a normal - # deployment. They are created only to make it easier to - # install the server, and to perform some simple tests with - # EAP-TLS, TTLS, or PEAP. + # deployment. They are created only to make it easier to install the + # server, and to perform some simple tests with EAP-TLS, TTLS, or + # PEAP. # - # Note that you should NOT use a globally known CA here! - # e.g. using a Verisign cert as a "known CA" means that - # ANYONE who has a certificate signed by them may be able to - # authenticate via EAP-TLS! This is likely not what you - # want. + # Note that you should NOT use a globally known CA here! e.g. using + # a Verisign cert as a "known CA" means that ANYONE who has a + # certificate signed by them may be able to authenticate via + # EAP-TLS! This is likely not what you want. # # # [NOTE] # ==== # As of 4.0 the following TLS config items/config sections have been - # removed. Equivalent functionality is available. + # removed. Equivalent functionality is available. # ==== # # [options="header,autowidth"] @@ -231,16 +238,17 @@ eap { # tls-config tls-common { # - # virtual_server:: The virtual server used for checking and saving TLS data. + # virtual_server:: The virtual server used for checking and saving + # TLS data. # - # When the module receives certificate checks and stateful - # session resumption requests, that information will be passed - # through a virtual server. This virtual server typically runs - # policies which verifies the certificate, or loads / stores - # session resumption data. + # When the module receives certificate checks and stateful session + # resumption requests, that information will be passed through a + # virtual server. This virtual server typically runs policies which + # verifies the certificate, or loads / stores session resumption + # data. # - # The virtual server must specify `namespace = tls`, and may contain - # the following sections: + # The virtual server must specify `namespace = tls`, and may + # contain the following sections: # # [options="header,autowidth"] # |=== @@ -262,17 +270,17 @@ eap { # | Gather stapling information for one or more of our certificates. # |=== # - # More information about the various sections can be found in the virtual server - # `sites-available/tls-session`. + # More information about the various sections can be found in the + # virtual server `sites-available/tls-session`. # # virtual_server = tls-session # auto_chain:: # - # OpenSSL will automatically create certificate chains, unless - # we tell it to not do that. The problem is that it sometimes - # gets the chains right from a certificate signature view, but - # wrong from the clients view. + # OpenSSL will automatically create certificate chains, unless we + # tell it to not do that. The problem is that it sometimes gets the + # chains right from a certificate signature view, but wrong from + # the clients view. # # NOTE: When setting `auto_chain = no`, the server `chain {}` # section(s) below MUST include the full certificate chain. @@ -285,29 +293,29 @@ eap { # Multiple chain sections can be specified to allow different # chains for different key types (RSA, DSA, DH, EC). # - # If multiple chains for the same key type are specified - # the last chain to be processed will be used for that - # key type. + # If multiple chains for the same key type are specified the last + # chain to be processed will be used for that key type. # - # WARNING: The server automatically selects a chain based on - # the cipher agreed by the client and server. For example, if - # the client includes ECC ciphers in its request, but the - # server only has an RSA certificate, then the authentication - # is likely to fail. i.e. The client is asking the server to - # use an ECC cipher and ECC certificate, but the server has no - # ECC certificate available. + # WARNING: The server automatically selects a chain based on the + # cipher agreed by the client and server. For example, if the + # client includes ECC ciphers in its request, but the server only + # has an RSA certificate, then the authentication is likely to + # fail. i.e. The client is asking the server to use an ECC cipher + # and ECC certificate, but the server has no ECC certificate + # available. # - # The key type does not need to be explicitly specified as - # it is determined from the provided certificate. + # The key type does not need to be explicitly specified as it is + # determined from the provided certificate. # chain rsa { # # format:: The format of the certificate(s) and private key file. # - # May be one of `PEM`, `DER` or `ASN1` (ASN1 is an alias for `DER`). + # May be one of `PEM`, `DER` or `ASN1` (ASN1 is an alias for + # `DER`). # - # Most Linux systems use PEM format. Windows and other - # systems usually use DER. + # Most Linux systems use PEM format. Windows and other systems + # usually use DER. # # format = "PEM" @@ -315,69 +323,63 @@ eap { # certificate_file:: File which contains the certificate presented # as the "server certificate" to the client. # - # If the PEM format is used, the `certificate_file` - # should contain the server certificates, along with - # any intermediate CAs up to the root CA. The client - # is not normally configured with the intermediate CAs, - # but it needs them to verify the server certificate. - # The server therefore has to supply the intermediate + # If the PEM format is used, the `certificate_file` should contain + # the server certificates, along with any intermediate CAs up to + # the root CA. The client is not normally configured with the + # intermediate CAs, but it needs them to verify the server + # certificate. The server therefore has to supply the intermediate # CAs to the client during the authentication process. # # [NOTE] # ==== - # If `verify_mode` (below) is set to `hard` or `soft` - # all intermediary CAs and the Root CA need to be - # included in the `certificate_file`. - # - # If the file includes multiple certificates, they MUST - # be listedin order from server certificate (first in - # the file) to intermediary CAs (second) to Root CA - # (last in the file) as per RFC 4346 Section 7.4.2 (see - # certificate_list) - # - # If the DER format is used, the `certificate_file` - # should contain ONLY the server's certificate. One - # or more `ca_file` items should be used to load - # the intermediate CAs and the Root CA. + # If `verify_mode` (below) is set to `hard` or `soft` all + # intermediary CAs and the Root CA need to be included in the + # `certificate_file`. + # + # If the file includes multiple certificates, they MUST be + # listedin order from server certificate (first in the file) to + # intermediary CAs (second) to Root CA (last in the file) as per + # RFC 4346 Section 7.4.2 (see certificate_list) + # + # If the DER format is used, the `certificate_file` should contain + # ONLY the server's certificate. One or more `ca_file` items + # should be used to load the intermediate CAs and the Root CA. # ==== # - # We recommend using `ca_file` to load the - # root CAs, instead of putting them in the - # `certificate_file`. + # We recommend using `ca_file` to load the root CAs, instead of + # putting them in the `certificate_file`. # certificate_file = ${certdir}/rsa/server.pem # - # ca_file:: File which contains the root CA. + # ca_file:: File which contains the root CA. # - # This configuration item allows the server to load - # additional intermediate CA or Root CA when creating - # certificate chains. Multiple "ca_file" - # configurations items may be specified in order to - # load multiple certificates. + # This configuration item allows the server to load additional + # intermediate CA or Root CA when creating certificate chains. + # Multiple "ca_file" configurations items may be specified in + # order to load multiple certificates. # - # When multiple `ca_file` entries are used, the server - # will still present only one server certificate (from - # `certificate_file`) to the clients. The main use for - # multiple `ca_file` entries is to permit the use of - # EAP-TLS with client certificates from multiple Root - # CAs. + # When multiple `ca_file` entries are used, the server will still + # present only one server certificate (from `certificate_file`) to + # the clients. The main use for multiple `ca_file` entries is to + # permit the use of EAP-TLS with client certificates from multiple + # Root CAs. # - # If the root CA does not issue client certificates, or - # if only one root CA is, then the `ca_file` - # configuration can be commented out (at least when PEM - # format is used). + # If the root CA does not issue client certificates, or if only + # one root CA is, then the `ca_file` configuration can be + # commented out (at least when PEM format is used). # ca_file = ${certdir}/rsa/ca.pem # - # private_key_password:: The password which is used to encrypt the private key. + # private_key_password:: The password which is used to encrypt the + # private key. # # If the private key is not encrypted, this configuration item # will have no effect. # - # In general, there is little security benefit in - # encrypting the `private_key_file` with a password. + # In general, there is little security benefit in encrypting the + # `private_key_file` with a password. # private_key_password = whatever @@ -393,9 +395,9 @@ eap { # # verify_mode:: How we verify the certificate chain. # - # During startup the server attempts to precompile the certificate chain - # from server certificate to Root CA. This configuration item specifies - # what happens if compilation fails. + # During startup the server attempts to precompile the certificate + # chain from server certificate to Root CA. This configuration + # item specifies what happens if compilation fails. # # [options="header,autowidth"] # |=== @@ -405,8 +407,8 @@ eap { # | none | Stay silent if we cannot build a complete certificate chain. # |=== # - # The default is `hard`. The only time this should be changed is if - # you want to limit the number of intermediary CAs sent to the + # The default is `hard`. The only time this should be changed is + # if you want to limit the number of intermediary CAs sent to the # client by not including them in the chain. # # [NOTE] @@ -415,8 +417,8 @@ eap { # build a complete chain, but this will be done at runtime. # # * `auto_chain` has no effect on which certificates are considered - # for pre-compilation. Only those listed in this `chain {}` section - # will be used. + # for pre-compilation. Only those listed in this `chain {}` + # section will be used. # ==== # # verify_mode = "hard" @@ -425,11 +427,12 @@ eap { # include_root_ca:: Whether or not the root CA is included in the # certificate chain. # - # The Root CA should already be known/trusted by the client so it is - # usually not needed unless the client is particularly poorly behaved. + # The Root CA should already be known/trusted by the client so it + # is usually not needed unless the client is particularly poorly + # behaved. # - # NOTE: The Root CA must still be available for creating certificate chains to - # succeed even if `include_root_ca = no`. + # NOTE: The Root CA must still be available for creating + # certificate chains to succeed even if `include_root_ca = no`. # # Default value is `no`. # @@ -441,45 +444,41 @@ eap { # # This is disabled by default, see the warning above. # - # If your supplicants propose a mix of different - # types of ciphers _and_ have all of the CA keys for - # each type of certificate, then multiple chains can be - # enabled simultaneously. + # If your supplicants propose a mix of different types of ciphers + # _and_ have all of the CA keys for each type of certificate, then + # multiple chains can be enabled simultaneously. # -# chain ecc { + # chain ecc { # certificate_file = ${certdir}/ecc/server.pem # ca_file = ${certdir}/ecc/ca.pem # private_key_password = whatever # private_key_file = ${certdir}/ecc/server.key -# } + # } # # == Server certificate # - # The server certificate may also be specified at - # runtime on a per session basis. In that use-case, - # the certificate file must consist of the - # certificate and private key, PEM encoded. The - # password should either be set above with - # `password`, or the certificate should have no - # password. + # The server certificate may also be specified at runtime on a per + # session basis. In that use-case, the certificate file must + # consist of the certificate and private key, PEM encoded. The + # password should either be set above with `password`, or the + # certificate should have no password. # # The file should be provided as the attribute: # # control.TLS-Session-Cert-File # - # If there are any errors loading or verifying the - # certificate, then authentication will fail. + # If there are any errors loading or verifying the certificate, + # then authentication will fail. # - # This configuration can be used to periodically - # verify correct supplicant behaviour, by presenting - # an untrusted or invalid server certificate and - # verifying that the supplicant returns the correct - # TLS alert (available in Module-Failure-Message). + # This configuration can be used to periodically verify correct + # supplicant behaviour, by presenting an untrusted or invalid + # server certificate and verifying that the supplicant returns the + # correct TLS alert (available in Module-Failure-Message). # - # NOTE: After receiving a fatal alert, TLS negotiation - # cannot continue, but as most supplicants will retry - # enthusiastically, so this probably won't be an issue. + # NOTE: After receiving a fatal alert, TLS negotiation cannot + # continue, but as most supplicants will retry enthusiastically, so + # this probably won't be an issue. # # @@ -488,87 +487,85 @@ eap { # ALL of the CA's in this list will be trusted to issue client # certificates for authentication. # - # NOTE: You should not use a public CA here. This should either be - # set to a certificate chain for your institution's CA, - # or to a self signed Root CA. + # NOTE: You should not use a public CA here. This should either be + # set to a certificate chain for your institution's CA, or to a + # self signed Root CA. # ca_file = ${cadir}/rsa/ca.pem # # psk_identity:: Default identity to present for PSK. # - # If OpenSSL supports TLS-PSK, then we can use a PSK identity - # and (hex) password. + # If OpenSSL supports TLS-PSK, then we can use a PSK identity and + # (hex) password. # - # If using a fixed identity, it must be the same on - # the client. The passphrase must be a hex value, - # and can be up to 256 hex characters. + # If using a fixed identity, it must be the same on the client. The + # passphrase must be a hex value, and can be up to 256 hex + # characters. # # psk_identity = "test" # psk_hexphrase = "036363823" # - # WARNING: Dynamic queries for the `PSK`. If `TLS-PSK` is used, - # and `psk_query` is set, then you MUST NOT use - # `psk_identity` or `psk_hexphrase`. + # WARNING: Dynamic queries for the `PSK`. If `TLS-PSK` is used, and + # `psk_query` is set, then you MUST NOT use `psk_identity` or + # `psk_hexphrase`. # # # psk_query:: Dynamically obtain the PSK from a query. # - # Instead, use a dynamic expansion similar to the one - # below. It keys off of TLS-PSK-Identity. It should - # return a of string no more than 512 hex characters. - # That string will be converted to binary, and will - # be used as the dynamic PSK hexphrase. + # Instead, use a dynamic expansion similar to the one below. It + # keys off of TLS-PSK-Identity. It should return a of string no + # more than 512 hex characters. That string will be converted to + # binary, and will be used as the dynamic PSK hexphrase. # - # Note that this query is just an example. You will - # need to customize it for your installation. + # Note that this query is just an example. You will need to + # customize it for your installation. # # psk_query = "%sql(select hex(key) from psk_keys where keyid = '%{TLS-PSK-Identity}')" # # cipher_suites:: TLS 1.3 cipher suites. # - # For TLS-PSK, uncomment the following line to use - # standard ciphers for TLS 1.3. + # For TLS-PSK, uncomment the following line to use standard ciphers + # for TLS 1.3. # - # TLS-PSK may work without this line, but it is - # likely to not work when the "next hop" home_server - # accepts both certificates and PSK. OpenSSL will - # negotiate cipher suites which are incompatible with - # PSK, and then fail. + # TLS-PSK may work without this line, but it is likely to not work + # when the "next hop" home_server accepts both certificates and + # PSK. OpenSSL will negotiate cipher suites which are incompatible + # with PSK, and then fail. # # Setting the `cipher_suites` here forces PSK to be negotiated. # # cipher_suites = "TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256" # - # You can create the DH parameters by running the - # following command: + # You can create the DH parameters by running the following + # command: # - # openssl dhparam -out certs/dh 2048 + # openssl dhparam -out certs/dh 2048 # # The DH parameters will usually be ignored in FIPS mode. # - # If this file isn't specified, then OpenSSL will - # automatically set the correct DH parameters. + # If this file isn't specified, then OpenSSL will automatically set + # the correct DH parameters. # # dh_file = ${certdir}/dh # # fragment_size:: Limit for size of EAP fragments. # - # This can never exceed the size of a RADIUS packet (4096 - # bytes), and is preferably less than half of that, to leave - # room for other attributes in RADIUS packet. In most cases, - # the maximum EAP packet length is limited to the Ethernet MTU, - # which between `1500 - 1600` bytes. + # This can never exceed the size of a RADIUS packet (4096 bytes), + # and is preferably less than half of that, to leave room for other + # attributes in RADIUS packet. In most cases, the maximum EAP + # packet length is limited to the Ethernet MTU, which between `1500 + # - 1600` bytes. # - # In these cases, fragment size should be `1024` or less. Note - # also that the EAP RFCs say that EAP implementations MUST use - # fragments of at least 1020 bytes! Many implementations will - # work with smaller values, but it is not guaranteed. + # In these cases, fragment size should be `1024` or less. Note also + # that the EAP RFCs say that EAP implementations MUST use fragments + # of at least 1020 bytes! Many implementations will work with + # smaller values, but it is not guaranteed. # # fragment_size = 1024 @@ -576,18 +573,18 @@ eap { # ca_path:: Directory where additional CAs are located. # # After placing files in this directory, the OpenSSL command - # `c_rehash` should be used to update the local files used by OpenSSL. + # `c_rehash` should be used to update the local files used by + # OpenSSL. # - # Most systems will only use one server certificate, - # and one root CA. Where client certificates are - # used, they are usually also issued from that same - # root CA. In which case the `ca_path` configuration - # is not necessary. All certificates can be placed + # Most systems will only use one server certificate, and one root + # CA. Where client certificates are used, they are usually also + # issued from that same root CA. In which case the `ca_path` + # configuration is not necessary. All certificates can be placed # into the file which is configured in `certificate_file`. # - # The main reason to use multiple `ca_file` entries, - # or the `ca_path` configuration, is when the server - # is expected to authenticate client certificates issued by multiple CAs. + # The main reason to use multiple `ca_file` entries, or the + # `ca_path` configuration, is when the server is expected to + # authenticate client certificates issued by multiple CAs. # ca_path = ${cadir} @@ -606,8 +603,8 @@ eap { # If enabled, OpenSSL will use the server cipher list (possibly # defined by the `cipher_list` option above) for choosing right # cipher suite, instead of using the client-specified list which is - # OpenSSl default behavior. Having it set to 'yes' is best - # practice for TLS. + # OpenSSl default behavior. Having it set to 'yes' is best practice + # for TLS. # cipher_server_preference = yes @@ -630,13 +627,11 @@ eap { # # [NOTE] # ==== - # Prevents versions < tls_min_version from being negotiated. - # In general the higher the tls_min_version the more secure - # the protocol, but the narrower the range of supported TLS - # clients. + # Prevents versions < tls_min_version from being negotiated. In + # general the higher the tls_min_version the more secure the + # protocol, but the narrower the range of supported TLS clients. # - # SSLv2 and SSLv3 are permanently disabled due to security - # issues. + # SSLv2 and SSLv3 are permanently disabled due to security issues. # ==== # # tls_min_version = 1.2 @@ -655,11 +650,11 @@ eap { # # client_hello_parse:: Extract attributes from TLS Client Hello # - # For logging / diagnostics it can be beneficial to extract - # data from the TLS Client Hello. + # For logging / diagnostics it can be beneficial to extract data + # from the TLS Client Hello. # - # These are placed in `session-state` so that they are - # accessible throughout the authentication process. + # These are placed in `session-state` so that they are accessible + # throughout the authentication process. # # client_hello_parse = no @@ -667,30 +662,27 @@ eap { # verify:: Parameters for controlling client cert chain # verification. # - # Certificate verification is performed in two phases. - # The first is handled by the SSL library which checks - # whether a trusted chain of certificates can be built - # between the certificates loaded from `ca_file` or - # found in `ca_path`. + # Certificate verification is performed in two phases. The first is + # handled by the SSL library which checks whether a trusted chain + # of certificates can be built between the certificates loaded from + # `ca_file` or found in `ca_path`. # - # The second (optional) phase is performed using the - # `verify * { ... }` sections of the tls - # `virtual_server`. + # The second (optional) phase is performed using the `verify * { + # ... }` sections of the tls `virtual_server`. # verify { # - # mode:: Which certificates in the verification chain - # should be checked. + # mode:: Which certificates in the verification chain should be + # checked. # - # Certificate verification is performed in two phases. - # The first is handled by the SSL library which checks - # whether a trusted chain of certificates can be built - # between the certificates loaded from `ca_file` or - # found in `ca_path`. + # Certificate verification is performed in two phases. The first + # is handled by the SSL library which checks whether a trusted + # chain of certificates can be built between the certificates + # loaded from `ca_file` or found in `ca_path`. # - # The SSL library also checks that the correct usage - # OIDs are present in the presented client certificate - # and that none of the certificates have expired. + # The SSL library also checks that the correct usage OIDs are + # present in the presented client certificate and that none of the + # certificates have expired. # # [options="header,autowidth"] # |=== @@ -714,22 +706,20 @@ eap { # | Only verify the client certificate. # |=== # - # It is recommended to leave mode as `all` except - # when debugging, or in an emergency situation. + # It is recommended to leave mode as `all` except when debugging, + # or in an emergency situation. # # mode = all # - # attribute_mode:: Which client certificates should - # be converted to attributes for use in the - # `verify * { ... }` sections of the specified - # `virtual_server`. + # attribute_mode:: Which client certificates should be converted + # to attributes for use in the `verify * { ... }` sections of the + # specified `virtual_server`. # - # Attributes created during certificate processing - # will be placed in the `session-state` list. - # This is to simplify session-resumption, as the - # contents of this list also contains session data - # for stateful resumption, and this list is encoded + # Attributes created during certificate processing will be placed + # in the `session-state` list. This is to simplify + # session-resumption, as the contents of this list also contains + # session data for stateful resumption, and this list is encoded # in the session-ticket for stateless resumption. # # [options="header,autowidth"] @@ -759,14 +749,12 @@ eap { # # [NOTE] # ==== - # Attribute generation is only performed on full - # handshake, or where we detect that attributes - # are missing from the `session-state` list during - # stateful session-resumption. - # - # Certificate attributes will usually be retrieved - # from the session-ticket in the case of - # stateless session-resumption. + # Attribute generation is only performed on full handshake, or + # where we detect that attributes are missing from the + # `session-state` list during stateful session-resumption. + # + # Certificate attributes will usually be retrieved from the + # session-ticket in the case of stateless session-resumption. # ==== # # attribute_mode = client-and-issuer @@ -774,52 +762,51 @@ eap { # # === TLS Session resumption # - # Once authentication has completed, the TLS client may be - # provided with a session ticket which it presents - # during the next authentication attempt. + # Once authentication has completed, the TLS client may be provided + # with a session ticket which it presents during the next + # authentication attempt. # # Presenting a session ticket allows the client to skip the # majority of TLS tunnel setup during its next authentication - # session. It also means that any "inner" authentication is - # skipped, which means that any "inner" policies need to be - # cached. + # session. It also means that any "inner" authentication is + # skipped, which means that any "inner" policies need to be cached. # # Enabling `Session-Resumption` is highly recommended for sites # using slow authentication backends such as winbindd/Active # Directory, and for access federations operating over the # internet, such as Eduroam. # - # For EAP-TLS, the server also caches the client certificate, - # as it is not supplied during session resumption. Caching the - # client certificate allows the server to re-apply policy rules - # for the client certificate, along with certificate expiry time. + # For EAP-TLS, the server also caches the client certificate, as it + # is not supplied during session resumption. Caching the client + # certificate allows the server to re-apply policy rules for the + # client certificate, along with certificate expiry time. # # Many of the configuration items in this section increase - # security, but are disabled by default. The intent is to - # allow the server to work in the widest possible - # circumstances, while still being reasonably secure. In the - # most common case (single EAP module, single server - # certificate), this configuration is acceptable. + # security, but are disabled by default. The intent is to allow the + # server to work in the widest possible circumstances, while still + # being reasonably secure. In the most common case (single EAP + # module, single server certificate), this configuration is + # acceptable. # # However, we still recommend enabling all of the security - # configurations below. If enabling them does not cause an - # issue in your environment, then there is no cost to leaving - # them enabled. They should only be disabled if clients are - # unable to connect when the configurations are enabled. + # configurations below. If enabling them does not cause an issue in + # your environment, then there is no cost to leaving them enabled. + # They should only be disabled if clients are unable to connect + # when the configurations are enabled. # # [NOTE] # ==== - # You must ensure that any attributes required for policy - # decisions are cached along with the TLS session - # data. This is usually done by placing policy attributes in the - # `session-state` list, or in the case of EAP-PEAP, EAP-TTLS and - # EAP-FAST, the `parent.session-state` list (i.e. in the request - # which sets up the TLS part of the authentication attempt). - # - # Caching this data means that the policies are cached at the - # same time as, and along with the session resumption data. In - # most cases, it is sufficient to cache the name of a policy, - # so that the named policy can be re-applied on session resumption. + # You must ensure that any attributes required for policy decisions + # are cached along with the TLS session data. This is usually done + # by placing policy attributes in the `session-state` list, or in + # the case of EAP-PEAP, EAP-TTLS and EAP-FAST, the + # `parent.session-state` list (i.e. in the request which sets up + # the TLS part of the authentication attempt). + # + # Caching this data means that the policies are cached at the same + # time as, and along with the session resumption data. In most + # cases, it is sufficient to cache the name of a policy, so that + # the named policy can be re-applied on session resumption. # ==== # session { @@ -859,54 +846,52 @@ eap { # It is recommended to set `mode = auto` *and* to provide a # correctly configured `virtual_server`. # - # Some clients such as wpa_supplicant do not allow - # session tickets by default for TLS < 1.3. + # Some clients such as wpa_supplicant do not allow session tickets + # by default for TLS < 1.3. # # mode = auto # name:: Name of the context used for TLS sessions. # - # This name associates the TLS sessions with a - # "namespace" so that they cannot be used for purposes - # other than the original (intended) use-case. This - # configuration helps to prevent accidental "leakage" - # of session tickes. For example, if the server uses - # multiple server certs, an attacker could try to get a - # session ticket for one server identity, and then - # resume the session for a different server identity. - # Using a session ticket "namespace" makes these - # attacks impossible. - # - # If you wish to share session resumption data between - # multiple EAP modules or virtual servers, they must - # all use the same `name`. + # This name associates the TLS sessions with a "namespace" so that + # they cannot be used for purposes other than the original + # (intended) use-case. This configuration helps to prevent + # accidental "leakage" of session tickes. For example, if the + # server uses multiple server certs, an attacker could try to get + # a session ticket for one server identity, and then resume the + # session for a different server identity. Using a session ticket + # "namespace" makes these attacks impossible. + # + # If you wish to share session resumption data between multiple + # EAP modules or virtual servers, they must all use the same + # `name`. # # To disable - set to a zero length string "". # - # NOTE: OpenSSL only allows 32 bytes of session ctx, so - # the value provided here is first hashed with SHA256 - # before being passed to OpenSSL. + # NOTE: OpenSSL only allows 32 bytes of session ctx, so the value + # provided here is first hashed with SHA256 before being passed to + # OpenSSL. # # name = "%{EAP-Type}%interpreter('server')" # - # lifetime:: The period for which a resumable session remains valid. + # lifetime:: The period for which a resumable session remains + # valid. # - # Default is 24hrs in line with RFC 4346. RFC 8446 - # requires that ticket lifetimes must not be more than - # 7 days. + # Default is 24hrs in line with RFC 4346. RFC 8446 requires that + # ticket lifetimes must not be more than 7 days. # # lifetime = 86400 # - # require_extended_master_secret:: Only allow session - # resumption if an extended master secret has been - # created. This requires client support. + # require_extended_master_secret:: Only allow session resumption + # if an extended master secret has been created. This requires + # client support. # - # Extended Master Secrets (RFC 7627) are required to - # prevent MITM attacks, where the attacker can resume - # a session if it can insert itself into the path between - # the TLS client and TLS server. + # Extended Master Secrets (RFC 7627) are required to prevent MITM + # attacks, where the attacker can resume a session if it can + # insert itself into the path between the TLS client and TLS + # server. # # See more at https://mitls.org/pages/attacks/3SHAKE # @@ -915,41 +900,38 @@ eap { # require_extended_master_secret = yes # - # require_perfect_forward_secrecy:: Only allow session - # resumption if a cipher which would allow perfect - # forward secrecy has been selected. + # require_perfect_forward_secrecy:: Only allow session resumption + # if a cipher which would allow perfect forward secrecy has been + # selected. # # require_perfect_forward_secrecy = no # - # session_ticket_key:: Key used to encrypt stateless - # session tickets. + # session_ticket_key:: Key used to encrypt stateless session + # tickets. # - # Sets a persistent key used to encrypt stateless session - # tickets. If this is not set, then a random key will be - # chosen when the server starts. + # Sets a persistent key used to encrypt stateless session tickets. + # If this is not set, then a random key will be chosen when the + # server starts. # - # Where a site has multiple RADIUS servers, it is - # useful for them to share a common value for the - # `session_ticket_key`. That way a client can - # authenticate against one server, get a session - # ticket, and then have that session ticket validated - # by a different server. Such a configuration has - # significant positive effects for increasing uptime, - # and decreasing server load. + # Where a site has multiple RADIUS servers, it is useful for them + # to share a common value for the `session_ticket_key`. That way a + # client can authenticate against one server, get a session + # ticket, and then have that session ticket validated by a + # different server. Such a configuration has significant positive + # effects for increasing uptime, and decreasing server load. # - # As the key length used by OpenSSL depends on the - # version/flavour of OpenSSL being used, the value - # provided is fed into a HKDF function (SHA256 of the - # key plus "freeradius-session-ticket"). The output of - # the HKDF is then used as input to the OpenSSL keying - # function. + # As the key length used by OpenSSL depends on the version/flavour + # of OpenSSL being used, the value provided is fed into a HKDF + # function (SHA256 of the key plus "freeradius-session-ticket"). + # The output of the HKDF is then used as input to the OpenSSL + # keying function. # - # It is important that a strong key is chosen here. If the - # key were ever revealed, then an attacker could manipulate - # the contents of a session ticket. This could in turn - # allow privilege escalation, or if OpenSSL's ticket parsing - # code is less than perfect, buffer overflow attacks. + # It is important that a strong key is chosen here. If the key + # were ever revealed, then an attacker could manipulate the + # contents of a session ticket. This could in turn allow privilege + # escalation, or if OpenSSL's ticket parsing code is less than + # perfect, buffer overflow attacks. # # session_ticket_key = "super-secret-key" @@ -959,11 +941,11 @@ eap { # As of 4.0 OpenSSL's internal cache has been disabled due to # scoping/threading issues. # - # The following configuration options are no longer - # supported. TLS session caching is now handled by - # FreeRADIUS either using session-tickets (stateless), - # or using TLS `virtual_server` and storing/retrieving - # sessions to/from an external datastore (stateful). + # The following configuration options are no longer supported. TLS + # session caching is now handled by FreeRADIUS either using + # session-tickets (stateless), or using TLS `virtual_server` and + # storing/retrieving sessions to/from an external datastore + # (stateful). # # * `enable` # * `persist_dir` @@ -976,8 +958,8 @@ eap { # # === EAP-TLS # - # The common TLS configuration for TLS-based EAP types is given above - # in the `tls-config { ... }` section. + # The common TLS configuration for TLS-based EAP types is given + # above in the `tls-config { ... }` section. # tls { # Point to the common TLS configuration @@ -989,11 +971,11 @@ eap { # `EAP-TLS` can work without a client certificate, but situations # whether this is useful are quite limited. # - # Currently only the Hotspot 2.0 R2 standard uses `EAP-TLS` - # without a peer certificate. + # Currently only the Hotspot 2.0 R2 standard uses `EAP-TLS` without + # a peer certificate. # - # This is to secure the SSID used to provide connectivity to the OSU - # (Online Signup Server). + # This is to secure the SSID used to provide connectivity to the + # OSU (Online Signup Server). # # You can override this configuration item at run-time by setting: # @@ -1002,16 +984,17 @@ eap { # require_client_cert = yes # - # include_length:: Whether we include a length field in the TLS header. + # include_length:: Whether we include a length field in the TLS + # header. # - # If set to `yes`, the total length of the message is included - # in every packet we send. If set to `no`, the total length of - # the message is included only in the First packet of a - # fragment series. + # If set to `yes`, the total length of the message is included in + # every packet we send. If set to `no`, the total length of the + # message is included only in the First packet of a fragment + # series. # - # This configuration item is here only to work around - # historical issues with misbehaving clients. In most cases, - # it does not need to be changed. + # This configuration item is here only to work around historical + # issues with misbehaving clients. In most cases, it does not need + # to be changed. # # include_length = yes } @@ -1023,22 +1006,23 @@ eap { # described as EAP inside of Diameter, inside of TLS, inside of EAP, # inside of RADIUS. # - # NOTE: To use `EAP-TTLS `you must also configure an `inner` method in - # `mods-enabled/eap_inner`. + # NOTE: To use `EAP-TTLS `you must also configure an `inner` method + # in `mods-enabled/eap_inner`. # # Surprisingly, it works quite well. # - # When using `PAP`, `GTC`, or `MSCHAPv2` as an inner method, `EAP-TTLS` - # is only secure if the supplicant validates the server certificate - # presented. If the client disables certificate validation, then an - # attacker can pretend to be the server, and collect user credentials. + # When using `PAP`, `GTC`, or `MSCHAPv2` as an inner method, + # `EAP-TTLS` is only secure if the supplicant validates the server + # certificate presented. If the client disables certificate + # validation, then an attacker can pretend to be the server, and + # collect user credentials. # ttls { # - # tls:: Point to the common TLS configuration + # tls:: Point to the common TLS configuration # - # Which `tls-config` section the TLS negotiation parameters - # are in - see `EAP-TLS` above for an explanation. + # Which `tls-config` section the TLS negotiation parameters are in + # - see `EAP-TLS` above for an explanation. # tls = tls-common @@ -1049,45 +1033,45 @@ eap { # removed in v4.0. # # See the new policy `copy_request_to_tunnel` in - # `sites-available/inner-tunnel`, and in `policy.d/eap` for - # more information. + # `sites-available/inner-tunnel`, and in `policy.d/eap` for more + # information. # ==== # # - # virtual_server:: The virtual server used for "inner" authentication. + # virtual_server:: The virtual server used for "inner" + # authentication. # - # The inner tunneled request can be sent through a virtual - # server which verifies the inner credentials. + # The inner tunneled request can be sent through a virtual server + # which verifies the inner credentials. # - # If this entry is commented out, the inner tunneled request - # will be sent through the virtual server which processed the - # outer request. This configuration is NOT RECOMMENDED. + # If this entry is commented out, the inner tunneled request will + # be sent through the virtual server which processed the outer + # request. This configuration is NOT RECOMMENDED. # virtual_server = "inner-tunnel" # - # include_length:: Whether we include a length field in the TLS header. + # include_length:: Whether we include a length field in the TLS + # header. # - # This has the same meaning, and overwrites, the same field in - # the `tls` configuration, above. The default value here is - # `yes`. + # This has the same meaning, and overwrites, the same field in the + # `tls` configuration, above. The default value here is `yes`. # # include_length = yes # # require_client_cert:: Whether we require a client certificate. # - # `EAP-TTLS` does not require a client certificate. - # However, you can require one by setting the - # following option. You can also override this option by - # setting: + # `EAP-TTLS` does not require a client certificate. However, you + # can require one by setting the following option. You can also + # override this option by setting: # # control.EAP-TLS-Require-Client-Cert = Yes # - # NOTE: The majority of supplicants do not support using a - # client certificate with `EAP-TTLS`, so this option is unlikely - # to be useful for most people. + # NOTE: The majority of supplicants do not support using a client + # certificate with `EAP-TTLS`, so this option is unlikely to be + # useful for most people. # # require_client_cert = yes } @@ -1095,30 +1079,31 @@ eap { # # === EAP-PEAP # - # The tunneled `EAP` session needs a default `EAP` type which is separate - # from the one for the non-tunneled EAP module. Inside of the TLS/PEAP - # tunnel, we recommend using `EAP-MS-CHAPv2`. + # The tunneled `EAP` session needs a default `EAP` type which is + # separate from the one for the non-tunneled EAP module. Inside of + # the TLS/PEAP tunnel, we recommend using `EAP-MS-CHAPv2`. # # When using `GTC`, or `MSCHAPv2` as an inner method, `PEAP` is only # secure if the supplicant is configured to validate the server - # certificate. See the comments above for EAP-TTLS about this topic. + # certificate. See the comments above for EAP-TTLS about this topic. # # ==== Windows compatibility # # [IMPORTANT] # ==== # * If you see the server send an `Access-Challenge`, and the client never - # sends another `Access-Request`, then *STOP*! + # sends another `Access-Request`, then *STOP*! # # * The server certificate has to have special OID's in it, or else the - # Microsoft clients will silently fail. See the `scripts/xpextensions` - # file for details, and the following page + # Microsoft clients will silently fail. See the + # `scripts/xpextensions` file for details, and the following page # http://support.microsoft.com/kb/814394/en-us # # * If is still doesn't work, and you're using Samba, you may be # encountering a Samba bug. # - # For further information, see https://bugzilla.samba.org/show_bug.cgi?id=6563 + # For further information, see + # https://bugzilla.samba.org/show_bug.cgi?id=6563 # # * Note that we do not necessarily agree with their explanation. but # the fix does appear to work. @@ -1129,20 +1114,21 @@ eap { # peap { # - # tls:: Point to the common TLS configuration + # tls:: Point to the common TLS configuration # - # Which `tls-config` section the TLS negotiation parameters are - # in - see `EAP-TLS` above for an explanation. + # Which `tls-config` section the TLS negotiation parameters are in + # - see `EAP-TLS` above for an explanation. # tls = tls-common # - # default_eap_type:: The default EAP type proposed by the server inside of the tunnel. + # default_eap_type:: The default EAP type proposed by the server + # inside of the tunnel. # # The tunneled EAP session needs a default EAP type which is - # separate from the one for the non-tunneled EAP module. - # Inside of the PEAP tunnel, we recommend using MS-CHAPv2, as - # that is the default type supported by Windows clients. + # separate from the one for the non-tunneled EAP module. Inside of + # the PEAP tunnel, we recommend using MS-CHAPv2, as that is the + # default type supported by Windows clients. # default_eap_type = mschapv2 @@ -1153,21 +1139,22 @@ eap { # removed in v4.0. # # See the new policy `copy_request_to_tunnel` in - # `sites-available/inner-tunnel`, and in `policy.d/eap` - # for more information. + # `sites-available/inner-tunnel`, and in `policy.d/eap` for more + # information. # # ==== # # - # virtual_server:: The virtual server used for "inner" authentication. + # virtual_server:: The virtual server used for "inner" + # authentication. # - # The inner tunneled request can be sent through a virtual - # server which verifies the inner credentials. + # The inner tunneled request can be sent through a virtual server + # which verifies the inner credentials. # - # If this entry is commented out, the inner tunneled request - # will be sent through the virtual server which processed the - # outer request. This configuration is NOT RECOMMENDED. + # If this entry is commented out, the inner tunneled request will + # be sent through the virtual server which processed the outer + # request. This configuration is NOT RECOMMENDED. # virtual_server = "inner-tunnel" @@ -1175,14 +1162,14 @@ eap { # require_client_cert:: Whether we require a client certificate. # # Unlike `EAP-TLS`, `PEAP` does not require a client certificate. - # However, you can require one by setting the following - # option. You can also override this option by setting + # However, you can require one by setting the following option. You + # can also override this option by setting # # control.EAP-TLS-Require-Client-Cert = Yes # - # NOTE: The majority of supplicants do not support using a - # client certificate with `PEAP`, so this option is unlikely to - # be useful for most people. + # NOTE: The majority of supplicants do not support using a client + # certificate with `PEAP`, so this option is unlikely to be useful + # for most people. # # require_client_cert = yes } @@ -1193,57 +1180,57 @@ eap { # NOTE: This is the EAP MS-CHAPv2 sub-module, not the main `mschap` # module. # - # In order for this sub-module to work, the main `mschap` module MUST - # ALSO be configured. + # In order for this sub-module to work, the main `mschap` module + # MUST ALSO be configured. # - # This module is the *Microsoft* implementation of `MS-CHAPv2` in `EAP`. - # There is another (*incompatible*) implementation of `MS-CHAPv2 in `EAP` by - # Cisco, which *FreeRADIUS does not support*. + # This module is the *Microsoft* implementation of `MS-CHAPv2` in + # `EAP`. There is another (*incompatible*) implementation of + # `MS-CHAPv2 in `EAP` by Cisco, which *FreeRADIUS does not support*. # mschapv2 { # - # auth_type:: Which "authenticate" section is used to authenticate the MS-CHAP data. + # auth_type:: Which "authenticate" section is used to authenticate + # the MS-CHAP data. # # auth_type = mschap # - # send_error:: Whether we send an MS-CHAP error on authentication failure. + # send_error:: Whether we send an MS-CHAP error on authentication + # failure. # # In early versions of FreeRADIUS, the module never sent the - # `MS-CHAP-Error` message to the client. This worked, but it had - # issues when the cached password was wrong. The server - # *should* send `E=691 R=0` to the client, which tells it to - # prompt the user for a new password. + # `MS-CHAP-Error` message to the client. This worked, but it had + # issues when the cached password was wrong. The server *should* + # send `E=691 R=0` to the client, which tells it to prompt the user + # for a new password. # - # CAUTION: The default is `no`, which is known to work. If you - # set `send_error = yes`, then the error message will be sent - # back to the client. This *may* help some clients work better, - # but *may* also cause other clients to stop working. + # CAUTION: The default is `no`, which is known to work. If you set + # `send_error = yes`, then the error message will be sent back to + # the client. This *may* help some clients work better, but *may* + # also cause other clients to stop working. # # send_error = no # # identity:: The server identifier to send back in the challenge. # - # It should generally be the host name of the RADIUS server. - # Or, some information which uniquely identifies it. + # It should generally be the host name of the RADIUS server. Or, + # some information which uniquely identifies it. # # identity = "FreeRADIUS" # - # with_ntdomain_hack:: Windows clients send `User-Name` in the - # form of `DOMAIN\User`, but sometimes calculate the - # challenge/response based only on the `User` portion. + # with_ntdomain_hack:: Windows clients send `User-Name` in the form + # of `DOMAIN\User`, but sometimes calculate the challenge/response + # based only on the `User` portion. # - # Setting this value to `yes` makes FreeRADIUS use only the - # "user" portion of the `User-Name` for its MS-CHAP - # calculations. + # Setting this value to `yes` makes FreeRADIUS use only the "user" + # portion of the `User-Name` for its MS-CHAP calculations. # - # If this behavior seems weird and complicated, we agree. - # There is no reason for the Windows systems to do something so - # unfriendly. All it does is make life difficult for the - # administrator, who has to figure out why MS-CHAP is magically - # failing. + # If this behavior seems weird and complicated, we agree. There is + # no reason for the Windows systems to do something so unfriendly. + # All it does is make life difficult for the administrator, who has + # to figure out why MS-CHAP is magically failing. # # Default is `no`. # @@ -1255,31 +1242,31 @@ eap { # # The FAST module implements the EAP-FAST protocol. # - # NOTE: To use `EAP-FAST` you must also configure an `inner` method in - # `mods-enabled/eap_inner`. + # NOTE: To use `EAP-FAST` you must also configure an `inner` method + # in `mods-enabled/eap_inner`. # fast { # - # tls:: Point to the common TLS configuration + # tls:: Point to the common TLS configuration # tls = tls-common # # cipher_list:: Set the list of allowed TLS cipher suites. # - # If `cipher_list` is set here, it will override the - # `cipher_list` configuration from the `tls-common` - # configuration. The `EAP-FAST` module has its own override - # for `cipher_list` because the specifications mandate a - # different set of ciphers than are used by the other `EAP` - # methods. + # If `cipher_list` is set here, it will override the `cipher_list` + # configuration from the `tls-common` configuration. The `EAP-FAST` + # module has its own override for `cipher_list` because the + # specifications mandate a different set of ciphers than are used + # by the other `EAP` methods. # - # The `cipher_list` MUST include "ADH" for anonymous - # provisioning. This is not as straightforward as appending - # "ADH" alongside "DEFAULT" as "DEFAULT" contains "!aNULL" so - # instead it is recommended "ALL:!EXPORT:!eNULL:!SSLv2" is used + # The `cipher_list` MUST include "ADH" for anonymous provisioning. + # This is not as straightforward as appending "ADH" alongside + # "DEFAULT" as "DEFAULT" contains "!aNULL" so instead it is + # recommended "ALL:!EXPORT:!eNULL:!SSLv2" is used # - # NOTE: for OpenSSL 1.1.0 and above you may need to add ":@SECLEVEL=0" + # NOTE: for OpenSSL 1.1.0 and above you may need to add + # ":@SECLEVEL=0" # cipher_list = "ALL:!EXPORT:!eNULL:!SSLv2" @@ -1295,8 +1282,8 @@ eap { # # if you are running a cluster of RADIUS servers, you should make # the value chosen here (and for `pac_opaque_key`) the same on all - # your RADIUS servers. This value should be unique to your - # installation. We suggest using a domain name. + # your RADIUS servers. This value should be unique to your + # installation. We suggest using a domain name. # authority_identity = "1234" @@ -1305,13 +1292,14 @@ eap { # # The PAC key must be exactly 32 bytes in size. # - # This value MUST be secret, and MUST be generated using - # a secure method, such as via `openssl rand -hex 32` + # This value MUST be secret, and MUST be generated using a secure + # method, such as via `openssl rand -hex 32` # pac_opaque_key = "0123456789abcdef0123456789ABCDEF" # - # virtual_server:: The virtual server used for "inner" authentication. + # virtual_server:: The virtual server used for "inner" + # authentication. # virtual_server = inner-tunnel @@ -1331,9 +1319,9 @@ eap { # virtual_server:: The EAP-SIM virtual server containing policy # sections. # - # This configuration must be set, EAP-SIM will not function - # without it, as certain operations such as getting SIM vectors - # require configuration for each user. + # This configuration must be set, EAP-SIM will not function without + # it, as certain operations such as getting SIM vectors require + # configuration for each user. # virtual_server = eap-aka-sim } @@ -1343,17 +1331,17 @@ eap { # aka { # - # prefer_aka_prime:: Send the AT_BIDDING attribute in - # AKA-Challenge messages. + # prefer_aka_prime:: Send the AT_BIDDING attribute in AKA-Challenge + # messages. # # When AT_BIDDING is sent in a AKA-Challenge and the supplicant - # supports EAP-AKA-Prime, RFC 5448 states the supplicant - # should abort the authentication attempt as a bidding down - # attack may have occurred. + # supports EAP-AKA-Prime, RFC 5448 states the supplicant should + # abort the authentication attempt as a bidding down attack may + # have occurred. # - # If a value is not provided for this configuration item - # it will be determined automatically by whether the - # EAP-AKA-Prime EAP method is enabled. + # If a value is not provided for this configuration item it will be + # determined automatically by whether the EAP-AKA-Prime EAP method + # is enabled. # # prefer_aka_prime = yes @@ -1361,9 +1349,9 @@ eap { # virtual_server:: The EAP-SIM virtual server containing policy # sections. # - # This configuration must be set, EAP-AKA will not function - # without it, as certain operations such as getting vectors - # require configuration for each user. + # This configuration must be set, EAP-AKA will not function without + # it, as certain operations such as getting vectors require + # configuration for each user. # virtual_server = eap-aka-sim } @@ -1377,8 +1365,8 @@ eap { # sections. # # This configuration must be set, EAP-AKA' will not function - # without it, as certain operations such as getting vectors - # require configuration for each user. + # without it, as certain operations such as getting vectors require + # configuration for each user. # virtual_server = eap-aka-sim } @@ -1387,7 +1375,8 @@ eap { # # == Expansions # -# The rlm_eap module provides the below functions to interact with the `3GPP` and `SIM` protocols. +# The rlm_eap module provides the below functions to interact with +# the `3GPP` and `SIM` protocols. # # === %3gpp_temporary_id.decrypt('...) # diff --git a/raddb/mods-available/eap_inner b/raddb/mods-available/eap_inner index 82e22670e81..567b3856a08 100644 --- a/raddb/mods-available/eap_inner +++ b/raddb/mods-available/eap_inner @@ -8,8 +8,8 @@ # = EAP/Inner Module # # The `eap_inner` module provides a sample configuration for an `EAP` -# module that occurs *inside* of a tunneled method. It is used to limit -# the `EAP` types that can occur inside of the inner tunnel. +# module that occurs *inside* of a tunneled method. It is used to +# limit the `EAP` types that can occur inside of the inner tunnel. # # See also `sites-available/inner-tunnel` # @@ -41,7 +41,8 @@ eap inner-eap { default_eap_type = mschapv2 # - # type:: Only EAP types listed below with a 'type = ' pair will be allowed. + # type:: Only EAP types listed below with a 'type = ' pair + # will be allowed. # type = md5 type = gtc @@ -51,8 +52,8 @@ eap inner-eap { # # == md5 { ... } # - # `md5` is OK to use the inner tunnel, as keying material is provided by - # the outer EAP method. + # `md5` is OK to use the inner tunnel, as keying material is + # provided by the outer EAP method. # md5 { } @@ -86,12 +87,14 @@ eap inner-eap { # tls-config tls-peer { # - # auto_chain:: See the `eap` module for common configuration explanation. + # auto_chain:: See the `eap` module for common configuration + # explanation. # # auto_chain = yes # - # chain { ... }:: See the `eap` module for common configuration explanation. + # chain { ... }:: See the `eap` module for common configuration + # explanation. # chain { certificate_file = ${certdir}/rsa/server.pem @@ -101,7 +104,8 @@ eap inner-eap { } # - # ca_file:: See the `eap` module for common configuration explanation. + # ca_file:: See the `eap` module for common configuration + # explanation. # ca_file = ${cadir}/rsa/ca.pem @@ -111,27 +115,32 @@ eap inner-eap { # dh_file = ${certdir}/dh # - # random_file:: See the `eap` module for common configuration explanation. + # random_file:: See the `eap` module for common configuration + # explanation. # # random_file = /dev/urandom # - # fragment_size:: See the `eap` module for common configuration explanation. + # fragment_size:: See the `eap` module for common configuration + # explanation. # fragment_size = 16384 # - # ca_path:: See the `eap` module for common configuration explanation. + # ca_path:: See the `eap` module for common configuration + # explanation. # ca_path = ${cadir} # - # check_cert_issuer:: See the `eap` module for common configuration explanation. + # check_cert_issuer:: See the `eap` module for common configuration + # explanation. # # check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd" # - # check_cert_cn:: See the `eap` module for common configuration explanation. + # check_cert_cn:: See the `eap` module for common configuration + # explanation. # # check_cert_cn = %{User-Name} } @@ -139,8 +148,8 @@ eap inner-eap { # # == tls { ... } # - # You SHOULD use different certificates than are used - # for the outer EAP configuration! + # You SHOULD use different certificates than are used for the outer + # EAP configuration! # # You can create the `inner-server.pem` file by doing: # diff --git a/raddb/mods-available/echo b/raddb/mods-available/echo index b18e2c02621..dcc72f3d29c 100644 --- a/raddb/mods-available/echo +++ b/raddb/mods-available/echo @@ -7,17 +7,17 @@ # # = Echo Module # -# The `echo` module an example of the `exec` module configured -# with a `program` configuration item set so it can be called -# as any other module, i.e. +# The `echo` module an example of the `exec` module configured with a +# `program` configuration item set so it can be called as any other +# module, i.e. # # echo # -# The sample `program` below is a trivial example and should be replaced -# with something more meaningful. +# The sample `program` below is a trivial example and should be +# replaced with something more meaningful. # -# The return value of the program run determines the result of the exec -# instance call as follows: +# The return value of the program run determines the result of the +# exec instance call as follows: # # [options="header,autowidth"] # |=== @@ -46,14 +46,13 @@ exec echo { wait = yes # - # program:: The name of the program to execute, and it's - # arguments. + # program:: The name of the program to execute, and it's arguments. # - # Dynamic translation is done on this field, so things like - # the following example will work. + # Dynamic translation is done on this field, so things like the + # following example will work. # - # The example program below has a few important features - # which should be noted: + # The example program below has a few important features which + # should be noted: # # * The string for the program name uses triple quotes. # These allow the text inside of the string to contain @@ -77,10 +76,10 @@ exec echo { # a command results in the _unquoted_ string being passed # to the command, as the argument. # - # The summary of all of the above is that when printing - # attributes it's usually easier to run one shell script with - # no arguments. That shell script can then print the - # attribute names, operators, and values. + # The summary of all of the above is that when printing attributes + # it's usually easier to run one shell script with no arguments. + # That shell script can then print the attribute names, operators, + # and values. # # Any string values should also be quoted. # diff --git a/raddb/mods-available/escape b/raddb/mods-available/escape index bdfa2460f75..8dc72fdee29 100644 --- a/raddb/mods-available/escape +++ b/raddb/mods-available/escape @@ -24,7 +24,8 @@ escape { # # safe_characters:: # - # Characters that will not be encoded by the `%{escape}` `xlat` function. + # Characters that will not be encoded by the `%{escape}` `xlat` + # function. # safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } diff --git a/raddb/mods-available/etc_group b/raddb/mods-available/etc_group index 18e4c8a4418..55cf55737b6 100644 --- a/raddb/mods-available/etc_group +++ b/raddb/mods-available/etc_group @@ -7,7 +7,8 @@ # # = etc_group Module # -# The `etc_group` module provides group names from the `/etc/group` file. +# The `etc_group` module provides group names from the `/etc/group` +# file. # # NOTE: Please see the `csv` module for full documentation on the # configuration items used here. @@ -16,12 +17,12 @@ # # == Configuration Settings # -# The `csv` module configuration for the /etc/group file. The module +# The `csv` module configuration for the /etc/group file. The module # adds a `Etc-Group-Name` attribute for every group that the user is # a member of. # -# You will have to define the `Etc-Group-Name` in the `dictionary` file, -# as a `string` type. For example: +# You will have to define the `Etc-Group-Name` in the `dictionary` +# file, as a `string` type. For example: # # ``` # DEFINE Etc-Group-Name string @@ -35,21 +36,20 @@ csv etc_group { key = User-Name # - # The field names are just place-holders. - # They are NOT attribute names! + # The field names are just place-holders. They are NOT attribute + # names! # fields = "group:::,user" index_field = user # - # Add the ETC-Group-Name attribute to the request list. - # If the user is a member of multiple groups, then the - # module will add multiple ETC-Group-Name attributes, - # one for each group. + # Add the ETC-Group-Name attribute to the request list. If the user + # is a member of multiple groups, then the module will add multiple + # ETC-Group-Name attributes, one for each group. # - # The field names from the `fields` entry above are used - # here in the right-hand side of the `update` section. + # The field names from the `fields` entry above are used here in the + # right-hand side of the `update` section. # update request { ETC-Group-Name := 'group' diff --git a/raddb/mods-available/exec b/raddb/mods-available/exec index 97403e7f515..c4efd61abee 100644 --- a/raddb/mods-available/exec +++ b/raddb/mods-available/exec @@ -12,36 +12,37 @@ # == Don't use this module. # # We provide this module for the _extremely rare_ case when it is -# useful. The main utility of the module is for testing, and for +# useful. The main utility of the module is for testing, and for # doing some unusual things which aren't possible via any other # method. # # It can be appealing to just ignore `unlang`, and run `%exec()` -# everywhere. This kind of configuration can be written quickly, +# everywhere. This kind of configuration can be written quickly, # means that you don't need to spend any time understanding the -# server configuration. This process is generally more effort than -# it is worth. +# server configuration. This process is generally more effort than it +# is worth. # -# The biggest problem with `exec` is that it is slow. Very, very, -# very, slow. We have tested the server at 80K Access-Requests per -# second (to OpenLDAP) on low-end hardware. This is fast enough to +# The biggest problem with `exec` is that it is slow. Very, very, +# very, slow. We have tested the server at 80K Access-Requests per +# second (to OpenLDAP) on low-end hardware. This is fast enough to # run a major ISP. # # In contrast, when each Access-Request causes an `exec` script to be # run, the rate of access-Request can drop by a factor of 100 or -# more. It is not unusual for the server to max out at a few hundred -# authentications per second when running multiple scripts per packet. +# more. It is not unusual for the server to max out at a few hundred +# authentications per second when running multiple scripts per +# packet. # # The server has sufficient functionality that it is essentially -# never necessary to `exec` and external script. Please use the +# never necessary to `exec` and external script. Please use the # built-in functionality of the server; it is hundreds of times # faster than running a script, and it is designed to process -# packets. An external script is worse, by nearly all possible +# packets. An external script is worse, by nearly all possible # standards of measurement. # # == %exec() function # -# This module also provides a dynamic expansion function. You can +# This module also provides a dynamic expansion function. You can # then run a script like this: # # Attribute-Name = %exec('/path/to/program', 'args', ...) @@ -49,11 +50,11 @@ # The output of `exec` is parsed and assigned to the attribute. # # Depending on the module configuration, the output of `%exec()` can -# even be pairs, such as `User-Name = foo`. Those pairs can be -# assigned to a list. If the program fails, it will output nothing. +# even be pairs, such as `User-Name = foo`. Those pairs can be +# assigned to a list. If the program fails, it will output nothing. # -# Note that when the assignment is to a list, the `exec` call _must_ be -# inside of a double-quoted string. +# Note that when the assignment is to a list, the `exec` call _must_ +# be inside of a double-quoted string. # # &request += "%exec(/path/to/program,args, ...)" # @@ -61,20 +62,20 @@ # program which is executed. # # The attributes from the list referenced in the `input_pairs` -# configuration item will be placed into environment variables of the executed -# program. +# configuration item will be placed into environment variables of the +# executed program. # -# Alternatively, by setting the `program` item of the module configuration, -# the module can be called as a module rather than as an xlat function. -# See the `echo` module for an example of this. +# Alternatively, by setting the `program` item of the module +# configuration, the module can be called as a module rather than as +# an xlat function. See the `echo` module for an example of this. # # In this scenario, if the configuration item `output_pairs` is set, # and the `wait` configuration item is set to "yes", the output of -# executing the program will be parsed for attribute pairs which -# will be added to the list referenced in `output_pairs`. +# executing the program will be parsed for attribute pairs which will +# be added to the list referenced in `output_pairs`. # -# When called as a module, the return value of the program run determines -# the result of the exec instance call as follows: +# When called as a module, the return value of the program run +# determines the result of the exec instance call as follows: # # [options="header,autowidth"] # |=== @@ -101,56 +102,51 @@ exec { # # wait:: Wait for the program to finish. # - # If we do NOT wait, then the program is "fire and - # forget", and any output attributes from it are ignored. + # If we do NOT wait, then the program is "fire and forget", and any + # output attributes from it are ignored. # - # If we are looking for the program to output - # attributes, and want to add those attributes to the - # request, then we MUST wait for the program to - # finish, and therefore set `wait=yes` + # If we are looking for the program to output attributes, and want + # to add those attributes to the request, then we MUST wait for the + # program to finish, and therefore set `wait=yes` # wait = yes # - # program:: The name of the program to execute, and it's - # arguments, when called as a module. + # program:: The name of the program to execute, and it's arguments, + # when called as a module. # - # The string is dynamically expanded, so it can contain - # attribute references, etc. However, quoting of programs - # and arguments is complex. The program name and arguments - # are parsed by the server as a single string. But that - # string is parsed by the shell into multiple arguments, - # which are then passed to the program. + # The string is dynamically expanded, so it can contain attribute + # references, etc. However, quoting of programs and arguments is + # complex. The program name and arguments are parsed by the server + # as a single string. But that string is parsed by the shell into + # multiple arguments, which are then passed to the program. # - # We recommend not using the `exec` module, and instead using - # the `%exec(...)` function. That function will generally be - # easier to use and understand. + # We recommend not using the `exec` module, and instead using the + # `%exec(...)` function. That function will generally be easier to + # use and understand. # - # Where this module is used, the `program` string below - # should use triple quotes. These allow the text inside of - # the string to contain double-quote characters without - # needing to escape them. This doesn't affect the output - # string, but it does make the configuration easier to read. + # Where this module is used, the `program` string below should use + # triple quotes. These allow the text inside of the string to + # contain double-quote characters without needing to escape them. + # This doesn't affect the output string, but it does make the + # configuration easier to read. # - # If the program is expected to take quoted strings as - # arguments, then the quotes have to be done carefully. See - # the `echo` module for more information, and for a worked - # example/ + # If the program is expected to take quoted strings as arguments, + # then the quotes have to be done carefully. See the `echo` module + # for more information, and for a worked example/ # - # The summary of all of the above is that it's usually easier - # to run one shell script with no arguments. That shell - # script can then print the attribute names, operators, and - # values. + # The summary of all of the above is that it's usually easier to run + # one shell script with no arguments. That shell script can then + # print the attribute names, operators, and values. # # program = """/bin/true "%{User-Name}" """ # - # input_pairs:: The attributes which are placed into the - # environment variables for the program. + # input_pairs:: The attributes which are placed into the environment + # variables for the program. # - # The `input_pairs` can be any "group" style attribute. - # Usually it is the top-level list such as `request`, - # `reply`, etc. + # The `input_pairs` can be any "group" style attribute. Usually it + # is the top-level list such as `request`, `reply`, etc. # input_pairs = request @@ -161,36 +157,38 @@ exec { # The values allowed are the same as for the `input_pairs`. # # This configuration item is used only when the `program` - # configuration item is set, and when `wait = yes` is also - # set. Otherwise it is ignored. + # configuration item is set, and when `wait = yes` is also set. + # Otherwise it is ignored. # # output_pairs = reply # # shell_escape:: Escape the environment variables. # - # If this is set, all the RADIUS attributes are capitalised and dashes - # replaced with underscores. Also, RADIUS values are surrounded with - # double-quotes. + # If this is set, all the RADIUS attributes are capitalised and + # dashes replaced with underscores. Also, RADIUS values are + # surrounded with double-quotes. # # That is to say: # # User-Name=BobUser => USER_NAME="BobUser" # # Note that this escaping only applies to environmental variables - # created from the request list. For environmental variables inherited - # from the main radiusd process no escaping is applied. + # created from the request list. For environmental variables + # inherited from the main radiusd process no escaping is applied. # shell_escape = yes # - # env_inherit:: Pass the server environment variables to the called program + # env_inherit:: Pass the server environment variables to the called + # program # - # For security, the server environment variables are not passed to the - # program being executed. Setting this flag to `yes` will pass the - # server environment variables to the program. + # For security, the server environment variables are not passed to + # the program being executed. Setting this flag to `yes` will pass + # the server environment variables to the program. # - # Any `input_pairs` will be merged with these environmental variables. + # Any `input_pairs` will be merged with these environmental + # variables. # # The default is `no`. # @@ -202,10 +200,9 @@ exec { # Default is `10` seconds, which should be plenty for nearly # anything. Range is `1` to `30` seconds. # - # WARNING: You are strongly encouraged to NOT increase this - # value. In fact, you are much better off decreasing it to a - # lower value. Doing so will improve network stability and - # responsiveness. + # WARNING: You are strongly encouraged to NOT increase this value. + # In fact, you are much better off decreasing it to a lower value. + # Doing so will improve network stability and responsiveness. # timeout = 10 } diff --git a/raddb/mods-available/files b/raddb/mods-available/files index b11751f910f..f6a5908788b 100644 --- a/raddb/mods-available/files +++ b/raddb/mods-available/files @@ -7,10 +7,13 @@ # # = Files Module # -# The `users` file as located in `mods-config/files/authorize`. (Livingston-style format). +# The `users` file as located in `mods-config/files/authorize`. +# (Livingston-style format). # -# See the doc/antora/modules/reference/pages/raddb/mods-config/files/users.adoc file for information -# on the format of the input file, and how it operates. +# See the +# doc/antora/modules/reference/pages/raddb/mods-config/files/users.adoc +# file for information on the format of the input file, and how it +# operates. # # @@ -26,10 +29,11 @@ files { # # key:: The default key attribute to use for matches. # - # The content of this attribute is used to match the `name` of the entry. + # The content of this attribute is used to match the `name` of the + # entry. # - # Note that unlike v4, the key does not have to be a string, but could instead - # be an IP address or netmask! + # Note that unlike v4, the key does not have to be a string, but + # could instead be an IP address or netmask! # # key = "%{Stripped-User-Name || User-Name}" @@ -39,24 +43,25 @@ files { filename = ${moddir}/authorize # - # match_attr:: List and attribute to populate with the `name` of the matched entry. + # match_attr:: List and attribute to populate with the `name` of the + # matched entry. # - # NOTE: the attriubte type should be capable of holding data of the type - # used as key values. - # Particularly useful if matching IP addresses to subnets, since the populated - # value will be the subnet. In that case it is best to use `0.0.0.0/0` in place - # of `DEFAULT` for any catch-all entries. + # NOTE: the attriubte type should be capable of holding data of the + # type used as key values. Particularly useful if matching IP + # addresses to subnets, since the populated value will be the + # subnet. In that case it is best to use `0.0.0.0/0` in place of + # `DEFAULT` for any catch-all entries. # # match_attr = control.User-Category # # v3_compat:: Version 3 compatibility flag. # - # When this flag is set, any enumeration names (e.g. Service-Type := Framed-User) - # do not need to have the v4 "::" prefix. This flag helps with migrating v3 - # configurations to v4. + # When this flag is set, any enumeration names (e.g. Service-Type := + # Framed-User) do not need to have the v4 "::" prefix. This flag + # helps with migrating v3 configurations to v4. # - # Default value "false". Allowed vaues, `true` and `false`. + # Default value "false". Allowed vaues, `true` and `false`. # # v3_compat = false } diff --git a/raddb/mods-available/ftp b/raddb/mods-available/ftp index 371b2341351..b5e15f7d496 100644 --- a/raddb/mods-available/ftp +++ b/raddb/mods-available/ftp @@ -19,25 +19,25 @@ ftp { # # max_resp_size:: Maximum accepted response size # - # If the server returns responses larger than this - # they will be discarded. + # If the server returns responses larger than this they will be + # discarded. # max_resp_size = 16k # # binary:: Should the response be treated as binary data # - # If this is `yes` then the output data will be octets. - # If it is `no` then the output data will be a string. + # If this is `yes` then the output data will be octets. If it is + # `no` then the output data will be a string. # binary = no # - # connection { ... }:: Configure how connection handles are - # managed per thread. + # connection { ... }:: Configure how connection handles are managed + # per thread. # connection { # - # Reusable connection handles are allocated in blocks. These + # Reusable connection handles are allocated in blocks. These # parameters allow for tuning how that is done. # # Since ftp requests are performed async, the settings here @@ -46,29 +46,28 @@ ftp { reuse { # - # min:: The minimum number of connection handles to - # keep allocated. + # min:: The minimum number of connection handles to keep + # allocated. # min = 10 # - # max:: The maximum number of reusable connection handles - # to allocate. + # max:: The maximum number of reusable connection handles to + # allocate. # - # Any requests to allocate a connection handle beyond - # this number will cause a temporary handle to be allocated. - # This is less efficient than the block allocation so - # `max` should be set to reflect the number of outstanding - # requests expected at peak load. + # Any requests to allocate a connection handle beyond this number + # will cause a temporary handle to be allocated. This is less + # efficient than the block allocation so `max` should be set to + # reflect the number of outstanding requests expected at peak + # load. max = 100 # - # cleanup_interval:: How often to free un-used connection - # handles. + # cleanup_interval:: How often to free un-used connection handles. # - # Every `cleanup_interval` a cleanup routine runs which - # will free any blocks of handles which are not in use, - # ensuring that at least `min` handles are kept. + # Every `cleanup_interval` a cleanup routine runs which will free + # any blocks of handles which are not in use, ensuring that at + # least `min` handles are kept. # cleanup_interval = 30s @@ -77,7 +76,8 @@ ftp { # # connect_timeout:: Connection timeout (in seconds). # - # The maximum amount of time to wait for a new connection to be established. + # The maximum amount of time to wait for a new connection to be + # established. # connect_timeout = 3.0 } diff --git a/raddb/mods-available/home_server_pool b/raddb/mods-available/home_server_pool index 16baa1d8109..25411653808 100644 --- a/raddb/mods-available/home_server_pool +++ b/raddb/mods-available/home_server_pool @@ -29,11 +29,13 @@ # home_server = home3 # } # -# This translates to a `load-balance` section with name `pool1`, and the following contents. +# This translates to a `load-balance` section with name `pool1`, and +# the following contents. # load-balance pool1 { # - # `home1`, `home2`, and `home3` should be instances of the `radius` module. + # `home1`, `home2`, and `home3` should be instances of the `radius` + # module. # home1 home2 @@ -42,7 +44,7 @@ load-balance pool1 { # # If you are using a Load-Balance-Key in v3, that can be translated # to a v4 configuration by simply specifying an option to the -# `load-balance` section. For example, to load balance on +# `load-balance` section. For example, to load balance on # `Calling-Station-Id`, the above `pool1` configuration can be # modified with one addition: # @@ -58,17 +60,17 @@ load-balance pool1 { # # == Using the home_server_pool # -# In this configuration, `pool1` is a _virtual module_. That is, it -# can be referred to by name as a module: `pool1`. This name can be +# In this configuration, `pool1` is a _virtual module_. That is, it +# can be referred to by name as a module: `pool1`. This name can be # used anywhere that a module name is allowed. # # The need to use the pool as a module is the one major difference in -# proxying between v3 and v4. In v3, proxying was an automatic thing -# that happened when a special attribute got set. -# e.g. `Proxy-To-Realm = ...`, or `Home-Server = ...`. +# proxying between v3 and v4. In v3, proxying was an automatic thing +# that happened when a special attribute got set. e.g. +# `Proxy-To-Realm = ...`, or `Home-Server = ...`. # # In v4, proxying happens only when you explicitly configure the -# server to run the `radius` module. The simplest way to do this is +# server to run the `radius` module. The simplest way to do this is # to add a section: # # ``` @@ -77,7 +79,7 @@ load-balance pool1 { # } # ``` # -# And then set `Auth-Type := proxy`. See the sites-available/proxy +# And then set `Auth-Type := proxy`. See the sites-available/proxy # example for more information. # # @@ -96,9 +98,11 @@ load-balance pool1 { # } # ``` # -# This translates to the `radius` module, with name `home1`, and the following contents. +# This translates to the `radius` module, with name `home1`, and the +# following contents. # -# See the `radius` module for more information about its full configuration. +# See the `radius` module for more information about its full +# configuration. # radius home1 { transport = udp @@ -114,5 +118,6 @@ radius home1 { } # -# You can add `home2`, `home3`, etc. here. They do not need to be in separate files. +# You can add `home2`, `home3`, etc. here. They do not need to be in +# separate files. # diff --git a/raddb/mods-available/icmp b/raddb/mods-available/icmp index 92a5e8645b1..1a880a9278b 100644 --- a/raddb/mods-available/icmp +++ b/raddb/mods-available/icmp @@ -9,17 +9,18 @@ # # The module `icmp` is used for sending ICMP Echo Request messages. # -# This module is useful only for `xlat`. Use it via the following expansion: +# This module is useful only for `xlat`. Use it via the following +# expansion: # # `%icmp(192.0.2.1)` # -# The module will "ping" the given IP address. If that IP address responds -# with an ICMP Echo Reply, then the result of the expansion will be `yes`. -# If that IP address does not respond within the timeout, then the result -# of the expansion will be `no`. +# The module will "ping" the given IP address. If that IP address +# responds with an ICMP Echo Reply, then the result of the expansion +# will be `yes`. If that IP address does not respond within the +# timeout, then the result of the expansion will be `no`. # -# The IP address does not have to be a fixed string. It can be another -# expansion, such as: +# The IP address does not have to be a fixed string. It can be +# another expansion, such as: # # `%icmp:(%{NAS-IP-Address})` # @@ -44,8 +45,8 @@ icmp { # # By default, packets are sent via the normal routing table. # - # Specifying an interface forces the packets to be sent via - # that particular interface. + # Specifying an interface forces the packets to be sent via that + # particular interface. # # interface = eth0 @@ -60,10 +61,9 @@ icmp { # Default is `1` seconds, which should be plenty for nearly # anything. Range is `0.1s` to `10s`. # - # WARNING: You are strongly encouraged to NOT increase this - # value. In fact, you are much better off decreasing it to a - # lower value. Doing so will improve network stability and - # responsiveness. + # WARNING: You are strongly encouraged to NOT increase this value. + # In fact, you are much better off decreasing it to a lower value. + # Doing so will improve network stability and responsiveness. # timeout = 1s } @@ -71,7 +71,8 @@ icmp { # # == Ping for IPv4 # -# Copy of the `icmp` module, as it may be easier to remember `ping` than `icmp`. +# Copy of the `icmp` module, as it may be easier to remember `ping` +# than `icmp`. # icmp ping { timeout = 1s diff --git a/raddb/mods-available/idn b/raddb/mods-available/idn index 2f161232d54..6d00ebbc76c 100644 --- a/raddb/mods-available/idn +++ b/raddb/mods-available/idn @@ -7,18 +7,18 @@ # # = IDN Module # -# The `idn` (Internationalised domain names) encoding for DNS aka IDNA -# standardized in RFC 3490. +# The `idn` (Internationalised domain names) encoding for DNS aka +# IDNA standardized in RFC 3490. # # [NOTE] # ==== # The expansion string: `%idn(example.com)` results in an ASCII -# punycode version of the domain name. That version can then be used -# for name comparisons. Using an `i18n` version of the name is *NOT +# punycode version of the domain name. That version can then be used +# for name comparisons. Using an `i18n` version of the name is *NOT # RECOMMENDED*, as that version is not canonical. # # i.e. the `same` domain name can be represented in many, many, -# different ways. Only the `idn` version has *one* representation. +# different ways. Only the `idn` version has *one* representation. # ==== # diff --git a/raddb/mods-available/imap b/raddb/mods-available/imap index c530cb1a479..117a960d61a 100644 --- a/raddb/mods-available/imap +++ b/raddb/mods-available/imap @@ -7,99 +7,107 @@ # # = IMAP Module # -# The `imap` module validates a users name and password against an IMAP server. -# It should be called from an `authenticate` section. +# The `imap` module validates a users name and password against an +# IMAP server. It should be called from an `authenticate` section. # -# The module can optionally perform a tls handshake, enabled with require_cert +# The module can optionally perform a tls handshake, enabled with +# require_cert # imap { # - # tls { ... }:: Configure the tls related items which control - # how FreeRADIUS connects to an IMAP server. + # tls { ... }:: Configure the tls related items which control how + # FreeRADIUS connects to an IMAP server. # tls { # # Certificate validation options # - # Specifies how the certificate(s) presented by the - # IMAP server are validated, and which certificates - # (if any) to send to that IMAP server. + # Specifies how the certificate(s) presented by the IMAP server are + # validated, and which certificates (if any) to send to that IMAP + # server. # - # The options here behave the same as the options in - # other `tls` sections in the server. + # The options here behave the same as the options in other `tls` + # sections in the server. # # - # certificate_file:: PEM formatted file containing the certificate we present to the IMAP server + # certificate_file:: PEM formatted file containing the certificate + # we present to the IMAP server # - # Specifies a certificate and any intermediary CAs we should send to the IMAP server. + # Specifies a certificate and any intermediary CAs we should send + # to the IMAP server. # - # This file should usually contain the client certificate file first, then any - # intermediary signing CAs, shallowest (direct signee of the certificate_file) - # to deepest (signed directly by the root CA). + # This file should usually contain the client certificate file + # first, then any intermediary signing CAs, shallowest (direct + # signee of the certificate_file) to deepest (signed directly by + # the root CA). # # certificate_file = /path/to/radius.pem # - # ca_file:: PEM formatted file containing the chain - # to validate the IMAP server's certificate. + # ca_file:: PEM formatted file containing the chain to validate the + # IMAP server's certificate. # - # Any certificate chain MUST be in order from server - # certificate (first in the file) to intermediary CAs (second) to - # Root CA (last in the file) as per RFC 4346 Section 7.4.2 (see certificate_list) + # Any certificate chain MUST be in order from server certificate + # (first in the file) to intermediary CAs (second) to Root CA (last + # in the file) as per RFC 4346 Section 7.4.2 (see certificate_list) # - # Providing a complete certificate chain here is the - # most common way of validating the certificate - # presented by an IMAP server. + # Providing a complete certificate chain here is the most common + # way of validating the certificate presented by an IMAP server. # # ca_file = "${certdir}/cacert.pem" # - # ca_issuer_file:: PEM formatted file containing the - # CA that signed the IMAP server's certificate. + # ca_issuer_file:: PEM formatted file containing the CA that signed + # the IMAP server's certificate. # - # Specifies the certificate which directly signed - # the certificate presented by the IMAPs server. + # Specifies the certificate which directly signed the certificate + # presented by the IMAPs server. # - # This configuration option can be used to prevent - # certificates passing validation which were signed - # by other intermediary CAs, or root CAs, in the - # trusted certificate chain. + # This configuration option can be used to prevent certificates + # passing validation which were signed by other intermediary CAs, + # or root CAs, in the trusted certificate chain. # # ca_issuer_file = "${certdir}/caissuer.pem" # - # ca_path:: A directory containing multiple root CA certs named by their hash. + # ca_path:: A directory containing multiple root CA certs named by + # their hash. # # See the OpenSSL documentation for more details: # - https://www.openssl.org/docs/man1.1.0/man3/SSL_CTX_set_default_verify_paths.html # - https://www.openssl.org/docs/man1.1.1/man1/c_rehash.html # - # This configuration option should only be used when the IMAP server being contacted - # is not known ahead of time (using a URL from an external source), and/or the CA used - # to sign the IMAP server certificate is unknown. + # This configuration option should only be used when the IMAP + # server being contacted is not known ahead of time (using a URL + # from an external source), and/or the CA used to sign the IMAP + # server certificate is unknown. # - # If not set, then whatever libcurl has as its default will be used, which typically - # will be the operating system's set of trusted CAs. This will be visible in the debug - # output when FreeRADIUS starts. + # If not set, then whatever libcurl has as its default will be + # used, which typically will be the operating system's set of + # trusted CAs. This will be visible in the debug output when + # FreeRADIUS starts. # # ca_path = "${certdir}" # - # private_key_file:: PEM formatted file containing the private key for the specified `certificate_file` + # private_key_file:: PEM formatted file containing the private key + # for the specified `certificate_file` # # This item must be specified if `certificate_file` is being used. # # private_key_file = /path/to/radius.key # - # private_key_password:: Password used to decrypt the `private_key_file`. + # private_key_password:: Password used to decrypt the + # `private_key_file`. # # private_key_password = "supersecret" # - # random_file:: Source of random data used for various cryptographic functions. + # random_file:: Source of random data used for various + # cryptographic functions. # # random_file = /dev/urandom @@ -120,8 +128,8 @@ imap { # check_cert = no # - # request_cert:: Options for controlling how the - # module requests TLS to the IMAP server. + # request_cert:: Options for controlling how the module requests + # TLS to the IMAP server. # # May be one of: # @@ -154,7 +162,8 @@ imap { # check_cert_cn = no # - # extract_cert_attrs:: Extract OIDs from presented certificates as OIDs. + # extract_cert_attrs:: Extract OIDs from presented certificates as + # OIDs. # # Default is `no` # @@ -164,8 +173,9 @@ imap { # # uri:: URI which will be used for connecting to the IMAP server. # - # The `imap` module uses Curl (https://curl.haxx.se/libcurl/) to implement - # the underlying mail protocols. The URI should be in the form of: + # The `imap` module uses Curl (https://curl.haxx.se/libcurl/) to + # implement the underlying mail protocols. The URI should be in the + # form of: # # `SCHEME://IP:PORT/` # @@ -187,18 +197,18 @@ imap { uri = "imap://192.0.20.1/" # - # timeout:: How long the module will wait before giving up on the response - # from the IMAP server. + # timeout:: How long the module will wait before giving up on the + # response from the IMAP server. # timeout = 5s # - # connection { .. }:: Configure how connection handles are - # managed per thread. + # connection { .. }:: Configure how connection handles are managed + # per thread. # connection { # - # Reusable connection handles are allocated in blocks. These + # Reusable connection handles are allocated in blocks. These # parameters allow for tuning how that is done. # # Since http requests are performed async, the settings here @@ -207,29 +217,28 @@ imap { reuse { # - # min:: The minimum number of connection handles to - # keep allocated. + # min:: The minimum number of connection handles to keep + # allocated. # min = 10 # - # max:: The maximum number of reusable connection handles - # to allocate. + # max:: The maximum number of reusable connection handles to + # allocate. # - # Any requests to allocate a connection handle beyond - # this number will cause a temporary handle to be allocated. - # This is less efficient than the block allocation so - # `max` should be set to reflect the number of outstanding - # requests expected at peak load. + # Any requests to allocate a connection handle beyond this number + # will cause a temporary handle to be allocated. This is less + # efficient than the block allocation so `max` should be set to + # reflect the number of outstanding requests expected at peak + # load. max = 100 # - # cleanup_interval:: How often to free un-used connection - # handles. + # cleanup_interval:: How often to free un-used connection handles. # - # Every `cleanup_interval` a cleanup routine runs which - # will free any blocks of handles which are not in use, - # ensuring that at least `min` handles are kept. + # Every `cleanup_interval` a cleanup routine runs which will free + # any blocks of handles which are not in use, ensuring that at + # least `min` handles are kept. # cleanup_interval = 30s diff --git a/raddb/mods-available/interval b/raddb/mods-available/interval index ffd0a7235bc..494e35f6ac2 100644 --- a/raddb/mods-available/interval +++ b/raddb/mods-available/interval @@ -7,8 +7,8 @@ # # = Interval Module # -# The `interval` module provides interval limiting functionality via an -# xlat function. +# The `interval` module provides interval limiting functionality via +# an xlat function. # # == xlat for interval limiting # @@ -19,7 +19,8 @@ # This function returns `true` if the request is allowed, or `false` # if the interval limit has been exceeded. # -# interval:: Time period for the interval limit (e.g., `1s`, `500ms`). +# interval:: Time period for the interval limit (e.g., `1s`, +# `500ms`). # # key:: Optional key to track interval limits separately. If omitted, # interval limiting is applied per xlat call site. @@ -44,16 +45,17 @@ # # The module supports two scopes for interval limit tracking: # -# global:: Interval limits are shared across all worker threads. -# Use this when you need server-wide interval limiting. +# global:: Interval limits are shared across all worker threads. Use +# this when you need server-wide interval limiting. # -# thread:: Interval limits are tracked per worker thread. -# Use this for higher performance when approximate interval limiting -# is acceptable. If no key argument is specified in thread mode, -# then the cost is reduced further. +# thread:: Interval limits are tracked per worker thread. Use this +# for higher performance when approximate interval limiting is +# acceptable. If no key argument is specified in thread mode, then +# the cost is reduced further. # -# NOTE: With `scope = thread`, the effective interval limit is multiplied -# by the number of worker threads, as each thread tracks independently. +# NOTE: With `scope = thread`, the effective interval limit is +# multiplied by the number of worker threads, as each thread tracks +# independently. # # @@ -63,8 +65,9 @@ interval interval_global { # # scope:: Whether interval limits are global or per-thread. # - # `global` - Interval limits shared across all threads (requires locking). - # `thread` - Interval limits tracked per-thread (higher performance). + # `global` - Interval limits shared across all threads (requires + # locking). `thread` - Interval limits tracked per-thread (higher + # performance). # scope = global } @@ -72,7 +75,8 @@ interval interval_global { # # == Thread-scoped instance # -# This instance uses per-thread interval limiting for higher performance. +# This instance uses per-thread interval limiting for higher +# performance. # interval interval_thread { scope = thread diff --git a/raddb/mods-available/isc_dhcp b/raddb/mods-available/isc_dhcp index 15004624981..935584711a2 100644 --- a/raddb/mods-available/isc_dhcp +++ b/raddb/mods-available/isc_dhcp @@ -11,11 +11,11 @@ # # When the module is listed in the `recv Discover` section, it will # look up the client by `client-identifier`, or failing that, by -# `hardware ethernet`. If found, the module will apply a +# `hardware ethernet`. If found, the module will apply a # `fixed-address` option to assign an IP address. # -# Leases are *not* handled by this module. Instead, you should use -# the `sqlippool` module in the `send Offer` section. After an IP +# Leases are *not* handled by this module. Instead, you should use +# the `sqlippool` module in the `send Offer` section. After an IP # address has been allocated, list `isc_dhcp`. # # The module will then apply any matching options to the packet. @@ -44,23 +44,22 @@ isc_dhcp { # # pedantic:: Be harsh or forgiving about what we parse # - # The `isc_dhcp` module implements only a small subset of the - # ISC DHCP configuration file commands. However, the module - # *parses* just about everything that is allowable in the ISC - # DHCP configuration. + # The `isc_dhcp` module implements only a small subset of the ISC + # DHCP configuration file commands. However, the module *parses* + # just about everything that is allowable in the ISC DHCP + # configuration. # - # The goal here is to allow an easy migration from ISC DHCP - # to FreeRADIUS, by just copying over "dhcpd.conf". - # FreeRADIUS will at least start, instead of complaining - # about everything. + # The goal here is to allow an easy migration from ISC DHCP to + # FreeRADIUS, by just copying over "dhcpd.conf". FreeRADIUS will at + # least start, instead of complaining about everything. # - # If `pedantic = true`, then the module will fail with an - # error when it sees a command it does not support. + # If `pedantic = true`, then the module will fail with an error when + # it sees a command it does not support. # - # The module will also issue warnings for commands which are - # ignored (e.g. OMAPI ones, "listen on port X", and similar). - # The module will also issue warnings for commands which - # should be implemented at some point. + # The module will also issue warnings for commands which are ignored + # (e.g. OMAPI ones, "listen on port X", and similar). The module + # will also issue warnings for commands which should be implemented + # at some point. # # If a command does not produce any errors or warnings, it is # implemented and supported. @@ -78,7 +77,8 @@ isc_dhcp { # # === Supported Keywords # -# The following keywords are have the same meaning and behavior as ISC DHCP. +# The following keywords are have the same meaning and behavior as +# ISC DHCP. # # [options="header,autowidth"] # |=== @@ -103,8 +103,8 @@ isc_dhcp { # == Ignored Keywords # # The following keywords control ISC DHCP behavior such as network -# IP/port, LDAP access, etc. These keywords are ignored even when -# the module is configured with `pedantic = true` +# IP/port, LDAP access, etc. These keywords are ignored even when the +# module is configured with `pedantic = true` # # [options="header,autowidth"] # |=== diff --git a/raddb/mods-available/json b/raddb/mods-available/json index 4a6106dbac9..e1e53c5c832 100644 --- a/raddb/mods-available/json +++ b/raddb/mods-available/json @@ -7,15 +7,15 @@ # # = JSON Module # -# The `json` module registers a `map` function to allow mapping fields from -# JSON structures to attributes. It also adds some xlats for processing and -# generating JSON documents. +# The `json` module registers a `map` function to allow mapping +# fields from JSON structures to attributes. It also adds some xlats +# for processing and generating JSON documents. # # == JSON 'map' function # -# The path through the JSON document's tree is specified with FR jpath, -# which is the FreeRADIUS implementation of the jpath grammar described -# at http://goessner.net/articles/JsonPath/ +# The path through the JSON document's tree is specified with FR +# jpath, which is the FreeRADIUS implementation of the jpath grammar +# described at http://goessner.net/articles/JsonPath/ # # Selectors currently implemented are: # @@ -46,8 +46,8 @@ # # == Sample # -# Assuming that the URL http://example.org/api/user/$username replies with -# some JSON content as below. +# Assuming that the URL http://example.org/api/user/$username replies +# with some JSON content as below. # # [source, json] # ---- @@ -62,8 +62,9 @@ # } # ---- # -# In this case, the `rest` module can be used to get the JSON data and the -# fields can be accessed using 'map' as shown in the example below. +# In this case, the `rest` module can be used to get the JSON data +# and the fields can be accessed using 'map' as shown in the example +# below. # # [source, unlang] # ---- @@ -86,8 +87,8 @@ json { encode { # - # output_mode:: set the format of JSON documenta - # that should be created. This may be one of: + # output_mode:: set the format of JSON documenta that should be + # created. This may be one of: # # - object # - object_simple @@ -104,10 +105,9 @@ json { # attribute { # - # prefix:: Add a colon-delimited prefix to all - # attribute names in the output document. For example, - # with a prefix of "foo", `User-Name` will be output as - # `foo:User-Name`. + # prefix:: Add a colon-delimited prefix to all attribute names in + # the output document. For example, with a prefix of "foo", + # `User-Name` will be output as `foo:User-Name`. # # prefix = } @@ -120,34 +120,31 @@ json { # # single_value_as_array:: always put values in an array # - # Output formats will by default put single values as a - # JSON object (string, integer, etc). More than one - # value will, depending on the output format, be added - # as an array. + # Output formats will by default put single values as a JSON + # object (string, integer, etc). More than one value will, + # depending on the output format, be added as an array. # - # When this option is enabled, values will always be - # added as an array. + # When this option is enabled, values will always be added as an + # array. # # single_value_as_array = no # - # enum_as_integer:: output the integer value of - # enumerated attributes + # enum_as_integer:: output the integer value of enumerated + # attributes # - # Where an attribute has enum values, the textual - # representation of the value will normally be output. - # Enable this option to force the numeric value - # instead. + # Where an attribute has enum values, the textual representation + # of the value will normally be output. Enable this option to + # force the numeric value instead. # # enum_as_integer = no # # always_string:: force all values to be strings # - # Integer values are normally written to the JSON - # document as numbers (i.e. without quotes). Enable - # this option to force all values to be as quoted - # strings. + # Integer values are normally written to the JSON document as + # numbers (i.e. without quotes). Enable this option to force all + # values to be as quoted strings. # # always_string = no @@ -170,7 +167,8 @@ json { # # == Expansions # -# rlm_json provides the below xlat functions to handle the JSON documents. +# rlm_json provides the below xlat functions to handle the JSON +# documents. # # === %json.jpath_validate(...) # @@ -184,9 +182,9 @@ json { # # [source,unlang] # ---- -# string payload -# payload := '$.my.json.payload[1]' -# reply.Reply-Message := "Validation of %{payload} is %json.jpath_validate($.my.json.payload[1])" +# string payload payload := '$.my.json.payload[1]' +# reply.Reply-Message := "Validation of %{payload} is +# %json.jpath_validate($.my.json.payload[1])" # ---- # # .Output @@ -205,9 +203,9 @@ json { # # [source,unlang] # ---- -# string path -# path := "caipirinha/gelada" -# reply.Reply-Message := "The string %{path} should be %json.quote(%{path}) to be a valid JSON string." +# string path path := "caipirinha/gelada" reply.Reply-Message := "The +# string %{path} should be %json.quote(%{path}) to be a valid JSON +# string." # ---- # # .Output @@ -218,23 +216,25 @@ json { # # === %json.encode(...) # -# Generates a JSON document from a given list of attribute templates. The -# format of document generated can be controlled with the 'encode' section in -# the module configuration. Attribute values will automatically be escaped so -# they are JSON-safe. +# Generates a JSON document from a given list of attribute templates. +# The format of document generated can be controlled with the +# 'encode' section in the module configuration. Attribute values will +# automatically be escaped so they are JSON-safe. # -# NOTE: The name of the xlat is based on the instance name of this module. If -# the module was defined as `json jdoc {...}`, then the xlat name will be -# `jdoc_encode`. +# NOTE: The name of the xlat is based on the instance name of this +# module. If the module was defined as `json jdoc {...}`, then the +# xlat name will be `jdoc_encode`. # -# The xlat should be passed a list of attributes to encode. Each attribute -# (after template expansion) will be added to a list of attributes to include -# in the JSON document. If any of the attributes given are preceded with a `!` -# then they are removed from the list. Once all attributes have been processed, -# the JSON document will be created using this list. +# The xlat should be passed a list of attributes to encode. Each +# attribute (after template expansion) will be added to a list of +# attributes to include in the JSON document. If any of the +# attributes given are preceded with a `!` then they are removed from +# the list. Once all attributes have been processed, the JSON +# document will be created using this list. # -# For example, the following will produce a JSON document with two attributes in -# it, `User-Name` and `Calling-Station-Id`, from the RADIUS request: +# For example, the following will produce a JSON document with two +# attributes in it, `User-Name` and `Calling-Station-Id`, from the +# RADIUS request: # # .Example # @@ -242,8 +242,8 @@ json { # %json.encode('User-Name', 'Calling-Station-Id') # ``` # -# The following will include all attributes in the RADIUS request, except for -# `User-Password`: +# The following will include all attributes in the RADIUS request, +# except for `User-Password`: # # .Example # @@ -251,9 +251,10 @@ json { # %json.encode('request[*]', '!User-Password') # ``` # -# In another (contrived) example, all the attributes in the RADIUS request will -# be included in the document, _except_ any attributes in the RADIUS reply. -# `User-Name` will be included from the control list, too, if it exists: +# In another (contrived) example, all the attributes in the RADIUS +# request will be included in the document, _except_ any attributes +# in the RADIUS reply. `User-Name` will be included from the control +# list, too, if it exists: # # .Example # @@ -263,15 +264,15 @@ json { # # ==== Output format modes # -# There are a number of output modes, each generating a different format of -# JSON document. +# There are a number of output modes, each generating a different +# format of JSON document. # -# NOTE: In the JSON document, "type" is the type of the _attribute_, which is -# not necessarily the same as the type of the "value" in the document. See e.g. -# `Login-Service` above, an enumerated value. +# NOTE: In the JSON document, "type" is the type of the _attribute_, +# which is not necessarily the same as the type of the "value" in the +# document. See e.g. `Login-Service` above, an enumerated value. # -# The following examples assume the three attributes are being added to the -# JSON document: +# The following examples assume the three attributes are being added +# to the JSON document: # # ``` # User-Name = bob @@ -311,10 +312,10 @@ json { # # ==== Array output mode examples # -# The "array" mode is a list of objects, each containing an attribute. If the -# "single_value_as_array" value option is set then each attribute will only -# appear once in the array, and "value" will be a list of all the values from -# the same attribute. +# The "array" mode is a list of objects, each containing an +# attribute. If the "single_value_as_array" value option is set then +# each attribute will only appear once in the array, and "value" will +# be a list of all the values from the same attribute. # # .Output mode "array" # @@ -357,11 +358,11 @@ json { # ] # ---- # -# The following output modes either do not include the attribute names or -# values. They are likely to be useful only when the attributes are -# individually specified and _guaranteed to exist_. In this case the attribute -# names in `array_of_names` will have corresponding indexes to the values in -# `array_of_values`. +# The following output modes either do not include the attribute +# names or values. They are likely to be useful only when the +# attributes are individually specified and _guaranteed to exist_. In +# this case the attribute names in `array_of_names` will have +# corresponding indexes to the values in `array_of_values`. # # .Output mode "array_of_names" # diff --git a/raddb/mods-available/kafka b/raddb/mods-available/kafka index 1be3eac6aae..c2102c34ec3 100644 --- a/raddb/mods-available/kafka +++ b/raddb/mods-available/kafka @@ -7,36 +7,37 @@ # = Kafka Producer Module # # The `kafka` module produces records to Apache Kafka topics -# asynchronously. Inbound requests pause while the record is in flight -# and resume once the broker has acknowledged the write (or rejected -# it), so the outcome is reflected in the module's return code. +# asynchronously. Inbound requests pause while the record is in +# flight and resume once the broker has acknowledged the write (or +# rejected it), so the outcome is reflected in the module's return +# code. # -# Setting names here correspond to librdkafka configuration properties; -# for example `client_id` maps to `client.id`. A full reference for -# each property is at: +# Setting names here correspond to librdkafka configuration +# properties; for example `client_id` maps to `client.id`. A full +# reference for each property is at: # # https://github.com/confluentinc/librdkafka/blob/master/CONFIGURATION.md # kafka { # - # server:: Initial list of brokers. One is enough - the rest of - # the cluster is discovered automatically. Specify additional - # servers one per line if you want bootstrap redundancy. + # server:: Initial list of brokers. One is enough - the rest of the + # cluster is discovered automatically. Specify additional servers + # one per line if you want bootstrap redundancy. # server = "localhost:9092" # server = "broker2.example.com:9092" # - # client_id:: Identifier the brokers see for this client. Shows - # up in broker logs and metrics; useful when multiple FreeRADIUS + # client_id:: Identifier the brokers see for this client. Shows up + # in broker logs and metrics; useful when multiple FreeRADIUS # instances share a cluster. # # client_id = "freeradius" # # idempotence:: Guarantee exactly-once, in-order delivery per - # partition. Requires the broker to acknowledge every message; + # partition. Requires the broker to acknowledge every message; # slightly slower, but safe against retries creating duplicates. # # idempotence = yes @@ -48,22 +49,22 @@ kafka { # # queue_max_messages:: Upper bound on unsent records buffered on - # this FreeRADIUS instance. Once the buffer is full, further - # produce attempts fail immediately rather than blocking. + # this FreeRADIUS instance. Once the buffer is full, further produce + # attempts fail immediately rather than blocking. # # queue_max_messages = 100000 # # queue_max_delay:: How long to wait to batch records before - # sending. Higher values increase throughput; lower values - # reduce end-to-end latency. + # sending. Higher values increase throughput; lower values reduce + # end-to-end latency. # # queue_max_delay = 5ms # - # Declared topics. The module only writes to topics listed - # here, so typos in a virtual server are caught at startup - # instead of silently creating unintended topics on the broker. + # Declared topics. The module only writes to topics listed here, so + # typos in a virtual server are caught at startup instead of + # silently creating unintended topics on the broker. # # Per-topic settings (acknowledgement policy, compression, # partitioning, etc.) are nested inside each topic's block. @@ -74,34 +75,33 @@ kafka { # message_timeout = 10s # - # value:: Payload for each record produced to this - # topic. Required. Evaluated per-call, so you can - # interpolate request attributes here. + # value:: Payload for each record produced to this topic. + # Required. Evaluated per-call, so you can interpolate request + # attributes here. # value = %json.encode(&request.