#
# = Client Definitions
#
-# The `clients.conf` file defines global clients. These clients are
-# systems which are permitted to send packets to the server. For
+# The `clients.conf` file defines global clients. These clients are
+# systems which are permitted to send packets to the server. For
# security, packets from other IP addresses are ignored.
#
#
# == Client subsection
#
-# A client is defined via a section called `client NAME { ... }`.
-# The NAME field is mandatory, and is used as the "short name" of the
+# A client is defined via a section called `client NAME { ... }`. The
+# NAME field is mandatory, and is used as the "short name" of the
# client.
#
# The default configuration allows packets from 127.0.0.1, and no
-# other IP address. This configuration is to allow testing of the
-# server after an initial installation. If you are not going to be
+# other IP address. This configuration is to allow testing of the
+# server after an initial installation. If you are not going to be
# permitting RADIUS queries from localhost, we suggest that you
# delete, or comment out, the 'localhost' entry.
#
client localhost {
#
- # ipaddr:: define the unique IP address (or network) for this client.
+ # ipaddr:: define the unique IP address (or network) for this
+ # client.
#
- # NOTE: Only *one* of ipaddr, ipv4addr, ipv6addr may be
- # specified for a client.
+ # NOTE: Only *one* of ipaddr, ipv4addr, ipv6addr may be specified
+ # for a client.
#
# IPv4 or IPv6 addresses with optional CIDR notation `/<mask>` to
# specify ranges can be used. `ipaddr` will also accept domain
# names, e.g. `example.org`, and will resolve the name via DNS
# (however, see note of recommendation below).
#
- # If both A and AAAA records are found, A records will be
- # used in preference to AAAA.
+ # If both A and AAAA records are found, A records will be used in
+ # preference to AAAA.
#
ipaddr = 127.0.0.1
#
- # ipv4addr:: Similar to `ipaddr`, but only allows v4
- # addresses. Looks up A record for domain names.
+ # ipv4addr:: Similar to `ipaddr`, but only allows v4 addresses.
+ # Looks up A record for domain names.
#
# * `*` is "any" address.
# * `127.0.0.1` is localhost.
# ipv4addr = *
#
- # ipv6addr:: Similar to `ipaddr` but only allows v6
- # addresses. Looks up AAAA record for domain names.
+ # ipv6addr:: Similar to `ipaddr` but only allows v6 addresses. Looks
+ # up AAAA record for domain names.
#
# * `::` is "any" address.
# * `::1` is localhost.
# ipv6addr = ::
#
- # NOTE: We *strongly* recommend using IP addresses instead of
- # host names. Using host names means that the server will do
- # DNS lookups when it starts, making it dependent on DNS.
- # i.e. If anything goes wrong with DNS, the server won't
- # start!
+ # NOTE: We *strongly* recommend using IP addresses instead of host
+ # names. Using host names means that the server will do DNS lookups
+ # when it starts, making it dependent on DNS. i.e. If anything goes
+ # wrong with DNS, the server won't start!
#
- # The server also looks up the IP address from DNS once, and
- # only once, when it starts. If the DNS record is later
- # updated, the server *will not* see that update.
+ # The server also looks up the IP address from DNS once, and only
+ # once, when it starts. If the DNS record is later updated, the
+ # server *will not* see that update.
#
#
# proto:: The transport protocol used by this client.
#
- # If unspecified, defaults to "udp", which is the traditional
- # RADIUS transport. It may also be "tcp", in which case the
- # server will accept connections from this client *only* over TCP.
+ # If unspecified, defaults to "udp", which is the traditional RADIUS
+ # transport. It may also be "tcp", in which case the server will
+ # accept connections from this client *only* over TCP.
#
proto = *
#
- # secret:: The shared secret use to "encrypt" and "sign"
- # packets between the NAS and FreeRADIUS. You *must*
- # change this secret from the default, otherwise it's not
- # a secret any more!
+ # secret:: The shared secret use to "encrypt" and "sign" packets
+ # between the NAS and FreeRADIUS. You *must* change this secret from
+ # the default, otherwise it's not a secret any more!
#
# The secret can be any string, up to 8k characters in length.
#
#
# `secret = """foo"bar"""
#
- # A note on security: The security of the RADIUS protocol
- # depends COMPLETELY on this secret! We recommend using a
- # shared secret that at LEAST 16 characters long. It should
- # preferably be 32 characters in length. The secret MUST be
- # random, and should not be words, phrase, or anything else
- # that is recognisable.
- #
- # Computing power has increased enormously since RADIUS was
- # first defined. A hobbyist with a high-end GPU can try ALL
- # of the 8-character shared secrets in about a day. The
- # security of shared secrets increases MUCH more with the
- # length of the shared secret, than with number of different
- # characters used in it. So don't bother trying to use
- # "special characters" or anything else in an attempt to get
- # un-guessable secrets. Instead, just get data from a secure
- # random number generator, and use that.
+ # A note on security: The security of the RADIUS protocol depends
+ # COMPLETELY on this secret! We recommend using a shared secret that
+ # at LEAST 16 characters long. It should preferably be 32 characters
+ # in length. The secret MUST be random, and should not be words,
+ # phrase, or anything else that is recognisable.
+ #
+ # Computing power has increased enormously since RADIUS was first
+ # defined. A hobbyist with a high-end GPU can try ALL of the
+ # 8-character shared secrets in about a day. The security of shared
+ # secrets increases MUCH more with the length of the shared secret,
+ # than with number of different characters used in it. So don't
+ # bother trying to use "special characters" or anything else in an
+ # attempt to get un-guessable secrets. Instead, just get data from a
+ # secure random number generator, and use that.
#
# You should create shared secrets using a method like this:
#
# dd if=/dev/random bs=1 count=24 | base64
#
- # This process will give output which takes 24 random bytes,
- # and converts them to 32 characters of ASCII. The output
- # should be accepted by all RADIUS clients.
+ # This process will give output which takes 24 random bytes, and
+ # converts them to 32 characters of ASCII. The output should be
+ # accepted by all RADIUS clients.
#
- # You should NOT create shared secrets by hand. They will
- # not be random. They will will be trivial to crack.
+ # You should NOT create shared secrets by hand. They will not be
+ # random. They will will be trivial to crack.
#
- # The default secret below is only for testing, and should
- # not be used in any real environment.
+ # The default secret below is only for testing, and should not be
+ # used in any real environment.
#
secret = testing123
#
- # require_message_authenticator::Require Message-Authenticator in Access-Requests.
+ # require_message_authenticator::Require Message-Authenticator in
+ # Access-Requests.
#
- # RFC 5080 suggests that all clients *should* include it in
- # an Access-Request. The configuration item below allows the
- # server to require it. If a client is required to include a
- # `Message-Authenticator` and it does not, then the packet
- # will be silently discarded.
+ # RFC 5080 suggests that all clients *should* include it in an
+ # Access-Request. The configuration item below allows the server to
+ # require it. If a client is required to include a
+ # `Message-Authenticator` and it does not, then the packet will be
+ # silently discarded.
#
- # If value is` auto`, then when an `Access-Request` packet from
- # the client contains a valid `Message-Authenticator`
- # attribute, the server will then require that it exist in
- # all future `Access-Request` packets from that client.
+ # If value is` auto`, then when an `Access-Request` packet from the
+ # client contains a valid `Message-Authenticator` attribute, the
+ # server will then require that it exist in all future
+ # `Access-Request` packets from that client.
#
- # This flag exists solely for legacy clients which do not
- # send `Message-Authenticator` in all `Access-Request`
- # packets. We do not recommend setting it to `no`, as that
- # may allow the BlastRADIUS attack to take place.
+ # This flag exists solely for legacy clients which do not send
+ # `Message-Authenticator` in all `Access-Request` packets. We do not
+ # recommend setting it to `no`, as that may allow the BlastRADIUS
+ # attack to take place.
#
- # The number one way to protect yourself from the BlastRADIUS
- # attack is to update all RADIUS servers, and then set this
- # flag to `yes`. If all RADIUS servers are updated, and if
- # all of them have this flag set to `yes` for all clients,
- # then your network is safe. You can then upgrade the
- # clients when it is convenient, instead of rushing the
- # upgrades.
+ # The number one way to protect yourself from the BlastRADIUS attack
+ # is to update all RADIUS servers, and then set this flag to `yes`.
+ # If all RADIUS servers are updated, and if all of them have this
+ # flag set to `yes` for all clients, then your network is safe. You
+ # can then upgrade the clients when it is convenient, instead of
+ # rushing the upgrades.
#
- # NOTE: This per-client setting overrides the identically
- # named configuration item in the `listen` section.
+ # NOTE: This per-client setting overrides the identically named
+ # configuration item in the `listen` section.
#
# Allowed values: yes, no, auto
#
#
# limit_proxy_state:: Control whether Proxy-State is allowed in
- # packets from this client which do not have a `Message-Authenticator`.
+ # packets from this client which do not have a
+ # `Message-Authenticator`.
#
# The BlastRADIUS attack allows an attacker to manipulate the
- # contents of responses to `Access-Request` packets, without
- # knowing the shared secret.
+ # contents of responses to `Access-Request` packets, without knowing
+ # the shared secret.
#
# The attack relies on controlling a portion of the data sent back
# in the response by the RADIUS server. As Proxy-State is always
# manipulate the data sent back from the server and facilitate the
# attack.
#
- # The attack also relies on deficiencies in the original
- # RADIUS standards which do not provide xintegrity protection
- # for `Access-Request`s.
+ # The attack also relies on deficiencies in the original RADIUS
+ # standards which do not provide xintegrity protection for
+ # `Access-Request`s.
#
# The attack is mitigated by requiring the Message-Authenticator,
# which contains a HMAC over the entire request, preventing
# modification of the request by the attacker.
#
- # If value is` auto`, then when an `Access-Request` packet
- # from the client contains does not contain a `Proxy-State`
- # attribute, the server will the discard `Access-Request`
- # packets from the client which contain `Proxy-State`, but no
- # `Message-Authenticator.
+ # If value is` auto`, then when an `Access-Request` packet from the
+ # client contains does not contain a `Proxy-State` attribute, the
+ # server will the discard `Access-Request` packets from the client
+ # which contain `Proxy-State`, but no `Message-Authenticator.
#
- # This provides some level of protection against the
- # blastradius attack, without requiring
- # `Message-Authenticator` in all packets, or breaking
- # existing deployments.
+ # This provides some level of protection against the blastradius
+ # attack, without requiring `Message-Authenticator` in all packets,
+ # or breaking existing deployments.
#
- # NOTE: This setting overrides the identically named config item in the
- # radius `listen` section.
+ # NOTE: This setting overrides the identically named config item in
+ # the radius `listen` section.
#
# Allowed values: yes, no, auto
#
# shortname:: The short name is used as an alias for the fully
# qualified domain name, or the IP address.
#
- # It is accepted for compatibility with 1.x, but it is no
- # longer necessary in >= 2.0.
+ # It is accepted for compatibility with 1.x, but it is no longer
+ # necessary in >= 2.0.
#
- # By default, `shortname` is set to the name of the subsection.
- # e.g. if we have `client localhost {...}`, then `shortname`
- # is set to `localhost`.
+ # By default, `shortname` is set to the name of the subsection. e.g.
+ # if we have `client localhost {...}`, then `shortname` is set to
+ # `localhost`.
#
# shortname = localhost
# max_connections:: Limit the number of simultaneous TCP
# connections from a client.
#
- # The default is 16.
- # Setting this to 0 means "no limit".
+ # The default is 16. Setting this to 0 means "no limit".
#
max_connections = 16
# The per-socket "max_requests" option does not exist.
#
- # lifetime:: The lifetime, in seconds, of a TCP connection.
- # After this lifetime, the connection will be closed.
+ # lifetime:: The lifetime, in seconds, of a TCP connection. After
+ # this lifetime, the connection will be closed.
#
# Setting this to 0 means "forever".
#
lifetime = 0
#
- # idle_timeout:: The idle timeout, in seconds, of a TCP
- # connection. If no packets have been received over the
- # connection for this time, the connection will be closed.
+ # idle_timeout:: The idle timeout, in seconds, of a TCP connection.
+ # If no packets have been received over the connection for this
+ # time, the connection will be closed.
#
# Setting this to 0 means "no timeout".
#
#
#
-# Defining an IPv6 client for `localhost` using the `ipv6addr` option.
+# Defining an IPv6 client for `localhost` using the `ipv6addr`
+# option.
#
client localhost_ipv6 {
ipv6addr = ::1
#
# All IPv6 Site-local clients
#
-#client sitelocal_ipv6 {
+# client sitelocal_ipv6 {
# ipv6addr = fe80::/16
# secret = testing123
-#}
+# }
#
-# Client that uses a DNS hostname.
-# (See important note on the use of hostname above.)
+# Client that uses a DNS hostname. (See important note on the use of
+# hostname above.)
#
-#client example.org {
+# client example.org {
# ipaddr = radius.example.org
# secret = testing123
-#}
+# }
#
-# You can specify one secret for a network of clients.
-# When a client request comes in, the *best* match is chosen,
-# i.e. the entry from the smallest possible network.
+# You can specify one secret for a network of clients. When a client
+# request comes in, the *best* match is chosen, i.e. the entry from
+# the smallest possible network.
#
-#client private-network-1 {
+# client private-network-1 {
# ipaddr = 192.0.2.0/24
# secret = testing123-1
-#}
+# }
-#client private-network-2 {
+# client private-network-2 {
# ipaddr = 198.51.100.0/24
# secret = testing123-2
-#}
+# }
#
# = Debugging configuration
#
-# This is a minimal configuration file used when debugging the
-# source code.
+# This is a minimal configuration file used when debugging the source
+# code.
#
# This file should not be installed by `make install`, or by any
# packaging system. It is only for developers.
#
# = Local dictionary definitions
#
-# This is the local dictionary file which can be
-# edited by local administrators. It will be loaded
-# *after* the main dictionary files are loaded.
+# This is the local dictionary file which can be edited by local
+# administrators. It will be loaded *after* the main dictionary files
+# are loaded.
#
#
# NOTE: We recommend using local variables inside of "unlang"
#
# FreeRADIUS will automatically load the main dictionary files from:
#
-# ${prefix}/share/freeradius/dictionary
+# ${prefix}/share/freeradius/dictionary
#
# It is no longer necessary for this file to `$INCLUDE` the main
-# dictionaries from this file. However, if the `$INCLUDE` line is
+# dictionaries from this file. However, if the `$INCLUDE` line is
# here, nothing bad will happen.
#
# == Dictionaries per Virtual Server
#
# v4 also supports a `dictionary { ... }` subsection in a virtual
-# server. If the attributes are used only in one virtual server,
-# they should be defined there.
+# server. If the attributes are used only in one virtual server, they
+# should be defined there.
#
#
# == Editing the dictionary
#
-# Any new/changed attributes *must* be placed in this file.
-# The pre-defined dictionaries *should not* be edited.
-# See `man dictionary` for documentation on how dictionary
-# entries should be formatted.
+# Any new/changed attributes *must* be placed in this file. The
+# pre-defined dictionaries *should not* be edited. See `man
+# dictionary` for documentation on how dictionary entries should be
+# formatted.
#
-# All local attributes and `$INCLUDE` directives should
-# go into this files.
+# All local attributes and `$INCLUDE` directives should go into this
+# files.
#
-# The attribute definitions here should use `DEFINE`, not `ATTRIBUTE`.
-# The `DEFINE` keyword is exactly like `ATTRIBUTE`, except it does not
-# require an attribute number.
+# The attribute definitions here should use `DEFINE`, not
+# `ATTRIBUTE`. The `DEFINE` keyword is exactly like `ATTRIBUTE`,
+# except it does not require an attribute number.
#
# As a result, there is no need to manually manage numbers.
#
# Any attribute `DEFINE`d here will not go into a packet.
#
-# If you do want attributes to go into a RADIUS packet, you
-# will need to use VSAs. This means requesting allocation
-# of a Private Enterprise Code from https://www.iana.org/. We
-# strongly suggest doing that *only* if you are a vendor of
-# RADIUS equipment.
+# If you do want attributes to go into a RADIUS packet, you will need
+# to use VSAs. This means requesting allocation of a Private
+# Enterprise Code from https://www.iana.org/. We strongly suggest
+# doing that *only* if you are a vendor of RADIUS equipment.
#
# See RFC 6158 for more details:
# http://ietf.org/rfc/rfc6158.txt
# required, or add your own.
#
-#DEFINE My-Local-String string
-#DEFINE My-Local-IPAddr ipaddr
-#DEFINE My-Local-Integer integer
+# DEFINE My-Local-String string DEFINE My-Local-IPAddr ipaddr DEFINE
+# My-Local-Integer integer
#
# == v3 Compatibility and Migration
#
-# By default, the server does NOT load the v3 names. While this
+# By default, the server does NOT load the v3 names. While this
# behavior is done to simplify the server configuration, it can also
# make migration more difficult.
#
# If your system is using Vendor-Specific attributes from a
-# particular vendor, you can list those dictionaries below. The
+# particular vendor, you can list those dictionaries below. The
# server will then load the version 3 names, which makes migration
# much simpler.
#
-# For v4, all of the attributes have been renamed from v3. This
-# change was necessary in order to support new functionality. The
+# For v4, all of the attributes have been renamed from v3. This
+# change was necessary in order to support new functionality. The
# unfortunate side effect of this change is that all of the attribute
# names used by v3 in the SQL, LDAP, and "files" module are
# incompatible with v4.
#
# The problem with v3 was that names were all in flat lists, so that
-# User-Name appeared in the same list as Cisco-AVPAir. This
+# User-Name appeared in the same list as Cisco-AVPAir. This
# organization was simple enough to work for 25 years, but its time
-# has come. The new names are hierarchical, which means they are
+# has come. The new names are hierarchical, which means they are
# organized into a tree-like structure.
#
-# For v4, the Cisco-AVPair attribute is now called "AVPair". It
-# lives inside of the "Cisco" namespace, which in turn lives inside
-# of the "Vendor-Specific" namespace. So the new name for
-# `Cisco-AVPair` is `Vendor-Specific.Cisco.AVPair`.
+# For v4, the Cisco-AVPair attribute is now called "AVPair". It lives
+# inside of the "Cisco" namespace, which in turn lives inside of the
+# "Vendor-Specific" namespace. So the new name for `Cisco-AVPair` is
+# `Vendor-Specific.Cisco.AVPair`.
#
# These changes have been made for many hundreds of dictionary files,
# and many thousands of Vendor-Specific attributes.
#
# In the interest of compatibility, is possible to use the old names
-# with v4. There are some limitations, but it will generally work.
+# with v4. There are some limitations, but it will generally work.
# The main reason for enabling the old names is to try out v4 with a
-# database that is also used by v3. This lets you test that v4
-# works, without going through a complex process to upgrade
-# everything.
+# database that is also used by v3. This lets you test that v4 works,
+# without going through a complex process to upgrade everything.
#
# The old v3 names are in "v3" dictionaries, in the `${dictdir}`
-# directory. To find out where this directory is on your local
-# system, run "radiusd -h" or "radclient -h". Then look for the "-D"
+# directory. To find out where this directory is on your local
+# system, run "radiusd -h" or "radclient -h". Then look for the "-D"
# command-line option, and it will tell you where the dictionary
# files are located.
#
# The default v4 dictionaries do not enable all of v3 compatibility
# names.
#
-# We recognize that this process is a bit of work. However, we
-# wish to encourage everyone using v4 to upgrade to using the new v4
-# features. Our experience shows that if we automatically enable
+# We recognize that this process is a bit of work. However, we wish
+# to encourage everyone using v4 to upgrade to using the new v4
+# features. Our experience shows that if we automatically enable
# "compatibility functions", then those compatibility functions will
-# be used for a decade. So we need to find a balance between
-# upgrades and ongoing support. Easy upgrades will mean complex
-# ongoing support. Complex upgrades make ongoing support easier, but
-# also make it less likely that people will upgrade.
+# be used for a decade. So we need to find a balance between upgrades
+# and ongoing support. Easy upgrades will mean complex ongoing
+# support. Complex upgrades make ongoing support easier, but also
+# make it less likely that people will upgrade.
#
# Note that if you over-write the "v3/dictionary.VENDOR" files with a
-# copy of the v3 dictionary, then it won't work. Migrations across
+# copy of the v3 dictionary, then it won't work. Migrations across
# major version numbers means that the configuration files are *not*
# 100% compatible. This includes the dictionaries!
#
-# The v3 compatibility names are in the RADIUS namespace.
-# There are no aliases for DHCPv4.
+# The v3 compatibility names are in the RADIUS namespace. There are
+# no aliases for DHCPv4.
#
-#BEGIN-PROTOCOL RADIUS
-#$INCLUDE ${dictdir}/radius/v3/dictionary.cisco
-#$INCLUDE ${dictdir}/radius/v3/dictionary.aruba
-#END-PROTOCOL RADIUS
+# BEGIN-PROTOCOL RADIUS $INCLUDE
+# ${dictdir}/radius/v3/dictionary.cisco $INCLUDE
+# ${dictdir}/radius/v3/dictionary.aruba END-PROTOCOL RADIUS
#
-# This dictionary includes v3-compatible names like "Cleartext-Password",
-# or "NT-Password".
+# This dictionary includes v3-compatible names like
+# "Cleartext-Password", or "NT-Password".
#
-#$INCLUDE ${dictdir}/freeradius/v3/dictionary.freeradius.internal
+# $INCLUDE ${dictdir}/freeradius/v3/dictionary.freeradius.internal
#
-# Any local dictionaries can be added in the `dictionary.d` subdirectory.
+# Any local dictionaries can be added in the `dictionary.d`
+# subdirectory.
#
# The server will load all files in that directory, but will skip
-# editor backup files, and others which are known to not be real files.
+# editor backup files, and others which are known to not be real
+# files.
#
$INCLUDE- dictionary.d/
#
# ldap_debug:: Debug flags for libldap (see OpenLDAP documentation).
- # Set this to enable debugging output from different code areas within libldap.
+ # Set this to enable debugging output from different code areas
+ # within libldap.
#
- # NOTE: These debugging options can produce significant amounts of logging output.
+ # NOTE: These debugging options can produce significant amounts of
+ # logging output.
#
# [options="header,autowidth"]
# |===
#
# path::
#
- # The search path for Python modules. It must include the path to your
- # Python module.
+ # The search path for Python modules. It must include the path to
+ # your Python module.
#
# path = ${modconfdir}/${.:name}
#
# path_include_default::
#
- # If "yes", retain the default search path. Any additional search
+ # If "yes", retain the default search path. Any additional search
# path components will be prepended to the default search path.
#
# path_include_default = "yes"
# = Always Module
#
# The `always` module simply returns the same result, always, without
-# doing anything else. It is here for use in complex policies.
+# doing anything else. It is here for use in complex policies.
#
-# The main configuration item is `rcode`, which sets the return code that
-# this instantiation of the module will return. The default, if none
-# specified, is 'fail'.
+# The main configuration item is `rcode`, which sets the return code
+# that this instantiation of the module will return. The default, if
+# none specified, is 'fail'.
#
#
# == Syntax
#
##always <name> {
- #
- # rcode:: Return code.
- #
- # The `rcode` may be one of the following values:
- #
- # [options="header,autowidth"]
- # |===
- # | Parameter | Description
- # | `reject` | Reject the user.
- # | `fail` | Simulate or indicate a failure.
- # | `ok` | Simulate or indicate a success.
- # | `handled` | Indicate that the request has been handled,
- # stop processing, and send response if set.
- # | `invalid` | Indicate that the request is invalid.
- # | `disallow` | Indicate that the user account has been
- # locked out.
- # | `notfound` | Indicate that a user account can't be found.
- # | `noop` | Simulate a no-op.
- # | `updated` | Indicate that the request has been updated.
- # |===
- #
+#
+# rcode:: Return code.
+#
+# The `rcode` may be one of the following values:
+#
+# [options="header,autowidth"]
+# |===
+# | Parameter | Description
+# | `reject` | Reject the user.
+# | `fail` | Simulate or indicate a failure.
+# | `ok` | Simulate or indicate a success.
+# | `handled` | Indicate that the request has been handled,
+# stop processing, and send response if set.
+# | `invalid` | Indicate that the request is invalid.
+# | `disallow` | Indicate that the user account has been
+# locked out.
+# | `notfound` | Indicate that a user account can't be found.
+# | `noop` | Simulate a no-op.
+# | `updated` | Indicate that the request has been updated.
+# |===
+#
## rcode = <value>
#
# simulcount::
#
- # If an instance of this module is listed in a `session {}`
- # section, this simulates a user having `<integer>` number of sessions.
+ # If an instance of this module is listed in a `session {}` section,
+ # this simulates a user having `<integer>` number of sessions.
#
## simulcount = <integer>
#
# mpp::
#
- # If an instance is listed in a `session {}` section, this
- # simulates the user having multilink sessions.
+ # If an instance is listed in a `session {}` section, this simulates
+ # the user having multilink sessions.
#
## mpp = <integer>
##}
#
# == xlat for peeking and poking the status
#
-# An xlat based on the instance name can be called to change the status
-# returned by the instance.
+# An xlat based on the instance name can be called to change the
+# status returned by the instance.
#
# .Example
#
# ...
# ```
#
-# The above xlats expand to the current status of the module. To fetch the
-# current status without affecting it call the xlat with an empty argument:
+# The above xlats expand to the current status of the module. To
+# fetch the current status without affecting it call the xlat with an
+# empty argument:
#
# .Example
#
#
# = Attr_filter Module
#
-# The `attr_filter` module exists for filtering certain attributes and
-# values in received (or transmitted) radius packets. It gives the
-# server a flexible framework to filter the attributes we send to or
-# receive from home servers or NASes. This makes sense, for example,
-# in an out-sourced dialup situation to various policy decisions, such as
-# restricting a client to certain ranges of `Idle-Timeout` or `Session-Time-out`.
-#
-# Filter rules are normally defined and applied on a per-realm basis, Filter
-# rules can optionally be applied using another attribute, by editing the key
-# configuration for this module.
-#
-# The rules for each entry are parsed to top to bottom, and an attribute
-# must pass *all* the rules which affect it in order to make it past the filter.
-# Order of the rules is important.
-# The operators and their purpose in defining the rules are as follows:
+# The `attr_filter` module exists for filtering certain attributes
+# and values in received (or transmitted) radius packets. It gives
+# the server a flexible framework to filter the attributes we send to
+# or receive from home servers or NASes. This makes sense, for
+# example, in an out-sourced dialup situation to various policy
+# decisions, such as restricting a client to certain ranges of
+# `Idle-Timeout` or `Session-Time-out`.
+#
+# Filter rules are normally defined and applied on a per-realm basis,
+# Filter rules can optionally be applied using another attribute, by
+# editing the key configuration for this module.
+#
+# The rules for each entry are parsed to top to bottom, and an
+# attribute must pass *all* the rules which affect it in order to
+# make it past the filter. Order of the rules is important. The
+# operators and their purpose in defining the rules are as follows:
#
# [options="header", cols="10%,90%"]
# |===
# | < | Less Than.
# |===
#
-# If regular expressions are enabled the following operators are also possible.
-# (Regular Expressions are included by default unless your system doesn't support
-# them, which should be rare). The value field uses standard regular expression syntax.
+# If regular expressions are enabled the following operators are also
+# possible. (Regular Expressions are included by default unless your
+# system doesn't support them, which should be rare). The value field
+# uses standard regular expression syntax.
#
# [options="header", cols="10%,90%"]
# |===
# The configuration items are:
#
##attr_filter attr_filter.<section> {
- #
- # key:: The `key` to use for filter the packets.
- #
+#
+# key:: The `key` to use for filter the packets.
+#
## key = "<value>"
#
- # relaxed:: Only move attribute if it passed all rules, or if the config says we
- # should copy unmatched attributes.
+ # relaxed:: Only move attribute if it passed all rules, or if the
+ # config says we should copy unmatched attributes.
#
## relaxed = no
#
# === pre-proxy
#
-# Filters the attributes in the packets we send to
-# the RADIUS home servers.
+# Filters the attributes in the packets we send to the RADIUS home
+# servers.
#
# Add this before calling rlm_radius for proxying.
#
#
# === post-proxy
#
-# Filters the attributes received in replies from proxied
-# servers, to make sure we send back to our RADIUS client
-# only allowed attributes.
+# Filters the attributes received in replies from proxied servers, to
+# make sure we send back to our RADIUS client only allowed
+# attributes.
#
# Add this after calling `rlm_radius` for proxying.
#
# === accounting_response
#
# Enforce RFC requirements on the contents of the
-# `Accounting-Response` packets. Called from the
-# `send Accounting-Response` section.
+# `Accounting-Response` packets. Called from the `send
+# Accounting-Response` section.
#
attr_filter attr_filter.accounting_response {
key = User-Name
}
#
- # large_window:: Allow window sizes outside of the range permitted by RFC 7932
+ # large_window:: Allow window sizes outside of the range permitted
+ # by RFC 7932
#
# Changes the behaviour of both the compressor and decompressor.
#
#
# = Cache Module
#
-# The `cache` module is used to cache attributes. The idea is that you can look
-# up information in a database, and then cache it. Repeated requests for the same
-# information will then have the cached values added to the request.
+# The `cache` module is used to cache attributes. The idea is that
+# you can look up information in a database, and then cache it.
+# Repeated requests for the same information will then have the
+# cached values added to the request.
#
-# The module can cache a fixed set of attributes per key.
-# It can be listed in any `recv` or `send` section.
+# The module can cache a fixed set of attributes per key. It can be
+# listed in any `recv` or `send` section.
#
# NOTE: If you want to have different things cached for different
# sections, you will need to define multiple instances of the module,
# driver = "rbtree"
#
- # NOTE: Some drivers accept specific options, to set them a config section with the
- # the name as the driver should be added to the cache instance.
+ # NOTE: Some drivers accept specific options, to set them a config
+ # section with the the name as the driver should be added to the
+ # cache instance.
#
# Driver specific options are:
#
}
#
- # key:: The `key` used to index the cache. It is dynamically expanded at run time.
+ # key:: The `key` used to index the cache. It is dynamically
+ # expanded at run time.
#
key = %{User-Name}
#
# ttl::
#
- # The TTL of cache entries, in seconds. Entries older than this
- # will be expired.
+ # The TTL of cache entries, in seconds. Entries older than this will
+ # be expired.
#
# This value should be between `10` and `86400`.
#
ttl = 10
#
- # NOTE: You can flush the cache via
- # `radmin -e "set module config cache epoch 123456789"`
- # Where last value is a 32-bit Unix timestamp. Cache entries older
- # than this are expired, as new entries added.
- # You should never set the "epoch" configuration item in this file.
+ # NOTE: You can flush the cache via `radmin -e "set module config
+ # cache epoch 123456789"` Where last value is a 32-bit Unix
+ # timestamp. Cache entries older than this are expired, as new
+ # entries added. You should never set the "epoch" configuration item
+ # in this file.
#
# add_stats::
#
# Each key gets the same set of cached attributes.
#
- # The operation of the `update` section is a little different
- # from normal `update` sections. This is because we need to
- # both reference the attributes which we want to store in the
- # cache, and also to describe where those attributes are
- # written to when the cache entry is read.
+ # The operation of the `update` section is a little different from
+ # normal `update` sections. This is because we need to both
+ # reference the attributes which we want to store in the cache, and
+ # also to describe where those attributes are written to when the
+ # cache entry is read.
#
- # The solution (albeit an imperfect one) is that the cache
- # does not store attributes, it stores `update` sections.
- # The `update` section given below is used as a template
- # for the cache entry.
+ # The solution (albeit an imperfect one) is that the cache does not
+ # store attributes, it stores `update` sections. The `update`
+ # section given below is used as a template for the cache entry.
#
- # When the cache entry is created, the right-hand side of
- # each attribute assignment line is expanded. The left-hand
- # side of the attribute assignment is left alone.
+ # When the cache entry is created, the right-hand side of each
+ # attribute assignment line is expanded. The left-hand side of the
+ # attribute assignment is left alone.
#
- # Once all of the right-hand side values are expanded, the
- # result is an `update` section with left-hand side
- # assignments, and right-hand side values. That `update`
- # section is then cached, indexed by the `key`
+ # Once all of the right-hand side values are expanded, the result is
+ # an `update` section with left-hand side assignments, and
+ # right-hand side values. That `update` section is then cached,
+ # indexed by the `key`
#
- # When the cache entry is read, it is looked up by the `key`,
- # and the cached `update` section is found. This cache entry
- # now has left-hand side assignments, and right-hand side
- # values. It is then applied to the current request.
+ # When the cache entry is read, it is looked up by the `key`, and
+ # the cached `update` section is found. This cache entry now has
+ # left-hand side assignments, and right-hand side values. It is then
+ # applied to the current request.
#
- # For example, if the `cache` module is configured with the
- # block below:
+ # For example, if the `cache` module is configured with the block
+ # below:
#
# update {
# reply.Reply-Message := "Hello %{User-Name}"
# }
#
- # When the cache entry is created, the module will expand the
- # right side of the entry, using the attributes from the
- # packet. In this case, the string could expand to `"Hello bob"`.
+ # When the cache entry is created, the module will expand the right
+ # side of the entry, using the attributes from the packet. In this
+ # case, the string could expand to `"Hello bob"`.
#
- # Once all of the right-hand values are expanded, the
- # resulting cache entry will look like this:
+ # Once all of the right-hand values are expanded, the resulting
+ # cache entry will look like this:
#
# update {
# reply.Reply-Message := "Hello bob"
# }
#
- # When the cache module is read, this `update` section is
- # applied just as if it had been specified in a configuration
- # file.
+ # When the cache module is read, this `update` section is applied
+ # just as if it had been specified in a configuration file.
#
- # NOTE: Only `request`, `reply`, `control` and
- # `session-state` lists are available for the left side of
- # cache entries. Attempting to reference other lists will
- # raise an error during config validation.
+ # NOTE: Only `request`, `reply`, `control` and `session-state` lists
+ # are available for the left side of cache entries. Attempting to
+ # reference other lists will raise an error during config
+ # validation.
#
update {
#
# represented by attributes in the `control.` list.
#
# control.Cache-TTL:: Sets the TTL of an entry to be created, or
- # modifies the TTL of an existing entry.
+ # modifies the TTL of an existing entry.
#
# [options="header,autowidth"]
# |===
# prevent a new entry from being created, and existing entries from
# being merged. It will also alter the module's return codes.
#
- # * The module will return `ok` if a cache entry was found.
- # * The module will return `notfound` if no cache entry was found.
+ # * The module will return `ok` if a cache entry was found.
+ # * The module will return `notfound` if no cache entry was found.
#
- # NOTE: If this is set to `yes`, no other cache control attributes will
- # be honoured, but they will still be cleared.
+ # NOTE: If this is set to `yes`, no other cache control attributes
+ # will be honoured, but they will still be cleared.
#
# control.Cache-Allow-Insert:: If present and set to `no` will
- # prevent a new entry from being created. If not present or set
- # to `yes`, and no entry exists, a new one will be created.
- # This is evaluated after `Cache-TTL`, so expired entries may be
- # recreated.
+ # prevent a new entry from being created. If not present or set to
+ # `yes`, and no entry exists, a new one will be created. This is
+ # evaluated after `Cache-TTL`, so expired entries may be recreated.
#
# control.Cache-Allow-Merge:: If present and set to `no` will
- # prevent existing entries from being merged. If not present or
- # set to `yes`, and an entry exists (and is valid), it will be
- # merged with the current request.
- # This is evaluated before `Cache-TTL`, so entries being expired
- # may first be merged.
+ # prevent existing entries from being merged. If not present or set
+ # to `yes`, and an entry exists (and is valid), it will be merged
+ # with the current request. This is evaluated before `Cache-TTL`, so
+ # entries being expired may first be merged.
#
- # control.Cache-Merge-New:: If present and set to `yes` will merge new
- # cache entries into the current request. Useful if results of execs or
- # expansions are stored directly in the cache.
+ # control.Cache-Merge-New:: If present and set to `yes` will merge
+ # new cache entries into the current request. Useful if results of
+ # execs or expansions are stored directly in the cache.
#
#
- # NOTE: All runtime configuration attributes will be removed from the
- # `control.` list after the cache module is called.
+ # NOTE: All runtime configuration attributes will be removed from
+ # the `control.` list after the cache module is called.
#
# === Methods
#
# The cache module also allows handling the cache using the methods.
#
- # cache.status:: Verify if an entry already exists without load the entries.
+ # cache.status:: Verify if an entry already exists without load the
+ # entries.
#
# [options="header,autowidth"]
# |===
# | `fail` | if the cache was unavailable.
# |===
#
- # cache.load:: Load an existing cache entry and merge it into the request.
+ # cache.load:: Load an existing cache entry and merge it into the
+ # request.
#
# [options="header,autowidth"]
# |===
# | `fail` | if the cache was unavailable.
# |===
#
- # cache.update:: Perform an upsert against the data store, updating the entry TTL
+ # cache.update:: Perform an upsert against the data store, updating
+ # the entry TTL
#
# [options="header,autowidth"]
# |===
# | `fail` | if the cache was unavailable.
# |===
#
- # cache.store:: Inserts data into the cache if, and only if, it is not already present
- # Will not update the entry TTL.
+ # cache.store:: Inserts data into the cache if, and only if, it is
+ # not already present Will not update the entry TTL.
#
# [options="header,autowidth"]
# |===
# | `fail` | if the cache was unavailable.
# |===
#
- # cache.clear:: Delete cache entry from the data store without checking if the entry
- # already exists.
+ # cache.clear:: Delete cache entry from the data store without
+ # checking if the entry already exists.
#
# [options="header,autowidth"]
# |===
# | `fail` | if the cache was unavailable.
# |===
#
- # ### Examples
+ # === Examples
#
# ```
# # Add a cache entry
#
# This module should be listed in the `send Access-Challenge` and
# `send Access-Accept` sections to write the cache, and in `recv
-# Access-Request` to read the cache. When it runs, it will cache the
+# Access-Request` to read the cache. When it runs, it will cache the
# current reply for an EAP session.
#
-# The "rbtree" cache back-end is an "in memory" cache. Which means
-# that the TLS session cache will be lost if the server restarts.
-# The TLS session cache can be preserved by using an external
-# back-end, such as "memcached" or "redis".
+# The "rbtree" cache back-end is an "in memory" cache. Which means
+# that the TLS session cache will be lost if the server restarts. The
+# TLS session cache can be preserved by using an external back-end,
+# such as "memcached" or "redis".
#
# When EAP packets are being proxied, they sometimes are sent through
-# a series of proxies. When that happens, a failover "upstream"
-# means that one packet from the EAP session can be received via
-# proxy 1, and the next packet from proxy 2. The server can
-# generally handle this case.
+# a series of proxies. When that happens, a failover "upstream" means
+# that one packet from the EAP session can be received via proxy 1,
+# and the next packet from proxy 2. The server can generally handle
+# this case.
#
# What's worse is when an upstream server retransmits the packet
-# through a different proxy. In that case, FreeRADIUS replies to
-# proxy 1, which doesn't send the packet upstream. The next
-# retransmit comes from proxy 2. In that case, FreeRADIUS should not
+# through a different proxy. In that case, FreeRADIUS replies to
+# proxy 1, which doesn't send the packet upstream. The next
+# retransmit comes from proxy 2. In that case, FreeRADIUS should not
# process the EAP data in the packet, it should just retransmit the
# previous reply.
#
-# These retransmits are not duplicate packets as per RFC 5080 Section 2.2.2,
-# so the "duplicate detection cache" in the server cannot send
-# a duplicate reply packet. Instead, it has to send a different
+# These retransmits are not duplicate packets as per RFC 5080 Section
+# 2.2.2, so the "duplicate detection cache" in the server cannot send
+# a duplicate reply packet. Instead, it has to send a different
# packet (i.e. different RADIUS packet header, different src/dst
# IP/port), but with the same contents.
#
#
# This module should be listed in a `send Access-Accept` section to
# write the cache, and in `recv Access-Request` to read the cache.
-# When it runs, it will cache the current TLS session. That cache
+# When it runs, it will cache the current TLS session. That cache
# allows for fast session resumption.
#
-# The `rbtree` cache back-end is an "in memory" cache. Which means
-# that the TLS session cache will be lost if the server restarts.
-# The TLS session cache can be preserved by using an external
-# back-end, such as `memcached` or `redis`.
+# The `rbtree` cache back-end is an "in memory" cache. Which means
+# that the TLS session cache will be lost if the server restarts. The
+# TLS session cache can be preserved by using an external back-end,
+# such as `memcached` or `redis`.
#
# Also, if an external backend is used, then the TLS session cache
-# can be shared across multiple RADIUS servers. That makes for
-# simple load balancing with full session resumption.
+# can be shared across multiple RADIUS servers. That makes for simple
+# load balancing with full session resumption.
#
-# NOTE: Please see the `cache` module for full documentation on the cache
-# configuration.
+# NOTE: Please see the `cache` module for full documentation on the
+# cache configuration.
#
#
#
# = CHAP
#
-# This module authenticates requests containing a `CHAP-Password` attribute.
+# This module authenticates requests containing a `CHAP-Password`
+# attribute.
#
-# NOTE: You should never send CHAP-Password in RADIUS/UDP packets. CHAP
-# is secure ONLY when used inside of TTLS.
+# NOTE: You should never send CHAP-Password in RADIUS/UDP packets.
+# CHAP is secure ONLY when used inside of TTLS.
#
-# CHAP authentication requires access to the Password.Cleartext for the user.
+# CHAP authentication requires access to the Password.Cleartext for
+# the user.
#
-# Standard Unix system authentication or passwords encrypted via `crypt()`
-# are not compatible with CHAP.
+# Standard Unix system authentication or passwords encrypted via
+# `crypt()` are not compatible with CHAP.
#
# == Configuration Settings
#
#
# = Cipher Module
#
-# The `cipher` module is used to transform plaintext in some way that is dependent
-# on a key or key pair, producing encrypted ciphertext.
+# The `cipher` module is used to transform plaintext in some way that
+# is dependent on a key or key pair, producing encrypted ciphertext.
#
# Registers the following expansions:
#
# | `%<inst>.certificate(not_after)` | Retrieves the notAfter time from `certificate_file`.
# |===
#
-# NOTE: `<ciphertext>` and `<signature>` are ingested and excreted to in their raw form.
-# You should use armouring expansions i.e. `%base64.encode(...)`, `%base64.decode(...)` if the values
-# are to be passed outside of FreeRADIUS.
+# NOTE: `<ciphertext>` and `<signature>` are ingested and excreted to
+# in their raw form. You should use armouring expansions i.e.
+# `%base64.encode(...)`, `%base64.decode(...)` if the values are to
+# be passed outside of FreeRADIUS.
#
# e.g:
#
# %cipher_decrypt(%base64.decode(<ciphertext>))
# ```
#
-# NOTE: The supported versions are determined _entirely_ by the version of OpenSSL used, FreeRADIUS
-# simply passes the name of the digest off to OpenSSL and it tells _us_ whether it's valid/supported
-# or not.
+# NOTE: The supported versions are determined _entirely_ by the
+# version of OpenSSL used, FreeRADIUS simply passes the name of the
+# digest off to OpenSSL and it tells _us_ whether it's
+# valid/supported or not.
#
# OpenSSL should support at least:
#
-# * `md2` (not recommended)
-# * `md4` (not recommended)
-# * `md5` (not recommended)
-# * `sha1` (widely used but deprecated)
-# * `sha224`
-# * `sha256` (the default)
-# * `sha384`
-# * `sha512`
-# * `sha3_224`
-# * `sha3_256`
-# * `sha3_384`
-# * `sha3_512`
+# * `md2` (not recommended)
+# * `md4` (not recommended)
+# * `md5` (not recommended)
+# * `sha1` (widely used but deprecated)
+# * `sha224`
+# * `sha256` (the default)
+# * `sha384`
+# * `sha512`
+# * `sha3_224`
+# * `sha3_256`
+# * `sha3_384`
+# * `sha3_512`
#
#
#
# certificate_file::
#
- # The PEM encoded certificate used for encrypting data and verifying signatures.
+ # The PEM encoded certificate used for encrypting data and
+ # verifying signatures.
#
certificate_file = ${certdir}/rsa/server.pem
#
# verify_mode:: How we verify certificate_file on startup
#
- # After reading the certificate file from disk and parsing it we can
- # apply other checks to ensure it is valid. Currently we check
- # the `notBefore` and `notAfter` fields to ensure the certificate is
- # temporally valid. Key use checks may be added in future.
+ # After reading the certificate file from disk and parsing it we
+ # can apply other checks to ensure it is valid. Currently we check
+ # the `notBefore` and `notAfter` fields to ensure the certificate
+ # is temporally valid. Key use checks may be added in future.
#
# [options="header,autowidth"]
# |===
#
# signature_digest::
#
- # Digest used to ingest the plaintext before signing or verification.
+ # Digest used to ingest the plaintext before signing or
+ # verification.
#
# signature_digest = "sha256"
#
# = Client Module
#
-# The `client` module loads RADIUS clients as needed, rather than when the server
-# starts.
+# The `client` module loads RADIUS clients as needed, rather than
+# when the server starts.
#
-# This module is listed in the `new client { ... }` section of a virtual server to read
-# client definitions from FreeRADIUS config files transforming them into attributes.
-# These attributes are then used by the server to create internal client definitions.
+# This module is listed in the `new client { ... }` section of a
+# virtual server to read client definitions from FreeRADIUS config
+# files transforming them into attributes. These attributes are then
+# used by the server to create internal client definitions.
#
-# This indirection is necessary as client definitions can be provided by many different
-# modules (`ldap`, `sql`, etc...), all of which emit client data in
-# attribute form. Treating static configuration files specially would increase code
-# complexity.
+# This indirection is necessary as client definitions can be provided
+# by many different modules (`ldap`, `sql`, etc...), all of which
+# emit client data in attribute form. Treating static configuration
+# files specially would increase code complexity.
#
-# There are no configuration entries for this module. Instead, it relies on the `client`
-# configuration.
+# There are no configuration entries for this module. Instead, it
+# relies on the `client` configuration.
#
# You must:
#
# The default example already does this.
#
# 5. Put files into the above directory, one per IP. e.g. file `192.0.2.1` should contain
-# a normal client definition
-# for a client with IP address `192.0.2.1`.
+# a normal client definition for a client with IP address
+# `192.0.2.1`.
#
-# NOTE: For more documentation, see the file `sites-available/dynamic-clients`
+# NOTE: For more documentation, see the file
+# `sites-available/dynamic-clients`
#
#
# == Client Configuration
#
-# In addition to loading `client` definitions in from flat files, the clients module can
-# also be used to access data from previously defined clients.
+# In addition to loading `client` definitions in from flat files, the
+# clients module can also be used to access data from previously
+# defined clients.
#
#
# === Attribute Mapping
#
-# Maps arbitrary fields from a client definition to attributes in the current request.
+# Maps arbitrary fields from a client definition to attributes in the
+# current request.
#
# [source,unlang]
-# ---
-# map client [<ipaddr>] { // <1>
+# --- map client [<ipaddr>] { // <1>
# Foo = 'nas_type' // <2>
# Bar := 'shortname' // <3>
# Baz += 'groups' // <4>
-# }
-# ---
+# } ---
#
-# <1> By default `map client { ... }` will operate on the current client, but alternative
+# <1> By default `map client { ... }` will operate on the current
+# client, but alternative
# clients can by specified by `<ipaddr>`.
-# <2> Assigns the value of the `nas_type` field from the client definition to
+# <2> Assigns the value of the `nas_type` field from the client
+# definition to
# `Foo` if the `Foo` attribute does not exist.
-# <3> Assigns the value of the `shortname` field from the client definition to
+# <3> Assigns the value of the `shortname` field from the client
+# definition to
# `Bar`.
-# <4> Creates multiple `Baz` attributes from a custom group field associated
+# <4> Creates multiple `Baz` attributes from a custom group field
+# associated
# with the client.
#
#
# virtual_server:: Name of the virtual server used to fetch CRLs.
#
- # This virtual server must use the 'crl' namespace and provide
- # a `recv CRL-Fetch` section to fetch CRLs.
+ # This virtual server must use the 'crl' namespace and provide a
+ # `recv CRL-Fetch` section to fetch CRLs.
#
- # A suitable example virtual server is provided in sites-available/crl
+ # A suitable example virtual server is provided in
+ # sites-available/crl
#
virtual_server = crl
# If a given CRL has not already been fetched when a certificate
# requires verification, then it will be fetched.
#
- # If the CRL distribution points which will be needed are known
- # then they can be configured using one or more instance of this
- # option.
+ # If the CRL distribution points which will be needed are known then
+ # they can be configured using one or more instance of this option.
#
# These distribution points will be fetched during server startup.
#
- # Only base CRL distribution points should be listed here. Deltas
+ # Only base CRL distribution points should be listed here. Deltas
# which they refer to will automatically be fetched.
#
## url = http://example.com/ca.crl
#
# WARNING: Multi-line fields are NOT allowed.
#
-# The CSV map can be used in a `map` section, as in the following example.
+# The CSV map can be used in a `map` section, as in the following
+# example.
#
# ```
# map csv User-Name {
# }
# ```
#
-# The argument to "map" is dynamically expanded. The result is taken
-# as a string, and is used as the value of the "key". The key is
-# then looked up in the cached CSV file. The fields are then mapped
-# to the attributes on the left side of the map.
+# The argument to "map" is dynamically expanded. The result is taken
+# as a string, and is used as the value of the "key". The key is then
+# looked up in the cached CSV file. The fields are then mapped to the
+# attributes on the left side of the map.
#
# == Configuration Settings
#
#
# header:: Whether or not there is a one-line header in the file.
#
- # If the value is set to 'yes', then the CSV file MUST contain
- # a header as the first line of the file. That header line
- # must contain the field names.
+ # If the value is set to 'yes', then the CSV file MUST contain a
+ # header as the first line of the file. That header line must
+ # contain the field names.
#
header = no
#
# The default is `no`.
#
- # If set to `yes`, then multiple entries are allowed. When a
- # key matches, each entry is applied in the order it appears
- # in the file.
+ # If set to `yes`, then multiple entries are allowed. When a key
+ # matches, each entry is applied in the order it appears in the
+ # file.
#
allow_multiple_keys = no
#
# fields:: A string which defines field names.
#
- # This configuration item is used only when `header = no`.
- # The content of the `fields` item must be the same as in RFC 4180.
- # That is, a list of field names, separated by the `delimiter`
- # character.
+ # This configuration item is used only when `header = no`. The
+ # content of the `fields` item must be the same as in RFC 4180. That
+ # is, a list of field names, separated by the `delimiter` character.
#
- # The `csv` module can be used to read files such as `/etc/group`
- # By setting `delimiter = ":"`, and by using `fields = "group:::,user"`
+ # The `csv` module can be used to read files such as `/etc/group` By
+ # setting `delimiter = ":"`, and by using `fields = "group:::,user"`
#
- # The special character `,` can be used *only* for the `key`
- # field, and *only* if the `key` field is the last field.
- # This special syntax means "add multiple entries for this
- # line, one for each `key`".
+ # The special character `,` can be used *only* for the `key` field,
+ # and *only* if the `key` field is the last field. This special
+ # syntax means "add multiple entries for this line, one for each
+ # `key`".
#
# [NOTE]
# =====
#
# It can be any one of the field names defined above.
#
- # The CSV rows are normally placed into a binary tree,
- # indexed by this field. A binary tree allows for fast
- # lookups, no matter the size of the CSV file.
+ # The CSV rows are normally placed into a binary tree, indexed by
+ # this field. A binary tree allows for fast lookups, no matter the
+ # size of the CSV file.
#
- # When looking up entries in the binary tree, the key must match
- # the `index_field` exactly.
+ # When looking up entries in the binary tree, the key must match the
+ # `index_field` exactly.
#
- # If `data_type` is an IP address type, then the CSV rows are
- # placed into a prefix trie, indexed by this field. The
- # prefix trie allows for fast prefix lookups.
+ # If `data_type` is an IP address type, then the CSV rows are placed
+ # into a prefix trie, indexed by this field. The prefix trie allows
+ # for fast prefix lookups.
#
- # When looking up entries in a prefix trie, the closest
- # enclosing prefix is matched. This prefix match allows you
- # to place `192.0.2/24` as an index field in the file, and
- # then lookups of `192.0.2.1` will return that row.
+ # When looking up entries in a prefix trie, the closest enclosing
+ # prefix is matched. This prefix match allows you to place
+ # `192.0.2/24` as an index field in the file, and then lookups of
+ # `192.0.2.1` will return that row.
#
index_field = "name"
#
- # key:: The key string used to look up entries via the `index_field`.
+ # key:: The key string used to look up entries via the
+ # `index_field`.
#
- # When the `csv` module is listed in a processing section,
- # the `key` is used to find the appropriate entry. The `update`
- # section below is then applied.
+ # When the `csv` module is listed in a processing section, the `key`
+ # is used to find the appropriate entry. The `update` section below
+ # is then applied.
#
- # The data type of the key is used to determine the type
- # of structure used to store the `index_field` values.
+ # The data type of the key is used to determine the type of
+ # structure used to store the `index_field` values.
#
# When the key data type is one of: `ipaddr`, `ipv4prefix`,
- # `ipv6addr`, or `ipv6prefix`, then the rows are stored in a
- # prefix trie.
+ # `ipv6addr`, or `ipv6prefix`, then the rows are stored in a prefix
+ # trie.
#
# For all other key data types, the rows are stored in a binary
# tree.
#
- # If a data type other than the native type of `key` expression
- # is needed, the casting operator can be used.
- # For example:
- # a key value of `(ipv4addr) reply.Reply-Message`.
- # would result in a prefix trie being used for lookups, and the
- # `string` value of the `Reply-Message` attribute being parsed as
- # CIDR notation.
+ # If a data type other than the native type of `key` expression is
+ # needed, the casting operator can be used. For example: a key value
+ # of `(ipv4addr) reply.Reply-Message`. would result in a prefix trie
+ # being used for lookups, and the `string` value of the
+ # `Reply-Message` attribute being parsed as CIDR notation.
#
- # Note that the individual fields of the CSV file do not have
- # data types. They are stored internally as strings, and are
- # parsed to the final data type only when the `csv` module
- # is run, either in-place, or as a `map`.
+ # Note that the individual fields of the CSV file do not have data
+ # types. They are stored internally as strings, and are parsed to
+ # the final data type only when the `csv` module is run, either
+ # in-place, or as a `map`.
#
key = User-Name
# |===
#
# Request and list qualifiers may be placed after the `update`
- # section name to set default destination requests/lists
- # for `<fr attr>s` with no list qualifiers.
+ # section name to set default destination requests/lists for `<fr
+ # attr>s` with no list qualifiers.
#
- # NOTE: CSV field names should be single quoted unless you want
- # the name to be derived from an xlat expansion, or an attribute ref.
+ # NOTE: CSV field names should be single quoted unless you want the
+ # name to be derived from an xlat expansion, or an attribute ref.
#
# update { ... }::
#
# map cvs <key> { ... }
#
# Where `csv` is the name of the module, and `key` is an expansion
- # as given the key` field above. For example, the map could
- # look like this:
+ # as given the key` field above. For example, the map could look
+ # like this:
#
# ```
# map csv User-Name {
# reply.Reply-Message := 'color'
# my-integer := 'count'
- # }
+ # }
# ```
#
- # This map does the same operations as the key / update
- # fields given above. The benefit here is that the key can
- # be dynamically changed, depending on the needs of the
- # current section.
+ # This map does the same operations as the key / update fields given
+ # above. The benefit here is that the key can be dynamically
+ # changed, depending on the needs of the current section.
#
- # If the key is not found in the CSV file, then the `map`
- # does nothing.
+ # If the key is not found in the CSV file, then the `map` does
+ # nothing.
#
}
# = CUI Module
#
# The module `cui` (`Chargeable-User-Identity`) writes
-# `Chargeable-User-Identity` log to an SQL database. It uses the `sql`
-# module to do the bulk of the work, but has custom schemas and
+# `Chargeable-User-Identity` log to an SQL database. It uses the
+# `sql` module to do the bulk of the work, but has custom schemas and
# queries.
#
# * Schema is in `sql/cui/<DB>/schema.sql`
#
sql cuisql {
#
- # dialect:: The dialect of SQL you want to use, this should usually match
- # the driver below.
+ # dialect:: The dialect of SQL you want to use, this should usually
+ # match the driver below.
#
# NOTE: If you're using rlm_sql_null, then it should be the type of
# database the logged queries are going to be executed against.
dialect = "sqlite"
#
- # driver:: The sub-module to use to execute queries. This should match
- # the database you're attempting to connect to.
+ # driver:: The sub-module to use to execute queries. This should
+ # match the database you're attempting to connect to.
#
# There are CUI queries available for:
#
#
# [NOTE]
# ====
- # For dialect `mysql` and `postgresql` the following information should be provided:
+ # For dialect `mysql` and `postgresql` the following information
+ # should be provided:
#
## server = "localhost"
## port = 3306
cui_table = "cui"
#
- # sql_user_name:: `SQL-User-Name` is used as the user for SQL queries.
- # Normally it is the same as `User-Name`, but sometimes it needs to be different.
- # Then instead of editing `User-Name` (*which we don't recommend*), you can
- # set `SQL-User-Name` to the new value.
+ # sql_user_name:: `SQL-User-Name` is used as the user for SQL
+ # queries. Normally it is the same as `User-Name`, but sometimes it
+ # needs to be different. Then instead of editing `User-Name` (*which
+ # we don't recommend*), you can set `SQL-User-Name` to the new
+ # value.
#
sql_user_name = "%{User-Name}"
# The `date` module parses dates, and prints them.
#
# The server will normally print dates in its own pre-defined format.
-# It will also parse dates in a few limited formats. However, these
-# operations are for full dates (e.g. January 1, 2020 12:34pm). The
+# It will also parse dates in a few limited formats. However, these
+# operations are for full dates (e.g. January 1, 2020 12:34pm). The
# server does not print dates in other formats, and does not parse
# dates in other formats.
#
-# The `date` module adds that functionality. It allows you to print
-# dates in almost any format you want. It allows you to parse dates
+# The `date` module adds that functionality. It allows you to print
+# dates in almost any format you want. It allows you to parse dates
# in almost any format, so long as you know what the fields are, and
# how they are defined.
#
#
# format:: Formatting of the output string.
#
- # The format arguments are the same as for the system
- # `strftime` call. See `man strftime` for documentation.
+ # The format arguments are the same as for the system `strftime`
+ # call. See `man strftime` for documentation.
#
format = "%b %e %Y %H:%M:%S %Z"
#
# utc:: Whether conversions are in UTC or local time.
#
- # If `utc` is enabled then any conversions will be made
- # as UTC, not localtime.
+ # If `utc` is enabled then any conversions will be made as UTC, not
+ # localtime.
#
# .Default is to use localtime.
#
#
# === xlat expansions
#
-# The `date` module defines an expansion `%date()` When the
-# expansion is not passed an argument, it returns the current date
-# printed according to the `format` string defined above.
+# The `date` module defines an expansion `%date()` When the expansion
+# is not passed an argument, it returns the current date printed
+# according to the `format` string defined above.
#
# ."Attribute" mode:
#
# If the argument to `%date(...)` is an attribute of `date` or
# `integer` type, the date used will be the time given by the
-# relevant attribute. If the attributes is of type `string`, the
-# string will be parsed according to the `format` configuration,
-# and a Unix date will be returned, as integer seconds since the epoch.
+# relevant attribute. If the attributes is of type `string`, the
+# string will be parsed according to the `format` configuration, and
+# a Unix date will be returned, as integer seconds since the epoch.
#
# For example, `%date('Event-Timestamp')` will use the date from the
# `Event-Timestamp` attribute as the source of the date for printing.
# time the current request packet arrived according to the format
# string, and return it as a string.
#
-# If the input is the string `now`, the `xlat` will behave as
-# above, for the current time.
+# If the input is the string `now`, the `xlat` will behave as above,
+# for the current time.
#
# If the input string begins with `+`, then the remainder of the
# string is interpreted as if the string had been given in the
#
# For example `%date('+%A')` will return `Monday` if today is Monday.
#
-# Note that the `%` character is special for xlat expansions, and therefore
-# either has to be "protected" by string quotation, or the `%` character has
-# to be escaped itself, as in `%date(+%%A)`
+# Note that the `%` character is special for xlat expansions, and
+# therefore either has to be "protected" by string quotation, or the
+# `%` character has to be escaped itself, as in `%date(+%%A)`
#
# ."Integer output"
#
# In some cases, it is useful for the module to parse dates instead
-# of printing them. In this mode, the format string is ignored.
+# of printing them. In this mode, the format string is ignored.
# Instead, the input arguments are parsed, and the output is an
# integer containing the requested value.
#
# Instead of having a specific "reject delay" configuration, it is
# instead possible to have a policy that delays the response.
#
-# TIP: The module can also be used to introduce artificial jitter into
-# responses by adding random delays.
+# TIP: The module can also be used to introduce artificial jitter
+# into responses by adding random delays.
#
# == xlat for delays
#
#
# %delay(...)
#
-# This function takes a time-delta argument (or data which is converted to a time-delta), and will delay the given number of seconds.
+# This function takes a time-delta argument (or data which is
+# converted to a time-delta), and will delay the given number of
+# seconds.
#
# .Example
#
delay = 1.0s
#
- # force_reschedule:: Whether the request should be rescheduled even if no
- # delay is needed.
+ # force_reschedule:: Whether the request should be rescheduled even
+ # if no delay is needed.
#
- # Rescheduling the request pauses it momentarily, and
- # introduces a small delay. It allows for processing of
- # other requests ahead of this one. The result is a small
- # amount of "jitter" in responses, which can help avoid some
- # deterministic timings in the network.
+ # Rescheduling the request pauses it momentarily, and introduces a
+ # small delay. It allows for processing of other requests ahead of
+ # this one. The result is a small amount of "jitter" in responses,
+ # which can help avoid some deterministic timings in the network.
#
# force_reschedule = no
#
- # relative:: Whether delay should be calculated relative to when
- # the request was received.
+ # relative:: Whether delay should be calculated relative to when the
+ # request was received.
#
- # This configuration can be useful for rate limiting, as most
- # NAS will only allow a limited number of requests to be in
- # flight.
+ # This configuration can be useful for rate limiting, as most NAS
+ # will only allow a limited number of requests to be in flight.
#
# The default is `no`, which means that.
#
#
# rcode:: Which rcode the delay module should return when it resumes
- # this can be useful for detecting whether a `timeout { ... }` section
- # expired, whilst the delay module was waiting.
+ # this can be useful for detecting whether a `timeout { ... }`
+ # section expired, whilst the delay module was waiting.
#
# The default is `notset`, which means that the delay module will be
# transparent and not alter the section rcode.
#
# [NOTE]
# ====
- # The default section `rcode` in many places is `fail`. Care should be
- # taken to set the `rcode` for the section a delay module appears in, if
- # this configuration item is not set, and no other modules are present
- # in the section.
+ # The default section `rcode` in many places is `fail`. Care should
+ # be taken to set the `rcode` for the section a delay module appears
+ # in, if this configuration item is not set, and no other modules
+ # are present in the section.
# ====
#
# rcode = 'notset'
# === Delaying Access-Reject packets
#
# The `delay_reject` module should be used in a `send Access-Reject`
-# section, as the last module in that section. When `delay_reject`
-# is used there, the reject will be delayed for either
-# FreeRADIUS-Response-Delay seconds, or if that attribute does
-# not exist, then one second.
+# section, as the last module in that section. When `delay_reject` is
+# used there, the reject will be delayed for either
+# FreeRADIUS-Response-Delay seconds, or if that attribute does not
+# exist, then one second.
