From: Alan T. DeKok Date: Thu, 29 Jun 2017 17:41:20 +0000 (-0400) Subject: remove more references to proxy.conf X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=655abe20925fc3d33958548fd13e85732bb0bb9b;p=thirdparty%2Ffreeradius-server.git remove more references to proxy.conf --- diff --git a/doc/modules/ldap_howto.rst b/doc/modules/ldap_howto.rst index 28f95d84510..0065ce6a3f4 100644 --- a/doc/modules/ldap_howto.rst +++ b/doc/modules/ldap_howto.rst @@ -979,9 +979,8 @@ will process the modules in the order specified in the authorization section of radiusd.conf. Currently, they are in the following order. 1) preprocess -2) suffix -3) files -4) ldap +2) files +3) ldap The first module will be preprocess. This will first check the huntgroups of the user coming in. The huntgroups are defined in the file huntgroups and they @@ -1001,45 +1000,6 @@ server, and add additional hacks that are based on the type of request that comes in. This is to help with certain NAS's that don't conform to radius RFC's. Check the comments in radiusd.conf for an explanation on those. -The second module is suffix. This event will determine which realm the user is -in, based on the User-Name attribute. It is currently setup to split the -username at the occurence of the @symbol. For example, the username of -example@mydomain.com, will be split into example and mydomain.com. The realm -is then checked against the file proxy.conf, which will determine what actions -should be taken for that realm. Certain realms can be setup to be proxied to a -different radius server or set to authenticate locally. Also, the username can -be setup to be stripped from the realm or left intact. An example of -proxy.conf, is listed below. If the realm is to be proxied, then a secret is -needed, which is the secret of the radius server it is to be proxied to. -By default the User-Name will be stripped, unless the nostrip option is set. - -Currently we will not be using realms with our users, but adding this ability -in the future will be much easier with already incorporating proxy.conf into the -setup:: - - proxy server { - synchronous = no - retry_delay = 5 - retry_count = 3 - dead_time = 120 - servers_per_realm = 15 - default_fallback = yes - } - - realm NULL { - type = radius - authhost = LOCAL - accthost = LOCAL - #secret = testing123 - } - - realm DEFAULT { - type = radius - authhost = LOCAL - accthost = LOCAL - #secret = testing123 - } - The next module is files, which is commonly know as the users file. The users file will start with either a username to determine how to authorize a specific user, or a DEFAULT setting. In each line it will define what items must be @@ -1424,33 +1384,6 @@ edit huntgroups to specify a NAS to a huntgroup:: dialup NAS-IP-Address == 10.10.10.3 ----End huntgroups---- -* edit proxy.conf to setup the different realms:: - - ----Begin proxy.conf---- - proxy server { - synchronous = no - retry_delay = 5 - retry_count = 3 - dead_time = 120 - servers_per_realm = 15 - default_fallback = yes - } - - realm NULL { - type = radius - authhost = LOCAL - accthost = LOCAL - #secret = testing123 - } - - realm DEFAULT { - type = radius - authhost = LOCAL - accthost = LOCAL - #secret = testing123 - } - ----End proxy.conf---- - -edit clients.conf to setup the NAS's that can talk to it diff --git a/doc/modules/rlm_passwd b/doc/modules/rlm_passwd index 59f4a5992aa..d97cf77f1e9 100644 --- a/doc/modules/rlm_passwd +++ b/doc/modules/rlm_passwd @@ -31,14 +31,6 @@ A: rlm_passwd supports passwd files in any format and may be used, for under Linux, you can choose between rlm_unix and rlm_passwd, probably you will have nearly same results in performance (I hope :) ). -Q: I'm using realms with rlm_passwd. I see rlm_passwd do not strip realm - from user name. How to configure rlm_passwd to strip realm? - -A: In case you configured realm to strip username, User-Password attribute - is not changed. Instead, rlm_realm creates new attribute Stripped-User-Name. - All you need is to use Stripped-User-Name instead of User-Name as a key - field for passwd file. - Q: How can I say passwd to add attribute even if it's value is empty? A: set ignore_empty to "no" in module configuration. diff --git a/man/man5/rlm_attr_filter.5 b/man/man5/rlm_attr_filter.5 index adb61301eb5..030f1689310 100644 --- a/man/man5/rlm_attr_filter.5 +++ b/man/man5/rlm_attr_filter.5 @@ -23,10 +23,8 @@ decisions, such as restricting a client to certain ranges of Idle-Timeout or Session-Timeout. .PP Filter rules are normally defined and applied on a per-realm basis, -where the realm is anything that is defined and matched based on the -configuration of the \fIrlm_realm\fP module. Filter rules can -optionally be applied using another attribute, by editing the -\fIkey\fP configuration for this module. +Filter rules can optionally be applied using another attribute, by +editing the \fIkey\fP configuration for this module. .PP In 2.0.1 and earlier versions, the "accounting" section filtered the Accounting-Request, even though it was documented as filtering the diff --git a/raddb/radrelay.conf.in b/raddb/radrelay.conf.in index 8dcab8b80d8..6b455c16e3d 100644 --- a/raddb/radrelay.conf.in +++ b/raddb/radrelay.conf.in @@ -96,7 +96,7 @@ instantiate { proxy_requests = yes # -# See proxy.conf for additional home server configuration. +# See v3 for what this is... # home_server home1 { type = acct diff --git a/raddb/sites-available/default b/raddb/sites-available/default index 015521c01e9..40406bc9414 100644 --- a/raddb/sites-available/default +++ b/raddb/sites-available/default @@ -72,18 +72,6 @@ listen { # type = auth - # Note: "type = proxy" lets you control the source IP used for - # proxying packets, with some limitations: - # - # * A proxy listener CANNOT be used in a virtual server section. - # * You should probably set "port = 0". - # * Any "clients" configuration will be ignored. - # - # See also proxy.conf, and the "src_ipaddr" configuration entry - # in the sample "home_server" section. When you specify the - # source IP address for packets sent to a home server, the - # proxy listeners are automatically created. - # ipaddr/ipv4addr/ipv6addr - IP address on which to listen. # Out of several options the first one will be used. # diff --git a/src/tests/vectors/eapsim-03/radiusd-example.txt b/src/tests/vectors/eapsim-03/radiusd-example.txt index cf31340b719..5de3c1aa736 100644 --- a/src/tests/vectors/eapsim-03/radiusd-example.txt +++ b/src/tests/vectors/eapsim-03/radiusd-example.txt @@ -334,26 +334,6 @@ security { status_server = no } -# PROXY CONFIGURATION -# -# proxy_requests: Turns proxying of RADIUS requests on or off. -# -# The server has proxying turned on by default. If your system is NOT -# set up to proxy requests to another server, then you can turn proxying -# off here. This will save a small amount of resources on the server. -# -# If you have proxying turned off, and your configuration files say -# to proxy a request, then an error message will be logged. -# -# To disable proxying, change the "yes" to "no", and comment the -# $INCLUDE line. -# -# allowed values: {no, yes} -# -proxy_requests = yes -$INCLUDE ${confdir}/proxy.conf - - # CLIENTS CONFIGURATION # # Client configuration is defined in "clients.conf".