[*]) # - # key:: Optional partition key. When omitted, - # librdkafka picks a partition according to the - # configured partitioner. + # key:: Optional partition key. When omitted, librdkafka picks a + # partition according to the configured partitioner. # # key = &User-Name } } # - # flush_timeout:: How long to wait when shutting down for - # in-flight records to drain. Any records still queued after - # this expires are lost. + # flush_timeout:: How long to wait when shutting down for in-flight + # records to drain. Any records still queued after this expires are + # lost. # flush_timeout = 5s # # properties:: Escape hatch for librdkafka settings the module - # doesn't expose as named knobs above. Values here are passed - # to librdkafka verbatim, so use its native units - for example - # `"500"` rather than `"500ms"` for time values, and raw byte - # counts rather than `"1M"` for sizes. + # doesn't expose as named knobs above. Values here are passed to + # librdkafka verbatim, so use its native units - for example `"500"` + # rather than `"500ms"` for time values, and raw byte counts rather + # than `"1M"` for sizes. # ## properties { ## "ssl.engine.id" = "pkcs11" @@ -109,9 +109,8 @@ kafka { ## } # - # Each declared topic also accepts its own `properties { }` - # block for per-topic librdkafka settings that aren't named - # knobs: + # Each declared topic also accepts its own `properties { }` block + # for per-topic librdkafka settings that aren't named knobs: # ## topic { ## radius-accounting { @@ -127,7 +126,7 @@ kafka { # == Usage # # The module exposes one method, `kafka.produce`, and one xlat -# expansion, `%kafka.produce(...)`. Both send a record and pause the +# expansion, `%kafka.produce(...)`. Both send a record and pause the # request until the broker acknowledges or the broker rejects it; the # return code reflects the outcome: # @@ -139,7 +138,7 @@ kafka { # # Call the method as `kafka.produce.`; the topic name must # match one declared in the `topic { }` block above, and typos fail -# at startup. `kafka.send.` and `kafka.recv.` are +# at startup. `kafka.send.` and `kafka.recv.` are # aliases that do the same thing - pick whichever reads most # naturally inside the surrounding section (e.g. `kafka.recv.auth` # inside `recv Access-Request { ... }`). @@ -155,7 +154,7 @@ kafka { # ``` # # This is tidy when you name topics after packet types; if you don't, -# stick with the explicit `kafka.produce.` form. Either way, +# stick with the explicit `kafka.produce.` form. Either way, # the topic must be declared in `topic { }` or the virtual server # will fail to compile. # @@ -191,15 +190,15 @@ kafka { # } # ``` # -# `value` is required per topic. `key` is optional; when omitted, +# `value` is required per topic. `key` is optional; when omitted, # librdkafka picks a partition according to the configured # partitioner. # # === Xlat expansion # -# Use the xlat when the topic or payload is chosen per-request. The +# Use the xlat when the topic or payload is chosen per-request. The # first argument is the topic name, and the rest are the payload (or -# key and payload). It returns `true` on successful delivery and +# key and payload). It returns `true` on successful delivery and # `false` on failure: # # ``` diff --git a/raddb/mods-available/krb5 b/raddb/mods-available/krb5 index ee3ff02ab3f..fe91d54caff 100644 --- a/raddb/mods-available/krb5 +++ b/raddb/mods-available/krb5 @@ -9,7 +9,8 @@ # # The `krb5` module enables the use of Kerberos 5 for authentication. # -# NOTE: This default config presumes you have the MIT Kerberos 5 distribution. +# NOTE: This default config presumes you have the MIT Kerberos 5 +# distribution. # # == Configuration Settings # @@ -40,8 +41,8 @@ krb5 { # # reuse:: Reusable Handles # - # Reusable krb5 handles are allocated in blocks. These - # parameters allow for tuning how that is done. + # Reusable krb5 handles are allocated in blocks. These parameters + # allow for tuning how that is done. # reuse { # @@ -77,15 +78,13 @@ krb5 { # } # ---- # -# Make sure the keytab is readable by the user that is used to run `radiusd` and -# that your authorization configuration really uses `krb5` to do the -# authentication. You will need to add the following to the `authenticate` -# section of your `radiusd.conf` file: +# Make sure the keytab is readable by the user that is used to run +# `radiusd` and that your authorization configuration really uses +# `krb5` to do the authentication. You will need to add the following +# to the `authenticate` section of your `radiusd.conf` file: # # [source, unlang] # ---- -# Auth-Type Kerberos { -# krb5 -# } +# Auth-Type Kerberos { krb5 } # ---- # diff --git a/raddb/mods-available/kv b/raddb/mods-available/kv index 0e0de6be9a4..5beaed8c75e 100644 --- a/raddb/mods-available/kv +++ b/raddb/mods-available/kv @@ -9,18 +9,19 @@ # # In-memory key-value store. # -# This module allows policies to associate "values" with "keys". The +# This module allows policies to associate "values" with "keys". The # data is store _only_ in memory, and is not persisted to disk, or to -# a database. As such, all data in the key-value store is lost when +# a database. As such, all data in the key-value store is lost when # the server restarts. # -# The module creates a _global_ key-value store. That is, one which is -# shared across multiple threads. This design allows a value to be set -# at any time, and in any thread; then examined by a later thread. +# The module creates a _global_ key-value store. That is, one which +# is shared across multiple threads. This design allows a value to be +# set at any time, and in any thread; then examined by a later +# thread. # # The caveat to the global / cross-thread store is that all access to -# the key-value store are protected by a mutex. The mutex serializes -# access to the key-value store. Which means that using this module +# the key-value store are protected by a mutex. The mutex serializes +# access to the key-value store. Which means that using this module # can effectively force the server to become single-threaded, and # therefore destroy all performance. # @@ -29,7 +30,7 @@ # # If you need to store multiple different types of data in a # key-value store, then you should create multiple instances of the -# module. Then, use one instance per type of data, or per use-case. +# module. Then, use one instance per type of data, or per use-case. # This approach causes the module to use multiple mutexes (one for # each instance), which reduces mutex contention and can improve # performance. @@ -40,8 +41,8 @@ # However, the cache module stores _attributes_, and _lists of # attributes_. # -# In contrast, the `kv` module stores _values_. e.g. `ipv4addr`, -# `uint32`, etc. The use-case for the `kv` module is to store a small +# In contrast, the `kv` module stores _values_. e.g. `ipv4addr`, +# `uint32`, etc. The use-case for the `kv` module is to store a small # number of simple values that can be shared across multiple threads. # # == Functions @@ -51,20 +52,20 @@ # # === %kv.write(key, value) # -# Writes _value_ at _key_. Any pre-existing value for _key_ is +# Writes _value_ at _key_. Any pre-existing value for _key_ is # discarded. # # This function returns nothing. # # === %kv.read(key) # -# Reads a value at _key_. If the value exists, it is returned. +# Reads a value at _key_. If the value exists, it is returned. # Otherwise, nothing is returned. # # === %kv.delete(key) # -# Deletes the value found at _key_. If a value was deleted, it is -# returned. Otherwise, nothing is returned. +# Deletes the value found at _key_. If a value was deleted, it is +# returned. Otherwise, nothing is returned. # # == Configuration Settings # @@ -74,13 +75,13 @@ kv { # # Should be 'string', 'octets', 'ipv4addr', etc. # - # The module will automatically choose a data structure based - # on the data type. It will be a hash table, rbtree or - # patricia trie store depending on the data type of the key. + # The module will automatically choose a data structure based on the + # data type. It will be a hash table, rbtree or patricia trie store + # depending on the data type of the key. # - # Any `key` which is passed to the `kv` functions - # (`%kv.write()`, `%kv.read()`, or `%kv.delete()`) must be - # the same data type as is given in `key_type`. + # Any `key` which is passed to the `kv` functions (`%kv.write()`, + # `%kv.read()`, or `%kv.delete()`) must be the same data type as is + # given in `key_type`. # key_type = string @@ -89,14 +90,13 @@ kv { # # The value must be larger than zero. # - # Keys are ordered by "last access" time. Keys which have - # not been used for a while are not automatically removed. - # Keys which are being continuously used will stick around - # forever. + # Keys are ordered by "last access" time. Keys which have not been + # used for a while are not automatically removed. Keys which are + # being continuously used will stick around forever. # - # Keys are removed automatically when the "max_entries" limit - # is reached. When that limit is reached, the olded used (or - # unused) key is deleted every time a new key is inserted. + # Keys are removed automatically when the "max_entries" limit is + # reached. When that limit is reached, the olded used (or unused) + # key is deleted every time a new key is inserted. # # max_entries = 1024 diff --git a/raddb/mods-available/ldap b/raddb/mods-available/ldap index 9d59735ac09..1a2475419ec 100644 --- a/raddb/mods-available/ldap +++ b/raddb/mods-available/ldap @@ -7,15 +7,15 @@ # # = LDAP (Lightweight Directory Access Protocol) Module # -# The `ldap` module allows LDAP directory entries to be retrieved, modified, -# inserted and deleted. +# The `ldap` module allows LDAP directory entries to be retrieved, +# modified, inserted and deleted. # -# NOTE: May also perform user authentication using LDAP binds, or by retrieving -# the contents of a password attribute for later comparison by a module such -# as `pap`, or an `eap` method. +# NOTE: May also perform user authentication using LDAP binds, or by +# retrieving the contents of a password attribute for later +# comparison by a module such as `pap`, or an `eap` method. # -# Please see the file `global.d/ldap` for server-global configuration items -# which control LDAP library debugging. +# Please see the file `global.d/ldap` for server-global configuration +# items which control LDAP library debugging. # # @@ -28,11 +28,11 @@ ldap { # server:: # # Note that this needs to match the name(s) in the LDAP server - # certificate, if you're using ldaps. See OpenLDAP documentation - # for the behavioral semantics of specifying more than one host. + # certificate, if you're using ldaps. See OpenLDAP documentation for + # the behavioral semantics of specifying more than one host. # - # Depending on the `libldap` in use, server may be specified as an LDAP - # URI. In the case of `OpenLDAP` this allows the following + # Depending on the `libldap` in use, server may be specified as an + # LDAP URI. In the case of `OpenLDAP` this allows the following # additional schemes: # # [options="header,autowidth"] @@ -48,15 +48,18 @@ ldap { # server = 'ldap.rrdns.example.org' # - # port:: Port to connect on, defaults to 389, will be ignored for LDAP URIs. + # port:: Port to connect on, defaults to 389, will be ignored for + # LDAP URIs. # # port = 389 # - # identity:: Administrator account for searching and possibly modifying. + # identity:: Administrator account for searching and possibly + # modifying. # - # WARNING: If using SASL + (KRB5 | EXTERNAL) identity should be commented out - # as it will set an authzid, which is likely not what you want. + # WARNING: If using SASL + (KRB5 | EXTERNAL) identity should be + # commented out as it will set an authzid, which is likely not what + # you want. # # identity = 'cn=admin,dc=example,dc=org' @@ -66,8 +69,8 @@ ldap { # password = mypass # - # base_dn:: Unless overridden in another section, the dn from which all - # searches will start from. + # base_dn:: Unless overridden in another section, the dn from which + # all searches will start from. # base_dn = 'dc=example,dc=org' @@ -81,14 +84,16 @@ ldap { # # That will give you the LDAP information for 'user'. # - # Group membership can be queried by using the above "ldapsearch" string, - # and adding "memberof" qualifiers. For ActiveDirectory, use: + # Group membership can be queried by using the above "ldapsearch" + # string, and adding "memberof" qualifiers. For ActiveDirectory, + # use: # # ``` # ldapsearch ... '(&(objectClass=user)(sAMAccountName=user)(memberof=CN=group,${base_dn}))' # ``` # - # Where 'user' is the user as above, and 'group' is the group you are querying for. + # Where 'user' is the user as above, and 'group' is the group you + # are querying for. # ==== # @@ -97,19 +102,19 @@ ldap { # # sasl { ... }:: # - # When we're prompted by the SASL library, the config items in the SASL - # section (in addition to the identity password config items above) - # determine the responses given. + # When we're prompted by the SASL library, the config items in the + # SASL section (in addition to the identity password config items + # above) determine the responses given. # # If any directive is commented out, a NULL response will be # provided to cyrus-sasl. # # Unfortunately the only way to control Keberos here is through - # environmental variables, as cyrus-sasl provides no API to - # set the kerberos (libkrb5) config directly. + # environmental variables, as cyrus-sasl provides no API to set the + # kerberos (libkrb5) config directly. # - # Full documentation for MIT krb5 can be - # found at http://web.mit.edu/kerberos/krb5-devel/doc/admin/env_variables.html + # Full documentation for MIT krb5 can be found at + # http://web.mit.edu/kerberos/krb5-devel/doc/admin/env_variables.html # # At a minimum you probably want to set `KRB5_CLIENT_KTNAME`. # @@ -185,14 +190,16 @@ ldap { # |=== # # Request and list qualifiers may be placed after the `update` - # section name to set default destination requests/lists - # for `s` with no list qualifiers. + # section name to set default destination requests/lists for `s` with no list qualifiers. # - # These attribute maps are applied _before_ any profiles, meaning that - # the values here can be referenced in profiles using expansions. + # These attribute maps are applied _before_ any profiles, meaning + # that the values here can be referenced in profiles using + # expansions. # # NOTE: LDAP attribute names should be single quoted unless you want - # the name to be derived from an xlat expansion, or an attribute ref. + # the name to be derived from an xlat expansion, or an attribute + # ref. # # update { ... }:: # @@ -204,23 +211,24 @@ ldap { ## reply.Tunnel-Medium-Type := 'radiusTunnelMediumType' ## reply.Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId' - # NOTE: Where only a list is specified as the RADIUS attribute, - # the value of the LDAP attribute is parsed as a valuepair - # in the same format as the 'valuepair_attribute' (above). + # NOTE: Where only a list is specified as the RADIUS attribute, the + # value of the LDAP attribute is parsed as a valuepair in the same + # format as the 'valuepair_attribute' (above). control += 'radiusControlAttribute' request += 'radiusRequestAttribute' reply += 'radiusReplyAttribute' } # - # edir:: Set to `yes` if you have eDirectory and want to use the universal - # password mechanism. + # edir:: Set to `yes` if you have eDirectory and want to use the + # universal password mechanism. # # edir = no # - # edir_autz:: Set to `yes` if you want to bind as the user after retrieving the - # `Password.Cleartext`. This will consume the login grace, and verify user authorization. + # edir_autz:: Set to `yes` if you want to bind as the user after + # retrieving the `Password.Cleartext`. This will consume the login + # grace, and verify user authorization. # # edir_autz = no @@ -235,10 +243,8 @@ ldap { # # [source, unlang] # ---- - # ldap - # if ((ok || updated) && User-Password) { - # control.Auth-Type := ::ldap - # } + # ldap if ((ok || updated) && User-Password) { control.Auth-Type := + # ::ldap } # ---- # ==== # @@ -253,33 +259,37 @@ ldap { base_dn = "${..base_dn}" # - # filter:: Filter for user objects, should be specific enough - # to identify a single user object. + # filter:: Filter for user objects, should be specific enough to + # identify a single user object. # filter = "(uid=%{Stripped-User-Name || User-Name})" - # For Active Directory nested group, you should comment out the previous 'filter = ...' - # and use the below. Where 'group' is the group you are querying for. + # For Active Directory nested group, you should comment out the + # previous 'filter = ...' and use the below. Where 'group' is the + # group you are querying for. # - # NOTE: The string '1.2.840.113556.1.4.1941' specifies LDAP_MATCHING_RULE_IN_CHAIN. - # This applies only to DN attributes. This is an extended match operator that walks - # the chain of ancestry in objects all the way to the root until it finds a match. - # This reveals group nesting. It is available only on domain controllers with - # Windows Server 2003 SP2 or Windows Server 2008 (or above). + # NOTE: The string '1.2.840.113556.1.4.1941' specifies + # LDAP_MATCHING_RULE_IN_CHAIN. This applies only to DN attributes. + # This is an extended match operator that walks the chain of + # ancestry in objects all the way to the root until it finds a + # match. This reveals group nesting. It is available only on domain + # controllers with Windows Server 2003 SP2 or Windows Server 2008 + # (or above). # - # For further information, see https://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx + # For further information, see + # https://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx # # filter = "(&(objectClass=user)(sAMAccountName=%{Stripped-User-Name || User-Name})(memberOf:1.2.840.113556.1.4.1941:=cn=group,${..base_dn}))" # # sasl { ... }:: SASL parameters to use for user binds # - # When we're prompted by the SASL library, these control - # the responses given. + # When we're prompted by the SASL library, these control the + # responses given. # - # NOTE: Any of the config items below may be an attribute ref - # or and expansion. This allows different SASL mechs, - # proxy IDs and realms to be used for different users. + # NOTE: Any of the config items below may be an attribute ref or + # and expansion. This allows different SASL mechs, proxy IDs and + # realms to be used for different users. # sasl { # @@ -288,8 +298,8 @@ ldap { # mech = 'PLAIN' # - # authname:: SASL authentication name. Mechanism specific value - # to use when prompted for the client authentication name. + # authname:: SASL authentication name. Mechanism specific value to + # use when prompted for the client authentication name. # # authname = User-Name @@ -305,15 +315,18 @@ ldap { } # - # password_attribute:: Which attribute in the request should be used as - # the password when performing user binds. + # password_attribute:: Which attribute in the request should be + # used as the password when performing user binds. # - # Note that Active Directory will allow unauthenticated user binds by default! + # Note that Active Directory will allow unauthenticated user binds + # by default! # - # You can fix this by choosing the "ADSI Edit" command from the Server Manager's Tools menu. - # Then, open the Configuration subtree, and then open the properties of the `CN=Directory - # Service, CN=Windows NT, CN=Services, CN=Configuration` object. Modify the - # `msDS-Other-Settings` attribute, and add a new entry for `DenyUnauthenticatedBind=1`. + # You can fix this by choosing the "ADSI Edit" command from the + # Server Manager's Tools menu. Then, open the Configuration + # subtree, and then open the properties of the `CN=Directory + # Service, CN=Windows NT, CN=Services, CN=Configuration` object. + # Modify the `msDS-Other-Settings` attribute, and add a new entry + # for `DenyUnauthenticatedBind=1`. # # password_attribute = User-Password @@ -334,7 +347,8 @@ ldap { # sorting order will be reversed for that attribute. # # * If `sort_by` is set, and the server does not support sorting - # or the attributes do not have an ORDERING rule, the search will fail. + # or the attributes do not have an ORDERING rule, the search will + # fail. # # * If a search returns multiple user objects and `sort_by` is not # set, the search will fail. @@ -344,17 +358,17 @@ ldap { # # access_attribute:: If this is undefined, anyone is authorised. # - # If it is defined, the contents of this attribute determine whether - # or not the user is authorised. + # If it is defined, the contents of this attribute determine + # whether or not the user is authorised. # # access_attribute = 'dialupAccess' # - # access_positive:: Control whether the presence of `access_attribute` - # allows access, or denies access. + # access_positive:: Control whether the presence of + # `access_attribute` allows access, or denies access. # # * If `yes`, and the `access_attribute` is present, or `no` and the - # `access_attribute` is absent then access will be allowed. + # `access_attribute` is absent then access will be allowed. # # * If `yes`, and the `access_attribute` is absent, or `no` and the # `access_attribute` is present, then access will not be allowed. @@ -382,21 +396,22 @@ ldap { # access_value_negate = 'false' # - # access_value_suspend:: Which value we look for in access_attribute - # to indicate that the user should be suspended. + # access_value_suspend:: Which value we look for in + # access_attribute to indicate that the user should be suspended. # # access_value_suspend = 'suspended' # - # expect_password:: When set to no, disable warnings for missing password - # attributes in user objects returned from LDAP. This is useful for - # ISP environments where some subscribers have passwords set, and others - # do not (e.g. mixed IPoE and PPPoE). + # expect_password:: When set to no, disable warnings for missing + # password attributes in user objects returned from LDAP. This is + # useful for ISP environments where some subscribers have passwords + # set, and others do not (e.g. mixed IPoE and PPPoE). # # expect_password = no # - # dn_attribute:: Where to cache the user's DN for use in authentication. + # dn_attribute:: Where to cache the user's DN for use in + # authentication. # # dn_attribute = 'LDAP-UserDN' } @@ -414,8 +429,8 @@ ldap { # filter:: Filter for group objects, should match all available # group objects a user might be a member of. # - # If using Active Directory you are likely to need `group` - # instead of `posixGroup`. + # If using Active Directory you are likely to need `group` instead + # of `posixGroup`. # filter = '(objectClass=posixGroup)' @@ -432,47 +447,51 @@ ldap { # name_attribute = cn # - # membership_filter:: Filter to find all group objects a user is a member of. + # membership_filter:: Filter to find all group objects a user is a + # member of. # - # That is, group objects with attributes that identify - # members (the inverse of `membership_attribute`). + # That is, group objects with attributes that identify members (the + # inverse of `membership_attribute`). # # membership_filter = "(|(member=%{control.Ldap-UserDn})(memberUid=%{Stripped-User-Name || User-Name}))" # - # membership_attribute:: The attribute, in user objects, which contain - # the names or DNs of groups a user is a member of. + # membership_attribute:: The attribute, in user objects, which + # contain the names or DNs of groups a user is a member of. # - # Unless a conversion between group name and group DN is - # needed, there's no requirement for the group objects - # referenced to actually exist. + # Unless a conversion between group name and group DN is needed, + # there's no requirement for the group objects referenced to + # actually exist. # # [NOTE] # ==== - # If the LDAP server does not support the `memberOf` attribute (or equivalent), - # then you will need to use the membership_filter option above instead. - # If you can't see the `memberOf` attribute then it is also possible that the - # LDAP bind user does not have the correct permissions to view it. + # If the LDAP server does not support the `memberOf` attribute (or + # equivalent), then you will need to use the membership_filter + # option above instead. If you can't see the `memberOf` attribute + # then it is also possible that the LDAP bind user does not have + # the correct permissions to view it. # ==== # membership_attribute = 'memberOf' # - # cacheable_name:: If `cacheable_name` or `cacheable_dn` are enabled, - # all group information for the user will be retrieved from the directory - # and written to `LDAP-Group` attributes appropriate for the instance of rlm_ldap. + # cacheable_name:: If `cacheable_name` or `cacheable_dn` are + # enabled, all group information for the user will be retrieved + # from the directory and written to `LDAP-Group` attributes + # appropriate for the instance of rlm_ldap. # - # For group comparisons these attributes will be checked instead of querying - # the LDAP directory directly. + # For group comparisons these attributes will be checked instead of + # querying the LDAP directory directly. # - # This feature is intended to be used with `rlm_cache`, but may also be useful - # if all group values need to be processed using `unlang` policies. + # This feature is intended to be used with `rlm_cache`, but may + # also be useful if all group values need to be processed using + # `unlang` policies. # - # If you wish to use this feature, you should enable the type that matches the - # format of your check items. + # If you wish to use this feature, you should enable the type that + # matches the format of your check items. # - # i.e. if your groups are specified as DNs then enable `cacheable_dn` - # else enable `cacheable_name`. + # i.e. if your groups are specified as DNs then enable + # `cacheable_dn` else enable `cacheable_name`. # # cacheable_name = 'no' @@ -482,8 +501,9 @@ ldap { # cacheable_dn = 'no' # - # cache_attribute:: Override the normal cache attribute (`-LDAP-Group` or - # `LDAP-Group` if using the default instance) and create a custom attribute. + # cache_attribute:: Override the normal cache attribute + # (`-LDAP-Group` or `LDAP-Group` if using the default + # instance) and create a custom attribute. # # This can help if multiple module instances are used in fail-over. # @@ -492,25 +512,27 @@ ldap { # # allow_dangling_group_ref:: # - # If the group being checked is specified as a name, but the user's groups are - # referenced by DN, and one of those group DNs is invalid, the whole group check - # is treated as invalid, and a negative result will be returned. + # If the group being checked is specified as a name, but the user's + # groups are referenced by DN, and one of those group DNs is + # invalid, the whole group check is treated as invalid, and a + # negative result will be returned. # # When set to `yes`, this option ignores invalid DN references. # # allow_dangling_group_ref = 'no' # - # group_attribute:: Override the normal group comparison attribute name - # `(-Group` or `LDAP-Group` if using the default instance). + # group_attribute:: Override the normal group comparison attribute + # name `(-Group` or `LDAP-Group` if using the default + # instance). # group_attribute = "${..:instance}-Group" # # skip_on_suspend:: # - # Don't process user groups if the user has been suspended. - # If set to 'no', groups will still be processed. + # Don't process user groups if the user has been suspended. If set + # to 'no', groups will still be processed. # # Groups are never processed for disabled users. # @@ -522,9 +544,9 @@ ldap { # # === User profiles # - # RADIUS profile objects contain sets of attributes to insert into the request. - # These attributes are mapped using the same mapping scheme applied to user - # objects (the update section above). + # RADIUS profile objects contain sets of attributes to insert into + # the request. These attributes are mapped using the same mapping + # scheme applied to user objects (the update section above). # profile { # @@ -535,37 +557,39 @@ ldap { # # scope:: Search scope, may be `base`, `one`, `sub` or `children`. # - # Should usually be left as "base", to retrieve the specific profile - # specified by 'default' or in the user or group objects. + # Should usually be left as "base", to retrieve the specific + # profile specified by 'default' or in the user or group objects. # # scope = 'base' # - # default:: The default profile. This may be a DN or an attribute reference. + # default:: The default profile. This may be a DN or an attribute + # reference. # - # NOTE: To get old v2.2.x style behaviour, or to use the `User-Profile` attribute - # to specify the default profile, set this to `control.User-Profile`. + # NOTE: To get old v2.2.x style behaviour, or to use the + # `User-Profile` attribute to specify the default profile, set this + # to `control.User-Profile`. # # default = 'cn=radprofile,dc=example,dc=org' # - # attribute:: The LDAP attribute containing profile DNs to apply - # in addition to the default profile above. + # attribute:: The LDAP attribute containing profile DNs to apply in + # addition to the default profile above. # # These are retrieved from the user object, at the same time as the - # attributes from the update section, are are applied if authorization - # is successful. + # attributes from the update section, are are applied if + # authorization is successful. # # attribute = 'radiusProfileDn' # - # attribute_suspend:: The LDAP attribute containing profile DNs to apply - # in addition to the default profile above, when the user account is in - # the suspended state + # attribute_suspend:: The LDAP attribute containing profile DNs to + # apply in addition to the default profile above, when the user + # account is in the suspended state # # These are retrieved from the user object, at the same time as the - # attributes from the update section, are are applied if authorization - # is successful. + # attributes from the update section, are are applied if + # authorization is successful. # # attribute_suspend = 'radiusProfileDn' @@ -580,13 +604,15 @@ ldap { # sorting order will be reversed for that attribute. # # * If `sort_by` is set, and the server does not support sorting - # or the attributes do not have an ORDERING rule, the search will fail. + # or the attributes do not have an ORDERING rule, the search will + # fail. # # sort_by = 'radiusProfilePriority' # # check_attribute:: The LDAP attribute containing conditions which - # will be evaluated to determine whether a profile should be applied. + # will be evaluated to determine whether a profile should be + # applied. # # check_attribute = 'radiusProfileCondition' @@ -598,8 +624,9 @@ ldap { # fallthrough_attribute = 'radiusProfileFallthrough' # - # fallthrough_def:: If the attribute referenced in fallthrough_attribute - # is not in the reply, what should be the default behaviour + # fallthrough_def:: If the attribute referenced in + # fallthrough_attribute is not in the reply, what should be the + # default behaviour # # fallthrough_default = yes } @@ -607,8 +634,8 @@ ldap { # # === Modify user object on receiving Accounting-Request # - # Useful for recording things like the last time the user logged - # in, or the `Acct-Session-ID` for CoA/DM. + # Useful for recording things like the last time the user logged in, + # or the `Acct-Session-ID` for CoA/DM. # # LDAP modification items are in the format: # @@ -667,7 +694,8 @@ ldap { # options { # - # dereference:: Control under which situations aliases are followed. + # dereference:: Control under which situations aliases are + # followed. # # May be one of 'never', 'searching', 'finding' or 'always' # @@ -678,49 +706,53 @@ ldap { # dereference = 'always' # - # chase_referrals:: controls whether the server follows references returned - # by the LDAP directory. + # chase_referrals:: controls whether the server follows references + # returned by the LDAP directory. # - # They are mostly for Active Directory compatibility. - # If you set this to `no`, then searches will likely return 'operations error', - # instead of a useful result. + # They are mostly for Active Directory compatibility. If you set + # this to `no`, then searches will likely return 'operations + # error', instead of a useful result. # chase_referrals = yes # - # rebind:: If `chase_referrals` is `yes` then, when a referral is followed - # having `rebind` set to `no` will cause the server to do an anonymous bind when - # making any additional connections. Setting this to `yes` will either bind - # with the admin credentials or the credentials from the rebind url depending - # on `use_referral_credentials`. + # rebind:: If `chase_referrals` is `yes` then, when a referral is + # followed having `rebind` set to `no` will cause the server to do + # an anonymous bind when making any additional connections. Setting + # this to `yes` will either bind with the admin credentials or the + # credentials from the rebind url depending on + # `use_referral_credentials`. # rebind = yes # - # use_referral_credentials:: On `rebind`, use the credentials from the rebind url - # instead of admin credentials used during the initial bind. + # use_referral_credentials:: On `rebind`, use the credentials from + # the rebind url instead of admin credentials used during the + # initial bind. # # Default `no` # use_referral_credentials = no # - # session_tracking:: If `yes`, then include `draft-wahl-ldap-session` tracking - # controls. + # session_tracking:: If `yes`, then include + # `draft-wahl-ldap-session` tracking controls. # - # If yes, encodes `NAS-IP-Address`, `NAS-IPv6-Address`, `User-Name`, `Acct-Session-Id`, - # `Acct-Multi-Session-Id` as session tracking controls in applicable LDAP operations. + # If yes, encodes `NAS-IP-Address`, `NAS-IPv6-Address`, + # `User-Name`, `Acct-Session-Id`, `Acct-Multi-Session-Id` as + # session tracking controls in applicable LDAP operations. # # Default `no` # # session_tracking = yes # - # sasl_secprops:: SASL Security Properties (see SASL_SECPROPS in ldap.conf man page). + # sasl_secprops:: SASL Security Properties (see SASL_SECPROPS in + # ldap.conf man page). # - # NOTE: uncomment when using GSS-API sasl mechanism along with TLS encryption against - # Active-Directory LDAP servers (this disables sealing and signing at the GSS level as - # required by AD). + # NOTE: uncomment when using GSS-API sasl mechanism along with TLS + # encryption against Active-Directory LDAP servers (this disables + # sealing and signing at the GSS level as required by AD). # # sasl_secprops = 'noanonymous,noplain,maxssf=0' @@ -732,8 +764,8 @@ ldap { res_timeout = 10 # - # srv_timelimit:: Seconds LDAP server has to process the query (server-side - # time limit). + # srv_timelimit:: Seconds LDAP server has to process the query + # (server-side time limit). # # Default `20` # @@ -742,23 +774,24 @@ ldap { srv_timelimit = 3 # - # idle:: Set the number of seconds a connection needs to remain idle - # before TCP starts sending keepalive probes. + # idle:: Set the number of seconds a connection needs to remain + # idle before TCP starts sending keepalive probes. # # NOTE: `LDAP_OPT_X_KEEPALIVE_IDLE` is set to this value. # idle = 60 # - # probes:: Set the maximum number of keepalive probes TCP should send - # before dropping the connection. + # probes:: Set the maximum number of keepalive probes TCP should + # send before dropping the connection. # # NOTE: `LDAP_OPT_X_KEEPALIVE_PROBES` is set to this value. # probes = 3 # - # interval:: Set the interval in seconds between individual keepalive probes. + # interval:: Set the interval in seconds between individual + # keepalive probes. # # NOTE: `LDAP_OPT_X_KEEPALIVE_INTERVAL` is set to this value. # @@ -772,9 +805,9 @@ ldap { net_timeout = 10 # - # reconnection_delay:: Sets the time in seconds before a failed connection - # will attempt reconnection. This includes failures to bind as the admin - # user due to incorrect credentials. + # reconnection_delay:: Sets the time in seconds before a failed + # connection will attempt reconnection. This includes failures to + # bind as the admin user due to incorrect credentials. # reconnection_delay = 10 } @@ -782,24 +815,27 @@ ldap { # # === TLS encrypted connections # - # This subsection configures the `tls` related items that control how FreeRADIUS - # connects to an LDAP server. It contains all of the `tls_*` configuration entries - # used in older versions of FreeRADIUS. + # This subsection configures the `tls` related items that control + # how FreeRADIUS connects to an LDAP server. It contains all of the + # `tls_*` configuration entries used in older versions of + # FreeRADIUS. # - # Those configuration entries can still be used, but we recommend using these. + # Those configuration entries can still be used, but we recommend + # using these. # tls { # - # start_tls:: Set this to `yes` to use TLS encrypted connections - # to the LDAP database by using the StartTLS extended operation. + # start_tls:: Set this to `yes` to use TLS encrypted connections to + # the LDAP database by using the StartTLS extended operation. # - # The StartTLS operation is supposed to be used with normal ldap connections - # instead of using ldaps (port 636) connections + # The StartTLS operation is supposed to be used with normal ldap + # connections instead of using ldaps (port 636) connections # # start_tls = yes # - # NOTE: If `start_tls = yes`, then fill up those such options with the certificate information. + # NOTE: If `start_tls = yes`, then fill up those such options with + # the certificate information. # ## ca_file = ${certdir}/cacert.pem ## ca_path = ${certdir} @@ -821,13 +857,14 @@ ldap { # | 'hard' | similar to 'demand' but fails if TLS cannot negotiate. # |=== # - # NOTE: The default is libldap's default, which varies based on the contents of `ldap.conf`. + # NOTE: The default is libldap's default, which varies based on the + # contents of `ldap.conf`. # # require_cert = 'demand' # - # Minimum TLS version to accept. We STRONGLY recommend - # setting this to "1.2" + # Minimum TLS version to accept. We STRONGLY recommend setting this + # to "1.2" # # tls_min_version = "1.2" } @@ -835,22 +872,22 @@ ldap { # # === Connection Pool # - # The connection pool is a set of per-thread parameters for connections - # to the LDAP server. + # The connection pool is a set of per-thread parameters for + # connections to the LDAP server. # - # This connection pool is used for LDAP queries run as the administrative user. + # This connection pool is used for LDAP queries run as the + # administrative user. # - # All LDAP operations are performed asynchronously, meaning that many queries - # can be active on a single connection simultaneously. + # All LDAP operations are performed asynchronously, meaning that + # many queries can be active on a single connection simultaneously. # pool { # # start:: Connections to create during module instantiation. # # If the server cannot create specified number of connections - # during instantiation it will exit. - # Set to `0` to allow the server to start without the directory - # being available. + # during instantiation it will exit. Set to `0` to allow the server + # to start without the directory being available. # start = 0 @@ -862,8 +899,9 @@ ldap { # # max:: Maximum number of connections. # - # If these connections are all fully in use (refer to per_connection_max below) - # and a new one is requested, the request will NOT get a connection. + # If these connections are all fully in use (refer to + # per_connection_max below) and a new one is requested, the request + # will NOT get a connection. # max = 5 @@ -889,13 +927,15 @@ ldap { # # open_delay:: Open delay (in seconds). # - # How long must we be above the target utilisation for connections to be opened. + # How long must we be above the target utilisation for connections + # to be opened. # open_delay = 0.2 # # close_delay:: Close delay (in seconds). # - # How long we must be below the target utilisation for connections to be closed + # How long we must be below the target utilisation for connections + # to be closed # # close_delay = 10 @@ -905,26 +945,29 @@ ldap { # manage_interval = 0.2 # - # request:: Options specific to requests handled by this connection pool + # request:: Options specific to requests handled by this connection + # pool # request { # - # per_connection_max:: Maximum number of active queries there can be on a - # single connection. + # per_connection_max:: Maximum number of active queries there can + # be on a single connection. # # per_connection_max = 2000 # - # per_connection_target:: Target number of active queries on a single connection. + # per_connection_target:: Target number of active queries on a + # single connection. # # per_connection_target = 1000 # - # free_delay:: How long must a request in the unassigned (free) list not have been - # used for before it's cleaned up and actually freed. + # free_delay:: How long must a request in the unassigned (free) + # list not have been used for before it's cleaned up and actually + # freed. # - # Unassigned requests can be re-used, multiple times, reducing memory allocation - # and freeing overheads. + # Unassigned requests can be re-used, multiple times, reducing + # memory allocation and freeing overheads. # # free_delay = 10 } @@ -933,17 +976,18 @@ ldap { # # === Bind Connection Pool # - # This connection pool is used for LDAP binds used to authenticate requests when - # calling the ldap module in authenticate context. If passwords are retrieved - # from the ldap directory and FreeRADIUS performs the authentication then this is - # not used. + # This connection pool is used for LDAP binds used to authenticate + # requests when calling the ldap module in authenticate context. If + # passwords are retrieved from the ldap directory and FreeRADIUS + # performs the authentication then this is not used. # - # The options are essentially identical to the pool section above with certain - # limitations. Since only one bind operation can be in progress on a connection at - # a time, `per_connection_max` and `per_connection_target` are always set to 1. + # The options are essentially identical to the pool section above + # with certain limitations. Since only one bind operation can be in + # progress on a connection at a time, `per_connection_max` and + # `per_connection_target` are always set to 1. # - # This limitation means that `max` represents the maximum number of in progress - # binds which there can be on a single thread. + # This limitation means that `max` represents the maximum number of + # in progress binds which there can be on a single thread. # bind_pool { start = 0 @@ -958,9 +1002,9 @@ ldap { # The following policy ensures that every call to the `ldap` module # will time out within a short period of time. # -# The policy name here should be the same as the module name. -# Reusing the same name means that this policy will be used instead -# of the module. +# The policy name here should be the same as the module name. Reusing +# the same name means that this policy will be used instead of the +# module. # ##@policy ldap { ## timeout 1s { @@ -981,18 +1025,20 @@ ldap { # If the LDAP uri starts `ldap:///`, i.e. no host is specified, then # the server configured for the module will be used. # -# When embedding user-controlled values in the filter part of the URI, wrap -# them with `%ldap.filter.escape(...)`. When embedding values in the DN part -# (base DN, or in a DN being looked up), wrap them with `%ldap.dn.escape(...)`. -# Inserting unescaped user input allows LDAP injection attacks. +# When embedding user-controlled values in the filter part of the +# URI, wrap them with `%ldap.filter.escape(...)`. When embedding +# values in the DN part (base DN, or in a DN being looked up), wrap +# them with `%ldap.dn.escape(...)`. Inserting unescaped user input +# allows LDAP injection attacks. # # .Example - safe filter embedding # # [source,unlang] # ---- -# # User-Name is filter-escaped before being embedded in the search filter. -# # Without escaping, a User-Name of '*' would produce (uid=*) and match all users. -# reply.Reply-Message := "Welcome %ldap("ldap:///ou=people,dc=example,dc=com?displayName?sub?(uid=%ldap.filter.escape(%{User-Name}))")" +# = User-Name is filter-escaped before being embedded in the search filter. +# = Without escaping, a User-Name of '*' would produce (uid=*) and match all users. +# reply.Reply-Message := "Welcome +# %ldap("ldap:///ou=people,dc=example,dc=com?displayName?sub?(uid=%ldap.filter.escape(%{User-Name}))")" # ---- # # .Output @@ -1004,17 +1050,19 @@ ldap { # # [source,unlang] # ---- -# # User-Name is DN-escaped before being used in the base DN. -# # Without escaping, a value containing ',' could add extra DN components. -# result := %ldap("ldap:///ou=%ldap.dn.escape(%{User-Name}),dc=example,dc=com?cn?base") +# = User-Name is DN-escaped before being used in the base DN. +# = Without escaping, a value containing ',' could add extra DN components. +# result := +# %ldap("ldap:///ou=%ldap.dn.escape(%{User-Name}),dc=example,dc=com?cn?base") # ---- # # === %ldap.dn.escape(...) # -# Escape a string for use in an LDAP distinguished name (RFC 4514). Characters -# that are special in a DN component (`,`, `+`, `"`, `\`, `<`, `>`, `;`, `*`, `=`, `(`, `)`) -# are converted to `\HH` hex sequences. The result is marked safe for use in DN positions -# and will not be re-escaped. +# Escape a string for use in an LDAP distinguished name (RFC 4514). +# Characters that are special in a DN component (`,`, `+`, `"`, `\`, +# `<`, `>`, `;`, `*`, `=`, `(`, `)`) are converted to `\HH` hex +# sequences. The result is marked safe for use in DN positions and +# will not be re-escaped. # # .Return: _string_ # @@ -1022,8 +1070,8 @@ ldap { # # [source,unlang] # ---- -# my-string := "cn=admin,dc=example,dc=com" -# reply.Reply-Message := "Escaped: %ldap.dn.escape(%{my-string})" +# my-string := "cn=admin,dc=example,dc=com" reply.Reply-Message := +# "Escaped: %ldap.dn.escape(%{my-string})" # ---- # # .Output @@ -1034,9 +1082,10 @@ ldap { # # === %ldap.dn.safe(...) # -# Mark a string as already safe for use in an LDAP DN. The value will not be escaped or -# modified, and will be allowed in places where dynamic values are usually prohibited. -# Use this only for strings you have constructed or validated yourself. +# Mark a string as already safe for use in an LDAP DN. The value will +# not be escaped or modified, and will be allowed in places where +# dynamic values are usually prohibited. Use this only for strings +# you have constructed or validated yourself. # # .Return: _string_ # @@ -1044,12 +1093,14 @@ ldap { # # [source,unlang] # ---- -# my-int := "%ldap.profile(ldap://%ldap.uri.safe(%{LDAP-Host}):%ldap.uri.safe(%{LDAP-Port})/ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)" +# my-int := +# "%ldap.profile(ldap://%ldap.uri.safe(%{LDAP-Host}):%ldap.uri.safe(%{LDAP-Port})/ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)" # ---- # # === %ldap.dn.unescape(...) # -# Decode `\HH` hex sequences in an LDAP DN string back to their original characters. +# Decode `\HH` hex sequences in an LDAP DN string back to their +# original characters. # # .Return: _string_ # @@ -1069,15 +1120,17 @@ ldap { # # === %ldap.filter.escape(...) # -# Escape a string for use as an assertion value in an LDAP search filter (RFC 4515). -# Only the characters that are special in a filter assertion value are escaped: -# `*`, `(`, `)`, `\`, and NUL. Characters such as `=`, `+`, and `,` are intentionally -# left unescaped because OpenLDAP does not decode non-required `\HH` sequences, so -# escaping them would cause silent match failures for usernames that legitimately -# contain those characters. +# Escape a string for use as an assertion value in an LDAP search +# filter (RFC 4515). Only the characters that are special in a filter +# assertion value are escaped: `*`, `(`, `)`, `\`, and NUL. +# Characters such as `=`, `+`, and `,` are intentionally left +# unescaped because OpenLDAP does not decode non-required `\HH` +# sequences, so escaping them would cause silent match failures for +# usernames that legitimately contain those characters. # -# Use this function -- not `%ldap.dn.escape` -- when inserting user-controlled values -# into the filter part of an LDAP URI or search string. +# Use this function -- not `%ldap.dn.escape` -- when inserting +# user-controlled values into the filter part of an LDAP URI or +# search string. # # .Return: _string_ # @@ -1085,16 +1138,17 @@ ldap { # # [source,unlang] # ---- -# # Safely embed User-Name in a search filter. -# # A payload like '*' would otherwise produce (uid=*), matching every user. -# result := %ldap("ldap:///ou=people,dc=example,dc=com?cn?sub?(uid=%ldap.filter.escape(%{User-Name}))") +# = Safely embed User-Name in a search filter. +# = A payload like '*' would otherwise produce (uid=*), matching every user. +# result := +# %ldap("ldap:///ou=people,dc=example,dc=com?cn?sub?(uid=%ldap.filter.escape(%{User-Name}))") # ---- # # === %ldap.filter.safe(...) # -# Mark a string as already safe for use in an LDAP filter assertion value. The value will -# not be escaped or modified. Use this only for strings you have constructed or validated -# yourself. +# Mark a string as already safe for use in an LDAP filter assertion +# value. The value will not be escaped or modified. Use this only for +# strings you have constructed or validated yourself. # # .Return: _string_ # @@ -1102,15 +1156,15 @@ ldap { # # [source,unlang] # ---- -# # A filter fragment built in policy code, known to be safe. -# my-filter := "(objectClass=radiusprofile)" -# result := %ldap("ldap:///ou=profiles,dc=example,dc=com?cn?sub?%ldap.filter.safe(%{my-filter})") +# = A filter fragment built in policy code, known to be safe. +# my-filter := "(objectClass=radiusprofile)" result := +# %ldap("ldap:///ou=profiles,dc=example,dc=com?cn?sub?