#
# While the response is delayed, the server will continue processing
-# other requests. It will simply set a timer to wake up and send the
+# other requests. It will simply set a timer to wake up and send the
# response after the delay.
#
-# NOTE: We set `relative = yes` here. That setting ensures that
-# if the server takes more than one second to process the request,
-# then the `delay_reject` module will not add *additional* delays.
+# NOTE: We set `relative = yes` here. That setting ensures that if
+# the server takes more than one second to process the request, then
+# the `delay_reject` module will not add *additional* delays.
# Instead, this module will ensure that the `Access-Reject` is sent
# no earlier than one second after the `Access-Request` had been
# received.
#
# filename:: The filename used when creating `detail` files.
#
- # The default configuration creates a new `detail` file for
- # every radius client (by IP address or hostname). In
- # addition, a new detail file is created every day, so that
- # the `detail` file doesn't have to go through a 'log
- # rotation'.
+ # The default configuration creates a new `detail` file for every
+ # radius client (by IP address or hostname). In addition, a new
+ # detail file is created every day, so that the `detail` file
+ # doesn't have to go through a 'log rotation'.
#
- # If your detail files are large, you may also want to
- # add a `:%H` (see `doc/unlang/xlat_character.adoc`) to
- # the end of it, to create a new detail file every hour.
+ # If your detail files are large, you may also want to add a `:%H`
+ # (see `doc/unlang/xlat_character.adoc`) to the end of it, to create
+ # a new detail file every hour.
#
# e.g.:
#
# This will create a new `detail` file for every hour.
#
# If you are reading detail files via the `listen { ... }` section
- # (e.g. as in `sites-available/robust-proxy-accounting`),
- # you MUST use a unique directory for each combination of a `detail`
- # file writer, and reader.
+ # (e.g. as in `sites-available/robust-proxy-accounting`), you MUST
+ # use a unique directory for each combination of a `detail` file
+ # writer, and reader.
#
- # That is, only *one* `listen { ... }` section can read
- # detail files from a particular directory.
+ # That is, only *one* `listen { ... }` section can read detail files
+ # from a particular directory.
#
filename = "${radacctdir}/%{Net.Src.IP}/detail-%Y-%m-%d"
#
- # NOTE: If you are using `radrelay`, delete the above line for `file`,
- # and use this one instead:
+ # NOTE: If you are using `radrelay`, delete the above line for
+ # `file`, and use this one instead:
#
# filename = ${radacctdir}/detail
#
- # escape_filenames:: Whether or not to escape "special"
- # characters in filenames.
+ # escape_filenames:: Whether or not to escape "special" characters
+ # in filenames.
#
# Most file systems can handle nearly the full range of UTF-8
- # characters. Ones that can deal with a limited range should
- # set this to `yes`.
+ # characters. Ones that can deal with a limited range should set
+ # this to `yes`.
#
escape_filenames = no
#
# permissions:: The Unix permissions on the `detail` file.
#
- # NOTE: The detail file often contains secret or private
- # information about users. The file permissions should be
- # restrictive, so that unwanted people are prevented from
- # seeing any secret information.
+ # NOTE: The detail file often contains secret or private information
+ # about users. The file permissions should be restrictive, so that
+ # unwanted people are prevented from seeing any secret information.
#
permissions = 0600
#
# group:: The Unix group of the log file.
#
- # NOTE: The user that the server runs as must be in the
- # specified system group otherwise the server will not have
- # permission to change the group ownership of the file.
+ # NOTE: The user that the server runs as must be in the specified
+ # system group otherwise the server will not have permission to
+ # change the group ownership of the file.
#
# group = ${security.group}
#
# header:: The header of a `detail` file entry.
#
- # Every entry in the detail file has a header which is a
- # timestamp.
- # By default, we use the ctime format (see `man 3 ctime` for details).
+ # Every entry in the detail file has a header which is a timestamp.
+ # By default, we use the ctime format (see `man 3 ctime` for
+ # details).
#
- # The header can be customised by editing this string.
- # See `doc/unlang/xlat.adoc` for a description
- # of what can be put here.
+ # The header can be customised by editing this string. See
+ # `doc/unlang/xlat.adoc` for a description of what can be put here.
#
header = "%t"
#
- # locking:: Whether or not we should lock the detail file
- # before writing to it.
+ # locking:: Whether or not we should lock the detail file before
+ # writing to it.
#
# Mainly used if the detail file reader is to be reading this file.
#
#
# log_packet_header::: Log the Packet src/dst IP/port.
#
- # This is disabled by default, as that information isn't used
- # by many people.
+ # This is disabled by default, as that information isn't used by
+ # many people.
#
# log_packet_header = yes
#
- # suppress { ... }:: Suppress "secret" information from appearing in the `detail` file.
+ # suppress { ... }:: Suppress "secret" information from appearing in
+ # the `detail` file.
#
- # Certain attributes such as `User-Password` may be
- # "sensitive", so they should not be printed in the detail
- # file. This section lists the attributes that should be
- # suppressed.
+ # Certain attributes such as `User-Password` may be "sensitive", so
+ # they should not be printed in the detail file. This section lists
+ # the attributes that should be suppressed.
#
# NOTE: The attributes should be listed one to a line.
#
# * `sites-available/robust-proxy-accounting`
# * `sites-available/decoupled-accounting`
#
-# NOTE: This module can write detail files that are read by
-# only ONE `listen { ... }` section. If you use BOTH of the examples
-# above, you will need to define TWO "detail" modules.
+# NOTE: This module can write detail files that are read by only ONE
+# `listen { ... }` section. If you use BOTH of the examples above,
+# you will need to define TWO "detail" modules.
#
# e.g. `detail1.example.com` && `detail2.example.com`
#
-# We write *multiple* detail files here. They will be processed
-# by the detail `listen { ... }` section in the order that they were
-# created. The directory containing these files should NOT be
-# used for any other purposes, i.e. it should have NO other
-# files in it.
+# We write *multiple* detail files here. They will be processed by
+# the detail `listen { ... }` section in the order that they were
+# created. The directory containing these files should NOT be used
+# for any other purposes, i.e. it should have NO other files in it.
#
# TIP: Writing multiple detail enables the server to process the
-# pieces in smaller chunks. This helps in certain catastrophic
-# corner cases.
+# pieces in smaller chunks. This helps in certain catastrophic corner
+# cases.
#
# == Configuration Settings
#
# More examples of doing detail logs.
#
-# NOTE: For a full explanation of the configuration options,
-# please see the `detail` module.
+# NOTE: For a full explanation of the configuration options, please
+# see the `detail` module.
#
#
permissions = 0600
#
- # suppress { ... }:: This will stop passwords being written to the log.
+ # suppress { ... }:: This will stop passwords being written to the
+ # log.
#
suppress {
User-Password
#
# === Access-Accept
#
-# This module logs authentication reply packets sent to a NAS.
-# Both `Access-Accept` and `Access-Reject` packets are logged.
+# This module logs authentication reply packets sent to a NAS. Both
+# `Access-Accept` and `Access-Reject` packets are logged.
#
# NOTE: You will also need to un-comment the 'reply_log' line in the
# `send Access-Accept` section of `sites-enabled/default`.
# relay.
#
# Packets MUST also have a `Gateway-IP-Address` option, otherwise
-# they will be dropped. This module does not (yet) support receiving
-# replies from the DHCPv4 server. Any packets sent to the outgoing
+# they will be dropped. This module does not (yet) support receiving
+# replies from the DHCPv4 server. Any packets sent to the outgoing
# socket will be discarded.
#
dhcpv4 {
#
# ipaddr:: The IP address we use for sending packets.
#
- # This MUST be an IPv4 address. IPv6 addresses are not
- # supported for DHCPv4.
+ # This MUST be an IPv4 address. IPv6 addresses are not supported for
+ # DHCPv4.
#
ipaddr = 127.0.0.1
#
# port:: The port we use for sending packets.
#
- # The default DHCPv4 client port is 68. It should be changed
- # from this only for testing.
+ # The default DHCPv4 client port is 68. It should be changed from
+ # this only for testing.
#
# port = 68
#
# = Dict Module
#
-# The `dict` module registers expansions which query the dictionaries.
+# The `dict` module registers expansions which query the
+# dictionaries.
#
# == Expansions
#
# === %dict.attr(_<string>_)
#
-# Takes an attribute name, and returns the canonicalized name of the attribute.
+# Takes an attribute name, and returns the canonicalized name of the
+# attribute.
#
# If the attribute does not exist, nothing is returned.
#
#
# If the attribute does not exist, nothing is returned.
#
-# Note that only the _final_ attribute number is returned. For example, the OID
-# for `Vendor-Specific.Cisco.AVPair` is `26.9.1`. This function will return
-# `1`, and not the full OID.
+# Note that only the _final_ attribute number is returned. For
+# example, the OID for `Vendor-Specific.Cisco.AVPair` is `26.9.1`.
+# This function will return `1`, and not the full OID.
#
# .Return: _uint32_
#
# === %dict.attr.type(_<string>_)
#
-# Takes an attribute name, and returns the data type of the attribute.
+# Takes an attribute name, and returns the data type of the
+# attribute.
#
# If the attribute does not exist, nothing is returned.
#
#
# === %dict.vendor(_<string>_)
#
-# Takes an vendor name, and returns the canonicalized name of the vendor.
+# Takes an vendor name, and returns the canonicalized name of the
+# vendor.
#
# If the vendor does not exist, nothing is returned.
#
#
# === %dict.vendor.by.num(_<uint32>_)
#
-# Takes an vendor number, and returns the canonicalized name of the vendor.
+# Takes an vendor number, and returns the canonicalized name of the
+# vendor.
#
# If the vendor does not exist, nothing is returned.
#
#
# = Digest Module
#
-# The `digest` module is used for performing authentication against a Cisco SIP server.
+# The `digest` module is used for performing authentication against a
+# Cisco SIP server.
#
-# TIP: Digest authentication is standardized in `RFC 5090`. However, most implementations
-# do not use that. Instead, they implement the draft
-# as can be seen at `draft-sterman-aaa-sip-01` for more details.
+# TIP: Digest authentication is standardized in `RFC 5090`. However,
+# most implementations do not use that. Instead, they implement the
+# draft as can be seen at `draft-sterman-aaa-sip-01` for more
+# details.
#
#
# * FreeRADIUS-802.1X-Anonce - from the AP
# * FreeRADIUS-802.1X-EAPoL-Key-Msg - from the AP
#
-# The attributes where data is found can be amened using configuration options
-# below, e.g. if you need to use different VSAs for the anonce and EAPoL key msg.
+# The attributes where data is found can be amened using
+# configuration options below, e.g. if you need to use different VSAs
+# for the anonce and EAPoL key msg.
#
-# Note that you MUST run the "rewrite_called_station_id" policy before calling this module.
+# Note that you MUST run the "rewrite_called_station_id" policy
+# before calling this module.
#
# That policy MUST also create the Called-Station-MAC attribute.
#
-# Then place the following configuration into the "recv Access-Request" section:
+# Then place the following configuration into the "recv
+# Access-Request" section:
#
# ```
# recv Access-Request {
# ```
#
# Alternatively, you can read control.PSK-Identity and
-# control.Pre-Shared-Key from a database. Just do that before
-# running the "authenticate" section. You can do the database lookup
-# after running the "dpsk" module in the "recv Access-Request" section.
+# control.Pre-Shared-Key from a database. Just do that before running
+# the "authenticate" section. You can do the database lookup after
+# running the "dpsk" module in the "recv Access-Request" section.
#
# The database should look up the User-Name (i.e. MAC), and then set
-# control,PSK-Identity and control.Pre-Shared-Key. In general, it
-# is easiest to just set PSK-Identity to be same as the User-Name.
+# control,PSK-Identity and control.Pre-Shared-Key. In general, it is
+# easiest to just set PSK-Identity to be same as the User-Name.
#
-# Then create an "authenticate dpsk" section which calls the "dpsk" module:
+# Then create an "authenticate dpsk" section which calls the "dpsk"
+# module:
#
# ```
# authenticate dpsk {
# We STRONGLY RECOMMEND THAT NO ONE USE THIS MODULE.
#
# While it works, it needs to use a brute-force method to match MAC
-# to PSK. That process is extremely slow, and scales very poorly.
+# to PSK. That process is extremely slow, and scales very poorly.
#
-# i.e. if you have 10 PSKs, it's not too bad. If you have 10,000
-# PSKs, then the module can consume 100% of CPU trying to
-# brute-force every PSK.
+# i.e. if you have 10 PSKs, it's not too bad. If you have 10,000
+# PSKs, then the module can consume 100% of CPU trying to brute-force
+# every PSK.
#
-# This is a limitation of how DPSK works. There is no way to make it
-# better. The only thing we've done is to add a cache which can help
+# This is a limitation of how DPSK works. There is no way to make it
+# better. The only thing we've done is to add a cache which can help
# to minimise the amount of brute-force attempts.
#
#
#
# The cache is keyed by (supplicant MAC + SSID)
#
- # The cache entry is the PSK-Identity and Pre-Shared-Key,
- # and/or the PMK which are used to verify the information in
- # the Access-Request.
+ # The cache entry is the PSK-Identity and Pre-Shared-Key, and/or the
+ # PMK which are used to verify the information in the
+ # Access-Request.
#
- # Caching entries can help, even when using a database. It
- # is very slow to calculate the PMK from the PSK.
+ # Caching entries can help, even when using a database. It is very
+ # slow to calculate the PMK from the PSK.
#
cache_size = 1024
# filename::
#
#
- # PSKs can also be stored in a CSV file. The format of the file is:
+ # PSKs can also be stored in a CSV file. The format of the file is:
#
# ```
# identity,psk,mac
# ```
#
- # If there are commas in a field, then the field can be
- # double quoted: "psk".
+ # If there are commas in a field, then the field can be double
+ # quoted: "psk".
#
- # The mac field is optional. If it exists, then that PSK
- # will be used. It is highly recommended that the MAC *not* be placed
- # into the CSV file. Instead, the MAC and PSK should be placed into a
- # database. The server can then be configured to look up the MAC in the
- # database, which returns the PSK. That way this module will only ever
- # check one PSK, which is fast.
+ # The mac field is optional. If it exists, then that PSK will be
+ # used. It is highly recommended that the MAC *not* be placed into
+ # the CSV file. Instead, the MAC and PSK should be placed into a
+ # database. The server can then be configured to look up the MAC in
+ # the database, which returns the PSK. That way this module will
+ # only ever check one PSK, which is fast.
#
- # i.e. the CSV file should only contain the small number of PSKs where
- # you do not yet know the MAC. As soon as you know the MAC, you should
- # put the MAC and PSK into a database, and then remove the MAC and PSK
- # from the CSV file.
+ # i.e. the CSV file should only contain the small number of PSKs
+ # where you do not yet know the MAC. As soon as you know the MAC,
+ # you should put the MAC and PSK into a database, and then remove
+ # the MAC and PSK from the CSV file.
#
- # NOTE: the file is opened and read from top to bottom for every
- # new request which comes in. This process can be very slow!
+ # NOTE: the file is opened and read from top to bottom for every new
+ # request which comes in. This process can be very slow!
#
# However, opening the file for every new request means that the
- # server does not have to be reloaded when the file changes. Instead,
- # the file can be generated, and then moved into place atomically:
+ # server does not have to be reloaded when the file changes.
+ # Instead, the file can be generated, and then moved into place
+ # atomically:
#
# ```
# create csv file > psk.csv.new
# mv psk.csv.new psk.csv
# ```
#
- # Any process which writes a new "psk.csv" file MUST NOT
- # write to the file directly, as that will cause the dpsk
- # module to read partial entries and fail. Instead, use "mv"
- # to atomically overwrite the old file with a new one.
+ # Any process which writes a new "psk.csv" file MUST NOT write to
+ # the file directly, as that will cause the dpsk module to read
+ # partial entries and fail. Instead, use "mv" to atomically
+ # overwrite the old file with a new one.
#
- # Both "cache_size" and "filename" can be configured at the
- # same time, which is recommended. When an entry in the file
- # is found, the identity, PSK, and MAC are saved in the cache.
+ # Both "cache_size" and "filename" can be configured at the same
+ # time, which is recommended. When an entry in the file is found,
+ # the identity, PSK, and MAC are saved in the cache.
#
# If a cache entry is found, then the filename is NOT read.
#
- # The resulting combination of features means that the module
- # should be as fast as possible, given the limitations of DPSK.
+ # The resulting combination of features means that the module should
+ # be as fast as possible, given the limitations of DPSK.
#
- # NOTE: Tests show that the module can do ~100K PSK / DPSK
- # checks per second. This means that if you have 10,000
- # users and 10 packets a second, the system will be 100% busy
- # checking PSKs. Similarly, of you have 100K DPSKs in the file,
- # the one packet will take 1 second of CPU time to verify!
+ # NOTE: Tests show that the module can do ~100K PSK / DPSK checks
+ # per second. This means that if you have 10,000 users and 10
+ # packets a second, the system will be 100% busy checking PSKs.
+ # Similarly, of you have 100K DPSKs in the file, the one packet will
+ # take 1 second of CPU time to verify!
#
- # As a result, the DPSK functionality scales poorly. It
- # should be used only with a small number of PSKs (100s
- # perhaps), and only at low packet rates. If the server is
- # getting 1000 packets per second, then it can only handle
- # 100 PSKs before running out of CPU.
+ # As a result, the DPSK functionality scales poorly. It should be
+ # used only with a small number of PSKs (100s perhaps), and only at
+ # low packet rates. If the server is getting 1000 packets per
+ # second, then it can only handle 100 PSKs before running out of
+ # CPU.
#
- # Using the cache will help substantially. But the cache is
- # only in memory, which means that all cache entries are lost
- # when the server restarts. As a result, the combination of
- # number of PSKs and packet rates should be kept as low as
- # possible.
+ # Using the cache will help substantially. But the cache is only in
+ # memory, which means that all cache entries are lost when the
+ # server restarts. As a result, the combination of number of PSKs
+ # and packet rates should be kept as low as possible.
#
- # The filename is dynamically expanded, so it can reference
- # other attributes. This expansion lets you split up DPSK
- # files by location, which can drastically reduce the overall
- # search space, and thus the CPU requirements.
+ # The filename is dynamically expanded, so it can reference other
+ # attributes. This expansion lets you split up DPSK files by
+ # location, which can drastically reduce the overall search space,
+ # and thus the CPU requirements.
#
# filename = "${modconfdir}/${.:name}/psk.csv"
#
# pre_shared_key::
#
- # Attribute containing the PSK for the user, as retrieved from
- # a data store
+ # Attribute containing the PSK for the user, as retrieved from a
+ # data store
#
# pre_shared_key = control.Pre-Shared-Key
#
# pairwise_master_key::
#
- # Attribute containing the pairwise master key for the user.
- # This is used in preference to the PSK if set.
+ # Attribute containing the pairwise master key for the user. This is
+ # used in preference to the PSK if set.
#
# pairwise_master_key = control.Pairwise-Master-Key
#
# username::
#
- # Attribute containing the supplicant MAC address in hex format, e.g. "abcdef012345".
+ # Attribute containing the supplicant MAC address in hex format,
+ # e.g. "abcdef012345".
#
# username = User-name
#
# Attribute containing the AP MAC in binary
#
- # Typically this is extracted from Called-Station-Id using a modified version
- # of the "rewrite_called_station_id" policy.
+ # Typically this is extracted from Called-Station-Id using a
+ # modified version of the "rewrite_called_station_id" policy.
#
# called_station = Called-Station-MAC
#
# = EAP Module
#
-# The `eap` module takes care of all EAP authentication as described in RFC 3579.
+# The `eap` module takes care of all EAP authentication as described
+# in RFC 3579.
#
# [WARNING]
# ====
-# Whatever you do, do NOT set 'Auth-Type := ::EAP'. The server is smart enough
-# to figure this out on its own.
+# Whatever you do, do NOT set 'Auth-Type := ::EAP'. The server is
+# smart enough to figure this out on its own.
#
-# The most common side effect of setting 'Auth-Type := ::EAP' is that the users
-# then cannot use ANY other authentication method.
+# The most common side effect of setting 'Auth-Type := ::EAP' is that
+# the users then cannot use ANY other authentication method.
# ====
#
#
eap {
#
- # require_identity_realm:: Require the EAP Identity provided contains
- # a realm.
+ # require_identity_realm:: Require the EAP Identity provided
+ # contains a realm.
#
- # If `require_identity_realm` is `nai`, the EAP identity provided must
- # end with `@<label0>.<label1>[.<labelN>]`, i.e. an '@' followed by at least
- # two DNS labels.
+ # If `require_identity_realm` is `nai`, the EAP identity provided
+ # must end with `@<label0>.<label1>[.<labelN>]`, i.e. an '@'
+ # followed by at least two DNS labels.
#
- # If `require_identity_realm` is `yes`, the EAP identity provided must
- # either match the NAI format described above, or a `Stripped-User-Domain`
- # attribute must be present in the request list.
- # This validation mode is intended to be user where Windows machine
- # authentication is intermixed with user authentication.
+ # If `require_identity_realm` is `yes`, the EAP identity provided
+ # must either match the NAI format described above, or a
+ # `Stripped-User-Domain` attribute must be present in the request
+ # list. This validation mode is intended to be user where Windows
+ # machine authentication is intermixed with user authentication.
#
- # If `require_identity_realm` is `no`, no identity format checks are performed.
- # It is NOT recommended to use this value. Future security standards will
- # key off the NAI realm to validate the certificate we (the EAP server) present.
- # If you do not require an NAI realm be present in the EAP identity string,
- # your users will not be able to take advantage of this added security when
- # it is enabled by OS and device vendors.
+ # If `require_identity_realm` is `no`, no identity format checks are
+ # performed. It is NOT recommended to use this value. Future
+ # security standards will key off the NAI realm to validate the
+ # certificate we (the EAP server) present. If you do not require an
+ # NAI realm be present in the EAP identity string, your users will
+ # not be able to take advantage of this added security when it is
+ # enabled by OS and device vendors.
#
# require_identity_realm = nai
#
- # Session tracking has moved to the `session` section of a virtual server.
+ # Session tracking has moved to the `session` section of a virtual
+ # server.
# * timer_expire --> timeout
# * max_sessions --> max
# * dedup_key --> dedup_key
#
#
- # default_eap_type:: The default EAP submodule to invoke when an `EAP-Identity`
- # response is received.
+ # default_eap_type:: The default EAP submodule to invoke when an
+ # `EAP-Identity` response is received.
#
- # If a `default_eap_type` value is not provided, enabled EAP submodules will be
- # queried to determine if they recognise the provided EAP-Identity.
- # If no submodules recognise the identity, the first `type` value listed below
- # will be used.
+ # If a `default_eap_type` value is not provided, enabled EAP
+ # submodules will be queried to determine if they recognise the
+ # provided EAP-Identity. If no submodules recognise the identity,
+ # the first `type` value listed below will be used.
#
- # If the `control.EAP-Type` attribute is set, then that EAP type takes precedence
- # over any configured or inferred EAP-Type.
+ # If the `control.EAP-Type` attribute is set, then that EAP type
+ # takes precedence over any configured or inferred EAP-Type.
#
- # It is generally recommended to NOT set `default_eap_type`, and instead order
- # the `type` configuration items appropriately.
+ # It is generally recommended to NOT set `default_eap_type`, and
+ # instead order the `type` configuration items appropriately.
#
# default_eap_type = md5
# ignore_unknown_eap_types::
#
# There are many EAP types, but the server has support for only a
- # limited subset. If the server receives a request for an EAP type it
- # does not support, then it normally rejects the request. By setting
- # this configuration to `yes`, you can tell the server to instead keep
- # processing the request. Another module MUST then be configured to
- # proxy the request to another RADIUS server which supports that EAP
- # type.
+ # limited subset. If the server receives a request for an EAP type
+ # it does not support, then it normally rejects the request. By
+ # setting this configuration to `yes`, you can tell the server to
+ # instead keep processing the request. Another module MUST then be
+ # configured to proxy the request to another RADIUS server which
+ # supports that EAP type.
#
- # NOTE: If another module is NOT configured to handle the request, then the
- # request will still end up being rejected.
+ # NOTE: If another module is NOT configured to handle the request,
+ # then the request will still end up being rejected.
#
ignore_unknown_eap_types = no
#
# == Allowed EAP-types
#
- # type:: Only EAP types listed below with a `type = <EAP-Type>` pair will be allowed.
+ # type:: Only EAP types listed below with a `type = <EAP-Type>` pair
+ # will be allowed.
#
- # In addition, setting `type = md5` will load the configuration section `md5 { ... }`.
- # There is no need to "comment out" the entire configuration section for EAP types
- # which are not used. Instead, simply comment out or delete the `type = ..` entry
- # for that EAP method, and the entire configuration section will be ignored.
+ # In addition, setting `type = md5` will load the configuration
+ # section `md5 { ... }`. There is no need to "comment out" the
+ # entire configuration section for EAP types which are not used.
+ # Instead, simply comment out or delete the `type = ..` entry for
+ # that EAP method, and the entire configuration section will be
+ # ignored.
#
- # If the `control.EAP-Type` attribute is set, then that is used to form the list of
- # allowed EAP types, with the first instance being the default type and others also
- # being allowed.
+ # If the `control.EAP-Type` attribute is set, then that is used to
+ # form the list of allowed EAP types, with the first instance being
+ # the default type and others also being allowed.
#
- # Setting an EAP type in `control.EAP-Type` which is not allowed below, will not have
- # any effect, since this list determines which methods are loaded and potentially
- # available.
+ # Setting an EAP type in `control.EAP-Type` which is not allowed
+ # below, will not have any effect, since this list determines which
+ # methods are loaded and potentially available.
#
type = md5
# type = pwd
# === EAP-MD5
#
# WARNING: EAP-MD5 authentication cannot be used for wireless
- # connections. It is insecure, and does not provide for dynamic WEP
+ # connections. It is insecure, and does not provide for dynamic WEP
# keys or WPA enterprise.
#
md5 {
#
# === EAP-PWD (Secure password-based authentication)
#
- # In v4, the "known good" password is taken from the `request.control.Password.Cleartext` list,
- # as is done by other modules. The change from v3 is that the `inner-tunnel` virtual server
- # is not used.
+ # In v4, the "known good" password is taken from the
+ # `request.control.Password.Cleartext` list, as is done by other
+ # modules. The change from v3 is that the `inner-tunnel` virtual
+ # server is not used.
#
pwd {
group = 19
#
# === Generic Token Card
#
- # Currently, this is only permitted inside of `EAP-TTLS`, or `EAP-PEAP`.
- # The module `challenges` the user with text, and the response from the
- # user is taken to be the `User-Password`.
+ # Currently, this is only permitted inside of `EAP-TTLS`, or
+ # `EAP-PEAP`. The module `challenges` the user with text, and the
+ # response from the user is taken to be the `User-Password`.
#
- # WARNING: Proxying the tunneled `EAP-GTC` session is a bad idea, the users
- # password will go over the wire in plain-text, for anyone to see.
+ # WARNING: Proxying the tunneled `EAP-GTC` session is a bad idea,
+ # the users password will go over the wire in plain-text, for anyone
+ # to see.
#
gtc {
#
#
# The plain-text response which comes back is put into a
# `User-Password` attribute, and passed to another module for
- # authentication. This allows the `EAP-GTC` response to be
- # checked against plain-text, or crypt'd passwords.
+ # authentication. This allows the `EAP-GTC` response to be checked
+ # against plain-text, or crypt'd passwords.
#
- # If you say "Local" instead of "PAP", then the module will
- # look for a `User-Password` configured for the request, and do
- # the authentication itself.
+ # If you say "Local" instead of "PAP", then the module will look
+ # for a `User-Password` configured for the request, and do the
+ # authentication itself.
#
auth_type = PAP
}
#
# See `certs/index.adoc` for additional comments on certificates.
#
- # If OpenSSL was not found at the time the server was built, the `tls`,
- # `ttls`, and `peap` sections will be ignored.
+ # If OpenSSL was not found at the time the server was built, the
+ # `tls`, `ttls`, and `peap` sections will be ignored.
#
- # If you do not currently have certificates signed by a trusted CA you
- # may use the 'snakeoil' certificates. Included with the server in
- # `certs`.
+ # If you do not currently have certificates signed by a trusted CA
+ # you may use the 'snakeoil' certificates. Included with the server
+ # in `certs`.
#
# If these certificates have not been auto-generated:
#
# make
#
# These test certificates *SHOULD NOT* be used in a normal
- # deployment. They are created only to make it easier to
- # install the server, and to perform some simple tests with
- # EAP-TLS, TTLS, or PEAP.
+ # deployment. They are created only to make it easier to install the
+ # server, and to perform some simple tests with EAP-TLS, TTLS, or
+ # PEAP.
#
- # Note that you should NOT use a globally known CA here!
- # e.g. using a Verisign cert as a "known CA" means that
- # ANYONE who has a certificate signed by them may be able to
- # authenticate via EAP-TLS! This is likely not what you
- # want.
+ # Note that you should NOT use a globally known CA here! e.g. using
+ # a Verisign cert as a "known CA" means that ANYONE who has a
+ # certificate signed by them may be able to authenticate via
+ # EAP-TLS! This is likely not what you want.
#
#
# [NOTE]
# ====
# As of 4.0 the following TLS config items/config sections have been
- # removed. Equivalent functionality is available.
+ # removed. Equivalent functionality is available.
# ====
#
# [options="header,autowidth"]
#
tls-config tls-common {
#
- # virtual_server:: The virtual server used for checking and saving TLS data.
+ # virtual_server:: The virtual server used for checking and saving
+ # TLS data.
#
- # When the module receives certificate checks and stateful
- # session resumption requests, that information will be passed
- # through a virtual server. This virtual server typically runs
- # policies which verifies the certificate, or loads / stores
- # session resumption data.
+ # When the module receives certificate checks and stateful session
+ # resumption requests, that information will be passed through a
+ # virtual server. This virtual server typically runs policies which
+ # verifies the certificate, or loads / stores session resumption
+ # data.
#
- # The virtual server must specify `namespace = tls`, and may contain
- # the following sections:
+ # The virtual server must specify `namespace = tls`, and may
+ # contain the following sections:
#
# [options="header,autowidth"]
# |===
# | Gather stapling information for one or more of our certificates.
# |===
#
- # More information about the various sections can be found in the virtual server
- # `sites-available/tls-session`.
+ # More information about the various sections can be found in the
+ # virtual server `sites-available/tls-session`.
#
# virtual_server = tls-session
# auto_chain::
#
- # OpenSSL will automatically create certificate chains, unless
- # we tell it to not do that. The problem is that it sometimes
- # gets the chains right from a certificate signature view, but
- # wrong from the clients view.
+ # OpenSSL will automatically create certificate chains, unless we
+ # tell it to not do that. The problem is that it sometimes gets the
+ # chains right from a certificate signature view, but wrong from
+ # the clients view.
#
# NOTE: When setting `auto_chain = no`, the server `chain {}`
# section(s) below MUST include the full certificate chain.
# Multiple chain sections can be specified to allow different
# chains for different key types (RSA, DSA, DH, EC).
#
- # If multiple chains for the same key type are specified
- # the last chain to be processed will be used for that
- # key type.
+ # If multiple chains for the same key type are specified the last
+ # chain to be processed will be used for that key type.
#
- # WARNING: The server automatically selects a chain based on
- # the cipher agreed by the client and server. For example, if
- # the client includes ECC ciphers in its request, but the
- # server only has an RSA certificate, then the authentication
- # is likely to fail. i.e. The client is asking the server to
- # use an ECC cipher and ECC certificate, but the server has no
- # ECC certificate available.
+ # WARNING: The server automatically selects a chain based on the
+ # cipher agreed by the client and server. For example, if the
+ # client includes ECC ciphers in its request, but the server only
+ # has an RSA certificate, then the authentication is likely to
+ # fail. i.e. The client is asking the server to use an ECC cipher
+ # and ECC certificate, but the server has no ECC certificate
+ # available.
#
- # The key type does not need to be explicitly specified as
- # it is determined from the provided certificate.
+ # The key type does not need to be explicitly specified as it is
+ # determined from the provided certificate.
#
chain rsa {
#
# format:: The format of the certificate(s) and private key file.
#
- # May be one of `PEM`, `DER` or `ASN1` (ASN1 is an alias for `DER`).
+ # May be one of `PEM`, `DER` or `ASN1` (ASN1 is an alias for
+ # `DER`).
#
- # Most Linux systems use PEM format. Windows and other
- # systems usually use DER.
+ # Most Linux systems use PEM format. Windows and other systems
+ # usually use DER.
#
# format = "PEM"
# certificate_file:: File which contains the certificate presented
# as the "server certificate" to the client.
#
- # If the PEM format is used, the `certificate_file`
- # should contain the server certificates, along with
- # any intermediate CAs up to the root CA. The client
- # is not normally configured with the intermediate CAs,
- # but it needs them to verify the server certificate.
- # The server therefore has to supply the intermediate
+ # If the PEM format is used, the `certificate_file` should contain
+ # the server certificates, along with any intermediate CAs up to
+ # the root CA. The client is not normally configured with the
+ # intermediate CAs, but it needs them to verify the server
+ # certificate. The server therefore has to supply the intermediate
# CAs to the client during the authentication process.
#
# [NOTE]
# ====
- # If `verify_mode` (below) is set to `hard` or `soft`
- # all intermediary CAs and the Root CA need to be
- # included in the `certificate_file`.
- #
- # If the file includes multiple certificates, they MUST
- # be listedin order from server certificate (first in
- # the file) to intermediary CAs (second) to Root CA
- # (last in the file) as per RFC 4346 Section 7.4.2 (see
- # certificate_list)
- #
- # If the DER format is used, the `certificate_file`
- # should contain ONLY the server's certificate. One
- # or more `ca_file` items should be used to load
- # the intermediate CAs and the Root CA.
+ # If `verify_mode` (below) is set to `hard` or `soft` all
+ # intermediary CAs and the Root CA need to be included in the
+ # `certificate_file`.
+ #
+ # If the file includes multiple certificates, they MUST be
+ # listedin order from server certificate (first in the file) to
+ # intermediary CAs (second) to Root CA (last in the file) as per
+ # RFC 4346 Section 7.4.2 (see certificate_list)
+ #
+ # If the DER format is used, the `certificate_file` should contain
+ # ONLY the server's certificate. One or more `ca_file` items
+ # should be used to load the intermediate CAs and the Root CA.
# ====
#
- # We recommend using `ca_file` to load the
- # root CAs, instead of putting them in the
- # `certificate_file`.
+ # We recommend using `ca_file` to load the root CAs, instead of
+ # putting them in the `certificate_file`.
#
certificate_file = ${certdir}/rsa/server.pem
#
- # ca_file:: File which contains the root CA.
+ # ca_file:: File which contains the root CA.
#
- # This configuration item allows the server to load
- # additional intermediate CA or Root CA when creating
- # certificate chains. Multiple "ca_file"
- # configurations items may be specified in order to
- # load multiple certificates.
+ # This configuration item allows the server to load additional
+ # intermediate CA or Root CA when creating certificate chains.
+ # Multiple "ca_file" configurations items may be specified in
+ # order to load multiple certificates.
#
- # When multiple `ca_file` entries are used, the server
- # will still present only one server certificate (from
- # `certificate_file`) to the clients. The main use for
- # multiple `ca_file` entries is to permit the use of
- # EAP-TLS with client certificates from multiple Root
- # CAs.
+ # When multiple `ca_file` entries are used, the server will still
+ # present only one server certificate (from `certificate_file`) to
+ # the clients. The main use for multiple `ca_file` entries is to
+ # permit the use of EAP-TLS with client certificates from multiple
+ # Root CAs.
#
- # If the root CA does not issue client certificates, or
- # if only one root CA is, then the `ca_file`
- # configuration can be commented out (at least when PEM
- # format is used).
+ # If the root CA does not issue client certificates, or if only
+ # one root CA is, then the `ca_file` configuration can be
+ # commented out (at least when PEM format is used).
#
ca_file = ${certdir}/rsa/ca.pem
#
- # private_key_password:: The password which is used to encrypt the private key.
+ # private_key_password:: The password which is used to encrypt the
+ # private key.
#
# If the private key is not encrypted, this configuration item
# will have no effect.
#
- # In general, there is little security benefit in
- # encrypting the `private_key_file` with a password.
+ # In general, there is little security benefit in encrypting the
+ # `private_key_file` with a password.
#
private_key_password = whatever
#
# verify_mode:: How we verify the certificate chain.
#
- # During startup the server attempts to precompile the certificate chain
- # from server certificate to Root CA. This configuration item specifies
- # what happens if compilation fails.
+ # During startup the server attempts to precompile the certificate
+ # chain from server certificate to Root CA. This configuration
+ # item specifies what happens if compilation fails.
#
# [options="header,autowidth"]
# |===
# | none | Stay silent if we cannot build a complete certificate chain.
# |===
#
- # The default is `hard`. The only time this should be changed is if
- # you want to limit the number of intermediary CAs sent to the
+ # The default is `hard`. The only time this should be changed is
+ # if you want to limit the number of intermediary CAs sent to the
# client by not including them in the chain.
#
# [NOTE]
# build a complete chain, but this will be done at runtime.
#
# * `auto_chain` has no effect on which certificates are considered
- # for pre-compilation. Only those listed in this `chain {}` section
- # will be used.
+ # for pre-compilation. Only those listed in this `chain {}`
+ # section will be used.
# ====
#
# verify_mode = "hard"
# include_root_ca:: Whether or not the root CA is included in the
# certificate chain.
#
- # The Root CA should already be known/trusted by the client so it is
- # usually not needed unless the client is particularly poorly behaved.
+ # The Root CA should already be known/trusted by the client so it
+ # is usually not needed unless the client is particularly poorly
+ # behaved.
#
- # NOTE: The Root CA must still be available for creating certificate chains to
- # succeed even if `include_root_ca = no`.
+ # NOTE: The Root CA must still be available for creating
+ # certificate chains to succeed even if `include_root_ca = no`.
#
# Default value is `no`.
#
#
# This is disabled by default, see the warning above.
#
- # If your supplicants propose a mix of different
- # types of ciphers _and_ have all of the CA keys for
- # each type of certificate, then multiple chains can be
- # enabled simultaneously.
+ # If your supplicants propose a mix of different types of ciphers
+ # _and_ have all of the CA keys for each type of certificate, then
+ # multiple chains can be enabled simultaneously.
#
-# chain ecc {
+ # chain ecc {
# certificate_file = ${certdir}/ecc/server.pem
# ca_file = ${certdir}/ecc/ca.pem
# private_key_password = whatever
# private_key_file = ${certdir}/ecc/server.key
-# }
+ # }
#
# == Server certificate
#
- # The server certificate may also be specified at
- # runtime on a per session basis. In that use-case,
- # the certificate file must consist of the
- # certificate and private key, PEM encoded. The
- # password should either be set above with
- # `password`, or the certificate should have no
- # password.
+ # The server certificate may also be specified at runtime on a per
+ # session basis. In that use-case, the certificate file must
+ # consist of the certificate and private key, PEM encoded. The
+ # password should either be set above with `password`, or the
+ # certificate should have no password.
#
# The file should be provided as the attribute:
#
# control.TLS-Session-Cert-File
#
- # If there are any errors loading or verifying the
- # certificate, then authentication will fail.
+ # If there are any errors loading or verifying the certificate,
+ # then authentication will fail.
#
- # This configuration can be used to periodically
- # verify correct supplicant behaviour, by presenting
- # an untrusted or invalid server certificate and
- # verifying that the supplicant returns the correct
- # TLS alert (available in Module-Failure-Message).
+ # This configuration can be used to periodically verify correct
+ # supplicant behaviour, by presenting an untrusted or invalid
+ # server certificate and verifying that the supplicant returns the
+ # correct TLS alert (available in Module-Failure-Message).
#
- # NOTE: After receiving a fatal alert, TLS negotiation
- # cannot continue, but as most supplicants will retry
- # enthusiastically, so this probably won't be an issue.
+ # NOTE: After receiving a fatal alert, TLS negotiation cannot
+ # continue, but as most supplicants will retry enthusiastically, so
+ # this probably won't be an issue.
#
#
# ALL of the CA's in this list will be trusted to issue client
# certificates for authentication.
#
- # NOTE: You should not use a public CA here. This should either be
- # set to a certificate chain for your institution's CA,
- # or to a self signed Root CA.
+ # NOTE: You should not use a public CA here. This should either be
+ # set to a certificate chain for your institution's CA, or to a
+ # self signed Root CA.
#
ca_file = ${cadir}/rsa/ca.pem
#
# psk_identity:: Default identity to present for PSK.
#
- # If OpenSSL supports TLS-PSK, then we can use a PSK identity
- # and (hex) password.
+ # If OpenSSL supports TLS-PSK, then we can use a PSK identity and
+ # (hex) password.
#
- # If using a fixed identity, it must be the same on
- # the client. The passphrase must be a hex value,
- # and can be up to 256 hex characters.
+ # If using a fixed identity, it must be the same on the client. The
+ # passphrase must be a hex value, and can be up to 256 hex
+ # characters.
#
# psk_identity = "test"
# psk_hexphrase = "036363823"
#
- # WARNING: Dynamic queries for the `PSK`. If `TLS-PSK` is used,
- # and `psk_query` is set, then you MUST NOT use
- # `psk_identity` or `psk_hexphrase`.
+ # WARNING: Dynamic queries for the `PSK`. If `TLS-PSK` is used, and
+ # `psk_query` is set, then you MUST NOT use `psk_identity` or
+ # `psk_hexphrase`.
#
#
# psk_query:: Dynamically obtain the PSK from a query.
#
- # Instead, use a dynamic expansion similar to the one
- # below. It keys off of TLS-PSK-Identity. It should
- # return a of string no more than 512 hex characters.
- # That string will be converted to binary, and will
- # be used as the dynamic PSK hexphrase.
+ # Instead, use a dynamic expansion similar to the one below. It
+ # keys off of TLS-PSK-Identity. It should return a of string no
+ # more than 512 hex characters. That string will be converted to
+ # binary, and will be used as the dynamic PSK hexphrase.
#
- # Note that this query is just an example. You will
- # need to customize it for your installation.
+ # Note that this query is just an example. You will need to
+ # customize it for your installation.
#
# psk_query = "%sql(select hex(key) from psk_keys where keyid = '%{TLS-PSK-Identity}')"
#
# cipher_suites:: TLS 1.3 cipher suites.
#
- # For TLS-PSK, uncomment the following line to use
- # standard ciphers for TLS 1.3.
+ # For TLS-PSK, uncomment the following line to use standard ciphers
+ # for TLS 1.3.
#
- # TLS-PSK may work without this line, but it is
- # likely to not work when the "next hop" home_server
- # accepts both certificates and PSK. OpenSSL will
- # negotiate cipher suites which are incompatible with
- # PSK, and then fail.
+ # TLS-PSK may work without this line, but it is likely to not work
+ # when the "next hop" home_server accepts both certificates and
+ # PSK. OpenSSL will negotiate cipher suites which are incompatible
+ # with PSK, and then fail.
#
# Setting the `cipher_suites` here forces PSK to be negotiated.
#
# cipher_suites = "TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256"
#
- # You can create the DH parameters by running the
- # following command:
+ # You can create the DH parameters by running the following
+ # command:
#
- # openssl dhparam -out certs/dh 2048
+ # openssl dhparam -out certs/dh 2048
#
# The DH parameters will usually be ignored in FIPS mode.
#
- # If this file isn't specified, then OpenSSL will
- # automatically set the correct DH parameters.
+ # If this file isn't specified, then OpenSSL will automatically set
+ # the correct DH parameters.
#
# dh_file = ${certdir}/dh
#
# fragment_size:: Limit for size of EAP fragments.
#
- # This can never exceed the size of a RADIUS packet (4096
- # bytes), and is preferably less than half of that, to leave
- # room for other attributes in RADIUS packet. In most cases,
- # the maximum EAP packet length is limited to the Ethernet MTU,
- # which between `1500 - 1600` bytes.
+ # This can never exceed the size of a RADIUS packet (4096 bytes),
+ # and is preferably less than half of that, to leave room for other
+ # attributes in RADIUS packet. In most cases, the maximum EAP
+ # packet length is limited to the Ethernet MTU, which between `1500
+ # - 1600` bytes.
#
- # In these cases, fragment size should be `1024` or less. Note
- # also that the EAP RFCs say that EAP implementations MUST use
- # fragments of at least 1020 bytes! Many implementations will
- # work with smaller values, but it is not guaranteed.
+ # In these cases, fragment size should be `1024` or less. Note also
+ # that the EAP RFCs say that EAP implementations MUST use fragments
+ # of at least 1020 bytes! Many implementations will work with
+ # smaller values, but it is not guaranteed.
#
# fragment_size = 1024
# ca_path:: Directory where additional CAs are located.
#
# After placing files in this directory, the OpenSSL command
- # `c_rehash` should be used to update the local files used by OpenSSL.
+ # `c_rehash` should be used to update the local files used by
+ # OpenSSL.
#
- # Most systems will only use one server certificate,
- # and one root CA. Where client certificates are
- # used, they are usually also issued from that same
- # root CA. In which case the `ca_path` configuration
- # is not necessary. All certificates can be placed
+ # Most systems will only use one server certificate, and one root
+ # CA. Where client certificates are used, they are usually also
+ # issued from that same root CA. In which case the `ca_path`
+ # configuration is not necessary. All certificates can be placed
# into the file which is configured in `certificate_file`.
#
- # The main reason to use multiple `ca_file` entries,
- # or the `ca_path` configuration, is when the server
- # is expected to authenticate client certificates issued by multiple CAs.
+ # The main reason to use multiple `ca_file` entries, or the
+ # `ca_path` configuration, is when the server is expected to
+ # authenticate client certificates issued by multiple CAs.
#
ca_path = ${cadir}
# If enabled, OpenSSL will use the server cipher list (possibly
# defined by the `cipher_list` option above) for choosing right
# cipher suite, instead of using the client-specified list which is
- # OpenSSl default behavior. Having it set to 'yes' is best
- # practice for TLS.
+ # OpenSSl default behavior. Having it set to 'yes' is best practice
+ # for TLS.
#
cipher_server_preference = yes
#
# [NOTE]
# ====
- # Prevents versions < tls_min_version from being negotiated.
- # In general the higher the tls_min_version the more secure
- # the protocol, but the narrower the range of supported TLS
- # clients.
+ # Prevents versions < tls_min_version from being negotiated. In
+ # general the higher the tls_min_version the more secure the
+ # protocol, but the narrower the range of supported TLS clients.
#
- # SSLv2 and SSLv3 are permanently disabled due to security
- # issues.
+ # SSLv2 and SSLv3 are permanently disabled due to security issues.
# ====
#
# tls_min_version = 1.2
#
# client_hello_parse:: Extract attributes from TLS Client Hello
#
- # For logging / diagnostics it can be beneficial to extract
- # data from the TLS Client Hello.
+ # For logging / diagnostics it can be beneficial to extract data
+ # from the TLS Client Hello.
#
- # These are placed in `session-state` so that they are
- # accessible throughout the authentication process.
+ # These are placed in `session-state` so that they are accessible
+ # throughout the authentication process.
#
# client_hello_parse = no
# verify:: Parameters for controlling client cert chain
# verification.
#
- # Certificate verification is performed in two phases.
- # The first is handled by the SSL library which checks
- # whether a trusted chain of certificates can be built
- # between the certificates loaded from `ca_file` or
- # found in `ca_path`.
+ # Certificate verification is performed in two phases. The first is
+ # handled by the SSL library which checks whether a trusted chain
+ # of certificates can be built between the certificates loaded from
+ # `ca_file` or found in `ca_path`.
#
- # The second (optional) phase is performed using the
- # `verify * { ... }` sections of the tls
- # `virtual_server`.
+ # The second (optional) phase is performed using the `verify * {
+ # ... }` sections of the tls `virtual_server`.
#
verify {
#
- # mode:: Which certificates in the verification chain
- # should be checked.
+ # mode:: Which certificates in the verification chain should be
+ # checked.
#
- # Certificate verification is performed in two phases.
- # The first is handled by the SSL library which checks
- # whether a trusted chain of certificates can be built
- # between the certificates loaded from `ca_file` or
- # found in `ca_path`.
+ # Certificate verification is performed in two phases. The first
+ # is handled by the SSL library which checks whether a trusted
+ # chain of certificates can be built between the certificates
+ # loaded from `ca_file` or found in `ca_path`.
#
- # The SSL library also checks that the correct usage
- # OIDs are present in the presented client certificate
- # and that none of the certificates have expired.
+ # The SSL library also checks that the correct usage OIDs are
+ # present in the presented client certificate and that none of the
+ # certificates have expired.
#
# [options="header,autowidth"]
# |===
# | Only verify the client certificate.
# |===
#
- # It is recommended to leave mode as `all` except
- # when debugging, or in an emergency situation.
+ # It is recommended to leave mode as `all` except when debugging,
+ # or in an emergency situation.
#
# mode = all
#
- # attribute_mode:: Which client certificates should
- # be converted to attributes for use in the
- # `verify * { ... }` sections of the specified
- # `virtual_server`.
+ # attribute_mode:: Which client certificates should be converted
+ # to attributes for use in the `verify * { ... }` sections of the
+ # specified `virtual_server`.
#
- # Attributes created during certificate processing
- # will be placed in the `session-state` list.
- # This is to simplify session-resumption, as the
- # contents of this list also contains session data
- # for stateful resumption, and this list is encoded
+ # Attributes created during certificate processing will be placed
+ # in the `session-state` list. This is to simplify
+ # session-resumption, as the contents of this list also contains
+ # session data for stateful resumption, and this list is encoded
# in the session-ticket for stateless resumption.
#
# [options="header,autowidth"]
#
# [NOTE]
# ====
- # Attribute generation is only performed on full
- # handshake, or where we detect that attributes
- # are missing from the `session-state` list during
- # stateful session-resumption.
- #
- # Certificate attributes will usually be retrieved
- # from the session-ticket in the case of
- # stateless session-resumption.
+ # Attribute generation is only performed on full handshake, or
+ # where we detect that attributes are missing from the
+ # `session-state` list during stateful session-resumption.
+ #
+ # Certificate attributes will usually be retrieved from the
+ # session-ticket in the case of stateless session-resumption.
# ====
#
# attribute_mode = client-and-issuer
#
# === TLS Session resumption
#
- # Once authentication has completed, the TLS client may be
- # provided with a session ticket which it presents
- # during the next authentication attempt.
+ # Once authentication has completed, the TLS client may be provided
+ # with a session ticket which it presents during the next
+ # authentication attempt.
#
# Presenting a session ticket allows the client to skip the
# majority of TLS tunnel setup during its next authentication
- # session. It also means that any "inner" authentication is
- # skipped, which means that any "inner" policies need to be
- # cached.
+ # session. It also means that any "inner" authentication is
+ # skipped, which means that any "inner" policies need to be cached.
#
# Enabling `Session-Resumption` is highly recommended for sites
# using slow authentication backends such as winbindd/Active
# Directory, and for access federations operating over the
# internet, such as Eduroam.
#
- # For EAP-TLS, the server also caches the client certificate,
- # as it is not supplied during session resumption. Caching the
- # client certificate allows the server to re-apply policy rules
- # for the client certificate, along with certificate expiry time.
+ # For EAP-TLS, the server also caches the client certificate, as it
+ # is not supplied during session resumption. Caching the client
+ # certificate allows the server to re-apply policy rules for the
+ # client certificate, along with certificate expiry time.
#
# Many of the configuration items in this section increase
- # security, but are disabled by default. The intent is to
- # allow the server to work in the widest possible
- # circumstances, while still being reasonably secure. In the
- # most common case (single EAP module, single server
- # certificate), this configuration is acceptable.
+ # security, but are disabled by default. The intent is to allow the
+ # server to work in the widest possible circumstances, while still
+ # being reasonably secure. In the most common case (single EAP
+ # module, single server certificate), this configuration is
+ # acceptable.
#
# However, we still recommend enabling all of the security
- # configurations below. If enabling them does not cause an
- # issue in your environment, then there is no cost to leaving
- # them enabled. They should only be disabled if clients are
- # unable to connect when the configurations are enabled.
+ # configurations below. If enabling them does not cause an issue in
+ # your environment, then there is no cost to leaving them enabled.
+ # They should only be disabled if clients are unable to connect
+ # when the configurations are enabled.
#
# [NOTE]
# ====
- # You must ensure that any attributes required for policy
- # decisions are cached along with the TLS session
- # data. This is usually done by placing policy attributes in the
- # `session-state` list, or in the case of EAP-PEAP, EAP-TTLS and
- # EAP-FAST, the `parent.session-state` list (i.e. in the request
- # which sets up the TLS part of the authentication attempt).
- #
- # Caching this data means that the policies are cached at the
- # same time as, and along with the session resumption data. In
- # most cases, it is sufficient to cache the name of a policy,
- # so that the named policy can be re-applied on session resumption.
+ # You must ensure that any attributes required for policy decisions
+ # are cached along with the TLS session data. This is usually done
+ # by placing policy attributes in the `session-state` list, or in
+ # the case of EAP-PEAP, EAP-TTLS and EAP-FAST, the
+ # `parent.session-state` list (i.e. in the request which sets up
+ # the TLS part of the authentication attempt).
+ #
+ # Caching this data means that the policies are cached at the same
+ # time as, and along with the session resumption data. In most
+ # cases, it is sufficient to cache the name of a policy, so that
+ # the named policy can be re-applied on session resumption.
# ====
#
session {
# It is recommended to set `mode = auto` *and* to provide a
# correctly configured `virtual_server`.
#
- # Some clients such as wpa_supplicant do not allow
- # session tickets by default for TLS < 1.3.
+ # Some clients such as wpa_supplicant do not allow session tickets
+ # by default for TLS < 1.3.
#
# mode = auto
# name:: Name of the context used for TLS sessions.
#
- # This name associates the TLS sessions with a
- # "namespace" so that they cannot be used for purposes
- # other than the original (intended) use-case. This
- # configuration helps to prevent accidental "leakage"
- # of session tickes. For example, if the server uses
- # multiple server certs, an attacker could try to get a
- # session ticket for one server identity, and then
- # resume the session for a different server identity.
- # Using a session ticket "namespace" makes these
- # attacks impossible.
- #
- # If you wish to share session resumption data between
- # multiple EAP modules or virtual servers, they must
- # all use the same `name`.
+ # This name associates the TLS sessions with a "namespace" so that
+ # they cannot be used for purposes other than the original
+ # (intended) use-case. This configuration helps to prevent
+ # accidental "leakage" of session tickes. For example, if the
+ # server uses multiple server certs, an attacker could try to get
+ # a session ticket for one server identity, and then resume the
+ # session for a different server identity. Using a session ticket
+ # "namespace" makes these attacks impossible.
+ #
+ # If you wish to share session resumption data between multiple
+ # EAP modules or virtual servers, they must all use the same
+ # `name`.
#
# To disable - set to a zero length string "".
#
- # NOTE: OpenSSL only allows 32 bytes of session ctx, so
- # the value provided here is first hashed with SHA256
- # before being passed to OpenSSL.
+ # NOTE: OpenSSL only allows 32 bytes of session ctx, so the value
+ # provided here is first hashed with SHA256 before being passed to
+ # OpenSSL.
#
# name = "%{EAP-Type}%interpreter('server')"
#
- # lifetime:: The period for which a resumable session remains valid.
+ # lifetime:: The period for which a resumable session remains
+ # valid.
#
- # Default is 24hrs in line with RFC 4346. RFC 8446
- # requires that ticket lifetimes must not be more than
- # 7 days.
+ # Default is 24hrs in line with RFC 4346. RFC 8446 requires that
+ # ticket lifetimes must not be more than 7 days.
#
# lifetime = 86400
#
- # require_extended_master_secret:: Only allow session
- # resumption if an extended master secret has been
- # created. This requires client support.
+ # require_extended_master_secret:: Only allow session resumption
+ # if an extended master secret has been created. This requires
+ # client support.
#
- # Extended Master Secrets (RFC 7627) are required to
- # prevent MITM attacks, where the attacker can resume
- # a session if it can insert itself into the path between
- # the TLS client and TLS server.
+ # Extended Master Secrets (RFC 7627) are required to prevent MITM
+ # attacks, where the attacker can resume a session if it can
+ # insert itself into the path between the TLS client and TLS
+ # server.
#
# See more at https://mitls.org/pages/attacks/3SHAKE
#
# require_extended_master_secret = yes
#
- # require_perfect_forward_secrecy:: Only allow session
- # resumption if a cipher which would allow perfect
- # forward secrecy has been selected.
+ # require_perfect_forward_secrecy:: Only allow session resumption
+ # if a cipher which would allow perfect forward secrecy has been
+ # selected.
#
# require_perfect_forward_secrecy = no
#
- # session_ticket_key:: Key used to encrypt stateless
- # session tickets.
+ # session_ticket_key:: Key used to encrypt stateless session
+ # tickets.
#
- # Sets a persistent key used to encrypt stateless session
- # tickets. If this is not set, then a random key will be
- # chosen when the server starts.
+ # Sets a persistent key used to encrypt stateless session tickets.
+ # If this is not set, then a random key will be chosen when the
+ # server starts.
#
- # Where a site has multiple RADIUS servers, it is
- # useful for them to share a common value for the
- # `session_ticket_key`. That way a client can
- # authenticate against one server, get a session
- # ticket, and then have that session ticket validated
- # by a different server. Such a configuration has
- # significant positive effects for increasing uptime,
- # and decreasing server load.
+ # Where a site has multiple RADIUS servers, it is useful for them
+ # to share a common value for the `session_ticket_key`. That way a
+ # client can authenticate against one server, get a session
+ # ticket, and then have that session ticket validated by a
+ # different server. Such a configuration has significant positive
+ # effects for increasing uptime, and decreasing server load.
#
- # As the key length used by OpenSSL depends on the
- # version/flavour of OpenSSL being used, the value
- # provided is fed into a HKDF function (SHA256 of the
- # key plus "freeradius-session-ticket"). The output of
- # the HKDF is then used as input to the OpenSSL keying
- # function.
+ # As the key length used by OpenSSL depends on the version/flavour
+ # of OpenSSL being used, the value provided is fed into a HKDF
+ # function (SHA256 of the key plus "freeradius-session-ticket").
+ # The output of the HKDF is then used as input to the OpenSSL
+ # keying function.
#
- # It is important that a strong key is chosen here. If the
- # key were ever revealed, then an attacker could manipulate
- # the contents of a session ticket. This could in turn
- # allow privilege escalation, or if OpenSSL's ticket parsing
- # code is less than perfect, buffer overflow attacks.
+ # It is important that a strong key is chosen here. If the key
+ # were ever revealed, then an attacker could manipulate the
+ # contents of a session ticket. This could in turn allow privilege
+ # escalation, or if OpenSSL's ticket parsing code is less than
+ # perfect, buffer overflow attacks.
#
# session_ticket_key = "super-secret-key"
# As of 4.0 OpenSSL's internal cache has been disabled due to
# scoping/threading issues.
#
- # The following configuration options are no longer
- # supported. TLS session caching is now handled by
- # FreeRADIUS either using session-tickets (stateless),
- # or using TLS `virtual_server` and storing/retrieving
- # sessions to/from an external datastore (stateful).
+ # The following configuration options are no longer supported. TLS
+ # session caching is now handled by FreeRADIUS either using
+ # session-tickets (stateless), or using TLS `virtual_server` and
+ # storing/retrieving sessions to/from an external datastore
+ # (stateful).
#
# * `enable`
# * `persist_dir`
#
# === EAP-TLS
#
- # The common TLS configuration for TLS-based EAP types is given above
- # in the `tls-config { ... }` section.
+ # The common TLS configuration for TLS-based EAP types is given
+ # above in the `tls-config { ... }` section.
#
tls {
# Point to the common TLS configuration
# `EAP-TLS` can work without a client certificate, but situations
# whether this is useful are quite limited.
#
- # Currently only the Hotspot 2.0 R2 standard uses `EAP-TLS`
- # without a peer certificate.
+ # Currently only the Hotspot 2.0 R2 standard uses `EAP-TLS` without
+ # a peer certificate.
#
- # This is to secure the SSID used to provide connectivity to the OSU
- # (Online Signup Server).
+ # This is to secure the SSID used to provide connectivity to the
+ # OSU (Online Signup Server).
#
# You can override this configuration item at run-time by setting:
#
# require_client_cert = yes
#
- # include_length:: Whether we include a length field in the TLS header.
+ # include_length:: Whether we include a length field in the TLS
+ # header.
#
- # If set to `yes`, the total length of the message is included
- # in every packet we send. If set to `no`, the total length of
- # the message is included only in the First packet of a
- # fragment series.
+ # If set to `yes`, the total length of the message is included in
+ # every packet we send. If set to `no`, the total length of the
+ # message is included only in the First packet of a fragment
+ # series.
#
- # This configuration item is here only to work around
- # historical issues with misbehaving clients. In most cases,
- # it does not need to be changed.
+ # This configuration item is here only to work around historical
+ # issues with misbehaving clients. In most cases, it does not need
+ # to be changed.
#
# include_length = yes
}
# described as EAP inside of Diameter, inside of TLS, inside of EAP,
# inside of RADIUS.
#
- # NOTE: To use `EAP-TTLS `you must also configure an `inner` method in
- # `mods-enabled/eap_inner`.
+ # NOTE: To use `EAP-TTLS `you must also configure an `inner` method
+ # in `mods-enabled/eap_inner`.
#
# Surprisingly, it works quite well.
#
- # When using `PAP`, `GTC`, or `MSCHAPv2` as an inner method, `EAP-TTLS`
- # is only secure if the supplicant validates the server certificate
- # presented. If the client disables certificate validation, then an
- # attacker can pretend to be the server, and collect user credentials.
+ # When using `PAP`, `GTC`, or `MSCHAPv2` as an inner method,
+ # `EAP-TTLS` is only secure if the supplicant validates the server
+ # certificate presented. If the client disables certificate
+ # validation, then an attacker can pretend to be the server, and
+ # collect user credentials.
#
ttls {
#
- # tls:: Point to the common TLS configuration
+ # tls:: Point to the common TLS configuration
#
- # Which `tls-config` section the TLS negotiation parameters
- # are in - see `EAP-TLS` above for an explanation.
+ # Which `tls-config` section the TLS negotiation parameters are in
+ # - see `EAP-TLS` above for an explanation.
#
tls = tls-common
# removed in v4.0.
#
# See the new policy `copy_request_to_tunnel` in
- # `sites-available/inner-tunnel`, and in `policy.d/eap` for
- # more information.
+ # `sites-available/inner-tunnel`, and in `policy.d/eap` for more
+ # information.
# ====
#
#
- # virtual_server:: The virtual server used for "inner" authentication.
+ # virtual_server:: The virtual server used for "inner"
+ # authentication.
#
- # The inner tunneled request can be sent through a virtual
- # server which verifies the inner credentials.
+ # The inner tunneled request can be sent through a virtual server
+ # which verifies the inner credentials.
#
- # If this entry is commented out, the inner tunneled request
- # will be sent through the virtual server which processed the
- # outer request. This configuration is NOT RECOMMENDED.
+ # If this entry is commented out, the inner tunneled request will
+ # be sent through the virtual server which processed the outer
+ # request. This configuration is NOT RECOMMENDED.
#
virtual_server = "inner-tunnel"
#
- # include_length:: Whether we include a length field in the TLS header.
+ # include_length:: Whether we include a length field in the TLS
+ # header.
#
- # This has the same meaning, and overwrites, the same field in
- # the `tls` configuration, above. The default value here is
- # `yes`.
+ # This has the same meaning, and overwrites, the same field in the
+ # `tls` configuration, above. The default value here is `yes`.
#
# include_length = yes
#
# require_client_cert:: Whether we require a client certificate.
#
- # `EAP-TTLS` does not require a client certificate.