%ldap.filter.safe(%{my-filter})") # ---- # # === %ldap.filter.unescape(...) # -# Decode `\HH` hex sequences in an LDAP filter assertion value back to their original -# characters. +# Decode `\HH` hex sequences in an LDAP filter assertion value back +# to their original characters. # # .Return: _string_ # @@ -1118,8 +1172,8 @@ ldap { # # [source,unlang] # ---- -# my-string := "john\29\28uid=\2a" -# reply.Reply-Message := "Unescaped: %ldap.filter.unescape(%{my-string})" +# my-string := "john\29\28uid=\2a" reply.Reply-Message := "Unescaped: +# %ldap.filter.unescape(%{my-string})" # ---- # # .Output @@ -1130,9 +1184,9 @@ ldap { # # === %ldap.uri.escape(...) # -# Escape a string for safe embedding in an LDAP URI. Special URI characters are -# converted to `\HH` hex sequences so that user-supplied values cannot alter the -# structure of the URI. +# Escape a string for safe embedding in an LDAP URI. Special URI +# characters are converted to `\HH` hex sequences so that +# user-supplied values cannot alter the structure of the URI. # # .Return: _string_ # @@ -1140,7 +1194,8 @@ ldap { # # [source,unlang] # ---- -# my-string := "ldap:///ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)" +# my-string := +# "ldap:///ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)" # reply.Reply-Message := "Escaped: %ldap.uri.escape(%{my-string})" # ---- # @@ -1152,9 +1207,10 @@ ldap { # # === %ldap.uri.safe(...) # -# Mark a string as already safe for use in an LDAP URI. The value will not be escaped or -# modified. Use this for URI components (host, port, path) that you have already -# validated or constructed yourself. +# Mark a string as already safe for use in an LDAP URI. The value +# will not be escaped or modified. Use this for URI components (host, +# port, path) that you have already validated or constructed +# yourself. # # .Return: _string_ # @@ -1162,12 +1218,14 @@ ldap { # # [source,unlang] # ---- -# my-int := "%ldap.profile(ldap://%ldap.uri.safe(%{LDAP-Host}):%ldap.uri.safe(%{LDAP-Port})/ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)" +# my-int := +# "%ldap.profile(ldap://%ldap.uri.safe(%{LDAP-Host}):%ldap.uri.safe(%{LDAP-Port})/ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)" # ---- # # === %ldap.uri.unescape(...) # -# Decode `\HH` hex sequences in an LDAP URI string back to their original characters. +# Decode `\HH` hex sequences in an LDAP URI string back to their +# original characters. # # .Return: _string_ # @@ -1175,8 +1233,10 @@ ldap { # # [source,unlang] # ---- -# my-string := "ldap\3a\2f\2fou\3dprofiles\2cdc\3dexample\2cdc\3dcom\3f\3fsub\3f\28objectClass\3dradiusprofile\29" -# reply.Reply-Message := "Unescaped: %ldap.uri.unescape(%{my-string})" +# my-string := +# "ldap\3a\2f\2fou\3dprofiles\2cdc\3dexample\2cdc\3dcom\3f\3fsub\3f\28objectClass\3dradiusprofile\29" +# reply.Reply-Message := "Unescaped: +# %ldap.uri.unescape(%{my-string})" # ---- # # .Output @@ -1189,10 +1249,10 @@ ldap { # # Add an option to all attribute referenced in an LDAP URI. # -# This is for the corner case where a URI is provided by a third party system -# and needs amending before being used. e.g. a CRL distribution point extracted -# from a certificate may need the "binary" option appending to the attribute -# being requested. +# This is for the corner case where a URI is provided by a third +# party system and needs amending before being used. e.g. a CRL +# distribution point extracted from a certificate may need the +# "binary" option appending to the attribute being requested. # # .Return: _string_ # @@ -1200,7 +1260,8 @@ ldap { # # [source,unlang] # ---- -# my-uri := "ldap:///cn=cdp1,ou=pki,dc=example,dc=com?certificateRevocationList?base?objectClass=cRLDistributionPoint" +# my-uri := +# "ldap:///cn=cdp1,ou=pki,dc=example,dc=com?certificateRevocationList?base?objectClass=cRLDistributionPoint" # reply.Reply-Message := %ldap.uri.attr_option(my-uri, 'binary') # ---- # @@ -1212,13 +1273,14 @@ ldap { # # === %ldap.group(...) # -# Check whether the current user is a member of a the given group. If the attribute -# `control.LDAP-UserDN` exists, that will be used as the "user" object. If it does -# not then the user is first looked up using the filter form the `user { }` section -# of the module configuration. +# Check whether the current user is a member of a the given group. If +# the attribute `control.LDAP-UserDN` exists, that will be used as +# the "user" object. If it does not then the user is first looked up +# using the filter form the `user { }` section of the module +# configuration. # -# Groups can be specified either as a name or a DN, with a lookup used if necessary -# to convert to the required format. +# Groups can be specified either as a name or a DN, with a lookup +# used if necessary to convert to the required format. # # .Return: _bool_ # @@ -1234,10 +1296,10 @@ ldap { # # === %ldap.profile(...) # -# Retrieve an LDAP object representing an RADIUS profile and apply the attriubte -# updates as configured in the module `update` section. This can be useful when -# additional profiles need to be applied to a subscriber beyond those directly -# associated with their LDAP entry. +# Retrieve an LDAP object representing an RADIUS profile and apply +# the attriubte updates as configured in the module `update` section. +# This can be useful when additional profiles need to be applied to a +# subscriber beyond those directly associated with their LDAP entry. # # The object can be expressed either as an LDAP URI or a DN. # diff --git a/raddb/mods-available/linelog b/raddb/mods-available/linelog index 12961c57fee..faab86542dd 100644 --- a/raddb/mods-available/linelog +++ b/raddb/mods-available/linelog @@ -7,14 +7,14 @@ # # = Linelog Module # -# The `linelog` module will log entries from attributes, string expansions, -# or static strings, and writes them to a variety of backends, including syslog, -# flat files, and raw UDP/TCP sockets. +# The `linelog` module will log entries from attributes, string +# expansions, or static strings, and writes them to a variety of +# backends, including syslog, flat files, and raw UDP/TCP sockets. # # NOTE: Multiple linelog's modules may be used for any given request. -# The `logtee` modules will not affect normal logging output. -# i.e. This logging is *in addition* to any other logging that is -# done by the server. +# The `logtee` modules will not affect normal logging output. i.e. +# This logging is *in addition* to any other logging that is done by +# the server. # # @@ -22,7 +22,7 @@ # linelog { # - # delimiter:: Custom line delimiters. + # delimiter:: Custom line delimiters. # # Defaults to `\n` (newline) but may be any UTF8 multi-character # string. @@ -39,32 +39,32 @@ linelog { # # [NOTE] # ==== - # The `reference` configuration item can be omitted. If it - # is omitted, then the log message is static, and is always - # given by `format`, above. + # The `reference` configuration item can be omitted. If it is + # omitted, then the log message is static, and is always given by + # `format`, above. # - # If `reference` is defined, then the value is dynamically - # expanded, and the result is used to find another - # configuration entry here, with the given name. That name - # is then used as the format string. + # If `reference` is defined, then the value is dynamically expanded, + # and the result is used to find another configuration entry here, + # with the given name. That name is then used as the format string. # - # If the configuration entry cannot be found, then no log - # message is printed. + # If the configuration entry cannot be found, then no log message is + # printed. # - # i.e: You can have many log messages in one `linelog` module. - # If this two-step expansion did not exist, you would have - # needed to configure one `linelog` module for each log message. + # i.e: You can have many log messages in one `linelog` module. If + # this two-step expansion did not exist, you would have needed to + # configure one `linelog` module for each log message. # ==== # # # reference:: # - # Reference the `Packet-Type` (`Access-Request`, etc.) If - # `reference` is commented out, the `format` entry above is - # used instead. + # Reference the `Packet-Type` (`Access-Request`, etc.) If + # `reference` is commented out, the `format` entry above is used + # instead. # - # May be an attribute reference, e.g. `User-Name`, or `xlat`, `literal` or `exec`. + # May be an attribute reference, e.g. `User-Name`, or `xlat`, + # `literal` or `exec`. # reference = "messages.%{reply.Packet-Type || 'default'}" @@ -74,7 +74,8 @@ linelog { # The messages defined here are chosen from the `reference` # expansion, above. # - # Pairs may be attributes attribute reference `User-Name` , `xlat`, `literal` or `exec`. + # Pairs may be attributes attribute reference `User-Name` , `xlat`, + # `literal` or `exec`. # messages { default = "Unknown packet type %{Packet-Type}" @@ -87,9 +88,8 @@ linelog { # # header:: Optional header line format for file output # - # If the destination is "file" and header is set, then this - # is expanded and output as the first line when a new file - # is created. + # If the destination is "file" and header is set, then this is + # expanded and output as the first line when a new file is created. # # header = "" @@ -111,10 +111,10 @@ linelog { # | unix | Write to a UNIX socket. # |=== # - # The `stdout` and `stderr` destinations are likely to work only when - # the server is running in debug mode. When the server is running in - # background mode, both `stdout` and `stderr` are usually redirected - # to `/dev/null`. + # The `stdout` and `stderr` destinations are likely to work only + # when the server is running in debug mode. When the server is + # running in background mode, both `stdout` and `stderr` are usually + # redirected to `/dev/null`. # destination = file @@ -125,12 +125,10 @@ linelog { # # filename:: The file where the logs will go. # - # WARNING: We STRONGLY suggest that you do not use - # data from the packet as part of the filename. This - # data is untrusted, and may play games with your - # file system! If it is necessary you must set - # `escape_filenames = yes` in order to prevent - # security issues. + # WARNING: We STRONGLY suggest that you do not use data from the + # packet as part of the filename. This data is untrusted, and may + # play games with your file system! If it is necessary you must set + # `escape_filenames = yes` in order to prevent security issues. # filename = ${logdir}/linelog @@ -138,7 +136,7 @@ linelog { # permissions:: The Unix-style permissions on the log file. # # Depending on format string, the log file may contain secret or - # private information about users. Keep the file permissions as + # private information about users. Keep the file permissions as # restrictive as possible. # permissions = 0600 @@ -146,34 +144,33 @@ linelog { # # group:: The Unix group which owns the log file. # - # The user that freeradius runs as must be in the specified - # group, otherwise it will not be possible to set the group. + # The user that freeradius runs as must be in the specified group, + # otherwise it will not be possible to set the group. # # group = ${security.group} # # escape_filenames:: Whether filenames are escaped. # - # Most file systems can handle nearly the full range - # of UTF-8 characters. Ones that can only deal with - # a limited range should set this to `yes`. + # Most file systems can handle nearly the full range of UTF-8 + # characters. Ones that can only deal with a limited range should + # set this to `yes`. # escape_filenames = no # # fsync:: Forcible sync the data to disk. # - # Synchronise data written with the file system after every - # write, returning fail when the operation fails. + # Synchronise data written with the file system after every write, + # returning fail when the operation fails. # fsync = no # - # buffer_count:: How many lines to buffer before - # writing to disk. + # buffer_count:: How many lines to buffer before writing to disk. # - # If buffer_count is set, then the module will buffer - # logs in memory before writing them to disk. + # If buffer_count is set, then the module will buffer logs in + # memory before writing them to disk. # # Setting this to zero will turn off buffering. # @@ -182,12 +179,11 @@ linelog { # # buffer_delay:: Time delay before writing logs to disk. # - # If logs are buffered, then they buffered data is - # written to disk when either the buffer_count is - # reached, or when buffer_delay is reached. The - # combination of the two settings allows much higher - # performance, while still ensuring that logs are - # regularly written to disk. + # If logs are buffered, then they buffered data is written to disk + # when either the buffer_count is reached, or when buffer_delay is + # reached. The combination of the two settings allows much higher + # performance, while still ensuring that logs are regularly written + # to disk. # buffer_delay = 1s } @@ -199,10 +195,9 @@ linelog { # # start:: Connections to create during module instantiation. # - # If the server cannot create specified number of - # connections during instantiation it will exit. - # Set to `0` to allow the server to start without the - # external service being available. + # If the server cannot create specified number of connections + # during instantiation it will exit. Set to `0` to allow the server + # to start without the external service being available. # start = 0 @@ -214,26 +209,26 @@ linelog { # # max:: Maximum number of connections. # - # If these connections are all in use and a new one - # is requested, the request will NOT get a connection. + # If these connections are all in use and a new one is requested, + # the request will NOT get a connection. # - # Setting `max` to *LESS* than the number of threads means - # that some threads may starve, and you will see errors - # like _No connections available and at max connection limit_. + # Setting `max` to *LESS* than the number of threads means that + # some threads may starve, and you will see errors like _No + # connections available and at max connection limit_. # - # Setting `max` to MORE than the number of threads means - # that there are more connections than necessary. + # Setting `max` to MORE than the number of threads means that there + # are more connections than necessary. # - # If `max` is not specified, then it defaults to the number - # of workers configured. + # If `max` is not specified, then it defaults to the number of + # workers configured. # # max = # # spare:: Spare connections to be left idle. # - # NOTE: Idle connections WILL be closed if `idle_timeout` - # is set. This should be less than or equal to `max` above. + # NOTE: Idle connections WILL be closed if `idle_timeout` is set. + # This should be less than or equal to `max` above. # spare = 1 @@ -247,9 +242,9 @@ linelog { # # retry_delay:: # - # The number of seconds to wait after the server tries - # to open a connection, and fails. During this time, - # no new connections will be opened. + # The number of seconds to wait after the server tries to open a + # connection, and fails. During this time, no new connections will + # be opened. # retry_delay = 30 @@ -259,40 +254,39 @@ linelog { lifetime = 0 # - # idle_timeout:: A connection which is unused for this length - # of time will be closed. + # idle_timeout:: A connection which is unused for this length of + # time will be closed. # # Default `60` seconds. # idle_timeout = 60 # - # NOTE: All configuration settings are enforced. If a - # connection is closed because of `idle_timeout`, - # `uses`, or `lifetime`, then the total number of - # connections MAY fall below `min`. When that - # happens, it will open a new connection. It will - # also log a WARNING message. + # NOTE: All configuration settings are enforced. If a connection is + # closed because of `idle_timeout`, `uses`, or `lifetime`, then the + # total number of connections MAY fall below `min`. When that + # happens, it will open a new connection. It will also log a + # WARNING message. # - # The solution is to either lower the `min` connections, - # or increase `lifetime`/`idle_timeout`. + # The solution is to either lower the `min` connections, or + # increase `lifetime`/`idle_timeout`. # } # # unix:: UNIX socket-file as destination # -# unix { - # - # filename:: Full path to the `unix socket` file. - # + # unix { + # + # filename:: Full path to the `unix socket` file. + # # filename = /path/to/unix.socket # # pool:: The `pool { ... }` of connections. # # pool = ${..pool} -# } + # } # # tcp:: TCP-server as a destination @@ -419,7 +413,8 @@ linelog { # linelog log_accounting { # - # Please see the `linelog` module for common configuration explanation. + # Please see the `linelog` module for common configuration + # explanation. # destination = file @@ -453,10 +448,12 @@ linelog log_accounting { # # == Authentication success / failure logging # -# A set of sample module instances which can replace the previous builtin auth log messages +# A set of sample module instances which can replace the previous +# builtin auth log messages # -# The destination settings here pick up from the main radiusd.conf values, but can be -# amended if these logs need to be sent to a different destination. +# The destination settings here pick up from the main radiusd.conf +# values, but can be amended if these logs need to be sent to a +# different destination. # linelog log_auth_access_accept { destination = ${log.destination} diff --git a/raddb/mods-available/logtee b/raddb/mods-available/logtee index 5985e92ebb6..ecde07c21ac 100644 --- a/raddb/mods-available/logtee +++ b/raddb/mods-available/logtee @@ -8,15 +8,15 @@ # = Logtee Module # # The `logtee` module writes the log messages to a socket or to a -# file. Each instance of the module can send log messages to one, -# and only one, destination. +# file. Each instance of the module can send log messages to one, and +# only one, destination. # # You should probably use the `linelog` message instead of this one. # # NOTE: Multiple `logtee`s modules may be used for any given request. -# The `logtee` modules will not affect normal logging output. -# i.e. This logging is *in addition* to any other logging that is -# done by the server. +# The `logtee` modules will not affect normal logging output. i.e. +# This logging is *in addition* to any other logging that is done by +# the server. # @@ -25,7 +25,7 @@ # logtee { # - # delimiter:: Custom line delimiters. + # delimiter:: Custom line delimiters. # # Defaults to `\n` (newline) but may be any UTF8 multi-character # string. @@ -55,13 +55,13 @@ logtee { # # The number of log messages we buffer before discarding. # - # The module writes log messages to a ring buffer between - # processing requests and checking whether the output socket is - # writable, so this should be not set to < `1000`. + # The module writes log messages to a ring buffer between processing + # requests and checking whether the output socket is writable, so + # this should be not set to < `1000`. # - # If an error occurs (connection failed, out of disk space - # etc...) the ring buffer will be used to temporarily buffer - # log data until the error is cleared. + # If an error occurs (connection failed, out of disk space etc...) + # the ring buffer will be used to temporarily buffer log data until + # the error is cleared. # # This limit is applied per worker thread. # @@ -82,23 +82,25 @@ logtee { # |=== # # NOTE: Syslog output via `syslog()` is not explicitly supported, - # but you may use one of the other transports to talk directly to - # a syslog daemon. + # but you may use one of the other transports to talk directly to a + # syslog daemon. # destination = 'file' # - # connection_timeout:: How long we wait for a connection or file to open. + # connection_timeout:: How long we wait for a connection or file to + # open. # - # If a connection takes longer than this to open, the module returns `fail`. + # If a connection takes longer than this to open, the module returns + # `fail`. # connection_timeout = 1.0 # # reconnection_delay:: # - # How long to wait after a connection or file has become - # unusable, to try and re-open the connection or file. + # How long to wait after a connection or file has become unusable, + # to try and re-open the connection or file. # reconnection_delay = 1.0 @@ -115,7 +117,7 @@ logtee { # permissions:: The Unix-style permissions on the log file. # # Depending on format string, the log file may contain secret or - # private information about users. Keep the file permissions as + # private information about users. Keep the file permissions as # restrictive as possible. # permissions = 0600 @@ -123,8 +125,8 @@ logtee { # # group:: The Unix group which owns the log file. # - # The user that freeradius runs as must be in the specified - # group, otherwise it will not be possible to set the group. + # The user that freeradius runs as must be in the specified group, + # otherwise it will not be possible to set the group. # # group = ${security.group} } diff --git a/raddb/mods-available/lua b/raddb/mods-available/lua index b0b0873b0de..7a6c4bf294e 100644 --- a/raddb/mods-available/lua +++ b/raddb/mods-available/lua @@ -16,11 +16,11 @@ # automatically derived from the section in which they are called. # # If `lua` is called in `recv Access-Request`, firstly a function -# `recv_access_request` will be looked for. If that does not exist, then -# a function `recv` will be looked for. +# `recv_access_request` will be looked for. If that does not exist, +# then a function `recv` will be looked for. # -# This can be overridden by setting `func_recv_access_request` or `func_recv` -# to point to a different function name. +# This can be overridden by setting `func_recv_access_request` or +# `func_recv` to point to a different function name. # # diff --git a/raddb/mods-available/mac2ip b/raddb/mods-available/mac2ip index f16db407843..a7d4f16afee 100644 --- a/raddb/mods-available/mac2ip +++ b/raddb/mods-available/mac2ip @@ -7,7 +7,8 @@ # # = Mac2IP Module # -# The `mac2ip` module is a simple file to map a MAC address to an IP address. +# The `mac2ip` module is a simple file to map a MAC address to an IP +# address. # # The file is in the format `,`. # @@ -18,7 +19,7 @@ # 02:01:02:03:04:05,192.0.2.102 # # This lets you perform simple static IP assignments from a flat-text -# file. You will have to define lease times yourself. +# file. You will have to define lease times yourself. # # diff --git a/raddb/mods-available/mac2vlan b/raddb/mods-available/mac2vlan index edcf4bce39e..6f2e9178ccf 100644 --- a/raddb/mods-available/mac2vlan +++ b/raddb/mods-available/mac2vlan @@ -7,7 +7,8 @@ # # = Mac2Vlan Module # -# The `mac2vlan` module is a simple file to map a MAC address to a VLAN. +# The `mac2vlan` module is a simple file to map a MAC address to a +# VLAN. # # The file should be in the format `,`. # diff --git a/raddb/mods-available/mruby b/raddb/mods-available/mruby index 583a1443954..bce9eecac82 100644 --- a/raddb/mods-available/mruby +++ b/raddb/mods-available/mruby @@ -17,20 +17,21 @@ # automatically derived from the section in which they are called. # # If `mruby` is called in `recv Access-Request`, firstly a method -# `recv_access_request` will be looked for. If that does not exist, then -# a method `recv` will be looked for. +# `recv_access_request` will be looked for. If that does not exist, +# then a method `recv` will be looked for. # -# This can be overridden by setting `func_recv_access_request` or `func_recv` -# to point to a different method name. +# This can be overridden by setting `func_recv_access_request` or +# `func_recv` to point to a different method name. # # Each method called during a packet processing section is passed an # object which represents the packet. # -# The object contains 4 methods `request`, `reply`, `control` and `session_state` -# which allow access to the pairs in those FreeRADIUS pair lists. +# The object contains 4 methods `request`, `reply`, `control` and +# `session_state` which allow access to the pairs in those FreeRADIUS +# pair lists. # -# Nested attributes are accessed by using chained methods. Each leaf attribute -# has the following methods +# Nested attributes are accessed by using chained methods. Each leaf +# attribute has the following methods # # [options="header,autowidth"] # |=== @@ -41,8 +42,9 @@ # | del(n) | Delete an attribute | Optional number specifying the attribute instance. # |=== # -# Where a specific instance of a nested attribute parent is required, the -# method can be passed an argument to specify the instance number. +# Where a specific instance of a nested attribute parent is required, +# the method can be passed an argument to specify the instance +# number. # # For example, if the Ruby method is defined `def self.recv(p)`, then # attributes in the request can be accessed using syntax of the form: @@ -55,30 +57,34 @@ # | p.requestbaa(2).baz.get | request.baa[2].baz # |=== # -# Where attribute names contain `-` this should be replaced by `_`, e.g. -# `request.User-Name` becomes `p.request.user_name` +# Where attribute names contain `-` this should be replaced by `_`, +# e.g. `request.User-Name` becomes `p.request.user_name` # # The interface between FreeRADIUS and Ruby is mosty string. # -# Attributes of type `string` are copied to Ruby as-is. -# They are not escaped or interpreted. +# Attributes of type `string` are copied to Ruby as-is. They are not +# escaped or interpreted. # -# Attributes of type `octets` are copied to Ruby as-is. -# They are not escaped or interpreted. +# Attributes of type `octets` are copied to Ruby as-is. They are not +# escaped or interpreted. # # Numeric attributes are passed as the appropriate Ruby numeric type. # -# All other attributes are printed, and passed to Ruby as a string value. +# All other attributes are printed, and passed to Ruby as a string +# value. # -# IP addresses are sent as strings, e.g. "192.0.2.25", and not as a 4-byte -# binary value. The same applies to other attribute data types. +# IP addresses are sent as strings, e.g. "192.0.2.25", and not as a +# 4-byte binary value. The same applies to other attribute data +# types. # -# Attributes can be set by using the `set` method of the leaf attributes E.g. +# Attributes can be set by using the `set` method of the leaf +# attributes E.g. # # `p.reply.foo.set('baa')` # -# The return codes from Ruby methods are passed directly to the server. -# A set of predefined constants are provided to use as return values: +# The return codes from Ruby methods are passed directly to the +# server. A set of predefined constants are provided to use as return +# values: # # [options="header,autowidth"] # |=== diff --git a/raddb/mods-available/mschap b/raddb/mods-available/mschap index 8776bacdf75..43ce6f310b1 100644 --- a/raddb/mods-available/mschap +++ b/raddb/mods-available/mschap @@ -7,17 +7,19 @@ # # = Microsoft CHAP authentication Module # -# The `mschap` module performs `MS-CHAP` and `MS-CHAPv2` authentication. +# The `mschap` module performs `MS-CHAP` and `MS-CHAPv2` +# authentication. # # MS-CHAP authentication requires access to either the -# Password.Cleartext or Password.NT attribute for the user. Due to +# Password.Cleartext or Password.NT attribute for the user. Due to # the limitations of MS-CHAP, no other password "encryption" methods # are possible. # -# This module validates a user with `MS-CHAP` or `MS-CHAPv2` authentication. -# If called in `recv Access-Request`, it will look for `MS-CHAP` Challenge/Response -# attributes in the `request` list and adds an `Auth-Type` attribute set to -# `mschap` in the Config-Items list unless Auth-Type has already set. +# This module validates a user with `MS-CHAP` or `MS-CHAPv2` +# authentication. If called in `recv Access-Request`, it will look +# for `MS-CHAP` Challenge/Response attributes in the `request` list +# and adds an `Auth-Type` attribute set to `mschap` in the +# Config-Items list unless Auth-Type has already set. # # The module also enforces the `SMB-Account-Ctrl` attribute. See the # Samba documentation for the meaning of SMB account control. The @@ -40,8 +42,8 @@ # # [NOTE] # ==== -# For more documentation on integrating FreeRADIUS with Active Directory, please -# see the following web page: +# For more documentation on integrating FreeRADIUS with Active +# Directory, please see the following web page: # http://deployingradius.com/documents/configuration/active_directory.html # ==== # @@ -57,8 +59,8 @@ mschap { # normalise:: # # By default the server will use heuristics to try and automatically - # handle base64 or hex encoded passwords or hashes. - # This behaviour can be disabled by setting the following to `no`. + # handle base64 or hex encoded passwords or hashes. This behaviour + # can be disabled by setting the following to `no`. # # The default is `yes` # @@ -67,9 +69,10 @@ mschap { # # use_mppe:: # - # By default the `mschap` will add `MS-CHAP-MPPE-Keys` for `MS-CHAPv1` and - # `MS-MPPE-Recv-Key` and `MS-MPPE-Send-Key` for `MS-CHAPv2`. Set this - # configuration item to `no` in order to not add the MPPE keys. + # By default the `mschap` will add `MS-CHAP-MPPE-Keys` for + # `MS-CHAPv1` and `MS-MPPE-Recv-Key` and `MS-MPPE-Send-Key` for + # `MS-CHAPv2`. Set this configuration item to `no` in order to not + # add the MPPE keys. # # Default is `yes`. # @@ -78,7 +81,8 @@ mschap { # # require_encryption:: # - # if `use_mppe` is enabled, the `require_encryption` makes encryption moderate. + # if `use_mppe` is enabled, the `require_encryption` makes + # encryption moderate. # # Default is `no`. # @@ -94,8 +98,9 @@ mschap { # require_strong = yes # - # with_ntdomain_hack:: Windows clients send `User-Name` in the form of "DOMAIN\User", - # but send the challenge/response based only on the User portion. + # with_ntdomain_hack:: Windows clients send `User-Name` in the form + # of "DOMAIN\User", but send the challenge/response based only on + # the User portion. # # Default is `yes`. # @@ -104,55 +109,57 @@ mschap { # # ntlm_auth:: Path and arguments to the `ntlm_auth` program. # - # The module can perform authentication itself, OR - # use a Windows Domain Controller. This configuration - # directive tells the module to call the `ntlm_auth` - # program, which will do the authentication, and return - # the `NT-Key`. + # The module can perform authentication itself, OR use a Windows + # Domain Controller. This configuration directive tells the module + # to call the `ntlm_auth` program, which will do the authentication, + # and return the `NT-Key`. # # NOTE: you MUST have the such services "winbindd" and "nmbd" # running on the local machine for `ntlm_auth` to work. # # See the `ntlm_auth` program documentation for details. # - # If `ntlm_auth` is configured below, then the `mschap` module - # will call `ntlm_auth` for every `MS-CHAP` authentication request. + # If `ntlm_auth` is configured below, then the `mschap` module will + # call `ntlm_auth` for every `MS-CHAP` authentication request. # - # If there is a cleartext or NT hashed password available, you can set - # `MS-CHAP-Use-NTLM-Auth := No` in the control items, and the `mschap` - # module will do the authentication itself, without calling `ntlm_auth`. + # If there is a cleartext or NT hashed password available, you can + # set `MS-CHAP-Use-NTLM-Auth := No` in the control items, and the + # `mschap` module will do the authentication itself, without calling + # `ntlm_auth`. # - # You can also set `MS-CHAP-Use-NTLM-Auth := Auto`. If a password is available, - # it will be used. Otherwise the module will fall back to ntlm_auth. + # You can also set `MS-CHAP-Use-NTLM-Auth := Auto`. If a password is + # available, it will be used. Otherwise the module will fall back to + # ntlm_auth. # # You can also try setting the user name as: # # `... --username=%mschap(User-Name) ...` # # In that case, the `mschap` module will look at the `User-Name` - # attribute, and do prefix/suffix checks in order to obtain the _best_ - # user name for the request. + # attribute, and do prefix/suffix checks in order to obtain the + # _best_ user name for the request. # - # Depending on the AD / Samba configuration, you may also need to add: + # Depending on the AD / Samba configuration, you may also need to + # add: # # `--allow-mschapv2` # # to the list of command-line options. # - # WARNING: Be VERY careful when editing the following line! - # Change the path, and ideally nothing else. + # WARNING: Be VERY careful when editing the following line! Change + # the path, and ideally nothing else. # # ntlm_auth = "/path/to/ntlm_auth --request-nt-key --allow-mschapv2 --username=%{Stripped-User-Name || User-Name || 'None'} --challenge=%{%mschap('Challenge') || 00} --nt-response=%{%mschap('NT-Response') || 00}" # # ntlm_auth_timeout:: Time to wait for `ntlm_auth` to run. # - # This is a long time, and if `ntlm_auth` is taking that long - # then you likely have other problems in your domain. + # This is a long time, and if `ntlm_auth` is taking that long then + # you likely have other problems in your domain. # - # The length of time can be decreased with the following - # option, which can save clients waiting if your `ntlm_auth` - # usually finishes quicker. + # The length of time can be decreased with the following option, + # which can save clients waiting if your `ntlm_auth` usually + # finishes quicker. # # Range `1` to `10` seconds. # @@ -169,16 +176,16 @@ mschap { # # domain:: Domain name for winbind # - # An alternative to using `ntlm_auth` is to connect to the - # winbind daemon directly for authentication. This option - # is likely to be faster and may be useful on busy systems. + # An alternative to using `ntlm_auth` is to connect to the winbind + # daemon directly for authentication. This option is likely to be + # faster and may be useful on busy systems. # - # Performance seems to be about twice that of `ntlm_auth`, - # which still isn't a lot. + # Performance seems to be about twice that of `ntlm_auth`, which + # still isn't a lot. # - # Using this option requires libwbclient from Samba 4.2.1 or - # later to be installed. Make sure that `ntlm_auth` above is - # commented out. + # Using this option requires libwbclient from Samba 4.2.1 or later + # to be installed. Make sure that `ntlm_auth` above is commented + # out. # # username = "%mschap('User-Name')" # domain = "%mschap('NT-Domain')" @@ -187,46 +194,45 @@ mschap { # retry_with_normalised_username:: # # When using single sign-on with a winbind connection and the - # client uses a different casing for the username than the - # casing is according to the backend, reauth may fail because - # of some Windows internals. - # This switch tries to find the user in the correct casing in - # the backend, and retry authentication with that username. + # client uses a different casing for the username than the casing + # is according to the backend, reauth may fail because of some + # Windows internals. This switch tries to find the user in the + # correct casing in the backend, and retry authentication with that + # username. # # retry_with_normalised_username = no # # == Reusable Handles # - # Reusable connection handles are allocated in blocks. These + # Reusable connection handles are allocated in blocks. These # parameters allow for tuning how that is done. # reuse { # - # min:: The minimum number of connection handles to - # keep allocated + # min:: The minimum number of connection handles to keep allocated # # min = 10 # - # max:: The maximum number of reusable connection - # handles to allocate. + # max:: The maximum number of reusable connection handles to + # allocate. # # max = 100 # - # cleanup_interval:: How often to free un-used - # connection handles. + # cleanup_interval:: How often to free un-used connection handles. # # cleanup_interval = 30s } } # - # passchange:: Control parameters for changing passwords via MS-CHAP. + # passchange:: Control parameters for changing passwords via + # MS-CHAP. # - # NOTE: This functionality should only be used inside of PEAP. Anything else - # is insecure. + # NOTE: This functionality should only be used inside of PEAP. + # Anything else is insecure. # passchange { # @@ -236,14 +242,15 @@ mschap { # # ntlm_auth_domain:: The domain name for ntlm_auth password change. # - # This module support `MS-CHAPv2` (not v1) password - # change requests. See `doc/howto/modules/mschap.adoc` for - # some IMPORTANT information. + # This module support `MS-CHAPv2` (not v1) password change + # requests. See `doc/howto/modules/mschap.adoc` for some IMPORTANT + # information. # # Samba/ntlm_auth - if you are using `ntlm_auth` to validate # passwords, you will need to use `ntlm_auth` to change passwords. # - # Uncomment the three lines below, and change the path to `ntlm_auth. + # Uncomment the three lines below, and change the path to + # `ntlm_auth. # ## ntlm_auth = "/usr/bin/ntlm_auth --helper-protocol=ntlm-change-password-1" ## ntlm_auth_username = "username: %mschap('User-Name')" @@ -253,9 +260,11 @@ mschap { # local_cpw:: # # To implement a local password change, you need to supply a string - # which is then expanded, so that the password can be placed somewhere. + # which is then expanded, so that the password can be placed + # somewhere. # - # e.g. passed to a script (`exec`), or written to SQL (UPDATE/INSERT). + # e.g. passed to a script (`exec`), or written to SQL + # (UPDATE/INSERT). # # TIP: We give both examples here, but *only one should be used*. # @@ -267,15 +276,16 @@ mschap { # # use_open_directory:: # - # For Apple Server, when running on the same machine as Open Directory. - # It has no effect on other systems. + # For Apple Server, when running on the same machine as Open + # Directory. It has no effect on other systems. # # use_open_directory = yes # # allow_retry:: # - # On failure, set (or not) the `MS-CHAP` error code saying _retries allowed_. + # On failure, set (or not) the `MS-CHAP` error code saying _retries + # allowed_. # # allow_retry = yes @@ -289,12 +299,12 @@ mschap { # # attributes:: the list of attributes used by the mschap module # - # The `mschap` module needs to be configured with which attributes contain - # MS-CHAP data in the request and which should be used for MS-CHAP data - # in the reply. + # The `mschap` module needs to be configured with which attributes + # contain MS-CHAP data in the request and which should be used for + # MS-CHAP data in the reply. # - # This varies for different protocols. The defaults show below are for - # RADIUS. + # This varies for different protocols. The defaults show below are + # for RADIUS. # attributes { # @@ -303,72 +313,81 @@ mschap { username = User-Name # - # chap_challenge:: The attribute containing the CHAP Challenge. + # chap_challenge:: The attribute containing the CHAP Challenge. # chap_challenge = Vendor-Specific.Microsoft.CHAP-Challenge # - # chap_response:: The attribute containing the CHAP Response for MS-CHAPv1. + # chap_response:: The attribute containing the CHAP Response for + # MS-CHAPv1. # chap_response = Vendor-Specific.Microsoft.CHAP-Response # - # chap2_response:: The attribute containing the CHAP Response for MS-CHAPv2. + # chap2_response:: The attribute containing the CHAP Response for + # MS-CHAPv2. # chap2_response = Vendor-Specific.Microsoft.CHAP2-Response # - # chap2_success:: The attribute MS-CHAPv2 success messages are returned in. + # chap2_success:: The attribute MS-CHAPv2 success messages are + # returned in. # chap2_success = Vendor-Specific.Microsoft.CHAP2-Success # - # chap_error:: The attribute CHAP error messages are returned in. + # chap_error:: The attribute CHAP error messages are returned in. # chap_error = Vendor-Specific.Microsoft.CHAP-Error # - # chap_mppe_keys:: The attribute MPPE keys are returned in for MS-CHAPv1 + # chap_mppe_keys:: The attribute MPPE keys are returned in for + # MS-CHAPv1 # chap_mppe_keys = Vendor-Specific.Microsoft.CHAP-MPPE-Keys # - # mppe_recv_key:: The attribute MPPE recv key is returned in for MS-CHAPv2 + # mppe_recv_key:: The attribute MPPE recv key is returned in for + # MS-CHAPv2 # mppe_recv_key = Vendor-Specific.Microsoft.MPPE-Recv-Key # - # mppe_send_key:: The attribute MPPE send key is returned in for MS-CHAPv2 + # mppe_send_key:: The attribute MPPE send key is returned in for + # MS-CHAPv2 # mppe_send_key = Vendor-Specific.Microsoft.MPPE-Send-Key # - # mppe_encryption_policy:: The attribute that MPPE encryption policy is returned in. + # mppe_encryption_policy:: The attribute that MPPE encryption + # policy is returned in. # mppe_encryption_policy = Vendor-Specific.Microsoft.MPPE-Encryption-Policy # - # mppe_encryption_types:: The attribute that MPPE encryption type is returned in. + # mppe_encryption_types:: The attribute that MPPE encryption type + # is returned in. # mppe_encryption_types = Vendor-Specific.Microsoft.MPPE-Encryption-Types # - # chap2_cpw:: The attribute used to change a users' password + # chap2_cpw:: The attribute used to change a users' password # chap2_cpw = Vendor-Specific.Microsoft.CHAP2-CPW # - # chap_nt_enc_pw:: The attribute containing the encrypted new NT password + # chap_nt_enc_pw:: The attribute containing the encrypted new NT + # password # chap_nt_enc_pw = Vendor-Specific.Microsoft.CHAP-NT-Enc-PW } # - # To use this instance of the mschap module to handle TACACS+ the attribute - # section should be replaced with the following. + # To use this instance of the mschap module to handle TACACS+ the + # attribute section should be replaced with the following. # - # TACACS+ does not have any inherent support for MPPE keys or password - # changing using MSCHAP. + # TACACS+ does not have any inherent support for MPPE keys or + # password changing using MSCHAP. # ## attributes { ## username = User-Name @@ -378,8 +397,8 @@ mschap { # # TACACS+ puts the MS-CHAP2-Success information in the Data field, - # but we call it MS-CHAP2-Success for simplicity. - # See the ALIAS definition in dictionary/tacacs/dictionary.freeradius.internal + # but we call it MS-CHAP2-Success for simplicity. See the ALIAS + # definition in dictionary/tacacs/dictionary.freeradius.internal # ## chap2_success = MS-CHAP2-Success diff --git a/raddb/mods-available/ntlm_auth b/raddb/mods-available/ntlm_auth index 83750c64f89..9c8ed5155a2 100644 --- a/raddb/mods-available/ntlm_auth +++ b/raddb/mods-available/ntlm_auth @@ -14,14 +14,15 @@ # # https://bugzilla.samba.org/show_bug.cgi?id=6563 # -# Depending on the AD / Samba configuration, you may also need to add: +# Depending on the AD / Samba configuration, you may also need to +# add: # # --allow-mschapv2 # # to the list of command-line options. # -# For more documentation on integrating FreeRADIUS with Active Directory, please -# see the following web page: +# For more documentation on integrating FreeRADIUS with Active +# Directory, please see the following web page: # # http://deployingradius.com/documents/configuration/active_directory.html # @@ -29,14 +30,15 @@ # # == Configuration Settings # -# See the `exec` module for an explanation of the configuration options. +# See the `exec` module for an explanation of the configuration +# options. # exec ntlm_auth { wait = yes # - # You will need to edit the path and domain to match your - # local system. The other fields can be left alone. + # You will need to edit the path and domain to match your local + # system. The other fields can be left alone. # program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%mschap(User-Name) --password=%{User-Password}" } diff --git a/raddb/mods-available/opendirectory b/raddb/mods-available/opendirectory index 4e62b7f6625..c54528efa5f 100644 --- a/raddb/mods-available/opendirectory +++ b/raddb/mods-available/opendirectory @@ -7,12 +7,12 @@ # # = OpenDirectory Module # -# The `opendirectory` module is only used when the server is running on the same -# system as OpenDirectory. The configuration of the module is hard-coded -# by Apple, and cannot be changed here. +# The `opendirectory` module is only used when the server is running +# on the same system as OpenDirectory. The configuration of the +# module is hard-coded by Apple, and cannot be changed here. # # The `mschap` module will also automatically talk to OpenDirectory -# if the server is built on an OSX machine. However, you must also +# if the server is built on an OSX machine. However, you must also # set `dsAttrTypeNative:apple-enabled-auth-mech` attribute in the # `/config/dirserv` OpenDirectory record. # diff --git a/raddb/mods-available/pam b/raddb/mods-available/pam index c33702272d9..2812a06cb7f 100644 --- a/raddb/mods-available/pam +++ b/raddb/mods-available/pam @@ -9,9 +9,9 @@ # # For Linux, see http://www.kernel.org/pub/linux/libs/pam/index.html # -# WARNING: On some systems, the system PAM libraries have -# memory leaks! We STRONGLY SUGGEST that you do not -# use `PAM` for authentication, due to those memory leaks. +# WARNING: On some systems, the system PAM libraries have memory +# leaks! We STRONGLY SUGGEST that you do not use `PAM` for +# authentication, due to those memory leaks. # # @@ -28,8 +28,7 @@ pam { # # See `redhat/radiusd-pam` for a sample PAM configuration file. # - # NOTE: Any `Pam-Auth` attribute that is set will override - # this one. + # NOTE: Any `Pam-Auth` attribute that is set will override this one. # pam_auth = radiusd } diff --git a/raddb/mods-available/pap b/raddb/mods-available/pap index c8833ee207c..7145ec09f48 100644 --- a/raddb/mods-available/pap +++ b/raddb/mods-available/pap @@ -7,17 +7,19 @@ # # = PAP Module # -# The `pap` module accepts a large number of formats for the _known good_ (reference) -# password, such as crypt hashes, md5 hashes, and etc. -# The module takes the `User-Password` and performs the necessary transformations of the -# user submitted password to match the copy of the password the server has retrieved. +# The `pap` module accepts a large number of formats for the _known +# good_ (reference) password, such as crypt hashes, md5 hashes, and +# etc. The module takes the `User-Password` and performs the +# necessary transformations of the user submitted password to match +# the copy of the password the server has retrieved. # -# For instructions on creating the various types of passwords, -# see http://www.openldap.org/faq/data/cache/347.html +# For instructions on creating the various types of passwords, see +# http://www.openldap.org/faq/data/cache/347.html # -# The module looks for the `Password.With-Header` control attribute to find -# the *"known good" password*. The attribute value comprises the header followed -# immediately by the password data. The header is given by the following table. +# The module looks for the `Password.With-Header` control attribute +# to find the *"known good" password*. The attribute value comprises +# the header followed immediately by the password data. The header is +# given by the following table. # # [options="header,autowidth"] # |=== @@ -54,25 +56,29 @@ # | {X- orclntv} | Password.NT | Windows NT hashed passwords. # |=== # -# The module tries to be flexible when handling the various password for mats. -# It will automatically handle Base-64 encoded data, hex strings, and binary data, -# and convert them to a format that the server can use. +# The module tries to be flexible when handling the various password +# for mats. It will automatically handle Base-64 encoded data, hex +# strings, and binary data, and convert them to a format that the +# server can use. # -# If there is no `Password.With-Header` attribute, the module looks for one -# of the `Password.Cleartext`, `Password.NT`, `Password.Crypt`, etc. attributes -# as listed in the above table. These attributes should contain the relevant -# format password directly, without the header prefix. +# If there is no `Password.With-Header` attribute, the module looks +# for one of the `Password.Cleartext`, `Password.NT`, +# `Password.Crypt`, etc. attributes as listed in the above table. +# These attributes should contain the relevant format password +# directly, without the header prefix. # -# Only one control attribute should be set, otherwise the behaviour is undefined -# as to which one is used for authentication. +# Only one control attribute should be set, otherwise the behaviour +# is undefined as to which one is used for authentication. # -# NOTE: It is important to understand the difference between the `User-Password` -# and `Password.Cleartext` attributes. The `Password.Cleartext` attribute is -# the *"known good"* password for the user. Simply supplying the `Password.Cleartext` -# to the server will result in most authentication methods working. The `User-Password` -# attribute is the password as typed in by the user on their private machine. -# The two are not the same, and should be treated very differently. That is, you should -# generally not use the `User-Password` attribute anywhere in the RADIUS configuration. +# NOTE: It is important to understand the difference between the +# `User-Password` and `Password.Cleartext` attributes. The +# `Password.Cleartext` attribute is the *"known good"* password for +# the user. Simply supplying the `Password.Cleartext` to the server +# will result in most authentication methods working. The +# `User-Password` attribute is the password as typed in by the user +# on their private machine. The two are not the same, and should be +# treated very differently. That is, you should generally not use the +# `User-Password` attribute anywhere in the RADIUS configuration. # # == Configuration Settings # @@ -89,8 +95,8 @@ pap { # normalise = no # - # password_attribute:: Which attribute in the request should be used as - # the user's password when performing PAP authentication. + # password_attribute:: Which attribute in the request should be used + # as the user's password when performing PAP authentication. # # password_attribute = User-Password } diff --git a/raddb/mods-available/passwd b/raddb/mods-available/passwd index 66aa3cc5391..8530de79210 100644 --- a/raddb/mods-available/passwd +++ b/raddb/mods-available/passwd @@ -15,11 +15,11 @@ # .htpasswd, etc). Every field of the file may be mapped to a RADIUS # attribute, with one of the fields used as a key. # -# The module reads the file when it initializes, and caches the data in -# memory. This makes it very fast, even for files with thousands of -# lines. To re-read the file the module will need to be reloaded with -# `radmin(8)`, or the server will need to be sent a SIGHUP, as dynamic -# updates are not supported. +# The module reads the file when it initializes, and caches the data +# in memory. This makes it very fast, even for files with thousands +# of lines. To re-read the file the module will need to be reloaded +# with `radmin(8)`, or the server will need to be sent a SIGHUP, as +# dynamic updates are not supported. # # See the `smbpasswd` and `etc_group` files for more examples. # @@ -28,9 +28,10 @@ # # An example configuration for using `/etc/passwd`. # -# This is an example which will NOT WORK if you have shadow passwords, -# NIS, etc. The `unix` module is normally responsible for reading -# system passwords. You should use it instead of this example. +# This is an example which will NOT WORK if you have shadow +# passwords, NIS, etc. The `unix` module is normally responsible for +# reading system passwords. You should use it instead of this +# example. # passwd etc_passwd { # @@ -66,19 +67,18 @@ passwd etc_passwd { # # * Field marked as `,` may contain a comma separated list of attributes. # - # The format here uses the first field as the key. If the - # `User-Name` matches, the `Crypt-Password` attribute is - # created from the second field, and is added to the - # `control.` list. + # The format here uses the first field as the key. If the + # `User-Name` matches, the `Crypt-Password` attribute is created + # from the second field, and is added to the `control.` list. # format = "*User-Name:Crypt-Password:" # - # ignore_empty:: Empty fields in the input will be skipped and the RADIUS attribute will - # not be added. + # ignore_empty:: Empty fields in the input will be skipped and the + # RADIUS attribute will not be added. # - # By setting this value to "no", all attributes in the format list will always be added, - # even if they have no value. + # By setting this value to "no", all attributes in the format list + # will always be added, even if they have no value. # # Default is `yes`. # @@ -88,8 +88,9 @@ passwd etc_passwd { # hash_size:: # # A future version of the server will have the module automatically - # determine the hash size. Having it set manually should not be - # necessary. It should be set to 50% of the number of lines in the file. + # determine the hash size. Having it set manually should not be + # necessary. It should be set to 50% of the number of lines in the + # file. # # WARNING: The value must be larger than zero. # @@ -101,11 +102,12 @@ passwd etc_passwd { ignore_nislike = no # - # allow_multiple_keys:: Control whether or not many records for a key are allowed. + # allow_multiple_keys:: Control whether or not many records for a + # key are allowed. # - # If set to `yes`, then the module processes all matching - # entries. If set to `no`, the module processes only the - # first matching entry. + # If set to `yes`, then the module processes all matching entries. + # If set to `no`, the module processes only the first matching + # entry. # allow_multiple_keys = no } diff --git a/raddb/mods-available/perl b/raddb/mods-available/perl index 8b8b521ad3e..ffea814f163 100644 --- a/raddb/mods-available/perl +++ b/raddb/mods-available/perl @@ -13,32 +13,34 @@ # * Please see http://www.perl.org/docs.html for more information about the # Perl language. # -# NOTE: As of FreeRADIUS v4, the Perl subroutine names called when the `perl` -# module is called are automatically derived from the section in which -# they are called. +# NOTE: As of FreeRADIUS v4, the Perl subroutine names called when +# the `perl` module is called are automatically derived from the +# section in which they are called. # -# e.g. if `perl` is called in `recv Access-Request`, firstly a subroutine -# `recv_access_request` will be looked for. If that does not exist, then -# a subroutine `recv` will be looked for. +# e.g. if `perl` is called in `recv Access-Request`, firstly a +# subroutine `recv_access_request` will be looked for. If that does +# not exist, then a subroutine `recv` will be looked for. # -# This can be overridden by setting `func_recv_access_request` or `func_recv` -# to point to a different subroutine name. +# This can be overridden by setting `func_recv_access_request` or +# `func_recv` to point to a different subroutine name. # -# In addition the option `func_detach` can be used to set a subroutine to call -# during shutdown. +# In addition the option `func_detach` can be used to set a +# subroutine to call during shutdown. # -# Each subroutine called during a packet processing section is passed a -# hash ref which represents the packet. +# Each subroutine called during a packet processing section is passed +# a hash ref which represents the packet. # -# The hash contains 4 keys `request`, `reply`, `control` and `session-state` -# which allow access to the pairs in those FreeRADIUS pair lists. +# The hash contains 4 keys `request`, `reply`, `control` and +# `session-state` which allow access to the pairs in those FreeRADIUS +# pair lists. # -# Nested attributes are represented by nested hashes, while leaf attributes -# are represented by arrays, allowing access to individual instances of the -# attribute. +# Nested attributes are represented by nested hashes, while leaf +# attributes are represented by arrays, allowing access to individual +# instances of the attribute. # -# For example, if the perl subroutine starts with `my $p = shift()`, then -# attributes in the request can be accessed using syntax of the form: +# For example, if the perl subroutine starts with `my $p = shift()`, +# then attributes in the request can be accessed using syntax of the +# form: # # [options-"header,autowidth"] # |=== @@ -50,35 +52,38 @@ # # The interface between FreeRADIUS and Perl is mostly strings. # -# Attributes of type `string` are copied to Perl as-is. -# They are not escaped or interpreted. +# Attributes of type `string` are copied to Perl as-is. They are not +# escaped or interpreted. # -# Attributes of type `octets` are copied to Perl as-is. -# They are not escaped or interpreted. +# Attributes of type `octets` are copied to Perl as-is. They are not +# escaped or interpreted. # # Numeric attributes are passed as the appropriate Perl numeric type. # -# All other attributes are printed, and passed to Perl as a string value. +# All other attributes are printed, and passed to Perl as a string +# value. # -# IP addresses are sent as strings, e.g. "192.0.2.25", and not as a 4-byte -# binary value. The same applies to other attribute data types. +# IP addresses are sent as strings, e.g. "192.0.2.25", and not as a +# 4-byte binary value. The same applies to other attribute data +# types. # -# Attributes can be set by assigning values to the array entries of leaf -# nodes. E.g. +# Attributes can be set by assigning values to the array entries of +# leaf nodes. E.g. # # ``` # $p->{'reply'}{'foo'}[0] = 'baa' # ``` # -# In addition, the Perl array functions `push`, `pop`, `shift` and `unshift` -# can be used to add or remove instances of attributes. +# In addition, the Perl array functions `push`, `pop`, `shift` and +# `unshift` can be used to add or remove instances of attributes. # -# The return codes from functions in the `perl_script` are passed directly back -# to the server. These codes are defined in `mods-config/example.pl` +# The return codes from functions in the `perl_script` are passed +# directly back to the server. These codes are defined in +# `mods-config/example.pl` # -# WARN:: The Perl module is slow compared to `unlang`. The only reason to use -# Perl is when you need to use a third-party API that is only accessible via -# a Perl library. +# WARN:: The Perl module is slow compared to `unlang`. The only +# reason to use Perl is when you need to use a third-party API that +# is only accessible via a Perl library. # # @@ -88,9 +93,9 @@ perl { # # filename:: Module to load functions from. # - # The Perl script to execute when the module is called. - # This is very similar to using the `exec` module, but it is - # persistent, and therefore faster. + # The Perl script to execute when the module is called. This is very + # similar to using the `exec` module, but it is persistent, and + # therefore faster. # filename = ${modconfdir}/${.:instance}/example.pl @@ -99,15 +104,15 @@ perl { # # Options which are passed to the Perl interpreter. # - # These are (mostly) the same options as are passed - # to the `perl` command line. + # These are (mostly) the same options as are passed to the `perl` + # command line. # - # The most useful flag is `-T`. This sets tainting on. - # Using this flag makes it impossible to leverage bad - # User-Names into local command execution. + # The most useful flag is `-T`. This sets tainting on. Using this + # flag makes it impossible to leverage bad User-Names into local + # command execution. # - # Delete this next line to allow people to pwn your - # FreeRADIUS server. + # Delete this next line to allow people to pwn your FreeRADIUS + # server. # perl_flags = "-T" @@ -119,8 +124,8 @@ perl { # # Sample subroutine name overrides # - # These options cause the old FreeRADIUS v3 default subroutine - # names to be used + # These options cause the old FreeRADIUS v3 default subroutine names + # to be used ## func_recv_access_request = authorize ## func_recv_accounting_request = preacct ## func_send = postauth @@ -128,16 +133,15 @@ perl { # # config { ... }:: # - # You can define configuration items (and nested sub-sections) in perl `config { ... }` - # section. - # These items will be accessible in the perl script through `%RAD_PERLCONF` hash. + # You can define configuration items (and nested sub-sections) in + # perl `config { ... }` section. These items will be accessible in + # the perl script through `%RAD_PERLCONF` hash. # # For instance: # # [source,perl] # ---- - # $RAD_PERLCONF{'name'} - # $RAD_PERLCONF{'sub-config'}->{'name'} + # $RAD_PERLCONF{'name'} $RAD_PERLCONF{'sub-config'}->{'name'} # ---- # ## config { diff --git a/raddb/mods-available/python b/raddb/mods-available/python index a6ca056e12f..e54622dbfaf 100644 --- a/raddb/mods-available/python +++ b/raddb/mods-available/python @@ -7,39 +7,40 @@ # # = Python Module # -# The `python` module processes attributes through a Python interpreter. +# The `python` module processes attributes through a Python +# interpreter. # # * Please see the `src/modules/rlm_python/example.py` sample. # * Please see https://www.python.org/doc/ for more information about the # Python language. # # NOTE: Uncomment any `func_*` configuration items below which are -# included in your module. If the module is called for a section which -# does not have a function defined, it will return `noop`. +# included in your module. If the module is called for a section +# which does not have a function defined, it will return `noop`. # -# NOTE: As of FreeRADIUS v4, the Python function names called when the `python` -# module is called are automatically derived from the section in which -# they are called. +# NOTE: As of FreeRADIUS v4, the Python function names called when +# the `python` module is called are automatically derived from the +# section in which they are called. # -# e.g. if `python` is called in `recv Access-Request`, firstly a function -# `recv_access_request` will be looked for. If that does not exist, then -# a function `recv` will be looked for. +# e.g. if `python` is called in `recv Access-Request`, firstly a +# function `recv_access_request` will be looked for. If that does not +# exist, then a function `recv` will be looked for. # -# This can be overridden by setting `func_recv_access_request` or `func_recv` -# to point to a different function name. +# This can be overridden by setting `func_recv_access_request` or +# `func_recv` to point to a different function name. # # Similarly, `mod_recv_access_request` or `mod_recv` can be used to # load the function from a module other than the one specified in the # `module` option. # -# WARN:: The Python module is slow compared to `unlang`. The only reason to use -# Python is when you need to use a third-party API that is only accessible via -# a Python library. +# WARN:: The Python module is slow compared to `unlang`. The only +# reason to use Python is when you need to use a third-party API that +# is only accessible via a Python library. # == Global Configuration # -# Please see the file `global.d/python` for server-global configuration -# items which control the Python path. +# Please see the file `global.d/python` for server-global +# configuration items which control the Python path. # # @@ -60,7 +61,7 @@ python { # [NOTE] # ==== # * You may set `mod_