- # However, you can require one by setting the
- # following option. You can also override this option by
- # setting:
+ # `EAP-TTLS` does not require a client certificate. However, you
+ # can require one by setting the following option. You can also
+ # override this option by setting:
#
# control.EAP-TLS-Require-Client-Cert = Yes
#
- # NOTE: The majority of supplicants do not support using a
- # client certificate with `EAP-TTLS`, so this option is unlikely
- # to be useful for most people.
+ # NOTE: The majority of supplicants do not support using a client
+ # certificate with `EAP-TTLS`, so this option is unlikely to be
+ # useful for most people.
#
# require_client_cert = yes
}
#
# === EAP-PEAP
#
- # The tunneled `EAP` session needs a default `EAP` type which is separate
- # from the one for the non-tunneled EAP module. Inside of the TLS/PEAP
- # tunnel, we recommend using `EAP-MS-CHAPv2`.
+ # The tunneled `EAP` session needs a default `EAP` type which is
+ # separate from the one for the non-tunneled EAP module. Inside of
+ # the TLS/PEAP tunnel, we recommend using `EAP-MS-CHAPv2`.
#
# When using `GTC`, or `MSCHAPv2` as an inner method, `PEAP` is only
# secure if the supplicant is configured to validate the server
- # certificate. See the comments above for EAP-TTLS about this topic.
+ # certificate. See the comments above for EAP-TTLS about this topic.
#
# ==== Windows compatibility
#
# [IMPORTANT]
# ====
# * If you see the server send an `Access-Challenge`, and the client never
- # sends another `Access-Request`, then *STOP*!
+ # sends another `Access-Request`, then *STOP*!
#
# * The server certificate has to have special OID's in it, or else the
- # Microsoft clients will silently fail. See the `scripts/xpextensions`
- # file for details, and the following page
+ # Microsoft clients will silently fail. See the
+ # `scripts/xpextensions` file for details, and the following page
# http://support.microsoft.com/kb/814394/en-us
#
# * If is still doesn't work, and you're using Samba, you may be
# encountering a Samba bug.
#
- # For further information, see https://bugzilla.samba.org/show_bug.cgi?id=6563
+ # For further information, see
+ # https://bugzilla.samba.org/show_bug.cgi?id=6563
#
# * Note that we do not necessarily agree with their explanation. but
# the fix does appear to work.
#
peap {
#
- # tls:: Point to the common TLS configuration
+ # tls:: Point to the common TLS configuration
#
- # Which `tls-config` section the TLS negotiation parameters are
- # in - see `EAP-TLS` above for an explanation.
+ # Which `tls-config` section the TLS negotiation parameters are in
+ # - see `EAP-TLS` above for an explanation.
#
tls = tls-common
#
- # default_eap_type:: The default EAP type proposed by the server inside of the tunnel.
+ # default_eap_type:: The default EAP type proposed by the server
+ # inside of the tunnel.
#
# The tunneled EAP session needs a default EAP type which is
- # separate from the one for the non-tunneled EAP module.
- # Inside of the PEAP tunnel, we recommend using MS-CHAPv2, as
- # that is the default type supported by Windows clients.
+ # separate from the one for the non-tunneled EAP module. Inside of
+ # the PEAP tunnel, we recommend using MS-CHAPv2, as that is the
+ # default type supported by Windows clients.
#
default_eap_type = mschapv2
# removed in v4.0.
#
# See the new policy `copy_request_to_tunnel` in
- # `sites-available/inner-tunnel`, and in `policy.d/eap`
- # for more information.
+ # `sites-available/inner-tunnel`, and in `policy.d/eap` for more
+ # information.
#
# ====
#
#
- # virtual_server:: The virtual server used for "inner" authentication.
+ # virtual_server:: The virtual server used for "inner"
+ # authentication.
#
- # The inner tunneled request can be sent through a virtual
- # server which verifies the inner credentials.
+ # The inner tunneled request can be sent through a virtual server
+ # which verifies the inner credentials.
#
- # If this entry is commented out, the inner tunneled request
- # will be sent through the virtual server which processed the
- # outer request. This configuration is NOT RECOMMENDED.
+ # If this entry is commented out, the inner tunneled request will
+ # be sent through the virtual server which processed the outer
+ # request. This configuration is NOT RECOMMENDED.
#
virtual_server = "inner-tunnel"
# require_client_cert:: Whether we require a client certificate.
#
# Unlike `EAP-TLS`, `PEAP` does not require a client certificate.
- # However, you can require one by setting the following
- # option. You can also override this option by setting
+ # However, you can require one by setting the following option. You
+ # can also override this option by setting
#
# control.EAP-TLS-Require-Client-Cert = Yes
#
- # NOTE: The majority of supplicants do not support using a
- # client certificate with `PEAP`, so this option is unlikely to
- # be useful for most people.
+ # NOTE: The majority of supplicants do not support using a client
+ # certificate with `PEAP`, so this option is unlikely to be useful
+ # for most people.
#
# require_client_cert = yes
}
# NOTE: This is the EAP MS-CHAPv2 sub-module, not the main `mschap`
# module.
#
- # In order for this sub-module to work, the main `mschap` module MUST
- # ALSO be configured.
+ # In order for this sub-module to work, the main `mschap` module
+ # MUST ALSO be configured.
#
- # This module is the *Microsoft* implementation of `MS-CHAPv2` in `EAP`.
- # There is another (*incompatible*) implementation of `MS-CHAPv2 in `EAP` by
- # Cisco, which *FreeRADIUS does not support*.
+ # This module is the *Microsoft* implementation of `MS-CHAPv2` in
+ # `EAP`. There is another (*incompatible*) implementation of
+ # `MS-CHAPv2 in `EAP` by Cisco, which *FreeRADIUS does not support*.
#
mschapv2 {
#
- # auth_type:: Which "authenticate" section is used to authenticate the MS-CHAP data.
+ # auth_type:: Which "authenticate" section is used to authenticate
+ # the MS-CHAP data.
#
# auth_type = mschap
#
- # send_error:: Whether we send an MS-CHAP error on authentication failure.
+ # send_error:: Whether we send an MS-CHAP error on authentication
+ # failure.
#
# In early versions of FreeRADIUS, the module never sent the
- # `MS-CHAP-Error` message to the client. This worked, but it had
- # issues when the cached password was wrong. The server
- # *should* send `E=691 R=0` to the client, which tells it to
- # prompt the user for a new password.
+ # `MS-CHAP-Error` message to the client. This worked, but it had
+ # issues when the cached password was wrong. The server *should*
+ # send `E=691 R=0` to the client, which tells it to prompt the user
+ # for a new password.
#
- # CAUTION: The default is `no`, which is known to work. If you
- # set `send_error = yes`, then the error message will be sent
- # back to the client. This *may* help some clients work better,
- # but *may* also cause other clients to stop working.
+ # CAUTION: The default is `no`, which is known to work. If you set
+ # `send_error = yes`, then the error message will be sent back to
+ # the client. This *may* help some clients work better, but *may*
+ # also cause other clients to stop working.
#
# send_error = no
#
# identity:: The server identifier to send back in the challenge.
#
- # It should generally be the host name of the RADIUS server.
- # Or, some information which uniquely identifies it.
+ # It should generally be the host name of the RADIUS server. Or,
+ # some information which uniquely identifies it.
#
# identity = "FreeRADIUS"
#
- # with_ntdomain_hack:: Windows clients send `User-Name` in the
- # form of `DOMAIN\User`, but sometimes calculate the
- # challenge/response based only on the `User` portion.
+ # with_ntdomain_hack:: Windows clients send `User-Name` in the form
+ # of `DOMAIN\User`, but sometimes calculate the challenge/response
+ # based only on the `User` portion.
#
- # Setting this value to `yes` makes FreeRADIUS use only the
- # "user" portion of the `User-Name` for its MS-CHAP
- # calculations.
+ # Setting this value to `yes` makes FreeRADIUS use only the "user"
+ # portion of the `User-Name` for its MS-CHAP calculations.
#
- # If this behavior seems weird and complicated, we agree.
- # There is no reason for the Windows systems to do something so
- # unfriendly. All it does is make life difficult for the
- # administrator, who has to figure out why MS-CHAP is magically
- # failing.
+ # If this behavior seems weird and complicated, we agree. There is
+ # no reason for the Windows systems to do something so unfriendly.
+ # All it does is make life difficult for the administrator, who has
+ # to figure out why MS-CHAP is magically failing.
#
# Default is `no`.
#
#
# The FAST module implements the EAP-FAST protocol.
#
- # NOTE: To use `EAP-FAST` you must also configure an `inner` method in
- # `mods-enabled/eap_inner`.
+ # NOTE: To use `EAP-FAST` you must also configure an `inner` method
+ # in `mods-enabled/eap_inner`.
#
fast {
#
- # tls:: Point to the common TLS configuration
+ # tls:: Point to the common TLS configuration
#
tls = tls-common
#
# cipher_list:: Set the list of allowed TLS cipher suites.
#
- # If `cipher_list` is set here, it will override the
- # `cipher_list` configuration from the `tls-common`
- # configuration. The `EAP-FAST` module has its own override
- # for `cipher_list` because the specifications mandate a
- # different set of ciphers than are used by the other `EAP`
- # methods.
+ # If `cipher_list` is set here, it will override the `cipher_list`
+ # configuration from the `tls-common` configuration. The `EAP-FAST`
+ # module has its own override for `cipher_list` because the
+ # specifications mandate a different set of ciphers than are used
+ # by the other `EAP` methods.
#
- # The `cipher_list` MUST include "ADH" for anonymous
- # provisioning. This is not as straightforward as appending
- # "ADH" alongside "DEFAULT" as "DEFAULT" contains "!aNULL" so
- # instead it is recommended "ALL:!EXPORT:!eNULL:!SSLv2" is used
+ # The `cipher_list` MUST include "ADH" for anonymous provisioning.
+ # This is not as straightforward as appending "ADH" alongside
+ # "DEFAULT" as "DEFAULT" contains "!aNULL" so instead it is
+ # recommended "ALL:!EXPORT:!eNULL:!SSLv2" is used
#
- # NOTE: for OpenSSL 1.1.0 and above you may need to add ":@SECLEVEL=0"
+ # NOTE: for OpenSSL 1.1.0 and above you may need to add
+ # ":@SECLEVEL=0"
#
cipher_list = "ALL:!EXPORT:!eNULL:!SSLv2"
#
# if you are running a cluster of RADIUS servers, you should make
# the value chosen here (and for `pac_opaque_key`) the same on all
- # your RADIUS servers. This value should be unique to your
- # installation. We suggest using a domain name.
+ # your RADIUS servers. This value should be unique to your
+ # installation. We suggest using a domain name.
#
authority_identity = "1234"
#
# The PAC key must be exactly 32 bytes in size.
#
- # This value MUST be secret, and MUST be generated using
- # a secure method, such as via `openssl rand -hex 32`
+ # This value MUST be secret, and MUST be generated using a secure
+ # method, such as via `openssl rand -hex 32`
#
pac_opaque_key = "0123456789abcdef0123456789ABCDEF"
#
- # virtual_server:: The virtual server used for "inner" authentication.
+ # virtual_server:: The virtual server used for "inner"
+ # authentication.
#
virtual_server = inner-tunnel
# virtual_server:: The EAP-SIM virtual server containing policy
# sections.
#
- # This configuration must be set, EAP-SIM will not function
- # without it, as certain operations such as getting SIM vectors
- # require configuration for each user.
+ # This configuration must be set, EAP-SIM will not function without
+ # it, as certain operations such as getting SIM vectors require
+ # configuration for each user.
#
virtual_server = eap-aka-sim
}
#
aka {
#
- # prefer_aka_prime:: Send the AT_BIDDING attribute in
- # AKA-Challenge messages.
+ # prefer_aka_prime:: Send the AT_BIDDING attribute in AKA-Challenge
+ # messages.
#
# When AT_BIDDING is sent in a AKA-Challenge and the supplicant
- # supports EAP-AKA-Prime, RFC 5448 states the supplicant
- # should abort the authentication attempt as a bidding down
- # attack may have occurred.
+ # supports EAP-AKA-Prime, RFC 5448 states the supplicant should
+ # abort the authentication attempt as a bidding down attack may
+ # have occurred.
#
- # If a value is not provided for this configuration item
- # it will be determined automatically by whether the
- # EAP-AKA-Prime EAP method is enabled.
+ # If a value is not provided for this configuration item it will be
+ # determined automatically by whether the EAP-AKA-Prime EAP method
+ # is enabled.
#
# prefer_aka_prime = yes
# virtual_server:: The EAP-SIM virtual server containing policy
# sections.
#
- # This configuration must be set, EAP-AKA will not function
- # without it, as certain operations such as getting vectors
- # require configuration for each user.
+ # This configuration must be set, EAP-AKA will not function without
+ # it, as certain operations such as getting vectors require
+ # configuration for each user.
#
virtual_server = eap-aka-sim
}
# sections.
#
# This configuration must be set, EAP-AKA' will not function
- # without it, as certain operations such as getting vectors
- # require configuration for each user.
+ # without it, as certain operations such as getting vectors require
+ # configuration for each user.
#
virtual_server = eap-aka-sim
}
#
# == Expansions
#
-# The rlm_eap module provides the below functions to interact with the `3GPP` and `SIM` protocols.
+# The rlm_eap module provides the below functions to interact with
+# the `3GPP` and `SIM` protocols.
#
# === %3gpp_temporary_id.decrypt('...)
#
# = EAP/Inner Module
#
# The `eap_inner` module provides a sample configuration for an `EAP`
-# module that occurs *inside* of a tunneled method. It is used to limit
-# the `EAP` types that can occur inside of the inner tunnel.
+# module that occurs *inside* of a tunneled method. It is used to
+# limit the `EAP` types that can occur inside of the inner tunnel.
#
# See also `sites-available/inner-tunnel`
#
default_eap_type = mschapv2
#
- # type:: Only EAP types listed below with a 'type = <EAP-Type>' pair will be allowed.
+ # type:: Only EAP types listed below with a 'type = <EAP-Type>' pair
+ # will be allowed.
#
type = md5
type = gtc
#
# == md5 { ... }
#
- # `md5` is OK to use the inner tunnel, as keying material is provided by
- # the outer EAP method.
+ # `md5` is OK to use the inner tunnel, as keying material is
+ # provided by the outer EAP method.
#
md5 {
}
#
tls-config tls-peer {
#
- # auto_chain:: See the `eap` module for common configuration explanation.
+ # auto_chain:: See the `eap` module for common configuration
+ # explanation.
#
# auto_chain = yes
#
- # chain { ... }:: See the `eap` module for common configuration explanation.
+ # chain { ... }:: See the `eap` module for common configuration
+ # explanation.
#
chain {
certificate_file = ${certdir}/rsa/server.pem
}
#
- # ca_file:: See the `eap` module for common configuration explanation.
+ # ca_file:: See the `eap` module for common configuration
+ # explanation.
#
ca_file = ${cadir}/rsa/ca.pem
# dh_file = ${certdir}/dh
#
- # random_file:: See the `eap` module for common configuration explanation.
+ # random_file:: See the `eap` module for common configuration
+ # explanation.
#
# random_file = /dev/urandom
#
- # fragment_size:: See the `eap` module for common configuration explanation.
+ # fragment_size:: See the `eap` module for common configuration
+ # explanation.
#
fragment_size = 16384
#
- # ca_path:: See the `eap` module for common configuration explanation.
+ # ca_path:: See the `eap` module for common configuration
+ # explanation.
#
ca_path = ${cadir}
#
- # check_cert_issuer:: See the `eap` module for common configuration explanation.
+ # check_cert_issuer:: See the `eap` module for common configuration
+ # explanation.
#
# check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd"
#
- # check_cert_cn:: See the `eap` module for common configuration explanation.
+ # check_cert_cn:: See the `eap` module for common configuration
+ # explanation.
#
# check_cert_cn = %{User-Name}
}
#
# == tls { ... }
#
- # You SHOULD use different certificates than are used
- # for the outer EAP configuration!
+ # You SHOULD use different certificates than are used for the outer
+ # EAP configuration!
#
# You can create the `inner-server.pem` file by doing:
#
#
# = Echo Module
#
-# The `echo` module an example of the `exec` module configured
-# with a `program` configuration item set so it can be called
-# as any other module, i.e.
+# The `echo` module an example of the `exec` module configured with a
+# `program` configuration item set so it can be called as any other
+# module, i.e.
#
# echo
#
-# The sample `program` below is a trivial example and should be replaced
-# with something more meaningful.
+# The sample `program` below is a trivial example and should be
+# replaced with something more meaningful.
#
-# The return value of the program run determines the result of the exec
-# instance call as follows:
+# The return value of the program run determines the result of the
+# exec instance call as follows:
#
# [options="header,autowidth"]
# |===
wait = yes
#
- # program:: The name of the program to execute, and it's
- # arguments.
+ # program:: The name of the program to execute, and it's arguments.
#
- # Dynamic translation is done on this field, so things like
- # the following example will work.
+ # Dynamic translation is done on this field, so things like the
+ # following example will work.
#
- # The example program below has a few important features
- # which should be noted:
+ # The example program below has a few important features which
+ # should be noted:
#
# * The string for the program name uses triple quotes.
# These allow the text inside of the string to contain
# a command results in the _unquoted_ string being passed
# to the command, as the argument.
#
- # The summary of all of the above is that when printing
- # attributes it's usually easier to run one shell script with
- # no arguments. That shell script can then print the
- # attribute names, operators, and values.
+ # The summary of all of the above is that when printing attributes
+ # it's usually easier to run one shell script with no arguments.
+ # That shell script can then print the attribute names, operators,
+ # and values.
#
# Any string values should also be quoted.
#
#
# safe_characters::
#
- # Characters that will not be encoded by the `%{escape}` `xlat` function.
+ # Characters that will not be encoded by the `%{escape}` `xlat`
+ # function.
#
safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ"
}
#
# = etc_group Module
#
-# The `etc_group` module provides group names from the `/etc/group` file.
+# The `etc_group` module provides group names from the `/etc/group`
+# file.
#
# NOTE: Please see the `csv` module for full documentation on the
# configuration items used here.
#
# == Configuration Settings
#
-# The `csv` module configuration for the /etc/group file. The module
+# The `csv` module configuration for the /etc/group file. The module
# adds a `Etc-Group-Name` attribute for every group that the user is
# a member of.
#
-# You will have to define the `Etc-Group-Name` in the `dictionary` file,
-# as a `string` type. For example:
+# You will have to define the `Etc-Group-Name` in the `dictionary`
+# file, as a `string` type. For example:
#
# ```
# DEFINE Etc-Group-Name string
key = User-Name
#
- # The field names are just place-holders.
- # They are NOT attribute names!
+ # The field names are just place-holders. They are NOT attribute
+ # names!
#
fields = "group:::,user"
index_field = user
#
- # Add the ETC-Group-Name attribute to the request list.
- # If the user is a member of multiple groups, then the
- # module will add multiple ETC-Group-Name attributes,
- # one for each group.
+ # Add the ETC-Group-Name attribute to the request list. If the user
+ # is a member of multiple groups, then the module will add multiple
+ # ETC-Group-Name attributes, one for each group.
#
- # The field names from the `fields` entry above are used
- # here in the right-hand side of the `update` section.
+ # The field names from the `fields` entry above are used here in the
+ # right-hand side of the `update` section.
#
update request {
ETC-Group-Name := 'group'
# == Don't use this module.
#
# We provide this module for the _extremely rare_ case when it is
-# useful. The main utility of the module is for testing, and for
+# useful. The main utility of the module is for testing, and for
# doing some unusual things which aren't possible via any other
# method.
#
# It can be appealing to just ignore `unlang`, and run `%exec()`
-# everywhere. This kind of configuration can be written quickly,
+# everywhere. This kind of configuration can be written quickly,
# means that you don't need to spend any time understanding the
-# server configuration. This process is generally more effort than
-# it is worth.
+# server configuration. This process is generally more effort than it
+# is worth.
#
-# The biggest problem with `exec` is that it is slow. Very, very,
-# very, slow. We have tested the server at 80K Access-Requests per
-# second (to OpenLDAP) on low-end hardware. This is fast enough to
+# The biggest problem with `exec` is that it is slow. Very, very,
+# very, slow. We have tested the server at 80K Access-Requests per
+# second (to OpenLDAP) on low-end hardware. This is fast enough to
# run a major ISP.
#
# In contrast, when each Access-Request causes an `exec` script to be
# run, the rate of access-Request can drop by a factor of 100 or
-# more. It is not unusual for the server to max out at a few hundred
-# authentications per second when running multiple scripts per packet.
+# more. It is not unusual for the server to max out at a few hundred
+# authentications per second when running multiple scripts per
+# packet.
#
# The server has sufficient functionality that it is essentially
-# never necessary to `exec` and external script. Please use the
+# never necessary to `exec` and external script. Please use the
# built-in functionality of the server; it is hundreds of times
# faster than running a script, and it is designed to process
-# packets. An external script is worse, by nearly all possible
+# packets. An external script is worse, by nearly all possible
# standards of measurement.
#
# == %exec() function
#
-# This module also provides a dynamic expansion function. You can
+# This module also provides a dynamic expansion function. You can
# then run a script like this:
#
# Attribute-Name = %exec('/path/to/program', 'args', ...)
# The output of `exec` is parsed and assigned to the attribute.
#
# Depending on the module configuration, the output of `%exec()` can
-# even be pairs, such as `User-Name = foo`. Those pairs can be
-# assigned to a list. If the program fails, it will output nothing.
+# even be pairs, such as `User-Name = foo`. Those pairs can be
+# assigned to a list. If the program fails, it will output nothing.
#
-# Note that when the assignment is to a list, the `exec` call _must_ be
-# inside of a double-quoted string.
+# Note that when the assignment is to a list, the `exec` call _must_
+# be inside of a double-quoted string.
#
# &request += "%exec(/path/to/program,args, ...)"
#
# program which is executed.
#
# The attributes from the list referenced in the `input_pairs`
-# configuration item will be placed into environment variables of the executed
-# program.
+# configuration item will be placed into environment variables of the
+# executed program.
#
-# Alternatively, by setting the `program` item of the module configuration,
-# the module can be called as a module rather than as an xlat function.
-# See the `echo` module for an example of this.
+# Alternatively, by setting the `program` item of the module
+# configuration, the module can be called as a module rather than as
+# an xlat function. See the `echo` module for an example of this.
#
# In this scenario, if the configuration item `output_pairs` is set,
# and the `wait` configuration item is set to "yes", the output of
-# executing the program will be parsed for attribute pairs which
-# will be added to the list referenced in `output_pairs`.
+# executing the program will be parsed for attribute pairs which will
+# be added to the list referenced in `output_pairs`.
#
-# When called as a module, the return value of the program run determines
-# the result of the exec instance call as follows:
+# When called as a module, the return value of the program run
+# determines the result of the exec instance call as follows:
#
# [options="header,autowidth"]
# |===
#
# wait:: Wait for the program to finish.
#
- # If we do NOT wait, then the program is "fire and
- # forget", and any output attributes from it are ignored.
+ # If we do NOT wait, then the program is "fire and forget", and any
+ # output attributes from it are ignored.
#
- # If we are looking for the program to output
- # attributes, and want to add those attributes to the
- # request, then we MUST wait for the program to
- # finish, and therefore set `wait=yes`
+ # If we are looking for the program to output attributes, and want
+ # to add those attributes to the request, then we MUST wait for the
+ # program to finish, and therefore set `wait=yes`
#
wait = yes
#
- # program:: The name of the program to execute, and it's
- # arguments, when called as a module.
+ # program:: The name of the program to execute, and it's arguments,
+ # when called as a module.
#
- # The string is dynamically expanded, so it can contain
- # attribute references, etc. However, quoting of programs
- # and arguments is complex. The program name and arguments
- # are parsed by the server as a single string. But that
- # string is parsed by the shell into multiple arguments,
- # which are then passed to the program.
+ # The string is dynamically expanded, so it can contain attribute
+ # references, etc. However, quoting of programs and arguments is
+ # complex. The program name and arguments are parsed by the server
+ # as a single string. But that string is parsed by the shell into
+ # multiple arguments, which are then passed to the program.
#
- # We recommend not using the `exec` module, and instead using
- # the `%exec(...)` function. That function will generally be
- # easier to use and understand.
+ # We recommend not using the `exec` module, and instead using the
+ # `%exec(...)` function. That function will generally be easier to
+ # use and understand.
#
- # Where this module is used, the `program` string below
- # should use triple quotes. These allow the text inside of
- # the string to contain double-quote characters without
- # needing to escape them. This doesn't affect the output
- # string, but it does make the configuration easier to read.
+ # Where this module is used, the `program` string below should use
+ # triple quotes. These allow the text inside of the string to
+ # contain double-quote characters without needing to escape them.
+ # This doesn't affect the output string, but it does make the
+ # configuration easier to read.
#
- # If the program is expected to take quoted strings as
- # arguments, then the quotes have to be done carefully. See
- # the `echo` module for more information, and for a worked
- # example/
+ # If the program is expected to take quoted strings as arguments,
+ # then the quotes have to be done carefully. See the `echo` module
+ # for more information, and for a worked example/
#
- # The summary of all of the above is that it's usually easier
- # to run one shell script with no arguments. That shell
- # script can then print the attribute names, operators, and
- # values.
+ # The summary of all of the above is that it's usually easier to run
+ # one shell script with no arguments. That shell script can then
+ # print the attribute names, operators, and values.
#
# program = """/bin/true "%{User-Name}" """
#
- # input_pairs:: The attributes which are placed into the
- # environment variables for the program.
+ # input_pairs:: The attributes which are placed into the environment
+ # variables for the program.
#
- # The `input_pairs` can be any "group" style attribute.
- # Usually it is the top-level list such as `request`,
- # `reply`, etc.
+ # The `input_pairs` can be any "group" style attribute. Usually it
+ # is the top-level list such as `request`, `reply`, etc.
#
input_pairs = request
# The values allowed are the same as for the `input_pairs`.
#
# This configuration item is used only when the `program`
- # configuration item is set, and when `wait = yes` is also
- # set. Otherwise it is ignored.
+ # configuration item is set, and when `wait = yes` is also set.
+ # Otherwise it is ignored.
#
# output_pairs = reply
#
# shell_escape:: Escape the environment variables.
#
- # If this is set, all the RADIUS attributes are capitalised and dashes
- # replaced with underscores. Also, RADIUS values are surrounded with
- # double-quotes.
+ # If this is set, all the RADIUS attributes are capitalised and
+ # dashes replaced with underscores. Also, RADIUS values are
+ # surrounded with double-quotes.
#
# That is to say:
#
# User-Name=BobUser => USER_NAME="BobUser"
#
# Note that this escaping only applies to environmental variables
- # created from the request list. For environmental variables inherited
- # from the main radiusd process no escaping is applied.
+ # created from the request list. For environmental variables
+ # inherited from the main radiusd process no escaping is applied.
#
shell_escape = yes
#
- # env_inherit:: Pass the server environment variables to the called program
+ # env_inherit:: Pass the server environment variables to the called
+ # program
#
- # For security, the server environment variables are not passed to the
- # program being executed. Setting this flag to `yes` will pass the
- # server environment variables to the program.
+ # For security, the server environment variables are not passed to
+ # the program being executed. Setting this flag to `yes` will pass
+ # the server environment variables to the program.
#
- # Any `input_pairs` will be merged with these environmental variables.
+ # Any `input_pairs` will be merged with these environmental
+ # variables.
#
# The default is `no`.
#
# Default is `10` seconds, which should be plenty for nearly
# anything. Range is `1` to `30` seconds.
#
- # WARNING: You are strongly encouraged to NOT increase this
- # value. In fact, you are much better off decreasing it to a
- # lower value. Doing so will improve network stability and
- # responsiveness.
+ # WARNING: You are strongly encouraged to NOT increase this value.
+ # In fact, you are much better off decreasing it to a lower value.
+ # Doing so will improve network stability and responsiveness.
#
timeout = 10
}
#
# = Files Module
#
-# The `users` file as located in `mods-config/files/authorize`. (Livingston-style format).
+# The `users` file as located in `mods-config/files/authorize`.
+# (Livingston-style format).
#
-# See the doc/antora/modules/reference/pages/raddb/mods-config/files/users.adoc file for information
-# on the format of the input file, and how it operates.
+# See the
+# doc/antora/modules/reference/pages/raddb/mods-config/files/users.adoc
+# file for information on the format of the input file, and how it
+# operates.
#
#
#
# key:: The default key attribute to use for matches.
#
- # The content of this attribute is used to match the `name` of the entry.
+ # The content of this attribute is used to match the `name` of the
+ # entry.
#
- # Note that unlike v4, the key does not have to be a string, but could instead
- # be an IP address or netmask!
+ # Note that unlike v4, the key does not have to be a string, but
+ # could instead be an IP address or netmask!
#
# key = "%{Stripped-User-Name || User-Name}"
filename = ${moddir}/authorize
#
- # match_attr:: List and attribute to populate with the `name` of the matched entry.
+ # match_attr:: List and attribute to populate with the `name` of the
+ # matched entry.
#
- # NOTE: the attriubte type should be capable of holding data of the type
- # used as key values.
- # Particularly useful if matching IP addresses to subnets, since the populated
- # value will be the subnet. In that case it is best to use `0.0.0.0/0` in place
- # of `DEFAULT` for any catch-all entries.
+ # NOTE: the attriubte type should be capable of holding data of the
+ # type used as key values. Particularly useful if matching IP
+ # addresses to subnets, since the populated value will be the
+ # subnet. In that case it is best to use `0.0.0.0/0` in place of
+ # `DEFAULT` for any catch-all entries.
#
# match_attr = control.User-Category
#
# v3_compat:: Version 3 compatibility flag.
#
- # When this flag is set, any enumeration names (e.g. Service-Type := Framed-User)
- # do not need to have the v4 "::" prefix. This flag helps with migrating v3
- # configurations to v4.
+ # When this flag is set, any enumeration names (e.g. Service-Type :=
+ # Framed-User) do not need to have the v4 "::" prefix. This flag
+ # helps with migrating v3 configurations to v4.
#
- # Default value "false". Allowed vaues, `true` and `false`.
+ # Default value "false". Allowed vaues, `true` and `false`.
#
# v3_compat = false
}
#
# max_resp_size:: Maximum accepted response size
#
- # If the server returns responses larger than this
- # they will be discarded.
+ # If the server returns responses larger than this they will be
+ # discarded.
# max_resp_size = 16k
#
# binary:: Should the response be treated as binary data
#
- # If this is `yes` then the output data will be octets.
- # If it is `no` then the output data will be a string.
+ # If this is `yes` then the output data will be octets. If it is
+ # `no` then the output data will be a string.
# binary = no
#
- # connection { ... }:: Configure how connection handles are
- # managed per thread.
+ # connection { ... }:: Configure how connection handles are managed
+ # per thread.
#
connection {
#
- # Reusable connection handles are allocated in blocks. These
+ # Reusable connection handles are allocated in blocks. These
# parameters allow for tuning how that is done.
#
# Since ftp requests are performed async, the settings here
reuse {
#
- # min:: The minimum number of connection handles to
- # keep allocated.
+ # min:: The minimum number of connection handles to keep
+ # allocated.
#
min = 10
#
- # max:: The maximum number of reusable connection handles
- # to allocate.
+ # max:: The maximum number of reusable connection handles to
+ # allocate.
#
- # Any requests to allocate a connection handle beyond
- # this number will cause a temporary handle to be allocated.
- # This is less efficient than the block allocation so
- # `max` should be set to reflect the number of outstanding
- # requests expected at peak load.
+ # Any requests to allocate a connection handle beyond this number
+ # will cause a temporary handle to be allocated. This is less
+ # efficient than the block allocation so `max` should be set to
+ # reflect the number of outstanding requests expected at peak
+ # load.
max = 100
#
- # cleanup_interval:: How often to free un-used connection
- # handles.
+ # cleanup_interval:: How often to free un-used connection handles.
#
- # Every `cleanup_interval` a cleanup routine runs which
- # will free any blocks of handles which are not in use,
- # ensuring that at least `min` handles are kept.
+ # Every `cleanup_interval` a cleanup routine runs which will free
+ # any blocks of handles which are not in use, ensuring that at
+ # least `min` handles are kept.
#
cleanup_interval = 30s
#
# connect_timeout:: Connection timeout (in seconds).
#
- # The maximum amount of time to wait for a new connection to be established.
+ # The maximum amount of time to wait for a new connection to be
+ # established.
#
connect_timeout = 3.0
}
# home_server = home3
# }
#
-# This translates to a `load-balance` section with name `pool1`, and the following contents.
+# This translates to a `load-balance` section with name `pool1`, and
+# the following contents.
#
load-balance pool1 {
#
- # `home1`, `home2`, and `home3` should be instances of the `radius` module.
+ # `home1`, `home2`, and `home3` should be instances of the `radius`
+ # module.
#
home1
home2
#
# If you are using a Load-Balance-Key in v3, that can be translated
# to a v4 configuration by simply specifying an option to the
-# `load-balance` section. For example, to load balance on
+# `load-balance` section. For example, to load balance on
# `Calling-Station-Id`, the above `pool1` configuration can be
# modified with one addition:
#
#
# == Using the home_server_pool
#
-# In this configuration, `pool1` is a _virtual module_. That is, it
-# can be referred to by name as a module: `pool1`. This name can be
+# In this configuration, `pool1` is a _virtual module_. That is, it
+# can be referred to by name as a module: `pool1`. This name can be
# used anywhere that a module name is allowed.
#
# The need to use the pool as a module is the one major difference in
-# proxying between v3 and v4. In v3, proxying was an automatic thing
-# that happened when a special attribute got set.
-# e.g. `Proxy-To-Realm = ...`, or `Home-Server = ...`.
+# proxying between v3 and v4. In v3, proxying was an automatic thing
+# that happened when a special attribute got set. e.g.
+# `Proxy-To-Realm = ...`, or `Home-Server = ...`.
#
# In v4, proxying happens only when you explicitly configure the
-# server to run the `radius` module. The simplest way to do this is
+# server to run the `radius` module. The simplest way to do this is
# to add a section:
#
# ```
# }
# ```
#
-# And then set `Auth-Type := proxy`. See the sites-available/proxy
+# And then set `Auth-Type := proxy`. See the sites-available/proxy
# example for more information.
#
#
# }
# ```
#
-# This translates to the `radius` module, with name `home1`, and the following contents.
+# This translates to the `radius` module, with name `home1`, and the
+# following contents.
#
-# See the `radius` module for more information about its full configuration.
+# See the `radius` module for more information about its full
+# configuration.
#
radius home1 {
transport = udp
}
#
-# You can add `home2`, `home3`, etc. here. They do not need to be in separate files.
+# You can add `home2`, `home3`, etc. here. They do not need to be in
+# separate files.
#
#
# The module `icmp` is used for sending ICMP Echo Request messages.
#
-# This module is useful only for `xlat`. Use it via the following expansion:
+# This module is useful only for `xlat`. Use it via the following
+# expansion:
#
# `%icmp(192.0.2.1)`
#
-# The module will "ping" the given IP address. If that IP address responds
-# with an ICMP Echo Reply, then the result of the expansion will be `yes`.
-# If that IP address does not respond within the timeout, then the result
-# of the expansion will be `no`.
+# The module will "ping" the given IP address. If that IP address
+# responds with an ICMP Echo Reply, then the result of the expansion
+# will be `yes`. If that IP address does not respond within the
+# timeout, then the result of the expansion will be `no`.
#
-# The IP address does not have to be a fixed string. It can be another
-# expansion, such as:
+# The IP address does not have to be a fixed string. It can be
+# another expansion, such as:
#
# `%icmp:(%{NAS-IP-Address})`
#
#
# By default, packets are sent via the normal routing table.
#
- # Specifying an interface forces the packets to be sent via
- # that particular interface.
+ # Specifying an interface forces the packets to be sent via that
+ # particular interface.
#
# interface = eth0
# Default is `1` seconds, which should be plenty for nearly
# anything. Range is `0.1s` to `10s`.
#
- # WARNING: You are strongly encouraged to NOT increase this
- # value. In fact, you are much better off decreasing it to a
- # lower value. Doing so will improve network stability and
- # responsiveness.
+ # WARNING: You are strongly encouraged to NOT increase this value.
+ # In fact, you are much better off decreasing it to a lower value.
+ # Doing so will improve network stability and responsiveness.
#
timeout = 1s
}
#
# == Ping for IPv4
#
-# Copy of the `icmp` module, as it may be easier to remember `ping` than `icmp`.
+# Copy of the `icmp` module, as it may be easier to remember `ping`
+# than `icmp`.
#
icmp ping {
timeout = 1s
#
# = IDN Module
#
-# The `idn` (Internationalised domain names) encoding for DNS aka IDNA
-# standardized in RFC 3490.
+# The `idn` (Internationalised domain names) encoding for DNS aka
+# IDNA standardized in RFC 3490.
#
# [NOTE]
# ====
# The expansion string: `%idn(example.com)` results in an ASCII
-# punycode version of the domain name. That version can then be used
-# for name comparisons. Using an `i18n` version of the name is *NOT
+# punycode version of the domain name. That version can then be used
+# for name comparisons. Using an `i18n` version of the name is *NOT
# RECOMMENDED*, as that version is not canonical.
#
# i.e. the `same` domain name can be represented in many, many,
-# different ways. Only the `idn` version has *one* representation.
+# different ways. Only the `idn` version has *one* representation.
# ====
#
#
# = IMAP Module
#
-# The `imap` module validates a users name and password against an IMAP server.
-# It should be called from an `authenticate` section.
+# The `imap` module validates a users name and password against an
+# IMAP server. It should be called from an `authenticate` section.
#
-# The module can optionally perform a tls handshake, enabled with require_cert
+# The module can optionally perform a tls handshake, enabled with
+# require_cert
#
imap {
#
- # tls { ... }:: Configure the tls related items which control
- # how FreeRADIUS connects to an IMAP server.
+ # tls { ... }:: Configure the tls related items which control how
+ # FreeRADIUS connects to an IMAP server.
#
tls {
#
# Certificate validation options
#
- # Specifies how the certificate(s) presented by the
- # IMAP server are validated, and which certificates
- # (if any) to send to that IMAP server.
+ # Specifies how the certificate(s) presented by the IMAP server are
+ # validated, and which certificates (if any) to send to that IMAP
+ # server.
#
- # The options here behave the same as the options in
- # other `tls` sections in the server.
+ # The options here behave the same as the options in other `tls`
+ # sections in the server.
#
#
- # certificate_file:: PEM formatted file containing the certificate we present to the IMAP server
+ # certificate_file:: PEM formatted file containing the certificate
+ # we present to the IMAP server
#
- # Specifies a certificate and any intermediary CAs we should send to the IMAP server.
+ # Specifies a certificate and any intermediary CAs we should send
+ # to the IMAP server.
#
- # This file should usually contain the client certificate file first, then any
- # intermediary signing CAs, shallowest (direct signee of the certificate_file)
- # to deepest (signed directly by the root CA).
+ # This file should usually contain the client certificate file
+ # first, then any intermediary signing CAs, shallowest (direct
+ # signee of the certificate_file) to deepest (signed directly by
+ # the root CA).
#
# certificate_file = /path/to/radius.pem
#
- # ca_file:: PEM formatted file containing the chain
- # to validate the IMAP server's certificate.
+ # ca_file:: PEM formatted file containing the chain to validate the
+ # IMAP server's certificate.
#
- # Any certificate chain MUST be in order from server
- # certificate (first in the file) to intermediary CAs (second) to
- # Root CA (last in the file) as per RFC 4346 Section 7.4.2 (see certificate_list)
+ # Any certificate chain MUST be in order from server certificate
+ # (first in the file) to intermediary CAs (second) to Root CA (last
+ # in the file) as per RFC 4346 Section 7.4.2 (see certificate_list)
#
- # Providing a complete certificate chain here is the
- # most common way of validating the certificate
- # presented by an IMAP server.
+ # Providing a complete certificate chain here is the most common
+ # way of validating the certificate presented by an IMAP server.
#
# ca_file = "${certdir}/cacert.pem"
#
- # ca_issuer_file:: PEM formatted file containing the
- # CA that signed the IMAP server's certificate.
+ # ca_issuer_file:: PEM formatted file containing the CA that signed
+ # the IMAP server's certificate.
#
- # Specifies the certificate which directly signed
- # the certificate presented by the IMAPs server.
+ # Specifies the certificate which directly signed the certificate
+ # presented by the IMAPs server.
#
- # This configuration option can be used to prevent
- # certificates passing validation which were signed
- # by other intermediary CAs, or root CAs, in the
- # trusted certificate chain.
+ # This configuration option can be used to prevent certificates
+ # passing validation which were signed by other intermediary CAs,
+ # or root CAs, in the trusted certificate chain.
#
# ca_issuer_file = "${certdir}/caissuer.pem"
#
- # ca_path:: A directory containing multiple root CA certs named by their hash.
+ # ca_path:: A directory containing multiple root CA certs named by
+ # their hash.
#
# See the OpenSSL documentation for more details:
# - https://www.openssl.org/docs/man1.1.0/man3/SSL_CTX_set_default_verify_paths.html
# - https://www.openssl.org/docs/man1.1.1/man1/c_rehash.html
#
- # This configuration option should only be used when the IMAP server being contacted
- # is not known ahead of time (using a URL from an external source), and/or the CA used
- # to sign the IMAP server certificate is unknown.
+ # This configuration option should only be used when the IMAP
+ # server being contacted is not known ahead of time (using a URL
+ # from an external source), and/or the CA used to sign the IMAP
+ # server certificate is unknown.
#
- # If not set, then whatever libcurl has as its default will be used, which typically
- # will be the operating system's set of trusted CAs. This will be visible in the debug
- # output when FreeRADIUS starts.
+ # If not set, then whatever libcurl has as its default will be
+ # used, which typically will be the operating system's set of
+ # trusted CAs. This will be visible in the debug output when
+ # FreeRADIUS starts.
#
# ca_path = "${certdir}"
#
- # private_key_file:: PEM formatted file containing the private key for the specified `certificate_file`
+ # private_key_file:: PEM formatted file containing the private key
+ # for the specified `certificate_file`
#
# This item must be specified if `certificate_file` is being used.
#
# private_key_file = /path/to/radius.key
#
- # private_key_password:: Password used to decrypt the `private_key_file`.
+ # private_key_password:: Password used to decrypt the
+ # `private_key_file`.
#
# private_key_password = "supersecret"
#
- # random_file:: Source of random data used for various cryptographic functions.
+ # random_file:: Source of random data used for various
+ # cryptographic functions.
#
# random_file = /dev/urandom
# check_cert = no
#
- # request_cert:: Options for controlling how the
- # module requests TLS to the IMAP server.
+ # request_cert:: Options for controlling how the module requests
+ # TLS to the IMAP server.
#
# May be one of:
#
# check_cert_cn = no
#
- # extract_cert_attrs:: Extract OIDs from presented certificates as OIDs.
+ # extract_cert_attrs:: Extract OIDs from presented certificates as
+ # OIDs.
#
# Default is `no`
#
#
# uri:: URI which will be used for connecting to the IMAP server.
#
- # The `imap` module uses Curl (https://curl.haxx.se/libcurl/) to implement
- # the underlying mail protocols. The URI should be in the form of:
+ # The `imap` module uses Curl (https://curl.haxx.se/libcurl/) to
+ # implement the underlying mail protocols. The URI should be in the
+ # form of:
#
# `SCHEME://IP:PORT/`
#
uri = "imap://192.0.20.1/"
#
- # timeout:: How long the module will wait before giving up on the response
- # from the IMAP server.
+ # timeout:: How long the module will wait before giving up on the
+ # response from the IMAP server.
#
timeout = 5s
#
- # connection { .. }:: Configure how connection handles are
- # managed per thread.
+ # connection { .. }:: Configure how connection handles are managed
+ # per thread.
#
connection {
#
- # Reusable connection handles are allocated in blocks. These
+ # Reusable connection handles are allocated in blocks. These
# parameters allow for tuning how that is done.
#
# Since http requests are performed async, the settings here
reuse {
#
- # min:: The minimum number of connection handles to
- # keep allocated.
+ # min:: The minimum number of connection handles to keep
+ # allocated.
#
min = 10
#
- # max:: The maximum number of reusable connection handles
- # to allocate.
+ # max:: The maximum number of reusable connection handles to
+ # allocate.
#
- # Any requests to allocate a connection handle beyond
- # this number will cause a temporary handle to be allocated.
- # This is less efficient than the block allocation so
- # `max` should be set to reflect the number of outstanding
- # requests expected at peak load.
+ # Any requests to allocate a connection handle beyond this number
+ # will cause a temporary handle to be allocated. This is less
+ # efficient than the block allocation so `max` should be set to
+ # reflect the number of outstanding requests expected at peak
+ # load.
max = 100
#
- # cleanup_interval:: How often to free un-used connection
- # handles.
+ # cleanup_interval:: How often to free un-used connection handles.
#
- # Every `cleanup_interval` a cleanup routine runs which
- # will free any blocks of handles which are not in use,
- # ensuring that at least `min` handles are kept.
+ # Every `cleanup_interval` a cleanup routine runs which will free
+ # any blocks of handles which are not in use, ensuring that at
+ # least `min` handles are kept.
#
cleanup_interval = 30s
#
# = Interval Module
#
-# The `interval` module provides interval limiting functionality via an
-# xlat function.
+# The `interval` module provides interval limiting functionality via
+# an xlat function.
#
# == xlat for interval limiting
#
# This function returns `true` if the request is allowed, or `false`
# if the interval limit has been exceeded.
#
-# interval:: Time period for the interval limit (e.g., `1s`, `500ms`).
+# interval:: Time period for the interval limit (e.g., `1s`,
+# `500ms`).
#
# key:: Optional key to track interval limits separately. If omitted,
# interval limiting is applied per xlat call site.
#
# The module supports two scopes for interval limit tracking:
#
-# global:: Interval limits are shared across all worker threads.
-# Use this when you need server-wide interval limiting.
+# global:: Interval limits are shared across all worker threads. Use
+# this when you need server-wide interval limiting.
#
-# thread:: Interval limits are tracked per worker thread.
-# Use this for higher performance when approximate interval limiting
-# is acceptable. If no key argument is specified in thread mode,
-# then the cost is reduced further.
+# thread:: Interval limits are tracked per worker thread. Use this
+# for higher performance when approximate interval limiting is
+# acceptable. If no key argument is specified in thread mode, then
+# the cost is reduced further.
#
-# NOTE: With `scope = thread`, the effective interval limit is multiplied
-# by the number of worker threads, as each thread tracks independently.
+# NOTE: With `scope = thread`, the effective interval limit is
+# multiplied by the number of worker threads, as each thread tracks
+# independently.
#
#
#
# scope:: Whether interval limits are global or per-thread.
#
- # `global` - Interval limits shared across all threads (requires locking).
- # `thread` - Interval limits tracked per-thread (higher performance).
+ # `global` - Interval limits shared across all threads (requires
+ # locking). `thread` - Interval limits tracked per-thread (higher
+ # performance).
#
scope = global
}
#
# == Thread-scoped instance
#
-# This instance uses per-thread interval limiting for higher performance.
+# This instance uses per-thread interval limiting for higher
+# performance.
#
interval interval_thread {
scope = thread
#
# When the module is listed in the `recv Discover` section, it will
# look up the client by `client-identifier`, or failing that, by
-# `hardware ethernet`. If found, the module will apply a
+# `hardware ethernet`. If found, the module will apply a
# `fixed-address` option to assign an IP address.
#
-# Leases are *not* handled by this module. Instead, you should use
-# the `sqlippool` module in the `send Offer` section. After an IP
+# Leases are *not* handled by this module. Instead, you should use
+# the `sqlippool` module in the `send Offer` section. After an IP
# address has been allocated, list `isc_dhcp`.
#
# The module will then apply any matching options to the packet.
#
# pedantic:: Be harsh or forgiving about what we parse
#
- # The `isc_dhcp` module implements only a small subset of the
- # ISC DHCP configuration file commands. However, the module
- # *parses* just about everything that is allowable in the ISC
- # DHCP configuration.
+ # The `isc_dhcp` module implements only a small subset of the ISC
+ # DHCP configuration file commands. However, the module *parses*
+ # just about everything that is allowable in the ISC DHCP
+ # configuration.
#
- # The goal here is to allow an easy migration from ISC DHCP
- # to FreeRADIUS, by just copying over "dhcpd.conf".
- # FreeRADIUS will at least start, instead of complaining
- # about everything.
+ # The goal here is to allow an easy migration from ISC DHCP to
+ # FreeRADIUS, by just copying over "dhcpd.conf". FreeRADIUS will at
+ # least start, instead of complaining about everything.
#
- # If `pedantic = true`, then the module will fail with an
- # error when it sees a command it does not support.
+ # If `pedantic = true`, then the module will fail with an error when
+ # it sees a command it does not support.
#
- # The module will also issue warnings for commands which are
- # ignored (e.g. OMAPI ones, "listen on port X", and similar).
- # The module will also issue warnings for commands which
- # should be implemented at some point.
+ # The module will also issue warnings for commands which are ignored
+ # (e.g. OMAPI ones, "listen on port X", and similar). The module
+ # will also issue warnings for commands which should be implemented
+ # at some point.
#
# If a command does not produce any errors or warnings, it is
# implemented and supported.
#
# === Supported Keywords
#
-# The following keywords are have the same meaning and behavior as ISC DHCP.
+# The following keywords are have the same meaning and behavior as
+# ISC DHCP.
#
# [options="header,autowidth"]
# |===
# == Ignored Keywords
#
# The following keywords control ISC DHCP behavior such as network
-# IP/port, LDAP access, etc. These keywords are ignored even when
-# the module is configured with `pedantic = true`
+# IP/port, LDAP access, etc. These keywords are ignored even when the
+# module is configured with `pedantic = true`
#
# [options="header,autowidth"]
# |===
#
# = JSON Module
#
-# The `json` module registers a `map` function to allow mapping fields from
-# JSON structures to attributes. It also adds some xlats for processing and
-# generating JSON documents.
+# The `json` module registers a `map` function to allow mapping
+# fields from JSON structures to attributes. It also adds some xlats
+# for processing and generating JSON documents.
#
# == JSON 'map' function
#
-# The path through the JSON document's tree is specified with FR jpath,
-# which is the FreeRADIUS implementation of the jpath grammar described
-# at http://goessner.net/articles/JsonPath/
+# The path through the JSON document's tree is specified with FR
+# jpath, which is the FreeRADIUS implementation of the jpath grammar
+# described at http://goessner.net/articles/JsonPath/
#
# Selectors currently implemented are:
#
#
# == Sample
#
-# Assuming that the URL http://example.org/api/user/$username replies with
-# some JSON content as below.
+# Assuming that the URL http://example.org/api/user/$username replies
+# with some JSON content as below.
#
# [source, json]
# ----
# }
# ----
#
-# In this case, the `rest` module can be used to get the JSON data and the
-# fields can be accessed using 'map' as shown in the example below.
+# In this case, the `rest` module can be used to get the JSON data
+# and the fields can be accessed using 'map' as shown in the example
+# below.
#
# [source, unlang]
# ----
encode {
#
- # output_mode:: set the format of JSON documenta
- # that should be created. This may be one of:
+ # output_mode:: set the format of JSON documenta that should be
+ # created. This may be one of:
#
# - object
# - object_simple
#
attribute {
#
- # prefix:: Add a colon-delimited prefix to all
- # attribute names in the output document. For example,
- # with a prefix of "foo", `User-Name` will be output as
- # `foo:User-Name`.
+ # prefix:: Add a colon-delimited prefix to all attribute names in
+ # the output document. For example, with a prefix of "foo",
+ # `User-Name` will be output as `foo:User-Name`.
#
# prefix =
}
#
# single_value_as_array:: always put values in an array
#
- # Output formats will by default put single values as a
- # JSON object (string, integer, etc). More than one
- # value will, depending on the output format, be added
- # as an array.
+ # Output formats will by default put single values as a JSON
+ # object (string, integer, etc). More than one value will,
+ # depending on the output format, be added as an array.
#
- # When this option is enabled, values will always be
- # added as an array.
+ # When this option is enabled, values will always be added as an
+ # array.
#
# single_value_as_array = no
#
- # enum_as_integer:: output the integer value of
- # enumerated attributes
+ # enum_as_integer:: output the integer value of enumerated
+ # attributes
#
- # Where an attribute has enum values, the textual
- # representation of the value will normally be output.
- # Enable this option to force the numeric value
- # instead.
+ # Where an attribute has enum values, the textual representation
+ # of the value will normally be output. Enable this option to
+ # force the numeric value instead.
#
# enum_as_integer = no
#
# always_string:: force all values to be strings
#
- # Integer values are normally written to the JSON
- # document as numbers (i.e. without quotes). Enable
- # this option to force all values to be as quoted
- # strings.
+ # Integer values are normally written to the JSON document as
+ # numbers (i.e. without quotes). Enable this option to force all
+ # values to be as quoted strings.
#
# always_string = no
#
# == Expansions
#
-# rlm_json provides the below xlat functions to handle the JSON documents.
+# rlm_json provides the below xlat functions to handle the JSON
+# documents.
#
# === %json.jpath_validate(...)
#
#
# [source,unlang]
# ----
-# string payload
-# payload := '$.my.json.payload[1]'
-# reply.Reply-Message := "Validation of %{payload} is %json.jpath_validate($.my.json.payload[1])"
+# string payload payload := '$.my.json.payload[1]'
+# reply.Reply-Message := "Validation of %{payload} is
+# %json.jpath_validate($.my.json.payload[1])"
# ----
#
# .Output
#
# [source,unlang]
# ----
-# string path
-# path := "caipirinha/gelada"
-# reply.Reply-Message := "The string %{path} should be %json.quote(%{path}) to be a valid JSON string."
+# string path path := "caipirinha/gelada" reply.Reply-Message := "The
+# string %{path} should be %json.quote(%{path}) to be a valid JSON
+# string."
# ----
#
# .Output
#
# === %json.encode(...)
#
-# Generates a JSON document from a given list of attribute templates. The
-# format of document generated can be controlled with the 'encode' section in
-# the module configuration. Attribute values will automatically be escaped so
-# they are JSON-safe.
+# Generates a JSON document from a given list of attribute templates.
+# The format of document generated can be controlled with the
+# 'encode' section in the module configuration. Attribute values will
+# automatically be escaped so they are JSON-safe.
#
-# NOTE: The name of the xlat is based on the instance name of this module. If
-# the module was defined as `json jdoc {...}`, then the xlat name will be
-# `jdoc_encode`.
+# NOTE: The name of the xlat is based on the instance name of this
+# module. If the module was defined as `json jdoc {...}`, then the
+# xlat name will be `jdoc_encode`.
#
-# The xlat should be passed a list of attributes to encode. Each attribute
-# (after template expansion) will be added to a list of attributes to include
-# in the JSON document. If any of the attributes given are preceded with a `!`
-# then they are removed from the list. Once all attributes have been processed,
-# the JSON document will be created using this list.
+# The xlat should be passed a list of attributes to encode. Each
+# attribute (after template expansion) will be added to a list of
+# attributes to include in the JSON document. If any of the
+# attributes given are preceded with a `!` then they are removed from
+# the list. Once all attributes have been processed, the JSON
+# document will be created using this list.
#
-# For example, the following will produce a JSON document with two attributes in
-# it, `User-Name` and `Calling-Station-Id`, from the RADIUS request:
+# For example, the following will produce a JSON document with two
+# attributes in it, `User-Name` and `Calling-Station-Id`, from the
+# RADIUS request:
#
# .Example
#
# %json.encode('User-Name', 'Calling-Station-Id')
# ```
#
-# The following will include all attributes in the RADIUS request, except for
-# `User-Password`:
+# The following will include all attributes in the RADIUS request,
+# except for `User-Password`:
#
# .Example
#
# %json.encode('request[*]', '!User-Password')
# ```
#
-# In another (contrived) example, all the attributes in the RADIUS request will
-# be included in the document, _except_ any attributes in the RADIUS reply.
-# `User-Name` will be included from the control list, too, if it exists:
+# In another (contrived) example, all the attributes in the RADIUS
+# request will be included in the document, _except_ any attributes
+# in the RADIUS reply. `User-Name` will be included from the control
+# list, too, if it exists:
#
# .Example
#
#
# ==== Output format modes
#
-# There are a number of output modes, each generating a different format of
-# JSON document.
+# There are a number of output modes, each generating a different
+# format of JSON document.
#
-# NOTE: In the JSON document, "type" is the type of the _attribute_, which is
-# not necessarily the same as the type of the "value" in the document. See e.g.
-# `Login-Service` above, an enumerated value.
+# NOTE: In the JSON document, "type" is the type of the _attribute_,
+# which is not necessarily the same as the type of the "value" in the
+# document. See e.g. `Login-Service` above, an enumerated value.
#
-# The following examples assume the three attributes are being added to the
-# JSON document:
+# The following examples assume the three attributes are being added
+# to the JSON document:
#
# ```
# User-Name = bob
#
# ==== Array output mode examples
#
-# The "array" mode is a list of objects, each containing an attribute. If the
-# "single_value_as_array" value option is set then each attribute will only
-# appear once in the array, and "value" will be a list of all the values from
-# the same attribute.
+# The "array" mode is a list of objects, each containing an
+# attribute. If the "single_value_as_array" value option is set then
+# each attribute will only appear once in the array, and "value" will
+# be a list of all the values from the same attribute.
#
# .Output mode "array"
#
# ]
# ----
#
-# The following output modes either do not include the attribute names or
-# values. They are likely to be useful only when the attributes are
-# individually specified and _guaranteed to exist_. In this case the attribute
-# names in `array_of_names` will have corresponding indexes to the values in
-# `array_of_values`.
+# The following output modes either do not include the attribute
+# names or values. They are likely to be useful only when the
+# attributes are individually specified and _guaranteed to exist_. In
+# this case the attribute names in `array_of_names` will have
+# corresponding indexes to the values in `array_of_values`.
#
# .Output mode "array_of_names"
#
# = Kafka Producer Module
#
# The `kafka` module produces records to Apache Kafka topics
-# asynchronously. Inbound requests pause while the record is in flight
-# and resume once the broker has acknowledged the write (or rejected
-# it), so the outcome is reflected in the module's return code.
+# asynchronously. Inbound requests pause while the record is in
+# flight and resume once the broker has acknowledged the write (or
+# rejected it), so the outcome is reflected in the module's return
+# code.
#
-# Setting names here correspond to librdkafka configuration properties;
-# for example `client_id` maps to `client.id`. A full reference for
-# each property is at:
+# Setting names here correspond to librdkafka configuration
+# properties; for example `client_id` maps to `client.id`. A full
+# reference for each property is at:
#
# https://github.com/confluentinc/librdkafka/blob/master/CONFIGURATION.md
#
kafka {
#
- # server:: Initial list of brokers. One is enough - the rest of
- # the cluster is discovered automatically. Specify additional
- # servers one per line if you want bootstrap redundancy.
+ # server:: Initial list of brokers. One is enough - the rest of the
+ # cluster is discovered automatically. Specify additional servers
+ # one per line if you want bootstrap redundancy.
#
server = "localhost:9092"
# server = "broker2.example.com:9092"
#
- # client_id:: Identifier the brokers see for this client. Shows
- # up in broker logs and metrics; useful when multiple FreeRADIUS
+ # client_id:: Identifier the brokers see for this client. Shows up
+ # in broker logs and metrics; useful when multiple FreeRADIUS
# instances share a cluster.
#
# client_id = "freeradius"
#
# idempotence:: Guarantee exactly-once, in-order delivery per
- # partition. Requires the broker to acknowledge every message;
+ # partition. Requires the broker to acknowledge every message;
# slightly slower, but safe against retries creating duplicates.
#
# idempotence = yes
#
# queue_max_messages:: Upper bound on unsent records buffered on
- # this FreeRADIUS instance. Once the buffer is full, further
- # produce attempts fail immediately rather than blocking.
+ # this FreeRADIUS instance. Once the buffer is full, further produce
+ # attempts fail immediately rather than blocking.
#
# queue_max_messages = 100000
#
# queue_max_delay:: How long to wait to batch records before
- # sending. Higher values increase throughput; lower values
- # reduce end-to-end latency.
+ # sending. Higher values increase throughput; lower values reduce
+ # end-to-end latency.
#
# queue_max_delay = 5ms
#
- # Declared topics. The module only writes to topics listed
- # here, so typos in a virtual server are caught at startup
- # instead of silently creating unintended topics on the broker.
+ # Declared topics. The module only writes to topics listed here, so
+ # typos in a virtual server are caught at startup instead of
+ # silently creating unintended topics on the broker.
#
# Per-topic settings (acknowledgement policy, compression,
# partitioning, etc.) are nested inside each topic's block.
# message_timeout = 10s
#
- # value:: Payload for each record produced to this
- # topic. Required. Evaluated per-call, so you can
- # interpolate request attributes here.
+ # value:: Payload for each record produced to this topic.
+ # Required. Evaluated per-call, so you can interpolate request
+ # attributes here.
#
value = %json.encode(&request.[*])
#
- # key:: Optional partition key. When omitted,
- # librdkafka picks a partition according to the
- # configured partitioner.
+ # key:: Optional partition key. When omitted, librdkafka picks a
+ # partition according to the configured partitioner.
#
# key = &User-Name
}
}
#
- # flush_timeout:: How long to wait when shutting down for
- # in-flight records to drain. Any records still queued after
- # this expires are lost.
+ # flush_timeout:: How long to wait when shutting down for in-flight
+ # records to drain. Any records still queued after this expires are
+ # lost.
#
flush_timeout = 5s
#
# properties:: Escape hatch for librdkafka settings the module
- # doesn't expose as named knobs above. Values here are passed
- # to librdkafka verbatim, so use its native units - for example
- # `"500"` rather than `"500ms"` for time values, and raw byte
- # counts rather than `"1M"` for sizes.
+ # doesn't expose as named knobs above. Values here are passed to
+ # librdkafka verbatim, so use its native units - for example `"500"`
+ # rather than `"500ms"` for time values, and raw byte counts rather
+ # than `"1M"` for sizes.
#
## properties {
## "ssl.engine.id" = "pkcs11"
## }
#
- # Each declared topic also accepts its own `properties { }`
- # block for per-topic librdkafka settings that aren't named
- # knobs:
+ # Each declared topic also accepts its own `properties { }` block
+ # for per-topic librdkafka settings that aren't named knobs:
#
## topic {
## radius-accounting {
# == Usage
#
# The module exposes one method, `kafka.produce`, and one xlat
-# expansion, `%kafka.produce(...)`. Both send a record and pause the
+# expansion, `%kafka.produce(...)`. Both send a record and pause the
# request until the broker acknowledges or the broker rejects it; the
# return code reflects the outcome:
#
#
# Call the method as `kafka.produce.<topic>`; the topic name must
# match one declared in the `topic { }` block above, and typos fail
-# at startup. `kafka.send.<topic>` and `kafka.recv.<topic>` are
+# at startup. `kafka.send.<topic>` and `kafka.recv.<topic>` are
# aliases that do the same thing - pick whichever reads most
# naturally inside the surrounding section (e.g. `kafka.recv.auth`
# inside `recv Access-Request { ... }`).
# ```
#
# This is tidy when you name topics after packet types; if you don't,
-# stick with the explicit `kafka.produce.<topic>` form. Either way,
+# stick with the explicit `kafka.produce.<topic>` form. Either way,
# the topic must be declared in `topic { }` or the virtual server
# will fail to compile.
#
# }
# ```
#
-# `value` is required per topic. `key` is optional; when omitted,
+# `value` is required per topic. `key` is optional; when omitted,
# librdkafka picks a partition according to the configured
# partitioner.
#
# === Xlat expansion
#
-# Use the xlat when the topic or payload is chosen per-request. The
+# Use the xlat when the topic or payload is chosen per-request. The
# first argument is the topic name, and the rest are the payload (or
-# key and payload). It returns `true` on successful delivery and
+# key and payload). It returns `true` on successful delivery and
# `false` on failure:
#
# ```
#
# The `krb5` module enables the use of Kerberos 5 for authentication.
#
-# NOTE: This default config presumes you have the MIT Kerberos 5 distribution.
+# NOTE: This default config presumes you have the MIT Kerberos 5
+# distribution.
#
# == Configuration Settings
#
#
# reuse:: Reusable Handles
#
- # Reusable krb5 handles are allocated in blocks. These
- # parameters allow for tuning how that is done.
+ # Reusable krb5 handles are allocated in blocks. These parameters
+ # allow for tuning how that is done.
#
reuse {
#
# }
# ----
#
-# Make sure the keytab is readable by the user that is used to run `radiusd` and
-# that your authorization configuration really uses `krb5` to do the
-# authentication. You will need to add the following to the `authenticate`
-# section of your `radiusd.conf` file:
+# Make sure the keytab is readable by the user that is used to run
+# `radiusd` and that your authorization configuration really uses
+# `krb5` to do the authentication. You will need to add the following
+# to the `authenticate` section of your `radiusd.conf` file:
#
# [source, unlang]
# ----
-# Auth-Type Kerberos {
-# krb5
-# }
+# Auth-Type Kerberos { krb5 }
# ----
#
#
# In-memory key-value store.
#
-# This module allows policies to associate "values" with "keys". The
+# This module allows policies to associate "values" with "keys". The
# data is store _only_ in memory, and is not persisted to disk, or to
-# a database. As such, all data in the key-value store is lost when
+# a database. As such, all data in the key-value store is lost when
# the server restarts.
#
-# The module creates a _global_ key-value store. That is, one which is
-# shared across multiple threads. This design allows a value to be set
-# at any time, and in any thread; then examined by a later thread.
+# The module creates a _global_ key-value store. That is, one which
+# is shared across multiple threads. This design allows a value to be
+# set at any time, and in any thread; then examined by a later
+# thread.
#
# The caveat to the global / cross-thread store is that all access to
-# the key-value store are protected by a mutex. The mutex serializes
-# access to the key-value store. Which means that using this module
+# the key-value store are protected by a mutex. The mutex serializes
+# access to the key-value store. Which means that using this module
# can effectively force the server to become single-threaded, and
# therefore destroy all performance.
#
#
# If you need to store multiple different types of data in a
# key-value store, then you should create multiple instances of the
-# module. Then, use one instance per type of data, or per use-case.
+# module. Then, use one instance per type of data, or per use-case.
# This approach causes the module to use multiple mutexes (one for
# each instance), which reduces mutex contention and can improve
# performance.
# However, the cache module stores _attributes_, and _lists of
# attributes_.
#
-# In contrast, the `kv` module stores _values_. e.g. `ipv4addr`,
-# `uint32`, etc. The use-case for the `kv` module is to store a small
+# In contrast, the `kv` module stores _values_. e.g. `ipv4addr`,
+# `uint32`, etc. The use-case for the `kv` module is to store a small
# number of simple values that can be shared across multiple threads.
#
# == Functions
#
# === %kv.write(key, value)
#
-# Writes _value_ at _key_. Any pre-existing value for _key_ is
+# Writes _value_ at _key_. Any pre-existing value for _key_ is
# discarded.
#
# This function returns nothing.
#
# === %kv.read(key)
#
-# Reads a value at _key_. If the value exists, it is returned.
+# Reads a value at _key_. If the value exists, it is returned.
# Otherwise, nothing is returned.
#
# === %kv.delete(key)
#
-# Deletes the value found at _key_. If a value was deleted, it is
-# returned. Otherwise, nothing is returned.
+# Deletes the value found at _key_. If a value was deleted, it is
+# returned. Otherwise, nothing is returned.
#
# == Configuration Settings
#
#
# Should be 'string', 'octets', 'ipv4addr', etc.
#
- # The module will automatically choose a data structure based
- # on the data type. It will be a hash table, rbtree or
- # patricia trie store depending on the data type of the key.
+ # The module will automatically choose a data structure based on the
+ # data type. It will be a hash table, rbtree or patricia trie store
+ # depending on the data type of the key.
#
- # Any `key` which is passed to the `kv` functions
- # (`%kv.write()`, `%kv.read()`, or `%kv.delete()`) must be
- # the same data type as is given in `key_type`.
+ # Any `key` which is passed to the `kv` functions (`%kv.write()`,
+ # `%kv.read()`, or `%kv.delete()`) must be the same data type as is
+ # given in `key_type`.
#
key_type = string
#
# The value must be larger than zero.
#
- # Keys are ordered by "last access" time. Keys which have
- # not been used for a while are not automatically removed.
- # Keys which are being continuously used will stick around
- # forever.
+ # Keys are ordered by "last access" time. Keys which have not been
+ # used for a while are not automatically removed. Keys which are
+ # being continuously used will stick around forever.
#
- # Keys are removed automatically when the "max_entries" limit
- # is reached. When that limit is reached, the olded used (or
- # unused) key is deleted every time a new key is inserted.
+ # Keys are removed automatically when the "max_entries" limit is
+ # reached. When that limit is reached, the olded used (or unused)
+ # key is deleted every time a new key is inserted.
#
# max_entries = 1024
#
# = LDAP (Lightweight Directory Access Protocol) Module
#
-# The `ldap` module allows LDAP directory entries to be retrieved, modified,
-# inserted and deleted.
+# The `ldap` module allows LDAP directory entries to be retrieved,
+# modified, inserted and deleted.
#
-# NOTE: May also perform user authentication using LDAP binds, or by retrieving
-# the contents of a password attribute for later comparison by a module such
-# as `pap`, or an `eap` method.
+# NOTE: May also perform user authentication using LDAP binds, or by
+# retrieving the contents of a password attribute for later
+# comparison by a module such as `pap`, or an `eap` method.
#
-# Please see the file `global.d/ldap` for server-global configuration items
-# which control LDAP library debugging.
+# Please see the file `global.d/ldap` for server-global configuration
+# items which control LDAP library debugging.
#
#
# server::
#
# Note that this needs to match the name(s) in the LDAP server
- # certificate, if you're using ldaps. See OpenLDAP documentation
- # for the behavioral semantics of specifying more than one host.
+ # certificate, if you're using ldaps. See OpenLDAP documentation for
+ # the behavioral semantics of specifying more than one host.
#
- # Depending on the `libldap` in use, server may be specified as an LDAP
- # URI. In the case of `OpenLDAP` this allows the following
+ # Depending on the `libldap` in use, server may be specified as an
+ # LDAP URI. In the case of `OpenLDAP` this allows the following
# additional schemes:
#
# [options="header,autowidth"]
# server = 'ldap.rrdns.example.org'
#
- # port:: Port to connect on, defaults to 389, will be ignored for LDAP URIs.
+ # port:: Port to connect on, defaults to 389, will be ignored for
+ # LDAP URIs.
#
# port = 389
#
- # identity:: Administrator account for searching and possibly modifying.
+ # identity:: Administrator account for searching and possibly
+ # modifying.
#
- # WARNING: If using SASL + (KRB5 | EXTERNAL) identity should be commented out
- # as it will set an authzid, which is likely not what you want.
+ # WARNING: If using SASL + (KRB5 | EXTERNAL) identity should be
+ # commented out as it will set an authzid, which is likely not what
+ # you want.
#
# identity = 'cn=admin,dc=example,dc=org'
# password = mypass
#
- # base_dn:: Unless overridden in another section, the dn from which all
- # searches will start from.
+ # base_dn:: Unless overridden in another section, the dn from which
+ # all searches will start from.
#
base_dn = 'dc=example,dc=org'
#
# That will give you the LDAP information for 'user'.
#
- # Group membership can be queried by using the above "ldapsearch" string,
- # and adding "memberof" qualifiers. For ActiveDirectory, use:
+ # Group membership can be queried by using the above "ldapsearch"
+ # string, and adding "memberof" qualifiers. For ActiveDirectory,
+ # use:
#
# ```
# ldapsearch ... '(&(objectClass=user)(sAMAccountName=user)(memberof=CN=group,${base_dn}))'
# ```
#
- # Where 'user' is the user as above, and 'group' is the group you are querying for.
+ # Where 'user' is the user as above, and 'group' is the group you
+ # are querying for.
# ====
#
#
# sasl { ... }::
#
- # When we're prompted by the SASL library, the config items in the SASL
- # section (in addition to the identity password config items above)
- # determine the responses given.
+ # When we're prompted by the SASL library, the config items in the
+ # SASL section (in addition to the identity password config items
+ # above) determine the responses given.
#
# If any directive is commented out, a NULL response will be
# provided to cyrus-sasl.
#
# Unfortunately the only way to control Keberos here is through
- # environmental variables, as cyrus-sasl provides no API to
- # set the kerberos (libkrb5) config directly.
+ # environmental variables, as cyrus-sasl provides no API to set the
+ # kerberos (libkrb5) config directly.
#
- # Full documentation for MIT krb5 can be
- # found at http://web.mit.edu/kerberos/krb5-devel/doc/admin/env_variables.html
+ # Full documentation for MIT krb5 can be found at
+ # http://web.mit.edu/kerberos/krb5-devel/doc/admin/env_variables.html
#
# At a minimum you probably want to set `KRB5_CLIENT_KTNAME`.
#
# |===
#
# Request and list qualifiers may be placed after the `update`
- # section name to set default destination requests/lists
- # for `<fr attr>s` with no list qualifiers.
+ # section name to set default destination requests/lists for `<fr
+ # attr>s` with no list qualifiers.
#
- # These attribute maps are applied _before_ any profiles, meaning that
- # the values here can be referenced in profiles using expansions.
+ # These attribute maps are applied _before_ any profiles, meaning
+ # that the values here can be referenced in profiles using
+ # expansions.
#
# NOTE: LDAP attribute names should be single quoted unless you want
- # the name to be derived from an xlat expansion, or an attribute ref.
+ # the name to be derived from an xlat expansion, or an attribute
+ # ref.
#
# update { ... }::
#
## reply.Tunnel-Medium-Type := 'radiusTunnelMediumType'
## reply.Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId'
- # NOTE: Where only a list is specified as the RADIUS attribute,
- # the value of the LDAP attribute is parsed as a valuepair
- # in the same format as the 'valuepair_attribute' (above).
+ # NOTE: Where only a list is specified as the RADIUS attribute, the
+ # value of the LDAP attribute is parsed as a valuepair in the same
+ # format as the 'valuepair_attribute' (above).
control += 'radiusControlAttribute'
request += 'radiusRequestAttribute'
reply += 'radiusReplyAttribute'
}
#
- # edir:: Set to `yes` if you have eDirectory and want to use the universal
- # password mechanism.
+ # edir:: Set to `yes` if you have eDirectory and want to use the
+ # universal password mechanism.
#
# edir = no
#
- # edir_autz:: Set to `yes` if you want to bind as the user after retrieving the
- # `Password.Cleartext`. This will consume the login grace, and verify user authorization.
+ # edir_autz:: Set to `yes` if you want to bind as the user after
+ # retrieving the `Password.Cleartext`. This will consume the login
+ # grace, and verify user authorization.
#
# edir_autz = no
#
# [source, unlang]
# ----
- # ldap
- # if ((ok || updated) && User-Password) {
- # control.Auth-Type := ::ldap
- # }
+ # ldap if ((ok || updated) && User-Password) { control.Auth-Type :=
+ # ::ldap }
# ----
# ====
#
base_dn = "${..base_dn}"
#
- # filter:: Filter for user objects, should be specific enough
- # to identify a single user object.
+ # filter:: Filter for user objects, should be specific enough to
+ # identify a single user object.
#
filter = "(uid=%{Stripped-User-Name || User-Name})"
- # For Active Directory nested group, you should comment out the previous 'filter = ...'
- # and use the below. Where 'group' is the group you are querying for.
+ # For Active Directory nested group, you should comment out the
+ # previous 'filter = ...' and use the below. Where 'group' is the
+ # group you are querying for.
#
- # NOTE: The string '1.2.840.113556.1.4.1941' specifies LDAP_MATCHING_RULE_IN_CHAIN.
- # This applies only to DN attributes. This is an extended match operator that walks
- # the chain of ancestry in objects all the way to the root until it finds a match.
- # This reveals group nesting. It is available only on domain controllers with
- # Windows Server 2003 SP2 or Windows Server 2008 (or above).
+ # NOTE: The string '1.2.840.113556.1.4.1941' specifies
+ # LDAP_MATCHING_RULE_IN_CHAIN. This applies only to DN attributes.
+ # This is an extended match operator that walks the chain of
+ # ancestry in objects all the way to the root until it finds a
+ # match. This reveals group nesting. It is available only on domain
+ # controllers with Windows Server 2003 SP2 or Windows Server 2008
+ # (or above).
#
- # For further information, see https://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx
+ # For further information, see
+ # https://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx
#
# filter = "(&(objectClass=user)(sAMAccountName=%{Stripped-User-Name || User-Name})(memberOf:1.2.840.113556.1.4.1941:=cn=group,${..base_dn}))"
#
# sasl { ... }:: SASL parameters to use for user binds
#
- # When we're prompted by the SASL library, these control
- # the responses given.
+ # When we're prompted by the SASL library, these control the
+ # responses given.
#
- # NOTE: Any of the config items below may be an attribute ref
- # or and expansion. This allows different SASL mechs,
- # proxy IDs and realms to be used for different users.
+ # NOTE: Any of the config items below may be an attribute ref or
+ # and expansion. This allows different SASL mechs, proxy IDs and
+ # realms to be used for different users.
#
sasl {
#
# mech = 'PLAIN'
#
- # authname:: SASL authentication name. Mechanism specific value
- # to use when prompted for the client authentication name.
+ # authname:: SASL authentication name. Mechanism specific value to
+ # use when prompted for the client authentication name.
#
# authname = User-Name
}
#
- # password_attribute:: Which attribute in the request should be used as
- # the password when performing user binds.
+ # password_attribute:: Which attribute in the request should be
+ # used as the password when performing user binds.
#
- # Note that Active Directory will allow unauthenticated user binds by default!
+ # Note that Active Directory will allow unauthenticated user binds
+ # by default!
#
- # You can fix this by choosing the "ADSI Edit" command from the Server Manager's Tools menu.
- # Then, open the Configuration subtree, and then open the properties of the `CN=Directory
- # Service, CN=Windows NT, CN=Services, CN=Configuration` object. Modify the
- # `msDS-Other-Settings` attribute, and add a new entry for `DenyUnauthenticatedBind=1`.
+ # You can fix this by choosing the "ADSI Edit" command from the
+ # Server Manager's Tools menu. Then, open the Configuration
+ # subtree, and then open the properties of the `CN=Directory
+ # Service, CN=Windows NT, CN=Services, CN=Configuration` object.
+ # Modify the `msDS-Other-Settings` attribute, and add a new entry
+ # for `DenyUnauthenticatedBind=1`.
#
# password_attribute = User-Password
# sorting order will be reversed for that attribute.
#
# * If `sort_by` is set, and the server does not support sorting
- # or the attributes do not have an ORDERING rule, the search will fail.
+ # or the attributes do not have an ORDERING rule, the search will
+ # fail.
#
# * If a search returns multiple user objects and `sort_by` is not
# set, the search will fail.
#
# access_attribute:: If this is undefined, anyone is authorised.
#
- # If it is defined, the contents of this attribute determine whether
- # or not the user is authorised.
+ # If it is defined, the contents of this attribute determine
+ # whether or not the user is authorised.
#
# access_attribute = 'dialupAccess'
#
- # access_positive:: Control whether the presence of `access_attribute`
- # allows access, or denies access.
+ # access_positive:: Control whether the presence of
+ # `access_attribute` allows access, or denies access.
#
# * If `yes`, and the `access_attribute` is present, or `no` and the
- # `access_attribute` is absent then access will be allowed.
+ # `access_attribute` is absent then access will be allowed.
#
# * If `yes`, and the `access_attribute` is absent, or `no` and the
# `access_attribute` is present, then access will not be allowed.
# access_value_negate = 'false'
#
- # access_value_suspend:: Which value we look for in access_attribute
- # to indicate that the user should be suspended.
+ # access_value_suspend:: Which value we look for in
+ # access_attribute to indicate that the user should be suspended.
#
# access_value_suspend = 'suspended'
#
- # expect_password:: When set to no, disable warnings for missing password
- # attributes in user objects returned from LDAP. This is useful for
- # ISP environments where some subscribers have passwords set, and others
- # do not (e.g. mixed IPoE and PPPoE).
+ # expect_password:: When set to no, disable warnings for missing
+ # password attributes in user objects returned from LDAP. This is
+ # useful for ISP environments where some subscribers have passwords
+ # set, and others do not (e.g. mixed IPoE and PPPoE).
#
# expect_password = no
#
- # dn_attribute:: Where to cache the user's DN for use in authentication.
+ # dn_attribute:: Where to cache the user's DN for use in
+ # authentication.
#
# dn_attribute = 'LDAP-UserDN'
}
# filter:: Filter for group objects, should match all available
# group objects a user might be a member of.
#
- # If using Active Directory you are likely to need `group`
- # instead of `posixGroup`.
+ # If using Active Directory you are likely to need `group` instead
+ # of `posixGroup`.
#
filter = '(objectClass=posixGroup)'
# name_attribute = cn
#
- # membership_filter:: Filter to find all group objects a user is a member of.
+ # membership_filter:: Filter to find all group objects a user is a
+ # member of.
#
- # That is, group objects with attributes that identify
- # members (the inverse of `membership_attribute`).
+ # That is, group objects with attributes that identify members (the
+ # inverse of `membership_attribute`).
#
# membership_filter = "(|(member=%{control.Ldap-UserDn})(memberUid=%{Stripped-User-Name || User-Name}))"
#
- # membership_attribute:: The attribute, in user objects, which contain
- # the names or DNs of groups a user is a member of.
+ # membership_attribute:: The attribute, in user objects, which
+ # contain the names or DNs of groups a user is a member of.
#
- # Unless a conversion between group name and group DN is
- # needed, there's no requirement for the group objects
- # referenced to actually exist.
+ # Unless a conversion between group name and group DN is needed,
+ # there's no requirement for the group objects referenced to
+ # actually exist.
#
# [NOTE]
# ====
- # If the LDAP server does not support the `memberOf` attribute (or equivalent),
- # then you will need to use the membership_filter option above instead.
- # If you can't see the `memberOf` attribute then it is also possible that the
- # LDAP bind user does not have the correct permissions to view it.
+ # If the LDAP server does not support the `memberOf` attribute (or
+ # equivalent), then you will need to use the membership_filter
+ # option above instead. If you can't see the `memberOf` attribute
+ # then it is also possible that the LDAP bind user does not have
+ # the correct permissions to view it.
# ====
#
membership_attribute = 'memberOf'
#
- # cacheable_name:: If `cacheable_name` or `cacheable_dn` are enabled,
- # all group information for the user will be retrieved from the directory
- # and written to `LDAP-Group` attributes appropriate for the instance of rlm_ldap.
+ # cacheable_name:: If `cacheable_name` or `cacheable_dn` are
+ # enabled, all group information for the user will be retrieved
+ # from the directory and written to `LDAP-Group` attributes
+ # appropriate for the instance of rlm_ldap.
#
- # For group comparisons these attributes will be checked instead of querying
- # the LDAP directory directly.
+ # For group comparisons these attributes will be checked instead of
+ # querying the LDAP directory directly.
#
- # This feature is intended to be used with `rlm_cache`, but may also be useful
- # if all group values need to be processed using `unlang` policies.
+ # This feature is intended to be used with `rlm_cache`, but may
+ # also be useful if all group values need to be processed using
+ # `unlang` policies.
#
- # If you wish to use this feature, you should enable the type that matches the
- # format of your check items.
+ # If you wish to use this feature, you should enable the type that
+ # matches the format of your check items.
#
- # i.e. if your groups are specified as DNs then enable `cacheable_dn`
- # else enable `cacheable_name`.
+ # i.e. if your groups are specified as DNs then enable
+ # `cacheable_dn` else enable `cacheable_name`.
#
# cacheable_name = 'no'
# cacheable_dn = 'no'
#
- # cache_attribute:: Override the normal cache attribute (`<inst>-LDAP-Group` or
- # `LDAP-Group` if using the default instance) and create a custom attribute.
+ # cache_attribute:: Override the normal cache attribute
+ # (`<inst>-LDAP-Group` or `LDAP-Group` if using the default
+ # instance) and create a custom attribute.
#
# This can help if multiple module instances are used in fail-over.
#
#
# allow_dangling_group_ref::
#
- # If the group being checked is specified as a name, but the user's groups are
- # referenced by DN, and one of those group DNs is invalid, the whole group check
- # is treated as invalid, and a negative result will be returned.
+ # If the group being checked is specified as a name, but the user's
+ # groups are referenced by DN, and one of those group DNs is
+ # invalid, the whole group check is treated as invalid, and a
+ # negative result will be returned.
#
# When set to `yes`, this option ignores invalid DN references.
#
# allow_dangling_group_ref = 'no'
#
- # group_attribute:: Override the normal group comparison attribute name
- # `(<inst>-Group` or `LDAP-Group` if using the default instance).
+ # group_attribute:: Override the normal group comparison attribute
+ # name `(<inst>-Group` or `LDAP-Group` if using the default
+ # instance).
#
group_attribute = "${..:instance}-Group"
#
# skip_on_suspend::
#
- # Don't process user groups if the user has been suspended.
- # If set to 'no', groups will still be processed.
+ # Don't process user groups if the user has been suspended. If set
+ # to 'no', groups will still be processed.
#
# Groups are never processed for disabled users.
#
#
# === User profiles
#
- # RADIUS profile objects contain sets of attributes to insert into the request.
- # These attributes are mapped using the same mapping scheme applied to user
- # objects (the update section above).
+ # RADIUS profile objects contain sets of attributes to insert into
+ # the request. These attributes are mapped using the same mapping
+ # scheme applied to user objects (the update section above).
#
profile {
#
#
# scope:: Search scope, may be `base`, `one`, `sub` or `children`.
#
- # Should usually be left as "base", to retrieve the specific profile
- # specified by 'default' or in the user or group objects.
+ # Should usually be left as "base", to retrieve the specific
+ # profile specified by 'default' or in the user or group objects.
#
# scope = 'base'
#
- # default:: The default profile. This may be a DN or an attribute reference.
+ # default:: The default profile. This may be a DN or an attribute
+ # reference.
#
- # NOTE: To get old v2.2.x style behaviour, or to use the `User-Profile` attribute
- # to specify the default profile, set this to `control.User-Profile`.
+ # NOTE: To get old v2.2.x style behaviour, or to use the
+ # `User-Profile` attribute to specify the default profile, set this
+ # to `control.User-Profile`.
#
# default = 'cn=radprofile,dc=example,dc=org'
#
- # attribute:: The LDAP attribute containing profile DNs to apply
- # in addition to the default profile above.
+ # attribute:: The LDAP attribute containing profile DNs to apply in
+ # addition to the default profile above.
#
# These are retrieved from the user object, at the same time as the
- # attributes from the update section, are are applied if authorization
- # is successful.
+ # attributes from the update section, are are applied if
+ # authorization is successful.
#
# attribute = 'radiusProfileDn'
#
- # attribute_suspend:: The LDAP attribute containing profile DNs to apply
- # in addition to the default profile above, when the user account is in
- # the suspended state
+ # attribute_suspend:: The LDAP attribute containing profile DNs to
+ # apply in addition to the default profile above, when the user
+ # account is in the suspended state
#
# These are retrieved from the user object, at the same time as the
- # attributes from the update section, are are applied if authorization
- # is successful.
+ # attributes from the update section, are are applied if
+ # authorization is successful.
#
# attribute_suspend = 'radiusProfileDn'
# sorting order will be reversed for that attribute.
#
# * If `sort_by` is set, and the server does not support sorting
- # or the attributes do not have an ORDERING rule, the search will fail.
+ # or the attributes do not have an ORDERING rule, the search will
+ # fail.
#
# sort_by = 'radiusProfilePriority'
#
# check_attribute:: The LDAP attribute containing conditions which
- # will be evaluated to determine whether a profile should be applied.
+ # will be evaluated to determine whether a profile should be
+ # applied.
#
# check_attribute = 'radiusProfileCondition'
# fallthrough_attribute = 'radiusProfileFallthrough'
#
- # fallthrough_def:: If the attribute referenced in fallthrough_attribute
- # is not in the reply, what should be the default behaviour
+ # fallthrough_def:: If the attribute referenced in
+ # fallthrough_attribute is not in the reply, what should be the
+ # default behaviour
#
# fallthrough_default = yes
}
#
# === Modify user object on receiving Accounting-Request
#
- # Useful for recording things like the last time the user logged
- # in, or the `Acct-Session-ID` for CoA/DM.
+ # Useful for recording things like the last time the user logged in,
+ # or the `Acct-Session-ID` for CoA/DM.
#
# LDAP modification items are in the format:
#
#
options {
#
- # dereference:: Control under which situations aliases are followed.
+ # dereference:: Control under which situations aliases are
+ # followed.
#
# May be one of 'never', 'searching', 'finding' or 'always'
#
# dereference = 'always'
#
- # chase_referrals:: controls whether the server follows references returned
- # by the LDAP directory.
+ # chase_referrals:: controls whether the server follows references
+ # returned by the LDAP directory.
#
- # They are mostly for Active Directory compatibility.
- # If you set this to `no`, then searches will likely return 'operations error',
- # instead of a useful result.
+ # They are mostly for Active Directory compatibility. If you set
+ # this to `no`, then searches will likely return 'operations
+ # error', instead of a useful result.
#
chase_referrals = yes
#
- # rebind:: If `chase_referrals` is `yes` then, when a referral is followed
- # having `rebind` set to `no` will cause the server to do an anonymous bind when
- # making any additional connections. Setting this to `yes` will either bind
- # with the admin credentials or the credentials from the rebind url depending
- # on `use_referral_credentials`.
+ # rebind:: If `chase_referrals` is `yes` then, when a referral is
+ # followed having `rebind` set to `no` will cause the server to do
+ # an anonymous bind when making any additional connections. Setting
+ # this to `yes` will either bind with the admin credentials or the
+ # credentials from the rebind url depending on
+ # `use_referral_credentials`.
#
rebind = yes
#
- # use_referral_credentials:: On `rebind`, use the credentials from the rebind url
- # instead of admin credentials used during the initial bind.
+ # use_referral_credentials:: On `rebind`, use the credentials from
+ # the rebind url instead of admin credentials used during the
+ # initial bind.
#
# Default `no`
#
use_referral_credentials = no
#
- # session_tracking:: If `yes`, then include `draft-wahl-ldap-session` tracking
- # controls.
+ # session_tracking:: If `yes`, then include
+ # `draft-wahl-ldap-session` tracking controls.
#
- # If yes, encodes `NAS-IP-Address`, `NAS-IPv6-Address`, `User-Name`, `Acct-Session-Id`,
- # `Acct-Multi-Session-Id` as session tracking controls in applicable LDAP operations.
+ # If yes, encodes `NAS-IP-Address`, `NAS-IPv6-Address`,
+ # `User-Name`, `Acct-Session-Id`, `Acct-Multi-Session-Id` as
+ # session tracking controls in applicable LDAP operations.
#
# Default `no`
#
# session_tracking = yes
#
- # sasl_secprops:: SASL Security Properties (see SASL_SECPROPS in ldap.conf man page).
+ # sasl_secprops:: SASL Security Properties (see SASL_SECPROPS in
+ # ldap.conf man page).
#
- # NOTE: uncomment when using GSS-API sasl mechanism along with TLS encryption against
- # Active-Directory LDAP servers (this disables sealing and signing at the GSS level as
- # required by AD).
+ # NOTE: uncomment when using GSS-API sasl mechanism along with TLS
+ # encryption against Active-Directory LDAP servers (this disables
+ # sealing and signing at the GSS level as required by AD).
#
# sasl_secprops = 'noanonymous,noplain,maxssf=0'
res_timeout = 10
#
- # srv_timelimit:: Seconds LDAP server has to process the query (server-side
- # time limit).
+ # srv_timelimit:: Seconds LDAP server has to process the query
+ # (server-side time limit).
#
# Default `20`
#
srv_timelimit = 3
#
- # idle:: Set the number of seconds a connection needs to remain idle
- # before TCP starts sending keepalive probes.
+ # idle:: Set the number of seconds a connection needs to remain
+ # idle before TCP starts sending keepalive probes.
#
# NOTE: `LDAP_OPT_X_KEEPALIVE_IDLE` is set to this value.
#
idle = 60
#
- # probes:: Set the maximum number of keepalive probes TCP should send
- # before dropping the connection.
+ # probes:: Set the maximum number of keepalive probes TCP should
+ # send before dropping the connection.
#
# NOTE: `LDAP_OPT_X_KEEPALIVE_PROBES` is set to this value.
#
probes = 3
#
- # interval:: Set the interval in seconds between individual keepalive probes.
+ # interval:: Set the interval in seconds between individual
+ # keepalive probes.
#
# NOTE: `LDAP_OPT_X_KEEPALIVE_INTERVAL` is set to this value.
#
net_timeout = 10
#
- # reconnection_delay:: Sets the time in seconds before a failed connection
- # will attempt reconnection. This includes failures to bind as the admin
- # user due to incorrect credentials.
+ # reconnection_delay:: Sets the time in seconds before a failed
+ # connection will attempt reconnection. This includes failures to
+ # bind as the admin user due to incorrect credentials.
#
reconnection_delay = 10
}
#
# === TLS encrypted connections
#
- # This subsection configures the `tls` related items that control how FreeRADIUS
- # connects to an LDAP server. It contains all of the `tls_*` configuration entries
- # used in older versions of FreeRADIUS.
+ # This subsection configures the `tls` related items that control
+ # how FreeRADIUS connects to an LDAP server. It contains all of the
+ # `tls_*` configuration entries used in older versions of
+ # FreeRADIUS.
#
- # Those configuration entries can still be used, but we recommend using these.
+ # Those configuration entries can still be used, but we recommend
+ # using these.
#
tls {
#
- # start_tls:: Set this to `yes` to use TLS encrypted connections
- # to the LDAP database by using the StartTLS extended operation.
+ # start_tls:: Set this to `yes` to use TLS encrypted connections to
+ # the LDAP database by using the StartTLS extended operation.
#
- # The StartTLS operation is supposed to be used with normal ldap connections
- # instead of using ldaps (port 636) connections
+ # The StartTLS operation is supposed to be used with normal ldap
+ # connections instead of using ldaps (port 636) connections
#
# start_tls = yes
#
- # NOTE: If `start_tls = yes`, then fill up those such options with the certificate information.
+ # NOTE: If `start_tls = yes`, then fill up those such options with
+ # the certificate information.
#
## ca_file = ${certdir}/cacert.pem
## ca_path = ${certdir}
# | 'hard' | similar to 'demand' but fails if TLS cannot negotiate.
# |===
#
- # NOTE: The default is libldap's default, which varies based on the contents of `ldap.conf`.
+ # NOTE: The default is libldap's default, which varies based on the
+ # contents of `ldap.conf`.
#
# require_cert = 'demand'
#
- # Minimum TLS version to accept. We STRONGLY recommend
- # setting this to "1.2"
+ # Minimum TLS version to accept. We STRONGLY recommend setting this
+ # to "1.2"
#
# tls_min_version = "1.2"
}
#
# === Connection Pool
#
- # The connection pool is a set of per-thread parameters for connections
- # to the LDAP server.
+ # The connection pool is a set of per-thread parameters for
+ # connections to the LDAP server.
#
- # This connection pool is used for LDAP queries run as the administrative user.
+ # This connection pool is used for LDAP queries run as the
+ # administrative user.
#
- # All LDAP operations are performed asynchronously, meaning that many queries
- # can be active on a single connection simultaneously.
+ # All LDAP operations are performed asynchronously, meaning that
+ # many queries can be active on a single connection simultaneously.
#
pool {
#
# start:: Connections to create during module instantiation.
#
# If the server cannot create specified number of connections
- # during instantiation it will exit.
- # Set to `0` to allow the server to start without the directory
- # being available.
+ # during instantiation it will exit. Set to `0` to allow the server
+ # to start without the directory being available.
#
start = 0
#
# max:: Maximum number of connections.
#
- # If these connections are all fully in use (refer to per_connection_max below)
- # and a new one is requested, the request will NOT get a connection.
+ # If these connections are all fully in use (refer to
+ # per_connection_max below) and a new one is requested, the request
+ # will NOT get a connection.
#
max = 5
#
# open_delay:: Open delay (in seconds).
#
- # How long must we be above the target utilisation for connections to be opened.
+ # How long must we be above the target utilisation for connections
+ # to be opened.
# open_delay = 0.2
#
# close_delay:: Close delay (in seconds).
#
- # How long we must be below the target utilisation for connections to be closed
+ # How long we must be below the target utilisation for connections
+ # to be closed
#
# close_delay = 10
# manage_interval = 0.2
#
- # request:: Options specific to requests handled by this connection pool
+ # request:: Options specific to requests handled by this connection
+ # pool
#
request {
#
- # per_connection_max:: Maximum number of active queries there can be on a
- # single connection.
+ # per_connection_max:: Maximum number of active queries there can
+ # be on a single connection.
#
# per_connection_max = 2000
#
- # per_connection_target:: Target number of active queries on a single connection.
+ # per_connection_target:: Target number of active queries on a
+ # single connection.
#
# per_connection_target = 1000
#
- # free_delay:: How long must a request in the unassigned (free) list not have been
- # used for before it's cleaned up and actually freed.
+ # free_delay:: How long must a request in the unassigned (free)
+ # list not have been used for before it's cleaned up and actually
+ # freed.
#
- # Unassigned requests can be re-used, multiple times, reducing memory allocation
- # and freeing overheads.
+ # Unassigned requests can be re-used, multiple times, reducing
+ # memory allocation and freeing overheads.
#
# free_delay = 10
}
#
# === Bind Connection Pool
#
- # This connection pool is used for LDAP binds used to authenticate requests when
- # calling the ldap module in authenticate context. If passwords are retrieved
- # from the ldap directory and FreeRADIUS performs the authentication then this is
- # not used.
+ # This connection pool is used for LDAP binds used to authenticate
+ # requests when calling the ldap module in authenticate context. If
+ # passwords are retrieved from the ldap directory and FreeRADIUS
+ # performs the authentication then this is not used.
#
- # The options are essentially identical to the pool section above with certain
- # limitations. Since only one bind operation can be in progress on a connection at
- # a time, `per_connection_max` and `per_connection_target` are always set to 1.
+ # The options are essentially identical to the pool section above
+ # with certain limitations. Since only one bind operation can be in
+ # progress on a connection at a time, `per_connection_max` and
+ # `per_connection_target` are always set to 1.
#
- # This limitation means that `max` represents the maximum number of in progress
- # binds which there can be on a single thread.
+ # This limitation means that `max` represents the maximum number of
+ # in progress binds which there can be on a single thread.
#
bind_pool {
start = 0
# The following policy ensures that every call to the `ldap` module
# will time out within a short period of time.
#
-# The policy name here should be the same as the module name.
-# Reusing the same name means that this policy will be used instead
-# of the module.
+# The policy name here should be the same as the module name. Reusing
+# the same name means that this policy will be used instead of the
+# module.
#
##@policy ldap {
## timeout 1s {
# If the LDAP uri starts `ldap:///`, i.e. no host is specified, then
# the server configured for the module will be used.
#
-# When embedding user-controlled values in the filter part of the URI, wrap
-# them with `%ldap.filter.escape(...)`. When embedding values in the DN part
-# (base DN, or in a DN being looked up), wrap them with `%ldap.dn.escape(...)`.
-# Inserting unescaped user input allows LDAP injection attacks.
+# When embedding user-controlled values in the filter part of the
+# URI, wrap them with `%ldap.filter.escape(...)`. When embedding
+# values in the DN part (base DN, or in a DN being looked up), wrap
+# them with `%ldap.dn.escape(...)`. Inserting unescaped user input
+# allows LDAP injection attacks.
#
# .Example - safe filter embedding
#
# [source,unlang]
# ----
-# # User-Name is filter-escaped before being embedded in the search filter.
-# # Without escaping, a User-Name of '*' would produce (uid=*) and match all users.
-# reply.Reply-Message := "Welcome %ldap("ldap:///ou=people,dc=example,dc=com?displayName?sub?(uid=%ldap.filter.escape(%{User-Name}))")"
+# = User-Name is filter-escaped before being embedded in the search filter.
+# = Without escaping, a User-Name of '*' would produce (uid=*) and match all users.
+# reply.Reply-Message := "Welcome
+# %ldap("ldap:///ou=people,dc=example,dc=com?displayName?sub?(uid=%ldap.filter.escape(%{User-Name}))")"
# ----
#
# .Output
#
# [source,unlang]
# ----
-# # User-Name is DN-escaped before being used in the base DN.
-# # Without escaping, a value containing ',' could add extra DN components.
-# result := %ldap("ldap:///ou=%ldap.dn.escape(%{User-Name}),dc=example,dc=com?cn?base")
+# = User-Name is DN-escaped before being used in the base DN.
+# = Without escaping, a value containing ',' could add extra DN components.
+# result :=
+# %ldap("ldap:///ou=%ldap.dn.escape(%{User-Name}),dc=example,dc=com?cn?base")
# ----
#
# === %ldap.dn.escape(...)
#
-# Escape a string for use in an LDAP distinguished name (RFC 4514). Characters
-# that are special in a DN component (`,`, `+`, `"`, `\`, `<`, `>`, `;`, `*`, `=`, `(`, `)`)
-# are converted to `\HH` hex sequences. The result is marked safe for use in DN positions
-# and will not be re-escaped.
+# Escape a string for use in an LDAP distinguished name (RFC 4514).
+# Characters that are special in a DN component (`,`, `+`, `"`, `\`,
+# `<`, `>`, `;`, `*`, `=`, `(`, `)`) are converted to `\HH` hex
+# sequences. The result is marked safe for use in DN positions and
+# will not be re-escaped.
#
# .Return: _string_
#
#
# [source,unlang]
# ----
-# my-string := "cn=admin,dc=example,dc=com"
-# reply.Reply-Message := "Escaped: %ldap.dn.escape(%{my-string})"
+# my-string := "cn=admin,dc=example,dc=com" reply.Reply-Message :=
+# "Escaped: %ldap.dn.escape(%{my-string})"
# ----
#
# .Output
#
# === %ldap.dn.safe(...)
#
-# Mark a string as already safe for use in an LDAP DN. The value will not be escaped or
-# modified, and will be allowed in places where dynamic values are usually prohibited.
-# Use this only for strings you have constructed or validated yourself.
+# Mark a string as already safe for use in an LDAP DN. The value will
+# not be escaped or modified, and will be allowed in places where
+# dynamic values are usually prohibited. Use this only for strings
+# you have constructed or validated yourself.
#
# .Return: _string_
#
#
# [source,unlang]
# ----
-# my-int := "%ldap.profile(ldap://%ldap.uri.safe(%{LDAP-Host}):%ldap.uri.safe(%{LDAP-Port})/ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)"
+# my-int :=
+# "%ldap.profile(ldap://%ldap.uri.safe(%{LDAP-Host}):%ldap.uri.safe(%{LDAP-Port})/ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)"
# ----
#
# === %ldap.dn.unescape(...)
#
-# Decode `\HH` hex sequences in an LDAP DN string back to their original characters.
+# Decode `\HH` hex sequences in an LDAP DN string back to their
+# original characters.
#
# .Return: _string_
#
#
# === %ldap.filter.escape(...)
#
-# Escape a string for use as an assertion value in an LDAP search filter (RFC 4515).
-# Only the characters that are special in a filter assertion value are escaped:
-# `*`, `(`, `)`, `\`, and NUL. Characters such as `=`, `+`, and `,` are intentionally
-# left unescaped because OpenLDAP does not decode non-required `\HH` sequences, so
-# escaping them would cause silent match failures for usernames that legitimately
-# contain those characters.
+# Escape a string for use as an assertion value in an LDAP search
+# filter (RFC 4515). Only the characters that are special in a filter
+# assertion value are escaped: `*`, `(`, `)`, `\`, and NUL.
+# Characters such as `=`, `+`, and `,` are intentionally left
+# unescaped because OpenLDAP does not decode non-required `\HH`
+# sequences, so escaping them would cause silent match failures for
+# usernames that legitimately contain those characters.
#
-# Use this function -- not `%ldap.dn.escape` -- when inserting user-controlled values
-# into the filter part of an LDAP URI or search string.
+# Use this function -- not `%ldap.dn.escape` -- when inserting
+# user-controlled values into the filter part of an LDAP URI or
+# search string.
#
# .Return: _string_
#
#
# [source,unlang]
# ----
-# # Safely embed User-Name in a search filter.
-# # A payload like '*' would otherwise produce (uid=*), matching every user.
-# result := %ldap("ldap:///ou=people,dc=example,dc=com?cn?sub?(uid=%ldap.filter.escape(%{User-Name}))")
+# = Safely embed User-Name in a search filter.
+# = A payload like '*' would otherwise produce (uid=*), matching every user.
+# result :=
+# %ldap("ldap:///ou=people,dc=example,dc=com?cn?sub?(uid=%ldap.filter.escape(%{User-Name}))")
# ----
#
# === %ldap.filter.safe(...)
#
-# Mark a string as already safe for use in an LDAP filter assertion value. The value will
-# not be escaped or modified. Use this only for strings you have constructed or validated
-# yourself.
+# Mark a string as already safe for use in an LDAP filter assertion
+# value. The value will not be escaped or modified. Use this only for
+# strings you have constructed or validated yourself.
#
# .Return: _string_
#
#
# [source,unlang]
# ----
-# # A filter fragment built in policy code, known to be safe.
-# my-filter := "(objectClass=radiusprofile)"
-# result := %ldap("ldap:///ou=profiles,dc=example,dc=com?cn?sub?%ldap.filter.safe(%{my-filter})")
+# = A filter fragment built in policy code, known to be safe.
+# my-filter := "(objectClass=radiusprofile)" result :=
+# %ldap("ldap:///ou=profiles,dc=example,dc=com?cn?sub?%ldap.filter.safe(%{my-filter})")
# ----
#
# === %ldap.filter.unescape(...)
#
-# Decode `\HH` hex sequences in an LDAP filter assertion value back to their original
-# characters.
+# Decode `\HH` hex sequences in an LDAP filter assertion value back
+# to their original characters.
#
# .Return: _string_
#
#
# [source,unlang]
# ----
-# my-string := "john\29\28uid=\2a"
-# reply.Reply-Message := "Unescaped: %ldap.filter.unescape(%{my-string})"
+# my-string := "john\29\28uid=\2a" reply.Reply-Message := "Unescaped:
+# %ldap.filter.unescape(%{my-string})"
# ----
#
# .Output
#
# === %ldap.uri.escape(...)
#
-# Escape a string for safe embedding in an LDAP URI. Special URI characters are
-# converted to `\HH` hex sequences so that user-supplied values cannot alter the
-# structure of the URI.
+# Escape a string for safe embedding in an LDAP URI. Special URI
+# characters are converted to `\HH` hex sequences so that
+# user-supplied values cannot alter the structure of the URI.
#
# .Return: _string_
#
#
# [source,unlang]
# ----
-# my-string := "ldap:///ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)"
+# my-string :=
+# "ldap:///ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)"
# reply.Reply-Message := "Escaped: %ldap.uri.escape(%{my-string})"
# ----
#
#
# === %ldap.uri.safe(...)
#
-# Mark a string as already safe for use in an LDAP URI. The value will not be escaped or
-# modified. Use this for URI components (host, port, path) that you have already
-# validated or constructed yourself.
+# Mark a string as already safe for use in an LDAP URI. The value
+# will not be escaped or modified. Use this for URI components (host,
+# port, path) that you have already validated or constructed
+# yourself.
#
# .Return: _string_
#
#
# [source,unlang]
# ----
-# my-int := "%ldap.profile(ldap://%ldap.uri.safe(%{LDAP-Host}):%ldap.uri.safe(%{LDAP-Port})/ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)"
+# my-int :=
+# "%ldap.profile(ldap://%ldap.uri.safe(%{LDAP-Host}):%ldap.uri.safe(%{LDAP-Port})/ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)"
# ----
#
# === %ldap.uri.unescape(...)
#
-# Decode `\HH` hex sequences in an LDAP URI string back to their original characters.
+# Decode `\HH` hex sequences in an LDAP URI string back to their
+# original characters.
#
# .Return: _string_
#
#
# [source,unlang]
# ----
-# my-string := "ldap\3a\2f\2fou\3dprofiles\2cdc\3dexample\2cdc\3dcom\3f\3fsub\3f\28objectClass\3dradiusprofile\29"
-# reply.Reply-Message := "Unescaped: %ldap.uri.unescape(%{my-string})"
+# my-string :=
+# "ldap\3a\2f\2fou\3dprofiles\2cdc\3dexample\2cdc\3dcom\3f\3fsub\3f\28objectClass\3dradiusprofile\29"
+# reply.Reply-Message := "Unescaped:
+# %ldap.uri.unescape(%{my-string})"
# ----
#
# .Output
#
# Add an option to all attribute referenced in an LDAP URI.
#
-# This is for the corner case where a URI is provided by a third party system
-# and needs amending before being used. e.g. a CRL distribution point extracted
-# from a certificate may need the "binary" option appending to the attribute
-# being requested.
+# This is for the corner case where a URI is provided by a third
+# party system and needs amending before being used. e.g. a CRL
+# distribution point extracted from a certificate may need the
+# "binary" option appending to the attribute being requested.
#
# .Return: _string_
#
#
# [source,unlang]
# ----
-# my-uri := "ldap:///cn=cdp1,ou=pki,dc=example,dc=com?certificateRevocationList?base?objectClass=cRLDistributionPoint"
+# my-uri :=
+# "ldap:///cn=cdp1,ou=pki,dc=example,dc=com?certificateRevocationList?base?objectClass=cRLDistributionPoint"
# reply.Reply-Message := %ldap.uri.attr_option(my-uri, 'binary')
# ----
#
#
# === %ldap.group(...)
#
-# Check whether the current user is a member of a the given group. If the attribute
-# `control.LDAP-UserDN` exists, that will be used as the "user" object. If it does
-# not then the user is first looked up using the filter form the `user { }` section
-# of the module configuration.
+# Check whether the current user is a member of a the given group. If
+# the attribute `control.LDAP-UserDN` exists, that will be used as
+# the "user" object. If it does not then the user is first looked up
+# using the filter form the `user { }` section of the module
+# configuration.
#
-# Groups can be specified either as a name or a DN, with a lookup used if necessary
-# to convert to the required format.
+# Groups can be specified either as a name or a DN, with a lookup
+# used if necessary to convert to the required format.
#
# .Return: _bool_
#
#
# === %ldap.profile(...)
#
-# Retrieve an LDAP object representing an RADIUS profile and apply the attriubte
-# updates as configured in the module `update` section. This can be useful when
-# additional profiles need to be applied to a subscriber beyond those directly
-# associated with their LDAP entry.
+# Retrieve an LDAP object representing an RADIUS profile and apply
+# the attriubte updates as configured in the module `update` section.
+# This can be useful when additional profiles need to be applied to a
+# subscriber beyond those directly associated with their LDAP entry.
#
# The object can be expressed either as an LDAP URI or a DN.
#
#
# = Linelog Module
#
-# The `linelog` module will log entries from attributes, string expansions,
-# or static strings, and writes them to a variety of backends, including syslog,
-# flat files, and raw UDP/TCP sockets.
+# The `linelog` module will log entries from attributes, string
+# expansions, or static strings, and writes them to a variety of
+# backends, including syslog, flat files, and raw UDP/TCP sockets.
#
# NOTE: Multiple linelog's modules may be used for any given request.
-# The `logtee` modules will not affect normal logging output.
-# i.e. This logging is *in addition* to any other logging that is
-# done by the server.
+# The `logtee` modules will not affect normal logging output. i.e.
+# This logging is *in addition* to any other logging that is done by
+# the server.
#
#
#
linelog {
#
- # delimiter:: Custom line delimiters.
+ # delimiter:: Custom line delimiters.
#
# Defaults to `\n` (newline) but may be any UTF8 multi-character
# string.
#
# [NOTE]
# ====
- # The `reference` configuration item can be omitted. If it
- # is omitted, then the log message is static, and is always
- # given by `format`, above.
+ # The `reference` configuration item can be omitted. If it is
+ # omitted, then the log message is static, and is always given by
+ # `format`, above.
#
- # If `reference` is defined, then the value is dynamically
- # expanded, and the result is used to find another
- # configuration entry here, with the given name. That name
- # is then used as the format string.
+ # If `reference` is defined, then the value is dynamically expanded,
+ # and the result is used to find another configuration entry here,
+ # with the given name. That name is then used as the format string.
#
- # If the configuration entry cannot be found, then no log
- # message is printed.
+ # If the configuration entry cannot be found, then no log message is
+ # printed.
#
- # i.e: You can have many log messages in one `linelog` module.
- # If this two-step expansion did not exist, you would have
- # needed to configure one `linelog` module for each log message.
+ # i.e: You can have many log messages in one `linelog` module. If
+ # this two-step expansion did not exist, you would have needed to
+ # configure one `linelog` module for each log message.
# ====
#
#
# reference::
#
- # Reference the `Packet-Type` (`Access-Request`, etc.) If
- # `reference` is commented out, the `format` entry above is
- # used instead.
+ # Reference the `Packet-Type` (`Access-Request`, etc.) If
+ # `reference` is commented out, the `format` entry above is used
+ # instead.
#
- # May be an attribute reference, e.g. `User-Name`, or `xlat`, `literal` or `exec`.
+ # May be an attribute reference, e.g. `User-Name`, or `xlat`,
+ # `literal` or `exec`.
#
reference = "messages.%{reply.Packet-Type || 'default'}"
# The messages defined here are chosen from the `reference`
# expansion, above.
#
- # Pairs may be attributes attribute reference `User-Name` , `xlat`, `literal` or `exec`.
+ # Pairs may be attributes attribute reference `User-Name` , `xlat`,
+ # `literal` or `exec`.
#
messages {
default = "Unknown packet type %{Packet-Type}"
#
# header:: Optional header line format for file output
#
- # If the destination is "file" and header is set, then this
- # is expanded and output as the first line when a new file
- # is created.
+ # If the destination is "file" and header is set, then this is
+ # expanded and output as the first line when a new file is created.
#
# header = ""
# | unix | Write to a UNIX socket.
# |===
#
- # The `stdout` and `stderr` destinations are likely to work only when
- # the server is running in debug mode. When the server is running in
- # background mode, both `stdout` and `stderr` are usually redirected
- # to `/dev/null`.
+ # The `stdout` and `stderr` destinations are likely to work only
+ # when the server is running in debug mode. When the server is
+ # running in background mode, both `stdout` and `stderr` are usually
+ # redirected to `/dev/null`.
#
destination = file
#
# filename:: The file where the logs will go.
#
- # WARNING: We STRONGLY suggest that you do not use
- # data from the packet as part of the filename. This
- # data is untrusted, and may play games with your
- # file system! If it is necessary you must set
- # `escape_filenames = yes` in order to prevent
- # security issues.
+ # WARNING: We STRONGLY suggest that you do not use data from the
+ # packet as part of the filename. This data is untrusted, and may
+ # play games with your file system! If it is necessary you must set
+ # `escape_filenames = yes` in order to prevent security issues.
#
filename = ${logdir}/linelog
# permissions:: The Unix-style permissions on the log file.
#
# Depending on format string, the log file may contain secret or
- # private information about users. Keep the file permissions as
+ # private information about users. Keep the file permissions as
# restrictive as possible.
#
permissions = 0600
#
# group:: The Unix group which owns the log file.
#
- # The user that freeradius runs as must be in the specified
- # group, otherwise it will not be possible to set the group.
+ # The user that freeradius runs as must be in the specified group,
+ # otherwise it will not be possible to set the group.
#
# group = ${security.group}
#
# escape_filenames:: Whether filenames are escaped.
#
- # Most file systems can handle nearly the full range
- # of UTF-8 characters. Ones that can only deal with
- # a limited range should set this to `yes`.
+ # Most file systems can handle nearly the full range of UTF-8
+ # characters. Ones that can only deal with a limited range should
+ # set this to `yes`.
#
escape_filenames = no
#
# fsync:: Forcible sync the data to disk.
#
- # Synchronise data written with the file system after every
- # write, returning fail when the operation fails.
+ # Synchronise data written with the file system after every write,
+ # returning fail when the operation fails.
#
fsync = no
#
- # buffer_count:: How many lines to buffer before
- # writing to disk.
+ # buffer_count:: How many lines to buffer before writing to disk.
#
- # If buffer_count is set, then the module will buffer
- # logs in memory before writing them to disk.
+ # If buffer_count is set, then the module will buffer logs in
+ # memory before writing them to disk.
#
# Setting this to zero will turn off buffering.
#
#
# buffer_delay:: Time delay before writing logs to disk.
#
- # If logs are buffered, then they buffered data is
- # written to disk when either the buffer_count is
- # reached, or when buffer_delay is reached. The
- # combination of the two settings allows much higher
- # performance, while still ensuring that logs are
- # regularly written to disk.
+ # If logs are buffered, then they buffered data is written to disk
+ # when either the buffer_count is reached, or when buffer_delay is
+ # reached. The combination of the two settings allows much higher
+ # performance, while still ensuring that logs are regularly written
+ # to disk.
#
buffer_delay = 1s
}
#
# start:: Connections to create during module instantiation.
#
- # If the server cannot create specified number of
- # connections during instantiation it will exit.
- # Set to `0` to allow the server to start without the
- # external service being available.
+ # If the server cannot create specified number of connections
+ # during instantiation it will exit. Set to `0` to allow the server
+ # to start without the external service being available.
#
start = 0
#
# max:: Maximum number of connections.
#
- # If these connections are all in use and a new one
- # is requested, the request will NOT get a connection.
+ # If these connections are all in use and a new one is requested,
+ # the request will NOT get a connection.
#
- # Setting `max` to *LESS* than the number of threads means
- # that some threads may starve, and you will see errors
- # like _No connections available and at max connection limit_.
+ # Setting `max` to *LESS* than the number of threads means that
+ # some threads may starve, and you will see errors like _No
+ # connections available and at max connection limit_.
#
- # Setting `max` to MORE than the number of threads means
- # that there are more connections than necessary.
+ # Setting `max` to MORE than the number of threads means that there
+ # are more connections than necessary.
#
- # If `max` is not specified, then it defaults to the number
- # of workers configured.
+ # If `max` is not specified, then it defaults to the number of
+ # workers configured.
#
# max =
#
# spare:: Spare connections to be left idle.
#
- # NOTE: Idle connections WILL be closed if `idle_timeout`
- # is set. This should be less than or equal to `max` above.
+ # NOTE: Idle connections WILL be closed if `idle_timeout` is set.
+ # This should be less than or equal to `max` above.
#
spare = 1
#
# retry_delay::
#
- # The number of seconds to wait after the server tries
- # to open a connection, and fails. During this time,
- # no new connections will be opened.
+ # The number of seconds to wait after the server tries to open a
+ # connection, and fails. During this time, no new connections will
+ # be opened.
#
retry_delay = 30
lifetime = 0
#
- # idle_timeout:: A connection which is unused for this length
- # of time will be closed.
+ # idle_timeout:: A connection which is unused for this length of
+ # time will be closed.
#
# Default `60` seconds.
#
idle_timeout = 60
#
- # NOTE: All configuration settings are enforced. If a
- # connection is closed because of `idle_timeout`,
- # `uses`, or `lifetime`, then the total number of
- # connections MAY fall below `min`. When that
- # happens, it will open a new connection. It will
- # also log a WARNING message.
+ # NOTE: All configuration settings are enforced. If a connection is
+ # closed because of `idle_timeout`, `uses`, or `lifetime`, then the
+ # total number of connections MAY fall below `min`. When that
+ # happens, it will open a new connection. It will also log a
+ # WARNING message.
#
- # The solution is to either lower the `min` connections,
- # or increase `lifetime`/`idle_timeout`.
+ # The solution is to either lower the `min` connections, or
+ # increase `lifetime`/`idle_timeout`.
#
}
#
# unix:: UNIX socket-file as destination
#
-# unix {
- #
- # filename:: Full path to the `unix socket` file.
- #
+ # unix {
+ #
+ # filename:: Full path to the `unix socket` file.
+ #
# filename = /path/to/unix.socket
#
# pool:: The `pool { ... }` of connections.
#
# pool = ${..pool}
-# }
+ # }
#
# tcp:: TCP-server as a destination
#
linelog log_accounting {
#
- # Please see the `linelog` module for common configuration explanation.
+ # Please see the `linelog` module for common configuration
+ # explanation.
#
destination = file
#
# == Authentication success / failure logging
#
-# A set of sample module instances which can replace the previous builtin auth log messages
+# A set of sample module instances which can replace the previous
+# builtin auth log messages
#
-# The destination settings here pick up from the main radiusd.conf values, but can be
-# amended if these logs need to be sent to a different destination.
+# The destination settings here pick up from the main radiusd.conf
+# values, but can be amended if these logs need to be sent to a
+# different destination.
#
linelog log_auth_access_accept {
destination = ${log.destination}
# = Logtee Module
#
# The `logtee` module writes the log messages to a socket or to a
-# file. Each instance of the module can send log messages to one,
-# and only one, destination.
+# file. Each instance of the module can send log messages to one, and
+# only one, destination.
#
# You should probably use the `linelog` message instead of this one.
#
# NOTE: Multiple `logtee`s modules may be used for any given request.
-# The `logtee` modules will not affect normal logging output.
-# i.e. This logging is *in addition* to any other logging that is
-# done by the server.
+# The `logtee` modules will not affect normal logging output. i.e.
+# This logging is *in addition* to any other logging that is done by
+# the server.
#
#
logtee {
#
- # delimiter:: Custom line delimiters.
+ # delimiter:: Custom line delimiters.
#
# Defaults to `\n` (newline) but may be any UTF8 multi-character
# string.
#
# The number of log messages we buffer before discarding.
#
- # The module writes log messages to a ring buffer between
- # processing requests and checking whether the output socket is
- # writable, so this should be not set to < `1000`.
+ # The module writes log messages to a ring buffer between processing
+ # requests and checking whether the output socket is writable, so
+ # this should be not set to < `1000`.
#
- # If an error occurs (connection failed, out of disk space
- # etc...) the ring buffer will be used to temporarily buffer
- # log data until the error is cleared.
+ # If an error occurs (connection failed, out of disk space etc...)
+ # the ring buffer will be used to temporarily buffer log data until
+ # the error is cleared.
#
# This limit is applied per worker thread.
#
# |===
#
# NOTE: Syslog output via `syslog()` is not explicitly supported,
- # but you may use one of the other transports to talk directly to
- # a syslog daemon.
+ # but you may use one of the other transports to talk directly to a
+ # syslog daemon.
#
destination = 'file'
#
- # connection_timeout:: How long we wait for a connection or file to open.
+ # connection_timeout:: How long we wait for a connection or file to
+ # open.
#
- # If a connection takes longer than this to open, the module returns `fail`.
+ # If a connection takes longer than this to open, the module returns
+ # `fail`.
#
connection_timeout = 1.0
#
# reconnection_delay::
#
- # How long to wait after a connection or file has become
- # unusable, to try and re-open the connection or file.
+ # How long to wait after a connection or file has become unusable,
+ # to try and re-open the connection or file.
#
reconnection_delay = 1.0
# permissions:: The Unix-style permissions on the log file.
#
# Depending on format string, the log file may contain secret or
- # private information about users. Keep the file permissions as
+ # private information about users. Keep the file permissions as
# restrictive as possible.
#
permissions = 0600
#
# group:: The Unix group which owns the log file.
#
- # The user that freeradius runs as must be in the specified
- # group, otherwise it will not be possible to set the group.
+ # The user that freeradius runs as must be in the specified group,
+ # otherwise it will not be possible to set the group.
#
# group = ${security.group}
}
# automatically derived from the section in which they are called.
#
# If `lua` is called in `recv Access-Request`, firstly a function
-# `recv_access_request` will be looked for. If that does not exist, then
-# a function `recv` will be looked for.
+# `recv_access_request` will be looked for. If that does not exist,
+# then a function `recv` will be looked for.
#
-# This can be overridden by setting `func_recv_access_request` or `func_recv`
-# to point to a different function name.
+# This can be overridden by setting `func_recv_access_request` or
+# `func_recv` to point to a different function name.
#
#
#
# = Mac2IP Module
#
-# The `mac2ip` module is a simple file to map a MAC address to an IP address.
+# The `mac2ip` module is a simple file to map a MAC address to an IP
+# address.
#
# The file is in the format `<mac>,<ip>`.
#
# 02:01:02:03:04:05,192.0.2.102
#
# This lets you perform simple static IP assignments from a flat-text
-# file. You will have to define lease times yourself.
+# file. You will have to define lease times yourself.
#
#
#
# = Mac2Vlan Module
#
-# The `mac2vlan` module is a simple file to map a MAC address to a VLAN.
+# The `mac2vlan` module is a simple file to map a MAC address to a
+# VLAN.
#
# The file should be in the format `<mac>,<vlan>`.
#
# automatically derived from the section in which they are called.
#
# If `mruby` is called in `recv Access-Request`, firstly a method
-# `recv_access_request` will be looked for. If that does not exist, then
-# a method `recv` will be looked for.
+# `recv_access_request` will be looked for. If that does not exist,
+# then a method `recv` will be looked for.
#
-# This can be overridden by setting `func_recv_access_request` or `func_recv`
-# to point to a different method name.
+# This can be overridden by setting `func_recv_access_request` or
+# `func_recv` to point to a different method name.
#
# Each method called during a packet processing section is passed an
# object which represents the packet.
#
-# The object contains 4 methods `request`, `reply`, `control` and `session_state`
-# which allow access to the pairs in those FreeRADIUS pair lists.
+# The object contains 4 methods `request`, `reply`, `control` and
+# `session_state` which allow access to the pairs in those FreeRADIUS
+# pair lists.
#
-# Nested attributes are accessed by using chained methods. Each leaf attribute
-# has the following methods
+# Nested attributes are accessed by using chained methods. Each leaf
+# attribute has the following methods
#
# [options="header,autowidth"]
# |===
# | del(n) | Delete an attribute | Optional number specifying the attribute instance.
# |===
#
-# Where a specific instance of a nested attribute parent is required, the
-# method can be passed an argument to specify the instance number.
+# Where a specific instance of a nested attribute parent is required,
+# the method can be passed an argument to specify the instance
+# number.
#
# For example, if the Ruby method is defined `def self.recv(p)`, then
# attributes in the request can be accessed using syntax of the form:
# | p.requestbaa(2).baz.get | request.baa[2].baz
# |===
#
-# Where attribute names contain `-` this should be replaced by `_`, e.g.
-# `request.User-Name` becomes `p.request.user_name`
+# Where attribute names contain `-` this should be replaced by `_`,
+# e.g. `request.User-Name` becomes `p.request.user_name`
#
# The interface between FreeRADIUS and Ruby is mosty string.
#
-# Attributes of type `string` are copied to Ruby as-is.
-# They are not escaped or interpreted.
+# Attributes of type `string` are copied to Ruby as-is. They are not
+# escaped or interpreted.
#
-# Attributes of type `octets` are copied to Ruby as-is.
-# They are not escaped or interpreted.
+# Attributes of type `octets` are copied to Ruby as-is. They are not
+# escaped or interpreted.
#
# Numeric attributes are passed as the appropriate Ruby numeric type.
#
-# All other attributes are printed, and passed to Ruby as a string value.
+# All other attributes are printed, and passed to Ruby as a string
+# value.
#
-# IP addresses are sent as strings, e.g. "192.0.2.25", and not as a 4-byte
-# binary value. The same applies to other attribute data types.