` for any of the section to module - # mappings below, if you want to reference a function in a different + # mappings below, if you want to reference a function in a different # module. # # * Uncomment `func_
` lines your module provides methods for. @@ -78,18 +79,19 @@ python { # func_detach = detach # - # config { ... }:: Define configuration items which are accessible to the Python script. + # config { ... }:: Define configuration items which are accessible + # to the Python script. # - # You can define configuration items (and nested sub-sections) in python `config { ... }` - # section. These items will be accessible in the Python script through `freeradius.config` - # dict as read-only items. + # You can define configuration items (and nested sub-sections) in + # python `config { ... }` section. These items will be accessible in + # the Python script through `freeradius.config` dict as read-only + # items. # # e.g: # # [source,python] # ---- - # freeradius.config['name'] - # freeradius.config['sub-config']['name'] + # freeradius.config['name'] freeradius.config['sub-config']['name'] # ---- # ## config { diff --git a/raddb/mods-available/radius b/raddb/mods-available/radius index ba3c2f36b8f..9b1d8d800e8 100644 --- a/raddb/mods-available/radius +++ b/raddb/mods-available/radius @@ -8,50 +8,49 @@ # = Radius Module # # The `radius` module in v4 implements RADIUS proxying and -# replication. In v3, RADIUS proxying is a special kind of -# configuration, with it's own load-balancing, fail-over etc. That -# configuration is now simpler in v4. The outbound RADIUS proxying -# is done by just another module: the `radius` module. -# Load-balancing and redundant fail-over are handled by the -# `load-balance` and `redundant` keywords. +# replication. In v3, RADIUS proxying is a special kind of +# configuration, with it's own load-balancing, fail-over etc. That +# configuration is now simpler in v4. The outbound RADIUS proxying is +# done by just another module: the `radius` module. Load-balancing +# and redundant fail-over are handled by the `load-balance` and +# `redundant` keywords. # # In v4, the `radius` module most clearly maps to a `home_server` in -# v4. The `radius` module typically makes a connection from one -# source IP address to a server at one destination IP/port. It may +# v4. The `radius` module typically makes a connection from one +# source IP address to a server at one destination IP/port. It may # open multiple source ports, depending on how many packets are being # proxied. # # == Recommendations # # In most cases, the v3 configuration be moved to v4 without too many -# problems. For each `home_server foo { ... }` in v3, create a v4 -# module `radius foo { ... } `. Copy over the IP address, port, and -# secret configuration items. When this step is finished, the bulk -# of the basic work is done. +# problems. For each `home_server foo { ... }` in v3, create a v4 +# module `radius foo { ... } `. Copy over the IP address, port, and +# secret configuration items. When this step is finished, the bulk of +# the basic work is done. # -# Converting a `home_server_pool foo { ... }` can be done by -# creating a module in `mods-enabled`, either `load-balance foo { -# ... }`, or `redundant foo { ... }`. i.e. the v3 module -# configuration does not have any `instantiate` section. You can -# just list "virtual" modules directly in the `modules` directory! +# Converting a `home_server_pool foo { ... }` can be done by creating +# a module in `mods-enabled`, either `load-balance foo { ... }`, or +# `redundant foo { ... }`. i.e. the v3 module configuration does not +# have any `instantiate` section. You can just list "virtual" modules +# directly in the `modules` directory! # # The contents of the `load-balance` or `redundant` section will be # the list of home servers which will part of that `load-balance` or # `redundant` pool. # # Then, anywhere you want to use a home server, just list it's name -# in an `unlang` processing section. Anywhere you want to list a -# home server pool, just list it's name in an `unlang` processing -# section. +# in an `unlang` processing section. Anywhere you want to list a home +# server pool, just list it's name in an `unlang` processing section. # # Unlike v3, there is no `Proxy-To-Realm` attribute, or -# `Home-Server-Pool`, or `Home-Server-Name`. Instead, you just +# `Home-Server-Pool`, or `Home-Server-Name`. Instead, you just # configure a module (`radius`, or `load-balance`), and then use the # module anywhere you want to proxy packets. # # In most cases, you can just set something like `Auth-Type := # example.com`, and then have a section `authenticate example.com { -# ... }`, which contains the `radius` modules which do proxying. See +# ... }`, which contains the `radius` modules which do proxying. See # `sites-available/default` for sample configuration which uses this # pattern. # @@ -59,29 +58,28 @@ # # The module adds a Proxy-State attribute to all proxied packets. # This `Proxy-State` contains a 32-bit random number, which is unique -# to this module. This unique number helps to detect proxy loops. +# to this module. This unique number helps to detect proxy loops. # # The reply from home server is appended to the reply list for the # current packet. # # WARNING: For security reasons, the module ensures that all proxied # `Access-Request` packets contain a `Message-Authenticator` -# attribute. This behavior is *NOT* configurable, and *CANNOT* be -# changed. This behavior is part of the BlastRADIUS mitigations. +# attribute. This behavior is *NOT* configurable, and *CANNOT* be +# changed. This behavior is part of the BlastRADIUS mitigations. # -# Any proxied packet (including `Accounting-Request`) can -# receive a `Protocol-Error` response packet. This packet -# is an explicit `NAK` that something went wrong processing -# the request. +# Any proxied packet (including `Accounting-Request`) can receive a +# `Protocol-Error` response packet. This packet is an explicit `NAK` +# that something went wrong processing the request. # # Unlike v3, the server does not support any "pre-proxy" or -# "post-proxy" processing sections. Similarly, this module does not -# support any "proxy" or "proxy-reply" list. Instead, the current +# "post-proxy" processing sections. Similarly, this module does not +# support any "proxy" or "proxy-reply" list. Instead, the current # request is proxied as-is, and the proxied reply is added to the -# current reply list. If you want to modify the proxied request +# current reply list. If you want to modify the proxied request # and/or proxied reply, then you should use a `subrequest` block to -# create a child request. That child request can then be modified -# independently of the parent. Any reply attributes will have to be +# create a child request. That child request can then be modified +# independently of the parent. Any reply attributes will have to be # copied back manually to the parent request. # # == Configuration Settings @@ -114,7 +112,7 @@ radius { # proxy - forward packets which are received from a NAS # - each packet has a Proxy-State attribute added. # - it looks for, and stops proxy loops - # - retransmissions are sent only when the NAS retransmits + # - retransmissions are sent only when the NAS retransmits # - the module fails if it does not receive a reply # # client - originate packet, and do retransmissions ourselves @@ -142,32 +140,31 @@ radius { # - You CANNOT use the module "in place" as with normal proxying. # - Proxying is only supported via the function %proxy.sendto.ipaddr(ipaddr, port, secret) # - # The server can still be used to create (i.e. originate) - # packets via this module when `mode = proxy` is set. The - # module can automatically detect the difference between - # proxied packets and client packets it originates. - # Originated packets are taken from the detail file, or - # result when changing packet type (e.g. Accounting-Request - # to Disconnect-Request), or when the current request is a - # subrequest, and the parent request is from a different - # protocol. - # - # Note that there is no `mode = unconnected`, where the - # module then both proxies packets, and replicates them. The - # need to track replies when proxying means that it's - # difficult to both proxy and replicate at the same time. As - # a result, there are two "unconnected" modes, one for each - # of "proxy" and "replicate". + # The server can still be used to create (i.e. originate) packets + # via this module when `mode = proxy` is set. The module can + # automatically detect the difference between proxied packets and + # client packets it originates. Originated packets are taken from + # the detail file, or result when changing packet type (e.g. + # Accounting-Request to Disconnect-Request), or when the current + # request is a subrequest, and the parent request is from a + # different protocol. + # + # Note that there is no `mode = unconnected`, where the module then + # both proxies packets, and replicates them. The need to track + # replies when proxying means that it's difficult to both proxy and + # replicate at the same time. As a result, there are two + # "unconnected" modes, one for each of "proxy" and "replicate". # mode = proxy # - # transport:: Transport protocol. Can be `udp` or `tcp`. + # transport:: Transport protocol. Can be `udp` or `tcp`. # transport = udp # - # max_attributes:: Maximum number of attributes to decode in response. + # max_attributes:: Maximum number of attributes to decode in + # response. # # Default is 255. # @@ -176,68 +173,66 @@ radius { # # type:: List of allowed packet types. # - # The module will only send packets types which are listed - # here. Other types of packets will be ignored. The main - # purpose of the `type` configuration is to ensure that the - # correct packets are being sent to the home server. This - # entry serves as a double-check against misconfigurations. + # The module will only send packets types which are listed here. + # Other types of packets will be ignored. The main purpose of the + # `type` configuration is to ensure that the correct packets are + # being sent to the home server. This entry serves as a double-check + # against misconfigurations. # - # In v3, the `home_server` configuration of `auth`, `acct`, - # or `auth+acct` is used to _find_ a home server. That is, - # when FreeRADIUS has an `Access-Request` packet in v3, it - # proxies it by looking up a matching `home_server`. + # In v3, the `home_server` configuration of `auth`, `acct`, or + # `auth+acct` is used to _find_ a home server. That is, when + # FreeRADIUS has an `Access-Request` packet in v3, it proxies it by + # looking up a matching `home_server`. # # In v4, proxying is done by listing the `radius` module in a - # processing section, such as `authenticate radius { ... }`, - # or `recv Accounting-Request { ... }`. So unlike v3, the - # module doesn't have to _find_ a proxy destination for a - # particular kind of packet. Instead, the administrator - # _configures_ the module to send packets to a destination. + # processing section, such as `authenticate radius { ... }`, or + # `recv Accounting-Request { ... }`. So unlike v3, the module + # doesn't have to _find_ a proxy destination for a particular kind + # of packet. Instead, the administrator _configures_ the module to + # send packets to a destination. # - # As a result, the module doesn't really care about what kind - # of packets it sends. It has a packet, a destination where - # that packet should be sent, and it sends the packet. + # As a result, the module doesn't really care about what kind of + # packets it sends. It has a packet, a destination where that packet + # should be sent, and it sends the packet. # # In order to change packet types, see the `subrequest` keyword. # - # NOTE: `Status-Server` is reserved for connection signaling, - # and cannot be proxied. + # NOTE: `Status-Server` is reserved for connection signaling, and + # cannot be proxied. # - # Unlike v3, all packet types are allocated from the same - # 8-bit ID space. This change does not affect the majority - # of RADIUS proxying, which only sends one type of packet. - # This change does not affect the home server which receives - # these packets, as the home server does not track IDs except - # to correlate requests to replies. + # Unlike v3, all packet types are allocated from the same 8-bit ID + # space. This change does not affect the majority of RADIUS + # proxying, which only sends one type of packet. This change does + # not affect the home server which receives these packets, as the + # home server does not track IDs except to correlate requests to + # replies. # - # The only visible difference, then, between v3 and v4 is - # that in some cases, the new `radius` module will use more - # source ports when proxying. + # The only visible difference, then, between v3 and v4 is that in + # some cases, the new `radius` module will use more source ports + # when proxying. # - # This change simplifies the implementation of the RADIUS - # client. + # This change simplifies the implementation of the RADIUS client. # type = Access-Request type = Accounting-Request # - # require_message_authenticator::Require Message-Authenticator - # in responses. + # require_message_authenticator::Require Message-Authenticator in + # responses. # - # A server should include Message-Authenticator attribute as - # the first attribute in responses to Access-Request packets. - # This behavior mitigates against the BlastRADIUS attack. + # A server should include Message-Authenticator attribute as the + # first attribute in responses to Access-Request packets. This + # behavior mitigates against the BlastRADIUS attack. # - # However, not all servers follow this security practice. As - # a result, this module can be configured to either not - # require, or require, Message-Authenticator. + # However, not all servers follow this security practice. As a + # result, this module can be configured to either not require, or + # require, Message-Authenticator. # - # If value is `auto`, then the module will automatically - # detect the existence of Message-Authenticator in response - # packets. Once the module sees a Message-Authenticator, it - # will automatically change the configuration internally to - # `yes`. This change prevents security "down-bidding" - # attacks. + # If value is `auto`, then the module will automatically detect the + # existence of Message-Authenticator in response packets. Once the + # module sees a Message-Authenticator, it will automatically change + # the configuration internally to `yes`. This change prevents + # security "down-bidding" attacks. # # Allowed values: yes, no, auto # @@ -246,58 +241,54 @@ radius { require_message_authenticator = auto # - # response_window:: If we do not receive any replies within - # this time period, then start `zombie_period` + # response_window:: If we do not receive any replies within this + # time period, then start `zombie_period` # response_window = 15 # - # zombie_period:: If the home server does not reply to - # packets within `response_window`, then `zombie_period` - # starts. + # zombie_period:: If the home server does not reply to packets + # within `response_window`, then `zombie_period` starts. # - # When `zombie_period` starts, a connection is marked - # `zombie`, and then is not used to send new packets. If - # there are no responses on this connection within - # `zombie_period`, the module either closes the connection - # (no `status_check` subsection), or starts pinging the home - # server (`status_check.type = Status-Server`). + # When `zombie_period` starts, a connection is marked `zombie`, and + # then is not used to send new packets. If there are no responses on + # this connection within `zombie_period`, the module either closes + # the connection (no `status_check` subsection), or starts pinging + # the home server (`status_check.type = Status-Server`). # zombie_period = 10 # - # revive_interval:: If there are no status checks, mark the - # home server alive after `revive_interval` timeout. + # revive_interval:: If there are no status checks, mark the home + # server alive after `revive_interval` timeout. # # Some home servers do not support status checks via the - # `Status-Server` packet. Others may not have a "test" user - # configured that can be used to query the server, to see if - # it is alive. For those servers, we have NO WAY of knowing - # when it becomes alive again. Therefore, after the server - # has been marked dead, we wait a period of time, and mark - # it alive again, in the hope that it has come back to - # life. - # - # If it has NOT come back to life, then the module will wait - # for `zombie_period` before marking it dead again. During - # the `zombie_period`, ALL AUTHENTICATIONS WILL FAIL, because - # the home server is still dead. There is NOTHING that can - # be done about this, other than to enable the status checks, - # as documented above. - # - # e.g. if `zombie_period` is 40 seconds, and `revive_interval` - # is 300 seconds, the for 40 seconds out of every 340, or about - # 10% of the time, all authentications will fail. - # - # If the `zombie_period` and `revive_interval` configurations - # are set smaller, than it is possible for up to 50% of - # authentications to fail. - # - # As a result, we recommend enabling status checks, and - # we do NOT recommend using `revive_interval`. + # `Status-Server` packet. Others may not have a "test" user + # configured that can be used to query the server, to see if it is + # alive. For those servers, we have NO WAY of knowing when it + # becomes alive again. Therefore, after the server has been marked + # dead, we wait a period of time, and mark it alive again, in the + # hope that it has come back to life. + # + # If it has NOT come back to life, then the module will wait for + # `zombie_period` before marking it dead again. During the + # `zombie_period`, ALL AUTHENTICATIONS WILL FAIL, because the home + # server is still dead. There is NOTHING that can be done about + # this, other than to enable the status checks, as documented above. + # + # e.g. if `zombie_period` is 40 seconds, and `revive_interval` is + # 300 seconds, the for 40 seconds out of every 340, or about 10% of + # the time, all authentications will fail. + # + # If the `zombie_period` and `revive_interval` configurations are + # set smaller, than it is possible for up to 50% of authentications + # to fail. + # + # As a result, we recommend enabling status checks, and we do NOT + # recommend using `revive_interval`. # # The `revive_interval` configuration is used ONLY if the - # `status_check` subsection is not used. Otherwise, + # `status_check` subsection is not used. Otherwise, # `revive_interval` is not necessary, and should be deleted. # # Useful range of values: 10 to 3600 @@ -309,49 +300,42 @@ radius { # # status_check { ... }:: For "are you alive?" queries. # - # If the home server does not respond to proxied packets, the - # module starts pinging the home server with these packets. + # If the home server does not respond to proxied packets, the module + # starts pinging the home server with these packets. # - # Disable status checks by deleting this section, or by - # commenting it out. + # Disable status checks by deleting this section, or by commenting + # it out. # status_check { # - # type:: You can specify any type of request packet here, - # e.g. 'Access-Request', 'Accounting-Request' or - # 'Status-Server'. + # type:: You can specify any type of request packet here, e.g. + # 'Access-Request', 'Accounting-Request' or 'Status-Server'. # - # Status-Server is recommended as other packet types - # may be interpreted incorrectly, or may ve proxied - # to a remote server, which defeats the purpose of - # the status checks. + # Status-Server is recommended as other packet types may be + # interpreted incorrectly, or may ve proxied to a remote server, + # which defeats the purpose of the status checks. # - # If you specify another type of packet, it MUST be listed - # as an allowed `type` above. + # If you specify another type of packet, it MUST be listed as an + # allowed `type` above. # type = Status-Server # # The packet contents can be set here. # - # We RECOMMEND that you use packet contents which - # lets the other end easily tell that they are not - # "real" packets from a NAS. + # We RECOMMEND that you use packet contents which lets the other + # end easily tell that they are not "real" packets from a NAS. # - # The example here is for Status-Server. The - # contents will vary by other packet types. The - # Message-Authenticator attribute will be added - # automatically, and does not need to be specified - # here. + # The example here is for Status-Server. The contents will vary by + # other packet types. The Message-Authenticator attribute will be + # added automatically, and does not need to be specified here. # - # If the Event-Timestamp attribute is added, it will - # be updated each time the packet is sent. + # If the Event-Timestamp attribute is added, it will be updated + # each time the packet is sent. # - # WARNING: Do NOT do SQL queries, LDAP queries, - # dynamic expansions, etc. in this section. The - # contents of the packet are created when a - # connection is opened, and are not changeable after - # that. + # WARNING: Do NOT do SQL queries, LDAP queries, dynamic expansions, + # etc. in this section. The contents of the packet are created when + # a connection is opened, and are not changeable after that. # update { User-Name := "test-user" @@ -369,8 +353,8 @@ radius { # # === File Output # - # Write raw RADIUS packets (no IP or UDP header) to a file. - # This transport can only be used for `mode = replicate` + # Write raw RADIUS packets (no IP or UDP header) to a file. This + # transport can only be used for `mode = replicate` # file { filename = ${logdir}/packets.bin @@ -390,8 +374,8 @@ radius { # # Destination IP address, port, and secret. # - # Use `ipv4addr = ...` to force IPv4 addresses. - # Use `ipv6addr = ...` to force IPv6 addresses. + # Use `ipv4addr = ...` to force IPv4 addresses. Use `ipv6addr = + # ...` to force IPv6 addresses. # ipaddr = 127.0.0.1 port = 1812 @@ -403,7 +387,8 @@ radius { # interface = eth0 # - # max_packet_size:: Our max packet size. may be different from the parent. + # max_packet_size:: Our max packet size. may be different from the + # parent. # # max_packet_size = 4096 @@ -424,29 +409,29 @@ radius { # The TCP configuration is identical to the `udp` configuration. # tcp { - # copy configuration items here + # copy configuration items here } # # == Connection trunking # - # Each worker thread (see radiusd.conf, num_workers), has - # it's own set of connections. These connections are grouped - # together into a "pool". + # Each worker thread (see radiusd.conf, num_workers), has it's own + # set of connections. These connections are grouped together into a + # "pool". # - # Much of the configuration here is similar to the old - # connection "pool" configuration in v3. However, there are - # more configuration parameters, and therefore more control - # over the behavior. + # Much of the configuration here is similar to the old connection + # "pool" configuration in v3. However, there are more configuration + # parameters, and therefore more control over the behavior. # pool { # # start:: Connections to create during module instantiation. # - # If the server cannot create specified number of connections during instantiation - # it will exit. + # If the server cannot create specified number of connections + # during instantiation it will exit. # - # Set to `0` to allow the server to start without the database being available. + # Set to `0` to allow the server to start without the database + # being available. # start = 0 @@ -458,68 +443,61 @@ radius { # # max:: Maximum number of connections. # - # If these connections are all in use and a new one is requested, the request - # will NOT get a connection. + # If these connections are all in use and a new one is requested, + # the request will NOT get a connection. # max = 8 # - # connecting:: Maximum number of sockets to have in the "connecting" state. + # connecting:: Maximum number of sockets to have in the + # "connecting" state. # - # If a home server goes down, the module will close - # old / broken connections, and try to open new ones. - # In order to avoid flooding the home server with - # connection attempts, set the `connecting` value to - # a small number. + # If a home server goes down, the module will close old / broken + # connections, and try to open new ones. In order to avoid flooding + # the home server with connection attempts, set the `connecting` + # value to a small number. # connecting = 1 # # uses:: number of packets which will use the connection. # - # After `uses` packets have been sent the connection - # will be closed, and a new one opened. For no - # limits, set `uses = 0`. + # After `uses` packets have been sent the connection will be + # closed, and a new one opened. For no limits, set `uses = 0`. # uses = 0 # # lifetime:: lifetime of a connection, in seconds. # - # After `lifetime` seconds have passed, no new - # packets will be sent on the connection. When all - # replies have been received, the connection will be - # closed. + # After `lifetime` seconds have passed, no new packets will be sent + # on the connection. When all replies have been received, the + # connection will be closed. # # For no limits, set `lifetime = 0`. # - # It is possible to use precise times, such as - # `lifetime = 1.023`, or even qualifiers such as - # `lifetime = 400ms`. + # It is possible to use precise times, such as `lifetime = 1.023`, + # or even qualifiers such as `lifetime = 400ms`. # lifetime = 0 # - # open_delay:: How long (in seconds) a connection - # must be above `per_connection_target` before a new - # connection is opened. + # open_delay:: How long (in seconds) a connection must be above + # `per_connection_target` before a new connection is opened. # - # Parsing of this field is the same as for - # `lifetime`. + # Parsing of this field is the same as for `lifetime`. # open_delay = 0.2 # - # close_delay:: How long (in seconds) a connection - # must be below `per_connection_target` before a - # connection is closed. + # close_delay:: How long (in seconds) a connection must be below + # `per_connection_target` before a connection is closed. # close_delay = 1.0 # - # manage_interval:: How often (in seconds) the - # connections are checked for limits, in order to - # open / close connections. + # manage_interval:: How often (in seconds) the connections are + # checked for limits, in order to open / close connections. # manage_interval = 0.2 @@ -528,18 +506,15 @@ radius { # connection { # - # connect_timeout:: How long to wait - # before giving up on a connection which is - # being opened. + # connect_timeout:: How long to wait before giving up on a + # connection which is being opened. # connect_timeout = 3.0 # - # reconnect_delay:: If opening a connection - # fails, or an open connection fails, - # we wait `reconnect_delay` seconds before - # attempting to open another - # connection. + # reconnect_delay:: If opening a connection fails, or an open + # connection fails, we wait `reconnect_delay` seconds before + # attempting to open another connection. # reconnect_delay = 5 } @@ -549,27 +524,24 @@ radius { # request { # - # per_connection_max:: The maximum number of requests - # which are "live" on a particular connection. + # per_connection_max:: The maximum number of requests which are + # "live" on a particular connection. # per_connection_max = 255 # - # per_connection_target:: The target number - # of requests which are "live" on a - # particular connection. + # per_connection_target:: The target number of requests which are + # "live" on a particular connection. # - # There can be a balance between overloading - # a connection, and under-utilizing it. The - # default is to fill each connection before - # opening a new one. + # There can be a balance between overloading a connection, and + # under-utilizing it. The default is to fill each connection + # before opening a new one. # per_connection_target = 255 # - # free_delay:: How long to wait before - # freeing internal resources associated with - # the connection. + # free_delay:: How long to wait before freeing internal resources + # associated with the connection. # free_delay = 10 } @@ -581,8 +553,8 @@ radius { # # Each packet can have its own retransmission timers. # - # The sections are named for each packet type. The contents - # are the same for all packet types. + # The sections are named for each packet type. The contents are the + # same for all packet types. # # @@ -590,8 +562,8 @@ radius { # Access-Request { # - # initial_rtx_time:: If there is no response within this time, - # the module will retransmit the packet. + # initial_rtx_time:: If there is no response within this time, the + # module will retransmit the packet. # # Value should be `1..5`. # @@ -622,8 +594,8 @@ radius { max_rtx_count = 2 # - # max_rtx_duration:: The total length of time the module will - # try to retransmit the packet. + # max_rtx_duration:: The total length of time the module will try + # to retransmit the packet. # # Value should be `5..60` # @@ -668,8 +640,8 @@ radius { # # === Status-Server packets # - # The configuration here helps the module determine if a home - # server is alive and responding to requests. + # The configuration here helps the module determine if a home server + # is alive and responding to requests. # # WARNING: The `Status-Server` packets CANNOT be proxied. # @@ -685,18 +657,18 @@ radius { # == Replication of Packets # # The module supports replication of packets to new destinations at -# run time. In this context, replication means "send the packet, and -# do not wait for the response". This functionality is most useful +# run time. In this context, replication means "send the packet, and +# do not wait for the response". This functionality is most useful # when copying large amounts of accounting data to multiple # destinations. # -# The module can then only be used as a dynamic expansion. That is, +# The module can then only be used as a dynamic expansion. That is, # you cannot specify the `replicate` module directly in a processing # section. # # === Usage # -# This module can only be used as a dynamic expansion. Since the +# This module can only be used as a dynamic expansion. Since the # module does not wait for any response, the expansion does not # return any value. # @@ -713,7 +685,7 @@ radius { # # This function allows the module to send packets to _any_ # destination, where the destination is chosen dynamically at run -# time. The arguments to the function can be take from other +# time. The arguments to the function can be take from other # attributes, database queries, etc. # radius replicate { @@ -723,8 +695,8 @@ radius replicate { type = Accounting-Request # - # We are not opening a socket from our server to their - # server. We are replicating packets. + # We are not opening a socket from our server to their server. We + # are replicating packets. # mode = unconnected-replicate @@ -745,23 +717,23 @@ radius replicate { src_ipaddr = * # - # `src_port` cannot be used. If it is used here, the - # module will refuse to start. Instead, the module - # will open a unique source port per thread. + # `src_port` cannot be used. If it is used here, the module will + # refuse to start. Instead, the module will open a unique source + # port per thread. # - # `secret` cannot be used. If it is used, the value - # will be ignored. + # `secret` cannot be used. If it is used, the value will be + # ignored. # } # # === Other Configuration # - # No other configuration items are supported when using - # `mode = unconnected-replicate`. + # No other configuration items are supported when using `mode = + # unconnected-replicate`. # - # The `pool` configuration is ignored, as is `status-check`, - # along with all per-packet timeouts. + # The `pool` configuration is ignored, as is `status-check`, along + # with all per-packet timeouts. # } @@ -773,7 +745,7 @@ radius replicate { # %proxy.sendto.ipaddr(127.0.0.1, 1812, "testing123") # # The first part of the function name (e.g. `proxy`) is taken from -# the module name. The rest is fixed as `sendto.ipaddr()` +# the module name. The rest is fixed as `sendto.ipaddr()` # # The arguments to the function are: # @@ -790,9 +762,9 @@ radius replicate { # # The packet name must be a quoted string. # -# The proxying is done asynchronously. i.e. the packet is sent, and -# the server goes on to do other work. At some point in the future, -# a response is received, the module processes it, and the server +# The proxying is done asynchronously. i.e. the packet is sent, and +# the server goes on to do other work. At some point in the future, a +# response is received, the module processes it, and the server # continues. # # The timeouts are controlled as described above. @@ -822,23 +794,20 @@ radius proxy { # # src_port_start:: Start of source port range. # - # The outgoing proxy normally uses random source - # ports. When all of the RADIUS IDs are used for one - # connection, it opens up another random source port. + # The outgoing proxy normally uses random source ports. When all of + # the RADIUS IDs are used for one connection, it opens up another + # random source port. # - # However, it is sometimes useful to restrict the - # range of source ports to known values. The - # `src_port_start` and `src_port_end` configuration - # flags allow the port range to be controlled. The - # module will then restrict the source ports it is - # using to be within this range. + # However, it is sometimes useful to restrict the range of source + # ports to known values. The `src_port_start` and `src_port_end` + # configuration flags allow the port range to be controlled. The + # module will then restrict the source ports it is using to be + # within this range. # - # When all ports in this range are used, the module - # will not be able to open any more outgoing - # connections.x + # When all ports in this range are used, the module will not be + # able to open any more outgoing connections.x # - # These two configuration items can only be used for - # UDP sockets. + # These two configuration items can only be used for UDP sockets. # src_port_start = 10000 @@ -848,44 +817,43 @@ radius proxy { src_port_end = 11000 # - # `src_port` cannot be used. If it is used here, the - # module will refuse to start. Instead, the module - # will open a unique source port per thread. + # `src_port` cannot be used. If it is used here, the module will + # refuse to start. Instead, the module will open a unique source + # port per thread. # - # `secret` cannot be used. If it is used, the value - # will be ignored. + # `secret` cannot be used. If it is used, the value will be + # ignored. # } # - # Dynamic proxying does *not* support the `status_check` - # section. + # Dynamic proxying does *not* support the `status_check` section. # # # home_server_lifetime:: The lifetime of the home server. # # When a new dynamic home server is used, the module caches - # information about it. So long as the home server is still - # being used, it will not expire. But if it has received all - # expected responses (or timeouts), _and_ it has reached its - # expected lifetime, then the home server will be deleted. - # - # This process allows for the secret to change over time. - # However, the secret can only be changed if there are no - # outstanding packets. Otherwise, changing the secret would - # involve having multiple packets outstanding which have - # different secrets. That doesn't work, and can't be fixed - # through any code changes on the server. + # information about it. So long as the home server is still being + # used, it will not expire. But if it has received all expected + # responses (or timeouts), _and_ it has reached its expected + # lifetime, then the home server will be deleted. + # + # This process allows for the secret to change over time. However, + # the secret can only be changed if there are no outstanding + # packets. Otherwise, changing the secret would involve having + # multiple packets outstanding which have different secrets. That + # doesn't work, and can't be fixed through any code changes on the + # server. # # The solution to that is to switch to using TLS. # home_server_lifetime = 3600 # - # These are allowed, but are less useful. If the home server - # doesn't respond, it will often just hit the home server - # lifetime, and be deleted. + # These are allowed, but are less useful. If the home server doesn't + # respond, it will often just hit the home server lifetime, and be + # deleted. # response_window = 15 zombie_period = 10 @@ -895,9 +863,8 @@ radius proxy { # # == Timeouts # - # Timeouts for proxying are controlled in sections named for - # the packet type. See the examples above for full - # documentation. + # Timeouts for proxying are controlled in sections named for the + # packet type. See the examples above for full documentation. # Access-Request { initial_rtx_time = 2 @@ -915,10 +882,11 @@ radius proxy { # # start:: Connections to create during module instantiation. # - # If the server cannot create specified number of connections during instantiation - # it will exit. + # If the server cannot create specified number of connections + # during instantiation it will exit. # - # Set to `0` to allow the server to start without the database being available. + # Set to `0` to allow the server to start without the database + # being available. # start = 0 @@ -930,68 +898,61 @@ radius proxy { # # max:: Maximum number of connections. # - # If these connections are all in use and a new one is requested, the request - # will NOT get a connection. + # If these connections are all in use and a new one is requested, + # the request will NOT get a connection. # max = 8 # - # connecting:: Maximum number of sockets to have in the "connecting" state. + # connecting:: Maximum number of sockets to have in the + # "connecting" state. # - # If a home server goes down, the module will close - # old / broken connections, and try to open new ones. - # In order to avoid flooding the home server with - # connection attempts, set the `connecting` value to - # a small number. + # If a home server goes down, the module will close old / broken + # connections, and try to open new ones. In order to avoid flooding + # the home server with connection attempts, set the `connecting` + # value to a small number. # connecting = 1 # # uses:: number of packets which will use the connection. # - # After `uses` packets have been sent the connection - # will be closed, and a new one opened. For no - # limits, set `uses = 0`. + # After `uses` packets have been sent the connection will be + # closed, and a new one opened. For no limits, set `uses = 0`. # uses = 0 # # lifetime:: lifetime of a connection, in seconds. # - # After `lifetime` seconds have passed, no new - # packets will be sent on the connection. When all - # replies have been received, the connection will be - # closed. + # After `lifetime` seconds have passed, no new packets will be sent + # on the connection. When all replies have been received, the + # connection will be closed. # # For no limits, set `lifetime = 0`. # - # It is possible to use precise times, such as - # `lifetime = 1.023`, or even qualifiers such as - # `lifetime = 400ms`. + # It is possible to use precise times, such as `lifetime = 1.023`, + # or even qualifiers such as `lifetime = 400ms`. # lifetime = 0 # - # open_delay:: How long (in seconds) a connection - # must be above `per_connection_target` before a new - # connection is opened. + # open_delay:: How long (in seconds) a connection must be above + # `per_connection_target` before a new connection is opened. # - # Parsing of this field is the same as for - # `lifetime`. + # Parsing of this field is the same as for `lifetime`. # open_delay = 0.2 # - # close_delay:: How long (in seconds) a connection - # must be below `per_connection_target` before a - # connection is closed. + # close_delay:: How long (in seconds) a connection must be below + # `per_connection_target` before a connection is closed. # close_delay = 1.0 # - # manage_interval:: How often (in seconds) the - # connections are checked for limits, in order to - # open / close connections. + # manage_interval:: How often (in seconds) the connections are + # checked for limits, in order to open / close connections. # manage_interval = 0.2 @@ -1000,18 +961,15 @@ radius proxy { # connection { # - # connect_timeout:: How long to wait - # before giving up on a connection which is - # being opened. + # connect_timeout:: How long to wait before giving up on a + # connection which is being opened. # connect_timeout = 3.0 # - # reconnect_delay:: If opening a connection - # fails, or an open connection fails, - # we wait `reconnect_delay` seconds before - # attempting to open another - # connection. + # reconnect_delay:: If opening a connection fails, or an open + # connection fails, we wait `reconnect_delay` seconds before + # attempting to open another connection. # reconnect_delay = 5 } @@ -1021,27 +979,24 @@ radius proxy { # request { # - # per_connection_max:: The maximum number of requests - # which are "live" on a particular connection. + # per_connection_max:: The maximum number of requests which are + # "live" on a particular connection. # per_connection_max = 255 # - # per_connection_target:: The target number - # of requests which are "live" on a - # particular connection. + # per_connection_target:: The target number of requests which are + # "live" on a particular connection. # - # There can be a balance between overloading - # a connection, and under-utilizing it. The - # default is to fill each connection before - # opening a new one. + # There can be a balance between overloading a connection, and + # under-utilizing it. The default is to fill each connection + # before opening a new one. # per_connection_target = 255 # - # free_delay:: How long to wait before - # freeing internal resources associated with - # the connection. + # free_delay:: How long to wait before freeing internal resources + # associated with the connection. # free_delay = 10 } @@ -1059,8 +1014,8 @@ radius proxy { @policy proxy { # - # Create a subrequest which we can edit. When the subrequest - # section is done, + # Create a subrequest which we can edit. When the subrequest section + # is done, # subrequest { # @@ -1080,24 +1035,20 @@ radius proxy { # # This is the "post-proxy" section. # - # Note that the Proxy-State attributes have already - # been deleted from the reply, so you don't need to - # do that here. Those attributes are not needed by - # anyone for anything, and confuse things if they're - # copied to the original request. The `radius` - # module therefore deletes them, to make your life - # easier. + # Note that the Proxy-State attributes have already been deleted + # from the reply, so you don't need to do that here. Those + # attributes are not needed by anyone for anything, and confuse + # things if they're copied to the original request. The `radius` + # module therefore deletes them, to make your life easier. # # - # Like v3, remove all pre-existing attributes in the - # original reply, and replace them with the reply - # from the home server. + # Like v3, remove all pre-existing attributes in the original + # reply, and replace them with the reply from the home server. # - # It is also possible to copy over some, or none of - # the attributes in the reply from the home server. - # The configuration here is just an example, and can - # be edited. + # It is also possible to copy over some, or none of the attributes + # in the reply from the home server. The configuration here is just + # an example, and can be edited. # parent.reply := reply } diff --git a/raddb/mods-available/redis b/raddb/mods-available/redis index cbfd45647fe..8be80974812 100644 --- a/raddb/mods-available/redis +++ b/raddb/mods-available/redis @@ -7,8 +7,8 @@ # # = REDIS Module # -# The `redis` module handles connections to a redis database, -# and the `%redis( ...)` dynamic expansion. +# The `redis` module handles connections to a redis database, and the +# `%redis( ...)` dynamic expansion. # # See also https://redis.io/documentation for documentation on the # Redis database. @@ -17,31 +17,32 @@ # # == Configuration Settings # -# This module connects to a Redis database. Other modules -# (e.g. `redis_ippool`) perform task-specific functions using Redis. +# This module connects to a Redis database. Other modules (e.g. +# `redis_ippool`) perform task-specific functions using Redis. # redis { # # server:: The server to connect to. # - # If using Redis cluster, multiple 'bootstrap' servers may be - # listed here (as separate config items). These will be contacted - # in turn until one provides us with a valid map for the cluster. + # If using Redis cluster, multiple 'bootstrap' servers may be listed + # here (as separate config items). These will be contacted in turn + # until one provides us with a valid map for the cluster. # # Server strings may contain unique ports e.g.: # # server = '127.0.0.1:30001' # server = '[::1]:30002' # - # NOTE: Instantiation failure behaviour is controlled by `pool.start` - # as with every other module, but with clustering, the `pool { ... }` - # section determines limits for each node in the cluster, not the - # cluster as a whole. + # NOTE: Instantiation failure behaviour is controlled by + # `pool.start` as with every other module, but with clustering, the + # `pool { ... }` section determines limits for each node in the + # cluster, not the cluster as a whole. # server = 127.0.0.1 # - # database:: Select the Redis logical database having the specified zero-based numeric index. + # database:: Select the Redis logical database having the specified + # zero-based numeric index. # # NOTE: Redis only supports logical databases when Redis cluster is # not in use. @@ -49,8 +50,7 @@ redis { # database = 0 # - # port:: Port to connect to - # The default port is 6379. + # port:: Port to connect to The default port is 6379. # port = 6379 @@ -64,21 +64,23 @@ redis { # # use_tls:: Use TLS (requires hiredis 1.0+) # - # TLS parameters can be specified in the optional adjacent tls {} section + # TLS parameters can be specified in the optional adjacent tls {} + # section # # use_tls = no -# tls { } + # tls { } # # use_cluster_map:: Use cluster map # # Build cluster map during initialization. # - # The cluster client can operate, albeit inefficiently, without a cluster map - # by following '-ASK' and '-MOVE' redirects. + # The cluster client can operate, albeit inefficiently, without a + # cluster map by following '-ASK' and '-MOVE' redirects. # - # Disabling cluster map can be required for stunnel-based deployments. - # Alternatively, cluster map is not built during initialization when pool.start == 0 + # Disabling cluster map can be required for stunnel-based + # deployments. Alternatively, cluster map is not built during + # initialization when pool.start == 0 # # In addition the cluster map should be disabled when connecting to # non-clustered Redis servers. @@ -94,24 +96,28 @@ redis { # # function { ... }:: # - # Every function section listed here will be registered as an expansion with a name - # in the format `.`. + # Every function section listed here will be registered as an + # expansion with a name in the format `.`. # - # For example the function below would be callable as `%redis.hello_world(...)`. + # For example the function below would be callable as + # `%redis.hello_world(...)`. # - # expansion functions take the same arguments as the redis `EVALSHA` command, - # i.e. ` [ [ ...]] [ [ ...]]`. + # expansion functions take the same arguments as the redis + # `EVALSHA` command, i.e. ` [ [ ...]] [ + # [ ...]]`. # - # `numkeys` specifies how many of the proceeding arguments should be treated as keys. + # `numkeys` specifies how many of the proceeding arguments should + # be treated as keys. # - # The redis module will use the first key to determine which cluster node the function - # should called on. + # The redis module will use the first key to determine which + # cluster node the function should called on. # - # The redis module pre-calcualtes the SHA1 hash of all lua functions on startup. - # When an expansion function is called, it uses the `EVALSHA` command to attempt to - # call lua function on a remote redis node. If `EVALSHA` fails with an error indicating - # no script could be found with the calculated SHA1 hash, the lua function will be - # loaded transparently using `SCRIPT LOAD`. + # The redis module pre-calcualtes the SHA1 hash of all lua + # functions on startup. When an expansion function is called, it + # uses the `EVALSHA` command to attempt to call lua function on a + # remote redis node. If `EVALSHA` fails with an error indicating no + # script could be found with the calculated SHA1 hash, the lua + # function will be loaded transparently using `SCRIPT LOAD`. # function hello_world { # @@ -124,17 +130,16 @@ redis { # # pool { ... }:: # - # Information for the connection pool. The configuration items below + # Information for the connection pool. The configuration items below # are the same for all modules which use the new connection pool. # pool { # # start:: Connections to create during module instantiation. # - # If the server cannot create specified number of - # connections during instantiation it will exit. - # Set to `0` to allow the server to start without the - # external service being available. + # If the server cannot create specified number of connections + # during instantiation it will exit. Set to `0` to allow the server + # to start without the external service being available. # start = 0 @@ -146,26 +151,26 @@ redis { # # max:: Maximum number of connections. # - # If these connections are all in use and a new one - # is requested, the request will NOT get a connection. + # If these connections are all in use and a new one is requested, + # the request will NOT get a connection. # - # Setting `max` to *LESS* than the number of threads means - # that some threads may starve, and you will see errors - # like _No connections available and at max connection limit_. + # Setting `max` to *LESS* than the number of threads means that + # some threads may starve, and you will see errors like _No + # connections available and at max connection limit_. # - # Setting `max` to MORE than the number of threads means - # that there are more connections than necessary. + # Setting `max` to MORE than the number of threads means that there + # are more connections than necessary. # - # If `max` is not specified, then it defaults to the number - # of workers configured. + # If `max` is not specified, then it defaults to the number of + # workers configured. # # max = # # spare:: Spare connections to be left idle. # - # NOTE: Idle connections WILL be closed if `idle_timeout` - # is set. This should be less than or equal to `max` above. + # NOTE: Idle connections WILL be closed if `idle_timeout` is set. + # This should be less than or equal to `max` above. # spare = 1 @@ -177,8 +182,8 @@ redis { uses = 0 # - # retry_delay:: The number of seconds to wait after the server tries - # to open a connection, and fails. + # retry_delay:: The number of seconds to wait after the server + # tries to open a connection, and fails. # # During this time, no new connections will be opened. # @@ -202,7 +207,8 @@ redis { # # idle_timeout:: The idle timeout (in seconds). # - # A connection which is unused for this length of time will be closed. + # A connection which is unused for this length of time will be + # closed. # # NOTE: `0` means "infinite". # @@ -211,22 +217,23 @@ redis { # # connect_timeout:: Connection timeout (in seconds). # - # The maximum amount of time to wait for a new connection to be established. + # The maximum amount of time to wait for a new connection to be + # established. # connect_timeout = 3.0 # # [NOTE] # ==== - # All configuration settings are enforced. If a connection is closed because of - # `idle_timeout`, `uses`, or `lifetime`, then the total number of connections MAY - # fall below `min`. + # All configuration settings are enforced. If a connection is + # closed because of `idle_timeout`, `uses`, or `lifetime`, then the + # total number of connections MAY fall below `min`. # - # When that happens, it will open a new connection. It will also log a *WARNING* - # message. + # When that happens, it will open a new connection. It will also + # log a *WARNING* message. # - # The solution is to either lower the "min" connections, - # or increase lifetime/idle_timeout. + # The solution is to either lower the "min" connections, or + # increase lifetime/idle_timeout. # ==== # } diff --git a/raddb/mods-available/redis_ippool b/raddb/mods-available/redis_ippool index c4a10cf8a89..4e02dcf22ce 100644 --- a/raddb/mods-available/redis_ippool +++ b/raddb/mods-available/redis_ippool @@ -20,12 +20,12 @@ # # == Configuration Settings # -# Al configuration items at this level (below the `redis` block) -# are polymorphic, meaning `xlats`, attribute references, literal values +# Al configuration items at this level (below the `redis` block) are +# polymorphic, meaning `xlats`, attribute references, literal values # and execs may be specified. # -# For example `pool_name` could be `pool_name = 'my_test_pool'` if only a -# single pool were being used. +# For example `pool_name` could be `pool_name = 'my_test_pool'` if +# only a single pool were being used. # redis_ippool { # @@ -34,13 +34,14 @@ redis_ippool { pool_name = control.IP-Pool.Name # - # offer_time:: How long a lease is reserved for after making an offer. + # offer_time:: How long a lease is reserved for after making an + # offer. # - # If no value is provided, the value from lease_time is used - # for initial allocations. + # If no value is provided, the value from lease_time is used for + # initial allocations. # - # NOTE: No value should be provided for _PPP/VPNs_, this is mainly for the - # _DORA_ flow in _DHCP_. + # NOTE: No value should be provided for _PPP/VPNs_, this is mainly + # for the _DORA_ flow in _DHCP_. # offer_time = 30 @@ -50,21 +51,23 @@ redis_ippool { lease_time = 3600 # - # association_time:: How long the owner -> IP association should be kept. + # association_time:: How long the owner -> IP association should be + # kept. # - # If this is set, and the value is greater than `lease_time` then the - # association between the "owner" and an IP address will be kept for - # this many seconds after the allocation / most recent renewal. + # If this is set, and the value is greater than `lease_time` then + # the association between the "owner" and an IP address will be kept + # for this many seconds after the allocation / most recent renewal. # - # This allows for "sticky" addressing, where a request for an address - # will return the last one allocated to the owner if it is within this - # number of seconds of the allocation / most recent renewal and the - # address has not been allocated to another owner. + # This allows for "sticky" addressing, where a request for an + # address will return the last one allocated to the owner if it is + # within this number of seconds of the allocation / most recent + # renewal and the address has not been allocated to another owner. # # association_time = 7200 # - # wait_num:: How many slaves we want to acknowledge allocations or updates. + # wait_num:: How many slaves we want to acknowledge allocations or + # updates. # # wait_num = 10 @@ -74,17 +77,17 @@ redis_ippool { # wait_timeout = 2 # - # gateway:: Gateway identifier, usually `NAS-Identifier` or the actual Option 82 gateway. - # Used for bulk lease cleanups. + # gateway:: Gateway identifier, usually `NAS-Identifier` or the + # actual Option 82 gateway. Used for bulk lease cleanups. # # gateway = NAS-Identifier # # owner:: The unique owner identifier to which an IP is assigned. # - # This is used as the lookup key to determine the IP address that has - # been allocated to a owner. It MUST therefore be something unique to - # each "owner" to which an IP address may be assigned. + # This is used as the lookup key to determine the IP address that + # has been allocated to a owner. It MUST therefore be something + # unique to each "owner" to which an IP address may be assigned. # # For DHCP it is often simply the MAC address of the owner. # @@ -100,16 +103,17 @@ redis_ippool { # owner = "%{Client-Identifier || Client-Hardware-Address}" # - # For purposes such as IP assignment using a RADIUS Framed-IP-Address - # attribute the "owner" identifier could be a `User-Name` or a - # certificate serial number provided that the number of sessions is - # limited to one per user/serial. + # For purposes such as IP assignment using a RADIUS + # Framed-IP-Address attribute the "owner" identifier could be a + # `User-Name` or a certificate serial number provided that the + # number of sessions is limited to one per user/serial. # # On a hostile network it SHOULD include a component that you trust, - # arranged such that the overall key cannot be spoofed by manipulation - # of the user-controlled data. For example you might determine that - # Vendor-Specific.ADSL-Forum.Agent-Circuit-ID is trusted but that Calling-Station-Id is - # formatted as a user-controlled MAC address: + # arranged such that the overall key cannot be spoofed by + # manipulation of the user-controlled data. For example you might + # determine that Vendor-Specific.ADSL-Forum.Agent-Circuit-ID is + # trusted but that Calling-Station-Id is formatted as a + # user-controlled MAC address: # # owner = "%{Vendor-Specific.ADSL-Forum.Agent-Circuit-ID} %{Calling-Station-Id}" @@ -119,39 +123,45 @@ redis_ippool { requested_address = "%{Requested-IP-Address || Net.Src.IP}" # - # ipv4_integer:: Whether IPv4 addresses should be cast to integers, for renew operations. + # ipv4_integer:: Whether IPv4 addresses should be cast to integers, + # for renew operations. # # # ipv4_integer = yes # - # allocated_address_attr:: List and attribute where the allocated address is written to. + # allocated_address_attr:: List and attribute where the allocated + # address is written to. # allocated_address_attr = reply.Your-IP-Address # - # range_attr:: List and attribute where the `IP-Pool.Range` ID (if set) is written to. + # range_attr:: List and attribute where the `IP-Pool.Range` ID (if + # set) is written to. # - # The idea of the `IP-Pool.Range` is that it provides a key into other datastores - # or caches, which store the additional options associated with the range an - # IP address belongs to. + # The idea of the `IP-Pool.Range` is that it provides a key into + # other datastores or caches, which store the additional options + # associated with the range an IP address belongs to. # - # There may be multiple ranges of IP address contained within any given pool, - # which is why this is provided in addition to the pool name. + # There may be multiple ranges of IP address contained within any + # given pool, which is why this is provided in addition to the pool + # name. # range_attr = reply.IP-Pool.Range # - # expiry_attr:: If set - the list and attribute to write the remaining lease time to. + # expiry_attr:: If set - the list and attribute to write the + # remaining lease time to. # - # This attribute can be populated on alloc, or renew, if an - # IP address was available for the alloc. + # This attribute can be populated on alloc, or renew, if an IP + # address was available for the alloc. # expiry_attr = reply.IP-Address-Lease-Time # - # copy_on_update:: If true - Copy the value of ip_address to the attribute specified by - # `allocated_address_attr` when performing an update/renew. + # copy_on_update:: If true - Copy the value of ip_address to the + # attribute specified by `allocated_address_attr` when performing an + # update/renew. # # This behavior is needed for DHCP where we need to send back # `Your-IP-Address` in ACKs. diff --git a/raddb/mods-available/rediswho b/raddb/mods-available/rediswho index eeb47bdf7eb..dea26b034b3 100644 --- a/raddb/mods-available/rediswho +++ b/raddb/mods-available/rediswho @@ -7,7 +7,8 @@ # # = REDISWho Module # -# The `rediswho` module tracks the last set of login sessions for a user. +# The `rediswho` module tracks the last set of login sessions for a +# user. # # @@ -17,30 +18,29 @@ rediswho { # # server:: # - # If using Redis cluster, multiple 'bootstrap' servers may be - # listed here (as separate config items). These will be contacted - # in turn until one provides us with a valid map for the cluster. - # Server strings may contain unique ports e.g.: + # If using Redis cluster, multiple 'bootstrap' servers may be listed + # here (as separate config items). These will be contacted in turn + # until one provides us with a valid map for the cluster. Server + # strings may contain unique ports e.g.: # # server = '127.0.0.1:30001' # server = '[::1]:30002' # # NOTE: Instantiation failure behaviour is controlled by - # `pool.start` as with other modules. With clustering - # however, the `pool { ... }` section determines limits for - # each node we access in the cluster, and not the cluster as - # a whole. + # `pool.start` as with other modules. With clustering however, the + # `pool { ... }` section determines limits for each node we access + # in the cluster, and not the cluster as a whole. # server = 127.0.0.1 # - # database:: Select the Redis logical database having the specified zero-based numeric index. + # database:: Select the Redis logical database having the specified + # zero-based numeric index. # # database = 0 # - # port:: Port to connect to - # The default port is 6379. + # port:: Port to connect to The default port is 6379. # port = 6379 @@ -60,8 +60,8 @@ rediswho { # # expire_time:: Expiry time in seconds. # - # Any sessions which have not received an update in this time will be - # automatically expired. + # Any sessions which have not received an update in this time will + # be automatically expired. # expire_time = 86400 @@ -70,13 +70,15 @@ rediswho { # # Each subsection contains insert / trim / expire queries. # - # The subsections are named after the contents of the `Acct-Status-Type` attribute. + # The subsections are named after the contents of the + # `Acct-Status-Type` attribute. # - # See `dictionary.rfc2866` for the names of the various Acct-Status-Type values, - # or look at the output of debug mode. + # See `dictionary.rfc2866` for the names of the various + # Acct-Status-Type values, or look at the output of debug mode. # - # This module supports *any* `Acct-Status-Type`. Just add a subsection - # of the appropriate name, along with insert / trim / expire queries. + # This module supports *any* `Acct-Status-Type`. Just add a + # subsection of the appropriate name, along with insert / trim / + # expire queries. # # diff --git a/raddb/mods-available/redundant_sql b/raddb/mods-available/redundant_sql index 4adaf4ada87..ffce6bc83db 100644 --- a/raddb/mods-available/redundant_sql +++ b/raddb/mods-available/redundant_sql @@ -7,7 +7,8 @@ # # = redundant_sql Module # -# The `redundant_sql` module handles SQL expansions in a redundant manner. +# The `redundant_sql` module handles SQL expansions in a redundant +# manner. # # # This configuration is a `virtual` module. @@ -27,23 +28,22 @@ # * All modules in the section are using the same # driver, e.g. They are all sql, or all ldap, etc. # -# When those conditions are satisfied, the server will -# automatically register a dynamic expansion, using the -# name of the `virtual` module. In the example below, -# it will be `redundant_sql`. You can then use this expansion -# just like any other: +# When those conditions are satisfied, the server will automatically +# register a dynamic expansion, using the name of the `virtual` +# module. In the example below, it will be `redundant_sql`. You can +# then use this expansion just like any other: # -# reply.Filter-Id := "%redundant_sql( ... )" +# reply.Filter-Id := "%redundant_sql( ... )" # # In this example, the expansion is done via module `sql1`, and if # that expansion fails, using module `sql2`. # # For best results, configure the `pool` subsection of the module so -# that `retry_delay` is non-zero. That will allow the redundant -# block to quickly ignore all "down" SQL databases. If instead we -# have `retry_delay = 0`, then every time the redundant block is -# used, the server will try to open a connection to every `down` -# database, causing problems. +# that `retry_delay` is non-zero. That will allow the redundant block +# to quickly ignore all "down" SQL databases. If instead we have +# `retry_delay = 0`, then every time the redundant block is used, the +# server will try to open a connection to every `down` database, +# causing problems. # redundant redundant_sql { sql1 diff --git a/raddb/mods-available/rest b/raddb/mods-available/rest index eadc66c1b45..953139b5334 100644 --- a/raddb/mods-available/rest +++ b/raddb/mods-available/rest @@ -15,84 +15,97 @@ rest { # - # tls { ... }:: Configure the tls related items that control - # how FreeRADIUS connects to a HTTPS server. + # tls { ... }:: Configure the tls related items that control how + # FreeRADIUS connects to a HTTPS server. # tls { # # Certificate validation options # - # Specifies how the certificate(s) presented by the HTTPS server being contacted - # are validated, and which certificates (if any) to send to the HTTPS server. + # Specifies how the certificate(s) presented by the HTTPS server + # being contacted are validated, and which certificates (if any) to + # send to the HTTPS server. # # - # ca_file:: PEM formatted file containing the chain to validate the HTTPS server's cert + # ca_file:: PEM formatted file containing the chain to validate the + # HTTPS server's cert # - # Should usually contain a concatenation of one or more intermediary CA - # files, shallowest (i.e. the one that signed the HTTPS server's cert) first, and - # deepest (the root CA) last. + # Should usually contain a concatenation of one or more + # intermediary CA files, shallowest (i.e. the one that signed the + # HTTPS server's cert) first, and deepest (the root CA) last. # - # Providing a complete certificate chain here is the most common way of validating - # the certificate presented by a HTTPS server. + # Providing a complete certificate chain here is the most common + # way of validating the certificate presented by a HTTPS server. # # ca_file = "${certdir}/cacert.pem" # - # ca_issuer_file:: PEM formatted file containing the CA that signed the HTTPS server's cert + # ca_issuer_file:: PEM formatted file containing the CA that signed + # the HTTPS server's cert # - # Specifies the certificate that directly signed the certificate presented by the - # HTTPS server. + # Specifies the certificate that directly signed the certificate + # presented by the HTTPS server. # - # This configuration option can be used to prevent certificates passing validation that - # were signed by other intermediary CAs or root CAs in the trusted certificate chain. + # This configuration option can be used to prevent certificates + # passing validation that were signed by other intermediary CAs or + # root CAs in the trusted certificate chain. # # ca_issuer_file = "${certdir}/caissuer.pem" # - # ca_path:: A directory containing multiple root CA certs named by their hash + # ca_path:: A directory containing multiple root CA certs named by + # their hash # # See the OpenSSL documentation for more details: # - https://www.openssl.org/docs/man1.1.0/man3/SSL_CTX_set_default_verify_paths.html # - https://www.openssl.org/docs/man1.1.1/man1/c_rehash.html # - # This configuration option should only be used when the HTTPS server being contacted - # is not known ahead of time (using a URL from an external source), and/or the CA used - # to sign the HTTPS server certificate is unknown. + # This configuration option should only be used when the HTTPS + # server being contacted is not known ahead of time (using a URL + # from an external source), and/or the CA used to sign the HTTPS + # server certificate is unknown. # - # If not set, then whatever libcurl has as its default will be used, which typically - # will be the operating system's set of trusted CAs. This will be visible in the debug - # output when FreeRADIUS starts. + # If not set, then whatever libcurl has as its default will be + # used, which typically will be the operating system's set of + # trusted CAs. This will be visible in the debug output when + # FreeRADIUS starts. # # ca_path = "${certdir}" # - # certificate_file:: PEM formatted file containing the certificate we present to the HTTPS server + # certificate_file:: PEM formatted file containing the certificate + # we present to the HTTPS server # - # Specifies a certificate and any intermediary CAs we should send to the HTTPS server. + # Specifies a certificate and any intermediary CAs we should send + # to the HTTPS server. # - # This file should usually contain the client certificate file first, then any - # intermediary signing CAs, shallowest (direct signee of the certificate_file) - # to deepest (signed directly by the root CA). + # This file should usually contain the client certificate file + # first, then any intermediary signing CAs, shallowest (direct + # signee of the certificate_file) to deepest (signed directly by + # the root CA). # # certificate_file = /path/to/radius.pem # - # private_key_file:: PEM formatted file containing the private key for the specified certificate_file + # private_key_file:: PEM formatted file containing the private key + # for the specified certificate_file # # Must be specified if certificate_file is being used. # # private_key_file = /path/to/radius.key # - # private_key_password:: Password used to decrypt the private key file. + # private_key_password:: Password used to decrypt the private key + # file. # # Should only be specified in the private_key_file is encrypted. # # private_key_password = "supersecret" # - # random_file:: Source of random data used for various cryptographic functions. + # random_file:: Source of random data used for various + # cryptographic functions. # # random_file = /dev/urandom @@ -129,7 +142,8 @@ rest { # check_cert_cn = no # - # extract_cert_attrs:: Extract OIDs from presented certificates as OIDs. + # extract_cert_attrs:: Extract OIDs from presented certificates as + # OIDs. # # Default is `no` # @@ -138,9 +152,11 @@ rest { # # keylog_file:: Write out session keys in SSLKEYLOGFILE format # - # The SSLKEYLOGFILE format is specified here https://www.ietf.org/archive/id/draft-thomson-tls-keylogfile-00.html. + # The SSLKEYLOGFILE format is specified here + # https://www.ietf.org/archive/id/draft-thomson-tls-keylogfile-00.html. # - # The contents of the keylog file allows wireshark captures to be decrypted for debugging purposes. + # The contents of the keylog file allows wireshark captures to be + # decrypted for debugging purposes. # # NOTE: keylog_file is not expanded at runtime. # @@ -178,10 +194,12 @@ rest { # http_negotiation = "default" # - # multiplex:: Execute multiple requests simultaneously using the same HTTP connection. + # multiplex:: Execute multiple requests simultaneously using the + # same HTTP connection. # - # NOTE: HTTP >= 2.0 is required for multiplexing to succeed. If we can't negotiate - # a high enough http version, multiplexing will be silently disabled. + # NOTE: HTTP >= 2.0 is required for multiplexing to succeed. If we + # can't negotiate a high enough http version, multiplexing will be + # silently disabled. # # multiplex = yes @@ -196,14 +214,17 @@ rest { # The following config items can be used in each of the sections. # The sections themselves reflect the sections in the server. # - # For example, if you list `rest` in the `recv Access-Request` section of a `virtual server`, - # the settings from the `recv access-request` section here will be used. + # For example, if you list `rest` in the `recv Access-Request` + # section of a `virtual server`, the settings from the `recv + # access-request` section here will be used. # - # Where sections have two parts to the name, if a section which matches both names is not - # found, then one using just the first name will be looked for. E.g. a call in `accounting Start`, - # will look for `accounting start` and fall back to `accounting`. + # Where sections have two parts to the name, if a section which + # matches both names is not found, then one using just the first + # name will be looked for. E.g. a call in `accounting Start`, will + # look for `accounting start` and fall back to `accounting`. # - # At the top level of each section, the following config items may be listed: + # At the top level of each section, the following config items may + # be listed: # # [options="header,autowidth"] # |=== @@ -214,7 +235,8 @@ rest { # | `timeout` | HTTP request timeout in seconds, defaults to 4.0. # |=== # - # In the `request { ... }` subsection, the following config items may be listed: + # In the `request { ... }` subsection, the following config items + # may be listed: # # [options="header,autowidth"] # |=== @@ -245,7 +267,8 @@ rest { # |=== # # - # In the `response { ... }` subsection, the following config items may be listed: + # In the `response { ... }` subsection, the following config items + # may be listed: # # [options="header,autowidth"] # |=== @@ -259,14 +282,15 @@ rest { # | `max_body_in` | Maximum size of incoming HTTP body, defaults to 16k. # |=== # - # Additional HTTP headers may be specified with `control.REST-HTTP-Header`. + # Additional HTTP headers may be specified with + # `control.REST-HTTP-Header`. # # The values of those attributes should be in the format: # # : # - # `control.REST-HTTP-Header` attributes will be consumed after each call - # to the rest module, and each `%rest(...)` expansion. + # `control.REST-HTTP-Header` attributes will be consumed after each + # call to the rest module, and each `%rest(...)` expansion. # # @@ -280,7 +304,8 @@ rest { # # `[outer.][.]=&[outer.][.]=` # - # JSON - All attributes and values are escaped according to the JSON specification. + # JSON - All attributes and values are escaped according to the JSON + # specification. # # e.g: # @@ -346,8 +371,8 @@ rest { # # - # xlat { ... }:: Allows a subset of section configuration items to be configured for - # any calls to this module's `xlat` function. + # xlat { ... }:: Allows a subset of section configuration items to + # be configured for any calls to this module's `xlat` function. # xlat { tls = ${..tls} @@ -355,11 +380,11 @@ rest { # # binary:: Is the output of %rest() expected to be binary data # - # Setting this to "yes" will result in the %rest() xlat outputting octet - # data rather than string data. + # Setting this to "yes" will result in the %rest() xlat outputting + # octet data rather than string data. # - # When it is "no" then the output type will be determined from the body - # type of the response. + # When it is "no" then the output type will be determined from the + # body type of the response. # # binary = yes } @@ -367,7 +392,8 @@ rest { # # === recv { ... } # - # Default action when called in `recv` sections except `recv Accounting-Request`. + # Default action when called in `recv` sections except `recv + # Accounting-Request`. # # [options="header,autowidth"] # |=== @@ -408,7 +434,8 @@ rest { # # === Accounting { ... } # - # Default action when called in `recv Accounting-Request` or `accounting` sections. + # Default action when called in `recv Accounting-Request` or + # `accounting` sections. # # [options="header,autowidth"] # |=== @@ -443,13 +470,13 @@ rest { } # - # connection { ... }:: Configure how connection handles are - # managed per thread. + # connection { ... }:: Configure how connection handles are managed + # per thread. # connection { # - # Reusable connection handles are allocated in blocks. These + # Reusable connection handles are allocated in blocks. These # parameters allow for tuning how that is done. # # Since http requests are performed async, the settings here @@ -458,29 +485,28 @@ rest { reuse { # - # min:: The minimum number of connection handles to - # keep allocated. + # min:: The minimum number of connection handles to keep + # allocated. # min = 10 # - # max:: The maximum number of reusable connection handles - # to allocate. + # max:: The maximum number of reusable connection handles to + # allocate. # - # Any requests to allocate a connection handle beyond - # this number will cause a temporary handle to be allocated. - # This is less efficient than the block allocation so - # `max` should be set to reflect the number of outstanding - # requests expected at peak load. + # Any requests to allocate a connection handle beyond this number + # will cause a temporary handle to be allocated. This is less + # efficient than the block allocation so `max` should be set to + # reflect the number of outstanding requests expected at peak + # load. max = 100 # - # cleanup_interval:: How often to free un-used connection - # handles. + # cleanup_interval:: How often to free un-used connection handles. # - # Every `cleanup_interval` a cleanup routine runs which - # will free any blocks of handles which are not in use, - # ensuring that at least `min` handles are kept. + # Every `cleanup_interval` a cleanup routine runs which will free + # any blocks of handles which are not in use, ensuring that at + # least `min` handles are kept. # cleanup_interval = 30s @@ -489,7 +515,8 @@ rest { # # connect_timeout:: Connection timeout (in seconds). # - # The maximum amount of time to wait for a new connection to be established. + # The maximum amount of time to wait for a new connection to be + # established. # connect_timeout = 3.0 } diff --git a/raddb/mods-available/smbpasswd b/raddb/mods-available/smbpasswd index aa5e402c591..bef4fd59fe6 100644 --- a/raddb/mods-available/smbpasswd +++ b/raddb/mods-available/smbpasswd @@ -13,8 +13,8 @@ # # == Configuration Settings # -# See the `passwd` module for documentation on the configuration items -# for this module. +# See the `passwd` module for documentation on the configuration +# items for this module. # passwd smbpasswd { filename = /etc/smbpasswd diff --git a/raddb/mods-available/smtp b/raddb/mods-available/smtp index b81cf903e71..8d45d7857b6 100644 --- a/raddb/mods-available/smtp +++ b/raddb/mods-available/smtp @@ -9,98 +9,106 @@ # # The `smtp` module can perform two actions: # -# When called in the `authenticate` section, it validates a users name -# and password from request attributes against an SMTP server without -# sending a mail. +# When called in the `authenticate` section, it validates a users +# name and password from request attributes against an SMTP server +# without sending a mail. # # When called with the method `mail` it will send an email. # -# The module can optionally perform a tls handshake, enabled with require_cert +# The module can optionally perform a tls handshake, enabled with +# require_cert # smtp { # - # tls { ... }:: Configure the tls related items which control - # how FreeRADIUS connects to an SMTP server. + # tls { ... }:: Configure the tls related items which control how + # FreeRADIUS connects to an SMTP server. # tls { # # Certificate validation options # - # Specifies how the certificate(s) presented by the - # SMTP server are validated, and which certificates - # (if any) to send to that SMTP server. + # Specifies how the certificate(s) presented by the SMTP server are + # validated, and which certificates (if any) to send to that SMTP + # server. # - # The options here behave the same as the options in - # other `tls` sections in the server. + # The options here behave the same as the options in other `tls` + # sections in the server. # # - # certificate_file:: PEM formatted file containing the certificate we present to the SMTP server + # certificate_file:: PEM formatted file containing the certificate + # we present to the SMTP server # - # Specifies a certificate and any intermediary CAs we should send to the SMTP server. + # Specifies a certificate and any intermediary CAs we should send + # to the SMTP server. # - # This file should usually contain the client certificate file first, then any - # intermediary signing CAs, shallowest (direct signee of the certificate_file) - # to deepest (signed directly by the root CA). + # This file should usually contain the client certificate file + # first, then any intermediary signing CAs, shallowest (direct + # signee of the certificate_file) to deepest (signed directly by + # the root CA). # # certificate_file = /path/to/radius.pem # - # ca_file:: PEM formatted file containing the chain - # to validate the SMTP server's certificate. + # ca_file:: PEM formatted file containing the chain to validate the + # SMTP server's certificate. # - # Any certificate chain MUST be in order from server - # certificate (first in the file) to intermediary CAs (second) to - # Root CA (last in the file) as per RFC 4346 Section 7.4.2 (see certificate_list) + # Any certificate chain MUST be in order from server certificate + # (first in the file) to intermediary CAs (second) to Root CA (last + # in the file) as per RFC 4346 Section 7.4.2 (see certificate_list) # - # Providing a complete certificate chain here is the - # most common way of validating the certificate - # presented by an SMTP server. + # Providing a complete certificate chain here is the most common + # way of validating the certificate presented by an SMTP server. # # ca_file = "${certdir}/cacert.pem" # - # ca_issuer_file:: PEM formatted file containing the - # CA that signed the SMTP server's certificate. + # ca_issuer_file:: PEM formatted file containing the CA that signed + # the SMTP server's certificate. # - # Specifies the certificate which directly signed - # the certificate presented by the SMTPs server. + # Specifies the certificate which directly signed the certificate + # presented by the SMTPs server. # - # This configuration option can be used to prevent - # certificates passing validation which were signed - # by other intermediary CAs, or root CAs, in the - # trusted certificate chain. + # This configuration option can be used to prevent certificates + # passing validation which were signed by other intermediary CAs, + # or root CAs, in the trusted certificate chain. # # ca_issuer_file = "${certdir}/caissuer.pem" # - # ca_path:: A directory containing multiple root CA certs named by their hash. + # ca_path:: A directory containing multiple root CA certs named by + # their hash. # - # This configuration option should only be used when the SMTP server being contacted - # is not known ahead of time (using a URL from an external source), and/or the CA used - # to sign the SMTP server certificate is unknown. + # This configuration option should only be used when the SMTP + # server being contacted is not known ahead of time (using a URL + # from an external source), and/or the CA used to sign the SMTP + # server certificate is unknown. # - # If not set, then whatever libcurl has as its default will be used, which typically - # will be the operating system's set of trusted CAs. This will be visible in the debug - # output when FreeRADIUS starts. + # If not set, then whatever libcurl has as its default will be + # used, which typically will be the operating system's set of + # trusted CAs. This will be visible in the debug output when + # FreeRADIUS starts. # # ca_path = "${certdir}" # - # private_key_file:: PEM formatted file containing the private key for the specified `certificate_file` + # private_key_file:: PEM formatted file containing the private key + # for the specified `certificate_file` # # This item must be specified if `certificate_file` is being used. # # private_key_file = /path/to/radius.key # - # private_key_password:: Password used to decrypt the `private_key_file`. + # private_key_password:: Password used to decrypt the + # `private_key_file`. # # private_key_password = "supersecret" # - # random_file:: Source of random data used for various cryptographic functions. + # random_file:: Source of random data used for various + # cryptographic functions. # # random_file = /dev/urandom @@ -121,8 +129,8 @@ smtp { # check_cert = no # - # request_cert:: Options for controlling how the - # module requests TLS to the SMTP server. + # request_cert:: Options for controlling how the module requests + # TLS to the SMTP server. # # May be one of: # @@ -155,7 +163,8 @@ smtp { # check_cert_cn = no # - # extract_cert_attrs:: Extract OIDs from presented certificates as OIDs. + # extract_cert_attrs:: Extract OIDs from presented certificates as + # OIDs. # # Default is `no` # @@ -165,8 +174,9 @@ smtp { # # uri:: URI which will be used for connecting to the SMTP server. # - # The `smtp` module uses Curl (https://curl.haxx.se/libcurl/) to implement - # the underlying mail protocols. The URI should be in the form of: + # The `smtp` module uses Curl (https://curl.haxx.se/libcurl/) to + # implement the underlying mail protocols. The URI should be in the + # form of: # # `SCHEME://IP:PORT/` # @@ -188,17 +198,18 @@ smtp { uri = "smtp://192.0.20.1/" # - # timeout:: How long the module will wait, before giving up on the response - # from the SMTP server. + # timeout:: How long the module will wait, before giving up on the + # response from the SMTP server. # timeout = 5s # - # authenticate:: Configuration for verifying a users name and clear-text password - # against an SMTP server. + # authenticate:: Configuration for verifying a users name and + # clear-text password against an SMTP server. # - # This is not generally recommended, but is supported for cases where an LDAP server - # is not available, and only an SMTP server is available. + # This is not generally recommended, but is supported for cases + # where an LDAP server is not available, and only an SMTP server is + # available. # authenticate { # @@ -207,7 +218,8 @@ smtp { # username = User-Name # - # password_attribute:: The users password when performing SMTP authentication + # password_attribute:: The users password when performing SMTP + # authentication # # password = User-Password } @@ -231,8 +243,8 @@ smtp { # # template_directory:: Directory where email templates are stored. # - # All file attachments should be given as a relative path - # from this location. i.e. without a leading '/'. + # All file attachments should be given as a relative path from this + # location. i.e. without a leading '/'. # template_directory = ${confdir}/mods_config/smtp/ @@ -255,8 +267,8 @@ smtp { # # This can be different than the provided envelope_address. # - # If envelope_address is set, this can be formatted however - # you want it to appear to the receiver. + # If envelope_address is set, this can be formatted however you want + # it to appear to the receiver. # # If envelope_address is not set, the first element in # sender_address will be used as the envelope address. @@ -266,9 +278,9 @@ smtp { # # recipients:: Email addresses to be set as recipients for the email # - # If recipients is set, then `bcc`, `cc`, and `to` will not - # be automatically added to the email. Only the list of - # `recipients` will be used. + # If recipients is set, then `bcc`, `cc`, and `to` will not be + # automatically added to the email. Only the list of `recipients` + # will be used. # ## recipients = SMTP-Recipients[*] ## recipients = SMTP-TO[*] @@ -278,14 +290,16 @@ smtp { # # to:: Set the body `TO` header. # - # If `recepients` is not set, then messages will be sent to the `TO` address. + # If `recepients` is not set, then messages will be sent to the `TO` + # address. # # to = SMTP-TO[*] # # cc:: Set the body `CC` header. # - # If `recepients` is not set, then messages will also be sent to the `CC` addresses. + # If `recepients` is not set, then messages will also be sent to the + # `CC` addresses. # # cc = SMTP-CC[*] @@ -294,16 +308,17 @@ smtp { # # The local part may contain commas, the domain may not (RFC 2821) # - # Therefore, the first comma after the @ represents a new - # address, and is not listed in the header of the email. + # Therefore, the first comma after the @ represents a new address, + # and is not listed in the header of the email. # - # If `recepients` is not set, then messages will also be sent to the `CCC` addresses. + # If `recepients` is not set, then messages will also be sent to the + # `CCC` addresses. # # bcc = SMTP-BCC[*] # - # set_date:: Adds a Date: to the header, set to the time the request is received - # Formatted as "Fri, 07 Aug 2020 00:57:37 -0400, (EDT)" + # set_date:: Adds a Date: to the header, set to the time the request + # is received Formatted as "Fri, 07 Aug 2020 00:57:37 -0400, (EDT)" # May be one of: # # [options="header,autowidth"] @@ -320,17 +335,19 @@ smtp { # # header:: Additional headers to add to the messages. # - # Any `FROM`, `TO`, and `CC` should not be added here. They are set in the configuration items above. + # Any `FROM`, `TO`, and `CC` should not be added here. They are set + # in the configuration items above. # - # If no `DATE` header is provided, one will be added which - # shows the time that the request was sent. + # If no `DATE` header is provided, one will be added which shows the + # time that the request was sent. # # Non-standard mail headers may be set. Adhere to your MTA's # documentation # header { # - # Headers are added with the given names and values, in the order listed here. + # Headers are added with the given names and values, in the order + # listed here. # subject = "email subject" Message-ID = "950124.162336@example.com" @@ -338,12 +355,12 @@ smtp { } # - # connection { .. }:: Configure how connection handles are - # managed per thread. + # connection { .. }:: Configure how connection handles are managed + # per thread. # connection { # - # Reusable connection handles are allocated in blocks. These + # Reusable connection handles are allocated in blocks. These # parameters allow for tuning how that is done. # # Since http requests are performed async, the settings here @@ -352,29 +369,28 @@ smtp { reuse { # - # min:: The minimum number of connection handles to - # keep allocated. + # min:: The minimum number of connection handles to keep + # allocated. # min = 10 # - # max:: The maximum number of reusable connection handles - # to allocate. + # max:: The maximum number of reusable connection handles to + # allocate. # - # Any requests to allocate a connection handle beyond - # this number will cause a temporary handle to be allocated. - # This is less efficient than the block allocation so - # `max` should be set to reflect the number of outstanding - # requests expected at peak load. + # Any requests to allocate a connection handle beyond this number + # will cause a temporary handle to be allocated. This is less + # efficient than the block allocation so `max` should be set to + # reflect the number of outstanding requests expected at peak + # load. max = 100 # - # cleanup_interval:: How often to free un-used connection - # handles. + # cleanup_interval:: How often to free un-used connection handles. # - # Every `cleanup_interval` a cleanup routine runs which - # will free any blocks of handles which are not in use, - # ensuring that at least `min` handles are kept. + # Every `cleanup_interval` a cleanup routine runs which will free + # any blocks of handles which are not in use, ensuring that at + # least `min` handles are kept. # cleanup_interval = 30s diff --git a/raddb/mods-available/sometimes b/raddb/mods-available/sometimes index 80a23f01d36..bd34a2c3e8f 100644 --- a/raddb/mods-available/sometimes +++ b/raddb/mods-available/sometimes @@ -7,8 +7,8 @@ # # = Sometimes Module # -# The `sometimes` module is used for `debugging` purposes. Each instance -# randomly returns the configured result, or `noop`. +# The `sometimes` module is used for `debugging` purposes. Each +# instance randomly returns the configured result, or `noop`. # # NOTE: It is based on the `always` module. # diff --git a/raddb/mods-available/sql b/raddb/mods-available/sql index 270ef52f94c..536d4d8dbfa 100644 --- a/raddb/mods-available/sql +++ b/raddb/mods-available/sql @@ -28,10 +28,10 @@ # # For authorization queries, the default schema mirrors the # functionality of the `files` module, including check items and -# reply items. See the -# doc/antora/modules/reference/pages/raddb/mods-config/files/users.adoc file -# documentation for information on the format of the check items and -# reply items. +# reply items. See the +# doc/antora/modules/reference/pages/raddb/mods-config/files/users.adoc +# file documentation for information on the format of the check items +# and reply items. # # @@ -54,19 +54,18 @@ sql { dialect = "sqlite" # - # driver:: The sub-module to use to execute queries. It - # should usually match the `dialect` above. + # driver:: The sub-module to use to execute queries. It should + # usually match the `dialect` above. # # In some cases, the driver is different from the `dialect`. # - # The null driver can be used with any `dialect`, - # along with the `logfile` directive below. It will then - # write the SQL queries to a log file. + # The null driver can be used with any `dialect`, along with the + # `logfile` directive below. It will then write the SQL queries to a + # log file. # - # For MS-SQL, there are multiple driver options, as given in - # the table below. If the databases require syntax - # *different* from MS-SQL, please submit bug reports so that - # we can fix them, + # For MS-SQL, there are multiple driver options, as given in the + # table below. If the databases require syntax *different* from + # MS-SQL, please submit bug reports so that we can fix them, # # [options="header,autowidth"] # |=== @@ -80,14 +79,14 @@ sql { driver = "${dialect}" # - # Include driver specific configuration file if one - # exists. These are in a separate configuration file - # in mods-config/sql/driver/. + # Include driver specific configuration file if one exists. These + # are in a separate configuration file in + # mods-config/sql/driver/. # $-INCLUDE ${modconfdir}/sql/driver/${driver} # - # Connection information + # Connection information # ## server = "localhost" ## port = 3306 @@ -107,13 +106,15 @@ sql { # radius_db = "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=localhost)(PORT=1521))(CONNECT_DATA=(SID=your_sid)))" # - # If you're using `postgresql` this can also be used instead of the connection info parameters. + # If you're using `postgresql` this can also be used instead of the + # connection info parameters. # # radius_db = "dbname=radius host=localhost user=radius password=radpass" # - # NOTE: Postgreql doesn't take `tls{}` options in its module config like mysql does, - # if you want to use SSL connections then use this form of connection info parameter. + # NOTE: Postgreql doesn't take `tls{}` options in its module config + # like mysql does, if you want to use SSL connections then use this + # form of connection info parameter. # # radius_db = "host=localhost port=5432 dbname=radius user=radius password=raddpass sslmode=verify-full sslcert=/etc/ssl/client.crt sslkey=/etc/ssl/client.key sslrootcert=/etc/ssl/ca.crt" @@ -122,9 +123,9 @@ sql { # acct_table2:: Table for "stop" records # - # If you want both stop and start records logged to the same SQL table, leave this as is. - # If you want them in different tables, put the start table in `acct_table1` and stop - # table in `acct_table2`. + # If you want both stop and start records logged to the same SQL + # table, leave this as is. If you want them in different tables, put + # the start table in `acct_table1` and stop table in `acct_table2`. # acct_table1 = "radacct" acct_table2 = "radacct" @@ -162,24 +163,27 @@ sql { # # read_groups:: Read the groups from the database. # - # If set to `yes`, we read the group tables unless `Fall-Through = no` in the reply table. - # If set to `no`, we do not read the group tables unless `Fall-Through = yes` in the - # reply table. + # If set to `yes`, we read the group tables unless `Fall-Through = + # no` in the reply table. If set to `no`, we do not read the group + # tables unless `Fall-Through = yes` in the reply table. # # Default is `yes`. # # read_groups = yes # - # read_profiles:: Read the user profile attributes from the database. + # read_profiles:: Read the user profile attributes from the + # database. # - # Following `check` and `reply` item handling and, depending on the `read_groups` option - # and `Fall-Through` value, groups processing, the SQL module will treat values of the - # `User-Profile` attributes in the control list as additional groups that the user belongs - # to and repeat the group `check` and `reply` processing. + # Following `check` and `reply` item handling and, depending on the + # `read_groups` option and `Fall-Through` value, groups processing, + # the SQL module will treat values of the `User-Profile` attributes + # in the control list as additional groups that the user belongs to + # and repeat the group `check` and `reply` processing. # - # If set to `yes`, we process the user profiles unless `Fall-Through = no` in the reply list. - # If set to `no`, we do not process the user profiles unless `Fall-Through = yes` in the reply list. + # If set to `yes`, we process the user profiles unless `Fall-Through + # = no` in the reply list. If set to `no`, we do not process the + # user profiles unless `Fall-Through = yes` in the reply list. # # Default is `yes`. # read_profiles = yes @@ -187,27 +191,30 @@ sql { # # logfile:: Write SQL queries to a logfile. # - # This is potentially useful for tracing issues with authorization queries. - # See also `logfile` directives in `mods-config/sql/main/*/queries.conf`. - # You can enable per-section logging by enabling `logfile` there, or global logging by - # enabling `logfile` here. + # This is potentially useful for tracing issues with authorization + # queries. See also `logfile` directives in + # `mods-config/sql/main/*/queries.conf`. You can enable per-section + # logging by enabling `logfile` there, or global logging by enabling + # `logfile` here. # # Per-section logging can be disabled by setting "logfile = ''" # # logfile = ${logdir}/sqllog.sql # - # query_timeout:: Set the maximum query duration for `cassandra` and `unixodbc` + # query_timeout:: Set the maximum query duration for `cassandra` and + # `unixodbc` # # query_timeout = 5 # # pool { ... }:: # - # The connection pool is a set of per-thread parameters for connections to the SQL database. + # The connection pool is a set of per-thread parameters for + # connections to the SQL database. # - # If the driver supports it, then queries are run asynchronously. Currently the list of - # drivers this applies to is: + # If the driver supports it, then queries are run asynchronously. + # Currently the list of drivers this applies to is: # # * mysql # * postgresql @@ -215,8 +222,9 @@ sql { # * oracle # * cassandra # - # Other drivers are synchronous and therefore queries will block packet processing, resulting - # in significantly worse system performance. + # Other drivers are synchronous and therefore queries will block + # packet processing, resulting in significantly worse system + # performance. # pool { # @@ -235,17 +243,17 @@ sql { # # max:: Maximum number of connections. # - # If these connections are all in use and a new one - # is requested, the request will NOT get a connection. + # If these connections are all in use and a new one is requested, + # the request will NOT get a connection. # # Since the majority of SQL drivers only allow one outstanding # query per connection, this represents the maximum number of # simultaneous packets that a thread can process. # - # NOTE: The maximum number of connections from FreeRADIUS to - # the database will be this number multiplied by the number of - # worker threads. Ensure that the database server supports that - # number of connections. + # NOTE: The maximum number of connections from FreeRADIUS to the + # database will be this number multiplied by the number of worker + # threads. Ensure that the database server supports that number of + # connections. # max = 100 @@ -271,13 +279,15 @@ sql { # # open_delay:: Open delay (in seconds). # - # How long must we be above the target utilisation for connections to be opened. + # How long must we be above the target utilisation for connections + # to be opened. # open_delay = 0.2 # # close_delay:: Close delay (in seconds). # - # How long we must be below the target utilisation for connections to be closed + # How long we must be below the target utilisation for connections + # to be closed # # close_delay = 10 @@ -291,107 +301,124 @@ sql { # connection { # - # connect_timeout:: How long to wait - # before giving up on a connection which is - # being opened. + # connect_timeout:: How long to wait before giving up on a + # connection which is being opened. # connect_timeout = 3.0 # - # reconnect_delay:: If opening a connection - # fails, or an open connection fails, - # we wait `reconnect_delay` seconds before + # reconnect_delay:: If opening a connection fails, or an open + # connection fails, we wait `reconnect_delay` seconds before # attempting to open another connection. # reconnect_delay = 5 } # - # request:: Options specific to requests handled by this connection pool + # request:: Options specific to requests handled by this connection + # pool # - # NOTE: Due to the one outstanding query per connection limit, the settings - # `per_connection_max` and `per_connection_target` are forcibly set to 1 for - # SQL database connections. + # NOTE: Due to the one outstanding query per connection limit, the + # settings `per_connection_max` and `per_connection_target` are + # forcibly set to 1 for SQL database connections. # request { # - # free_delay:: How long must a request in the unassigned (free) list not have been - # used for before it's cleaned up and actually freed. + # free_delay:: How long must a request in the unassigned (free) + # list not have been used for before it's cleaned up and actually + # freed. # - # Unassigned requests can be re-used, multiple times, reducing memory allocation - # and freeing overheads. + # Unassigned requests can be re-used, multiple times, reducing + # memory allocation and freeing overheads. # # free_delay = 10 } } # - # group_attribute:: The group attribute specific to this instance of `rlm_sql`. + # group_attribute:: The group attribute specific to this instance of + # `rlm_sql`. # - # The "group_membership_query" is used to select which groups the user is a member of. + # The "group_membership_query" is used to select which groups the + # user is a member of. # - # The module loops over all groups, and places the group name into the "group_attribute". + # The module loops over all groups, and places the group name into + # the "group_attribute". # - # The group attribute is used in the "authorize_group_check_query" and "authorize_group_check_query" - # to select entries which match that particular group. + # The group attribute is used in the "authorize_group_check_query" + # and "authorize_group_check_query" to select entries which match + # that particular group. # - # After all groups in SQL have been run, the module looks for `control.User-Profile`, and runs - # those profiles for "authorize_group_check_query" and "authorize_group_check_query". i.e. a user - # profile is essentially a group. + # After all groups in SQL have been run, the module looks for + # `control.User-Profile`, and runs those profiles for + # "authorize_group_check_query" and "authorize_group_check_query". + # i.e. a user profile is essentially a group. # - # These group queries can also update `control.User-Profile`, which lets you have a group - # create a "fall through" to a DEFAULT group. However, these groups are _not_ cross-checked against - # each other. So it is possible to create loops, which is highly not recommended. + # These group queries can also update `control.User-Profile`, which + # lets you have a group create a "fall through" to a DEFAULT group. + # However, these groups are _not_ cross-checked against each other. + # So it is possible to create loops, which is highly not + # recommended. # - # If caching is enabled, then the module is done looping over groups, the module adds the names of - # groups to the `control` list. The "group_attribute" can then be used to check group membership. - # That check will be done internally, and will not result in a database lookup. This also means that - # it is now possible to do group comparisons based on regular expressions. + # If caching is enabled, then the module is done looping over + # groups, the module adds the names of groups to the `control` list. + # The "group_attribute" can then be used to check group membership. + # That check will be done internally, and will not result in a + # database lookup. This also means that it is now possible to do + # group comparisons based on regular expressions. # - # It is possible to force a dynamic group lookup via the expansion `%sql.group(foo)`. This - # expansion returns `true` if the user is a member of that SQL group, and `false` otherwise. + # It is possible to force a dynamic group lookup via the expansion + # `%sql.group(foo)`. This expansion returns `true` if the user is a + # member of that SQL group, and `false` otherwise. # - # NOTE: The `SQL-Group` attribute is only available after the SQL module has been run. + # NOTE: The `SQL-Group` attribute is only available after the SQL + # module has been run. # - # The name of the group attribute is automatically determined from the module name. By default, the - # name is `SQL-Group`. if the module is an instance such as `sql sql1 { ... }`, then the name of the - # group attribute is `SQL1-Group`. + # The name of the group attribute is automatically determined from + # the module name. By default, the name is `SQL-Group`. if the + # module is an instance such as `sql sql1 { ... }`, then the name of + # the group attribute is `SQL1-Group`. # group_attribute = "${.:instance}-Group" # # cache_groups:: whether or not we cache the list of SQL groups # - # The groups are cached in the `control` list. So any comparisons must be done as - # `control.SQL-Group = ...` + # The groups are cached in the `control` list. So any comparisons + # must be done as `control.SQL-Group = ...