+# IP addresses are sent as strings, e.g. "192.0.2.25", and not as a
+# 4-byte binary value. The same applies to other attribute data
+# types.
#
-# Attributes can be set by using the `set` method of the leaf attributes E.g.
+# Attributes can be set by using the `set` method of the leaf
+# attributes E.g.
#
# `p.reply.foo.set('baa')`
#
-# The return codes from Ruby methods are passed directly to the server.
-# A set of predefined constants are provided to use as return values:
+# The return codes from Ruby methods are passed directly to the
+# server. A set of predefined constants are provided to use as return
+# values:
#
# [options="header,autowidth"]
# |===
#
# = Microsoft CHAP authentication Module
#
-# The `mschap` module performs `MS-CHAP` and `MS-CHAPv2` authentication.
+# The `mschap` module performs `MS-CHAP` and `MS-CHAPv2`
+# authentication.
#
# MS-CHAP authentication requires access to either the
-# Password.Cleartext or Password.NT attribute for the user. Due to
+# Password.Cleartext or Password.NT attribute for the user. Due to
# the limitations of MS-CHAP, no other password "encryption" methods
# are possible.
#
-# This module validates a user with `MS-CHAP` or `MS-CHAPv2` authentication.
-# If called in `recv Access-Request`, it will look for `MS-CHAP` Challenge/Response
-# attributes in the `request` list and adds an `Auth-Type` attribute set to
-# `mschap` in the Config-Items list unless Auth-Type has already set.
+# This module validates a user with `MS-CHAP` or `MS-CHAPv2`
+# authentication. If called in `recv Access-Request`, it will look
+# for `MS-CHAP` Challenge/Response attributes in the `request` list
+# and adds an `Auth-Type` attribute set to `mschap` in the
+# Config-Items list unless Auth-Type has already set.
#
# The module also enforces the `SMB-Account-Ctrl` attribute. See the
# Samba documentation for the meaning of SMB account control. The
#
# [NOTE]
# ====
-# For more documentation on integrating FreeRADIUS with Active Directory, please
-# see the following web page:
+# For more documentation on integrating FreeRADIUS with Active
+# Directory, please see the following web page:
# http://deployingradius.com/documents/configuration/active_directory.html
# ====
#
# normalise::
#
# By default the server will use heuristics to try and automatically
- # handle base64 or hex encoded passwords or hashes.
- # This behaviour can be disabled by setting the following to `no`.
+ # handle base64 or hex encoded passwords or hashes. This behaviour
+ # can be disabled by setting the following to `no`.
#
# The default is `yes`
#
#
# use_mppe::
#
- # By default the `mschap` will add `MS-CHAP-MPPE-Keys` for `MS-CHAPv1` and
- # `MS-MPPE-Recv-Key` and `MS-MPPE-Send-Key` for `MS-CHAPv2`. Set this
- # configuration item to `no` in order to not add the MPPE keys.
+ # By default the `mschap` will add `MS-CHAP-MPPE-Keys` for
+ # `MS-CHAPv1` and `MS-MPPE-Recv-Key` and `MS-MPPE-Send-Key` for
+ # `MS-CHAPv2`. Set this configuration item to `no` in order to not
+ # add the MPPE keys.
#
# Default is `yes`.
#
#
# require_encryption::
#
- # if `use_mppe` is enabled, the `require_encryption` makes encryption moderate.
+ # if `use_mppe` is enabled, the `require_encryption` makes
+ # encryption moderate.
#
# Default is `no`.
#
# require_strong = yes
#
- # with_ntdomain_hack:: Windows clients send `User-Name` in the form of "DOMAIN\User",
- # but send the challenge/response based only on the User portion.
+ # with_ntdomain_hack:: Windows clients send `User-Name` in the form
+ # of "DOMAIN\User", but send the challenge/response based only on
+ # the User portion.
#
# Default is `yes`.
#
#
# ntlm_auth:: Path and arguments to the `ntlm_auth` program.
#
- # The module can perform authentication itself, OR
- # use a Windows Domain Controller. This configuration
- # directive tells the module to call the `ntlm_auth`
- # program, which will do the authentication, and return
- # the `NT-Key`.
+ # The module can perform authentication itself, OR use a Windows
+ # Domain Controller. This configuration directive tells the module
+ # to call the `ntlm_auth` program, which will do the authentication,
+ # and return the `NT-Key`.
#
# NOTE: you MUST have the such services "winbindd" and "nmbd"
# running on the local machine for `ntlm_auth` to work.
#
# See the `ntlm_auth` program documentation for details.
#
- # If `ntlm_auth` is configured below, then the `mschap` module
- # will call `ntlm_auth` for every `MS-CHAP` authentication request.
+ # If `ntlm_auth` is configured below, then the `mschap` module will
+ # call `ntlm_auth` for every `MS-CHAP` authentication request.
#
- # If there is a cleartext or NT hashed password available, you can set
- # `MS-CHAP-Use-NTLM-Auth := No` in the control items, and the `mschap`
- # module will do the authentication itself, without calling `ntlm_auth`.
+ # If there is a cleartext or NT hashed password available, you can
+ # set `MS-CHAP-Use-NTLM-Auth := No` in the control items, and the
+ # `mschap` module will do the authentication itself, without calling
+ # `ntlm_auth`.
#
- # You can also set `MS-CHAP-Use-NTLM-Auth := Auto`. If a password is available,
- # it will be used. Otherwise the module will fall back to ntlm_auth.
+ # You can also set `MS-CHAP-Use-NTLM-Auth := Auto`. If a password is
+ # available, it will be used. Otherwise the module will fall back to
+ # ntlm_auth.
#
# You can also try setting the user name as:
#
# `... --username=%mschap(User-Name) ...`
#
# In that case, the `mschap` module will look at the `User-Name`
- # attribute, and do prefix/suffix checks in order to obtain the _best_
- # user name for the request.
+ # attribute, and do prefix/suffix checks in order to obtain the
+ # _best_ user name for the request.
#
- # Depending on the AD / Samba configuration, you may also need to add:
+ # Depending on the AD / Samba configuration, you may also need to
+ # add:
#
# `--allow-mschapv2`
#
# to the list of command-line options.
#
- # WARNING: Be VERY careful when editing the following line!
- # Change the path, and ideally nothing else.
+ # WARNING: Be VERY careful when editing the following line! Change
+ # the path, and ideally nothing else.
#
# ntlm_auth = "/path/to/ntlm_auth --request-nt-key --allow-mschapv2 --username=%{Stripped-User-Name || User-Name || 'None'} --challenge=%{%mschap('Challenge') || 00} --nt-response=%{%mschap('NT-Response') || 00}"
#
# ntlm_auth_timeout:: Time to wait for `ntlm_auth` to run.
#
- # This is a long time, and if `ntlm_auth` is taking that long
- # then you likely have other problems in your domain.
+ # This is a long time, and if `ntlm_auth` is taking that long then
+ # you likely have other problems in your domain.
#
- # The length of time can be decreased with the following
- # option, which can save clients waiting if your `ntlm_auth`
- # usually finishes quicker.
+ # The length of time can be decreased with the following option,
+ # which can save clients waiting if your `ntlm_auth` usually
+ # finishes quicker.
#
# Range `1` to `10` seconds.
#
#
# domain:: Domain name for winbind
#
- # An alternative to using `ntlm_auth` is to connect to the
- # winbind daemon directly for authentication. This option
- # is likely to be faster and may be useful on busy systems.
+ # An alternative to using `ntlm_auth` is to connect to the winbind
+ # daemon directly for authentication. This option is likely to be
+ # faster and may be useful on busy systems.
#
- # Performance seems to be about twice that of `ntlm_auth`,
- # which still isn't a lot.
+ # Performance seems to be about twice that of `ntlm_auth`, which
+ # still isn't a lot.
#
- # Using this option requires libwbclient from Samba 4.2.1 or
- # later to be installed. Make sure that `ntlm_auth` above is
- # commented out.
+ # Using this option requires libwbclient from Samba 4.2.1 or later
+ # to be installed. Make sure that `ntlm_auth` above is commented
+ # out.
#
# username = "%mschap('User-Name')"
# domain = "%mschap('NT-Domain')"
# retry_with_normalised_username::
#
# When using single sign-on with a winbind connection and the
- # client uses a different casing for the username than the
- # casing is according to the backend, reauth may fail because
- # of some Windows internals.
- # This switch tries to find the user in the correct casing in
- # the backend, and retry authentication with that username.
+ # client uses a different casing for the username than the casing
+ # is according to the backend, reauth may fail because of some
+ # Windows internals. This switch tries to find the user in the
+ # correct casing in the backend, and retry authentication with that
+ # username.
#
# retry_with_normalised_username = no
#
# == Reusable Handles
#
- # Reusable connection handles are allocated in blocks. These
+ # Reusable connection handles are allocated in blocks. These
# parameters allow for tuning how that is done.
#
reuse {
#
- # min:: The minimum number of connection handles to
- # keep allocated
+ # min:: The minimum number of connection handles to keep allocated
#
# min = 10
#
- # max:: The maximum number of reusable connection
- # handles to allocate.
+ # max:: The maximum number of reusable connection handles to
+ # allocate.
#
# max = 100
#
- # cleanup_interval:: How often to free un-used
- # connection handles.
+ # cleanup_interval:: How often to free un-used connection handles.
#
# cleanup_interval = 30s
}
}
#
- # passchange:: Control parameters for changing passwords via MS-CHAP.
+ # passchange:: Control parameters for changing passwords via
+ # MS-CHAP.
#
- # NOTE: This functionality should only be used inside of PEAP. Anything else
- # is insecure.
+ # NOTE: This functionality should only be used inside of PEAP.
+ # Anything else is insecure.
#
passchange {
#
#
# ntlm_auth_domain:: The domain name for ntlm_auth password change.
#
- # This module support `MS-CHAPv2` (not v1) password
- # change requests. See `doc/howto/modules/mschap.adoc` for
- # some IMPORTANT information.
+ # This module support `MS-CHAPv2` (not v1) password change
+ # requests. See `doc/howto/modules/mschap.adoc` for some IMPORTANT
+ # information.
#
# Samba/ntlm_auth - if you are using `ntlm_auth` to validate
# passwords, you will need to use `ntlm_auth` to change passwords.
#
- # Uncomment the three lines below, and change the path to `ntlm_auth.
+ # Uncomment the three lines below, and change the path to
+ # `ntlm_auth.
#
## ntlm_auth = "/usr/bin/ntlm_auth --helper-protocol=ntlm-change-password-1"
## ntlm_auth_username = "username: %mschap('User-Name')"
# local_cpw::
#
# To implement a local password change, you need to supply a string
- # which is then expanded, so that the password can be placed somewhere.
+ # which is then expanded, so that the password can be placed
+ # somewhere.
#
- # e.g. passed to a script (`exec`), or written to SQL (UPDATE/INSERT).
+ # e.g. passed to a script (`exec`), or written to SQL
+ # (UPDATE/INSERT).
#
# TIP: We give both examples here, but *only one should be used*.
#
#
# use_open_directory::
#
- # For Apple Server, when running on the same machine as Open Directory.
- # It has no effect on other systems.
+ # For Apple Server, when running on the same machine as Open
+ # Directory. It has no effect on other systems.
#
# use_open_directory = yes
#
# allow_retry::
#
- # On failure, set (or not) the `MS-CHAP` error code saying _retries allowed_.
+ # On failure, set (or not) the `MS-CHAP` error code saying _retries
+ # allowed_.
#
# allow_retry = yes
#
# attributes:: the list of attributes used by the mschap module
#
- # The `mschap` module needs to be configured with which attributes contain
- # MS-CHAP data in the request and which should be used for MS-CHAP data
- # in the reply.
+ # The `mschap` module needs to be configured with which attributes
+ # contain MS-CHAP data in the request and which should be used for
+ # MS-CHAP data in the reply.
#
- # This varies for different protocols. The defaults show below are for
- # RADIUS.
+ # This varies for different protocols. The defaults show below are
+ # for RADIUS.
#
attributes {
#
username = User-Name
#
- # chap_challenge:: The attribute containing the CHAP Challenge.
+ # chap_challenge:: The attribute containing the CHAP Challenge.
#
chap_challenge = Vendor-Specific.Microsoft.CHAP-Challenge
#
- # chap_response:: The attribute containing the CHAP Response for MS-CHAPv1.
+ # chap_response:: The attribute containing the CHAP Response for
+ # MS-CHAPv1.
#
chap_response = Vendor-Specific.Microsoft.CHAP-Response
#
- # chap2_response:: The attribute containing the CHAP Response for MS-CHAPv2.
+ # chap2_response:: The attribute containing the CHAP Response for
+ # MS-CHAPv2.
#
chap2_response = Vendor-Specific.Microsoft.CHAP2-Response
#
- # chap2_success:: The attribute MS-CHAPv2 success messages are returned in.
+ # chap2_success:: The attribute MS-CHAPv2 success messages are
+ # returned in.
#
chap2_success = Vendor-Specific.Microsoft.CHAP2-Success
#
- # chap_error:: The attribute CHAP error messages are returned in.
+ # chap_error:: The attribute CHAP error messages are returned in.
#
chap_error = Vendor-Specific.Microsoft.CHAP-Error
#
- # chap_mppe_keys:: The attribute MPPE keys are returned in for MS-CHAPv1
+ # chap_mppe_keys:: The attribute MPPE keys are returned in for
+ # MS-CHAPv1
#
chap_mppe_keys = Vendor-Specific.Microsoft.CHAP-MPPE-Keys
#
- # mppe_recv_key:: The attribute MPPE recv key is returned in for MS-CHAPv2
+ # mppe_recv_key:: The attribute MPPE recv key is returned in for
+ # MS-CHAPv2
#
mppe_recv_key = Vendor-Specific.Microsoft.MPPE-Recv-Key
#
- # mppe_send_key:: The attribute MPPE send key is returned in for MS-CHAPv2
+ # mppe_send_key:: The attribute MPPE send key is returned in for
+ # MS-CHAPv2
#
mppe_send_key = Vendor-Specific.Microsoft.MPPE-Send-Key
#
- # mppe_encryption_policy:: The attribute that MPPE encryption policy is returned in.
+ # mppe_encryption_policy:: The attribute that MPPE encryption
+ # policy is returned in.
#
mppe_encryption_policy = Vendor-Specific.Microsoft.MPPE-Encryption-Policy
#
- # mppe_encryption_types:: The attribute that MPPE encryption type is returned in.
+ # mppe_encryption_types:: The attribute that MPPE encryption type
+ # is returned in.
#
mppe_encryption_types = Vendor-Specific.Microsoft.MPPE-Encryption-Types
#
- # chap2_cpw:: The attribute used to change a users' password
+ # chap2_cpw:: The attribute used to change a users' password
#
chap2_cpw = Vendor-Specific.Microsoft.CHAP2-CPW
#
- # chap_nt_enc_pw:: The attribute containing the encrypted new NT password
+ # chap_nt_enc_pw:: The attribute containing the encrypted new NT
+ # password
#
chap_nt_enc_pw = Vendor-Specific.Microsoft.CHAP-NT-Enc-PW
}
#
- # To use this instance of the mschap module to handle TACACS+ the attribute
- # section should be replaced with the following.
+ # To use this instance of the mschap module to handle TACACS+ the
+ # attribute section should be replaced with the following.
#
- # TACACS+ does not have any inherent support for MPPE keys or password
- # changing using MSCHAP.
+ # TACACS+ does not have any inherent support for MPPE keys or
+ # password changing using MSCHAP.
#
## attributes {
## username = User-Name
#
# TACACS+ puts the MS-CHAP2-Success information in the Data field,
- # but we call it MS-CHAP2-Success for simplicity.
- # See the ALIAS definition in dictionary/tacacs/dictionary.freeradius.internal
+ # but we call it MS-CHAP2-Success for simplicity. See the ALIAS
+ # definition in dictionary/tacacs/dictionary.freeradius.internal
#
## chap2_success = MS-CHAP2-Success
#
# https://bugzilla.samba.org/show_bug.cgi?id=6563
#
-# Depending on the AD / Samba configuration, you may also need to add:
+# Depending on the AD / Samba configuration, you may also need to
+# add:
#
# --allow-mschapv2
#
# to the list of command-line options.
#
-# For more documentation on integrating FreeRADIUS with Active Directory, please
-# see the following web page:
+# For more documentation on integrating FreeRADIUS with Active
+# Directory, please see the following web page:
#
# http://deployingradius.com/documents/configuration/active_directory.html
#
#
# == Configuration Settings
#
-# See the `exec` module for an explanation of the configuration options.
+# See the `exec` module for an explanation of the configuration
+# options.
#
exec ntlm_auth {
wait = yes
#
- # You will need to edit the path and domain to match your
- # local system. The other fields can be left alone.
+ # You will need to edit the path and domain to match your local
+ # system. The other fields can be left alone.
#
program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%mschap(User-Name) --password=%{User-Password}"
}
#
# = OpenDirectory Module
#
-# The `opendirectory` module is only used when the server is running on the same
-# system as OpenDirectory. The configuration of the module is hard-coded
-# by Apple, and cannot be changed here.
+# The `opendirectory` module is only used when the server is running
+# on the same system as OpenDirectory. The configuration of the
+# module is hard-coded by Apple, and cannot be changed here.
#
# The `mschap` module will also automatically talk to OpenDirectory
-# if the server is built on an OSX machine. However, you must also
+# if the server is built on an OSX machine. However, you must also
# set `dsAttrTypeNative:apple-enabled-auth-mech` attribute in the
# `/config/dirserv` OpenDirectory record.
#
#
# For Linux, see http://www.kernel.org/pub/linux/libs/pam/index.html
#
-# WARNING: On some systems, the system PAM libraries have
-# memory leaks! We STRONGLY SUGGEST that you do not
-# use `PAM` for authentication, due to those memory leaks.
+# WARNING: On some systems, the system PAM libraries have memory
+# leaks! We STRONGLY SUGGEST that you do not use `PAM` for
+# authentication, due to those memory leaks.
#
#
#
# See `redhat/radiusd-pam` for a sample PAM configuration file.
#
- # NOTE: Any `Pam-Auth` attribute that is set will override
- # this one.
+ # NOTE: Any `Pam-Auth` attribute that is set will override this one.
#
pam_auth = radiusd
}
#
# = PAP Module
#
-# The `pap` module accepts a large number of formats for the _known good_ (reference)
-# password, such as crypt hashes, md5 hashes, and etc.
-# The module takes the `User-Password` and performs the necessary transformations of the
-# user submitted password to match the copy of the password the server has retrieved.
+# The `pap` module accepts a large number of formats for the _known
+# good_ (reference) password, such as crypt hashes, md5 hashes, and
+# etc. The module takes the `User-Password` and performs the
+# necessary transformations of the user submitted password to match
+# the copy of the password the server has retrieved.
#
-# For instructions on creating the various types of passwords,
-# see http://www.openldap.org/faq/data/cache/347.html
+# For instructions on creating the various types of passwords, see
+# http://www.openldap.org/faq/data/cache/347.html
#
-# The module looks for the `Password.With-Header` control attribute to find
-# the *"known good" password*. The attribute value comprises the header followed
-# immediately by the password data. The header is given by the following table.
+# The module looks for the `Password.With-Header` control attribute
+# to find the *"known good" password*. The attribute value comprises
+# the header followed immediately by the password data. The header is
+# given by the following table.
#
# [options="header,autowidth"]
# |===
# | {X- orclntv} | Password.NT | Windows NT hashed passwords.
# |===
#
-# The module tries to be flexible when handling the various password for mats.
-# It will automatically handle Base-64 encoded data, hex strings, and binary data,
-# and convert them to a format that the server can use.
+# The module tries to be flexible when handling the various password
+# for mats. It will automatically handle Base-64 encoded data, hex
+# strings, and binary data, and convert them to a format that the
+# server can use.
#
-# If there is no `Password.With-Header` attribute, the module looks for one
-# of the `Password.Cleartext`, `Password.NT`, `Password.Crypt`, etc. attributes
-# as listed in the above table. These attributes should contain the relevant
-# format password directly, without the header prefix.
+# If there is no `Password.With-Header` attribute, the module looks
+# for one of the `Password.Cleartext`, `Password.NT`,
+# `Password.Crypt`, etc. attributes as listed in the above table.
+# These attributes should contain the relevant format password
+# directly, without the header prefix.
#
-# Only one control attribute should be set, otherwise the behaviour is undefined
-# as to which one is used for authentication.
+# Only one control attribute should be set, otherwise the behaviour
+# is undefined as to which one is used for authentication.
#
-# NOTE: It is important to understand the difference between the `User-Password`
-# and `Password.Cleartext` attributes. The `Password.Cleartext` attribute is
-# the *"known good"* password for the user. Simply supplying the `Password.Cleartext`
-# to the server will result in most authentication methods working. The `User-Password`
-# attribute is the password as typed in by the user on their private machine.
-# The two are not the same, and should be treated very differently. That is, you should
-# generally not use the `User-Password` attribute anywhere in the RADIUS configuration.
+# NOTE: It is important to understand the difference between the
+# `User-Password` and `Password.Cleartext` attributes. The
+# `Password.Cleartext` attribute is the *"known good"* password for
+# the user. Simply supplying the `Password.Cleartext` to the server
+# will result in most authentication methods working. The
+# `User-Password` attribute is the password as typed in by the user
+# on their private machine. The two are not the same, and should be
+# treated very differently. That is, you should generally not use the
+# `User-Password` attribute anywhere in the RADIUS configuration.
#
# == Configuration Settings
#
# normalise = no
#
- # password_attribute:: Which attribute in the request should be used as
- # the user's password when performing PAP authentication.
+ # password_attribute:: Which attribute in the request should be used
+ # as the user's password when performing PAP authentication.
#
# password_attribute = User-Password
}
# .htpasswd, etc). Every field of the file may be mapped to a RADIUS
# attribute, with one of the fields used as a key.
#
-# The module reads the file when it initializes, and caches the data in
-# memory. This makes it very fast, even for files with thousands of
-# lines. To re-read the file the module will need to be reloaded with
-# `radmin(8)`, or the server will need to be sent a SIGHUP, as dynamic
-# updates are not supported.
+# The module reads the file when it initializes, and caches the data
+# in memory. This makes it very fast, even for files with thousands
+# of lines. To re-read the file the module will need to be reloaded
+# with `radmin(8)`, or the server will need to be sent a SIGHUP, as
+# dynamic updates are not supported.
#
# See the `smbpasswd` and `etc_group` files for more examples.
#
#
# An example configuration for using `/etc/passwd`.
#
-# This is an example which will NOT WORK if you have shadow passwords,
-# NIS, etc. The `unix` module is normally responsible for reading
-# system passwords. You should use it instead of this example.
+# This is an example which will NOT WORK if you have shadow
+# passwords, NIS, etc. The `unix` module is normally responsible for
+# reading system passwords. You should use it instead of this
+# example.
#
passwd etc_passwd {
#
#
# * Field marked as `,` may contain a comma separated list of attributes.
#
- # The format here uses the first field as the key. If the
- # `User-Name` matches, the `Crypt-Password` attribute is
- # created from the second field, and is added to the
- # `control.` list.
+ # The format here uses the first field as the key. If the
+ # `User-Name` matches, the `Crypt-Password` attribute is created
+ # from the second field, and is added to the `control.` list.
#
format = "*User-Name:Crypt-Password:"
#
- # ignore_empty:: Empty fields in the input will be skipped and the RADIUS attribute will
- # not be added.
+ # ignore_empty:: Empty fields in the input will be skipped and the
+ # RADIUS attribute will not be added.
#
- # By setting this value to "no", all attributes in the format list will always be added,
- # even if they have no value.
+ # By setting this value to "no", all attributes in the format list
+ # will always be added, even if they have no value.
#
# Default is `yes`.
#
# hash_size::
#
# A future version of the server will have the module automatically
- # determine the hash size. Having it set manually should not be
- # necessary. It should be set to 50% of the number of lines in the file.
+ # determine the hash size. Having it set manually should not be
+ # necessary. It should be set to 50% of the number of lines in the
+ # file.
#
# WARNING: The value must be larger than zero.
#
ignore_nislike = no
#
- # allow_multiple_keys:: Control whether or not many records for a key are allowed.
+ # allow_multiple_keys:: Control whether or not many records for a
+ # key are allowed.
#
- # If set to `yes`, then the module processes all matching
- # entries. If set to `no`, the module processes only the
- # first matching entry.
+ # If set to `yes`, then the module processes all matching entries.
+ # If set to `no`, the module processes only the first matching
+ # entry.
#
allow_multiple_keys = no
}
# * Please see http://www.perl.org/docs.html for more information about the
# Perl language.
#
-# NOTE: As of FreeRADIUS v4, the Perl subroutine names called when the `perl`
-# module is called are automatically derived from the section in which
-# they are called.
+# NOTE: As of FreeRADIUS v4, the Perl subroutine names called when
+# the `perl` module is called are automatically derived from the
+# section in which they are called.
#
-# e.g. if `perl` is called in `recv Access-Request`, firstly a subroutine
-# `recv_access_request` will be looked for. If that does not exist, then
-# a subroutine `recv` will be looked for.
+# e.g. if `perl` is called in `recv Access-Request`, firstly a
+# subroutine `recv_access_request` will be looked for. If that does
+# not exist, then a subroutine `recv` will be looked for.
#
-# This can be overridden by setting `func_recv_access_request` or `func_recv`
-# to point to a different subroutine name.
+# This can be overridden by setting `func_recv_access_request` or
+# `func_recv` to point to a different subroutine name.
#
-# In addition the option `func_detach` can be used to set a subroutine to call
-# during shutdown.
+# In addition the option `func_detach` can be used to set a
+# subroutine to call during shutdown.
#
-# Each subroutine called during a packet processing section is passed a
-# hash ref which represents the packet.
+# Each subroutine called during a packet processing section is passed
+# a hash ref which represents the packet.
#
-# The hash contains 4 keys `request`, `reply`, `control` and `session-state`
-# which allow access to the pairs in those FreeRADIUS pair lists.
+# The hash contains 4 keys `request`, `reply`, `control` and
+# `session-state` which allow access to the pairs in those FreeRADIUS
+# pair lists.
#
-# Nested attributes are represented by nested hashes, while leaf attributes
-# are represented by arrays, allowing access to individual instances of the
-# attribute.
+# Nested attributes are represented by nested hashes, while leaf
+# attributes are represented by arrays, allowing access to individual
+# instances of the attribute.
#
-# For example, if the perl subroutine starts with `my $p = shift()`, then
-# attributes in the request can be accessed using syntax of the form:
+# For example, if the perl subroutine starts with `my $p = shift()`,
+# then attributes in the request can be accessed using syntax of the
+# form:
#
# [options-"header,autowidth"]
# |===
#
# The interface between FreeRADIUS and Perl is mostly strings.
#
-# Attributes of type `string` are copied to Perl as-is.
-# They are not escaped or interpreted.
+# Attributes of type `string` are copied to Perl as-is. They are not
+# escaped or interpreted.
#
-# Attributes of type `octets` are copied to Perl as-is.
-# They are not escaped or interpreted.
+# Attributes of type `octets` are copied to Perl as-is. They are not
+# escaped or interpreted.
#
# Numeric attributes are passed as the appropriate Perl numeric type.
#
-# All other attributes are printed, and passed to Perl as a string value.
+# All other attributes are printed, and passed to Perl as a string
+# value.
#
-# IP addresses are sent as strings, e.g. "192.0.2.25", and not as a 4-byte
-# binary value. The same applies to other attribute data types.
+# IP addresses are sent as strings, e.g. "192.0.2.25", and not as a
+# 4-byte binary value. The same applies to other attribute data
+# types.
#
-# Attributes can be set by assigning values to the array entries of leaf
-# nodes. E.g.
+# Attributes can be set by assigning values to the array entries of
+# leaf nodes. E.g.
#
# ```
# $p->{'reply'}{'foo'}[0] = 'baa'
# ```
#
-# In addition, the Perl array functions `push`, `pop`, `shift` and `unshift`
-# can be used to add or remove instances of attributes.
+# In addition, the Perl array functions `push`, `pop`, `shift` and
+# `unshift` can be used to add or remove instances of attributes.
#
-# The return codes from functions in the `perl_script` are passed directly back
-# to the server. These codes are defined in `mods-config/example.pl`
+# The return codes from functions in the `perl_script` are passed
+# directly back to the server. These codes are defined in
+# `mods-config/example.pl`
#
-# WARN:: The Perl module is slow compared to `unlang`. The only reason to use
-# Perl is when you need to use a third-party API that is only accessible via
-# a Perl library.
+# WARN:: The Perl module is slow compared to `unlang`. The only
+# reason to use Perl is when you need to use a third-party API that
+# is only accessible via a Perl library.
#
#
#
# filename:: Module to load functions from.
#
- # The Perl script to execute when the module is called.
- # This is very similar to using the `exec` module, but it is
- # persistent, and therefore faster.
+ # The Perl script to execute when the module is called. This is very
+ # similar to using the `exec` module, but it is persistent, and
+ # therefore faster.
#
filename = ${modconfdir}/${.:instance}/example.pl
#
# Options which are passed to the Perl interpreter.
#
- # These are (mostly) the same options as are passed
- # to the `perl` command line.
+ # These are (mostly) the same options as are passed to the `perl`
+ # command line.
#
- # The most useful flag is `-T`. This sets tainting on.
- # Using this flag makes it impossible to leverage bad
- # User-Names into local command execution.
+ # The most useful flag is `-T`. This sets tainting on. Using this
+ # flag makes it impossible to leverage bad User-Names into local
+ # command execution.
#
- # Delete this next line to allow people to pwn your
- # FreeRADIUS server.
+ # Delete this next line to allow people to pwn your FreeRADIUS
+ # server.
#
perl_flags = "-T"
#
# Sample subroutine name overrides
#
- # These options cause the old FreeRADIUS v3 default subroutine
- # names to be used
+ # These options cause the old FreeRADIUS v3 default subroutine names
+ # to be used
## func_recv_access_request = authorize
## func_recv_accounting_request = preacct
## func_send = postauth
#
# config { ... }::
#
- # You can define configuration items (and nested sub-sections) in perl `config { ... }`
- # section.
- # These items will be accessible in the perl script through `%RAD_PERLCONF` hash.
+ # You can define configuration items (and nested sub-sections) in
+ # perl `config { ... }` section. These items will be accessible in
+ # the perl script through `%RAD_PERLCONF` hash.
#
# For instance:
#
# [source,perl]
# ----
- # $RAD_PERLCONF{'name'}
- # $RAD_PERLCONF{'sub-config'}->{'name'}
+ # $RAD_PERLCONF{'name'} $RAD_PERLCONF{'sub-config'}->{'name'}
# ----
#
## config {
#
# = Python Module
#
-# The `python` module processes attributes through a Python interpreter.
+# The `python` module processes attributes through a Python
+# interpreter.
#
# * Please see the `src/modules/rlm_python/example.py` sample.
# * Please see https://www.python.org/doc/ for more information about the
# Python language.
#
# NOTE: Uncomment any `func_*` configuration items below which are
-# included in your module. If the module is called for a section which
-# does not have a function defined, it will return `noop`.
+# included in your module. If the module is called for a section
+# which does not have a function defined, it will return `noop`.
#
-# NOTE: As of FreeRADIUS v4, the Python function names called when the `python`
-# module is called are automatically derived from the section in which
-# they are called.
+# NOTE: As of FreeRADIUS v4, the Python function names called when
+# the `python` module is called are automatically derived from the
+# section in which they are called.
#
-# e.g. if `python` is called in `recv Access-Request`, firstly a function
-# `recv_access_request` will be looked for. If that does not exist, then
-# a function `recv` will be looked for.
+# e.g. if `python` is called in `recv Access-Request`, firstly a
+# function `recv_access_request` will be looked for. If that does not
+# exist, then a function `recv` will be looked for.
#
-# This can be overridden by setting `func_recv_access_request` or `func_recv`
-# to point to a different function name.
+# This can be overridden by setting `func_recv_access_request` or
+# `func_recv` to point to a different function name.
#
# Similarly, `mod_recv_access_request` or `mod_recv` can be used to
# load the function from a module other than the one specified in the
# `module` option.
#
-# WARN:: The Python module is slow compared to `unlang`. The only reason to use
-# Python is when you need to use a third-party API that is only accessible via
-# a Python library.
+# WARN:: The Python module is slow compared to `unlang`. The only
+# reason to use Python is when you need to use a third-party API that
+# is only accessible via a Python library.
# == Global Configuration
#
-# Please see the file `global.d/python` for server-global configuration
-# items which control the Python path.
+# Please see the file `global.d/python` for server-global
+# configuration items which control the Python path.
#
#
# [NOTE]
# ====
# * You may set `mod_<section>` for any of the section to module
- # mappings below, if you want to reference a function in a different
+ # mappings below, if you want to reference a function in a different
# module.
#
# * Uncomment `func_<section>` lines your module provides methods for.
# func_detach = detach
#
- # config { ... }:: Define configuration items which are accessible to the Python script.
+ # config { ... }:: Define configuration items which are accessible
+ # to the Python script.
#
- # You can define configuration items (and nested sub-sections) in python `config { ... }`
- # section. These items will be accessible in the Python script through `freeradius.config`
- # dict as read-only items.
+ # You can define configuration items (and nested sub-sections) in
+ # python `config { ... }` section. These items will be accessible in
+ # the Python script through `freeradius.config` dict as read-only
+ # items.
#
# e.g:
#
# [source,python]
# ----
- # freeradius.config['name']
- # freeradius.config['sub-config']['name']
+ # freeradius.config['name'] freeradius.config['sub-config']['name']
# ----
#
## config {
# = Radius Module
#
# The `radius` module in v4 implements RADIUS proxying and
-# replication. In v3, RADIUS proxying is a special kind of
-# configuration, with it's own load-balancing, fail-over etc. That
-# configuration is now simpler in v4. The outbound RADIUS proxying
-# is done by just another module: the `radius` module.
-# Load-balancing and redundant fail-over are handled by the
-# `load-balance` and `redundant` keywords.
+# replication. In v3, RADIUS proxying is a special kind of
+# configuration, with it's own load-balancing, fail-over etc. That
+# configuration is now simpler in v4. The outbound RADIUS proxying is
+# done by just another module: the `radius` module. Load-balancing
+# and redundant fail-over are handled by the `load-balance` and
+# `redundant` keywords.
#
# In v4, the `radius` module most clearly maps to a `home_server` in
-# v4. The `radius` module typically makes a connection from one
-# source IP address to a server at one destination IP/port. It may
+# v4. The `radius` module typically makes a connection from one
+# source IP address to a server at one destination IP/port. It may
# open multiple source ports, depending on how many packets are being
# proxied.
#
# == Recommendations
#
# In most cases, the v3 configuration be moved to v4 without too many
-# problems. For each `home_server foo { ... }` in v3, create a v4
-# module `radius foo { ... } `. Copy over the IP address, port, and
-# secret configuration items. When this step is finished, the bulk
-# of the basic work is done.
+# problems. For each `home_server foo { ... }` in v3, create a v4
+# module `radius foo { ... } `. Copy over the IP address, port, and
+# secret configuration items. When this step is finished, the bulk of
+# the basic work is done.
#
-# Converting a `home_server_pool foo { ... }` can be done by
-# creating a module in `mods-enabled`, either `load-balance foo {
-# ... }`, or `redundant foo { ... }`. i.e. the v3 module
-# configuration does not have any `instantiate` section. You can
-# just list "virtual" modules directly in the `modules` directory!
+# Converting a `home_server_pool foo { ... }` can be done by creating
+# a module in `mods-enabled`, either `load-balance foo { ... }`, or
+# `redundant foo { ... }`. i.e. the v3 module configuration does not
+# have any `instantiate` section. You can just list "virtual" modules
+# directly in the `modules` directory!
#
# The contents of the `load-balance` or `redundant` section will be
# the list of home servers which will part of that `load-balance` or
# `redundant` pool.
#
# Then, anywhere you want to use a home server, just list it's name
-# in an `unlang` processing section. Anywhere you want to list a
-# home server pool, just list it's name in an `unlang` processing
-# section.
+# in an `unlang` processing section. Anywhere you want to list a home
+# server pool, just list it's name in an `unlang` processing section.
#
# Unlike v3, there is no `Proxy-To-Realm` attribute, or
-# `Home-Server-Pool`, or `Home-Server-Name`. Instead, you just
+# `Home-Server-Pool`, or `Home-Server-Name`. Instead, you just
# configure a module (`radius`, or `load-balance`), and then use the
# module anywhere you want to proxy packets.
#
# In most cases, you can just set something like `Auth-Type :=
# example.com`, and then have a section `authenticate example.com {
-# ... }`, which contains the `radius` modules which do proxying. See
+# ... }`, which contains the `radius` modules which do proxying. See
# `sites-available/default` for sample configuration which uses this
# pattern.
#
#
# The module adds a Proxy-State attribute to all proxied packets.
# This `Proxy-State` contains a 32-bit random number, which is unique
-# to this module. This unique number helps to detect proxy loops.
+# to this module. This unique number helps to detect proxy loops.
#
# The reply from home server is appended to the reply list for the
# current packet.
#
# WARNING: For security reasons, the module ensures that all proxied
# `Access-Request` packets contain a `Message-Authenticator`
-# attribute. This behavior is *NOT* configurable, and *CANNOT* be
-# changed. This behavior is part of the BlastRADIUS mitigations.
+# attribute. This behavior is *NOT* configurable, and *CANNOT* be
+# changed. This behavior is part of the BlastRADIUS mitigations.
#
-# Any proxied packet (including `Accounting-Request`) can
-# receive a `Protocol-Error` response packet. This packet
-# is an explicit `NAK` that something went wrong processing
-# the request.
+# Any proxied packet (including `Accounting-Request`) can receive a
+# `Protocol-Error` response packet. This packet is an explicit `NAK`
+# that something went wrong processing the request.
#
# Unlike v3, the server does not support any "pre-proxy" or
-# "post-proxy" processing sections. Similarly, this module does not
-# support any "proxy" or "proxy-reply" list. Instead, the current
+# "post-proxy" processing sections. Similarly, this module does not
+# support any "proxy" or "proxy-reply" list. Instead, the current
# request is proxied as-is, and the proxied reply is added to the
-# current reply list. If you want to modify the proxied request
+# current reply list. If you want to modify the proxied request
# and/or proxied reply, then you should use a `subrequest` block to
-# create a child request. That child request can then be modified
-# independently of the parent. Any reply attributes will have to be
+# create a child request. That child request can then be modified
+# independently of the parent. Any reply attributes will have to be
# copied back manually to the parent request.
#
# == Configuration Settings
# proxy - forward packets which are received from a NAS
# - each packet has a Proxy-State attribute added.
# - it looks for, and stops proxy loops
- # - retransmissions are sent only when the NAS retransmits
+ # - retransmissions are sent only when the NAS retransmits
# - the module fails if it does not receive a reply
#
# client - originate packet, and do retransmissions ourselves
# - You CANNOT use the module "in place" as with normal proxying.
# - Proxying is only supported via the function %proxy.sendto.ipaddr(ipaddr, port, secret)
#
- # The server can still be used to create (i.e. originate)
- # packets via this module when `mode = proxy` is set. The
- # module can automatically detect the difference between
- # proxied packets and client packets it originates.
- # Originated packets are taken from the detail file, or
- # result when changing packet type (e.g. Accounting-Request
- # to Disconnect-Request), or when the current request is a
- # subrequest, and the parent request is from a different
- # protocol.
- #
- # Note that there is no `mode = unconnected`, where the
- # module then both proxies packets, and replicates them. The
- # need to track replies when proxying means that it's
- # difficult to both proxy and replicate at the same time. As
- # a result, there are two "unconnected" modes, one for each
- # of "proxy" and "replicate".
+ # The server can still be used to create (i.e. originate) packets
+ # via this module when `mode = proxy` is set. The module can
+ # automatically detect the difference between proxied packets and
+ # client packets it originates. Originated packets are taken from
+ # the detail file, or result when changing packet type (e.g.
+ # Accounting-Request to Disconnect-Request), or when the current
+ # request is a subrequest, and the parent request is from a
+ # different protocol.
+ #
+ # Note that there is no `mode = unconnected`, where the module then
+ # both proxies packets, and replicates them. The need to track
+ # replies when proxying means that it's difficult to both proxy and
+ # replicate at the same time. As a result, there are two
+ # "unconnected" modes, one for each of "proxy" and "replicate".
#
mode = proxy
#
- # transport:: Transport protocol. Can be `udp` or `tcp`.
+ # transport:: Transport protocol. Can be `udp` or `tcp`.
#
transport = udp
#
- # max_attributes:: Maximum number of attributes to decode in response.
+ # max_attributes:: Maximum number of attributes to decode in
+ # response.
#
# Default is 255.
#
#
# type:: List of allowed packet types.
#
- # The module will only send packets types which are listed
- # here. Other types of packets will be ignored. The main
- # purpose of the `type` configuration is to ensure that the
- # correct packets are being sent to the home server. This
- # entry serves as a double-check against misconfigurations.
+ # The module will only send packets types which are listed here.
+ # Other types of packets will be ignored. The main purpose of the
+ # `type` configuration is to ensure that the correct packets are
+ # being sent to the home server. This entry serves as a double-check
+ # against misconfigurations.
#
- # In v3, the `home_server` configuration of `auth`, `acct`,
- # or `auth+acct` is used to _find_ a home server. That is,
- # when FreeRADIUS has an `Access-Request` packet in v3, it
- # proxies it by looking up a matching `home_server`.
+ # In v3, the `home_server` configuration of `auth`, `acct`, or
+ # `auth+acct` is used to _find_ a home server. That is, when
+ # FreeRADIUS has an `Access-Request` packet in v3, it proxies it by
+ # looking up a matching `home_server`.
#
# In v4, proxying is done by listing the `radius` module in a
- # processing section, such as `authenticate radius { ... }`,
- # or `recv Accounting-Request { ... }`. So unlike v3, the
- # module doesn't have to _find_ a proxy destination for a
- # particular kind of packet. Instead, the administrator
- # _configures_ the module to send packets to a destination.
+ # processing section, such as `authenticate radius { ... }`, or
+ # `recv Accounting-Request { ... }`. So unlike v3, the module
+ # doesn't have to _find_ a proxy destination for a particular kind
+ # of packet. Instead, the administrator _configures_ the module to
+ # send packets to a destination.
#
- # As a result, the module doesn't really care about what kind
- # of packets it sends. It has a packet, a destination where
- # that packet should be sent, and it sends the packet.
+ # As a result, the module doesn't really care about what kind of
+ # packets it sends. It has a packet, a destination where that packet
+ # should be sent, and it sends the packet.
#
# In order to change packet types, see the `subrequest` keyword.
#
- # NOTE: `Status-Server` is reserved for connection signaling,
- # and cannot be proxied.
+ # NOTE: `Status-Server` is reserved for connection signaling, and
+ # cannot be proxied.
#
- # Unlike v3, all packet types are allocated from the same
- # 8-bit ID space. This change does not affect the majority
- # of RADIUS proxying, which only sends one type of packet.
- # This change does not affect the home server which receives
- # these packets, as the home server does not track IDs except
- # to correlate requests to replies.
+ # Unlike v3, all packet types are allocated from the same 8-bit ID
+ # space. This change does not affect the majority of RADIUS
+ # proxying, which only sends one type of packet. This change does
+ # not affect the home server which receives these packets, as the
+ # home server does not track IDs except to correlate requests to
+ # replies.
#
- # The only visible difference, then, between v3 and v4 is
- # that in some cases, the new `radius` module will use more
- # source ports when proxying.
+ # The only visible difference, then, between v3 and v4 is that in
+ # some cases, the new `radius` module will use more source ports
+ # when proxying.
#
- # This change simplifies the implementation of the RADIUS
- # client.
+ # This change simplifies the implementation of the RADIUS client.
#
type = Access-Request
type = Accounting-Request
#
- # require_message_authenticator::Require Message-Authenticator
- # in responses.
+ # require_message_authenticator::Require Message-Authenticator in
+ # responses.
#
- # A server should include Message-Authenticator attribute as
- # the first attribute in responses to Access-Request packets.
- # This behavior mitigates against the BlastRADIUS attack.
+ # A server should include Message-Authenticator attribute as the
+ # first attribute in responses to Access-Request packets. This
+ # behavior mitigates against the BlastRADIUS attack.
#
- # However, not all servers follow this security practice. As
- # a result, this module can be configured to either not
- # require, or require, Message-Authenticator.
+ # However, not all servers follow this security practice. As a
+ # result, this module can be configured to either not require, or
+ # require, Message-Authenticator.
#
- # If value is `auto`, then the module will automatically
- # detect the existence of Message-Authenticator in response
- # packets. Once the module sees a Message-Authenticator, it
- # will automatically change the configuration internally to
- # `yes`. This change prevents security "down-bidding"
- # attacks.
+ # If value is `auto`, then the module will automatically detect the
+ # existence of Message-Authenticator in response packets. Once the
+ # module sees a Message-Authenticator, it will automatically change
+ # the configuration internally to `yes`. This change prevents
+ # security "down-bidding" attacks.
#
# Allowed values: yes, no, auto
#
require_message_authenticator = auto
#
- # response_window:: If we do not receive any replies within
- # this time period, then start `zombie_period`
+ # response_window:: If we do not receive any replies within this
+ # time period, then start `zombie_period`
#
response_window = 15
#
- # zombie_period:: If the home server does not reply to
- # packets within `response_window`, then `zombie_period`
- # starts.
+ # zombie_period:: If the home server does not reply to packets
+ # within `response_window`, then `zombie_period` starts.
#
- # When `zombie_period` starts, a connection is marked
- # `zombie`, and then is not used to send new packets. If
- # there are no responses on this connection within
- # `zombie_period`, the module either closes the connection
- # (no `status_check` subsection), or starts pinging the home
- # server (`status_check.type = Status-Server`).
+ # When `zombie_period` starts, a connection is marked `zombie`, and
+ # then is not used to send new packets. If there are no responses on
+ # this connection within `zombie_period`, the module either closes
+ # the connection (no `status_check` subsection), or starts pinging
+ # the home server (`status_check.type = Status-Server`).
#
zombie_period = 10
#
- # revive_interval:: If there are no status checks, mark the
- # home server alive after `revive_interval` timeout.
+ # revive_interval:: If there are no status checks, mark the home
+ # server alive after `revive_interval` timeout.
#
# Some home servers do not support status checks via the
- # `Status-Server` packet. Others may not have a "test" user
- # configured that can be used to query the server, to see if
- # it is alive. For those servers, we have NO WAY of knowing
- # when it becomes alive again. Therefore, after the server
- # has been marked dead, we wait a period of time, and mark
- # it alive again, in the hope that it has come back to
- # life.
- #
- # If it has NOT come back to life, then the module will wait
- # for `zombie_period` before marking it dead again. During
- # the `zombie_period`, ALL AUTHENTICATIONS WILL FAIL, because
- # the home server is still dead. There is NOTHING that can
- # be done about this, other than to enable the status checks,
- # as documented above.
- #
- # e.g. if `zombie_period` is 40 seconds, and `revive_interval`
- # is 300 seconds, the for 40 seconds out of every 340, or about
- # 10% of the time, all authentications will fail.
- #
- # If the `zombie_period` and `revive_interval` configurations
- # are set smaller, than it is possible for up to 50% of
- # authentications to fail.
- #
- # As a result, we recommend enabling status checks, and
- # we do NOT recommend using `revive_interval`.
+ # `Status-Server` packet. Others may not have a "test" user
+ # configured that can be used to query the server, to see if it is
+ # alive. For those servers, we have NO WAY of knowing when it
+ # becomes alive again. Therefore, after the server has been marked
+ # dead, we wait a period of time, and mark it alive again, in the
+ # hope that it has come back to life.
+ #
+ # If it has NOT come back to life, then the module will wait for
+ # `zombie_period` before marking it dead again. During the
+ # `zombie_period`, ALL AUTHENTICATIONS WILL FAIL, because the home
+ # server is still dead. There is NOTHING that can be done about
+ # this, other than to enable the status checks, as documented above.
+ #
+ # e.g. if `zombie_period` is 40 seconds, and `revive_interval` is
+ # 300 seconds, the for 40 seconds out of every 340, or about 10% of
+ # the time, all authentications will fail.
+ #
+ # If the `zombie_period` and `revive_interval` configurations are
+ # set smaller, than it is possible for up to 50% of authentications
+ # to fail.
+ #
+ # As a result, we recommend enabling status checks, and we do NOT
+ # recommend using `revive_interval`.
#
# The `revive_interval` configuration is used ONLY if the
- # `status_check` subsection is not used. Otherwise,
+ # `status_check` subsection is not used. Otherwise,
# `revive_interval` is not necessary, and should be deleted.
#
# Useful range of values: 10 to 3600
#
# status_check { ... }:: For "are you alive?" queries.
#
- # If the home server does not respond to proxied packets, the
- # module starts pinging the home server with these packets.
+ # If the home server does not respond to proxied packets, the module
+ # starts pinging the home server with these packets.
#
- # Disable status checks by deleting this section, or by
- # commenting it out.
+ # Disable status checks by deleting this section, or by commenting
+ # it out.
#
status_check {
#
- # type:: You can specify any type of request packet here,
- # e.g. 'Access-Request', 'Accounting-Request' or
- # 'Status-Server'.
+ # type:: You can specify any type of request packet here, e.g.
+ # 'Access-Request', 'Accounting-Request' or 'Status-Server'.
#
- # Status-Server is recommended as other packet types
- # may be interpreted incorrectly, or may ve proxied
- # to a remote server, which defeats the purpose of
- # the status checks.
+ # Status-Server is recommended as other packet types may be
+ # interpreted incorrectly, or may ve proxied to a remote server,
+ # which defeats the purpose of the status checks.
#
- # If you specify another type of packet, it MUST be listed
- # as an allowed `type` above.
+ # If you specify another type of packet, it MUST be listed as an
+ # allowed `type` above.
#
type = Status-Server
#
# The packet contents can be set here.
#
- # We RECOMMEND that you use packet contents which
- # lets the other end easily tell that they are not
- # "real" packets from a NAS.
+ # We RECOMMEND that you use packet contents which lets the other
+ # end easily tell that they are not "real" packets from a NAS.
#
- # The example here is for Status-Server. The
- # contents will vary by other packet types. The
- # Message-Authenticator attribute will be added
- # automatically, and does not need to be specified
- # here.
+ # The example here is for Status-Server. The contents will vary by
+ # other packet types. The Message-Authenticator attribute will be
+ # added automatically, and does not need to be specified here.
#
- # If the Event-Timestamp attribute is added, it will
- # be updated each time the packet is sent.
+ # If the Event-Timestamp attribute is added, it will be updated
+ # each time the packet is sent.
#
- # WARNING: Do NOT do SQL queries, LDAP queries,
- # dynamic expansions, etc. in this section. The
- # contents of the packet are created when a
- # connection is opened, and are not changeable after
- # that.
+ # WARNING: Do NOT do SQL queries, LDAP queries, dynamic expansions,
+ # etc. in this section. The contents of the packet are created when
+ # a connection is opened, and are not changeable after that.
#
update {
User-Name := "test-user"
#
# === File Output
#
- # Write raw RADIUS packets (no IP or UDP header) to a file.
- # This transport can only be used for `mode = replicate`
+ # Write raw RADIUS packets (no IP or UDP header) to a file. This
+ # transport can only be used for `mode = replicate`
#
file {
filename = ${logdir}/packets.bin
#
# Destination IP address, port, and secret.
#
- # Use `ipv4addr = ...` to force IPv4 addresses.
- # Use `ipv6addr = ...` to force IPv6 addresses.
+ # Use `ipv4addr = ...` to force IPv4 addresses. Use `ipv6addr =
+ # ...` to force IPv6 addresses.
#
ipaddr = 127.0.0.1
port = 1812
# interface = eth0
#
- # max_packet_size:: Our max packet size. may be different from the parent.
+ # max_packet_size:: Our max packet size. may be different from the
+ # parent.
#
# max_packet_size = 4096
# The TCP configuration is identical to the `udp` configuration.
#
tcp {
- # copy configuration items here
+ # copy configuration items here
}
#
# == Connection trunking
#
- # Each worker thread (see radiusd.conf, num_workers), has
- # it's own set of connections. These connections are grouped
- # together into a "pool".
+ # Each worker thread (see radiusd.conf, num_workers), has it's own
+ # set of connections. These connections are grouped together into a
+ # "pool".
#
- # Much of the configuration here is similar to the old
- # connection "pool" configuration in v3. However, there are
- # more configuration parameters, and therefore more control
- # over the behavior.
+ # Much of the configuration here is similar to the old connection
+ # "pool" configuration in v3. However, there are more configuration
+ # parameters, and therefore more control over the behavior.
#
pool {
#
# start:: Connections to create during module instantiation.
#
- # If the server cannot create specified number of connections during instantiation
- # it will exit.
+ # If the server cannot create specified number of connections
+ # during instantiation it will exit.
#
- # Set to `0` to allow the server to start without the database being available.
+ # Set to `0` to allow the server to start without the database
+ # being available.
#
start = 0
#
# max:: Maximum number of connections.
#
- # If these connections are all in use and a new one is requested, the request
- # will NOT get a connection.
+ # If these connections are all in use and a new one is requested,
+ # the request will NOT get a connection.
#
max = 8
#
- # connecting:: Maximum number of sockets to have in the "connecting" state.
+ # connecting:: Maximum number of sockets to have in the
+ # "connecting" state.
#
- # If a home server goes down, the module will close
- # old / broken connections, and try to open new ones.
- # In order to avoid flooding the home server with
- # connection attempts, set the `connecting` value to
- # a small number.
+ # If a home server goes down, the module will close old / broken
+ # connections, and try to open new ones. In order to avoid flooding
+ # the home server with connection attempts, set the `connecting`
+ # value to a small number.
#
connecting = 1
#
# uses:: number of packets which will use the connection.
#
- # After `uses` packets have been sent the connection
- # will be closed, and a new one opened. For no
- # limits, set `uses = 0`.
+ # After `uses` packets have been sent the connection will be
+ # closed, and a new one opened. For no limits, set `uses = 0`.
#
uses = 0
#
# lifetime:: lifetime of a connection, in seconds.
#
- # After `lifetime` seconds have passed, no new
- # packets will be sent on the connection. When all
- # replies have been received, the connection will be
- # closed.
+ # After `lifetime` seconds have passed, no new packets will be sent
+ # on the connection. When all replies have been received, the
+ # connection will be closed.
#
# For no limits, set `lifetime = 0`.
#
- # It is possible to use precise times, such as
- # `lifetime = 1.023`, or even qualifiers such as
- # `lifetime = 400ms`.
+ # It is possible to use precise times, such as `lifetime = 1.023`,
+ # or even qualifiers such as `lifetime = 400ms`.
#
lifetime = 0
#
- # open_delay:: How long (in seconds) a connection
- # must be above `per_connection_target` before a new
- # connection is opened.
+ # open_delay:: How long (in seconds) a connection must be above
+ # `per_connection_target` before a new connection is opened.
#
- # Parsing of this field is the same as for
- # `lifetime`.
+ # Parsing of this field is the same as for `lifetime`.
#
open_delay = 0.2
#
- # close_delay:: How long (in seconds) a connection
- # must be below `per_connection_target` before a
- # connection is closed.
+ # close_delay:: How long (in seconds) a connection must be below
+ # `per_connection_target` before a connection is closed.
#
close_delay = 1.0
#
- # manage_interval:: How often (in seconds) the
- # connections are checked for limits, in order to
- # open / close connections.
+ # manage_interval:: How often (in seconds) the connections are
+ # checked for limits, in order to open / close connections.
#
manage_interval = 0.2
#
connection {
#
- # connect_timeout:: How long to wait
- # before giving up on a connection which is
- # being opened.
+ # connect_timeout:: How long to wait before giving up on a
+ # connection which is being opened.
#
connect_timeout = 3.0
#
- # reconnect_delay:: If opening a connection
- # fails, or an open connection fails,
- # we wait `reconnect_delay` seconds before
- # attempting to open another
- # connection.
+ # reconnect_delay:: If opening a connection fails, or an open
+ # connection fails, we wait `reconnect_delay` seconds before
+ # attempting to open another connection.
#
reconnect_delay = 5
}
#
request {
#
- # per_connection_max:: The maximum number of requests
- # which are "live" on a particular connection.
+ # per_connection_max:: The maximum number of requests which are
+ # "live" on a particular connection.
#
per_connection_max = 255
#
- # per_connection_target:: The target number
- # of requests which are "live" on a
- # particular connection.
+ # per_connection_target:: The target number of requests which are
+ # "live" on a particular connection.
#
- # There can be a balance between overloading
- # a connection, and under-utilizing it. The
- # default is to fill each connection before
- # opening a new one.
+ # There can be a balance between overloading a connection, and
+ # under-utilizing it. The default is to fill each connection
+ # before opening a new one.
#
per_connection_target = 255
#
- # free_delay:: How long to wait before
- # freeing internal resources associated with
- # the connection.
+ # free_delay:: How long to wait before freeing internal resources
+ # associated with the connection.
#
free_delay = 10
}
#
# Each packet can have its own retransmission timers.
#
- # The sections are named for each packet type. The contents
- # are the same for all packet types.
+ # The sections are named for each packet type. The contents are the
+ # same for all packet types.
#
#
#
Access-Request {
#
- # initial_rtx_time:: If there is no response within this time,
- # the module will retransmit the packet.
+ # initial_rtx_time:: If there is no response within this time, the
+ # module will retransmit the packet.
#
# Value should be `1..5`.
#
max_rtx_count = 2
#
- # max_rtx_duration:: The total length of time the module will
- # try to retransmit the packet.
+ # max_rtx_duration:: The total length of time the module will try
+ # to retransmit the packet.
#
# Value should be `5..60`
#
#
# === Status-Server packets
#
- # The configuration here helps the module determine if a home
- # server is alive and responding to requests.
+ # The configuration here helps the module determine if a home server
+ # is alive and responding to requests.
#
# WARNING: The `Status-Server` packets CANNOT be proxied.
#
# == Replication of Packets
#
# The module supports replication of packets to new destinations at
-# run time. In this context, replication means "send the packet, and
-# do not wait for the response". This functionality is most useful
+# run time. In this context, replication means "send the packet, and
+# do not wait for the response". This functionality is most useful
# when copying large amounts of accounting data to multiple
# destinations.
#
-# The module can then only be used as a dynamic expansion. That is,
+# The module can then only be used as a dynamic expansion. That is,
# you cannot specify the `replicate` module directly in a processing
# section.
#
# === Usage
#
-# This module can only be used as a dynamic expansion. Since the
+# This module can only be used as a dynamic expansion. Since the
# module does not wait for any response, the expansion does not
# return any value.
#
#
# This function allows the module to send packets to _any_
# destination, where the destination is chosen dynamically at run
-# time. The arguments to the function can be take from other
+# time. The arguments to the function can be take from other
# attributes, database queries, etc.
#
radius replicate {
type = Accounting-Request
#
- # We are not opening a socket from our server to their
- # server. We are replicating packets.
+ # We are not opening a socket from our server to their server. We
+ # are replicating packets.
#
mode = unconnected-replicate
src_ipaddr = *
#
- # `src_port` cannot be used. If it is used here, the
- # module will refuse to start. Instead, the module
- # will open a unique source port per thread.
+ # `src_port` cannot be used. If it is used here, the module will
+ # refuse to start. Instead, the module will open a unique source
+ # port per thread.
#
- # `secret` cannot be used. If it is used, the value
- # will be ignored.
+ # `secret` cannot be used. If it is used, the value will be
+ # ignored.
#
}
#
# === Other Configuration
#
- # No other configuration items are supported when using
- # `mode = unconnected-replicate`.
+ # No other configuration items are supported when using `mode =
+ # unconnected-replicate`.
#
- # The `pool` configuration is ignored, as is `status-check`,
- # along with all per-packet timeouts.
+ # The `pool` configuration is ignored, as is `status-check`, along
+ # with all per-packet timeouts.
#
}
# %proxy.sendto.ipaddr(127.0.0.1, 1812, "testing123")
#
# The first part of the function name (e.g. `proxy`) is taken from
-# the module name. The rest is fixed as `sendto.ipaddr()`
+# the module name. The rest is fixed as `sendto.ipaddr()`
#
# The arguments to the function are:
#
#
# The packet name must be a quoted string.
#
-# The proxying is done asynchronously. i.e. the packet is sent, and
-# the server goes on to do other work. At some point in the future,
-# a response is received, the module processes it, and the server
+# The proxying is done asynchronously. i.e. the packet is sent, and
+# the server goes on to do other work. At some point in the future, a
+# response is received, the module processes it, and the server
# continues.
#
# The timeouts are controlled as described above.
#
# src_port_start:: Start of source port range.
#
- # The outgoing proxy normally uses random source
- # ports. When all of the RADIUS IDs are used for one
- # connection, it opens up another random source port.
+ # The outgoing proxy normally uses random source ports. When all of
+ # the RADIUS IDs are used for one connection, it opens up another
+ # random source port.
#
- # However, it is sometimes useful to restrict the
- # range of source ports to known values. The
- # `src_port_start` and `src_port_end` configuration
- # flags allow the port range to be controlled. The
- # module will then restrict the source ports it is
- # using to be within this range.
+ # However, it is sometimes useful to restrict the range of source
+ # ports to known values. The `src_port_start` and `src_port_end`
+ # configuration flags allow the port range to be controlled. The
+ # module will then restrict the source ports it is using to be
+ # within this range.
#
- # When all ports in this range are used, the module
- # will not be able to open any more outgoing
- # connections.x
+ # When all ports in this range are used, the module will not be
+ # able to open any more outgoing connections.x
#
- # These two configuration items can only be used for
- # UDP sockets.
+ # These two configuration items can only be used for UDP sockets.
#
src_port_start = 10000
src_port_end = 11000
#
- # `src_port` cannot be used. If it is used here, the
- # module will refuse to start. Instead, the module
- # will open a unique source port per thread.
+ # `src_port` cannot be used. If it is used here, the module will
+ # refuse to start. Instead, the module will open a unique source
+ # port per thread.
#
- # `secret` cannot be used. If it is used, the value
- # will be ignored.
+ # `secret` cannot be used. If it is used, the value will be
+ # ignored.
#
}
#
- # Dynamic proxying does *not* support the `status_check`
- # section.
+ # Dynamic proxying does *not* support the `status_check` section.
#
#
# home_server_lifetime:: The lifetime of the home server.
#
# When a new dynamic home server is used, the module caches
- # information about it. So long as the home server is still
- # being used, it will not expire. But if it has received all
- # expected responses (or timeouts), _and_ it has reached its
- # expected lifetime, then the home server will be deleted.
- #
- # This process allows for the secret to change over time.
- # However, the secret can only be changed if there are no
- # outstanding packets. Otherwise, changing the secret would
- # involve having multiple packets outstanding which have
- # different secrets. That doesn't work, and can't be fixed
- # through any code changes on the server.
+ # information about it. So long as the home server is still being
+ # used, it will not expire. But if it has received all expected
+ # responses (or timeouts), _and_ it has reached its expected
+ # lifetime, then the home server will be deleted.
+ #
+ # This process allows for the secret to change over time. However,
+ # the secret can only be changed if there are no outstanding
+ # packets. Otherwise, changing the secret would involve having
+ # multiple packets outstanding which have different secrets. That
+ # doesn't work, and can't be fixed through any code changes on the
+ # server.
#
# The solution to that is to switch to using TLS.
#
home_server_lifetime = 3600
#
- # These are allowed, but are less useful. If the home server
- # doesn't respond, it will often just hit the home server
- # lifetime, and be deleted.
+ # These are allowed, but are less useful. If the home server doesn't
+ # respond, it will often just hit the home server lifetime, and be
+ # deleted.
#
response_window = 15
zombie_period = 10
#
# == Timeouts
#
- # Timeouts for proxying are controlled in sections named for
- # the packet type. See the examples above for full
- # documentation.
+ # Timeouts for proxying are controlled in sections named for the
+ # packet type. See the examples above for full documentation.
#
Access-Request {
initial_rtx_time = 2
#
# start:: Connections to create during module instantiation.
#
- # If the server cannot create specified number of connections during instantiation
- # it will exit.
+ # If the server cannot create specified number of connections
+ # during instantiation it will exit.
#
- # Set to `0` to allow the server to start without the database being available.
+ # Set to `0` to allow the server to start without the database
+ # being available.
#
start = 0
#
# max:: Maximum number of connections.
#
- # If these connections are all in use and a new one is requested, the request
- # will NOT get a connection.
+ # If these connections are all in use and a new one is requested,
+ # the request will NOT get a connection.
#
max = 8
#
- # connecting:: Maximum number of sockets to have in the "connecting" state.
+ # connecting:: Maximum number of sockets to have in the
+ # "connecting" state.
#
- # If a home server goes down, the module will close
- # old / broken connections, and try to open new ones.
- # In order to avoid flooding the home server with
- # connection attempts, set the `connecting` value to
- # a small number.
+ # If a home server goes down, the module will close old / broken
+ # connections, and try to open new ones. In order to avoid flooding
+ # the home server with connection attempts, set the `connecting`
+ # value to a small number.
#
connecting = 1
#
# uses:: number of packets which will use the connection.
#
- # After `uses` packets have been sent the connection
- # will be closed, and a new one opened. For no
- # limits, set `uses = 0`.
+ # After `uses` packets have been sent the connection will be
+ # closed, and a new one opened. For no limits, set `uses = 0`.
#
uses = 0
#
# lifetime:: lifetime of a connection, in seconds.
#
- # After `lifetime` seconds have passed, no new
- # packets will be sent on the connection. When all
- # replies have been received, the connection will be
- # closed.
+ # After `lifetime` seconds have passed, no new packets will be sent
+ # on the connection. When all replies have been received, the
+ # connection will be closed.
#
# For no limits, set `lifetime = 0`.
#
- # It is possible to use precise times, such as
- # `lifetime = 1.023`, or even qualifiers such as
- # `lifetime = 400ms`.
+ # It is possible to use precise times, such as `lifetime = 1.023`,
+ # or even qualifiers such as `lifetime = 400ms`.
#
lifetime = 0
#
- # open_delay:: How long (in seconds) a connection
- # must be above `per_connection_target` before a new
- # connection is opened.
+ # open_delay:: How long (in seconds) a connection must be above
+ # `per_connection_target` before a new connection is opened.
#
- # Parsing of this field is the same as for
- # `lifetime`.
+ # Parsing of this field is the same as for `lifetime`.
#
open_delay = 0.2
#
- # close_delay:: How long (in seconds) a connection
- # must be below `per_connection_target` before a
- # connection is closed.
+ # close_delay:: How long (in seconds) a connection must be below
+ # `per_connection_target` before a connection is closed.
#
close_delay = 1.0
#
- # manage_interval:: How often (in seconds) the
- # connections are checked for limits, in order to
- # open / close connections.
+ # manage_interval:: How often (in seconds) the connections are
+ # checked for limits, in order to open / close connections.
#
manage_interval = 0.2
#
connection {
#
- # connect_timeout:: How long to wait
- # before giving up on a connection which is
- # being opened.
+ # connect_timeout:: How long to wait before giving up on a
+ # connection which is being opened.
#
connect_timeout = 3.0
#
- # reconnect_delay:: If opening a connection
- # fails, or an open connection fails,
- # we wait `reconnect_delay` seconds before
- # attempting to open another
- # connection.
+ # reconnect_delay:: If opening a connection fails, or an open
+ # connection fails, we wait `reconnect_delay` seconds before
+ # attempting to open another connection.
#
reconnect_delay = 5
}
#
request {
#
- # per_connection_max:: The maximum number of requests
- # which are "live" on a particular connection.
+ # per_connection_max:: The maximum number of requests which are
+ # "live" on a particular connection.
#
per_connection_max = 255
#
- # per_connection_target:: The target number
- # of requests which are "live" on a
- # particular connection.
+ # per_connection_target:: The target number of requests which are
+ # "live" on a particular connection.
#
- # There can be a balance between overloading
- # a connection, and under-utilizing it. The
- # default is to fill each connection before
- # opening a new one.
+ # There can be a balance between overloading a connection, and
+ # under-utilizing it. The default is to fill each connection
+ # before opening a new one.
#
per_connection_target = 255
#
- # free_delay:: How long to wait before
- # freeing internal resources associated with
- # the connection.
+ # free_delay:: How long to wait before freeing internal resources
+ # associated with the connection.
#
free_delay = 10
}
@policy proxy {
#
- # Create a subrequest which we can edit. When the subrequest
- # section is done,
+ # Create a subrequest which we can edit. When the subrequest section
+ # is done,
#
subrequest {
#
#
# This is the "post-proxy" section.
#
- # Note that the Proxy-State attributes have already
- # been deleted from the reply, so you don't need to
- # do that here. Those attributes are not needed by
- # anyone for anything, and confuse things if they're
- # copied to the original request. The `radius`
- # module therefore deletes them, to make your life
- # easier.
+ # Note that the Proxy-State attributes have already been deleted
+ # from the reply, so you don't need to do that here. Those
+ # attributes are not needed by anyone for anything, and confuse
+ # things if they're copied to the original request. The `radius`
+ # module therefore deletes them, to make your life easier.
#
#
- # Like v3, remove all pre-existing attributes in the
- # original reply, and replace them with the reply
- # from the home server.
+ # Like v3, remove all pre-existing attributes in the original
+ # reply, and replace them with the reply from the home server.
#
- # It is also possible to copy over some, or none of
- # the attributes in the reply from the home server.
- # The configuration here is just an example, and can
- # be edited.
+ # It is also possible to copy over some, or none of the attributes
+ # in the reply from the home server. The configuration here is just
+ # an example, and can be edited.
#
parent.reply := reply
}
#
# = REDIS Module
#
-# The `redis` module handles connections to a redis database,
-# and the `%redis( ...)` dynamic expansion.
+# The `redis` module handles connections to a redis database, and the
+# `%redis( ...)` dynamic expansion.
#
# See also https://redis.io/documentation for documentation on the
# Redis database.
#
# == Configuration Settings
#
-# This module connects to a Redis database. Other modules
-# (e.g. `redis_ippool`) perform task-specific functions using Redis.
+# This module connects to a Redis database. Other modules (e.g.
+# `redis_ippool`) perform task-specific functions using Redis.
#
redis {
#
# server:: The server to connect to.
#
- # If using Redis cluster, multiple 'bootstrap' servers may be
- # listed here (as separate config items). These will be contacted
- # in turn until one provides us with a valid map for the cluster.
+ # If using Redis cluster, multiple 'bootstrap' servers may be listed
+ # here (as separate config items). These will be contacted in turn
+ # until one provides us with a valid map for the cluster.
#
# Server strings may contain unique ports e.g.:
#
# server = '127.0.0.1:30001'
# server = '[::1]:30002'
#
- # NOTE: Instantiation failure behaviour is controlled by `pool.start`
- # as with every other module, but with clustering, the `pool { ... }`
- # section determines limits for each node in the cluster, not the
- # cluster as a whole.
+ # NOTE: Instantiation failure behaviour is controlled by
+ # `pool.start` as with every other module, but with clustering, the
+ # `pool { ... }` section determines limits for each node in the
+ # cluster, not the cluster as a whole.
#
server = 127.0.0.1
#
- # database:: Select the Redis logical database having the specified zero-based numeric index.
+ # database:: Select the Redis logical database having the specified
+ # zero-based numeric index.
#
# NOTE: Redis only supports logical databases when Redis cluster is
# not in use.
# database = 0
#
- # port:: Port to connect to
- # The default port is 6379.
+ # port:: Port to connect to The default port is 6379.
#
port = 6379
#
# use_tls:: Use TLS (requires hiredis 1.0+)
#
- # TLS parameters can be specified in the optional adjacent tls {} section
+ # TLS parameters can be specified in the optional adjacent tls {}
+ # section
#
# use_tls = no
-# tls { }
+ # tls { }
#
# use_cluster_map:: Use cluster map
#
# Build cluster map during initialization.
#
- # The cluster client can operate, albeit inefficiently, without a cluster map
- # by following '-ASK' and '-MOVE' redirects.
+ # The cluster client can operate, albeit inefficiently, without a
+ # cluster map by following '-ASK' and '-MOVE' redirects.
#
- # Disabling cluster map can be required for stunnel-based deployments.
- # Alternatively, cluster map is not built during initialization when pool.start == 0
+ # Disabling cluster map can be required for stunnel-based
+ # deployments. Alternatively, cluster map is not built during
+ # initialization when pool.start == 0
#
# In addition the cluster map should be disabled when connecting to
# non-clustered Redis servers.
#
# function <name> { ... }::
#
- # Every function section listed here will be registered as an expansion with a name
- # in the format `<inst>.<name>`.
+ # Every function section listed here will be registered as an
+ # expansion with a name in the format `<inst>.<name>`.
#
- # For example the function below would be callable as `%redis.hello_world(...)`.
+ # For example the function below would be callable as
+ # `%redis.hello_world(...)`.
#
- # expansion functions take the same arguments as the redis `EVALSHA` command,
- # i.e. `<numkeys> [<key> [<key> ...]] [<arg> [<arg> ...]]`.
+ # expansion functions take the same arguments as the redis
+ # `EVALSHA` command, i.e. `<numkeys> [<key> [<key> ...]] [<arg>
+ # [<arg> ...]]`.
#
- # `numkeys` specifies how many of the proceeding arguments should be treated as keys.
+ # `numkeys` specifies how many of the proceeding arguments should
+ # be treated as keys.
#
- # The redis module will use the first key to determine which cluster node the function
- # should called on.
+ # The redis module will use the first key to determine which
+ # cluster node the function should called on.
#
- # The redis module pre-calcualtes the SHA1 hash of all lua functions on startup.
- # When an expansion function is called, it uses the `EVALSHA` command to attempt to
- # call lua function on a remote redis node. If `EVALSHA` fails with an error indicating
- # no script could be found with the calculated SHA1 hash, the lua function will be
- # loaded transparently using `SCRIPT LOAD`.
+ # The redis module pre-calcualtes the SHA1 hash of all lua
+ # functions on startup. When an expansion function is called, it
+ # uses the `EVALSHA` command to attempt to call lua function on a
+ # remote redis node. If `EVALSHA` fails with an error indicating no
+ # script could be found with the calculated SHA1 hash, the lua
+ # function will be loaded transparently using `SCRIPT LOAD`.
#
function hello_world {
#
#
# pool { ... }::
#
- # Information for the connection pool. The configuration items below
+ # Information for the connection pool. The configuration items below
# are the same for all modules which use the new connection pool.
#
pool {
#
# start:: Connections to create during module instantiation.
#
- # If the server cannot create specified number of
- # connections during instantiation it will exit.
- # Set to `0` to allow the server to start without the
- # external service being available.
+ # If the server cannot create specified number of connections
+ # during instantiation it will exit. Set to `0` to allow the server
+ # to start without the external service being available.
#
start = 0
#
# max:: Maximum number of connections.
#
- # If these connections are all in use and a new one
- # is requested, the request will NOT get a connection.
+ # If these connections are all in use and a new one is requested,
+ # the request will NOT get a connection.
#
- # Setting `max` to *LESS* than the number of threads means
- # that some threads may starve, and you will see errors
- # like _No connections available and at max connection limit_.
+ # Setting `max` to *LESS* than the number of threads means that
+ # some threads may starve, and you will see errors like _No
+ # connections available and at max connection limit_.
#
- # Setting `max` to MORE than the number of threads means
- # that there are more connections than necessary.
+ # Setting `max` to MORE than the number of threads means that there
+ # are more connections than necessary.
#
- # If `max` is not specified, then it defaults to the number
- # of workers configured.
+ # If `max` is not specified, then it defaults to the number of
+ # workers configured.
#
# max =
#
# spare:: Spare connections to be left idle.
#
- # NOTE: Idle connections WILL be closed if `idle_timeout`
- # is set. This should be less than or equal to `max` above.
+ # NOTE: Idle connections WILL be closed if `idle_timeout` is set.
+ # This should be less than or equal to `max` above.
#
spare = 1
uses = 0
#
- # retry_delay:: The number of seconds to wait after the server tries
- # to open a connection, and fails.
+ # retry_delay:: The number of seconds to wait after the server
+ # tries to open a connection, and fails.
#
# During this time, no new connections will be opened.
#
#
# idle_timeout:: The idle timeout (in seconds).
#
- # A connection which is unused for this length of time will be closed.
+ # A connection which is unused for this length of time will be
+ # closed.
#
# NOTE: `0` means "infinite".
#
#
# connect_timeout:: Connection timeout (in seconds).
#
- # The maximum amount of time to wait for a new connection to be established.
+ # The maximum amount of time to wait for a new connection to be
+ # established.
#
connect_timeout = 3.0
#
# [NOTE]
# ====
- # All configuration settings are enforced. If a connection is closed because of
- # `idle_timeout`, `uses`, or `lifetime`, then the total number of connections MAY
- # fall below `min`.
+ # All configuration settings are enforced. If a connection is
+ # closed because of `idle_timeout`, `uses`, or `lifetime`, then the
+ # total number of connections MAY fall below `min`.
#
- # When that happens, it will open a new connection. It will also log a *WARNING*
- # message.
+ # When that happens, it will open a new connection. It will also
+ # log a *WARNING* message.
#
- # The solution is to either lower the "min" connections,
- # or increase lifetime/idle_timeout.
+ # The solution is to either lower the "min" connections, or
+ # increase lifetime/idle_timeout.
# ====
#
}
#
# == Configuration Settings
#
-# Al configuration items at this level (below the `redis` block)
-# are polymorphic, meaning `xlats`, attribute references, literal values
+# Al configuration items at this level (below the `redis` block) are
+# polymorphic, meaning `xlats`, attribute references, literal values
# and execs may be specified.
#
-# For example `pool_name` could be `pool_name = 'my_test_pool'` if only a
-# single pool were being used.
+# For example `pool_name` could be `pool_name = 'my_test_pool'` if
+# only a single pool were being used.
#
redis_ippool {
#
pool_name = control.IP-Pool.Name
#
- # offer_time:: How long a lease is reserved for after making an offer.
+ # offer_time:: How long a lease is reserved for after making an
+ # offer.
#
- # If no value is provided, the value from lease_time is used
- # for initial allocations.
+ # If no value is provided, the value from lease_time is used for
+ # initial allocations.
#
- # NOTE: No value should be provided for _PPP/VPNs_, this is mainly for the
- # _DORA_ flow in _DHCP_.
+ # NOTE: No value should be provided for _PPP/VPNs_, this is mainly
+ # for the _DORA_ flow in _DHCP_.
#
offer_time = 30
lease_time = 3600
#
- # association_time:: How long the owner -> IP association should be kept.
+ # association_time:: How long the owner -> IP association should be
+ # kept.
#
- # If this is set, and the value is greater than `lease_time` then the
- # association between the "owner" and an IP address will be kept for
- # this many seconds after the allocation / most recent renewal.
+ # If this is set, and the value is greater than `lease_time` then
+ # the association between the "owner" and an IP address will be kept
+ # for this many seconds after the allocation / most recent renewal.
#
- # This allows for "sticky" addressing, where a request for an address
- # will return the last one allocated to the owner if it is within this
- # number of seconds of the allocation / most recent renewal and the
- # address has not been allocated to another owner.
+ # This allows for "sticky" addressing, where a request for an
+ # address will return the last one allocated to the owner if it is
+ # within this number of seconds of the allocation / most recent
+ # renewal and the address has not been allocated to another owner.
#
# association_time = 7200
#
- # wait_num:: How many slaves we want to acknowledge allocations or updates.
+ # wait_num:: How many slaves we want to acknowledge allocations or
+ # updates.
#
# wait_num = 10
# wait_timeout = 2
#
- # gateway:: Gateway identifier, usually `NAS-Identifier` or the actual Option 82 gateway.
- # Used for bulk lease cleanups.
+ # gateway:: Gateway identifier, usually `NAS-Identifier` or the
+ # actual Option 82 gateway. Used for bulk lease cleanups.
#
# gateway = NAS-Identifier
#
# owner:: The unique owner identifier to which an IP is assigned.
#
- # This is used as the lookup key to determine the IP address that has
- # been allocated to a owner. It MUST therefore be something unique to
- # each "owner" to which an IP address may be assigned.
+ # This is used as the lookup key to determine the IP address that
+ # has been allocated to a owner. It MUST therefore be something
+ # unique to each "owner" to which an IP address may be assigned.
#
# For DHCP it is often simply the MAC address of the owner.
#
# owner = "%{Client-Identifier || Client-Hardware-Address}"
#
- # For purposes such as IP assignment using a RADIUS Framed-IP-Address
- # attribute the "owner" identifier could be a `User-Name` or a
- # certificate serial number provided that the number of sessions is
- # limited to one per user/serial.
+ # For purposes such as IP assignment using a RADIUS
+ # Framed-IP-Address attribute the "owner" identifier could be a
+ # `User-Name` or a certificate serial number provided that the
+ # number of sessions is limited to one per user/serial.
#
# On a hostile network it SHOULD include a component that you trust,
- # arranged such that the overall key cannot be spoofed by manipulation
- # of the user-controlled data. For example you might determine that
- # Vendor-Specific.ADSL-Forum.Agent-Circuit-ID is trusted but that Calling-Station-Id is
- # formatted as a user-controlled MAC address:
+ # arranged such that the overall key cannot be spoofed by
+ # manipulation of the user-controlled data. For example you might
+ # determine that Vendor-Specific.ADSL-Forum.Agent-Circuit-ID is
+ # trusted but that Calling-Station-Id is formatted as a
+ # user-controlled MAC address:
#
# owner = "%{Vendor-Specific.ADSL-Forum.Agent-Circuit-ID} %{Calling-Station-Id}"
requested_address = "%{Requested-IP-Address || Net.Src.IP}"
#
- # ipv4_integer:: Whether IPv4 addresses should be cast to integers, for renew operations.
+ # ipv4_integer:: Whether IPv4 addresses should be cast to integers,
+ # for renew operations.
#
#
# ipv4_integer = yes
#
- # allocated_address_attr:: List and attribute where the allocated address is written to.
+ # allocated_address_attr:: List and attribute where the allocated
+ # address is written to.
#
allocated_address_attr = reply.Your-IP-Address
#
- # range_attr:: List and attribute where the `IP-Pool.Range` ID (if set) is written to.
+ # range_attr:: List and attribute where the `IP-Pool.Range` ID (if
+ # set) is written to.
#
- # The idea of the `IP-Pool.Range` is that it provides a key into other datastores
- # or caches, which store the additional options associated with the range an
- # IP address belongs to.
+ # The idea of the `IP-Pool.Range` is that it provides a key into
+ # other datastores or caches, which store the additional options
+ # associated with the range an IP address belongs to.
#
- # There may be multiple ranges of IP address contained within any given pool,
- # which is why this is provided in addition to the pool name.
+ # There may be multiple ranges of IP address contained within any
+ # given pool, which is why this is provided in addition to the pool
+ # name.
#
range_attr = reply.IP-Pool.Range
#
- # expiry_attr:: If set - the list and attribute to write the remaining lease time to.
+ # expiry_attr:: If set - the list and attribute to write the
+ # remaining lease time to.
#
- # This attribute can be populated on alloc, or renew, if an
- # IP address was available for the alloc.
+ # This attribute can be populated on alloc, or renew, if an IP
+ # address was available for the alloc.
#
expiry_attr = reply.IP-Address-Lease-Time
#
- # copy_on_update:: If true - Copy the value of ip_address to the attribute specified by
- # `allocated_address_attr` when performing an update/renew.
+ # copy_on_update:: If true - Copy the value of ip_address to the
+ # attribute specified by `allocated_address_attr` when performing an
+ # update/renew.
#
# This behavior is needed for DHCP where we need to send back
# `Your-IP-Address` in ACKs.
#
# = REDISWho Module
#
-# The `rediswho` module tracks the last set of login sessions for a user.
+# The `rediswho` module tracks the last set of login sessions for a
+# user.
#
#
#
# server::
#
- # If using Redis cluster, multiple 'bootstrap' servers may be
- # listed here (as separate config items). These will be contacted
- # in turn until one provides us with a valid map for the cluster.
- # Server strings may contain unique ports e.g.:
+ # If using Redis cluster, multiple 'bootstrap' servers may be listed
+ # here (as separate config items). These will be contacted in turn
+ # until one provides us with a valid map for the cluster. Server
+ # strings may contain unique ports e.g.:
#
# server = '127.0.0.1:30001'
# server = '[::1]:30002'
#
# NOTE: Instantiation failure behaviour is controlled by
- # `pool.start` as with other modules. With clustering
- # however, the `pool { ... }` section determines limits for
- # each node we access in the cluster, and not the cluster as
- # a whole.
+ # `pool.start` as with other modules. With clustering however, the
+ # `pool { ... }` section determines limits for each node we access
+ # in the cluster, and not the cluster as a whole.
#
server = 127.0.0.1
#
- # database:: Select the Redis logical database having the specified zero-based numeric index.
+ # database:: Select the Redis logical database having the specified
+ # zero-based numeric index.
#
# database = 0
#
- # port:: Port to connect to
- # The default port is 6379.
+ # port:: Port to connect to The default port is 6379.
#
port = 6379
#
# expire_time:: Expiry time in seconds.
#
- # Any sessions which have not received an update in this time will be
- # automatically expired.
+ # Any sessions which have not received an update in this time will
+ # be automatically expired.
#
expire_time = 86400
#
# Each subsection contains insert / trim / expire queries.
#
- # The subsections are named after the contents of the `Acct-Status-Type` attribute.
+ # The subsections are named after the contents of the
+ # `Acct-Status-Type` attribute.
#
- # See `dictionary.rfc2866` for the names of the various Acct-Status-Type values,
- # or look at the output of debug mode.
+ # See `dictionary.rfc2866` for the names of the various
+ # Acct-Status-Type values, or look at the output of debug mode.
#
- # This module supports *any* `Acct-Status-Type`. Just add a subsection
- # of the appropriate name, along with insert / trim / expire queries.
+ # This module supports *any* `Acct-Status-Type`. Just add a
+ # subsection of the appropriate name, along with insert / trim /
+ # expire queries.
#
#
#
# = redundant_sql Module
#
-# The `redundant_sql` module handles SQL expansions in a redundant manner.
+# The `redundant_sql` module handles SQL expansions in a redundant
+# manner.
#
#
# This configuration is a `virtual` module.
# * All modules in the section are using the same
# driver, e.g. They are all sql, or all ldap, etc.
#
-# When those conditions are satisfied, the server will
-# automatically register a dynamic expansion, using the
-# name of the `virtual` module. In the example below,
-# it will be `redundant_sql`. You can then use this expansion
-# just like any other:
+# When those conditions are satisfied, the server will automatically
+# register a dynamic expansion, using the name of the `virtual`
+# module. In the example below, it will be `redundant_sql`. You can
+# then use this expansion just like any other:
#
-# reply.Filter-Id := "%redundant_sql( ... )"
+# reply.Filter-Id := "%redundant_sql( ... )"
#
# In this example, the expansion is done via module `sql1`, and if
# that expansion fails, using module `sql2`.
#
# For best results, configure the `pool` subsection of the module so
-# that `retry_delay` is non-zero. That will allow the redundant
-# block to quickly ignore all "down" SQL databases. If instead we
-# have `retry_delay = 0`, then every time the redundant block is
-# used, the server will try to open a connection to every `down`
-# database, causing problems.
+# that `retry_delay` is non-zero. That will allow the redundant block
+# to quickly ignore all "down" SQL databases. If instead we have
+# `retry_delay = 0`, then every time the redundant block is used, the
+# server will try to open a connection to every `down` database,
+# causing problems.
#
redundant redundant_sql {
sql1
rest {
#
- # tls { ... }:: Configure the tls related items that control
- # how FreeRADIUS connects to a HTTPS server.
+ # tls { ... }:: Configure the tls related items that control how
+ # FreeRADIUS connects to a HTTPS server.
#
tls {
#
# Certificate validation options
#
- # Specifies how the certificate(s) presented by the HTTPS server being contacted
- # are validated, and which certificates (if any) to send to the HTTPS server.
+ # Specifies how the certificate(s) presented by the HTTPS server
+ # being contacted are validated, and which certificates (if any) to
+ # send to the HTTPS server.
#
#
- # ca_file:: PEM formatted file containing the chain to validate the HTTPS server's cert
+ # ca_file:: PEM formatted file containing the chain to validate the
+ # HTTPS server's cert
#
- # Should usually contain a concatenation of one or more intermediary CA
- # files, shallowest (i.e. the one that signed the HTTPS server's cert) first, and
- # deepest (the root CA) last.
+ # Should usually contain a concatenation of one or more
+ # intermediary CA files, shallowest (i.e. the one that signed the
+ # HTTPS server's cert) first, and deepest (the root CA) last.
#
- # Providing a complete certificate chain here is the most common way of validating
- # the certificate presented by a HTTPS server.
+ # Providing a complete certificate chain here is the most common
+ # way of validating the certificate presented by a HTTPS server.
#
# ca_file = "${certdir}/cacert.pem"
#
- # ca_issuer_file:: PEM formatted file containing the CA that signed the HTTPS server's cert
+ # ca_issuer_file:: PEM formatted file containing the CA that signed
+ # the HTTPS server's cert
#
- # Specifies the certificate that directly signed the certificate presented by the
- # HTTPS server.
+ # Specifies the certificate that directly signed the certificate
+ # presented by the HTTPS server.
#
- # This configuration option can be used to prevent certificates passing validation that
- # were signed by other intermediary CAs or root CAs in the trusted certificate chain.
+ # This configuration option can be used to prevent certificates
+ # passing validation that were signed by other intermediary CAs or
+ # root CAs in the trusted certificate chain.
#
# ca_issuer_file = "${certdir}/caissuer.pem"
#
- # ca_path:: A directory containing multiple root CA certs named by their hash
+ # ca_path:: A directory containing multiple root CA certs named by
+ # their hash
#
# See the OpenSSL documentation for more details:
# - https://www.openssl.org/docs/man1.1.0/man3/SSL_CTX_set_default_verify_paths.html
# - https://www.openssl.org/docs/man1.1.1/man1/c_rehash.html
#
- # This configuration option should only be used when the HTTPS server being contacted
- # is not known ahead of time (using a URL from an external source), and/or the CA used
- # to sign the HTTPS server certificate is unknown.
+ # This configuration option should only be used when the HTTPS
+ # server being contacted is not known ahead of time (using a URL
+ # from an external source), and/or the CA used to sign the HTTPS
+ # server certificate is unknown.
#
- # If not set, then whatever libcurl has as its default will be used, which typically
- # will be the operating system's set of trusted CAs. This will be visible in the debug
- # output when FreeRADIUS starts.
+ # If not set, then whatever libcurl has as its default will be
+ # used, which typically will be the operating system's set of
+ # trusted CAs. This will be visible in the debug output when
+ # FreeRADIUS starts.
#
# ca_path = "${certdir}"
#
- # certificate_file:: PEM formatted file containing the certificate we present to the HTTPS server
+ # certificate_file:: PEM formatted file containing the certificate
+ # we present to the HTTPS server
#
- # Specifies a certificate and any intermediary CAs we should send to the HTTPS server.
+ # Specifies a certificate and any intermediary CAs we should send
+ # to the HTTPS server.
#
- # This file should usually contain the client certificate file first, then any
- # intermediary signing CAs, shallowest (direct signee of the certificate_file)
- # to deepest (signed directly by the root CA).
+ # This file should usually contain the client certificate file
+ # first, then any intermediary signing CAs, shallowest (direct
+ # signee of the certificate_file) to deepest (signed directly by
+ # the root CA).
#
# certificate_file = /path/to/radius.pem
#
- # private_key_file:: PEM formatted file containing the private key for the specified certificate_file
+ # private_key_file:: PEM formatted file containing the private key
+ # for the specified certificate_file
#
# Must be specified if certificate_file is being used.
#
# private_key_file = /path/to/radius.key
#
- # private_key_password:: Password used to decrypt the private key file.
+ # private_key_password:: Password used to decrypt the private key
+ # file.
#
# Should only be specified in the private_key_file is encrypted.
#
# private_key_password = "supersecret"
#
- # random_file:: Source of random data used for various cryptographic functions.
+ # random_file:: Source of random data used for various
+ # cryptographic functions.
#
# random_file = /dev/urandom
# check_cert_cn = no
#
- # extract_cert_attrs:: Extract OIDs from presented certificates as OIDs.
+ # extract_cert_attrs:: Extract OIDs from presented certificates as
+ # OIDs.
#
# Default is `no`
#
#
# keylog_file:: Write out session keys in SSLKEYLOGFILE format
#
- # The SSLKEYLOGFILE format is specified here https://www.ietf.org/archive/id/draft-thomson-tls-keylogfile-00.html.
+ # The SSLKEYLOGFILE format is specified here
+ # https://www.ietf.org/archive/id/draft-thomson-tls-keylogfile-00.html.
#
- # The contents of the keylog file allows wireshark captures to be decrypted for debugging purposes.
+ # The contents of the keylog file allows wireshark captures to be
+ # decrypted for debugging purposes.
#
# NOTE: keylog_file is not expanded at runtime.
#
# http_negotiation = "default"
#
- # multiplex:: Execute multiple requests simultaneously using the same HTTP connection.
+ # multiplex:: Execute multiple requests simultaneously using the
+ # same HTTP connection.
#
- # NOTE: HTTP >= 2.0 is required for multiplexing to succeed. If we can't negotiate
- # a high enough http version, multiplexing will be silently disabled.
+ # NOTE: HTTP >= 2.0 is required for multiplexing to succeed. If we
+ # can't negotiate a high enough http version, multiplexing will be
+ # silently disabled.
#
# multiplex = yes
# The following config items can be used in each of the sections.
# The sections themselves reflect the sections in the server.
#
- # For example, if you list `rest` in the `recv Access-Request` section of a `virtual server`,
- # the settings from the `recv access-request` section here will be used.
+ # For example, if you list `rest` in the `recv Access-Request`
+ # section of a `virtual server`, the settings from the `recv
+ # access-request` section here will be used.
#
- # Where sections have two parts to the name, if a section which matches both names is not
- # found, then one using just the first name will be looked for. E.g. a call in `accounting Start`,
- # will look for `accounting start` and fall back to `accounting`.
+ # Where sections have two parts to the name, if a section which
+ # matches both names is not found, then one using just the first
+ # name will be looked for. E.g. a call in `accounting Start`, will
+ # look for `accounting start` and fall back to `accounting`.
#
- # At the top level of each section, the following config items may be listed:
+ # At the top level of each section, the following config items may
+ # be listed:
#
# [options="header,autowidth"]
# |===
# | `timeout` | HTTP request timeout in seconds, defaults to 4.0.
# |===
#
- # In the `request { ... }` subsection, the following config items may be listed:
+ # In the `request { ... }` subsection, the following config items
+ # may be listed:
#
# [options="header,autowidth"]
# |===
# |===
#
#
- # In the `response { ... }` subsection, the following config items may be listed:
+ # In the `response { ... }` subsection, the following config items
+ # may be listed:
#
# [options="header,autowidth"]
# |===
# | `max_body_in` | Maximum size of incoming HTTP body, defaults to 16k.
# |===
#
- # Additional HTTP headers may be specified with `control.REST-HTTP-Header`.
+ # Additional HTTP headers may be specified with
+ # `control.REST-HTTP-Header`.
#
# The values of those attributes should be in the format:
#
# <attribute>: <value>
#
- # `control.REST-HTTP-Header` attributes will be consumed after each call
- # to the rest module, and each `%rest(...)` expansion.
+ # `control.REST-HTTP-Header` attributes will be consumed after each
+ # call to the rest module, and each `%rest(...)` expansion.
#
#
#
# `[outer.][<list>.]<attribute0>=<value0>&[outer.][<list>.]<attributeN>=<valueN>`
#
- # JSON - All attributes and values are escaped according to the JSON specification.
+ # JSON - All attributes and values are escaped according to the JSON
+ # specification.
#
# e.g:
#
#
#
- # xlat { ... }:: Allows a subset of section configuration items to be configured for
- # any calls to this module's `xlat` function.
+ # xlat { ... }:: Allows a subset of section configuration items to
+ # be configured for any calls to this module's `xlat` function.
#
xlat {
tls = ${..tls}
#
# binary:: Is the output of %rest() expected to be binary data
#
- # Setting this to "yes" will result in the %rest() xlat outputting octet
- # data rather than string data.
+ # Setting this to "yes" will result in the %rest() xlat outputting
+ # octet data rather than string data.
#
- # When it is "no" then the output type will be determined from the body
- # type of the response.
+ # When it is "no" then the output type will be determined from the
+ # body type of the response.
#
# binary = yes
}
#
# === recv { ... }
#
- # Default action when called in `recv` sections except `recv Accounting-Request`.
+ # Default action when called in `recv` sections except `recv
+ # Accounting-Request`.
#
# [options="header,autowidth"]
# |===
#
# === Accounting { ... }
#
- # Default action when called in `recv Accounting-Request` or `accounting` sections.
+ # Default action when called in `recv Accounting-Request` or
+ # `accounting` sections.
#
# [options="header,autowidth"]
# |===
}
#
- # connection { ... }:: Configure how connection handles are
- # managed per thread.
+ # connection { ... }:: Configure how connection handles are managed
+ # per thread.
#
connection {
#
- # Reusable connection handles are allocated in blocks. These
+ # Reusable connection handles are allocated in blocks. These
# parameters allow for tuning how that is done.
#
# Since http requests are performed async, the settings here
reuse {
#
- # min:: The minimum number of connection handles to
- # keep allocated.
+ # min:: The minimum number of connection handles to keep
+ # allocated.
#
min = 10
#
- # max:: The maximum number of reusable connection handles
- # to allocate.
+ # max:: The maximum number of reusable connection handles to
+ # allocate.
#
- # Any requests to allocate a connection handle beyond
- # this number will cause a temporary handle to be allocated.
- # This is less efficient than the block allocation so
- # `max` should be set to reflect the number of outstanding
- # requests expected at peak load.
+ # Any requests to allocate a connection handle beyond this number
+ # will cause a temporary handle to be allocated. This is less
+ # efficient than the block allocation so `max` should be set to
+ # reflect the number of outstanding requests expected at peak
+ # load.
max = 100
#
- # cleanup_interval:: How often to free un-used connection
- # handles.
+ # cleanup_interval:: How often to free un-used connection handles.
#
- # Every `cleanup_interval` a cleanup routine runs which
- # will free any blocks of handles which are not in use,
- # ensuring that at least `min` handles are kept.
+ # Every `cleanup_interval` a cleanup routine runs which will free
+ # any blocks of handles which are not in use, ensuring that at
+ # least `min` handles are kept.
#
cleanup_interval = 30s
#
# connect_timeout:: Connection timeout (in seconds).
#
- # The maximum amount of time to wait for a new connection to be established.
+ # The maximum amount of time to wait for a new connection to be
+ # established.
#
connect_timeout = 3.0
}
#
# == Configuration Settings
#
-# See the `passwd` module for documentation on the configuration items
-# for this module.
+# See the `passwd` module for documentation on the configuration
+# items for this module.
#
passwd smbpasswd {
filename = /etc/smbpasswd
#
# The `smtp` module can perform two actions:
#
-# When called in the `authenticate` section, it validates a users name
-# and password from request attributes against an SMTP server without
-# sending a mail.
+# When called in the `authenticate` section, it validates a users
+# name and password from request attributes against an SMTP server
+# without sending a mail.
#
# When called with the method `mail` it will send an email.
#
-# The module can optionally perform a tls handshake, enabled with require_cert
+# The module can optionally perform a tls handshake, enabled with
+# require_cert
#
smtp {
#
- # tls { ... }:: Configure the tls related items which control
- # how FreeRADIUS connects to an SMTP server.
+ # tls { ... }:: Configure the tls related items which control how
+ # FreeRADIUS connects to an SMTP server.
#
tls {
#
# Certificate validation options
#
- # Specifies how the certificate(s) presented by the
- # SMTP server are validated, and which certificates
- # (if any) to send to that SMTP server.
+ # Specifies how the certificate(s) presented by the SMTP server are
+ # validated, and which certificates (if any) to send to that SMTP
+ # server.
#
- # The options here behave the same as the options in
- # other `tls` sections in the server.
+ # The options here behave the same as the options in other `tls`
+ # sections in the server.
#
#
- # certificate_file:: PEM formatted file containing the certificate we present to the SMTP server
+ # certificate_file:: PEM formatted file containing the certificate
+ # we present to the SMTP server
#
- # Specifies a certificate and any intermediary CAs we should send to the SMTP server.
+ # Specifies a certificate and any intermediary CAs we should send
+ # to the SMTP server.
#
- # This file should usually contain the client certificate file first, then any
- # intermediary signing CAs, shallowest (direct signee of the certificate_file)
- # to deepest (signed directly by the root CA).
+ # This file should usually contain the client certificate file
+ # first, then any intermediary signing CAs, shallowest (direct
+ # signee of the certificate_file) to deepest (signed directly by
+ # the root CA).
#
# certificate_file = /path/to/radius.pem
#
- # ca_file:: PEM formatted file containing the chain
- # to validate the SMTP server's certificate.
+ # ca_file:: PEM formatted file containing the chain to validate the
+ # SMTP server's certificate.
#
- # Any certificate chain MUST be in order from server
- # certificate (first in the file) to intermediary CAs (second) to
- # Root CA (last in the file) as per RFC 4346 Section 7.4.2 (see certificate_list)
+ # Any certificate chain MUST be in order from server certificate
+ # (first in the file) to intermediary CAs (second) to Root CA (last
+ # in the file) as per RFC 4346 Section 7.4.2 (see certificate_list)
#
- # Providing a complete certificate chain here is the
- # most common way of validating the certificate
- # presented by an SMTP server.
+ # Providing a complete certificate chain here is the most common
+ # way of validating the certificate presented by an SMTP server.
#
# ca_file = "${certdir}/cacert.pem"
#
- # ca_issuer_file:: PEM formatted file containing the
- # CA that signed the SMTP server's certificate.
+ # ca_issuer_file:: PEM formatted file containing the CA that signed
+ # the SMTP server's certificate.
#
- # Specifies the certificate which directly signed
- # the certificate presented by the SMTPs server.
+ # Specifies the certificate which directly signed the certificate
+ # presented by the SMTPs server.
#
- # This configuration option can be used to prevent
- # certificates passing validation which were signed
- # by other intermediary CAs, or root CAs, in the
- # trusted certificate chain.
+ # This configuration option can be used to prevent certificates
+ # passing validation which were signed by other intermediary CAs,
+ # or root CAs, in the trusted certificate chain.
#
# ca_issuer_file = "${certdir}/caissuer.pem"
#
- # ca_path:: A directory containing multiple root CA certs named by their hash.
+ # ca_path:: A directory containing multiple root CA certs named by
+ # their hash.
#
- # This configuration option should only be used when the SMTP server being contacted
- # is not known ahead of time (using a URL from an external source), and/or the CA used
- # to sign the SMTP server certificate is unknown.
+ # This configuration option should only be used when the SMTP
+ # server being contacted is not known ahead of time (using a URL
+ # from an external source), and/or the CA used to sign the SMTP
+ # server certificate is unknown.
#
- # If not set, then whatever libcurl has as its default will be used, which typically
- # will be the operating system's set of trusted CAs. This will be visible in the debug
- # output when FreeRADIUS starts.
+ # If not set, then whatever libcurl has as its default will be
+ # used, which typically will be the operating system's set of
+ # trusted CAs. This will be visible in the debug output when
+ # FreeRADIUS starts.
#
# ca_path = "${certdir}"
#
- # private_key_file:: PEM formatted file containing the private key for the specified `certificate_file`
+ # private_key_file:: PEM formatted file containing the private key
+ # for the specified `certificate_file`
#
# This item must be specified if `certificate_file` is being used.
#
# private_key_file = /path/to/radius.key
#
- # private_key_password:: Password used to decrypt the `private_key_file`.
+ # private_key_password:: Password used to decrypt the
+ # `private_key_file`.
#
# private_key_password = "supersecret"
#
- # random_file:: Source of random data used for various cryptographic functions.
+ # random_file:: Source of random data used for various
+ # cryptographic functions.
#
# random_file = /dev/urandom
# check_cert = no
#
- # request_cert:: Options for controlling how the
- # module requests TLS to the SMTP server.
+ # request_cert:: Options for controlling how the module requests
+ # TLS to the SMTP server.
#
# May be one of:
#
# check_cert_cn = no
#
- # extract_cert_attrs:: Extract OIDs from presented certificates as OIDs.
+ # extract_cert_attrs:: Extract OIDs from presented certificates as
+ # OIDs.
#
# Default is `no`
#
#
# uri:: URI which will be used for connecting to the SMTP server.
#
- # The `smtp` module uses Curl (https://curl.haxx.se/libcurl/) to implement
- # the underlying mail protocols. The URI should be in the form of:
+ # The `smtp` module uses Curl (https://curl.haxx.se/libcurl/) to
+ # implement the underlying mail protocols. The URI should be in the
+ # form of:
#
# `SCHEME://IP:PORT/`
#
uri = "smtp://192.0.20.1/"
#
- # timeout:: How long the module will wait, before giving up on the response
- # from the SMTP server.
+ # timeout:: How long the module will wait, before giving up on the
+ # response from the SMTP server.
#
timeout = 5s
#
- # authenticate:: Configuration for verifying a users name and clear-text password
- # against an SMTP server.
+ # authenticate:: Configuration for verifying a users name and
+ # clear-text password against an SMTP server.
#
- # This is not generally recommended, but is supported for cases where an LDAP server
- # is not available, and only an SMTP server is available.
+ # This is not generally recommended, but is supported for cases
+ # where an LDAP server is not available, and only an SMTP server is
+ # available.
#
authenticate {
#
# username = User-Name
#
- # password_attribute:: The users password when performing SMTP authentication
+ # password_attribute:: The users password when performing SMTP
+ # authentication
#
# password = User-Password
}
#
# template_directory:: Directory where email templates are stored.
#
- # All file attachments should be given as a relative path
- # from this location. i.e. without a leading '/'.
+ # All file attachments should be given as a relative path from this
+ # location. i.e. without a leading '/'.
#
template_directory = ${confdir}/mods_config/smtp/
#
# This can be different than the provided envelope_address.
#
- # If envelope_address is set, this can be formatted however
- # you want it to appear to the receiver.
+ # If envelope_address is set, this can be formatted however you want
+ # it to appear to the receiver.
#
# If envelope_address is not set, the first element in
# sender_address will be used as the envelope address.
#
# recipients:: Email addresses to be set as recipients for the email
#
- # If recipients is set, then `bcc`, `cc`, and `to` will not
- # be automatically added to the email. Only the list of
- # `recipients` will be used.
+ # If recipients is set, then `bcc`, `cc`, and `to` will not be
+ # automatically added to the email. Only the list of `recipients`
+ # will be used.
#
## recipients = SMTP-Recipients[*]
## recipients = SMTP-TO[*]
#
# to:: Set the body `TO` header.
#
- # If `recepients` is not set, then messages will be sent to the `TO` address.
+ # If `recepients` is not set, then messages will be sent to the `TO`
+ # address.
#
# to = SMTP-TO[*]
#
# cc:: Set the body `CC` header.
#
- # If `recepients` is not set, then messages will also be sent to the `CC` addresses.
+ # If `recepients` is not set, then messages will also be sent to the
+ # `CC` addresses.
#
# cc = SMTP-CC[*]
#
# The local part may contain commas, the domain may not (RFC 2821)
#
- # Therefore, the first comma after the @ represents a new
- # address, and is not listed in the header of the email.
+ # Therefore, the first comma after the @ represents a new address,
+ # and is not listed in the header of the email.
#
- # If `recepients` is not set, then messages will also be sent to the `CCC` addresses.
+ # If `recepients` is not set, then messages will also be sent to the
+ # `CCC` addresses.
#
# bcc = SMTP-BCC[*]
#
- # set_date:: Adds a Date: to the header, set to the time the request is received
- # Formatted as "Fri, 07 Aug 2020 00:57:37 -0400, (EDT)"
+ # set_date:: Adds a Date: to the header, set to the time the request
+ # is received Formatted as "Fri, 07 Aug 2020 00:57:37 -0400, (EDT)"
# May be one of:
#
# [options="header,autowidth"]
#
# header:: Additional headers to add to the messages.
#
- # Any `FROM`, `TO`, and `CC` should not be added here. They are set in the configuration items above.
+ # Any `FROM`, `TO`, and `CC` should not be added here. They are set
+ # in the configuration items above.
#
- # If no `DATE` header is provided, one will be added which
- # shows the time that the request was sent.
+ # If no `DATE` header is provided, one will be added which shows the
+ # time that the request was sent.
#
# Non-standard mail headers may be set. Adhere to your MTA's
# documentation
#
header {
#
- # Headers are added with the given names and values, in the order listed here.
+ # Headers are added with the given names and values, in the order
+ # listed here.
#
subject = "email subject"
Message-ID = "950124.162336@example.com"
}
#
- # connection { .. }:: Configure how connection handles are
- # managed per thread.
+ # connection { .. }:: Configure how connection handles are managed
+ # per thread.
#
connection {
#
- # Reusable connection handles are allocated in blocks. These
+ # Reusable connection handles are allocated in blocks. These
# parameters allow for tuning how that is done.
#
# Since http requests are performed async, the settings here
reuse {
#
- # min:: The minimum number of connection handles to
- # keep allocated.
+ # min:: The minimum number of connection handles to keep
+ # allocated.
#
min = 10
#
- # max:: The maximum number of reusable connection handles
- # to allocate.
+ # max:: The maximum number of reusable connection handles to
+ # allocate.
#
- # Any requests to allocate a connection handle beyond
- # this number will cause a temporary handle to be allocated.
- # This is less efficient than the block allocation so
- # `max` should be set to reflect the number of outstanding
- # requests expected at peak load.
+ # Any requests to allocate a connection handle beyond this number
+ # will cause a temporary handle to be allocated. This is less
+ # efficient than the block allocation so `max` should be set to
+ # reflect the number of outstanding requests expected at peak
+ # load.
max = 100
#
- # cleanup_interval:: How often to free un-used connection
- # handles.
+ # cleanup_interval:: How often to free un-used connection handles.
#
- # Every `cleanup_interval` a cleanup routine runs which
- # will free any blocks of handles which are not in use,
- # ensuring that at least `min` handles are kept.
+ # Every `cleanup_interval` a cleanup routine runs which will free
+ # any blocks of handles which are not in use, ensuring that at
+ # least `min` handles are kept.
#
cleanup_interval = 30s
#
# = Sometimes Module
#
-# The `sometimes` module is used for `debugging` purposes. Each instance
-# randomly returns the configured result, or `noop`.
+# The `sometimes` module is used for `debugging` purposes. Each
+# instance randomly returns the configured result, or `noop`.
#
# NOTE: It is based on the `always` module.
#
#
# For authorization queries, the default schema mirrors the
# functionality of the `files` module, including check items and
-# reply items. See the
-# doc/antora/modules/reference/pages/raddb/mods-config/files/users.adoc file
-# documentation for information on the format of the check items and
-# reply items.
+# reply items. See the
+# doc/antora/modules/reference/pages/raddb/mods-config/files/users.adoc
+# file documentation for information on the format of the check items
+# and reply items.
#
#
dialect = "sqlite"
#
- # driver:: The sub-module to use to execute queries. It
- # should usually match the `dialect` above.
+ # driver:: The sub-module to use to execute queries. It should
+ # usually match the `dialect` above.
#
# In some cases, the driver is different from the `dialect`.
#
- # The null driver can be used with any `dialect`,
- # along with the `logfile` directive below. It will then
- # write the SQL queries to a log file.
+ # The null driver can be used with any `dialect`, along with the
+ # `logfile` directive below. It will then write the SQL queries to a
+ # log file.
#
- # For MS-SQL, there are multiple driver options, as given in
- # the table below. If the databases require syntax
- # *different* from MS-SQL, please submit bug reports so that
- # we can fix them,
+ # For MS-SQL, there are multiple driver options, as given in the
+ # table below. If the databases require syntax *different* from
+ # MS-SQL, please submit bug reports so that we can fix them,
#
# [options="header,autowidth"]
# |===
driver = "${dialect}"
#
- # Include driver specific configuration file if one
- # exists. These are in a separate configuration file
- # in mods-config/sql/driver/<driver>.
+ # Include driver specific configuration file if one exists. These
+ # are in a separate configuration file in
+ # mods-config/sql/driver/<driver>.
#
$-INCLUDE ${modconfdir}/sql/driver/${driver}
#
- # Connection information
+ # Connection information
#
## server = "localhost"
## port = 3306
# radius_db = "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=localhost)(PORT=1521))(CONNECT_DATA=(SID=your_sid)))"
#
- # If you're using `postgresql` this can also be used instead of the connection info parameters.
+ # If you're using `postgresql` this can also be used instead of the
+ # connection info parameters.
#
# radius_db = "dbname=radius host=localhost user=radius password=radpass"
#
- # NOTE: Postgreql doesn't take `tls{}` options in its module config like mysql does,
- # if you want to use SSL connections then use this form of connection info parameter.
+ # NOTE: Postgreql doesn't take `tls{}` options in its module config
+ # like mysql does, if you want to use SSL connections then use this
+ # form of connection info parameter.
#
# radius_db = "host=localhost port=5432 dbname=radius user=radius password=raddpass sslmode=verify-full sslcert=/etc/ssl/client.crt sslkey=/etc/ssl/client.key sslrootcert=/etc/ssl/ca.crt"
# acct_table2:: Table for "stop" records
#
- # If you want both stop and start records logged to the same SQL table, leave this as is.
- # If you want them in different tables, put the start table in `acct_table1` and stop
- # table in `acct_table2`.
+ # If you want both stop and start records logged to the same SQL
+ # table, leave this as is. If you want them in different tables, put
+ # the start table in `acct_table1` and stop table in `acct_table2`.
#
acct_table1 = "radacct"
acct_table2 = "radacct"
#
# read_groups:: Read the groups from the database.
#
- # If set to `yes`, we read the group tables unless `Fall-Through = no` in the reply table.
- # If set to `no`, we do not read the group tables unless `Fall-Through = yes` in the
- # reply table.
+ # If set to `yes`, we read the group tables unless `Fall-Through =
+ # no` in the reply table. If set to `no`, we do not read the group
+ # tables unless `Fall-Through = yes` in the reply table.
#
# Default is `yes`.
#
# read_groups = yes
#
- # read_profiles:: Read the user profile attributes from the database.
+ # read_profiles:: Read the user profile attributes from the
+ # database.
#
- # Following `check` and `reply` item handling and, depending on the `read_groups` option
- # and `Fall-Through` value, groups processing, the SQL module will treat values of the
- # `User-Profile` attributes in the control list as additional groups that the user belongs
- # to and repeat the group `check` and `reply` processing.
+ # Following `check` and `reply` item handling and, depending on the
+ # `read_groups` option and `Fall-Through` value, groups processing,
+ # the SQL module will treat values of the `User-Profile` attributes
+ # in the control list as additional groups that the user belongs to
+ # and repeat the group `check` and `reply` processing.
#
- # If set to `yes`, we process the user profiles unless `Fall-Through = no` in the reply list.
- # If set to `no`, we do not process the user profiles unless `Fall-Through = yes` in the reply list.
+ # If set to `yes`, we process the user profiles unless `Fall-Through
+ # = no` in the reply list. If set to `no`, we do not process the
+ # user profiles unless `Fall-Through = yes` in the reply list.
#
# Default is `yes`.
# read_profiles = yes
#
# logfile:: Write SQL queries to a logfile.
#
- # This is potentially useful for tracing issues with authorization queries.
- # See also `logfile` directives in `mods-config/sql/main/*/queries.conf`.
- # You can enable per-section logging by enabling `logfile` there, or global logging by
- # enabling `logfile` here.
+ # This is potentially useful for tracing issues with authorization
+ # queries. See also `logfile` directives in
+ # `mods-config/sql/main/*/queries.conf`. You can enable per-section
+ # logging by enabling `logfile` there, or global logging by enabling
+ # `logfile` here.
#
# Per-section logging can be disabled by setting "logfile = ''"
#
# logfile = ${logdir}/sqllog.sql
#
- # query_timeout:: Set the maximum query duration for `cassandra` and `unixodbc`
+ # query_timeout:: Set the maximum query duration for `cassandra` and
+ # `unixodbc`
#
# query_timeout = 5
#
# pool { ... }::
#
- # The connection pool is a set of per-thread parameters for connections to the SQL database.
+ # The connection pool is a set of per-thread parameters for
+ # connections to the SQL database.
#
- # If the driver supports it, then queries are run asynchronously. Currently the list of
- # drivers this applies to is:
+ # If the driver supports it, then queries are run asynchronously.
+ # Currently the list of drivers this applies to is:
#
# * mysql
# * postgresql
# * oracle
# * cassandra
#
- # Other drivers are synchronous and therefore queries will block packet processing, resulting
- # in significantly worse system performance.
+ # Other drivers are synchronous and therefore queries will block
+ # packet processing, resulting in significantly worse system
+ # performance.
#
pool {
#
#
# max:: Maximum number of connections.
#
- # If these connections are all in use and a new one
- # is requested, the request will NOT get a connection.
+ # If these connections are all in use and a new one is requested,
+ # the request will NOT get a connection.
#
# Since the majority of SQL drivers only allow one outstanding
# query per connection, this represents the maximum number of
# simultaneous packets that a thread can process.
#
- # NOTE: The maximum number of connections from FreeRADIUS to
- # the database will be this number multiplied by the number of
- # worker threads. Ensure that the database server supports that
- # number of connections.
+ # NOTE: The maximum number of connections from FreeRADIUS to the
+ # database will be this number multiplied by the number of worker
+ # threads. Ensure that the database server supports that number of
+ # connections.
#
max = 100
#
# open_delay:: Open delay (in seconds).
#
- # How long must we be above the target utilisation for connections to be opened.
+ # How long must we be above the target utilisation for connections
+ # to be opened.
# open_delay = 0.2
#
# close_delay:: Close delay (in seconds).
#
- # How long we must be below the target utilisation for connections to be closed
+ # How long we must be below the target utilisation for connections
+ # to be closed
#
# close_delay = 10
#
connection {
#
- # connect_timeout:: How long to wait
- # before giving up on a connection which is
- # being opened.
+ # connect_timeout:: How long to wait before giving up on a
+ # connection which is being opened.
#
connect_timeout = 3.0
#
- # reconnect_delay:: If opening a connection
- # fails, or an open connection fails,
- # we wait `reconnect_delay` seconds before
+ # reconnect_delay:: If opening a connection fails, or an open
+ # connection fails, we wait `reconnect_delay` seconds before
# attempting to open another connection.
#
reconnect_delay = 5
}
#
- # request:: Options specific to requests handled by this connection pool
+ # request:: Options specific to requests handled by this connection
+ # pool
#
- # NOTE: Due to the one outstanding query per connection limit, the settings
- # `per_connection_max` and `per_connection_target` are forcibly set to 1 for
- # SQL database connections.
+ # NOTE: Due to the one outstanding query per connection limit, the
+ # settings `per_connection_max` and `per_connection_target` are
+ # forcibly set to 1 for SQL database connections.
#
request {
#
- # free_delay:: How long must a request in the unassigned (free) list not have been
- # used for before it's cleaned up and actually freed.
+ # free_delay:: How long must a request in the unassigned (free)
+ # list not have been used for before it's cleaned up and actually
+ # freed.
#
- # Unassigned requests can be re-used, multiple times, reducing memory allocation
- # and freeing overheads.
+ # Unassigned requests can be re-used, multiple times, reducing
+ # memory allocation and freeing overheads.
#
# free_delay = 10
}
}
#
- # group_attribute:: The group attribute specific to this instance of `rlm_sql`.
+ # group_attribute:: The group attribute specific to this instance of
+ # `rlm_sql`.
#
- # The "group_membership_query" is used to select which groups the user is a member of.
+ # The "group_membership_query" is used to select which groups the
+ # user is a member of.
#
- # The module loops over all groups, and places the group name into the "group_attribute".
+ # The module loops over all groups, and places the group name into
+ # the "group_attribute".
#
- # The group attribute is used in the "authorize_group_check_query" and "authorize_group_check_query"
- # to select entries which match that particular group.
+ # The group attribute is used in the "authorize_group_check_query"
+ # and "authorize_group_check_query" to select entries which match
+ # that particular group.
#
- # After all groups in SQL have been run, the module looks for `control.User-Profile`, and runs
- # those profiles for "authorize_group_check_query" and "authorize_group_check_query". i.e. a user
- # profile is essentially a group.
+ # After all groups in SQL have been run, the module looks for
+ # `control.User-Profile`, and runs those profiles for
+ # "authorize_group_check_query" and "authorize_group_check_query".
+ # i.e. a user profile is essentially a group.
#
- # These group queries can also update `control.User-Profile`, which lets you have a group
- # create a "fall through" to a DEFAULT group. However, these groups are _not_ cross-checked against
- # each other. So it is possible to create loops, which is highly not recommended.
+ # These group queries can also update `control.User-Profile`, which
+ # lets you have a group create a "fall through" to a DEFAULT group.
+ # However, these groups are _not_ cross-checked against each other.
+ # So it is possible to create loops, which is highly not
+ # recommended.
#
- # If caching is enabled, then the module is done looping over groups, the module adds the names of
- # groups to the `control` list. The "group_attribute" can then be used to check group membership.
- # That check will be done internally, and will not result in a database lookup. This also means that
- # it is now possible to do group comparisons based on regular expressions.
+ # If caching is enabled, then the module is done looping over
+ # groups, the module adds the names of groups to the `control` list.
+ # The "group_attribute" can then be used to check group membership.
+ # That check will be done internally, and will not result in a
+ # database lookup. This also means that it is now possible to do
+ # group comparisons based on regular expressions.
#
- # It is possible to force a dynamic group lookup via the expansion `%sql.group(foo)`. This
- # expansion returns `true` if the user is a member of that SQL group, and `false` otherwise.
+ # It is possible to force a dynamic group lookup via the expansion
+ # `%sql.group(foo)`. This expansion returns `true` if the user is a
+ # member of that SQL group, and `false` otherwise.
#
- # NOTE: The `SQL-Group` attribute is only available after the SQL module has been run.
+ # NOTE: The `SQL-Group` attribute is only available after the SQL
+ # module has been run.
#
- # The name of the group attribute is automatically determined from the module name. By default, the
- # name is `SQL-Group`. if the module is an instance such as `sql sql1 { ... }`, then the name of the
- # group attribute is `SQL1-Group`.
+ # The name of the group attribute is automatically determined from
+ # the module name. By default, the name is `SQL-Group`. if the
+ # module is an instance such as `sql sql1 { ... }`, then the name of
+ # the group attribute is `SQL1-Group`.
#
group_attribute = "${.:instance}-Group"
#
# cache_groups:: whether or not we cache the list of SQL groups
#
- # The groups are cached in the `control` list. So any comparisons must be done as
- # `control.SQL-Group = ...`
+ # The groups are cached in the `control` list. So any comparisons
+ # must be done as `control.SQL-Group = ...`
#
# Default is `no`.
#
# cache_groups = no
#
- # query_number_attribute:: An attribute to write the successful query number to.
+ # query_number_attribute:: An attribute to write the successful
+ # query number to.
#
- # When calling the `sql` module in a section such as `accounting` where there are a list of queries to
- # try, and success is determined by a query modifying one or more records, this option can be used to
- # record which query succeeded.
+ # When calling the `sql` module in a section such as `accounting`
+ # where there are a list of queries to try, and success is
+ # determined by a query modifying one or more records, this option
+ # can be used to record which query succeeded.
#
- # The attribute named here will be populated in the `control` list with the number of the query
- # which succeeded.
+ # The attribute named here will be populated in the `control` list
+ # with the number of the query which succeeded.
#
- # If, as is the case with the default Interim-Update queries, the first query is an `UPDATE` and the
- # second is an `INSERT`, this can be used to determine if calling the module resulted in a new record
- # being written or an existing one being updated. I.e. if the `UPDATE` succeeds, the attribute will be
- # populated with 1, whereas if the `INSERT` succeeds, the attribute will be populated with 2.
+ # If, as is the case with the default Interim-Update queries, the
+ # first query is an `UPDATE` and the second is an `INSERT`, this can
+ # be used to determine if calling the module resulted in a new
+ # record being written or an existing one being updated. I.e. if the
+ # `UPDATE` succeeds, the attribute will be populated with 1, whereas
+ # if the `INSERT` succeeds, the attribute will be populated with 2.
#
# query_number_attribute = 'Query-Number'
#
# Database-specific queries.
#
- # Not all drivers ship with `query.conf` or `schema.sql` files. For those which don't,
- # please create them and contribute them back to the project.
+ # Not all drivers ship with `query.conf` or `schema.sql` files. For
+ # those which don't, please create them and contribute them back to
+ # the project.
#
$INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf
}
#
# = SQL Counter Module
#
-# The `sqlcounter` module provides a general framework to allow access
-# based on accumulated usage of a resource, such as total time online in
-# a given period, total data transferred in a given period, etc. This is
-# very useful in a _Prepaid Service_ situation, where a user has paid for
-# a finite amount of usage and should not be allowed to use more than
-# that service. Collection, monitoring, and replenishment of prepaid
-# services are beyond the scope of this module.
+# The `sqlcounter` module provides a general framework to allow
+# access based on accumulated usage of a resource, such as total time
+# online in a given period, total data transferred in a given period,
+# etc. This is very useful in a _Prepaid Service_ situation, where a
+# user has paid for a finite amount of usage and should not be
+# allowed to use more than that service. Collection, monitoring, and
+# replenishment of prepaid services are beyond the scope of this
+# module.
#
-# Rather than maintaining separate (`GDBM`) databases of accounting info
-# for each counter, this module uses the data stored in the `radacct` table
-# by the `sql` modules.
+# Rather than maintaining separate (`GDBM`) databases of accounting
+# info for each counter, this module uses the data stored in the
+# `radacct` table by the `sql` modules.
#
-# NOTE: This module *NEVER* does any database INSERTs or UPDATEs. It is totally
-# dependent on the SQL module to process `Accounting` packets.
+# NOTE: This module *NEVER* does any database INSERTs or UPDATEs. It
+# is totally dependent on the SQL module to process `Accounting`
+# packets.
#
#
# sqlcounter <name> {
# ```
#
-# sql_module_instance:: Holds the instance of the `sql` module to use when
-# querying the SQL database.
+# sql_module_instance:: Holds the instance of the `sql` module to use
+# when querying the SQL database.
#
-# NOTE: Normally it is just `sql`. If you define more and one SQL module instance
-# (usually for failover situations), you can specify which module has access to
-# the Accounting Data (`radacct table`).
+# NOTE: Normally it is just `sql`. If you define more and one SQL
+# module instance (usually for failover situations), you can specify
+# which module has access to the Accounting Data (`radacct table`).
#
# ```
# sql_module_instance = sql_foo
#
# reset = 12h
#
-# key:: Specifies the unique identifier for the counter records (usually `User-Name`).
+# key:: Specifies the unique identifier for the counter records
+# (usually `User-Name`).
#
-# The `query` parameter specifies the SQL query used to get the current Counter value
-# from the database.
+# The `query` parameter specifies the SQL query used to get the
+# current Counter value from the database.