` # # Default is `no`. # # cache_groups = no # - # query_number_attribute:: An attribute to write the successful query number to. + # query_number_attribute:: An attribute to write the successful + # query number to. # - # When calling the `sql` module in a section such as `accounting` where there are a list of queries to - # try, and success is determined by a query modifying one or more records, this option can be used to - # record which query succeeded. + # When calling the `sql` module in a section such as `accounting` + # where there are a list of queries to try, and success is + # determined by a query modifying one or more records, this option + # can be used to record which query succeeded. # - # The attribute named here will be populated in the `control` list with the number of the query - # which succeeded. + # The attribute named here will be populated in the `control` list + # with the number of the query which succeeded. # - # If, as is the case with the default Interim-Update queries, the first query is an `UPDATE` and the - # second is an `INSERT`, this can be used to determine if calling the module resulted in a new record - # being written or an existing one being updated. I.e. if the `UPDATE` succeeds, the attribute will be - # populated with 1, whereas if the `INSERT` succeeds, the attribute will be populated with 2. + # If, as is the case with the default Interim-Update queries, the + # first query is an `UPDATE` and the second is an `INSERT`, this can + # be used to determine if calling the module resulted in a new + # record being written or an existing one being updated. I.e. if the + # `UPDATE` succeeds, the attribute will be populated with 1, whereas + # if the `INSERT` succeeds, the attribute will be populated with 2. # # query_number_attribute = 'Query-Number' # # Database-specific queries. # - # Not all drivers ship with `query.conf` or `schema.sql` files. For those which don't, - # please create them and contribute them back to the project. + # Not all drivers ship with `query.conf` or `schema.sql` files. For + # those which don't, please create them and contribute them back to + # the project. # $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf } diff --git a/raddb/mods-available/sqlcounter b/raddb/mods-available/sqlcounter index 1282e0dc0d5..2b6af5d9e84 100644 --- a/raddb/mods-available/sqlcounter +++ b/raddb/mods-available/sqlcounter @@ -7,20 +7,22 @@ # # = SQL Counter Module # -# The `sqlcounter` module provides a general framework to allow access -# based on accumulated usage of a resource, such as total time online in -# a given period, total data transferred in a given period, etc. This is -# very useful in a _Prepaid Service_ situation, where a user has paid for -# a finite amount of usage and should not be allowed to use more than -# that service. Collection, monitoring, and replenishment of prepaid -# services are beyond the scope of this module. +# The `sqlcounter` module provides a general framework to allow +# access based on accumulated usage of a resource, such as total time +# online in a given period, total data transferred in a given period, +# etc. This is very useful in a _Prepaid Service_ situation, where a +# user has paid for a finite amount of usage and should not be +# allowed to use more than that service. Collection, monitoring, and +# replenishment of prepaid services are beyond the scope of this +# module. # -# Rather than maintaining separate (`GDBM`) databases of accounting info -# for each counter, this module uses the data stored in the `radacct` table -# by the `sql` modules. +# Rather than maintaining separate (`GDBM`) databases of accounting +# info for each counter, this module uses the data stored in the +# `radacct` table by the `sql` modules. # -# NOTE: This module *NEVER* does any database INSERTs or UPDATEs. It is totally -# dependent on the SQL module to process `Accounting` packets. +# NOTE: This module *NEVER* does any database INSERTs or UPDATEs. It +# is totally dependent on the SQL module to process `Accounting` +# packets. # # @@ -32,12 +34,12 @@ # sqlcounter { # ``` # -# sql_module_instance:: Holds the instance of the `sql` module to use when -# querying the SQL database. +# sql_module_instance:: Holds the instance of the `sql` module to use +# when querying the SQL database. # -# NOTE: Normally it is just `sql`. If you define more and one SQL module instance -# (usually for failover situations), you can specify which module has access to -# the Accounting Data (`radacct table`). +# NOTE: Normally it is just `sql`. If you define more and one SQL +# module instance (usually for failover situations), you can specify +# which module has access to the Accounting Data (`radacct table`). # # ``` # sql_module_instance = sql_foo @@ -68,55 +70,63 @@ # # reset = 12h # -# key:: Specifies the unique identifier for the counter records (usually `User-Name`). +# key:: Specifies the unique identifier for the counter records +# (usually `User-Name`). # -# The `query` parameter specifies the SQL query used to get the current Counter value -# from the database. +# The `query` parameter specifies the SQL query used to get the +# current Counter value from the database. # # ``` # key = "%{Stripped-User-Name || User-Name}" # ``` # -# reset_period_start_name:: The name of the attribute which is used to store the -# time that the current reset period started. +# reset_period_start_name:: The name of the attribute which is used +# to store the time that the current reset period started. # # The default is `control.${.:instance}-Reset-Start` # -# Note because we are counting seconds, this attribute is of type `uint64`, and not `date`. +# Note because we are counting seconds, this attribute is of type +# `uint64`, and not `date`. # -# reset_period_end_name:: The name of the attribute which is used to store the -# time that the current reset period will end. +# reset_period_end_name:: The name of the attribute which is used to +# store the time that the current reset period will end. # # The default is `control.${.:instance}-Reset-End` # -# Note because we are counting seconds, this attribute is of type `uint64`, and not `date`. +# Note because we are counting seconds, this attribute is of type +# `uint64`, and not `date`. # -# counter_name:: Name of the attribute to add to the `control` list with the current -# value of the counter. +# counter_name:: Name of the attribute to add to the `control` list +# with the current value of the counter. # -# After the sqlcounter module has run, the counter attribute will exist. +# After the sqlcounter module has run, the counter attribute will +# exist. # # if (control.Daily-Session-Time > 3600) { # Reply-Message := "You've used up more than one hour today" # reject # } # -# check_name:: Name of the attribute containing the limit to compare the counter to. +# check_name:: Name of the attribute containing the limit to compare +# the counter to. # -# reply_name:: Name of the attribute to populate with the remaining session time. -# e.g. `reply.Session-Timeout`. If the attribute already exists and contains -# a lower value, then it will not be updated. +# reply_name:: Name of the attribute to populate with the remaining +# session time. e.g. `reply.Session-Timeout`. If the attribute +# already exists and contains a lower value, then it will not be +# updated. # -# reply_message_name:: Name of the attribute into which a message should be placed -# if the limit has been exceeded for the counter. +# reply_message_name:: Name of the attribute into which a message +# should be placed if the limit has been exceeded for the counter. # -# auto_extend:: If set to `yes` and the remaining session time goes past the time for -# the next counter reset, the value in the `reply_name` attribute will be set to -# the time to the next reset plus the value of the `check_name` attribute. -# This is most useful if the limit is a time based one, and, for example, -# `Session-Timeout` is the `reply_name` attribute. If there is sufficient allocation -# left for the session to get to the next counter period, the user will not have -# to re-authenticate before they have used their allocation for the next counter period. +# auto_extend:: If set to `yes` and the remaining session time goes +# past the time for the next counter reset, the value in the +# `reply_name` attribute will be set to the time to the next reset +# plus the value of the `check_name` attribute. This is most useful +# if the limit is a time based one, and, for example, +# `Session-Timeout` is the `reply_name` attribute. If there is +# sufficient allocation left for the session to get to the next +# counter period, the user will not have to re-authenticate before +# they have used their allocation for the next counter period. # # utc:: Use UTC for calculating the period start and end values. @@ -182,10 +192,11 @@ sqlcounter noresetcounter { # # === Expire on login # -# Set an account to expire T seconds after first login. Requires the `Expire-After` -# attribute to be set, in seconds. +# Set an account to expire T seconds after first login. Requires the +# `Expire-After` attribute to be set, in seconds. # -# NOTE: You may need to edit `dictionary` to add the `Expire-After` attribute. +# NOTE: You may need to edit `dictionary` to add the `Expire-After` +# attribute. # sqlcounter expire_on_login { sql_module_instance = sql diff --git a/raddb/mods-available/sqlippool b/raddb/mods-available/sqlippool index 428e30c204c..c10a95108f7 100644 --- a/raddb/mods-available/sqlippool +++ b/raddb/mods-available/sqlippool @@ -7,24 +7,27 @@ # # = SQL-IP-Pool Module # -# The module `sqlippool` provide configuration for the SQL based IP Pool module. +# The module `sqlippool` provide configuration for the SQL based IP +# Pool module. # -# NOTE: The database schemas are available at `sql/ippool//schema.sql`. +# NOTE: The database schemas are available at +# `sql/ippool//schema.sql`. # # == Configuration Settings # sqlippool { # - # sql_module_instance:: SQL instance to use (from `mods-available/sql`) + # sql_module_instance:: SQL instance to use (from + # `mods-available/sql`) # - # If you have multiple sql instances, such as `sql sql1 {...}`, - # use the *instance* name here: `sql1`. + # If you have multiple sql instances, such as `sql sql1 {...}`, use + # the *instance* name here: `sql1`. # sql_module_instance = "sql" # - # dialect:: This is duplicative of info available in the SQL module, but - # we have to list it here as we do not yet support nested + # dialect:: This is duplicative of info available in the SQL module, + # but we have to list it here as we do not yet support nested # reference expansions. # dialect = "mysql" @@ -50,11 +53,13 @@ sqlippool { pool_name = control.IP-Pool.Name # - # allocated_address_attr:: List and attribute where the allocated address is written to. + # allocated_address_attr:: List and attribute where the allocated + # address is written to. # # [NOTE] # ==== - # It MUST be a qualified name of an attribute of a type which contains IP addresses. + # It MUST be a qualified name of an attribute of a type which + # contains IP addresses. # # e.g. `ipaddr`, `ipv4prefix,` `ipv6addr`, or `ipv6prefix`. # ==== @@ -67,10 +72,10 @@ sqlippool { # IP address) to be applied, the owner specified in the incoming # packet must match the owner recorded for the lease. # - # For purposes such as IP assignment using a RADIUS Framed-IP-Address - # attribute the "owner" identifier could be a `User-Name` or a - # certificate serial number provided that the number of sessions is - # limited to one per user/serial. + # For purposes such as IP assignment using a RADIUS + # Framed-IP-Address attribute the "owner" identifier could be a + # `User-Name` or a certificate serial number provided that the + # number of sessions is limited to one per user/serial. # # For RADIUS the owner will likely be specified by: # @@ -95,20 +100,21 @@ sqlippool { # # On a hostile network the owner SHOULD include a component that you # trust, arranged such that the overall value cannot be spoofed by - # manipulation of the user-controlled data (i.e. the mac or identifier) - # provided by the user's device. + # manipulation of the user-controlled data (i.e. the mac or + # identifier) provided by the user's device. # - # For example it might be that the value `Vendor-Specific.ADSL-Forum.Agent-Circuit-ID` is - # considered trusted as it's set by a controlled device at the edge of - # the network. Calling-Station-Id however, is usually provided by - # the user's device so may be spoofed. + # For example it might be that the value + # `Vendor-Specific.ADSL-Forum.Agent-Circuit-ID` is considered + # trusted as it's set by a controlled device at the edge of the + # network. Calling-Station-Id however, is usually provided by the + # user's device so may be spoofed. # # In order to prevent an attacker releasing DHCP leases for another # device on the network, the owner string should be constructed so # that it contains both the trusted and untrusted attributes, or if # the trusted attribute is sufficiently stable and unique, only the - # trusted attribute. - # One example would be `%{Vendor-Specific.ADSL-Forum.Agent-Circuit-ID}.%{Calling-Station-Id}`.` + # trusted attribute. One example would be + # `%{Vendor-Specific.ADSL-Forum.Agent-Circuit-ID}.%{Calling-Station-Id}`.` # owner = "%{Calling-Station-ID}" @@ -119,7 +125,8 @@ sqlippool { # # requested_address:: The IP address being renewed or released. # - # For RADIUS the requested_address will almost always be `%{Framed-IP-Address}`. + # For RADIUS the requested_address will almost always be + # `%{Framed-IP-Address}`. # # For DHCPv4 the requested_address will almost always be # `%{Requested-IP-Address || Client-IP-Address}`. @@ -134,11 +141,11 @@ sqlippool { # # For RADIUS, this device is recorded so that if an Accounting-On or # Accounting-Off packet is received, then all leases associated with - # the gateway can be released. 'gateway' in this context is synonymous - # with the NAS the user is connected to. + # the gateway can be released. 'gateway' in this context is + # synonymous with the NAS the user is connected to. # - # For DHCPv4, this device is recorded so that we can respond correctly - # to lease queries. + # For DHCPv4, this device is recorded so that we can respond + # correctly to lease queries. # gateway = "%{NAS-Identifier || NAS-IP-Address}" diff --git a/raddb/mods-available/stats b/raddb/mods-available/stats index fcad6ba0396..6c120ed6ad6 100644 --- a/raddb/mods-available/stats +++ b/raddb/mods-available/stats @@ -17,8 +17,8 @@ # When listed in a `recv Status-Server` section, it will add global # server statistics to the packet. # -# See `dictionary.freeradius`, and the `FreeRADIUS-Stats4` attributes, -# for a list of which attributes it adds. +# See `dictionary.freeradius`, and the `FreeRADIUS-Stats4` +# attributes, for a list of which attributes it adds. # # diff --git a/raddb/mods-available/tacacs b/raddb/mods-available/tacacs index 6cd87580ac9..623c0d60922 100644 --- a/raddb/mods-available/tacacs +++ b/raddb/mods-available/tacacs @@ -34,7 +34,8 @@ tacacs { transport = tcp # - # max_attributes:: Maximum number of attributes to decode in response. + # max_attributes:: Maximum number of attributes to decode in + # response. # # Default is 255. # @@ -44,13 +45,13 @@ tacacs { # type:: List of allowed packet types. # # There is currently no way to change the packet type in the - # request. See `unlang` fork for that functionality. + # request. See `unlang` fork for that functionality. # type = Accounting-Request # - # response_window:: If we do not receive a reply within this time period, then - # start `zombie_period` + # response_window:: If we do not receive a reply within this time + # period, then start `zombie_period` # response_window = 15 @@ -58,46 +59,45 @@ tacacs { # zombie_period:: If the home server does not reply to a packet, the # `zombie_period` starts. # - # The connection is marked `zombie`, and isn't used to send new packets. - # If there are no responses within `zombie_period`, the server either - # closes the connection (no `status_check` subsection), or starts pinging the - # home server (`status_check.type = Status-Server`). + # The connection is marked `zombie`, and isn't used to send new + # packets. If there are no responses within `zombie_period`, the + # server either closes the connection (no `status_check` + # subsection), or starts pinging the home server (`status_check.type + # = Status-Server`). # zombie_period = 10 # - # revive_interval:: If there are no status checks, mark the - # home server alive after `revive_interval` timeout. + # revive_interval:: If there are no status checks, mark the home + # server alive after `revive_interval` timeout. # # Some home servers do not support status checks via the - # `Status-Server` packet. Others may not have a "test" user - # configured that can be used to query the server, to see if - # it is alive. For those servers, we have NO WAY of knowing - # when it becomes alive again. Therefore, after the server - # has been marked dead, we wait a period of time, and mark - # it alive again, in the hope that it has come back to - # life. + # `Status-Server` packet. Others may not have a "test" user + # configured that can be used to query the server, to see if it is + # alive. For those servers, we have NO WAY of knowing when it + # becomes alive again. Therefore, after the server has been marked + # dead, we wait a period of time, and mark it alive again, in the + # hope that it has come back to life. # - # If it has NOT come back to life, then the module will wait - # for `zombie_period` before marking it dead again. During - # the `zombie_period`, ALL AUTHENTICATIONS WILL FAIL, because - # the home server is still dead. There is NOTHING that can - # be done about this, other than to enable the status checks, - # as documented above. + # If it has NOT come back to life, then the module will wait for + # `zombie_period` before marking it dead again. During the + # `zombie_period`, ALL AUTHENTICATIONS WILL FAIL, because the home + # server is still dead. There is NOTHING that can be done about + # this, other than to enable the status checks, as documented above. # - # e.g. if `zombie_period` is 40 seconds, and `revive_interval` - # is 300 seconds, the for 40 seconds out of every 340, or about - # 10% of the time, all authentications will fail. + # e.g. if `zombie_period` is 40 seconds, and `revive_interval` is + # 300 seconds, the for 40 seconds out of every 340, or about 10% of + # the time, all authentications will fail. # - # If the `zombie_period` and `revive_interval` configurations - # are set smaller, than it is possible for up to 50% of - # authentications to fail. + # If the `zombie_period` and `revive_interval` configurations are + # set smaller, than it is possible for up to 50% of authentications + # to fail. # - # As a result, we recommend enabling status checks, and - # we do NOT recommend using `revive_interval`. + # As a result, we recommend enabling status checks, and we do NOT + # recommend using `revive_interval`. # # The `revive_interval` configuration is used ONLY if the - # `status_check` subsection is not used. Otherwise, + # `status_check` subsection is not used. Otherwise, # `revive_interval` is not necessary, and should be deleted. # # Useful range of values: 10 to 3600 @@ -107,23 +107,23 @@ tacacs { # # == Connection trunking # - # Each worker thread (see tacacsd.conf, num_workers), has - # it's own set of connections. These connections are grouped - # together into a "pool". + # Each worker thread (see tacacsd.conf, num_workers), has it's own + # set of connections. These connections are grouped together into a + # "pool". # - # Much of the configuration here is similar to the old - # connection "pool" configuration in v3. However, there are - # more configuration parameters, and therefore more control - # over the behavior. + # Much of the configuration here is similar to the old connection + # "pool" configuration in v3. However, there are more configuration + # parameters, and therefore more control over the behavior. # pool { # # start:: Connections to create during module instantiation. # - # If the server cannot create specified number of connections during instantiation - # it will exit. + # If the server cannot create specified number of connections + # during instantiation it will exit. # - # Set to `0` to allow the server to start without the database being available. + # Set to `0` to allow the server to start without the database + # being available. # start = 0 @@ -135,68 +135,61 @@ tacacs { # # max:: Maximum number of connections. # - # If these connections are all in use and a new one is requested, the request - # will NOT get a connection. + # If these connections are all in use and a new one is requested, + # the request will NOT get a connection. # max = 8 # - # connecting:: Maximum number of sockets to have in the "connecting" state. + # connecting:: Maximum number of sockets to have in the + # "connecting" state. # - # If a home server goes down, the module will close - # old / broken connections, and try to open new ones. - # In order to avoid flooding the home server with - # connection attempts, set the `connecting` value to - # a small number. + # If a home server goes down, the module will close old / broken + # connections, and try to open new ones. In order to avoid flooding + # the home server with connection attempts, set the `connecting` + # value to a small number. # connecting = 1 # # uses:: number of packets which will use the connection. # - # After `uses` packets have been sent the connection - # will be closed, and a new one opened. For no - # limits, set `uses = 0`. + # After `uses` packets have been sent the connection will be + # closed, and a new one opened. For no limits, set `uses = 0`. # uses = 0 # # lifetime:: lifetime of a connection, in seconds. # - # After `lifetime` seconds have passed, no new - # packets will be sent on the connection. When all - # replies have been received, the connection will be - # closed. + # After `lifetime` seconds have passed, no new packets will be sent + # on the connection. When all replies have been received, the + # connection will be closed. # # For no limits, set `lifetime = 0`. # - # It is possible to use precise times, such as - # `lifetime = 1.023`, or even qualifiers such as - # `lifetime = 400ms`. + # It is possible to use precise times, such as `lifetime = 1.023`, + # or even qualifiers such as `lifetime = 400ms`. # lifetime = 0 # - # open_delay:: How long (in seconds) a connection - # must be above `per_connection_target` before a new - # connection is opened. + # open_delay:: How long (in seconds) a connection must be above + # `per_connection_target` before a new connection is opened. # - # Parsing of this field is the same as for - # `lifetime`. + # Parsing of this field is the same as for `lifetime`. # open_delay = 0.2 # - # close_delay:: How long (in seconds) a connection - # must be below `per_connection_target` before a - # connection is closed. + # close_delay:: How long (in seconds) a connection must be below + # `per_connection_target` before a connection is closed. # close_delay = 1.0 # - # manage_interval:: How often (in seconds) the - # connections are checked for limits, in order to - # open / close connections. + # manage_interval:: How often (in seconds) the connections are + # checked for limits, in order to open / close connections. # manage_interval = 0.2 @@ -205,18 +198,15 @@ tacacs { # connection { # - # connect_timeout:: How long to wait - # before giving up on a connection which is - # being opened. + # connect_timeout:: How long to wait before giving up on a + # connection which is being opened. # connect_timeout = 3.0 # - # reconnect_delay:: If opening a connection - # fails, or an open connection fails, - # we wait `reconnect_delay` seconds before - # attempting to open another - # connection. + # reconnect_delay:: If opening a connection fails, or an open + # connection fails, we wait `reconnect_delay` seconds before + # attempting to open another connection. # reconnect_delay = 5 } @@ -226,27 +216,24 @@ tacacs { # request { # - # per_connection_max:: The maximum number of requests - # which are "live" on a particular connection. + # per_connection_max:: The maximum number of requests which are + # "live" on a particular connection. # per_connection_max = 255 # - # per_connection_target:: The target number - # of requests which are "live" on a - # particular connection. + # per_connection_target:: The target number of requests which are + # "live" on a particular connection. # - # There can be a balance between overloading - # a connection, and under-utilizing it. The - # default is to fill each connection before - # opening a new one. + # There can be a balance between overloading a connection, and + # under-utilizing it. The default is to fill each connection + # before opening a new one. # per_connection_target = 255 # - # free_delay:: How long to wait before - # freeing internal resources associated with - # the connection. + # free_delay:: How long to wait before freeing internal resources + # associated with the connection. # free_delay = 10 } @@ -275,7 +262,8 @@ tacacs { # interface = eth0 # - # max_packet_size:: Our max packet size. may be different from the parent. + # max_packet_size:: Our max packet size. may be different from the + # parent. # # max_packet_size = 4096 diff --git a/raddb/mods-available/totp b/raddb/mods-available/totp index dcf770522e9..ac8a65afc0b 100644 --- a/raddb/mods-available/totp +++ b/raddb/mods-available/totp @@ -6,7 +6,8 @@ # # = Time-based One-Time Passwords (TOTP) # -# Defined in `RFC6238`, and used in Google Authenticator, among others. +# Defined in `RFC6238`, and used in Google Authenticator, among +# others. # # This module can only be used in the "authenticate" section. # @@ -18,16 +19,18 @@ # # `control.TOTP.Key` # -# If `TOTP.Key` exists, then it will be used instead of `TOTP.Secret`. +# If `TOTP.Key` exists, then it will be used instead of +# `TOTP.Secret`. # # The TOTP password entered by the user should be placed into: # # `request.TOTP.From-User` # -# The module will return `ok` if the passwords match, and `fail` -# if the passwords do not match. +# The module will return `ok` if the passwords match, and `fail` if +# the passwords do not match. # -# NOTE: The crypto algorithms are HmacSHA1, HmacSHA256 and HmacSHA512. +# NOTE: The crypto algorithms are HmacSHA1, HmacSHA256 and +# HmacSHA512. # # NOTE: This module will *NOT* interact with Google. The module is # intended to be used where the local administrator knows the TOTP @@ -62,12 +65,14 @@ totp { otp_length = 6 # - # lookback_steps:: How many steps backward in time we look for a matching OTP. + # lookback_steps:: How many steps backward in time we look for a + # matching OTP. # lookback_steps = 1 # - # lookforward_steps:: How many steps forward in time we look for a matching OTP. + # lookforward_steps:: How many steps forward in time we look for a + # matching OTP. # lookforward_steps = 0 @@ -81,9 +86,9 @@ totp { # # time_offset:: A time offset to use from the current time. # - # Some tokens get severely out of sync with local time. It is - # possible to offset the definition of "now" for one token by setting - # this to an attribute containing the offset. + # Some tokens get severely out of sync with local time. It is + # possible to offset the definition of "now" for one token by + # setting this to an attribute containing the offset. # # time_offset = 0 } diff --git a/raddb/mods-available/unbound b/raddb/mods-available/unbound index 7fdd4161364..cfcfbd55d0a 100644 --- a/raddb/mods-available/unbound +++ b/raddb/mods-available/unbound @@ -7,22 +7,23 @@ # # = Unbound Module # -# The `unbound` module performs queries against a DNS service to allow -# FQDNs to be resolved during request processing. +# The `unbound` module performs queries against a DNS service to +# allow FQDNs to be resolved during request processing. # # The module is primarily intended for use by other modules through # internal APIs, and so, instances should be initialized earlier than -# those modules which use them. Each instance does also provide some +# those modules which use them. Each instance does also provide some # functions for general use and for troubleshooting. # # == Caveats # -# There is a potential for a FreeRADIUS server using rlm_unbound to either -# fail to terminate cleanly (leaving zombie processes, failing to clean up -# other modules, and hanging after a SIGTERM until a SIGKILL is sent) or -# to fail valgrind checks during termination when run with -m. Likewise this -# problem will rely on upstream enhancements before it can be fixed, and the -# exact behavior may change in interim releases of libunbound until then. +# There is a potential for a FreeRADIUS server using rlm_unbound to +# either fail to terminate cleanly (leaving zombie processes, failing +# to clean up other modules, and hanging after a SIGTERM until a +# SIGKILL is sent) or to fail valgrind checks during termination when +# run with -m. Likewise this problem will rely on upstream +# enhancements before it can be fixed, and the exact behavior may +# change in interim releases of libunbound until then. # # @@ -45,9 +46,9 @@ unbound dns { # # Defaults to not set. # - # Without this set, unbound will query the root DNS servers. - # This is NOT RECOMMENDED. A local caching DNS server will - # substantially improve performance. + # Without this set, unbound will query the root DNS servers. This is + # NOT RECOMMENDED. A local caching DNS server will substantially + # improve performance. # # resolvconf = "/etc/resolv.conf" @@ -62,7 +63,8 @@ unbound dns { # # == Functions for DNS resolution # -# A function based on the instance name can be used to perform DNS lookups. +# A function based on the instance name can be used to perform DNS +# lookups. # # %dns(, [, ]) # @@ -75,8 +77,8 @@ unbound dns { # %dns('www.example.com', 'AAAA') # ``` # -# Given an instance `dns` the above function will perform `A` record and -# `AAAA` record lookups on `www.example.com`. +# Given an instance `dns` the above function will perform `A` record +# and `AAAA` record lookups on `www.example.com`. # # .Example # @@ -95,6 +97,6 @@ unbound dns { # The above example will perform an `MX` lookup on `example.com`, and # will return just the first result. # -# NOTE: The DNS queries are blocking! A slow (or unavailable) DNS +# NOTE: The DNS queries are blocking! A slow (or unavailable) DNS # server can completely destroy the performance of FreeRADIUS. # diff --git a/raddb/mods-available/unix b/raddb/mods-available/unix index 022b5dedd67..3fd6f8285ce 100644 --- a/raddb/mods-available/unix +++ b/raddb/mods-available/unix @@ -16,27 +16,30 @@ # # Look for "shadow", and follow the instructions there. # -# NOTE: This password is usually in the `crypt` form, and is incompatible -# with `CHAP`, `MS-CHAP`, `PEAP`, etc*. +# NOTE: This password is usually in the `crypt` form, and is +# incompatible with `CHAP`, `MS-CHAP`, `PEAP`, etc*. # # == Group Comparisons # -# The module also registers a Unix group expansion, where it is possible -# to check if the user is a member of a particular Unix group. +# The module also registers a Unix group expansion, where it is +# possible to check if the user is a member of a particular Unix +# group. # # ``` # if (%unix.group(admin)) { ... # ``` # -# The expansion returns `true` if the `User-Name` is a membber of the given -# group, and `false` otherwise. +# The expansion returns `true` if the `User-Name` is a membber of the +# given group, and `false` otherwise. # -# The old `Unix-Group`, `Group`, and `Group-Name` attributes and comparisons -# are no longer supported. +# The old `Unix-Group`, `Group`, and `Group-Name` attributes and +# comparisons are no longer supported. # -# All of `radutmp`, `radwho`, `radlast`, and `radzap` have been removed. +# All of `radutmp`, `radwho`, `radlast`, and `radzap` have been +# removed. # -# You can no longer have the `unix` module process accounting packets. +# You can no longer have the `unix` module process accounting +# packets. # # diff --git a/raddb/mods-available/unpack b/raddb/mods-available/unpack index 632353b1e2a..c8b7ec88660 100644 --- a/raddb/mods-available/unpack +++ b/raddb/mods-available/unpack @@ -10,8 +10,8 @@ # The `unpack` module unpacks binary data from octets type attributes # into individual attributes. # -# It is used when vendors put multiple fields into one attribute -# of type "octets". +# It is used when vendors put multiple fields into one attribute of +# type "octets". # # NOTE: The module is useful only for `xlat`. # @@ -19,33 +19,34 @@ # # == Syntax # -# To use it, add it to the `mods-enabled/` directory. Then, -# use it on the right-hand side of a variable assignment. +# To use it, add it to the `mods-enabled/` directory. Then, use it on +# the right-hand side of a variable assignment. # -# %unpack(, , [, ]) +# %unpack(, , [, ]) # # The arguments are three or four fields: # # data:: # -# Either `octets` or `string` type data, literal or expanded attributes. -# If `string` type data contains a representation of hex data, e.g. 0xabcdef -# that is first converted to `octets`. +# Either `octets` or `string` type data, literal or expanded +# attributes. If `string` type data contains a representation of hex +# data, e.g. 0xabcdef that is first converted to `octets`. # # offset:: # -# The offset into the string from which it starts unpacking. The offset starts -# at zero, for the first attribute. +# The offset into the string from which it starts unpacking. The +# offset starts at zero, for the first attribute. # # data_type:: # -# the data type to unpack at that offset. e.g. `integer`, `ipaddr`, `byte`, `short`, etc. +# the data type to unpack at that offset. e.g. `integer`, `ipaddr`, +# `byte`, `short`, etc. # # repeat:: # -# How many instances of the data type should be unpacked. This optional argument -# must either be an integer or the special value of `'*'` to extract as many instances -# as can be from the input data. +# How many instances of the data type should be unpacked. This +# optional argument must either be an integer or the special value of +# `'*'` to extract as many instances as can be from the input data. # # == Sample @@ -54,7 +55,8 @@ # # %unpack(%{Class}, 4, uint16) # -# will unpack octets `4` and `5` as a `uint16`, which has value `0x0304`. +# will unpack octets `4` and `5` as a `uint16`, which has value +# `0x0304`. # # diff --git a/raddb/mods-available/utf8 b/raddb/mods-available/utf8 index 54d309bd1a2..418a4032829 100644 --- a/raddb/mods-available/utf8 +++ b/raddb/mods-available/utf8 @@ -12,11 +12,11 @@ # An attribute of type "string" containing UTF-8 makes the module # return `NOOP`. # -# An attribute of type "string" containing non-UTF-8 data makes -# the module return `FAIL`. +# An attribute of type "string" containing non-UTF-8 data makes the +# module return `FAIL`. # # The module can be used as a simple check for non-conforming -# packets. If the contents of the Access-Request packets are not +# packets. If the contents of the Access-Request packets are not # UTF-8, it's likely best to just reject the request. # diff --git a/raddb/mods-available/wimax b/raddb/mods-available/wimax index bdfc7446083..7291f9dfdd0 100644 --- a/raddb/mods-available/wimax +++ b/raddb/mods-available/wimax @@ -10,7 +10,8 @@ # The `wimax` module implements the WiMAX attributes as defined in # NWG_R1_V1.2.1-Stage-3.pdf # -# It should be listed in the `recv Access-Request` and `recv Accounting-Request` sections. +# It should be listed in the `recv Access-Request` and `recv +# Accounting-Request` sections. # # NOTE: The module will change the horrible binary version of # `Calling-Station-Id` to the normal format, as specified in RFC @@ -21,12 +22,11 @@ # In the `recv Access-Request section. the `wimax` module fixes up # various non-standard WiMAX issues. # -# The WiMAX specification says that the `Calling-Station-Id` -# is 6 octets of the MAC. This definition conflicts with RFC -# 3580, and all common RADIUS practices. Uncommenting the -# `wimax` module here allows the module to change the -# `Calling-Station-Id` attribute to the normal format as -# specified in RFC 3580 Section 3.21. +# The WiMAX specification says that the `Calling-Station-Id` is 6 +# octets of the MAC. This definition conflicts with RFC 3580, and all +# common RADIUS practices. Uncommenting the `wimax` module here +# allows the module to change the `Calling-Station-Id` attribute to +# the normal format as specified in RFC 3580 Section 3.21. # # ``` # recv Access-Request { @@ -38,10 +38,10 @@ # # == send Access-Accept # -# In order to calculate the various WiMAX keys, the module should -# be listed in the `send Access-Accept` section. If EAP authentication -# has been used, AND the EAP method derives MSK and EMSK, then -# the various WiMAX keys can be calculated. +# In order to calculate the various WiMAX keys, the module should be +# listed in the `send Access-Accept` section. If EAP authentication +# has been used, AND the EAP method derives MSK and EMSK, then the +# various WiMAX keys can be calculated. # # ``` # send Access-Accept { @@ -97,17 +97,18 @@ # # MN-NAI:: Mobile node NAI. # -# You have to create it, and put it into the request or reply as something like: +# You have to create it, and put it into the request or reply as +# something like: # # ``` # WiMAX-MN-NAI = User-Name # ``` # -# You will also have to have the appropriate IP address (`v4` or `v6`) -# in order to calculate the keys below. +# You will also have to have the appropriate IP address (`v4` or +# `v6`) in order to calculate the keys below. # -# Lifetimes are derived from `Session-Timeout`. It needs to be set -# to some useful number. +# Lifetimes are derived from `Session-Timeout`. It needs to be set to +# some useful number. # # NOTE: The hash function below `H()` is `HMAC-SHA1`. # @@ -132,28 +133,30 @@ # # Both with similar comments to above for `MN-HA-CMIP4`. # -# In order to tell which one to use (`CMIP4`, `PMIP4`, or `CMIP6`), you have to -# set `WiMAX-IP-Technology` in the reply to one of the appropriate values. +# In order to tell which one to use (`CMIP4`, `PMIP4`, or `CMIP6`), +# you have to set `WiMAX-IP-Technology` in the reply to one of the +# appropriate values. # # FA-RK = H(MIP-RK, "FA-RK") # MN-FA = H(FA-RK, "MN FA" | FA-IP | MN-NAI) # -# Where does the `FA-IP` come from? No idea... +# Where does the `FA-IP` come from? No idea... # -# The next two keys (`HA-RK` and `FA-HA`) are not generated for every authentication -# request, but only on demand. +# The next two keys (`HA-RK` and `FA-HA`) are not generated for every +# authentication request, but only on demand. # -# `HA-RK` = 160-bit random number assigned by the AAA server to a specific HA. +# `HA-RK` = 160-bit random number assigned by the AAA server to a +# specific HA. # # `FA-HA` = H(HA-RK, "FA-HA" | HA-IPv4 | FA-CoAv4 | SPI) # # where `HA-IPv4` is as above. # -# and `FA-CoAv4` address of the `FA` as seen by the `HA` -# and `SPI` is the relevant `SPI` for the `HA-RK`. +# and `FA-CoAv4` address of the `FA` as seen by the `HA` and `SPI` is +# the relevant `SPI` for the `HA-RK`. # -# `DHCP-RK` = 160-bit random number assigned by the AAA server to a specific DHCP server. -# `vDHCP-RK` is the same thing. +# `DHCP-RK` = 160-bit random number assigned by the AAA server to a +# specific DHCP server. `vDHCP-RK` is the same thing. # # @@ -163,23 +166,23 @@ wimax { # # delete_mppe_keys:: # - # Some WiMAX equipment requires that the `MS-MPPE-*-Key` - # attributes are sent in the Access-Accept, in addition to - # the `WiMAX-MSK` attribute. + # Some WiMAX equipment requires that the `MS-MPPE-*-Key` attributes + # are sent in the Access-Accept, in addition to the `WiMAX-MSK` + # attribute. # - # Other WiMAX equipment request that the `MS-MPPE-*-Key` - # attributes are NOT sent in the `Access-Accept`. + # Other WiMAX equipment request that the `MS-MPPE-*-Key` attributes + # are NOT sent in the `Access-Accept`. # # By default, the EAP modules sends `MS-MPPE-*-Key` attributes. # - # The default virtual server (`sites-available/default`) - # contains examples of adding the `WiMAX-MSK`. + # The default virtual server (`sites-available/default`) contains + # examples of adding the `WiMAX-MSK`. # - # This configuration option makes the WiMAX module delete - # the `MS-MPPE-*-Key` attributes. + # This configuration option makes the WiMAX module delete the + # `MS-MPPE-*-Key` attributes. # - # If the keys are deleted (by setting this to `yes`), then - # the `WiMAX-MSK` attribute is automatically added to the reply. + # If the keys are deleted (by setting this to `yes`), then the + # `WiMAX-MSK` attribute is automatically added to the reply. # # The default is to leave them in place. # diff --git a/raddb/mods-available/winbind b/raddb/mods-available/winbind index e038fab51de..76fcd2fee8b 100644 --- a/raddb/mods-available/winbind +++ b/raddb/mods-available/winbind @@ -7,8 +7,8 @@ # # = Winbind # -# The `winbind` module authenticate PAP passwords against Microsoft Active -# Directory or Samba, via the winbind API. +# The `winbind` module authenticate PAP passwords against Microsoft +# Active Directory or Samba, via the winbind API. # # This module is for PAP authentication (where plaintext passwords # are sent in the `User-Password` attribute) only. For authenticating @@ -30,13 +30,14 @@ winbind { # # domain:: The windows domain. # - # While not required to be set, it is likely that authentication will fail - # if it is not set correctly. + # While not required to be set, it is likely that authentication + # will fail if it is not set correctly. # - # This configuration option, as the username above, is also expanded before use. + # This configuration option, as the username above, is also expanded + # before use. # - # If unset then winbind will be queried for the correct value. If you - # actually want it blank it should be explicitly set here. + # If unset then winbind will be queried for the correct value. If + # you actually want it blank it should be explicitly set here. # # domain = "" @@ -49,17 +50,17 @@ winbind { # # search_username:: AD username to search for group searches. # - # This should generally not include a realm, so `Stripped-User-Name` - # is likely the best attribute if it exists. + # This should generally not include a realm, so + # `Stripped-User-Name` is likely the best attribute if it exists. # search_username = "%{Stripped-User-Name || User-Name}" # # add_domain:: Include the domain in group searches. # - # When this is enabled, winbind_domain is prepended to the - # username (as `domain\username`) before searching. This is - # generally required. + # When this is enabled, winbind_domain is prepended to the username + # (as `domain\username`) before searching. This is generally + # required. # # add_domain = yes } @@ -67,25 +68,23 @@ winbind { # # reuse:: Maintain long-term connections to the windbind server. # - # Reusable connection handles are allocated in blocks. These + # Reusable connection handles are allocated in blocks. These # parameters allow for tuning how that is done. # reuse { # - # min:: The minimum number of connection handles to - # keep allocated + # min:: The minimum number of connection handles to keep allocated # # min = 10 # - # max:: The maximum number of reusable connection - # handles to allocate. + # max:: The maximum number of reusable connection handles to + # allocate. # # max = 100 # - # cleanup_interval:: How often to free un-used - # connection handles. + # cleanup_interval:: How often to free un-used connection handles. # # cleanup_interval = 30s } diff --git a/raddb/mods-config/sql/counter/mysql/dailycounter.conf b/raddb/mods-config/sql/counter/mysql/dailycounter.conf index 80bec465bac..0241cf6b7a6 100644 --- a/raddb/mods-config/sql/counter/mysql/dailycounter.conf +++ b/raddb/mods-config/sql/counter/mysql/dailycounter.conf @@ -1,8 +1,7 @@ # -# This query properly handles calls that span from the -# previous reset period into the current period but -# involves more work for the SQL server than those -# below +# This query properly handles calls that span from the previous reset +# period into the current period but involves more work for the SQL +# server than those below # query = "\ SELECT IFNULL(SUM(acctsessiontime - GREATEST((%{control.dailycounter-reset-start} - UNIX_TIMESTAMP(acctstarttime)), 0)), 0) \ @@ -11,9 +10,9 @@ query = "\ AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%{control.dailycounter-reset-start}'" # -# This query ignores calls that started in a previous -# reset period and continue into into this one. But it -# is a little easier on the SQL server +# This query ignores calls that started in a previous reset period +# and continue into into this one. But it is a little easier on the +# SQL server # #query = "\ # SELECT IFNULL(SUM(acctsessiontime), 0) \ @@ -22,8 +21,8 @@ query = "\ # AND acctstarttime > FROM_UNIXTIME('%{control.dailycounter-reset-start}')" # -# This query is the same as above, but demonstrates an -# additional counter parameter '%{control.dailycounter-reset-end}' which is the +# This query is the same as above, but demonstrates an additional +# counter parameter '%{control.dailycounter-reset-end}' which is the # timestamp for the end of the period # #query = "\ diff --git a/raddb/mods-config/sql/counter/mysql/monthlycounter.conf b/raddb/mods-config/sql/counter/mysql/monthlycounter.conf index 92364a4d4bd..0513dd706e9 100644 --- a/raddb/mods-config/sql/counter/mysql/monthlycounter.conf +++ b/raddb/mods-config/sql/counter/mysql/monthlycounter.conf @@ -1,8 +1,7 @@ # -# This query properly handles calls that span from the -# previous reset period into the current period but -# involves more work for the SQL server than those -# below +# This query properly handles calls that span from the previous reset +# period into the current period but involves more work for the SQL +# server than those below # query = "\ SELECT IFNULL(SUM(acctsessiontime - GREATEST((%{control.monthlycounter-reset-start} - UNIX_TIMESTAMP(acctstarttime)), 0)), 0) \ @@ -11,9 +10,9 @@ query = "\ AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%{control.monthlycounter-reset-start}'" # -# This query ignores calls that started in a previous -# reset period and continue into into this one. But it -# is a little easier on the SQL server +# This query ignores calls that started in a previous reset period +# and continue into into this one. But it is a little easier on the +# SQL server # #query = "\ # SELECT IFNULL(SUM(acctsessiontime), 0) \ @@ -22,9 +21,9 @@ query = "\ # AND acctstarttime > FROM_UNIXTIME('%{control.monthlycounter-reset-start}')" # -# This query is the same as above, but demonstrates an -# additional counter parameter '%{control.monthlycounter-reset-end}' which is the -# timestamp for the end of the period +# This query is the same as above, but demonstrates an additional +# counter parameter '%{control.monthlycounter-reset-end}' which is +# the timestamp for the end of the period # #query = "\ # SELECT IFNULL(SUM(acctsessiontime), 0) \ diff --git a/raddb/mods-config/sql/counter/postgresql/dailycounter.conf b/raddb/mods-config/sql/counter/postgresql/dailycounter.conf index 3fc51ada81c..6c0f90b3ec3 100644 --- a/raddb/mods-config/sql/counter/postgresql/dailycounter.conf +++ b/raddb/mods-config/sql/counter/postgresql/dailycounter.conf @@ -1,8 +1,7 @@ # -# This query properly handles calls that span from the -# previous reset period into the current period but -# involves more work for the SQL server than those -# below +# This query properly handles calls that span from the previous reset +# period into the current period but involves more work for the SQL +# server than those below # query = "\ SELECT COALESCE(SUM(AcctSessionTime - GREATEST((%{control.dailycounter-reset-start} - EXTRACT(epoch FROM AcctStartTime)), 0)), 0) \ @@ -11,9 +10,9 @@ query = "\ AND EXTRACT(epoch FROM AcctStartTime) + AcctSessionTime > '%{control.dailycounter-reset-start}'" # -# This query ignores calls that started in a previous -# reset period and continue into into this one. But it -# is a little easier on the SQL server +# This query ignores calls that started in a previous reset period +# and continue into into this one. But it is a little easier on the +# SQL server # #query = "\ # SELECT COALESCE(SUM(AcctSessionTime), 0) \ @@ -22,8 +21,8 @@ query = "\ # AND EXTRACT(epoch FROM AcctStartTime) > '%{control.dailycounter-reset-start}'" # -# This query is the same as above, but demonstrates an -# additional counter parameter '%{control.dailycounter-reset-end}' which is the +# This query is the same as above, but demonstrates an additional +# counter parameter '%{control.dailycounter-reset-end}' which is the # timestamp for the end of the period # #query = "\ diff --git a/raddb/mods-config/sql/counter/postgresql/monthlycounter.conf b/raddb/mods-config/sql/counter/postgresql/monthlycounter.conf index 3ded21809c3..8dcdd045c92 100644 --- a/raddb/mods-config/sql/counter/postgresql/monthlycounter.conf +++ b/raddb/mods-config/sql/counter/postgresql/monthlycounter.conf @@ -1,7 +1,6 @@ -# This query properly handles calls that span from the -# previous reset period into the current period but -# involves more work for the SQL server than those -# below +# This query properly handles calls that span from the previous reset +# period into the current period but involves more work for the SQL +# server than those below query = "\ SELECT COALESCE(SUM(AcctSessionTime - GREATEST((%{control.monthlycounter-reset-start} - EXTRACT(epoch FROM AcctStartTime)), 0)), 0) \ FROM radacct \ @@ -9,9 +8,9 @@ query = "\ AND EXTRACT(epoch FROM AcctStartTime) + AcctSessionTime > '%{control.monthlycounter-reset-start}'" # -# This query ignores calls that started in a previous -# reset period and continue into into this one. But it -# is a little easier on the SQL server +# This query ignores calls that started in a previous reset period +# and continue into into this one. But it is a little easier on the +# SQL server # #query = "\ # SELECT COALESCE(SUM(AcctSessionTime), 0) \ @@ -20,9 +19,9 @@ query = "\ # AND EXTRACT(epoch FROM AcctStartTime) > '%{control.monthlycounter-reset-start}'" # -# This query is the same as above, but demonstrates an -# additional counter parameter '%{control.monthlycounter-reset-end}' which is the -# timestamp for the end of the period +# This query is the same as above, but demonstrates an additional +# counter parameter '%{control.monthlycounter-reset-end}' which is +# the timestamp for the end of the period # #query = "\ # SELECT COALESCE(SUM(AcctSessionTime), 0) \ diff --git a/raddb/mods-config/sql/counter/sqlite/dailycounter.conf b/raddb/mods-config/sql/counter/sqlite/dailycounter.conf index 28574038123..78b90d70719 100644 --- a/raddb/mods-config/sql/counter/sqlite/dailycounter.conf +++ b/raddb/mods-config/sql/counter/sqlite/dailycounter.conf @@ -1,8 +1,7 @@ # -# This query properly handles calls that span from the -# previous reset period into the current period but -# involves more work for the SQL server than those -# below +# This query properly handles calls that span from the previous reset +# period into the current period but involves more work for the SQL +# server than those below # query = "\ SELECT IFNULL(SUM(acctsessiontime - MAX((%{control.dailycounter-reset-start} - strftime('%%s', acctstarttime)), 0)), 0) \ @@ -11,9 +10,9 @@ query = "\ AND (strftime('%%s', acctstarttime) + acctsessiontime) > %{control.dailycounter-reset-start}" # -# This query ignores calls that started in a previous -# reset period and continue into into this one. But it -# is a little easier on the SQL server +# This query ignores calls that started in a previous reset period +# and continue into into this one. But it is a little easier on the +# SQL server # #query = "\ # SELECT IFNULL(SUM(acctsessiontime), 0) \ @@ -22,8 +21,8 @@ query = "\ # AND acctstarttime > %{control.dailycounter-reset-start}" # -# This query is the same as above, but demonstrates an -# additional counter parameter '%{control.dailycounter-reset-end}' which is the +# This query is the same as above, but demonstrates an additional +# counter parameter '%{control.dailycounter-reset-end}' which is the # timestamp for the end of the period # #query = "\ diff --git a/raddb/mods-config/sql/counter/sqlite/monthlycounter.conf b/raddb/mods-config/sql/counter/sqlite/monthlycounter.conf index 1ead23e4caa..4d8f76e51c7 100644 --- a/raddb/mods-config/sql/counter/sqlite/monthlycounter.conf +++ b/raddb/mods-config/sql/counter/sqlite/monthlycounter.conf @@ -1,8 +1,7 @@ # -# This query properly handles calls that span from the -# previous reset period into the current period but -# involves more work for the SQL server than those -# below +# This query properly handles calls that span from the previous reset +# period into the current period but involves more work for the SQL +# server than those below # query = "\ SELECT IFNULL(SUM(acctsessiontime - MAX((%{control.monthlycounter-reset-start} - strftime('%%s', acctstarttime)), 0)), 0) \ @@ -11,9 +10,9 @@ query = "\ (strftime('%%s', acctstarttime) + acctsessiontime) > %{control.monthlycounter-reset-start}" # -# This query ignores calls that started in a previous -# reset period and continue into into this one. But it -# is a little easier on the SQL server +# This query ignores calls that started in a previous reset period +# and continue into into this one. But it is a little easier on the +# SQL server # #query = "\ # SELECT IFNULL(SUM(acctsessiontime), 0) \ @@ -22,9 +21,9 @@ query = "\ # AND acctstarttime > %{control.monthlycounter-reset-start}" # -# This query is the same as above, but demonstrates an -# additional counter parameter '%{control.monthlycounter-reset-end}' which is the -# timestamp for the end of the period +# This query is the same as above, but demonstrates an additional +# counter parameter '%{control.monthlycounter-reset-end}' which is +# the timestamp for the end of the period # #query = "\ # SELECT IFNULL(SUM(acctsessiontime), 0) \ diff --git a/raddb/mods-config/sql/cui/postgresql/queries.conf b/raddb/mods-config/sql/cui/postgresql/queries.conf index b5d235b2468..b75016ef667 100644 --- a/raddb/mods-config/sql/cui/postgresql/queries.conf +++ b/raddb/mods-config/sql/cui/postgresql/queries.conf @@ -1,14 +1,15 @@ # -*- text -*- # -# cui/postgresql/queries.conf -- Queries to update a PostgreSQL CUI table. +# cui/postgresql/queries.conf -- Queries to update a PostgreSQL CUI +# table. # # $Id$ send { access-accept { # NOTE: Clause ON CONFLICT (aka upsert) was added in PostgreSQL 9.5. - # If you're using an older version, you should upgrade, or use queries.conf - # and schema.sql from FreeRADIUS 3.0.20 or older. + # If you're using an older version, you should upgrade, or use + # queries.conf and schema.sql from FreeRADIUS 3.0.20 or older. query = "\ INSERT INTO ${...cui_table} \ (clientipaddress, callingstationid, username, cui) \ diff --git a/raddb/mods-config/sql/ippool/firebird/queries.conf b/raddb/mods-config/sql/ippool/firebird/queries.conf index 85086c5a0a3..025248ababc 100644 --- a/raddb/mods-config/sql/ippool/firebird/queries.conf +++ b/raddb/mods-config/sql/ippool/firebird/queries.conf @@ -1,4 +1,4 @@ -# -*- text -*- +# -*- text -*- # # ippool/firebird/queries.conf -- Firebird queries for rlm_sqlippool # @@ -13,8 +13,7 @@ skip_locked = "SKIP LOCKED" # -# RADIUS (Accounting-Start) -# DHCPv4 (Discover) +# RADIUS (Accounting-Start) DHCPv4 (Discover) # # @@ -22,13 +21,14 @@ skip_locked = "SKIP LOCKED" # # Firebird is inherently transaction based, and each of the queries # making up the allocation sequence are executed within a single -# transaction - so there