#
# ```
# key = "%{Stripped-User-Name || User-Name}"
# ```
#
-# reset_period_start_name:: The name of the attribute which is used to store the
-# time that the current reset period started.
+# reset_period_start_name:: The name of the attribute which is used
+# to store the time that the current reset period started.
#
# The default is `control.${.:instance}-Reset-Start`
#
-# Note because we are counting seconds, this attribute is of type `uint64`, and not `date`.
+# Note because we are counting seconds, this attribute is of type
+# `uint64`, and not `date`.
#
-# reset_period_end_name:: The name of the attribute which is used to store the
-# time that the current reset period will end.
+# reset_period_end_name:: The name of the attribute which is used to
+# store the time that the current reset period will end.
#
# The default is `control.${.:instance}-Reset-End`
#
-# Note because we are counting seconds, this attribute is of type `uint64`, and not `date`.
+# Note because we are counting seconds, this attribute is of type
+# `uint64`, and not `date`.
#
-# counter_name:: Name of the attribute to add to the `control` list with the current
-# value of the counter.
+# counter_name:: Name of the attribute to add to the `control` list
+# with the current value of the counter.
#
-# After the sqlcounter module has run, the counter attribute will exist.
+# After the sqlcounter module has run, the counter attribute will
+# exist.
#
# if (control.Daily-Session-Time > 3600) {
# Reply-Message := "You've used up more than one hour today"
# reject
# }
#
-# check_name:: Name of the attribute containing the limit to compare the counter to.
+# check_name:: Name of the attribute containing the limit to compare
+# the counter to.
#
-# reply_name:: Name of the attribute to populate with the remaining session time.
-# e.g. `reply.Session-Timeout`. If the attribute already exists and contains
-# a lower value, then it will not be updated.
+# reply_name:: Name of the attribute to populate with the remaining
+# session time. e.g. `reply.Session-Timeout`. If the attribute
+# already exists and contains a lower value, then it will not be
+# updated.
#
-# reply_message_name:: Name of the attribute into which a message should be placed
-# if the limit has been exceeded for the counter.
+# reply_message_name:: Name of the attribute into which a message
+# should be placed if the limit has been exceeded for the counter.
#
-# auto_extend:: If set to `yes` and the remaining session time goes past the time for
-# the next counter reset, the value in the `reply_name` attribute will be set to
-# the time to the next reset plus the value of the `check_name` attribute.
-# This is most useful if the limit is a time based one, and, for example,
-# `Session-Timeout` is the `reply_name` attribute. If there is sufficient allocation
-# left for the session to get to the next counter period, the user will not have
-# to re-authenticate before they have used their allocation for the next counter period.
+# auto_extend:: If set to `yes` and the remaining session time goes
+# past the time for the next counter reset, the value in the
+# `reply_name` attribute will be set to the time to the next reset
+# plus the value of the `check_name` attribute. This is most useful
+# if the limit is a time based one, and, for example,
+# `Session-Timeout` is the `reply_name` attribute. If there is
+# sufficient allocation left for the session to get to the next
+# counter period, the user will not have to re-authenticate before
+# they have used their allocation for the next counter period.
#
# utc:: Use UTC for calculating the period start and end values.
#
# === Expire on login
#
-# Set an account to expire T seconds after first login. Requires the `Expire-After`
-# attribute to be set, in seconds.
+# Set an account to expire T seconds after first login. Requires the
+# `Expire-After` attribute to be set, in seconds.
#
-# NOTE: You may need to edit `dictionary` to add the `Expire-After` attribute.
+# NOTE: You may need to edit `dictionary` to add the `Expire-After`
+# attribute.
#
sqlcounter expire_on_login {
sql_module_instance = sql
#
# = SQL-IP-Pool Module
#
-# The module `sqlippool` provide configuration for the SQL based IP Pool module.
+# The module `sqlippool` provide configuration for the SQL based IP
+# Pool module.
#
-# NOTE: The database schemas are available at `sql/ippool/<DB>/schema.sql`.
+# NOTE: The database schemas are available at
+# `sql/ippool/<DB>/schema.sql`.
#
# == Configuration Settings
#
sqlippool {
#
- # sql_module_instance:: SQL instance to use (from `mods-available/sql`)
+ # sql_module_instance:: SQL instance to use (from
+ # `mods-available/sql`)
#
- # If you have multiple sql instances, such as `sql sql1 {...}`,
- # use the *instance* name here: `sql1`.
+ # If you have multiple sql instances, such as `sql sql1 {...}`, use
+ # the *instance* name here: `sql1`.
#
sql_module_instance = "sql"
#
- # dialect:: This is duplicative of info available in the SQL module, but
- # we have to list it here as we do not yet support nested
+ # dialect:: This is duplicative of info available in the SQL module,
+ # but we have to list it here as we do not yet support nested
# reference expansions.
#
dialect = "mysql"
pool_name = control.IP-Pool.Name
#
- # allocated_address_attr:: List and attribute where the allocated address is written to.
+ # allocated_address_attr:: List and attribute where the allocated
+ # address is written to.
#
# [NOTE]
# ====
- # It MUST be a qualified name of an attribute of a type which contains IP addresses.
+ # It MUST be a qualified name of an attribute of a type which
+ # contains IP addresses.
#
# e.g. `ipaddr`, `ipv4prefix,` `ipv6addr`, or `ipv6prefix`.
# ====
# IP address) to be applied, the owner specified in the incoming
# packet must match the owner recorded for the lease.
#
- # For purposes such as IP assignment using a RADIUS Framed-IP-Address
- # attribute the "owner" identifier could be a `User-Name` or a
- # certificate serial number provided that the number of sessions is
- # limited to one per user/serial.
+ # For purposes such as IP assignment using a RADIUS
+ # Framed-IP-Address attribute the "owner" identifier could be a
+ # `User-Name` or a certificate serial number provided that the
+ # number of sessions is limited to one per user/serial.
#
# For RADIUS the owner will likely be specified by:
#
#
# On a hostile network the owner SHOULD include a component that you
# trust, arranged such that the overall value cannot be spoofed by
- # manipulation of the user-controlled data (i.e. the mac or identifier)
- # provided by the user's device.
+ # manipulation of the user-controlled data (i.e. the mac or
+ # identifier) provided by the user's device.
#
- # For example it might be that the value `Vendor-Specific.ADSL-Forum.Agent-Circuit-ID` is
- # considered trusted as it's set by a controlled device at the edge of
- # the network. Calling-Station-Id however, is usually provided by
- # the user's device so may be spoofed.
+ # For example it might be that the value
+ # `Vendor-Specific.ADSL-Forum.Agent-Circuit-ID` is considered
+ # trusted as it's set by a controlled device at the edge of the
+ # network. Calling-Station-Id however, is usually provided by the
+ # user's device so may be spoofed.
#
# In order to prevent an attacker releasing DHCP leases for another
# device on the network, the owner string should be constructed so
# that it contains both the trusted and untrusted attributes, or if
# the trusted attribute is sufficiently stable and unique, only the
- # trusted attribute.
- # One example would be `%{Vendor-Specific.ADSL-Forum.Agent-Circuit-ID}.%{Calling-Station-Id}`.`
+ # trusted attribute. One example would be
+ # `%{Vendor-Specific.ADSL-Forum.Agent-Circuit-ID}.%{Calling-Station-Id}`.`
#
owner = "%{Calling-Station-ID}"
#
# requested_address:: The IP address being renewed or released.
#
- # For RADIUS the requested_address will almost always be `%{Framed-IP-Address}`.
+ # For RADIUS the requested_address will almost always be
+ # `%{Framed-IP-Address}`.
#
# For DHCPv4 the requested_address will almost always be
# `%{Requested-IP-Address || Client-IP-Address}`.
#
# For RADIUS, this device is recorded so that if an Accounting-On or
# Accounting-Off packet is received, then all leases associated with
- # the gateway can be released. 'gateway' in this context is synonymous
- # with the NAS the user is connected to.
+ # the gateway can be released. 'gateway' in this context is
+ # synonymous with the NAS the user is connected to.
#
- # For DHCPv4, this device is recorded so that we can respond correctly
- # to lease queries.
+ # For DHCPv4, this device is recorded so that we can respond
+ # correctly to lease queries.
#
gateway = "%{NAS-Identifier || NAS-IP-Address}"
# When listed in a `recv Status-Server` section, it will add global
# server statistics to the packet.
#
-# See `dictionary.freeradius`, and the `FreeRADIUS-Stats4` attributes,
-# for a list of which attributes it adds.
+# See `dictionary.freeradius`, and the `FreeRADIUS-Stats4`
+# attributes, for a list of which attributes it adds.
#
#
transport = tcp
#
- # max_attributes:: Maximum number of attributes to decode in response.
+ # max_attributes:: Maximum number of attributes to decode in
+ # response.
#
# Default is 255.
#
# type:: List of allowed packet types.
#
# There is currently no way to change the packet type in the
- # request. See `unlang` fork for that functionality.
+ # request. See `unlang` fork for that functionality.
#
type = Accounting-Request
#
- # response_window:: If we do not receive a reply within this time period, then
- # start `zombie_period`
+ # response_window:: If we do not receive a reply within this time
+ # period, then start `zombie_period`
#
response_window = 15
# zombie_period:: If the home server does not reply to a packet, the
# `zombie_period` starts.
#
- # The connection is marked `zombie`, and isn't used to send new packets.
- # If there are no responses within `zombie_period`, the server either
- # closes the connection (no `status_check` subsection), or starts pinging the
- # home server (`status_check.type = Status-Server`).
+ # The connection is marked `zombie`, and isn't used to send new
+ # packets. If there are no responses within `zombie_period`, the
+ # server either closes the connection (no `status_check`
+ # subsection), or starts pinging the home server (`status_check.type
+ # = Status-Server`).
#
zombie_period = 10
#
- # revive_interval:: If there are no status checks, mark the
- # home server alive after `revive_interval` timeout.
+ # revive_interval:: If there are no status checks, mark the home
+ # server alive after `revive_interval` timeout.
#
# Some home servers do not support status checks via the
- # `Status-Server` packet. Others may not have a "test" user
- # configured that can be used to query the server, to see if
- # it is alive. For those servers, we have NO WAY of knowing
- # when it becomes alive again. Therefore, after the server
- # has been marked dead, we wait a period of time, and mark
- # it alive again, in the hope that it has come back to
- # life.
+ # `Status-Server` packet. Others may not have a "test" user
+ # configured that can be used to query the server, to see if it is
+ # alive. For those servers, we have NO WAY of knowing when it
+ # becomes alive again. Therefore, after the server has been marked
+ # dead, we wait a period of time, and mark it alive again, in the
+ # hope that it has come back to life.
#
- # If it has NOT come back to life, then the module will wait
- # for `zombie_period` before marking it dead again. During
- # the `zombie_period`, ALL AUTHENTICATIONS WILL FAIL, because
- # the home server is still dead. There is NOTHING that can
- # be done about this, other than to enable the status checks,
- # as documented above.
+ # If it has NOT come back to life, then the module will wait for
+ # `zombie_period` before marking it dead again. During the
+ # `zombie_period`, ALL AUTHENTICATIONS WILL FAIL, because the home
+ # server is still dead. There is NOTHING that can be done about
+ # this, other than to enable the status checks, as documented above.
#
- # e.g. if `zombie_period` is 40 seconds, and `revive_interval`
- # is 300 seconds, the for 40 seconds out of every 340, or about
- # 10% of the time, all authentications will fail.
+ # e.g. if `zombie_period` is 40 seconds, and `revive_interval` is
+ # 300 seconds, the for 40 seconds out of every 340, or about 10% of
+ # the time, all authentications will fail.
#
- # If the `zombie_period` and `revive_interval` configurations
- # are set smaller, than it is possible for up to 50% of
- # authentications to fail.
+ # If the `zombie_period` and `revive_interval` configurations are
+ # set smaller, than it is possible for up to 50% of authentications
+ # to fail.
#
- # As a result, we recommend enabling status checks, and
- # we do NOT recommend using `revive_interval`.
+ # As a result, we recommend enabling status checks, and we do NOT
+ # recommend using `revive_interval`.
#
# The `revive_interval` configuration is used ONLY if the
- # `status_check` subsection is not used. Otherwise,
+ # `status_check` subsection is not used. Otherwise,
# `revive_interval` is not necessary, and should be deleted.
#
# Useful range of values: 10 to 3600
#
# == Connection trunking
#
- # Each worker thread (see tacacsd.conf, num_workers), has
- # it's own set of connections. These connections are grouped
- # together into a "pool".
+ # Each worker thread (see tacacsd.conf, num_workers), has it's own
+ # set of connections. These connections are grouped together into a
+ # "pool".
#
- # Much of the configuration here is similar to the old
- # connection "pool" configuration in v3. However, there are
- # more configuration parameters, and therefore more control
- # over the behavior.
+ # Much of the configuration here is similar to the old connection
+ # "pool" configuration in v3. However, there are more configuration
+ # parameters, and therefore more control over the behavior.
#
pool {
#
# start:: Connections to create during module instantiation.
#
- # If the server cannot create specified number of connections during instantiation
- # it will exit.
+ # If the server cannot create specified number of connections
+ # during instantiation it will exit.
#
- # Set to `0` to allow the server to start without the database being available.
+ # Set to `0` to allow the server to start without the database
+ # being available.
#
start = 0
#
# max:: Maximum number of connections.
#
- # If these connections are all in use and a new one is requested, the request
- # will NOT get a connection.
+ # If these connections are all in use and a new one is requested,
+ # the request will NOT get a connection.
#
max = 8
#
- # connecting:: Maximum number of sockets to have in the "connecting" state.
+ # connecting:: Maximum number of sockets to have in the
+ # "connecting" state.
#
- # If a home server goes down, the module will close
- # old / broken connections, and try to open new ones.
- # In order to avoid flooding the home server with
- # connection attempts, set the `connecting` value to
- # a small number.
+ # If a home server goes down, the module will close old / broken
+ # connections, and try to open new ones. In order to avoid flooding
+ # the home server with connection attempts, set the `connecting`
+ # value to a small number.
#
connecting = 1
#
# uses:: number of packets which will use the connection.
#
- # After `uses` packets have been sent the connection
- # will be closed, and a new one opened. For no
- # limits, set `uses = 0`.
+ # After `uses` packets have been sent the connection will be
+ # closed, and a new one opened. For no limits, set `uses = 0`.
#
uses = 0
#
# lifetime:: lifetime of a connection, in seconds.
#
- # After `lifetime` seconds have passed, no new
- # packets will be sent on the connection. When all
- # replies have been received, the connection will be
- # closed.
+ # After `lifetime` seconds have passed, no new packets will be sent
+ # on the connection. When all replies have been received, the
+ # connection will be closed.
#
# For no limits, set `lifetime = 0`.
#
- # It is possible to use precise times, such as
- # `lifetime = 1.023`, or even qualifiers such as
- # `lifetime = 400ms`.
+ # It is possible to use precise times, such as `lifetime = 1.023`,
+ # or even qualifiers such as `lifetime = 400ms`.
#
lifetime = 0
#
- # open_delay:: How long (in seconds) a connection
- # must be above `per_connection_target` before a new
- # connection is opened.
+ # open_delay:: How long (in seconds) a connection must be above
+ # `per_connection_target` before a new connection is opened.
#
- # Parsing of this field is the same as for
- # `lifetime`.
+ # Parsing of this field is the same as for `lifetime`.
#
open_delay = 0.2
#
- # close_delay:: How long (in seconds) a connection
- # must be below `per_connection_target` before a
- # connection is closed.
+ # close_delay:: How long (in seconds) a connection must be below
+ # `per_connection_target` before a connection is closed.
#
close_delay = 1.0
#
- # manage_interval:: How often (in seconds) the
- # connections are checked for limits, in order to
- # open / close connections.
+ # manage_interval:: How often (in seconds) the connections are
+ # checked for limits, in order to open / close connections.
#
manage_interval = 0.2
#
connection {
#
- # connect_timeout:: How long to wait
- # before giving up on a connection which is
- # being opened.
+ # connect_timeout:: How long to wait before giving up on a
+ # connection which is being opened.
#
connect_timeout = 3.0
#
- # reconnect_delay:: If opening a connection
- # fails, or an open connection fails,
- # we wait `reconnect_delay` seconds before
- # attempting to open another
- # connection.
+ # reconnect_delay:: If opening a connection fails, or an open
+ # connection fails, we wait `reconnect_delay` seconds before
+ # attempting to open another connection.
#
reconnect_delay = 5
}
#
request {
#
- # per_connection_max:: The maximum number of requests
- # which are "live" on a particular connection.
+ # per_connection_max:: The maximum number of requests which are
+ # "live" on a particular connection.
#
per_connection_max = 255
#
- # per_connection_target:: The target number
- # of requests which are "live" on a
- # particular connection.
+ # per_connection_target:: The target number of requests which are
+ # "live" on a particular connection.
#
- # There can be a balance between overloading
- # a connection, and under-utilizing it. The
- # default is to fill each connection before
- # opening a new one.
+ # There can be a balance between overloading a connection, and
+ # under-utilizing it. The default is to fill each connection
+ # before opening a new one.
#
per_connection_target = 255
#
- # free_delay:: How long to wait before
- # freeing internal resources associated with
- # the connection.
+ # free_delay:: How long to wait before freeing internal resources
+ # associated with the connection.
#
free_delay = 10
}
# interface = eth0
#
- # max_packet_size:: Our max packet size. may be different from the parent.
+ # max_packet_size:: Our max packet size. may be different from the
+ # parent.
#
# max_packet_size = 4096
#
# = Time-based One-Time Passwords (TOTP)
#
-# Defined in `RFC6238`, and used in Google Authenticator, among others.
+# Defined in `RFC6238`, and used in Google Authenticator, among
+# others.
#
# This module can only be used in the "authenticate" section.
#
#
# `control.TOTP.Key`
#
-# If `TOTP.Key` exists, then it will be used instead of `TOTP.Secret`.
+# If `TOTP.Key` exists, then it will be used instead of
+# `TOTP.Secret`.
#
# The TOTP password entered by the user should be placed into:
#
# `request.TOTP.From-User`
#
-# The module will return `ok` if the passwords match, and `fail`
-# if the passwords do not match.
+# The module will return `ok` if the passwords match, and `fail` if
+# the passwords do not match.
#
-# NOTE: The crypto algorithms are HmacSHA1, HmacSHA256 and HmacSHA512.
+# NOTE: The crypto algorithms are HmacSHA1, HmacSHA256 and
+# HmacSHA512.
#
# NOTE: This module will *NOT* interact with Google. The module is
# intended to be used where the local administrator knows the TOTP
otp_length = 6
#
- # lookback_steps:: How many steps backward in time we look for a matching OTP.
+ # lookback_steps:: How many steps backward in time we look for a
+ # matching OTP.
#
lookback_steps = 1
#
- # lookforward_steps:: How many steps forward in time we look for a matching OTP.
+ # lookforward_steps:: How many steps forward in time we look for a
+ # matching OTP.
#
lookforward_steps = 0
#
# time_offset:: A time offset to use from the current time.
#
- # Some tokens get severely out of sync with local time. It is
- # possible to offset the definition of "now" for one token by setting
- # this to an attribute containing the offset.
+ # Some tokens get severely out of sync with local time. It is
+ # possible to offset the definition of "now" for one token by
+ # setting this to an attribute containing the offset.
#
# time_offset = 0
}
#
# = Unbound Module
#
-# The `unbound` module performs queries against a DNS service to allow
-# FQDNs to be resolved during request processing.
+# The `unbound` module performs queries against a DNS service to
+# allow FQDNs to be resolved during request processing.
#
# The module is primarily intended for use by other modules through
# internal APIs, and so, instances should be initialized earlier than
-# those modules which use them. Each instance does also provide some
+# those modules which use them. Each instance does also provide some
# functions for general use and for troubleshooting.
#
# == Caveats
#
-# There is a potential for a FreeRADIUS server using rlm_unbound to either
-# fail to terminate cleanly (leaving zombie processes, failing to clean up
-# other modules, and hanging after a SIGTERM until a SIGKILL is sent) or
-# to fail valgrind checks during termination when run with -m. Likewise this
-# problem will rely on upstream enhancements before it can be fixed, and the
-# exact behavior may change in interim releases of libunbound until then.
+# There is a potential for a FreeRADIUS server using rlm_unbound to
+# either fail to terminate cleanly (leaving zombie processes, failing
+# to clean up other modules, and hanging after a SIGTERM until a
+# SIGKILL is sent) or to fail valgrind checks during termination when
+# run with -m. Likewise this problem will rely on upstream
+# enhancements before it can be fixed, and the exact behavior may
+# change in interim releases of libunbound until then.
#
#
#
# Defaults to not set.
#
- # Without this set, unbound will query the root DNS servers.
- # This is NOT RECOMMENDED. A local caching DNS server will
- # substantially improve performance.
+ # Without this set, unbound will query the root DNS servers. This is
+ # NOT RECOMMENDED. A local caching DNS server will substantially
+ # improve performance.
#
# resolvconf = "/etc/resolv.conf"
#
# == Functions for DNS resolution
#
-# A function based on the instance name can be used to perform DNS lookups.
+# A function based on the instance name can be used to perform DNS
+# lookups.
#
# %dns(<owner>, <record type>[, <limit>])
#
# %dns('www.example.com', 'AAAA')
# ```
#
-# Given an instance `dns` the above function will perform `A` record and
-# `AAAA` record lookups on `www.example.com`.
+# Given an instance `dns` the above function will perform `A` record
+# and `AAAA` record lookups on `www.example.com`.
#
# .Example
#
# The above example will perform an `MX` lookup on `example.com`, and
# will return just the first result.
#
-# NOTE: The DNS queries are blocking! A slow (or unavailable) DNS
+# NOTE: The DNS queries are blocking! A slow (or unavailable) DNS
# server can completely destroy the performance of FreeRADIUS.
#
#
# Look for "shadow", and follow the instructions there.
#
-# NOTE: This password is usually in the `crypt` form, and is incompatible
-# with `CHAP`, `MS-CHAP`, `PEAP`, etc*.
+# NOTE: This password is usually in the `crypt` form, and is
+# incompatible with `CHAP`, `MS-CHAP`, `PEAP`, etc*.
#
# == Group Comparisons
#
-# The module also registers a Unix group expansion, where it is possible
-# to check if the user is a member of a particular Unix group.
+# The module also registers a Unix group expansion, where it is
+# possible to check if the user is a member of a particular Unix
+# group.
#
# ```
# if (%unix.group(admin)) { ...
# ```
#
-# The expansion returns `true` if the `User-Name` is a membber of the given
-# group, and `false` otherwise.
+# The expansion returns `true` if the `User-Name` is a membber of the
+# given group, and `false` otherwise.
#
-# The old `Unix-Group`, `Group`, and `Group-Name` attributes and comparisons
-# are no longer supported.
+# The old `Unix-Group`, `Group`, and `Group-Name` attributes and
+# comparisons are no longer supported.
#
-# All of `radutmp`, `radwho`, `radlast`, and `radzap` have been removed.
+# All of `radutmp`, `radwho`, `radlast`, and `radzap` have been
+# removed.
#
-# You can no longer have the `unix` module process accounting packets.
+# You can no longer have the `unix` module process accounting
+# packets.
#
#
# The `unpack` module unpacks binary data from octets type attributes
# into individual attributes.
#
-# It is used when vendors put multiple fields into one attribute
-# of type "octets".
+# It is used when vendors put multiple fields into one attribute of
+# type "octets".
#
# NOTE: The module is useful only for `xlat`.
#
#
# == Syntax
#
-# To use it, add it to the `mods-enabled/` directory. Then,
-# use it on the right-hand side of a variable assignment.
+# To use it, add it to the `mods-enabled/` directory. Then, use it on
+# the right-hand side of a variable assignment.
#
-# %unpack(<data>, <offset>, <data_type>[, <repeat>])
+# %unpack(<data>, <offset>, <data_type>[, <repeat>])
#
# The arguments are three or four fields:
#
# data::
#
-# Either `octets` or `string` type data, literal or expanded attributes.
-# If `string` type data contains a representation of hex data, e.g. 0xabcdef
-# that is first converted to `octets`.
+# Either `octets` or `string` type data, literal or expanded
+# attributes. If `string` type data contains a representation of hex
+# data, e.g. 0xabcdef that is first converted to `octets`.
#
# offset::
#
-# The offset into the string from which it starts unpacking. The offset starts
-# at zero, for the first attribute.
+# The offset into the string from which it starts unpacking. The
+# offset starts at zero, for the first attribute.
#
# data_type::
#
-# the data type to unpack at that offset. e.g. `integer`, `ipaddr`, `byte`, `short`, etc.
+# the data type to unpack at that offset. e.g. `integer`, `ipaddr`,
+# `byte`, `short`, etc.
#
# repeat::
#
-# How many instances of the data type should be unpacked. This optional argument
-# must either be an integer or the special value of `'*'` to extract as many instances
-# as can be from the input data.
+# How many instances of the data type should be unpacked. This
+# optional argument must either be an integer or the special value of
+# `'*'` to extract as many instances as can be from the input data.
#
# == Sample
#
# %unpack(%{Class}, 4, uint16)
#
-# will unpack octets `4` and `5` as a `uint16`, which has value `0x0304`.
+# will unpack octets `4` and `5` as a `uint16`, which has value
+# `0x0304`.
#
#
# An attribute of type "string" containing UTF-8 makes the module
# return `NOOP`.
#
-# An attribute of type "string" containing non-UTF-8 data makes
-# the module return `FAIL`.
+# An attribute of type "string" containing non-UTF-8 data makes the
+# module return `FAIL`.
#
# The module can be used as a simple check for non-conforming
-# packets. If the contents of the Access-Request packets are not
+# packets. If the contents of the Access-Request packets are not
# UTF-8, it's likely best to just reject the request.
#
# The `wimax` module implements the WiMAX attributes as defined in
# NWG_R1_V1.2.1-Stage-3.pdf
#
-# It should be listed in the `recv Access-Request` and `recv Accounting-Request` sections.
+# It should be listed in the `recv Access-Request` and `recv
+# Accounting-Request` sections.
#
# NOTE: The module will change the horrible binary version of
# `Calling-Station-Id` to the normal format, as specified in RFC
# In the `recv Access-Request section. the `wimax` module fixes up
# various non-standard WiMAX issues.
#
-# The WiMAX specification says that the `Calling-Station-Id`
-# is 6 octets of the MAC. This definition conflicts with RFC
-# 3580, and all common RADIUS practices. Uncommenting the
-# `wimax` module here allows the module to change the
-# `Calling-Station-Id` attribute to the normal format as
-# specified in RFC 3580 Section 3.21.
+# The WiMAX specification says that the `Calling-Station-Id` is 6
+# octets of the MAC. This definition conflicts with RFC 3580, and all
+# common RADIUS practices. Uncommenting the `wimax` module here
+# allows the module to change the `Calling-Station-Id` attribute to
+# the normal format as specified in RFC 3580 Section 3.21.
#
# ```
# recv Access-Request {
#
# == send Access-Accept
#
-# In order to calculate the various WiMAX keys, the module should
-# be listed in the `send Access-Accept` section. If EAP authentication
-# has been used, AND the EAP method derives MSK and EMSK, then
-# the various WiMAX keys can be calculated.
+# In order to calculate the various WiMAX keys, the module should be
+# listed in the `send Access-Accept` section. If EAP authentication
+# has been used, AND the EAP method derives MSK and EMSK, then the
+# various WiMAX keys can be calculated.
#
# ```
# send Access-Accept {
#
# MN-NAI:: Mobile node NAI.
#
-# You have to create it, and put it into the request or reply as something like:
+# You have to create it, and put it into the request or reply as
+# something like:
#
# ```
# WiMAX-MN-NAI = User-Name
# ```
#
-# You will also have to have the appropriate IP address (`v4` or `v6`)
-# in order to calculate the keys below.
+# You will also have to have the appropriate IP address (`v4` or
+# `v6`) in order to calculate the keys below.
#
-# Lifetimes are derived from `Session-Timeout`. It needs to be set
-# to some useful number.
+# Lifetimes are derived from `Session-Timeout`. It needs to be set to
+# some useful number.
#
# NOTE: The hash function below `H()` is `HMAC-SHA1`.
#
#
# Both with similar comments to above for `MN-HA-CMIP4`.
#
-# In order to tell which one to use (`CMIP4`, `PMIP4`, or `CMIP6`), you have to
-# set `WiMAX-IP-Technology` in the reply to one of the appropriate values.
+# In order to tell which one to use (`CMIP4`, `PMIP4`, or `CMIP6`),
+# you have to set `WiMAX-IP-Technology` in the reply to one of the
+# appropriate values.
#
# FA-RK = H(MIP-RK, "FA-RK")
# MN-FA = H(FA-RK, "MN FA" | FA-IP | MN-NAI)
#
-# Where does the `FA-IP` come from? No idea...
+# Where does the `FA-IP` come from? No idea...
#
-# The next two keys (`HA-RK` and `FA-HA`) are not generated for every authentication
-# request, but only on demand.
+# The next two keys (`HA-RK` and `FA-HA`) are not generated for every
+# authentication request, but only on demand.
#
-# `HA-RK` = 160-bit random number assigned by the AAA server to a specific HA.
+# `HA-RK` = 160-bit random number assigned by the AAA server to a
+# specific HA.
#
# `FA-HA` = H(HA-RK, "FA-HA" | HA-IPv4 | FA-CoAv4 | SPI)
#
# where `HA-IPv4` is as above.
#
-# and `FA-CoAv4` address of the `FA` as seen by the `HA`
-# and `SPI` is the relevant `SPI` for the `HA-RK`.
+# and `FA-CoAv4` address of the `FA` as seen by the `HA` and `SPI` is
+# the relevant `SPI` for the `HA-RK`.
#
-# `DHCP-RK` = 160-bit random number assigned by the AAA server to a specific DHCP server.
-# `vDHCP-RK` is the same thing.
+# `DHCP-RK` = 160-bit random number assigned by the AAA server to a
+# specific DHCP server. `vDHCP-RK` is the same thing.
#
#
#
# delete_mppe_keys::
#
- # Some WiMAX equipment requires that the `MS-MPPE-*-Key`
- # attributes are sent in the Access-Accept, in addition to
- # the `WiMAX-MSK` attribute.
+ # Some WiMAX equipment requires that the `MS-MPPE-*-Key` attributes
+ # are sent in the Access-Accept, in addition to the `WiMAX-MSK`
+ # attribute.
#
- # Other WiMAX equipment request that the `MS-MPPE-*-Key`
- # attributes are NOT sent in the `Access-Accept`.
+ # Other WiMAX equipment request that the `MS-MPPE-*-Key` attributes
+ # are NOT sent in the `Access-Accept`.
#
# By default, the EAP modules sends `MS-MPPE-*-Key` attributes.
#
- # The default virtual server (`sites-available/default`)
- # contains examples of adding the `WiMAX-MSK`.
+ # The default virtual server (`sites-available/default`) contains
+ # examples of adding the `WiMAX-MSK`.
#
- # This configuration option makes the WiMAX module delete
- # the `MS-MPPE-*-Key` attributes.
+ # This configuration option makes the WiMAX module delete the
+ # `MS-MPPE-*-Key` attributes.
#
- # If the keys are deleted (by setting this to `yes`), then
- # the `WiMAX-MSK` attribute is automatically added to the reply.
+ # If the keys are deleted (by setting this to `yes`), then the
+ # `WiMAX-MSK` attribute is automatically added to the reply.
#
# The default is to leave them in place.
#
#
# = Winbind
#
-# The `winbind` module authenticate PAP passwords against Microsoft Active
-# Directory or Samba, via the winbind API.
+# The `winbind` module authenticate PAP passwords against Microsoft
+# Active Directory or Samba, via the winbind API.
#
# This module is for PAP authentication (where plaintext passwords
# are sent in the `User-Password` attribute) only. For authenticating
#
# domain:: The windows domain.
#
- # While not required to be set, it is likely that authentication will fail
- # if it is not set correctly.
+ # While not required to be set, it is likely that authentication
+ # will fail if it is not set correctly.
#
- # This configuration option, as the username above, is also expanded before use.
+ # This configuration option, as the username above, is also expanded
+ # before use.
#
- # If unset then winbind will be queried for the correct value. If you
- # actually want it blank it should be explicitly set here.
+ # If unset then winbind will be queried for the correct value. If
+ # you actually want it blank it should be explicitly set here.
#
# domain = ""
#
# search_username:: AD username to search for group searches.
#
- # This should generally not include a realm, so `Stripped-User-Name`
- # is likely the best attribute if it exists.
+ # This should generally not include a realm, so
+ # `Stripped-User-Name` is likely the best attribute if it exists.
#
search_username = "%{Stripped-User-Name || User-Name}"
#
# add_domain:: Include the domain in group searches.
#
- # When this is enabled, winbind_domain is prepended to the
- # username (as `domain\username`) before searching. This is
- # generally required.
+ # When this is enabled, winbind_domain is prepended to the username
+ # (as `domain\username`) before searching. This is generally
+ # required.
#
# add_domain = yes
}
#
# reuse:: Maintain long-term connections to the windbind server.
#
- # Reusable connection handles are allocated in blocks. These
+ # Reusable connection handles are allocated in blocks. These
# parameters allow for tuning how that is done.
#
reuse {
#
- # min:: The minimum number of connection handles to
- # keep allocated
+ # min:: The minimum number of connection handles to keep allocated
#
# min = 10
#
- # max:: The maximum number of reusable connection
- # handles to allocate.
+ # max:: The maximum number of reusable connection handles to
+ # allocate.
#
# max = 100
#
- # cleanup_interval:: How often to free un-used
- # connection handles.
+ # cleanup_interval:: How often to free un-used connection handles.
#
# cleanup_interval = 30s
}
#
-# This query properly handles calls that span from the
-# previous reset period into the current period but
-# involves more work for the SQL server than those
-# below
+# This query properly handles calls that span from the previous reset
+# period into the current period but involves more work for the SQL
+# server than those below
#
query = "\
SELECT IFNULL(SUM(acctsessiontime - GREATEST((%{control.dailycounter-reset-start} - UNIX_TIMESTAMP(acctstarttime)), 0)), 0) \
AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%{control.dailycounter-reset-start}'"
#
-# This query ignores calls that started in a previous
-# reset period and continue into into this one. But it
-# is a little easier on the SQL server
+# This query ignores calls that started in a previous reset period
+# and continue into into this one. But it is a little easier on the
+# SQL server
#
#query = "\
# SELECT IFNULL(SUM(acctsessiontime), 0) \
# AND acctstarttime > FROM_UNIXTIME('%{control.dailycounter-reset-start}')"
#
-# This query is the same as above, but demonstrates an
-# additional counter parameter '%{control.dailycounter-reset-end}' which is the
+# This query is the same as above, but demonstrates an additional
+# counter parameter '%{control.dailycounter-reset-end}' which is the
# timestamp for the end of the period
#
#query = "\
#
-# This query properly handles calls that span from the
-# previous reset period into the current period but
-# involves more work for the SQL server than those
-# below
+# This query properly handles calls that span from the previous reset
+# period into the current period but involves more work for the SQL
+# server than those below
#
query = "\
SELECT IFNULL(SUM(acctsessiontime - GREATEST((%{control.monthlycounter-reset-start} - UNIX_TIMESTAMP(acctstarttime)), 0)), 0) \
AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%{control.monthlycounter-reset-start}'"
#
-# This query ignores calls that started in a previous
-# reset period and continue into into this one. But it
-# is a little easier on the SQL server
+# This query ignores calls that started in a previous reset period
+# and continue into into this one. But it is a little easier on the
+# SQL server
#
#query = "\
# SELECT IFNULL(SUM(acctsessiontime), 0) \
# AND acctstarttime > FROM_UNIXTIME('%{control.monthlycounter-reset-start}')"
#
-# This query is the same as above, but demonstrates an
-# additional counter parameter '%{control.monthlycounter-reset-end}' which is the
-# timestamp for the end of the period
+# This query is the same as above, but demonstrates an additional
+# counter parameter '%{control.monthlycounter-reset-end}' which is
+# the timestamp for the end of the period
#
#query = "\
# SELECT IFNULL(SUM(acctsessiontime), 0) \
#
-# This query properly handles calls that span from the
-# previous reset period into the current period but
-# involves more work for the SQL server than those
-# below
+# This query properly handles calls that span from the previous reset
+# period into the current period but involves more work for the SQL
+# server than those below
#
query = "\
SELECT COALESCE(SUM(AcctSessionTime - GREATEST((%{control.dailycounter-reset-start} - EXTRACT(epoch FROM AcctStartTime)), 0)), 0) \
AND EXTRACT(epoch FROM AcctStartTime) + AcctSessionTime > '%{control.dailycounter-reset-start}'"
#
-# This query ignores calls that started in a previous
-# reset period and continue into into this one. But it
-# is a little easier on the SQL server
+# This query ignores calls that started in a previous reset period
+# and continue into into this one. But it is a little easier on the
+# SQL server
#
#query = "\
# SELECT COALESCE(SUM(AcctSessionTime), 0) \
# AND EXTRACT(epoch FROM AcctStartTime) > '%{control.dailycounter-reset-start}'"
#
-# This query is the same as above, but demonstrates an
-# additional counter parameter '%{control.dailycounter-reset-end}' which is the
+# This query is the same as above, but demonstrates an additional
+# counter parameter '%{control.dailycounter-reset-end}' which is the
# timestamp for the end of the period
#
#query = "\
-# This query properly handles calls that span from the
-# previous reset period into the current period but
-# involves more work for the SQL server than those
-# below
+# This query properly handles calls that span from the previous reset
+# period into the current period but involves more work for the SQL
+# server than those below
query = "\
SELECT COALESCE(SUM(AcctSessionTime - GREATEST((%{control.monthlycounter-reset-start} - EXTRACT(epoch FROM AcctStartTime)), 0)), 0) \
FROM radacct \
AND EXTRACT(epoch FROM AcctStartTime) + AcctSessionTime > '%{control.monthlycounter-reset-start}'"
#
-# This query ignores calls that started in a previous
-# reset period and continue into into this one. But it
-# is a little easier on the SQL server
+# This query ignores calls that started in a previous reset period
+# and continue into into this one. But it is a little easier on the
+# SQL server
#
#query = "\
# SELECT COALESCE(SUM(AcctSessionTime), 0) \
# AND EXTRACT(epoch FROM AcctStartTime) > '%{control.monthlycounter-reset-start}'"
#
-# This query is the same as above, but demonstrates an
-# additional counter parameter '%{control.monthlycounter-reset-end}' which is the
-# timestamp for the end of the period
+# This query is the same as above, but demonstrates an additional
+# counter parameter '%{control.monthlycounter-reset-end}' which is
+# the timestamp for the end of the period
#
#query = "\
# SELECT COALESCE(SUM(AcctSessionTime), 0) \
#
-# This query properly handles calls that span from the
-# previous reset period into the current period but
-# involves more work for the SQL server than those
-# below
+# This query properly handles calls that span from the previous reset
+# period into the current period but involves more work for the SQL
+# server than those below
#
query = "\
SELECT IFNULL(SUM(acctsessiontime - MAX((%{control.dailycounter-reset-start} - strftime('%%s', acctstarttime)), 0)), 0) \
AND (strftime('%%s', acctstarttime) + acctsessiontime) > %{control.dailycounter-reset-start}"
#
-# This query ignores calls that started in a previous
-# reset period and continue into into this one. But it
-# is a little easier on the SQL server
+# This query ignores calls that started in a previous reset period
+# and continue into into this one. But it is a little easier on the
+# SQL server
#
#query = "\
# SELECT IFNULL(SUM(acctsessiontime), 0) \
# AND acctstarttime > %{control.dailycounter-reset-start}"
#
-# This query is the same as above, but demonstrates an
-# additional counter parameter '%{control.dailycounter-reset-end}' which is the
+# This query is the same as above, but demonstrates an additional
+# counter parameter '%{control.dailycounter-reset-end}' which is the
# timestamp for the end of the period
#
#query = "\
#
-# This query properly handles calls that span from the
-# previous reset period into the current period but
-# involves more work for the SQL server than those
-# below
+# This query properly handles calls that span from the previous reset
+# period into the current period but involves more work for the SQL
+# server than those below
#
query = "\
SELECT IFNULL(SUM(acctsessiontime - MAX((%{control.monthlycounter-reset-start} - strftime('%%s', acctstarttime)), 0)), 0) \
(strftime('%%s', acctstarttime) + acctsessiontime) > %{control.monthlycounter-reset-start}"
#
-# This query ignores calls that started in a previous
-# reset period and continue into into this one. But it
-# is a little easier on the SQL server
+# This query ignores calls that started in a previous reset period
+# and continue into into this one. But it is a little easier on the
+# SQL server
#
#query = "\
# SELECT IFNULL(SUM(acctsessiontime), 0) \
# AND acctstarttime > %{control.monthlycounter-reset-start}"
#
-# This query is the same as above, but demonstrates an
-# additional counter parameter '%{control.monthlycounter-reset-end}' which is the
-# timestamp for the end of the period
+# This query is the same as above, but demonstrates an additional
+# counter parameter '%{control.monthlycounter-reset-end}' which is
+# the timestamp for the end of the period
#
#query = "\
# SELECT IFNULL(SUM(acctsessiontime), 0) \
# -*- text -*-
#
-# cui/postgresql/queries.conf -- Queries to update a PostgreSQL CUI table.
+# cui/postgresql/queries.conf -- Queries to update a PostgreSQL CUI
+# table.
#
# $Id$
send {
access-accept {
# NOTE: Clause ON CONFLICT (aka upsert) was added in PostgreSQL 9.5.
- # If you're using an older version, you should upgrade, or use queries.conf
- # and schema.sql from FreeRADIUS 3.0.20 or older.
+ # If you're using an older version, you should upgrade, or use
+ # queries.conf and schema.sql from FreeRADIUS 3.0.20 or older.
query = "\
INSERT INTO ${...cui_table} \
(clientipaddress, callingstationid, username, cui) \
-# -*- text -*-
+# -*- text -*-
#
# ippool/firebird/queries.conf -- Firebird queries for rlm_sqlippool
#
skip_locked = "SKIP LOCKED"
#
-# RADIUS (Accounting-Start)
-# DHCPv4 (Discover)
+# RADIUS (Accounting-Start) DHCPv4 (Discover)
#
#
#
# Firebird is inherently transaction based, and each of the queries
# making up the allocation sequence are executed within a single
-# transaction - so there is no need to specifically start the transaction.
+# transaction - so there is no need to specifically start the
+# transaction.
#
alloc_begin = ""
#
-# This query attempts to re-allocate the most recent IP address
-# for the client
+# This query attempts to re-allocate the most recent IP address for
+# the client
alloc_existing = "\
UPDATE ${ippool_table} \
SET expiry_time = DATEADD(${offer_duration} SECOND TO CURRENT_TIMESTAMP), \
RETURNING address"
#
-# If the preceding query doesn't find an address the following one
-# is used for finding one from the pool
+# If the preceding query doesn't find an address the following one is
+# used for finding one from the pool
#
alloc_find = "\
UPDATE ${ippool_table} \
#
# This query marks the IP address handed out by "alloc_find" as used
-# for the period of "offer_duration" after which time it may be reused.
-# It is only needed if the SELECT query does not perform the update.
+# for the period of "offer_duration" after which time it may be
+# reused. It is only needed if the SELECT query does not perform the
+# update.
#
#alloc_update = "\
# UPDATE ${ippool_table} \
# AND pool_name = '%{${pool_name}}'"
#
-# The transaction used to execute the previous queries is automatically
-# committed when a successful allocation has happened - so there is
-# no requirement to call COMMIT.
+# The transaction used to execute the previous queries is
+# automatically committed when a successful allocation has happened -
+# so there is no requirement to call COMMIT.
#
alloc_commit = ""
#
-# If an IP could not be allocated, check to see whether the pool exists or not
-# This allows the module to differentiate between a full pool and no pool
-# NOTE: If you are not running redundant pool modules this query may be commented
-# out to save running this query every time an ip is not allocated.
+# If an IP could not be allocated, check to see whether the pool
+# exists or not This allows the module to differentiate between a
+# full pool and no pool NOTE: If you are not running redundant pool
+# modules this query may be commented out to save running this query
+# every time an ip is not allocated.
#
pool_check = "\
SELECT id \
FETCH FIRST ROW ONLY"
#
-# RADIUS (Interim-Update)
-# DHCPv4 (Request)
+# RADIUS (Interim-Update) DHCPv4 (Request)
#
#
-# Query used to clear any other addresses that have been offered to the client
+# Query used to clear any other addresses that have been offered to
+# the client
#
update_free = "\
UPDATE ${ippool_table} \
AND status_id IN (SELECT status_id FROM fr_ippool_status WHERE status = 'dynamic')"
#
-# Queries to update a lease.
-# This query must update a row when a lease is successfully requested -
-# queries that update no rows will result in a "notfound" response to
-# the module which by default will give a NAK reply. In this example
-# incrementing "counter" is used to achieve this.
+# Queries to update a lease. This query must update a row when a
+# lease is successfully requested - queries that update no rows will
+# result in a "notfound" response to the module which by default will
+# give a NAK reply. In this example incrementing "counter" is used to
+# achieve this.
#
update_update = "\
UPDATE ${ippool_table} \
AND address = '${requested_address}'"
#
-# RADIUS (Accounting-Stop)
-# DHCPv4 (Release)
+# RADIUS (Accounting-Stop) DHCPv4 (Release)
#
#
AND owner = '${owner}'"
#
-# RADIUS (Accounting-On)
-# RADIUS (Accounting-Off)
+# RADIUS (Accounting-On) RADIUS (Accounting-Off)
#
#
-# -*- text -*-
+# -*- text -*-
#
# ippool/mssql/queries.conf -- MSSQL queries for rlm_sqlippool
#
# $Id$
#
-# RADIUS (Accounting-Start)
-# DHCPv4 (Discover)
+# RADIUS (Accounting-Start) DHCPv4 (Discover)
#
#
-# MSSQL-specific syntax - required if finding the address and updating
-# it are separate queries
+# MSSQL-specific syntax - required if finding the address and
+# updating it are separate queries
#
#alloc_begin = "BEGIN TRAN"
#alloc_commit = "COMMIT TRAN"
#
# Alternatively attempt both in one, more complex, query
#
-# The ORDER BY clause of this query tries to allocate the same IP-address
-# which user had last session. Ensure that owner is unique to the user
-# within a given pool.
+# The ORDER BY clause of this query tries to allocate the same
+# IP-address which user had last session. Ensure that owner is unique
+# to the user within a given pool.
#
#alloc_find = "\
# UPDATE TOP(1) ${ippool_table} \
# )"
#
-# If you prefer to allocate a random IP address every time, use this query instead.
-# NOTE: This is very slow if you have a lot of free IPs.
+# If you prefer to allocate a random IP address every time, use this
+# query instead. NOTE: This is very slow if you have a lot of free
+# IPs.
#
#alloc_find = "\
# WITH cte AS ( \
# OUTPUT INSERTED.address"
#
-# If an IP could not be allocated, check to see if the pool exists or not
-# This allows the module to differentiate between a full pool and no pool
-# NOTE: If you are not running redundant pool modules this query may be
-# commented out to save running this query every time an ip is not allocated.
+# If an IP could not be allocated, check to see if the pool exists or
+# not This allows the module to differentiate between a full pool and
+# no pool NOTE: If you are not running redundant pool modules this
+# query may be commented out to save running this query every time an
+# ip is not allocated.
#
pool_check = "\
SELECT TOP(1) id \
WHERE pool_name='%{${pool_name}}'"
#
-# This is the final IP Allocation query, which saves the allocated ip details.
-# Only needed if the initial "find" query is not storing the allocation.
+# This is the final IP Allocation query, which saves the allocated ip
+# details. Only needed if the initial "find" query is not storing the
+# allocation.
#
#alloc_update = "\
# UPDATE ${ippool_table} \
# AND pool_name = '%{${pool_name}}'"
#
-# Use a stored procedure to find AND allocate the address. Read and customise
-# `procedure.sql` in this directory to determine the optimal configuration.
+# Use a stored procedure to find AND allocate the address. Read and
+# customise `procedure.sql` in this directory to determine the
+# optimal configuration.
#
-# Comment out alloc_existing, alloc_requested and alloc_update to use this
+# Comment out alloc_existing, alloc_requested and alloc_update to use
+# this
#
#alloc_begin = ""
#alloc_find = "\
#
-# RADIUS (Interim-Update)
-# DHCPv4 (Request)
+# RADIUS (Interim-Update) DHCPv4 (Request)
#
#
-# This query revokes any active offers for addresses that a client is not
-# requesting.
+# This query revokes any active offers for addresses that a client is
+# not requesting.
#
update_free = "\
UPDATE ${ippool_table} \
(SELECT status_id FROM fr_ippool_status WHERE status = 'dynamic')"
#
-# Queries to update a lease.
-# This query must update a row when a lease is successfully requested -
-# queries that update no rows will result in a "notfound" response to
-# the module which by default will give a NAK reply (for DHCPv4).
-# In this example incrementing "counter" is used to achieve this.
+# Queries to update a lease. This query must update a row when a
+# lease is successfully requested - queries that update no rows will
+# result in a "notfound" response to the module which by default will
+# give a NAK reply (for DHCPv4). In this example incrementing
+# "counter" is used to achieve this.
#
update_update = "\
UPDATE ${ippool_table} \
AND address = '${requested_address}'"
#
-# RADIUS (Accounting-Stop)
-# DHCPv4 (Release)
+# RADIUS (Accounting-Stop) DHCPv4 (Release)
#
#
AND owner = '${owner}'"
#
-# RADIUS (Accounting-On)
-# RADIUS (Accounting-Off)
+# RADIUS (Accounting-On) RADIUS (Accounting-Off)
#
#
#
# $Id$
-# Using SKIP LOCKED speeds up selection queries
-# However, it requires MySQL >= 8.0.1. Uncomment the
-# following if you are running a suitable version of MySQL
+# Using SKIP LOCKED speeds up selection queries However, it requires
+# MySQL >= 8.0.1. Uncomment the following if you are running a
+# suitable version of MySQL
#
# skip_locked = "SKIP LOCKED"
skip_locked = ""
#
-# RADIUS (Accounting-Start)
-# DHCPv4 (Discover)
+# RADIUS (Accounting-Start) DHCPv4 (Discover)
#
#
#
#
-# This query attempts to find the most recent IP address for the client
+# This query attempts to find the most recent IP address for the
+# client
#
alloc_existing = "\
SELECT address \
FOR UPDATE ${skip_locked}"
#
-# Alternatively do the operations in one query.
-# Depending on transaction isolation mode, this can cause deadlocks
+# Alternatively do the operations in one query. Depending on
+# transaction isolation mode, this can cause deadlocks
#
#alloc_find = "\
# (SELECT address, 1 AS o FROM ${ippool_table} \
# LIMIT 1"
#
-# If you prefer to allocate a random IP address every time, use this query instead.
-# NOTE: This is very slow if you have a lot of free IPs.
+# If you prefer to allocate a random IP address every time, use this
+# query instead. NOTE: This is very slow if you have a lot of free
+# IPs.
#
#alloc_find = "\
# SELECT address FROM ${ippool_table} \
# FOR UPDATE ${skip_locked}"
#
-# If an IP could not be allocated, check to see if the pool exists or not
-# This allows the module to differentiate between a full pool and no pool
-# NOTE: If you are not running redundant pool modules this query may be
-# commented out to save running this query every time an ip is not allocated.
+# If an IP could not be allocated, check to see if the pool exists or
+# not This allows the module to differentiate between a full pool and
+# no pool NOTE: If you are not running redundant pool modules this
+# query may be commented out to save running this query every time an
+# ip is not allocated.
#
pool_check = "\
SELECT id \
LIMIT 1"
#
-# This is the final IP Allocation query, which saves the allocated ip details.
+# This is the final IP Allocation query, which saves the allocated ip
+# details.
#
alloc_update = "\
UPDATE ${ippool_table} \
AND pool_name = '%{${pool_name}}'"
#
-# Use a stored procedure to find AND allocate the address. Read and customise
-# `procedure.sql` in this directory to determine the optimal configuration.
+# Use a stored procedure to find AND allocate the address. Read and
+# customise `procedure.sql` in this directory to determine the
+# optimal configuration.
#
-# Comment out alloc_existing, alloc_requested and alloc_update to use this
+# Comment out alloc_existing, alloc_requested and alloc_update to use
+# this
#
#alloc_begin = ""
#alloc_find = "\
#
-# RADIUS (Interim-Update)
-# DHCPv4 (Request)
+# RADIUS (Interim-Update) DHCPv4 (Request)
#
#
-# This query revokes any active offers for addresses that a client is not
-# requesting when a DHCP REQUEST packet arrives
+# This query revokes any active offers for addresses that a client is
+# not requesting when a DHCP REQUEST packet arrives
#
update_free = "\
UPDATE ${ippool_table} \
AND `status` = 'dynamic'"
#
-# Queries to update a lease.
-# This query must update a row when a lease is successfully requested -
-# queries that update no rows will result in a "notfound" response to
-# the module which by default will give a NAK reply. In this example
-# incrementing "counter" is used to achieve this.
+# Queries to update a lease. This query must update a row when a
+# lease is successfully requested - queries that update no rows will
+# result in a "notfound" response to the module which by default will
+# give a NAK reply. In this example incrementing "counter" is used to
+# achieve this.
#
update_update = "\
UPDATE ${ippool_table} \
AND address = '${requested_address}'"
#
-# RADIUS (Accounting-Stop)
-# DHCPv4 (Release)
+# RADIUS (Accounting-Stop) DHCPv4 (Release)
#
#
AND owner = '${owner}'"
#
-# RADIUS (Accounting-On)
-# RADIUS (Accounting-Off)
+# RADIUS (Accounting-On) RADIUS (Accounting-Off)
#
#
#
-# RADIUS (Accounting-Start)
-# DHCPv4 (Discover)
+# RADIUS (Accounting-Start) DHCPv4 (Discover)
#
#
-# Use a stored procedure to find AND allocate the address. Read and customise
-# `procedure.sql` in this directory to determine the optimal configuration.
-# Oracle's locking mechanism limitations prevents the use of single queries
-# that can either find a client's existing address or the first available one.
+# Use a stored procedure to find AND allocate the address. Read and
+# customise `procedure.sql` in this directory to determine the
+# optimal configuration. Oracle's locking mechanism limitations
+# prevents the use of single queries that can either find a client's
+# existing address or the first available one.
#
alloc_begin = ""
alloc_find = "\
#
-# If you prefer to allocate a random IP address every time, use this query instead
-# NOTE: This is very slow if you have a lot of free IPs.
+# If you prefer to allocate a random IP address every time, use this
+# query instead NOTE: This is very slow if you have a lot of free
+# IPs.
#
#alloc_find = "\
# SELECT address FROM ${ippool_table} WHERE id IN ( \
# ) FOR UPDATE"
#
-# The above query again, but with SKIP LOCKED. This requires Oracle > 11g.
-# It may work in 9i and 10g, but is not documented, so YMMV.
+# The above query again, but with SKIP LOCKED. This requires Oracle >
+# 11g. It may work in 9i and 10g, but is not documented, so YMMV.
#
#alloc_find = "\
# SELECT address FROM ${ippool_table} WHERE id IN ( \
# ) FOR UPDATE SKIP LOCKED"
#
-# A tidier version that needs Oracle >= 12c
+# A tidier version that needs Oracle >= 12c
#
#alloc_find = "\
# SELECT address FROM ${ippool_table} WHERE id IN (
# ) FROM UPDATE SKIP LOCKED"
#
-# If an IP could not be allocated, check to see whether the pool exists or not
-# This allows the module to differentiate between a full pool and no pool
-# NOTE: If you are not running redundant pool modules this query may be commented
-# out to save running this query every time an ip is not allocated.
+# If an IP could not be allocated, check to see whether the pool
+# exists or not This allows the module to differentiate between a
+# full pool and no pool NOTE: If you are not running redundant pool
+# modules this query may be commented out to save running this query
+# every time an ip is not allocated.
#
pool_check = "\
SELECT id \
#
# This query marks the IP address handed out by "alloc_find" as used
-# for the period of "offer_duration" after which time it may be reused.
+# for the period of "offer_duration" after which time it may be
+# reused.
#
#alloc_update = "\
# UPDATE ${ippool_table} \
#
-# RADIUS (Interim-Update)
-# DHCPv4 (Request)
+# RADIUS (Interim-Update) DHCPv4 (Request)
#
#
-# Queries to update a lease.
-# This query must update a row when a lease is successfully requested -
-# queries that update no rows will result in a "notfound" response to
-# the module which by default will give a NAK reply. In this example
-# incrementing "counter" is used to achieve this.
+# Queries to update a lease. This query must update a row when a
+# lease is successfully requested - queries that update no rows will
+# result in a "notfound" response to the module which by default will
+# give a NAK reply. In this example incrementing "counter" is used to
+# achieve this.
#
update_update = "\
UPDATE ${ippool_table} \
AND address = '${requested_address}'"
#
-# RADIUS (Accounting-Stop)
-# DHCPv4 (Release)
+# RADIUS (Accounting-Stop) DHCPv4 (Release)
#
#
AND owner = '${owner}'"
#
-# RADIUS (Accounting-On)
-# RADIUS (Accounting-Off)
+# RADIUS (Accounting-On) RADIUS (Accounting-Off)
#
#
-# -*- text -*-
+# -*- text -*-
#
-# ippool/postgresql/queries.conf -- PostgreSQL queries for rlm_sqlippool
+# ippool/postgresql/queries.conf -- PostgreSQL queries for
+# rlm_sqlippool
#
# $Id$
-# Using SKIP LOCKED speed up the alloc_find query by 10
-# times. However, it requires PostgreSQL >= 9.5.
+# Using SKIP LOCKED speed up the alloc_find query by 10 times.
+# However, it requires PostgreSQL >= 9.5.
#
-# If you are using an older version of PostgreSQL comment out the following:
+# If you are using an older version of PostgreSQL comment out the
+# following:
skip_locked = "SKIP LOCKED"
#
-# RADIUS (Accounting-Start)
-# DHCPv4 (Discover)
+# RADIUS (Accounting-Start) DHCPv4 (Discover)
#
#
# This sequence of queries allocate an IP address from the Pool
#
-# If the SELECT and UPDATE are in separate queries then set the following
-# to "BEGIN" to wrap them as a transaction
+# If the SELECT and UPDATE are in separate queries then set the
+# following to "BEGIN" to wrap them as a transaction
#
alloc_begin = ""
#
-# This query attempts to re-allocate the most recent IP address
-# for the client
+# This query attempts to re-allocate the most recent IP address for
+# the client
alloc_existing = "\
WITH cte AS ( \
SELECT address \
RETURNING cte.address"
#
-# If the preceding query doesn't find an address the following one
-# is used for finding one from the pool
+# If the preceding query doesn't find an address the following one is
+# used for finding one from the pool
#
alloc_find = "\
WITH cte AS ( \
RETURNING cte.address"
#
-# If you prefer to allocate a random IP address every time, use this query instead
-# NOTE: This is very slow if you have a lot of free IPs.
-# Use of either of these next two queries should have the alloc_begin line commented out
-# and alloc_update below un-commented.
+# If you prefer to allocate a random IP address every time, use this
+# query instead NOTE: This is very slow if you have a lot of free
+# IPs. Use of either of these next two queries should have the
+# alloc_begin line commented out and alloc_update below un-commented.
#
#alloc_find = "\
# SELECT address FROM ${ippool_table} \
#
# This query marks the IP address handed out by "alloc_find" as used
-# for the period of "offer_duration" after which time it may be reused.
-# It is only needed if the SELECT query does not perform the update.
+# for the period of "offer_duration" after which time it may be
+# reused. It is only needed if the SELECT query does not perform the
+# update.
#
#alloc_update = "\
# UPDATE ${ippool_table} \
# AND pool_name = '%{${pool_name}}'"
#
-# If the SELECT and UPDATE are in separate queries then set the following
-# to "COMMIT" to wrap them as a transaction
+# If the SELECT and UPDATE are in separate queries then set the
+# following to "COMMIT" to wrap them as a transaction
#
alloc_commit = ""
#
-# If an IP could not be allocated, check to see whether the pool exists or not
-# This allows the module to differentiate between a full pool and no pool
-# NOTE: If you are not running redundant pool modules this query may be commented
-# out to save running this query every time an ip is not allocated.
+# If an IP could not be allocated, check to see whether the pool
+# exists or not This allows the module to differentiate between a
+# full pool and no pool NOTE: If you are not running redundant pool
+# modules this query may be commented out to save running this query
+# every time an ip is not allocated.
#
pool_check = "\
SELECT id \
LIMIT 1"
#
-# Use a stored procedure to find AND allocate the address. Read and customise
-# `procedure.sql` in this directory to determine the optimal configuration.
+# Use a stored procedure to find AND allocate the address. Read and
+# customise `procedure.sql` in this directory to determine the
+# optimal configuration.
#
# This requires PostgreSQL >= 9.5 as SKIP LOCKED is used.
#
-# The "NO LOAD BALANCE" comment is included here to indicate to a PgPool
-# system that this needs to be a write transaction. PgPool itself cannot
-# detect this from the statement alone. If you are using PgPool and do not
-# have this comment, the query may go to a read only server, and will fail.
-# This has no negative effect if you are not using PgPool.
+# The "NO LOAD BALANCE" comment is included here to indicate to a
+# PgPool system that this needs to be a write transaction. PgPool
+# itself cannot detect this from the statement alone. If you are
+# using PgPool and do not have this comment, the query may go to a
+# read only server, and will fail. This has no negative effect if you
+# are not using PgPool.
#
#alloc_begin = ""
#alloc_find = "\
#
-# RADIUS (Interim-Update)
-# DHCPv4 (Request)
+# RADIUS (Interim-Update) DHCPv4 (Request)
#
#
-# Query used to clear any other addresses that have been offered to the client
+# Query used to clear any other addresses that have been offered to
+# the client
#
update_free = "\
UPDATE ${ippool_table} \
AND status = 'dynamic'"
#
-# Queries to update a lease.
-# This query must update a row when a lease is successfully requested -
-# queries that update no rows will result in a "notfound" response to
-# the module which by default will give a NAK reply. In this example
-# incrementing "counter" is used to achieve this.
+# Queries to update a lease. This query must update a row when a
+# lease is successfully requested - queries that update no rows will
+# result in a "notfound" response to the module which by default will
+# give a NAK reply. In this example incrementing "counter" is used to
+# achieve this.
#
update_update = "\
UPDATE ${ippool_table} \
AND address = '${requested_address}'"
#
-# RADIUS (Accounting-Stop)
-# DHCPv4 (Release)
+# RADIUS (Accounting-Stop) DHCPv4 (Release)
#
#
AND owner = '${owner}'"
#
-# RADIUS (Accounting-On)
-# RADIUS (Accounting-Off)
+# RADIUS (Accounting-On) RADIUS (Accounting-Off)
#
#
#
-# RADIUS (Accounting-Start)
-# DHCPv4 (Discover)
+# RADIUS (Accounting-Start) DHCPv4 (Discover)
#
#
-# SQLite does not implement SELECT FOR UPDATE which is normally used to place
-# an exclusive lock over rows to prevent the same address from being
-# concurrently selected for allocation to multiple users.
+# SQLite does not implement SELECT FOR UPDATE which is normally used
+# to place an exclusive lock over rows to prevent the same address
+# from being concurrently selected for allocation to multiple users.
#
-# The most granular read-blocking lock that SQLite has is an exclusive lock
-# over the database, so that's what we use. All locking in SQLite is performed
-# over the entire database and we perform a row update for any IP that we
-# allocate, requiring an exclusive lock. Taking the exclusive lock from the
-# start of the transaction (even if it were not required to guard the SELECT)
-# is actually quicker than if we deferred it causing SQLite to "upgrade" the
-# automatic shared lock for the transaction to an exclusive lock for the
-# subsequent UPDATE.