is no need to specifically start the transaction. +# transaction - so there is no need to specifically start the +# transaction. # alloc_begin = "" # -# This query attempts to re-allocate the most recent IP address -# for the client +# This query attempts to re-allocate the most recent IP address for +# the client alloc_existing = "\ UPDATE ${ippool_table} \ SET expiry_time = DATEADD(${offer_duration} SECOND TO CURRENT_TIMESTAMP), \ @@ -57,8 +57,8 @@ alloc_requested = "\ RETURNING address" # -# If the preceding query doesn't find an address the following one -# is used for finding one from the pool +# If the preceding query doesn't find an address the following one is +# used for finding one from the pool # alloc_find = "\ UPDATE ${ippool_table} \ @@ -74,8 +74,9 @@ alloc_find = "\ # # This query marks the IP address handed out by "alloc_find" as used -# for the period of "offer_duration" after which time it may be reused. -# It is only needed if the SELECT query does not perform the update. +# for the period of "offer_duration" after which time it may be +# reused. It is only needed if the SELECT query does not perform the +# update. # #alloc_update = "\ # UPDATE ${ippool_table} \ @@ -87,17 +88,18 @@ alloc_find = "\ # AND pool_name = '%{${pool_name}}'" # -# The transaction used to execute the previous queries is automatically -# committed when a successful allocation has happened - so there is -# no requirement to call COMMIT. +# The transaction used to execute the previous queries is +# automatically committed when a successful allocation has happened - +# so there is no requirement to call COMMIT. # alloc_commit = "" # -# If an IP could not be allocated, check to see whether the pool exists or not -# This allows the module to differentiate between a full pool and no pool -# NOTE: If you are not running redundant pool modules this query may be commented -# out to save running this query every time an ip is not allocated. +# If an IP could not be allocated, check to see whether the pool +# exists or not This allows the module to differentiate between a +# full pool and no pool NOTE: If you are not running redundant pool +# modules this query may be commented out to save running this query +# every time an ip is not allocated. # pool_check = "\ SELECT id \ @@ -106,12 +108,12 @@ pool_check = "\ FETCH FIRST ROW ONLY" # -# RADIUS (Interim-Update) -# DHCPv4 (Request) +# RADIUS (Interim-Update) DHCPv4 (Request) # # -# Query used to clear any other addresses that have been offered to the client +# Query used to clear any other addresses that have been offered to +# the client # update_free = "\ UPDATE ${ippool_table} \ @@ -126,11 +128,11 @@ update_free = "\ AND status_id IN (SELECT status_id FROM fr_ippool_status WHERE status = 'dynamic')" # -# Queries to update a lease. -# This query must update a row when a lease is successfully requested - -# queries that update no rows will result in a "notfound" response to -# the module which by default will give a NAK reply. In this example -# incrementing "counter" is used to achieve this. +# Queries to update a lease. This query must update a row when a +# lease is successfully requested - queries that update no rows will +# result in a "notfound" response to the module which by default will +# give a NAK reply. In this example incrementing "counter" is used to +# achieve this. # update_update = "\ UPDATE ${ippool_table} \ @@ -143,8 +145,7 @@ update_update = "\ AND address = '${requested_address}'" # -# RADIUS (Accounting-Stop) -# DHCPv4 (Release) +# RADIUS (Accounting-Stop) DHCPv4 (Release) # # @@ -175,8 +176,7 @@ mark_update = "\ AND owner = '${owner}'" # -# RADIUS (Accounting-On) -# RADIUS (Accounting-Off) +# RADIUS (Accounting-On) RADIUS (Accounting-Off) # # diff --git a/raddb/mods-config/sql/ippool/mssql/queries.conf b/raddb/mods-config/sql/ippool/mssql/queries.conf index ffd2fffab1a..4ff23fa3be6 100644 --- a/raddb/mods-config/sql/ippool/mssql/queries.conf +++ b/raddb/mods-config/sql/ippool/mssql/queries.conf @@ -1,17 +1,16 @@ -# -*- text -*- +# -*- text -*- # # ippool/mssql/queries.conf -- MSSQL queries for rlm_sqlippool # # $Id$ # -# RADIUS (Accounting-Start) -# DHCPv4 (Discover) +# RADIUS (Accounting-Start) DHCPv4 (Discover) # # -# MSSQL-specific syntax - required if finding the address and updating -# it are separate queries +# MSSQL-specific syntax - required if finding the address and +# updating it are separate queries # #alloc_begin = "BEGIN TRAN" #alloc_commit = "COMMIT TRAN" @@ -82,9 +81,9 @@ alloc_find = "\ # # Alternatively attempt both in one, more complex, query # -# The ORDER BY clause of this query tries to allocate the same IP-address -# which user had last session. Ensure that owner is unique to the user -# within a given pool. +# The ORDER BY clause of this query tries to allocate the same +# IP-address which user had last session. Ensure that owner is unique +# to the user within a given pool. # #alloc_find = "\ # UPDATE TOP(1) ${ippool_table} \ @@ -119,8 +118,9 @@ alloc_find = "\ # )" # -# If you prefer to allocate a random IP address every time, use this query instead. -# NOTE: This is very slow if you have a lot of free IPs. +# If you prefer to allocate a random IP address every time, use this +# query instead. NOTE: This is very slow if you have a lot of free +# IPs. # #alloc_find = "\ # WITH cte AS ( \ @@ -137,10 +137,11 @@ alloc_find = "\ # OUTPUT INSERTED.address" # -# If an IP could not be allocated, check to see if the pool exists or not -# This allows the module to differentiate between a full pool and no pool -# NOTE: If you are not running redundant pool modules this query may be -# commented out to save running this query every time an ip is not allocated. +# If an IP could not be allocated, check to see if the pool exists or +# not This allows the module to differentiate between a full pool and +# no pool NOTE: If you are not running redundant pool modules this +# query may be commented out to save running this query every time an +# ip is not allocated. # pool_check = "\ SELECT TOP(1) id \ @@ -148,8 +149,9 @@ pool_check = "\ WHERE pool_name='%{${pool_name}}'" # -# This is the final IP Allocation query, which saves the allocated ip details. -# Only needed if the initial "find" query is not storing the allocation. +# This is the final IP Allocation query, which saves the allocated ip +# details. Only needed if the initial "find" query is not storing the +# allocation. # #alloc_update = "\ # UPDATE ${ippool_table} \ @@ -160,10 +162,12 @@ pool_check = "\ # AND pool_name = '%{${pool_name}}'" # -# Use a stored procedure to find AND allocate the address. Read and customise -# `procedure.sql` in this directory to determine the optimal configuration. +# Use a stored procedure to find AND allocate the address. Read and +# customise `procedure.sql` in this directory to determine the +# optimal configuration. # -# Comment out alloc_existing, alloc_requested and alloc_update to use this +# Comment out alloc_existing, alloc_requested and alloc_update to use +# this # #alloc_begin = "" #alloc_find = "\ @@ -178,13 +182,12 @@ pool_check = "\ # -# RADIUS (Interim-Update) -# DHCPv4 (Request) +# RADIUS (Interim-Update) DHCPv4 (Request) # # -# This query revokes any active offers for addresses that a client is not -# requesting. +# This query revokes any active offers for addresses that a client is +# not requesting. # update_free = "\ UPDATE ${ippool_table} \ @@ -200,11 +203,11 @@ update_free = "\ (SELECT status_id FROM fr_ippool_status WHERE status = 'dynamic')" # -# Queries to update a lease. -# This query must update a row when a lease is successfully requested - -# queries that update no rows will result in a "notfound" response to -# the module which by default will give a NAK reply (for DHCPv4). -# In this example incrementing "counter" is used to achieve this. +# Queries to update a lease. This query must update a row when a +# lease is successfully requested - queries that update no rows will +# result in a "notfound" response to the module which by default will +# give a NAK reply (for DHCPv4). In this example incrementing +# "counter" is used to achieve this. # update_update = "\ UPDATE ${ippool_table} \ @@ -217,8 +220,7 @@ update_update = "\ AND address = '${requested_address}'" # -# RADIUS (Accounting-Stop) -# DHCPv4 (Release) +# RADIUS (Accounting-Stop) DHCPv4 (Release) # # @@ -249,8 +251,7 @@ mark_update = "\ AND owner = '${owner}'" # -# RADIUS (Accounting-On) -# RADIUS (Accounting-Off) +# RADIUS (Accounting-On) RADIUS (Accounting-Off) # # diff --git a/raddb/mods-config/sql/ippool/mysql/queries.conf b/raddb/mods-config/sql/ippool/mysql/queries.conf index 7529ed5818d..23088930399 100644 --- a/raddb/mods-config/sql/ippool/mysql/queries.conf +++ b/raddb/mods-config/sql/ippool/mysql/queries.conf @@ -4,16 +4,15 @@ # # $Id$ -# Using SKIP LOCKED speeds up selection queries -# However, it requires MySQL >= 8.0.1. Uncomment the -# following if you are running a suitable version of MySQL +# Using SKIP LOCKED speeds up selection queries However, it requires +# MySQL >= 8.0.1. Uncomment the following if you are running a +# suitable version of MySQL # # skip_locked = "SKIP LOCKED" skip_locked = "" # -# RADIUS (Accounting-Start) -# DHCPv4 (Discover) +# RADIUS (Accounting-Start) DHCPv4 (Discover) # # @@ -21,7 +20,8 @@ skip_locked = "" # # -# This query attempts to find the most recent IP address for the client +# This query attempts to find the most recent IP address for the +# client # alloc_existing = "\ SELECT address \ @@ -60,8 +60,8 @@ alloc_find = "\ FOR UPDATE ${skip_locked}" # -# Alternatively do the operations in one query. -# Depending on transaction isolation mode, this can cause deadlocks +# Alternatively do the operations in one query. Depending on +# transaction isolation mode, this can cause deadlocks # #alloc_find = "\ # (SELECT address, 1 AS o FROM ${ippool_table} \ @@ -86,8 +86,9 @@ alloc_find = "\ # LIMIT 1" # -# If you prefer to allocate a random IP address every time, use this query instead. -# NOTE: This is very slow if you have a lot of free IPs. +# If you prefer to allocate a random IP address every time, use this +# query instead. NOTE: This is very slow if you have a lot of free +# IPs. # #alloc_find = "\ # SELECT address FROM ${ippool_table} \ @@ -100,10 +101,11 @@ alloc_find = "\ # FOR UPDATE ${skip_locked}" # -# If an IP could not be allocated, check to see if the pool exists or not -# This allows the module to differentiate between a full pool and no pool -# NOTE: If you are not running redundant pool modules this query may be -# commented out to save running this query every time an ip is not allocated. +# If an IP could not be allocated, check to see if the pool exists or +# not This allows the module to differentiate between a full pool and +# no pool NOTE: If you are not running redundant pool modules this +# query may be commented out to save running this query every time an +# ip is not allocated. # pool_check = "\ SELECT id \ @@ -112,7 +114,8 @@ pool_check = "\ LIMIT 1" # -# This is the final IP Allocation query, which saves the allocated ip details. +# This is the final IP Allocation query, which saves the allocated ip +# details. # alloc_update = "\ UPDATE ${ippool_table} \ @@ -123,10 +126,12 @@ alloc_update = "\ AND pool_name = '%{${pool_name}}'" # -# Use a stored procedure to find AND allocate the address. Read and customise -# `procedure.sql` in this directory to determine the optimal configuration. +# Use a stored procedure to find AND allocate the address. Read and +# customise `procedure.sql` in this directory to determine the +# optimal configuration. # -# Comment out alloc_existing, alloc_requested and alloc_update to use this +# Comment out alloc_existing, alloc_requested and alloc_update to use +# this # #alloc_begin = "" #alloc_find = "\ @@ -141,13 +146,12 @@ alloc_update = "\ # -# RADIUS (Interim-Update) -# DHCPv4 (Request) +# RADIUS (Interim-Update) DHCPv4 (Request) # # -# This query revokes any active offers for addresses that a client is not -# requesting when a DHCP REQUEST packet arrives +# This query revokes any active offers for addresses that a client is +# not requesting when a DHCP REQUEST packet arrives # update_free = "\ UPDATE ${ippool_table} \ @@ -162,11 +166,11 @@ update_free = "\ AND `status` = 'dynamic'" # -# Queries to update a lease. -# This query must update a row when a lease is successfully requested - -# queries that update no rows will result in a "notfound" response to -# the module which by default will give a NAK reply. In this example -# incrementing "counter" is used to achieve this. +# Queries to update a lease. This query must update a row when a +# lease is successfully requested - queries that update no rows will +# result in a "notfound" response to the module which by default will +# give a NAK reply. In this example incrementing "counter" is used to +# achieve this. # update_update = "\ UPDATE ${ippool_table} \ @@ -179,8 +183,7 @@ update_update = "\ AND address = '${requested_address}'" # -# RADIUS (Accounting-Stop) -# DHCPv4 (Release) +# RADIUS (Accounting-Stop) DHCPv4 (Release) # # @@ -211,8 +214,7 @@ mark_update = "\ AND owner = '${owner}'" # -# RADIUS (Accounting-On) -# RADIUS (Accounting-Off) +# RADIUS (Accounting-On) RADIUS (Accounting-Off) # # diff --git a/raddb/mods-config/sql/ippool/oracle/queries.conf b/raddb/mods-config/sql/ippool/oracle/queries.conf index 405f9a362f8..b7981a2099e 100644 --- a/raddb/mods-config/sql/ippool/oracle/queries.conf +++ b/raddb/mods-config/sql/ippool/oracle/queries.conf @@ -10,15 +10,15 @@ # -# RADIUS (Accounting-Start) -# DHCPv4 (Discover) +# RADIUS (Accounting-Start) DHCPv4 (Discover) # # -# Use a stored procedure to find AND allocate the address. Read and customise -# `procedure.sql` in this directory to determine the optimal configuration. -# Oracle's locking mechanism limitations prevents the use of single queries -# that can either find a client's existing address or the first available one. +# Use a stored procedure to find AND allocate the address. Read and +# customise `procedure.sql` in this directory to determine the +# optimal configuration. Oracle's locking mechanism limitations +# prevents the use of single queries that can either find a client's +# existing address or the first available one. # alloc_begin = "" alloc_find = "\ @@ -33,8 +33,9 @@ alloc_commit = "" # -# If you prefer to allocate a random IP address every time, use this query instead -# NOTE: This is very slow if you have a lot of free IPs. +# If you prefer to allocate a random IP address every time, use this +# query instead NOTE: This is very slow if you have a lot of free +# IPs. # #alloc_find = "\ # SELECT address FROM ${ippool_table} WHERE id IN ( \ @@ -51,8 +52,8 @@ alloc_commit = "" # ) FOR UPDATE" # -# The above query again, but with SKIP LOCKED. This requires Oracle > 11g. -# It may work in 9i and 10g, but is not documented, so YMMV. +# The above query again, but with SKIP LOCKED. This requires Oracle > +# 11g. It may work in 9i and 10g, but is not documented, so YMMV. # #alloc_find = "\ # SELECT address FROM ${ippool_table} WHERE id IN ( \ @@ -69,7 +70,7 @@ alloc_commit = "" # ) FOR UPDATE SKIP LOCKED" # -# A tidier version that needs Oracle >= 12c +# A tidier version that needs Oracle >= 12c # #alloc_find = "\ # SELECT address FROM ${ippool_table} WHERE id IN ( @@ -84,10 +85,11 @@ alloc_commit = "" # ) FROM UPDATE SKIP LOCKED" # -# If an IP could not be allocated, check to see whether the pool exists or not -# This allows the module to differentiate between a full pool and no pool -# NOTE: If you are not running redundant pool modules this query may be commented -# out to save running this query every time an ip is not allocated. +# If an IP could not be allocated, check to see whether the pool +# exists or not This allows the module to differentiate between a +# full pool and no pool NOTE: If you are not running redundant pool +# modules this query may be commented out to save running this query +# every time an ip is not allocated. # pool_check = "\ SELECT id \ @@ -99,7 +101,8 @@ pool_check = "\ # # This query marks the IP address handed out by "alloc_find" as used -# for the period of "offer_duration" after which time it may be reused. +# for the period of "offer_duration" after which time it may be +# reused. # #alloc_update = "\ # UPDATE ${ippool_table} \ @@ -112,16 +115,15 @@ pool_check = "\ # -# RADIUS (Interim-Update) -# DHCPv4 (Request) +# RADIUS (Interim-Update) DHCPv4 (Request) # # -# Queries to update a lease. -# This query must update a row when a lease is successfully requested - -# queries that update no rows will result in a "notfound" response to -# the module which by default will give a NAK reply. In this example -# incrementing "counter" is used to achieve this. +# Queries to update a lease. This query must update a row when a +# lease is successfully requested - queries that update no rows will +# result in a "notfound" response to the module which by default will +# give a NAK reply. In this example incrementing "counter" is used to +# achieve this. # update_update = "\ UPDATE ${ippool_table} \ @@ -134,8 +136,7 @@ update_update = "\ AND address = '${requested_address}'" # -# RADIUS (Accounting-Stop) -# DHCPv4 (Release) +# RADIUS (Accounting-Stop) DHCPv4 (Release) # # @@ -165,8 +166,7 @@ mark_update = "\ AND owner = '${owner}'" # -# RADIUS (Accounting-On) -# RADIUS (Accounting-Off) +# RADIUS (Accounting-On) RADIUS (Accounting-Off) # # diff --git a/raddb/mods-config/sql/ippool/postgresql/queries.conf b/raddb/mods-config/sql/ippool/postgresql/queries.conf index 1b088b2ec50..38e10ade719 100644 --- a/raddb/mods-config/sql/ippool/postgresql/queries.conf +++ b/raddb/mods-config/sql/ippool/postgresql/queries.conf @@ -1,31 +1,32 @@ -# -*- text -*- +# -*- text -*- # -# ippool/postgresql/queries.conf -- PostgreSQL queries for rlm_sqlippool +# ippool/postgresql/queries.conf -- PostgreSQL queries for +# rlm_sqlippool # # $Id$ -# Using SKIP LOCKED speed up the alloc_find query by 10 -# times. However, it requires PostgreSQL >= 9.5. +# Using SKIP LOCKED speed up the alloc_find query by 10 times. +# However, it requires PostgreSQL >= 9.5. # -# If you are using an older version of PostgreSQL comment out the following: +# If you are using an older version of PostgreSQL comment out the +# following: skip_locked = "SKIP LOCKED" # -# RADIUS (Accounting-Start) -# DHCPv4 (Discover) +# RADIUS (Accounting-Start) DHCPv4 (Discover) # # # This sequence of queries allocate an IP address from the Pool # -# If the SELECT and UPDATE are in separate queries then set the following -# to "BEGIN" to wrap them as a transaction +# If the SELECT and UPDATE are in separate queries then set the +# following to "BEGIN" to wrap them as a transaction # alloc_begin = "" # -# This query attempts to re-allocate the most recent IP address -# for the client +# This query attempts to re-allocate the most recent IP address for +# the client alloc_existing = "\ WITH cte AS ( \ SELECT address \ @@ -66,8 +67,8 @@ alloc_requested = "\ RETURNING cte.address" # -# If the preceding query doesn't find an address the following one -# is used for finding one from the pool +# If the preceding query doesn't find an address the following one is +# used for finding one from the pool # alloc_find = "\ WITH cte AS ( \ @@ -88,10 +89,10 @@ alloc_find = "\ RETURNING cte.address" # -# If you prefer to allocate a random IP address every time, use this query instead -# NOTE: This is very slow if you have a lot of free IPs. -# Use of either of these next two queries should have the alloc_begin line commented out -# and alloc_update below un-commented. +# If you prefer to allocate a random IP address every time, use this +# query instead NOTE: This is very slow if you have a lot of free +# IPs. Use of either of these next two queries should have the +# alloc_begin line commented out and alloc_update below un-commented. # #alloc_find = "\ # SELECT address FROM ${ippool_table} \ @@ -103,8 +104,9 @@ alloc_find = "\ # # This query marks the IP address handed out by "alloc_find" as used -# for the period of "offer_duration" after which time it may be reused. -# It is only needed if the SELECT query does not perform the update. +# for the period of "offer_duration" after which time it may be +# reused. It is only needed if the SELECT query does not perform the +# update. # #alloc_update = "\ # UPDATE ${ippool_table} \ @@ -116,16 +118,17 @@ alloc_find = "\ # AND pool_name = '%{${pool_name}}'" # -# If the SELECT and UPDATE are in separate queries then set the following -# to "COMMIT" to wrap them as a transaction +# If the SELECT and UPDATE are in separate queries then set the +# following to "COMMIT" to wrap them as a transaction # alloc_commit = "" # -# If an IP could not be allocated, check to see whether the pool exists or not -# This allows the module to differentiate between a full pool and no pool -# NOTE: If you are not running redundant pool modules this query may be commented -# out to save running this query every time an ip is not allocated. +# If an IP could not be allocated, check to see whether the pool +# exists or not This allows the module to differentiate between a +# full pool and no pool NOTE: If you are not running redundant pool +# modules this query may be commented out to save running this query +# every time an ip is not allocated. # pool_check = "\ SELECT id \ @@ -134,16 +137,18 @@ pool_check = "\ LIMIT 1" # -# Use a stored procedure to find AND allocate the address. Read and customise -# `procedure.sql` in this directory to determine the optimal configuration. +# Use a stored procedure to find AND allocate the address. Read and +# customise `procedure.sql` in this directory to determine the +# optimal configuration. # # This requires PostgreSQL >= 9.5 as SKIP LOCKED is used. # -# The "NO LOAD BALANCE" comment is included here to indicate to a PgPool -# system that this needs to be a write transaction. PgPool itself cannot -# detect this from the statement alone. If you are using PgPool and do not -# have this comment, the query may go to a read only server, and will fail. -# This has no negative effect if you are not using PgPool. +# The "NO LOAD BALANCE" comment is included here to indicate to a +# PgPool system that this needs to be a write transaction. PgPool +# itself cannot detect this from the statement alone. If you are +# using PgPool and do not have this comment, the query may go to a +# read only server, and will fail. This has no negative effect if you +# are not using PgPool. # #alloc_begin = "" #alloc_find = "\ @@ -159,12 +164,12 @@ pool_check = "\ # -# RADIUS (Interim-Update) -# DHCPv4 (Request) +# RADIUS (Interim-Update) DHCPv4 (Request) # # -# Query used to clear any other addresses that have been offered to the client +# Query used to clear any other addresses that have been offered to +# the client # update_free = "\ UPDATE ${ippool_table} \ @@ -179,11 +184,11 @@ update_free = "\ AND status = 'dynamic'" # -# Queries to update a lease. -# This query must update a row when a lease is successfully requested - -# queries that update no rows will result in a "notfound" response to -# the module which by default will give a NAK reply. In this example -# incrementing "counter" is used to achieve this. +# Queries to update a lease. This query must update a row when a +# lease is successfully requested - queries that update no rows will +# result in a "notfound" response to the module which by default will +# give a NAK reply. In this example incrementing "counter" is used to +# achieve this. # update_update = "\ UPDATE ${ippool_table} \ @@ -196,8 +201,7 @@ update_update = "\ AND address = '${requested_address}'" # -# RADIUS (Accounting-Stop) -# DHCPv4 (Release) +# RADIUS (Accounting-Stop) DHCPv4 (Release) # # @@ -228,8 +232,7 @@ mark_update = "\ AND owner = '${owner}'" # -# RADIUS (Accounting-On) -# RADIUS (Accounting-Off) +# RADIUS (Accounting-On) RADIUS (Accounting-Off) # # diff --git a/raddb/mods-config/sql/ippool/sqlite/queries.conf b/raddb/mods-config/sql/ippool/sqlite/queries.conf index 6539f840a7e..2afce08c780 100644 --- a/raddb/mods-config/sql/ippool/sqlite/queries.conf +++ b/raddb/mods-config/sql/ippool/sqlite/queries.conf @@ -6,23 +6,23 @@ # -# RADIUS (Accounting-Start) -# DHCPv4 (Discover) +# RADIUS (Accounting-Start) DHCPv4 (Discover) # # -# SQLite does not implement SELECT FOR UPDATE which is normally used to place -# an exclusive lock over rows to prevent the same address from being -# concurrently selected for allocation to multiple users. +# SQLite does not implement SELECT FOR UPDATE which is normally used +# to place an exclusive lock over rows to prevent the same address +# from being concurrently selected for allocation to multiple users. # -# The most granular read-blocking lock that SQLite has is an exclusive lock -# over the database, so that's what we use. All locking in SQLite is performed -# over the entire database and we perform a row update for any IP that we -# allocate, requiring an exclusive lock. Taking the exclusive lock from the -# start of the transaction (even if it were not required to guard the SELECT) -# is actually quicker than if we deferred it causing SQLite to "upgrade" the -# automatic shared lock for the transaction to an exclusive lock for the -# subsequent UPDATE. +# The most granular read-blocking lock that SQLite has is an +# exclusive lock over the database, so that's what we use. All +# locking in SQLite is performed over the entire database and we +# perform a row update for any IP that we allocate, requiring an +# exclusive lock. Taking the exclusive lock from the start of the +# transaction (even if it were not required to guard the SELECT) is +# actually quicker than if we deferred it causing SQLite to "upgrade" +# the automatic shared lock for the transaction to an exclusive lock +# for the subsequent UPDATE. # alloc_begin = "BEGIN EXCLUSIVE" alloc_commit = "COMMIT" @@ -70,7 +70,8 @@ alloc_find = "\ ORDER BY expiry_time LIMIT 1" # -# If you prefer to allocate a random IP address every time, use this query instead +# If you prefer to allocate a random IP address every time, use this +# query instead # #alloc_find = "\ # SELECT address FROM ${ippool_table} \ @@ -84,10 +85,11 @@ alloc_find = "\ # -# If an IP could not be allocated, check to see if the pool exists or not -# This allows the module to differentiate between a full pool and no pool -# NOTE: If you are not running redundant pool modules this query may be -# commented out to save running this query every time an ip is not allocated. +# If an IP could not be allocated, check to see if the pool exists or +# not This allows the module to differentiate between a full pool and +# no pool NOTE: If you are not running redundant pool modules this +# query may be commented out to save running this query every time an +# ip is not allocated. # pool_check = "\ SELECT id \ @@ -96,7 +98,8 @@ pool_check = "\ LIMIT 1" # -# This is the final IP Allocation query, which saves the allocated ip details +# This is the final IP Allocation query, which saves the allocated ip +# details # alloc_update = "\ UPDATE ${ippool_table} \ @@ -109,12 +112,12 @@ alloc_update = "\ # -# RADIUS (Interim-Update) -# DHCPv4 (Request) +# RADIUS (Interim-Update) DHCPv4 (Request) # # -# Query used to clear any other addresses that have been offered to the client +# Query used to clear any other addresses that have been offered to +# the client # update_free = "\ UPDATE ${ippool_table} \ @@ -130,11 +133,11 @@ update_free = "\ (SELECT status_id FROM fr_ippool_status WHERE status = 'dynamic')" # -# Queries to update a lease. -# This query must update a row when a lease is successfully requested - -# queries that update no rows will result in a "notfound" response to -# the module which by default will give a NAK reply. In this example -# incrementing "counter" is used to achieve this. +# Queries to update a lease. This query must update a row when a +# lease is successfully requested - queries that update no rows will +# result in a "notfound" response to the module which by default will +# give a NAK reply. In this example incrementing "counter" is used to +# achieve this. # update_update = "\ UPDATE ${ippool_table} \ @@ -148,8 +151,7 @@ update_update = "\ # -# RADIUS (Accounting-Stop) -# DHCPv4 (Release) +# RADIUS (Accounting-Stop) DHCPv4 (Release) # # @@ -182,8 +184,7 @@ mark_update = "\ AND owner = '${owner}'" # -# RADIUS (Accounting-On) -# RADIUS (Accounting-Off) +# RADIUS (Accounting-On) RADIUS (Accounting-Off) # # diff --git a/raddb/mods-config/sql/main/cassandra/queries.conf b/raddb/mods-config/sql/main/cassandra/queries.conf index d2c77836508..25efde47bb7 100644 --- a/raddb/mods-config/sql/main/cassandra/queries.conf +++ b/raddb/mods-config/sql/main/cassandra/queries.conf @@ -1,33 +1,33 @@ # -*- text -*- # -# main/mysql/queries.conf-- MySQL configuration for default schema (schema.sql) +# main/mysql/queries.conf-- MySQL configuration for default schema +# (schema.sql) # # $Id$ -# Safe characters list for sql queries. Everything else is replaced -# with their mime-encoded equivalents. -# The default list should be ok +# Safe characters list for sql queries. Everything else is replaced +# with their mime-encoded equivalents. The default list should be ok #safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" ####################################################################### # Connection config ####################################################################### -# The character set is not configurable. The default character set of -# the mysql client library is used. To control the character set, -# create/edit my.cnf (typically in /etc/mysql/my.cnf or /etc/my.cnf) -# and enter -# [client] +# The character set is not configurable. The default character set of +# the mysql client library is used. To control the character set, +# create/edit my.cnf (typically in /etc/mysql/my.cnf or /etc/my.cnf) +# and enter +# [client] # default-character-set = utf8 # ####################################################################### -# Query config: Username +# Query config: Username ####################################################################### -# This is the username that will get substituted, escaped, and added -# as attribute 'SQL-User-Name'. '%{SQL-User-Name}' can be used below -# everywhere a username substitution is needed for consistency. +# This is the username that will get substituted, escaped, and added +# as attribute 'SQL-User-Name'. '%{SQL-User-Name}' can be used below +# everywhere a username substitution is needed for consistency. # -# Uncomment the next line, if you want the sql_user_name to mean: +# Uncomment the next line, if you want the sql_user_name to mean: # # Use Stripped-User-Name, if it's there. # Else use User-Name, if it's there, @@ -37,38 +37,37 @@ sql_user_name = "%{User-Name}" ####################################################################### -# Query config: Event-Timestamp +# Query config: Event-Timestamp ####################################################################### -# event_timestamp_epoch is the basis for the time inserted into -# accounting records. Typically this will be the Event-Timestamp of the -# accounting request, which is usually provided by a NAS. +# event_timestamp_epoch is the basis for the time inserted into +# accounting records. Typically this will be the Event-Timestamp of +# the accounting request, which is usually provided by a NAS. # -# Uncomment the next line, if you want the timestamp to be based on the -# request reception time recorded by this server, for example if you -# distrust the provided Event-Timestamp. +# Uncomment the next line, if you want the timestamp to be based on +# the request reception time recorded by this server, for example if +# you distrust the provided Event-Timestamp. #event_timestamp_epoch = "%l" event_timestamp_epoch = %{((integer) Event-Timestamp) || %l} -# event_timestamp is the SQL snippet for converting an epoch timestamp -# to an SQL date. +# event_timestamp is the SQL snippet for converting an epoch +# timestamp to an SQL date. event_timestamp = "%{${event_timestamp_epoch} * 1000}" ####################################################################### -# Authorization Queries +# Authorization Queries ####################################################################### -# These queries compare the check items for the user -# in ${authcheck_table} and setup the reply items in -# ${authreply_table}. You can use any query/tables -# you want, but the return data for each row MUST -# be in the following order: +# These queries compare the check items for the user in +# ${authcheck_table} and setup the reply items in ${authreply_table}. +# You can use any query/tables you want, but the return data for each +# row MUST be in the following order: # -# 0. Row ID (currently unused) -# 1. UserName/GroupName -# 2. Item Attr Name -# 3. Item Attr Value -# 4. Item Attr Operation +# 0. Row ID (currently unused) +# 1. UserName/GroupName +# 2. Item Attr Name +# 3. Item Attr Value +# 4. Item Attr Operation ####################################################################### # @@ -104,36 +103,37 @@ authorize_group_reply_query = "\ WHERE groupname = '%{${group_attribute}}'" ####################################################################### -# Accounting and Post-Auth Queries +# Accounting and Post-Auth Queries ####################################################################### -# These queries insert/update accounting and authentication records. -# The query to use is determined by the name of the section the module -# is called from. +# These queries insert/update accounting and authentication records. +# The query to use is determined by the name of the section the +# module is called from. # -# e.g. when called from `accouting Start`, the contents of +# e.g. when called from `accouting Start`, the contents of # -# accounting { +# accounting { # start {} -# } +# } # -# will be read, and the "query" entry found will be used. +# will be read, and the "query" entry found will be used. # -# Unlike other SQL drivers, the rlm_cassandra driver will always -# indicate a single row was updated. This is because the updates aren't -# applied synchronously, so there's really no clue as to what will be -# updated when the query is issued. -# This prevents the normal query failover from occurring, but that's ok -# as INSERTS are really UPSERTS so we can work around it. +# Unlike other SQL drivers, the rlm_cassandra driver will always +# indicate a single row was updated. This is because the updates +# aren't applied synchronously, so there's really no clue as to what +# will be updated when the query is issued. This prevents the normal +# query failover from occurring, but that's ok as INSERTS are really +# UPSERTS so we can work around it. ####################################################################### accounting { - # Write SQL queries to a logfile. This is potentially useful for bulk inserts - # when used with the rlm_sql_null driver. + # Write SQL queries to a logfile. This is potentially useful for + # bulk inserts when used with the rlm_sql_null driver. # logfile = ${logdir}/accounting.sql # - # Because cassandra doesn't allow secondary indexes to be used in update statements - # applying acct on/off packets must be done outside of the server, by a script that - # first performs a SELECT to identify candidate rows, then closes out the sessions. + # Because cassandra doesn't allow secondary indexes to be used in + # update statements applying acct on/off packets must be done + # outside of the server, by a script that first performs a SELECT to + # identify candidate rows, then closes out the sessions. # accounting-on { query = "\ @@ -332,14 +332,14 @@ accounting { ####################################################################### -# Authentication Logging Queries +# Authentication Logging Queries ####################################################################### -# send queries - Insert some info after authentication +# send queries - Insert some info after authentication ####################################################################### send { - # Write SQL queries to a logfile. This is potentially useful for bulk inserts - # when used with the rlm_sql_null driver. + # Write SQL queries to a logfile. This is potentially useful for + # bulk inserts when used with the rlm_sql_null driver. # logfile = ${logdir}/post-auth.sql access-accept { diff --git a/raddb/mods-config/sql/main/firebird/queries.conf b/raddb/mods-config/sql/main/firebird/queries.conf index a8954b6c0c2..0f646668a37 100644 --- a/raddb/mods-config/sql/main/firebird/queries.conf +++ b/raddb/mods-config/sql/main/firebird/queries.conf @@ -1,17 +1,18 @@ # -*- text -*- # -# main/firebird/queries.conf-- Firebird configuration for default schema (schema.sql) +# main/firebird/queries.conf-- Firebird configuration for default +# schema (schema.sql) # # $Id$ ####################################################################### -# Query config: Username +# Query config: Username ####################################################################### -# This is the username that will get substituted, escaped, and added -# as attribute 'SQL-User-Name'. '%{SQL-User-Name}' can be used below -# everywhere a username substitution is needed for consistency. +# This is the username that will get substituted, escaped, and added +# as attribute 'SQL-User-Name'. '%{SQL-User-Name}' can be used below +# everywhere a username substitution is needed for consistency. # -# Uncomment the next line, if you want the sql_user_name to mean: +# Uncomment the next line, if you want the sql_user_name to mean: # # Use Stripped-User-Name, if it's there. # Else use User-Name, if it's there, @@ -21,38 +22,37 @@ sql_user_name = "%{User-Name}" ####################################################################### -# Query config: Event-Timestamp +# Query config: Event-Timestamp ####################################################################### -# event_timestamp_epoch is the basis for the time inserted into -# accounting records. Typically this will be the Event-Timestamp of the -# accounting request, which is usually provided by a NAS. +# event_timestamp_epoch is the basis for the time inserted into +# accounting records. Typically this will be the Event-Timestamp of +# the accounting request, which is usually provided by a NAS. # -# Uncomment the next line, if you want the timestamp to be based on the -# request reception time recorded by this server, for example if you -# distrust the provided Event-Timestamp. +# Uncomment the next line, if you want the timestamp to be based on +# the request reception time recorded by this server, for example if +# you distrust the provided Event-Timestamp. #event_timestamp_epoch = "%l" event_timestamp_epoch = "%{((integer) Event-Timestamp) || %l}" -# event_timestamp is the SQL snippet for converting an epoch timestamp -# to an SQL date. +# event_timestamp is the SQL snippet for converting an epoch +# timestamp to an SQL date. event_timestamp = "DATEADD(${event_timestamp_epoch} SECOND TO TIMESTAMP '1970-01-01 00:00:00')" ####################################################################### -# Authorization Queries +# Authorization Queries ####################################################################### -# These queries compare the check items for the user -# in ${authcheck_table} and setup the reply items in -# ${authreply_table}. You can use any query/tables -# you want, but the return data for each row MUST -# be in the following order: +# These queries compare the check items for the user in +# ${authcheck_table} and setup the reply items in ${authreply_table}. +# You can use any query/tables you want, but the return data for each +# row MUST be in the following order: # -# 0. Row ID (currently unused) -# 1. UserName/GroupName -# 2. Item Attr Name -# 3. Item Attr Value -# 4. Item Attr Operation +# 0. Row ID (currently unused) +# 1. UserName/GroupName +# 2. Item Attr Name +# 3. Item Attr Value +# 4. Item Attr Operation ####################################################################### authorize_check_query = "\ @@ -86,24 +86,24 @@ authorize_group_reply_query = "\ ORDER BY id" ####################################################################### -# Accounting and Post-Auth Queries +# Accounting and Post-Auth Queries ####################################################################### -# These queries insert/update accounting and authentication records. -# The query to use is determined by the name of the section the module -# is called from. +# These queries insert/update accounting and authentication records. +# The query to use is determined by the name of the section the +# module is called from. # -# e.g. when called from `accouting Start`, the contents of +# e.g. when called from `accouting Start`, the contents of # -# accounting { +# accounting { # start {} -# } +# } # -# will be read, and any "query" entries will be run in sequence -# until one returns a positive number of modified rows. +# will be read, and any "query" entries will be run in sequence until +# one returns a positive number of modified rows. ####################################################################### accounting { - # Write SQL queries to a logfile. This is potentially useful for bulk inserts - # when used with the rlm_sql_null driver. + # Write SQL queries to a logfile. This is potentially useful for + # bulk inserts when used with the rlm_sql_null driver. # logfile = ${logdir}/accounting.sql column_list = "\ @@ -122,14 +122,12 @@ accounting { # # "Bulk update" Accounting-On/Off strategy. # - # Immediately terminate all sessions associated with a - # given NAS. + # Immediately terminate all sessions associated with a given NAS. # - # NOTE: If a large number of sessions require closing - # then the bulk update may be take a long time to run - # and lock an excessive number of rows. See the - # strategy below for an alternative approach that does - # not touch the radacct session data. + # NOTE: If a large number of sessions require closing then the bulk + # update may be take a long time to run and lock an excessive + # number of rows. See the strategy below for an alternative + # approach that does not touch the radacct session data. # query = "\ UPDATE ${...acct_table1} \ @@ -144,28 +142,25 @@ accounting { # # "Lightweight" Accounting-On/Off strategy. # - # Record the reload time of the NAS and let the - # administrator actually close the sessions in radacct - # out-of-band, if desired. + # Record the reload time of the NAS and let the administrator + # actually close the sessions in radacct out-of-band, if desired. # - # Implementation advice, together with a stored - # procedure for closing sessions and a view showing - # the effective stop time of each session is provided - # in process-radacct.sql. + # Implementation advice, together with a stored procedure for + # closing sessions and a view showing the effective stop time of + # each session is provided in process-radacct.sql. # - # To enable this strategy, just change the previous - # query to "-query", and this one to "query". The - # previous one will be ignored, and this one will be - # enabled. + # To enable this strategy, just change the previous query to + # "-query", and this one to "query". The previous one will be + # ignored, and this one will be enabled. # -query = "\ UPDATE OR INSERT INTO nasreload \ (nasipaddress, reloadtime) VALUES \ ('%{NAS-IP-Address}', ${...event_timestamp})" - # If there are no open user sessions, then the previous query - # will return "no rows updated". The server will then fall through - # to the next query, which is just "yes, that's fine". + # If there are no open user sessions, then the previous query will + # return "no rows updated". The server will then fall through to + # the next query, which is just "yes, that's fine". # query = "SELECT true" @@ -214,8 +209,8 @@ accounting { '%{Class}')" # - # Key constraints prevented us from inserting a new session, - # use the alternate query to update an existing session. + # Key constraints prevented us from inserting a new session, use + # the alternate query to update an existing session. # query = "\ UPDATE ${...acct_table1} SET \ @@ -228,9 +223,9 @@ accounting { interim-update { # - # Update an existing session and calculate the interval - # between the last data we received for the session and this - # update. This can be used to find stale sessions. + # Update an existing session and calculate the interval between the + # last data we received for the session and this update. This can + # be used to find stale sessions. # query = "\ UPDATE ${...acct_table1} \ @@ -249,8 +244,8 @@ accounting { WHERE acctuniqueid = '%{Acct-Unique-Session-Id}'" # - # The update condition matched no existing sessions. Use - # the values provided in the update to create a new session. + # The update condition matched no existing sessions. Use the values + # provided in the update to create a new session. # query = "\ INSERT INTO ${...acct_table1} \ @@ -301,8 +296,8 @@ accounting { WHERE acctuniqueid = '%{Acct-Unique-Session-Id}'" # - # The update condition matched no existing sessions. Use - # the values provided in the update to create a new session. + # The update condition matched no existing sessions. Use the values + # provided in the update to create a new session. # query = "\ INSERT INTO ${...acct_table2} \ @@ -340,14 +335,14 @@ accounting { ####################################################################### -# Authentication Logging Queries +# Authentication Logging Queries ####################################################################### -# send queries - Insert some info after authentication +# send queries - Insert some info after authentication ####################################################################### send { - # Write SQL queries to a logfile. This is potentially useful for bulk inserts - # when used with the rlm_sql_null driver. + # Write SQL queries to a logfile. This is potentially useful for + # bulk inserts when used with the rlm_sql_null driver. # logfile = ${logdir}/post-auth.sql access-accept { diff --git a/raddb/mods-config/sql/main/mssql/queries.conf b/raddb/mods-config/sql/main/mssql/queries.conf index 4b07a459ff5..a6f5b01a6f1 100644 --- a/raddb/mods-config/sql/main/mssql/queries.conf +++ b/raddb/mods-config/sql/main/mssql/queries.conf @@ -1,22 +1,22 @@ # -*- text -*- # -# main/mssql/queries.conf -- MSSQL configuration for default schema (schema.sql) +# main/mssql/queries.conf -- MSSQL configuration for default schema +# (schema.sql) # # $Id$ -# Safe characters list for sql queries. Everything else is replaced -# with their mime-encoded equivalents. -# The default list should be ok +# Safe characters list for sql queries. Everything else is replaced +# with their mime-encoded equivalents. The default list should be ok #safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" ####################################################################### -# Query config: Username +# Query config: Username ####################################################################### -# This is the username that will get substituted, escaped, and added -# as attribute 'SQL-User-Name'. '%{SQL-User-Name}' can be used -# below everywhere a username substitution is needed for consistency. +# This is the username that will get substituted, escaped, and added +# as attribute 'SQL-User-Name'. '%{SQL-User-Name}' can be used below +# everywhere a username substitution is needed for consistency. # -# Uncomment the next line, if you want the sql_user_name to mean: +# Uncomment the next line, if you want the sql_user_name to mean: # # Use Stripped-User-Name, if it's there. # Else use User-Name, if it's there, @@ -26,32 +26,31 @@ sql_user_name = "%{User-Name}" ####################################################################### -# Query config: Event-Timestamp +# Query config: Event-Timestamp ####################################################################### -# event_timestamp_epoch is the basis for the time inserted into -# accounting records. Typically this will be the Event-Timestamp of the -# accounting request, which is usually provided by a NAS. +# event_timestamp_epoch is the basis for the time inserted into +# accounting records. Typically this will be the Event-Timestamp of +# the accounting request, which is usually provided by a NAS. # -# Uncomment the next line, if you want the timestamp to be based on the -# request reception time recorded by this server, for example if you -# distrust the provided Event-Timestamp. +# Uncomment the next line, if you want the timestamp to be based on +# the request reception time recorded by this server, for example if +# you distrust the provided Event-Timestamp. #event_timestamp_epoch = "%l" event_timestamp_epoch = %{((integer) Event-Timestamp) || %l} -# event_timestamp is the SQL snippet for converting an epoch timestamp -# to an SQL date. +# event_timestamp is the SQL snippet for converting an epoch +# timestamp to an SQL date. event_timestamp = "DATEADD(SS, ${event_timestamp_epoch}, '19700101')" ####################################################################### # Authorization Queries ####################################################################### -# These queries compare the check items for the user -# in ${authcheck_table} and setup the reply items in -# ${authreply_table}. You can use any query/tables -# you want, but the return data for each row MUST -# be in the following order: +# These queries compare the check items for the user in +# ${authcheck_table} and setup the reply items in ${authreply_table}. +# You can use any query/tables you want, but the return data for each +# row MUST be in the following order: # # 0. Row ID (currently unused) # 1. UserName/GroupName @@ -59,8 +58,8 @@ event_timestamp = "DATEADD(SS, ${event_timestamp_epoch}, '19700101')" # 3. Item Attr Value # 4. Item Attr Operation ####################################################################### -# Query for case sensitive usernames was removed. Please contact with me, -# if you know analog of STRCMP functions for MS SQL. +# Query for case sensitive usernames was removed. Please contact with +# me, if you know analog of STRCMP functions for MS SQL. authorize_check_query = "\ SELECT id, username, attribute, value, op \ @@ -93,24 +92,24 @@ group_membership_query = "\ ORDER BY priority" ####################################################################### -# Accounting and Send Queries +# Accounting and Send Queries ####################################################################### -# These queries insert/update accounting and authentication records. -# The query to use is determined by the name of the section the module -# is called from. +# These queries insert/update accounting and authentication records. +# The query to use is determined by the name of the section the +# module is called from. # -# e.g. when called from `accouting Start`, the contents of +# e.g. when called from `accouting Start`, the contents of # -# accounting { +# accounting { # start {} -# } +# } # -# will be read, and any "query" entries will be run in sequence -# until one returns a positive number of modified rows. +# will be read, and any "query" entries will be run in sequence until +# one returns a positive number of modified rows. ####################################################################### accounting { - # Write SQL queries to a logfile. This is potentially useful for bulk inserts - # when used with the rlm_sql_null driver. + # Write SQL queries to a logfile. This is potentially useful for + # bulk inserts when used with the rlm_sql_null driver. # logfile = ${logdir}/accounting.sql column_list = "\ @@ -137,9 +136,9 @@ accounting { AND acctstarttime <= ${...event_timestamp}" # - # If there are no open user sessions, then the previous query - # will return "no rows updated". The server will then fall through - # to the next query, which is just "yes, that's fine". + # If there are no open user sessions, then the previous query will + # return "no rows updated". The server will then fall through to + # the next query, which is just "yes, that's fine". # query = "SELECT true" } @@ -295,8 +294,8 @@ accounting { send { - # Write SQL queries to a logfile. This is potentially useful for bulk inserts - # when used with the rlm_sql_null driver. + # Write SQL queries to a logfile. This is potentially useful for + # bulk inserts when used with the rlm_sql_null driver. # logfile = ${logdir}/post-auth.sql access-accept { diff --git a/raddb/mods-config/sql/main/mysql/extras/wimax/queries.conf b/raddb/mods-config/sql/main/mysql/extras/wimax/queries.conf index b1f37000741..bf5cdadae54 100644 --- a/raddb/mods-config/sql/main/mysql/extras/wimax/queries.conf +++ b/raddb/mods-config/sql/main/mysql/extras/wimax/queries.conf @@ -4,18 +4,17 @@ ## ## $Id$ -# Safe characters list for sql queries. Everything else is replaced -# with their mime-encoded equivalents. -# The default list should be ok +# Safe characters list for sql queries. Everything else is replaced +# with their mime-encoded equivalents. The default list should be ok #safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" ####################################################################### -# Query config: Username +# Query config: Username ####################################################################### -# This is the username that will get substituted, escaped, and added -# as attribute 'SQL-User-Name'. '%{SQL-User-Name}' should be used below -# everywhere a username substitution is needed so you you can be sure -# the username passed from the client is escaped properly. +# This is the username that will get substituted, escaped, and added +# as attribute 'SQL-User-Name'. '%{SQL-User-Name}' should be used +# below everywhere a username substitution is needed so you you can +# be sure the username passed from the client is escaped properly. # # Uncomment the next line, if you want the sql_user_name to mean: # @@ -27,9 +26,9 @@ sql_user_name = "%{User-Name}" ####################################################################### -# Logging of WiMAX SPI -> key mappings +# Logging of WiMAX SPI -> key mappings ####################################################################### -# postauth_query - Insert some info after authentication +# postauth_query - Insert some info after authentication ####################################################################### postauth_query = "INSERT INTO wimax \ diff --git a/raddb/mods-config/sql/main/mysql/queries.conf b/raddb/mods-config/sql/main/mysql/queries.conf index 35c2c8709be..05e81dd1125 100644 --- a/raddb/mods-config/sql/main/mysql/queries.conf +++ b/raddb/mods-config/sql/main/mysql/queries.conf @@ -1,29 +1,30 @@ # -*- text -*- # -# main/mysql/queries.conf-- MySQL configuration for default schema (schema.sql) +# main/mysql/queries.conf-- MySQL configuration for default schema +# (schema.sql) # # $Id$ ####################################################################### # Connection config ####################################################################### -# The character set is configured using the driver option `character_set` -# in mods-config/sql/driver/mysql +# The character set is configured using the driver option +# `character_set` in mods-config/sql/driver/mysql # -# To control other client library options, create / edit my.cnf (typically -# in /etc/mysql/my.cnf or /etc/my.cnf) and enter -# [freeradius] -#