+# The most granular read-blocking lock that SQLite has is an
+# exclusive lock over the database, so that's what we use. All
+# locking in SQLite is performed over the entire database and we
+# perform a row update for any IP that we allocate, requiring an
+# exclusive lock. Taking the exclusive lock from the start of the
+# transaction (even if it were not required to guard the SELECT) is
+# actually quicker than if we deferred it causing SQLite to "upgrade"
+# the automatic shared lock for the transaction to an exclusive lock
+# for the subsequent UPDATE.
#
alloc_begin = "BEGIN EXCLUSIVE"
alloc_commit = "COMMIT"
ORDER BY expiry_time LIMIT 1"
#
-# If you prefer to allocate a random IP address every time, use this query instead
+# If you prefer to allocate a random IP address every time, use this
+# query instead
#
#alloc_find = "\
# SELECT address FROM ${ippool_table} \
#
-# If an IP could not be allocated, check to see if the pool exists or not
-# This allows the module to differentiate between a full pool and no pool
-# NOTE: If you are not running redundant pool modules this query may be
-# commented out to save running this query every time an ip is not allocated.
+# If an IP could not be allocated, check to see if the pool exists or
+# not This allows the module to differentiate between a full pool and
+# no pool NOTE: If you are not running redundant pool modules this
+# query may be commented out to save running this query every time an
+# ip is not allocated.
#
pool_check = "\
SELECT id \
LIMIT 1"
#
-# This is the final IP Allocation query, which saves the allocated ip details
+# This is the final IP Allocation query, which saves the allocated ip
+# details
#
alloc_update = "\
UPDATE ${ippool_table} \
#
-# RADIUS (Interim-Update)
-# DHCPv4 (Request)
+# RADIUS (Interim-Update) DHCPv4 (Request)
#
#
-# Query used to clear any other addresses that have been offered to the client
+# Query used to clear any other addresses that have been offered to
+# the client
#
update_free = "\
UPDATE ${ippool_table} \
(SELECT status_id FROM fr_ippool_status WHERE status = 'dynamic')"
#
-# Queries to update a lease.
-# This query must update a row when a lease is successfully requested -
-# queries that update no rows will result in a "notfound" response to
-# the module which by default will give a NAK reply. In this example
-# incrementing "counter" is used to achieve this.
+# Queries to update a lease. This query must update a row when a
+# lease is successfully requested - queries that update no rows will
+# result in a "notfound" response to the module which by default will
+# give a NAK reply. In this example incrementing "counter" is used to
+# achieve this.
#
update_update = "\
UPDATE ${ippool_table} \
#
-# RADIUS (Accounting-Stop)
-# DHCPv4 (Release)
+# RADIUS (Accounting-Stop) DHCPv4 (Release)
#
#
AND owner = '${owner}'"
#
-# RADIUS (Accounting-On)
-# RADIUS (Accounting-Off)
+# RADIUS (Accounting-On) RADIUS (Accounting-Off)
#
#
# -*- text -*-
#
-# main/mysql/queries.conf-- MySQL configuration for default schema (schema.sql)
+# main/mysql/queries.conf-- MySQL configuration for default schema
+# (schema.sql)
#
# $Id$
-# Safe characters list for sql queries. Everything else is replaced
-# with their mime-encoded equivalents.
-# The default list should be ok
+# Safe characters list for sql queries. Everything else is replaced
+# with their mime-encoded equivalents. The default list should be ok
#safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"
#######################################################################
# Connection config
#######################################################################
-# The character set is not configurable. The default character set of
-# the mysql client library is used. To control the character set,
-# create/edit my.cnf (typically in /etc/mysql/my.cnf or /etc/my.cnf)
-# and enter
-# [client]
+# The character set is not configurable. The default character set of
+# the mysql client library is used. To control the character set,
+# create/edit my.cnf (typically in /etc/mysql/my.cnf or /etc/my.cnf)
+# and enter
+# [client]
# default-character-set = utf8
#
#######################################################################
-# Query config: Username
+# Query config: Username
#######################################################################
-# This is the username that will get substituted, escaped, and added
-# as attribute 'SQL-User-Name'. '%{SQL-User-Name}' can be used below
-# everywhere a username substitution is needed for consistency.
+# This is the username that will get substituted, escaped, and added
+# as attribute 'SQL-User-Name'. '%{SQL-User-Name}' can be used below
+# everywhere a username substitution is needed for consistency.
#
-# Uncomment the next line, if you want the sql_user_name to mean:
+# Uncomment the next line, if you want the sql_user_name to mean:
#
# Use Stripped-User-Name, if it's there.
# Else use User-Name, if it's there,
sql_user_name = "%{User-Name}"
#######################################################################
-# Query config: Event-Timestamp
+# Query config: Event-Timestamp
#######################################################################
-# event_timestamp_epoch is the basis for the time inserted into
-# accounting records. Typically this will be the Event-Timestamp of the
-# accounting request, which is usually provided by a NAS.
+# event_timestamp_epoch is the basis for the time inserted into
+# accounting records. Typically this will be the Event-Timestamp of
+# the accounting request, which is usually provided by a NAS.
#
-# Uncomment the next line, if you want the timestamp to be based on the
-# request reception time recorded by this server, for example if you
-# distrust the provided Event-Timestamp.
+# Uncomment the next line, if you want the timestamp to be based on
+# the request reception time recorded by this server, for example if
+# you distrust the provided Event-Timestamp.
#event_timestamp_epoch = "%l"
event_timestamp_epoch = %{((integer) Event-Timestamp) || %l}
-# event_timestamp is the SQL snippet for converting an epoch timestamp
-# to an SQL date.
+# event_timestamp is the SQL snippet for converting an epoch
+# timestamp to an SQL date.
event_timestamp = "%{${event_timestamp_epoch} * 1000}"
#######################################################################
-# Authorization Queries
+# Authorization Queries
#######################################################################
-# These queries compare the check items for the user
-# in ${authcheck_table} and setup the reply items in
-# ${authreply_table}. You can use any query/tables
-# you want, but the return data for each row MUST
-# be in the following order:
+# These queries compare the check items for the user in
+# ${authcheck_table} and setup the reply items in ${authreply_table}.
+# You can use any query/tables you want, but the return data for each
+# row MUST be in the following order:
#
-# 0. Row ID (currently unused)
-# 1. UserName/GroupName
-# 2. Item Attr Name
-# 3. Item Attr Value
-# 4. Item Attr Operation
+# 0. Row ID (currently unused)
+# 1. UserName/GroupName
+# 2. Item Attr Name
+# 3. Item Attr Value
+# 4. Item Attr Operation
#######################################################################
#
WHERE groupname = '%{${group_attribute}}'"
#######################################################################
-# Accounting and Post-Auth Queries
+# Accounting and Post-Auth Queries
#######################################################################
-# These queries insert/update accounting and authentication records.
-# The query to use is determined by the name of the section the module
-# is called from.
+# These queries insert/update accounting and authentication records.
+# The query to use is determined by the name of the section the
+# module is called from.
#
-# e.g. when called from `accouting Start`, the contents of
+# e.g. when called from `accouting Start`, the contents of
#
-# accounting {
+# accounting {
# start {}
-# }
+# }
#
-# will be read, and the "query" entry found will be used.
+# will be read, and the "query" entry found will be used.
#
-# Unlike other SQL drivers, the rlm_cassandra driver will always
-# indicate a single row was updated. This is because the updates aren't
-# applied synchronously, so there's really no clue as to what will be
-# updated when the query is issued.
-# This prevents the normal query failover from occurring, but that's ok
-# as INSERTS are really UPSERTS so we can work around it.
+# Unlike other SQL drivers, the rlm_cassandra driver will always
+# indicate a single row was updated. This is because the updates
+# aren't applied synchronously, so there's really no clue as to what
+# will be updated when the query is issued. This prevents the normal
+# query failover from occurring, but that's ok as INSERTS are really
+# UPSERTS so we can work around it.
#######################################################################
accounting {
- # Write SQL queries to a logfile. This is potentially useful for bulk inserts
- # when used with the rlm_sql_null driver.
+ # Write SQL queries to a logfile. This is potentially useful for
+ # bulk inserts when used with the rlm_sql_null driver.
# logfile = ${logdir}/accounting.sql
#
- # Because cassandra doesn't allow secondary indexes to be used in update statements
- # applying acct on/off packets must be done outside of the server, by a script that
- # first performs a SELECT to identify candidate rows, then closes out the sessions.
+ # Because cassandra doesn't allow secondary indexes to be used in
+ # update statements applying acct on/off packets must be done
+ # outside of the server, by a script that first performs a SELECT to
+ # identify candidate rows, then closes out the sessions.
#
accounting-on {
query = "\
#######################################################################
-# Authentication Logging Queries
+# Authentication Logging Queries
#######################################################################
-# send queries - Insert some info after authentication
+# send queries - Insert some info after authentication
#######################################################################
send {
- # Write SQL queries to a logfile. This is potentially useful for bulk inserts
- # when used with the rlm_sql_null driver.
+ # Write SQL queries to a logfile. This is potentially useful for
+ # bulk inserts when used with the rlm_sql_null driver.
# logfile = ${logdir}/post-auth.sql
access-accept {
# -*- text -*-
#
-# main/firebird/queries.conf-- Firebird configuration for default schema (schema.sql)
+# main/firebird/queries.conf-- Firebird configuration for default
+# schema (schema.sql)
#
# $Id$
#######################################################################
-# Query config: Username
+# Query config: Username
#######################################################################
-# This is the username that will get substituted, escaped, and added
-# as attribute 'SQL-User-Name'. '%{SQL-User-Name}' can be used below
-# everywhere a username substitution is needed for consistency.
+# This is the username that will get substituted, escaped, and added
+# as attribute 'SQL-User-Name'. '%{SQL-User-Name}' can be used below
+# everywhere a username substitution is needed for consistency.
#
-# Uncomment the next line, if you want the sql_user_name to mean:
+# Uncomment the next line, if you want the sql_user_name to mean:
#
# Use Stripped-User-Name, if it's there.
# Else use User-Name, if it's there,
sql_user_name = "%{User-Name}"
#######################################################################
-# Query config: Event-Timestamp
+# Query config: Event-Timestamp
#######################################################################
-# event_timestamp_epoch is the basis for the time inserted into
-# accounting records. Typically this will be the Event-Timestamp of the
-# accounting request, which is usually provided by a NAS.
+# event_timestamp_epoch is the basis for the time inserted into
+# accounting records. Typically this will be the Event-Timestamp of
+# the accounting request, which is usually provided by a NAS.
#
-# Uncomment the next line, if you want the timestamp to be based on the
-# request reception time recorded by this server, for example if you
-# distrust the provided Event-Timestamp.
+# Uncomment the next line, if you want the timestamp to be based on
+# the request reception time recorded by this server, for example if
+# you distrust the provided Event-Timestamp.
#event_timestamp_epoch = "%l"
event_timestamp_epoch = "%{((integer) Event-Timestamp) || %l}"
-# event_timestamp is the SQL snippet for converting an epoch timestamp
-# to an SQL date.
+# event_timestamp is the SQL snippet for converting an epoch
+# timestamp to an SQL date.
event_timestamp = "DATEADD(${event_timestamp_epoch} SECOND TO TIMESTAMP '1970-01-01 00:00:00')"
#######################################################################
-# Authorization Queries
+# Authorization Queries
#######################################################################
-# These queries compare the check items for the user
-# in ${authcheck_table} and setup the reply items in
-# ${authreply_table}. You can use any query/tables
-# you want, but the return data for each row MUST
-# be in the following order:
+# These queries compare the check items for the user in
+# ${authcheck_table} and setup the reply items in ${authreply_table}.
+# You can use any query/tables you want, but the return data for each
+# row MUST be in the following order:
#
-# 0. Row ID (currently unused)
-# 1. UserName/GroupName
-# 2. Item Attr Name
-# 3. Item Attr Value
-# 4. Item Attr Operation
+# 0. Row ID (currently unused)
+# 1. UserName/GroupName
+# 2. Item Attr Name
+# 3. Item Attr Value
+# 4. Item Attr Operation
#######################################################################
authorize_check_query = "\
ORDER BY id"
#######################################################################
-# Accounting and Post-Auth Queries
+# Accounting and Post-Auth Queries
#######################################################################
-# These queries insert/update accounting and authentication records.
-# The query to use is determined by the name of the section the module
-# is called from.
+# These queries insert/update accounting and authentication records.
+# The query to use is determined by the name of the section the
+# module is called from.
#
-# e.g. when called from `accouting Start`, the contents of
+# e.g. when called from `accouting Start`, the contents of
#
-# accounting {
+# accounting {
# start {}
-# }
+# }
#
-# will be read, and any "query" entries will be run in sequence
-# until one returns a positive number of modified rows.
+# will be read, and any "query" entries will be run in sequence until
+# one returns a positive number of modified rows.
#######################################################################
accounting {
- # Write SQL queries to a logfile. This is potentially useful for bulk inserts
- # when used with the rlm_sql_null driver.
+ # Write SQL queries to a logfile. This is potentially useful for
+ # bulk inserts when used with the rlm_sql_null driver.
# logfile = ${logdir}/accounting.sql
column_list = "\
#
# "Bulk update" Accounting-On/Off strategy.
#
- # Immediately terminate all sessions associated with a
- # given NAS.
+ # Immediately terminate all sessions associated with a given NAS.
#
- # NOTE: If a large number of sessions require closing
- # then the bulk update may be take a long time to run
- # and lock an excessive number of rows. See the
- # strategy below for an alternative approach that does
- # not touch the radacct session data.
+ # NOTE: If a large number of sessions require closing then the bulk
+ # update may be take a long time to run and lock an excessive
+ # number of rows. See the strategy below for an alternative
+ # approach that does not touch the radacct session data.
#
query = "\
UPDATE ${...acct_table1} \
#
# "Lightweight" Accounting-On/Off strategy.
#
- # Record the reload time of the NAS and let the
- # administrator actually close the sessions in radacct
- # out-of-band, if desired.
+ # Record the reload time of the NAS and let the administrator
+ # actually close the sessions in radacct out-of-band, if desired.
#
- # Implementation advice, together with a stored
- # procedure for closing sessions and a view showing
- # the effective stop time of each session is provided
- # in process-radacct.sql.
+ # Implementation advice, together with a stored procedure for
+ # closing sessions and a view showing the effective stop time of
+ # each session is provided in process-radacct.sql.
#
- # To enable this strategy, just change the previous
- # query to "-query", and this one to "query". The
- # previous one will be ignored, and this one will be
- # enabled.
+ # To enable this strategy, just change the previous query to
+ # "-query", and this one to "query". The previous one will be
+ # ignored, and this one will be enabled.
#
-query = "\
UPDATE OR INSERT INTO nasreload \
(nasipaddress, reloadtime) VALUES \
('%{NAS-IP-Address}', ${...event_timestamp})"
- # If there are no open user sessions, then the previous query
- # will return "no rows updated". The server will then fall through
- # to the next query, which is just "yes, that's fine".
+ # If there are no open user sessions, then the previous query will
+ # return "no rows updated". The server will then fall through to
+ # the next query, which is just "yes, that's fine".
#
query = "SELECT true"
'%{Class}')"
#
- # Key constraints prevented us from inserting a new session,
- # use the alternate query to update an existing session.
+ # Key constraints prevented us from inserting a new session, use
+ # the alternate query to update an existing session.
#
query = "\
UPDATE ${...acct_table1} SET \
interim-update {
#
- # Update an existing session and calculate the interval
- # between the last data we received for the session and this
- # update. This can be used to find stale sessions.
+ # Update an existing session and calculate the interval between the
+ # last data we received for the session and this update. This can
+ # be used to find stale sessions.
#
query = "\
UPDATE ${...acct_table1} \
WHERE acctuniqueid = '%{Acct-Unique-Session-Id}'"
#
- # The update condition matched no existing sessions. Use
- # the values provided in the update to create a new session.
+ # The update condition matched no existing sessions. Use the values
+ # provided in the update to create a new session.
#
query = "\
INSERT INTO ${...acct_table1} \
WHERE acctuniqueid = '%{Acct-Unique-Session-Id}'"
#
- # The update condition matched no existing sessions. Use
- # the values provided in the update to create a new session.
+ # The update condition matched no existing sessions. Use the values
+ # provided in the update to create a new session.
#
query = "\
INSERT INTO ${...acct_table2} \
#######################################################################
-# Authentication Logging Queries
+# Authentication Logging Queries
#######################################################################
-# send queries - Insert some info after authentication
+# send queries - Insert some info after authentication
#######################################################################
send {
- # Write SQL queries to a logfile. This is potentially useful for bulk inserts
- # when used with the rlm_sql_null driver.
+ # Write SQL queries to a logfile. This is potentially useful for
+ # bulk inserts when used with the rlm_sql_null driver.
# logfile = ${logdir}/post-auth.sql
access-accept {
# -*- text -*-
#
-# main/mssql/queries.conf -- MSSQL configuration for default schema (schema.sql)
+# main/mssql/queries.conf -- MSSQL configuration for default schema
+# (schema.sql)
#
# $Id$
-# Safe characters list for sql queries. Everything else is replaced
-# with their mime-encoded equivalents.
-# The default list should be ok
+# Safe characters list for sql queries. Everything else is replaced
+# with their mime-encoded equivalents. The default list should be ok
#safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"
#######################################################################
-# Query config: Username
+# Query config: Username
#######################################################################
-# This is the username that will get substituted, escaped, and added
-# as attribute 'SQL-User-Name'. '%{SQL-User-Name}' can be used
-# below everywhere a username substitution is needed for consistency.
+# This is the username that will get substituted, escaped, and added
+# as attribute 'SQL-User-Name'. '%{SQL-User-Name}' can be used below
+# everywhere a username substitution is needed for consistency.
#
-# Uncomment the next line, if you want the sql_user_name to mean:
+# Uncomment the next line, if you want the sql_user_name to mean:
#
# Use Stripped-User-Name, if it's there.
# Else use User-Name, if it's there,
sql_user_name = "%{User-Name}"
#######################################################################
-# Query config: Event-Timestamp
+# Query config: Event-Timestamp
#######################################################################
-# event_timestamp_epoch is the basis for the time inserted into
-# accounting records. Typically this will be the Event-Timestamp of the
-# accounting request, which is usually provided by a NAS.
+# event_timestamp_epoch is the basis for the time inserted into
+# accounting records. Typically this will be the Event-Timestamp of
+# the accounting request, which is usually provided by a NAS.
#
-# Uncomment the next line, if you want the timestamp to be based on the
-# request reception time recorded by this server, for example if you
-# distrust the provided Event-Timestamp.
+# Uncomment the next line, if you want the timestamp to be based on
+# the request reception time recorded by this server, for example if
+# you distrust the provided Event-Timestamp.
#event_timestamp_epoch = "%l"
event_timestamp_epoch = %{((integer) Event-Timestamp) || %l}
-# event_timestamp is the SQL snippet for converting an epoch timestamp
-# to an SQL date.
+# event_timestamp is the SQL snippet for converting an epoch
+# timestamp to an SQL date.
event_timestamp = "DATEADD(SS, ${event_timestamp_epoch}, '19700101')"
#######################################################################
# Authorization Queries
#######################################################################
-# These queries compare the check items for the user
-# in ${authcheck_table} and setup the reply items in
-# ${authreply_table}. You can use any query/tables
-# you want, but the return data for each row MUST
-# be in the following order:
+# These queries compare the check items for the user in
+# ${authcheck_table} and setup the reply items in ${authreply_table}.
+# You can use any query/tables you want, but the return data for each
+# row MUST be in the following order:
#
# 0. Row ID (currently unused)
# 1. UserName/GroupName
# 3. Item Attr Value
# 4. Item Attr Operation
#######################################################################
-# Query for case sensitive usernames was removed. Please contact with me,
-# if you know analog of STRCMP functions for MS SQL.
+# Query for case sensitive usernames was removed. Please contact with
+# me, if you know analog of STRCMP functions for MS SQL.
authorize_check_query = "\
SELECT id, username, attribute, value, op \
ORDER BY priority"
#######################################################################
-# Accounting and Send Queries
+# Accounting and Send Queries
#######################################################################
-# These queries insert/update accounting and authentication records.
-# The query to use is determined by the name of the section the module
-# is called from.
+# These queries insert/update accounting and authentication records.
+# The query to use is determined by the name of the section the
+# module is called from.
#
-# e.g. when called from `accouting Start`, the contents of
+# e.g. when called from `accouting Start`, the contents of
#
-# accounting {
+# accounting {
# start {}
-# }
+# }
#
-# will be read, and any "query" entries will be run in sequence
-# until one returns a positive number of modified rows.
+# will be read, and any "query" entries will be run in sequence until
+# one returns a positive number of modified rows.
#######################################################################
accounting {
- # Write SQL queries to a logfile. This is potentially useful for bulk inserts
- # when used with the rlm_sql_null driver.
+ # Write SQL queries to a logfile. This is potentially useful for
+ # bulk inserts when used with the rlm_sql_null driver.
# logfile = ${logdir}/accounting.sql
column_list = "\
AND acctstarttime <= ${...event_timestamp}"
#
- # If there are no open user sessions, then the previous query
- # will return "no rows updated". The server will then fall through
- # to the next query, which is just "yes, that's fine".
+ # If there are no open user sessions, then the previous query will
+ # return "no rows updated". The server will then fall through to
+ # the next query, which is just "yes, that's fine".
#
query = "SELECT true"
}
send {
- # Write SQL queries to a logfile. This is potentially useful for bulk inserts
- # when used with the rlm_sql_null driver.
+ # Write SQL queries to a logfile. This is potentially useful for
+ # bulk inserts when used with the rlm_sql_null driver.
# logfile = ${logdir}/post-auth.sql
access-accept {
##
## $Id$
-# Safe characters list for sql queries. Everything else is replaced
-# with their mime-encoded equivalents.
-# The default list should be ok
+# Safe characters list for sql queries. Everything else is replaced
+# with their mime-encoded equivalents. The default list should be ok
#safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"
#######################################################################
-# Query config: Username
+# Query config: Username
#######################################################################
-# This is the username that will get substituted, escaped, and added
-# as attribute 'SQL-User-Name'. '%{SQL-User-Name}' should be used below
-# everywhere a username substitution is needed so you you can be sure
-# the username passed from the client is escaped properly.
+# This is the username that will get substituted, escaped, and added
+# as attribute 'SQL-User-Name'. '%{SQL-User-Name}' should be used
+# below everywhere a username substitution is needed so you you can
+# be sure the username passed from the client is escaped properly.
#
# Uncomment the next line, if you want the sql_user_name to mean:
#
sql_user_name = "%{User-Name}"
#######################################################################
-# Logging of WiMAX SPI -> key mappings
+# Logging of WiMAX SPI -> key mappings
#######################################################################
-# postauth_query - Insert some info after authentication
+# postauth_query - Insert some info after authentication
#######################################################################
postauth_query = "INSERT INTO wimax \
# -*- text -*-
#
-# main/mysql/queries.conf-- MySQL configuration for default schema (schema.sql)
+# main/mysql/queries.conf-- MySQL configuration for default schema
+# (schema.sql)
#
# $Id$
#######################################################################
# Connection config
#######################################################################
-# The character set is configured using the driver option `character_set`
-# in mods-config/sql/driver/mysql
+# The character set is configured using the driver option
+# `character_set` in mods-config/sql/driver/mysql
#
-# To control other client library options, create / edit my.cnf (typically
-# in /etc/mysql/my.cnf or /etc/my.cnf) and enter
-# [freeradius]
-# <option> = <value>
+# To control other client library options, create / edit my.cnf
+# (typically in /etc/mysql/my.cnf or /etc/my.cnf) and enter
+# [freeradius]
+# <option> = <value>
#
#######################################################################
-# Query config: Username
+# Query config: Username
#######################################################################
-# This is the username that will get substituted, escaped, and added
-# as attribute 'SQL-User-Name'. '%{SQL-User-Name}' can be used below
-# everywhere a username substitution is needed for consistency.
+# This is the username that will get substituted, escaped, and added
+# as attribute 'SQL-User-Name'. '%{SQL-User-Name}' can be used below
+# everywhere a username substitution is needed for consistency.
#
-# Uncomment the next line, if you want the sql_user_name to mean:
+# Uncomment the next line, if you want the sql_user_name to mean:
#
# Use Stripped-User-Name, if it's there.
# Else use User-Name, if it's there,
sql_user_name = "%{User-Name}"
#######################################################################
-# Query config: Event-Timestamp
+# Query config: Event-Timestamp
#######################################################################
-# event_timestamp_epoch is the basis for the time inserted into
-# accounting records. Typically this will be the Event-Timestamp of the
-# accounting request, which is usually provided by a NAS.
+# event_timestamp_epoch is the basis for the time inserted into
+# accounting records. Typically this will be the Event-Timestamp of
+# the accounting request, which is usually provided by a NAS.
#
-# Uncomment the next line, if you want the timestamp to be based on the
-# request reception time recorded by this server, for example if you
-# distrust the provided Event-Timestamp.
+# Uncomment the next line, if you want the timestamp to be based on
+# the request reception time recorded by this server, for example if
+# you distrust the provided Event-Timestamp.
#event_timestamp_epoch = "%l"
event_timestamp_epoch = "%{((integer) Event-Timestamp) || %l}"
-# event_timestamp is the SQL snippet for converting an epoch timestamp
-# to an SQL date.
+# event_timestamp is the SQL snippet for converting an epoch
+# timestamp to an SQL date.
event_timestamp = "FROM_UNIXTIME(${event_timestamp_epoch})"
#######################################################################
-# Conection setup query
+# Conection setup query
#######################################################################
-# This query is run on each new connection when it is first opened.
-# Typically used for setting connection options and not expected
-# to return any results.
-# With MySQL / MariaDB it can be necessary to amend the transaction
-# isolation level to prevent gap locks creating deadlocks.
+# This query is run on each new connection when it is first opened.
+# Typically used for setting connection options and not expected to
+# return any results. With MySQL / MariaDB it can be necessary to
+# amend the transaction isolation level to prevent gap locks creating
+# deadlocks.
# open_query = "SET TRANSACTION ISOLATION LEVEL READ COMMITTED"
#######################################################################
-# Authorization Queries
+# Authorization Queries
#######################################################################
-# These queries compare the check items for the user
-# in ${authcheck_table} and setup the reply items in
-# ${authreply_table}. You can use any query/tables
-# you want, but the return data for each row MUST
-# be in the following order:
+# These queries compare the check items for the user in
+# ${authcheck_table} and setup the reply items in ${authreply_table}.
+# You can use any query/tables you want, but the return data for each
+# row MUST be in the following order:
#
-# 0. Row ID (currently unused)
-# 1. UserName/GroupName
-# 2. Item Attr Name
-# 3. Item Attr Value
-# 4. Item Attr Operation
+# 0. Row ID (currently unused)
+# 1. UserName/GroupName
+# 2. Item Attr Name
+# 3. Item Attr Value
+# 4. Item Attr Operation
#######################################################################
-# Use these for case sensitive usernames.
+# Use these for case sensitive usernames.
#authorize_check_query = "\
# SELECT id, username, attribute, value, op \
ORDER BY id"
#######################################################################
-# Accounting and Post-Auth Queries
+# Accounting and Post-Auth Queries
#######################################################################
-# These queries insert/update accounting and authentication records.
-# The query to use is determined by the name of the section the module
-# is called from.
+# These queries insert/update accounting and authentication records.
+# The query to use is determined by the name of the section the
+# module is called from.
#
-# e.g. when called from `accouting Start`, the contents of
+# e.g. when called from `accouting Start`, the contents of
#
-# accounting {
+# accounting {
# start {}
-# }
+# }
#
-# will be read, and any "query" entries will be run in sequence
-# until one returns a positive number of modified rows.
+# will be read, and any "query" entries will be run in sequence until
+# one returns a positive number of modified rows.
#######################################################################
accounting {
- # Write SQL queries to a logfile. This is potentially useful for bulk inserts
- # when used with the rlm_sql_null driver.
+ # Write SQL queries to a logfile. This is potentially useful for
+ # bulk inserts when used with the rlm_sql_null driver.
# logfile = ${logdir}/accounting.sql
column_list = "\
#
# "Bulk update" Accounting-On/Off strategy.
#
- # Immediately terminate all sessions associated with a
- # given NAS.
+ # Immediately terminate all sessions associated with a given NAS.
#
- # NOTE: If a large number of sessions require closing
- # then the bulk update may be take a long time to run
- # and lock an excessive number of rows. See the
- # strategy below for an alternative approach that does
- # not touch the radacct session data.
+ # NOTE: If a large number of sessions require closing then the bulk
+ # update may be take a long time to run and lock an excessive
+ # number of rows. See the strategy below for an alternative
+ # approach that does not touch the radacct session data.
#
query = "\
UPDATE ${...acct_table1} \
#
# "Lightweight" Accounting-On/Off strategy.
#
- # Record the reload time of the NAS and let the
- # administrator actually close the sessions in radacct
- # out-of-band, if desired.
+ # Record the reload time of the NAS and let the administrator
+ # actually close the sessions in radacct out-of-band, if desired.
#
- # Implementation advice, together with a stored
- # procedure for closing sessions and a view showing
- # the effective stop time of each session is provided
- # in process-radacct.sql.
+ # Implementation advice, together with a stored procedure for
+ # closing sessions and a view showing the effective stop time of
+ # each session is provided in process-radacct.sql.
#
- # To enable this strategy, just change the previous
- # query to "-query", and this one to "query". The
- # previous one will be ignored, and this one will be
- # enabled.
+ # To enable this strategy, just change the previous query to
+ # "-query", and this one to "query". The previous one will be
+ # ignored, and this one will be enabled.
#
-query = "\
INSERT INTO nasreload \
reloadtime = ${...event_timestamp} \
ON DUPLICATE KEY UPDATE reloadtime = ${...event_timestamp}"
- # If there are no open user sessions, then the previous query
- # will return "no rows updated". The server will then fall through
- # to the next query, which is just "yes, that's fine".
+ # If there are no open user sessions, then the previous query will
+ # return "no rows updated". The server will then fall through to
+ # the next query, which is just "yes, that's fine".
#
query = "SELECT true"
'%{Class}')"
#
- # Key constraints prevented us from inserting a new session,
- # use the alternate query to update an existing session.
+ # Key constraints prevented us from inserting a new session, use
+ # the alternate query to update an existing session.
#
query = "\
UPDATE ${...acct_table1} SET \
interim-update {
#
- # Update an existing session and calculate the interval
- # between the last data we received for the session and this
- # update. This can be used to find stale sessions.
+ # Update an existing session and calculate the interval between the
+ # last data we received for the session and this update. This can
+ # be used to find stale sessions.
#
query = "\
UPDATE ${...acct_table1} \
WHERE acctuniqueid = '%{Acct-Unique-Session-Id}'"
#
- # The update condition matched no existing sessions. Use
- # the values provided in the update to create a new session.
+ # The update condition matched no existing sessions. Use the values
+ # provided in the update to create a new session.
#
query = "\
INSERT INTO ${...acct_table1} \
WHERE acctuniqueid = '%{Acct-Unique-Session-Id}'"
#
- # The update condition matched no existing sessions. Use
- # the values provided in the update to create a new session.
+ # The update condition matched no existing sessions. Use the values
+ # provided in the update to create a new session.
#
query = "\
INSERT INTO ${...acct_table2} \
#######################################################################
-# Authentication Logging Queries
+# Authentication Logging Queries
#######################################################################
-# send queries - Insert some info after authentication
+# send queries - Insert some info after authentication
#######################################################################
send {
- # Write SQL queries to a logfile. This is potentially useful for bulk inserts
- # when used with the rlm_sql_null driver.
+ # Write SQL queries to a logfile. This is potentially useful for
+ # bulk inserts when used with the rlm_sql_null driver.
# logfile = ${logdir}/post-auth.sql
access-accept {
# -*- text -*-
#
-# main/oracle/queries.conf -- Oracle configuration for default schema (schema.sql)
+# main/oracle/queries.conf -- Oracle configuration for default schema
+# (schema.sql)
#
# $Id$
#######################################################################
-# Query config: Username
+# Query config: Username
#######################################################################
-# This is the username that will get substituted, escaped, and added
-# as attribute 'SQL-User-Name'. '%{SQL-User-Name}' can be used below
-# everywhere a username substitution is needed for consistency.
+# This is the username that will get substituted, escaped, and added
+# as attribute 'SQL-User-Name'. '%{SQL-User-Name}' can be used below
+# everywhere a username substitution is needed for consistency.
#
# Uncomment the next line, if you want the sql_user_name to mean:
#
sql_user_name = "%{User-Name}"
#######################################################################
-# Query config: Event-Timestamp
+# Query config: Event-Timestamp
#######################################################################
-# event_timestamp_epoch is the basis for the time inserted into
-# accounting records. Typically this will be the Event-Timestamp of the
-# accounting request, which is provided by a NAS.
+# event_timestamp_epoch is the basis for the time inserted into
+# accounting records. Typically this will be the Event-Timestamp of
+# the accounting request, which is provided by a NAS.
#
-# Uncomment the next line, if you want the timestamp to be based on the
-# request reception time recorded by this server, for example if you
-# distrust the provided Event-Timestamp.
+# Uncomment the next line, if you want the timestamp to be based on
+# the request reception time recorded by this server, for example if
+# you distrust the provided Event-Timestamp.
#event_timestamp_epoch = "%l"
event_timestamp_epoch = %{((integer) Event-Timestamp) || %l}
-# event_timestamp is the SQL snippet for converting an epoch timestamp
-# to an SQL date.
+# event_timestamp is the SQL snippet for converting an epoch
+# timestamp to an SQL date.
event_timestamp = "TO_DATE('1970-01-01','YYYY-MM-DD') + NUMTODSINTERVAL(${event_timestamp_epoch},'SECOND')"
#######################################################################
# Authorization Queries
#######################################################################
-# These queries compare the check items for the user
-# in ${authcheck_table} and setup the reply items in
-# ${authreply_table}. You can use any query/tables
-# you want, but the return data for each row MUST
-# be in the following order:
+# These queries compare the check items for the user in
+# ${authcheck_table} and setup the reply items in ${authreply_table}.
+# You can use any query/tables you want, but the return data for each
+# row MUST be in the following order:
#
# 0. Row ID (currently unused)
# 1. UserName/GroupName
# 4. Item Attr Operation
#######################################################################
#
-# WARNING: Oracle is case sensitive
+# WARNING: Oracle is case sensitive
#
-# The main difference between MySQL and Oracle queries is the date format.
-# You must use the TO_DATE function to transform the radius date format to
-# the Oracle date format, and put NULL otherwise '0' in a void date field.
+# The main difference between MySQL and Oracle queries is the date
+# format. You must use the TO_DATE function to transform the radius
+# date format to the Oracle date format, and put NULL otherwise '0'
+# in a void date field.
#
#######################################################################
ORDER BY id"
#######################################################################
-# Group Membership Queries
+# Group Membership Queries
#######################################################################
-# group_membership_query - Check user group membership
+# group_membership_query - Check user group membership
#######################################################################
group_membership_query = "\
ORDER BY priority"
#######################################################################
-# Accounting and Post-Auth Queries
+# Accounting and Post-Auth Queries
#######################################################################
-# These queries insert/update accounting and authentication records.
-# The query to use is determined by the name of the section the module
-# is called from.
+# These queries insert/update accounting and authentication records.
+# The query to use is determined by the name of the section the
+# module is called from.
#
-# e.g. when called from `accouting Start`, the contents of
+# e.g. when called from `accouting Start`, the contents of
#
-# accounting {
+# accounting {
# start {}
-# }
+# }
#
-# will be read, and any "query" entries will be run in sequence
-# until one returns a positive number of modified rows.
+# will be read, and any "query" entries will be run in sequence until
+# one returns a positive number of modified rows.
#######################################################################
accounting {
- # Write SQL queries to a logfile. This is potentially useful for bulk inserts
- # when used with the rlm_sql_null driver.
+ # Write SQL queries to a logfile. This is potentially useful for
+ # bulk inserts when used with the rlm_sql_null driver.
# logfile = ${logdir}/accounting.sql
column_list = "\
AND acctstarttime <= ${...event_timestamp}"
#
- # If there are no open user sessions, then the previous query
- # will return "no rows updated". The server will then fall through
- # to the next query, which is just "yes, that's fine".
+ # If there are no open user sessions, then the previous query will
+ # return "no rows updated". The server will then fall through to
+ # the next query, which is just "yes, that's fine".
#
query = "SELECT 1 from dual"
}
}
#######################################################################
-# Authentication Logging Queries
+# Authentication Logging Queries
#######################################################################
-# send queries - Insert some info after authentication
+# send queries - Insert some info after authentication
#######################################################################
send {
- # Write SQL queries to a logfile. This is potentially useful for bulk inserts
- # when used with the rlm_sql_null driver.
+ # Write SQL queries to a logfile. This is potentially useful for
+ # bulk inserts when used with the rlm_sql_null driver.
# logfile = ${logdir}/post-auth.sql
access-accept {
#######################################################################
- # Query config: Username
+ # Query config: Username
#######################################################################
- # This is the username that will get substituted, escaped, and added
- # as attribute 'SQL-User-Name'. '%{SQL-User-Name}' should be used below
- # everywhere a username substitution is needed so you you can be sure
- # the username passed from the client is escaped properly.
+ # This is the username that will get substituted, escaped, and added
+ # as attribute 'SQL-User-Name'. '%{SQL-User-Name}' should be used
+ # below everywhere a username substitution is needed so you you can
+ # be sure the username passed from the client is escaped properly.
#
# Uncomment the next line, if you want the sql_user_name to mean:
#
# Else use User-Name, if it's there,
# Else use hard-coded string "none" as the user name.
#
- #sql_user_name = "%{Stripped-User-Name || User-Name || 'none'}"
+ # sql_user_name = "%{Stripped-User-Name || User-Name || 'none'}"
#
sql_user_name = "%{User-Name}"
accounting {
- # Write SQL queries to a logfile. This is potentially useful for bulk inserts
- # when used with the rlm_sql_null driver.
+ # Write SQL queries to a logfile. This is potentially useful for
+ # bulk inserts when used with the rlm_sql_null driver.
# logfile = ${logdir}/accounting.sql
start {
# -*- text -*-
#
-# main/postgresql/queries.conf -- PostgreSQL configuration for default schema (schema.sql)
+# main/postgresql/queries.conf -- PostgreSQL configuration for
+# default schema (schema.sql)
#
# $Id$
#######################################################################
-# Query config: Username
+# Query config: Username
#######################################################################
-# This is the username that will get substituted, escaped, and added
-# as attribute 'SQL-User-Name'. '%{SQL-User-Name}' can be used
-# below everywhere a username substitution is needed for consistency.
+# This is the username that will get substituted, escaped, and added
+# as attribute 'SQL-User-Name'. '%{SQL-User-Name}' can be used below
+# everywhere a username substitution is needed for consistency.
#
-# Uncomment the next line, if you want the sql_user_name to mean:
+# Uncomment the next line, if you want the sql_user_name to mean:
#
# Use Stripped-User-Name, if it's there.
# Else use User-Name, if it's there,
sql_user_name = "%{User-Name}"
#######################################################################
-# Query config: Event-Timestamp
+# Query config: Event-Timestamp
#######################################################################
-# event_timestamp_epoch is the basis for the time inserted into
-# accounting records. Typically this will be the Event-Timestamp of the
-# accounting request, which is usually provided by a NAS.
+# event_timestamp_epoch is the basis for the time inserted into
+# accounting records. Typically this will be the Event-Timestamp of
+# the accounting request, which is usually provided by a NAS.
#
-# Uncomment the next line, if you want the timestamp to be based on the
-# request reception time recorded by this server, for example if you
-# distrust the provided Event-Timestamp.
+# Uncomment the next line, if you want the timestamp to be based on
+# the request reception time recorded by this server, for example if
+# you distrust the provided Event-Timestamp.
#event_timestamp_epoch = "%l"
event_timestamp_epoch = %{((integer) Event-Timestamp) || %l}
-# event_timestamp is the SQL snippet for converting an epoch timestamp
-# to an SQL date.
+# event_timestamp is the SQL snippet for converting an epoch
+# timestamp to an SQL date.
event_timestamp = "TO_TIMESTAMP(${event_timestamp_epoch})"
#######################################################################
# Open Query
#######################################################################
-# This query is run whenever a new connection is opened.
-# It is commented out by default.
+# This query is run whenever a new connection is opened. It is
+# commented out by default.
#
-# If you have issues with connections hanging for too long, uncomment
-# the next line, and set the timeout in milliseconds. As a general
-# rule, if the queries take longer than a second, something is wrong
-# with the database.
+# If you have issues with connections hanging for too long, uncomment
+# the next line, and set the timeout in milliseconds. As a general
+# rule, if the queries take longer than a second, something is wrong
+# with the database.
#open_query = "set statement_timeout to 1000"
#######################################################################
# Authorization Queries
#######################################################################
-# These queries compare the check items for the user
-# in ${authcheck_table} and setup the reply items in
-# ${authreply_table}. You can use any query/tables
-# you want, but the return data for each row MUST
-# be in the following order:
+# These queries compare the check items for the user in
+# ${authcheck_table} and setup the reply items in ${authreply_table}.
+# You can use any query/tables you want, but the return data for each
+# row MUST be in the following order:
#
# 0. Row ID (currently unused)
# 1. UserName/GroupName
ORDER BY id"
#######################################################################
-# Group Membership Queries
+# Group Membership Queries
#######################################################################
-# group_membership_query - Check user group membership
+# group_membership_query - Check user group membership
#######################################################################
-# Use these for case insensitive usernames. WARNING: Slower queries!
+# Use these for case insensitive usernames. WARNING: Slower queries!
#group_membership_query = "\
# SELECT groupname \
# FROM ${usergroup_table} \
ORDER BY priority"
#######################################################################
-# Accounting and Post-Auth Queries
+# Accounting and Post-Auth Queries
#######################################################################
-# These queries insert/update accounting and authentication records.
-# The query to use is determined by the name of the section the module
-# is called from.
+# These queries insert/update accounting and authentication records.
+# The query to use is determined by the name of the section the
+# module is called from.
#
-# e.g. when called from `accouting Start`, the contents of
+# e.g. when called from `accouting Start`, the contents of
#
-# accounting {
+# accounting {
# start {}
-# }
+# }
#
-# will be read, and any "query" entries will be run in sequence
-# until one returns a positive number of modified rows.
+# will be read, and any "query" entries will be run in sequence until
+# one returns a positive number of modified rows.
#######################################################################
accounting {
- # Write SQL queries to a logfile. This is potentially useful for bulk inserts
- # when used with the rlm_sql_null driver.
+ # Write SQL queries to a logfile. This is potentially useful for
+ # bulk inserts when used with the rlm_sql_null driver.
# logfile = ${logdir}/accounting.sql
column_list = "\
#
# "Bulk update" Accounting-On/Off strategy.
#
- # Immediately terminate all sessions associated with a
- # given NAS.
+ # Immediately terminate all sessions associated with a given NAS.
#
- # NOTE: If a large number of sessions require closing
- # then the bulk update may be take a long time to run
- # and lock an excessive number of rows. See the
- # strategy below for an alternative approach that does
- # not touch the radacct session data.
+ # NOTE: If a large number of sessions require closing then the bulk
+ # update may be take a long time to run and lock an excessive
+ # number of rows. See the strategy below for an alternative
+ # approach that does not touch the radacct session data.
#
query = "\
UPDATE ${...acct_table1} \
#
# "Lightweight" Accounting-On/Off strategy.
#
- # Record the reload time of the NAS and let the
- # administrator actually close the sessions in radacct
- # out-of-band, if desired.
+ # Record the reload time of the NAS and let the administrator
+ # actually close the sessions in radacct out-of-band, if desired.
#
- # Implementation advice, together with a stored
- # procedure for closing sessions and a view showing
- # the effective stop time of each session is provided
- # in process-radacct.sql.
+ # Implementation advice, together with a stored procedure for
+ # closing sessions and a view showing the effective stop time of
+ # each session is provided in process-radacct.sql.
#
- # To enable this strategy, just change the previous
- # query to "-query", and this one to "query". The
- # previous one will be ignored, and this one will be
- # enabled.
+ # To enable this strategy, just change the previous query to
+ # "-query", and this one to "query". The previous one will be
+ # ignored, and this one will be enabled.
#
-query = "\
INSERT INTO nasreload (nasipaddress, reloadtime) \
DO UPDATE SET \
reloadtime = ${...event_timestamp}"
- # If there are no open user sessions, then the previous query
- # will return "no rows updated". The server will then fall through
- # to the next query, which is just "yes, that's fine".
+ # If there are no open user sessions, then the previous query will
+ # return "no rows updated". The server will then fall through to
+ # the next query, which is just "yes, that's fine".
#
query = "SELECT true"
WHERE ${...acct_table1}.acctuniqueid = '%{Acct-Unique-Session-Id}' \
AND ${...acct_table1}.acctstoptime IS NULL"
- # and again where we don't have "AND AcctStopTime IS NULL"
+ # and again where we don't have "AND AcctStopTime IS NULL"
query = "\
UPDATE ${...acct_table1} \
SET \
ON CONFLICT (acctuniqueid) \
DO NOTHING"
- # and again where we don't have "AND AcctStopTime IS NULL"
+ # and again where we don't have "AND AcctStopTime IS NULL"
query = "\
UPDATE ${...acct_table2} \
SET \
#######################################################################
-# Authentication Logging Queries
+# Authentication Logging Queries
#######################################################################
-# send queries - Insert some info after authentication
+# send queries - Insert some info after authentication
#######################################################################
send {
- # Write SQL queries to a logfile. This is potentially useful for bulk inserts
- # when used with the rlm_sql_null driver.
+ # Write SQL queries to a logfile. This is potentially useful for
+ # bulk inserts when used with the rlm_sql_null driver.
# logfile = ${logdir}/post-auth.sql
access-accept {
# -*- text -*-
#
-# main/sqlite/queries.conf -- SQLite configuration for default schema (schema.sql)
+# main/sqlite/queries.conf -- SQLite configuration for default schema
+# (schema.sql)
#
# $Id$
-# Safe characters list for sql queries. Everything else is replaced
-# with their mime-encoded equivalents.
-# The default list should be ok
+# Safe characters list for sql queries. Everything else is replaced
+# with their mime-encoded equivalents. The default list should be ok
#safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"
#######################################################################
-# Query config: Username
+# Query config: Username
#######################################################################
-# This is the username that will get substituted, escaped, and added
-# as attribute 'SQL-User-Name'. '%{SQL-User-Name}' can be used below
-# everywhere a username substitution is needed for consistency.
+# This is the username that will get substituted, escaped, and added
+# as attribute 'SQL-User-Name'. '%{SQL-User-Name}' can be used below
+# everywhere a username substitution is needed for consistency.
#
-# Uncomment the next line, if you want the sql_user_name to mean:
+# Uncomment the next line, if you want the sql_user_name to mean:
#
# Use Stripped-User-Name, if it's there.
# Else use User-Name, if it's there,
sql_user_name = "%{User-Name}"
#######################################################################
-# Query config: Event-Timestamp
+# Query config: Event-Timestamp
#######################################################################
-# event_timestamp_epoch is the basis for the time inserted into
-# accounting records. Typically this will be the Event-Timestamp of the
-# accounting request, which is usually provided by a NAS.
+# event_timestamp_epoch is the basis for the time inserted into
+# accounting records. Typically this will be the Event-Timestamp of
+# the accounting request, which is usually provided by a NAS.
#
-# Uncomment the next line, if you want the timestamp to be based on the
-# request reception time recorded by this server, for example if you
-# distrust the provided Event-Timestamp.
+# Uncomment the next line, if you want the timestamp to be based on
+# the request reception time recorded by this server, for example if
+# you distrust the provided Event-Timestamp.
#event_timestamp_epoch = "%l"
event_timestamp_epoch = %{((integer) Event-Timestamp) || %l}
-# event_timestamp is the SQL snippet for converting an epoch timestamp
-# to an SQL date.
+# event_timestamp is the SQL snippet for converting an epoch
+# timestamp to an SQL date.
event_timestamp = "${event_timestamp_epoch}"
-# NOTE: Recent SQLite versions allow proper arithmetic with dates
-# stored as strings including comparison using an index, so we keep
-# these variables differentiated in preparation for switching away from
-# integer storage.
+# NOTE: Recent SQLite versions allow proper arithmetic with dates
+# stored as strings including comparison using an index, so we keep
+# these variables differentiated in preparation for switching away
+# from integer storage.
#######################################################################
-# Authorization Queries
+# Authorization Queries
#######################################################################
-# These queries compare the check items for the user
-# in ${authcheck_table} and setup the reply items in
-# ${authreply_table}. You can use any query/tables
-# you want, but the return data for each row MUST
-# be in the following order:
+# These queries compare the check items for the user in
+# ${authcheck_table} and setup the reply items in ${authreply_table}.
+# You can use any query/tables you want, but the return data for each
+# row MUST be in the following order:
#
-# 0. Row ID (currently unused)
-# 1. UserName/GroupName
-# 2. Item Attr Name
-# 3. Item Attr Value
-# 4. Item Attr Operation
+# 0. Row ID (currently unused)
+# 1. UserName/GroupName
+# 2. Item Attr Name
+# 3. Item Attr Value
+# 4. Item Attr Operation
#######################################################################
#
# ORDER BY id"
#
-# The default queries are case insensitive. (for compatibility with older versions of FreeRADIUS)
+# The default queries are case insensitive. (for compatibility with
+# older versions of FreeRADIUS)
#
authorize_check_query = "\
SELECT id, username, attribute, value, op \
ORDER BY id"
#
-# Use these for case sensitive usernames.
+# Use these for case sensitive usernames.
#
#group_membership_query = "\
# SELECT groupname \
ORDER BY id"
#######################################################################
-# Accounting and Send Queries
+# Accounting and Send Queries
#######################################################################
-# These queries insert/update accounting and authentication records.
-# The query to use is determined by the name of the section the module
-# is called from.
+# These queries insert/update accounting and authentication records.
+# The query to use is determined by the name of the section the
+# module is called from.
#
-# e.g. when called from `accouting Start`, the contents of
+# e.g. when called from `accouting Start`, the contents of
#
-# accounting {
+# accounting {
# start {}
-# }
+# }
#
-# will be read, and any "query" entries will be run in sequence
-# until one returns a positive number of modified rows.
+# will be read, and any "query" entries will be run in sequence until
+# one returns a positive number of modified rows.
#######################################################################
accounting {
- # Write SQL queries to a logfile. This is potentially useful for bulk inserts
- # when used with the rlm_sql_null driver.
+ # Write SQL queries to a logfile. This is potentially useful for
+ # bulk inserts when used with the rlm_sql_null driver.
# logfile = ${logdir}/accounting.sql
column_list = "\
#
# "Bulk update" Accounting-On/Off strategy.
#
- # Immediately terminate all sessions associated with a
- # given NAS.
+ # Immediately terminate all sessions associated with a given NAS.
#
- # NOTE: If a large number of sessions require closing
- # then the bulk update may be take a long time to run
- # and lock an excessive number of rows. See the
- # strategy below for an alternative approach that does
- # not touch the radacct session data.
+ # NOTE: If a large number of sessions require closing then the bulk
+ # update may be take a long time to run and lock an excessive
+ # number of rows. See the strategy below for an alternative
+ # approach that does not touch the radacct session data.
#
query = "\
UPDATE ${...acct_table1} \
# "Lightweight" Accounting-On/Off strategy.
#
- # Record the reload time of the NAS and let the
- # administrator actually close the sessions in radacct
- # out-of-band, if desired.
+ # Record the reload time of the NAS and let the administrator
+ # actually close the sessions in radacct out-of-band, if desired.
#
- # Implementation advice, together with a stored
- # procedure for closing sessions and a view showing
- # the effective stop time of each session is provided
- # in process-radacct.sql.
+ # Implementation advice, together with a stored procedure for
+ # closing sessions and a view showing the effective stop time of
+ # each session is provided in process-radacct.sql.
#
- # To enable this strategy, just change the previous
- # query to "-query", and this one to "query". The
- # previous one will be ignored, and this one will be
- # enabled.
+ # To enable this strategy, just change the previous query to
+ # "-query", and this one to "query". The previous one will be
+ # ignored, and this one will be enabled.
#
-query = "\
INSERT OR REPLACE INTO nasreload (nasipaddress, reloadtime) \
VALUES ('%{NAS-IP-Address}', ${...event_timestamp})"
#
- # If there are no open user sessions, then the previous query
- # will return "no rows updated". The server will then fall through
- # to the next query, which is just "yes, that's fine".
+ # If there are no open user sessions, then the previous query will
+ # return "no rows updated". The server will then fall through to
+ # the next query, which is just "yes, that's fine".
#
query = "SELECT true"
'%{Class}')"
#
- # Key constraints prevented us from inserting a new session,
- # use the alternate query to update an existing session.
+ # Key constraints prevented us from inserting a new session, use
+ # the alternate query to update an existing session.
#
query = "\
UPDATE ${...acct_table1} SET \
interim-update {
#
- # Update an existing session and calculate the interval
- # between the last data we received for the session and this
- # update. This can be used to find stale sessions.
+ # Update an existing session and calculate the interval between the
+ # last data we received for the session and this update. This can
+ # be used to find stale sessions.
#
query = "\
UPDATE ${...acct_table1} \
WHERE acctuniqueid = '%{Acct-Unique-Session-Id}'"
#
- # The update condition matched no existing sessions. Use
- # the values provided in the update to create a new session.
+ # The update condition matched no existing sessions. Use the values
+ # provided in the update to create a new session.
#
query = "\
INSERT INTO ${...acct_table1} \
WHERE acctuniqueid = '%{Acct-Unique-Session-Id}'"
#
- # The update condition matched no existing sessions. Use
- # the values provided in the update to create a new session.
+ # The update condition matched no existing sessions. Use the values
+ # provided in the update to create a new session.
#
query = "\
INSERT INTO ${...acct_table2} \
#######################################################################
-# Authentication Logging Queries
+# Authentication Logging Queries
#######################################################################
-# send queries - Insert some info after authentication
+# send queries - Insert some info after authentication
#######################################################################
send {
- # Write SQL queries to a logfile. This is potentially useful for bulk inserts
- # when used with the rlm_sql_null driver.
+ # Write SQL queries to a logfile. This is potentially useful for
+ # bulk inserts when used with the rlm_sql_null driver.
# logfile = ${logdir}/post-auth.sql
access-accept {
-# -*- text -*-
-# $Id$
+# -*- text -*- $Id$
#######################################################################
-# We check for this prefix to determine whether the class
-# value was generated by this server. It should be changed
-# so that it is globally unique.
+# We check for this prefix to determine whether the class value was
+# generated by this server. It should be changed so that it is
+# globally unique.
class_value_prefix = 'ai:'
#
#
acct_unique {
#
- # If we have a class attribute in the format
- # 'auth_id:[0-9a-f]{32}' it'll have a local value
- # (defined by insert_acct_class), this ensures
- # uniqueness and suitability.
+ # If we have a class attribute in the format 'auth_id:[0-9a-f]{32}'
+ # it'll have a local value (defined by insert_acct_class), this
+ # ensures uniqueness and suitability.
#
- # We could just use the Class attribute as
- # Acct-Unique-Session-Id, but this may cause problems
- # with NAS that carry Class values across between
- # multiple linked sessions. So we rehash class with
- # Acct-Session-ID to provide a truly unique session
- # identifier.
+ # We could just use the Class attribute as Acct-Unique-Session-Id,
+ # but this may cause problems with NAS that carry Class values
+ # across between multiple linked sessions. So we rehash class with
+ # Acct-Session-ID to provide a truly unique session identifier.
#
- # Using a Class/Session-ID combination is more robust
- # than using elements in the Accounting-Request,
- # which may be subject to change, such as
- # NAS-IP-Address, Net.Src.IP and
+ # Using a Class/Session-ID combination is more robust than using
+ # elements in the Accounting-Request, which may be subject to
+ # change, such as NAS-IP-Address, Net.Src.IP and
# NAS-Port-ID/NAS-Port.
#
- # This policy should ensure that session data is not
- # affected if NAS IP addresses change, or the client
- # roams to a different 'port' whilst maintaining its
- # initial authentication session (Common in a
+ # This policy should ensure that session data is not affected if NAS
+ # IP addresses change, or the client roams to a different 'port'
+ # whilst maintaining its initial authentication session (Common in a
# wireless environment).
#
if (Class =~ /${policy.class_value_prefix}([0-9a-f]{32})/i) {
}
#
- # Not All devices respect RFC 2865 when dealing with
- # the class attribute, so be prepared to use the
- # older style of hashing scheme if a class attribute
- # is not included
+ # Not All devices respect RFC 2865 when dealing with the class
+ # attribute, so be prepared to use the older style of hashing scheme
+ # if a class attribute is not included
#
else {
request.Acct-Unique-Session-Id := %hex(%hash.md5("%{User-Name},%{Acct-Multi-Session-ID},%{Acct-Session-ID},%{NAS-IPv6-Address || NAS-IP-Address},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}"))
#
# Split User-Name in NAI format (RFC 7542) into components
#
-# This policy writes the Username and Domain portions of the
-# NAI into the Stripped-User-Name and Stripped-User-Domain
-# attributes.
+# This policy writes the Username and Domain portions of the NAI into
+# the Stripped-User-Name and Stripped-User-Domain attributes.
#
-# The regular expression to do this is not strictly compliant
-# with the standard, but it is not possible to write a
-# compliant regexp without perl style regular expressions (or
-# at least not a legible one).
+# The regular expression to do this is not strictly compliant with
+# the standard, but it is not possible to write a compliant regexp
+# without perl style regular expressions (or at least not a legible
+# one).
#
-# i.e. this regular expression will accept all valid NAIs,
-# and will not reject valid NAIs. Unfortunately, it will also
-# accept invalid NAIs.
+# i.e. this regular expression will accept all valid NAIs, and will
+# not reject valid NAIs. Unfortunately, it will also accept invalid
+# NAIs.
#
nai_regexp = '^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$'
request.Stripped-User-Name := "%{1}"
- # Only add the Stripped-User-Domain attribute if
- # we have a domain. This means presence checks
- # for Stripped-User-Domain work.
+ # Only add the Stripped-User-Domain attribute if we have a domain.
+ # This means presence checks for Stripped-User-Domain work.
if ("%{3}" != '') {
request.Stripped-User-Domain = "%{3}"
}
- # If any of the expansions result in a null
- # string, the update section may return
- # something other than updated...
+ # If any of the expansions result in a null string, the update
+ # section may return something other than updated...
updated
}
else {
# Add "rewrite_called_station_id" in the "recv Access-Request" and
# "recv Accounting-Request" sections.
#
-# Makes Called-Station-ID conform to what RFC3580 says should
-# be provided by 802.1X authenticators.
+# Makes Called-Station-ID conform to what RFC3580 says should be
+# provided by 802.1X authenticators.
#
rewrite_called_station_id {
if (Called-Station-Id && (Called-Station-Id =~ /^${policy.mac-addr-regexp}([^0-9a-f](.+))?$/i)) {
# If this is being used with rlm_dpsk, populate the binary MAC address of the AP
# request.Called-Station-MAC := %bin("%{1}%{2}%{3}%{4}%{5}%{6}")
- # SSID component?
+ # SSID component?
if (%{8}) {
request.Called-Station-SSID := %{8}
}
# Add "rewrite_calling_station_id" in the "recv Access-Request" and
# "recv Accounting-Request" sections.
#
-# Makes Calling-Station-ID conform to what RFC3580 says should
-# be provided by 802.1X authenticators.
+# Makes Calling-Station-ID conform to what RFC3580 says should be
+# provided by 802.1X authenticators.
#
rewrite_calling_station_id {
if (Calling-Station-Id && (Calling-Station-Id =~ /^${policy.mac-addr-regexp}$/i)) {
#
-# If you want the server to pretend that it is dead,
-# then use the "do_not_respond" policy.
+# If you want the server to pretend that it is dead, then use the
+# "do_not_respond" policy.
#
do_not_respond {
reply.Packet-Type := ::Do-Not-Respond
#
-# The following policies are for the Chargeable-User-Identity
-# (CUI) configuration.
+# The following policies are for the Chargeable-User-Identity (CUI)
+# configuration.
#
-# The policies below can be called as just 'cui' (not
-# cui.authorize etc..) from the various config sections.
+# The policies below can be called as just 'cui' (not cui.authorize
+# etc..) from the various config sections.
#
#
-# cui_hash_key definition
-# This key serves the purpose of protecting CUI values against
-# dictionary attacks, therefore should be chosen as a "random"
-# string and kept secret.
+# cui_hash_key definition This key serves the purpose of protecting
+# CUI values against dictionary attacks, therefore should be chosen
+# as a "random" string and kept secret.
#
cui_hash_key = "changeme"
#
-# cui_require_operator_name switch
-# If this is set to nonzero value then CUI will only be added
-# when a non-empty Operator-Name value is present in the request
+# cui_require_operator_name switch If this is set to nonzero value
+# then CUI will only be added when a non-empty Operator-Name value is
+# present in the request
#
cui_require_operator_name = "no"
#
# The client indicates it can do CUI by sending a CUI attribute
-# containing one zero byte.
-# A non-empty value in Operator-Name can be an additional requirement.
-# Normally CUI support is turned on only for such requests.
-# CUI support can be used for local clients which do not
-# supports CUI themselves, the server can simulate a CUI request
-# adding the missing NUL CUI value and the Operator-Name attribute.
-# Clients which are supposed to get this treatment should
-# be marked by add_cui flag in clients.conf
-# We assume that local clients are marked in the client.conf with
-# add_cui flag, e.g.
+# containing one zero byte. A non-empty value in Operator-Name can be
+# an additional requirement. Normally CUI support is turned on only
+# for such requests. CUI support can be used for local clients which
+# do not supports CUI themselves, the server can simulate a CUI
+# request adding the missing NUL CUI value and the Operator-Name
+# attribute. Clients which are supposed to get this treatment should
+# be marked by add_cui flag in clients.conf We assume that local
+# clients are marked in the client.conf with add_cui flag, e.g.
# client xxxx {
# ...
# add_cui = yes
#
-# Add a CUI attribute based on the User-Name, and a secret key
-# known only to this server.
-# For EAP-TTLS and EAP-PEAP methods
+# Add a CUI attribute based on the User-Name, and a secret key known
+# only to this server. For EAP-TTLS and EAP-PEAP methods
# use_tunneled_reply parameter MUST be set to yes
#
cui.post-auth {
}
#
- # The section below will store a CUI for the User in the DB and remove the
- # User-Name attribute from the reply if a CUI is present.
+ # The section below will store a CUI for the User in the DB and
+ # remove the User-Name attribute from the reply if a CUI is present.
#
- # You need to configure the cuisql module and your database for this to work.
- # If your NAS can do CUI based accounting themselves or you do not care about
- # accounting, comment out the 'cuisql' line below.
+ # You need to configure the cuisql module and your database for this
+ # to work. If your NAS can do CUI based accounting themselves or you
+ # do not care about accounting, comment out the 'cuisql' line below.
#
if (reply.Chargeable-User-Identity) {
- # Force User-Name to be the User-Name from the request
+ # Force User-Name to be the User-Name from the request
reply.User-Name := request.User-Name
cuisql
cui-inner.post-auth {
- if (outer.request.Chargeable-User-Identity && \
+ if (outer.request.Chargeable-User-Identity &&
(outer.request.Operator-Name || ('${policy.cui_require_operator_name}' != 'yes'))) {
reply.Chargeable-User-Identity := %sha1("${policy.cui_hash_key}%str.lower(%{User-Name}%{outer.request.Operator-Name || ''})")
}
#
cui.accounting {
#
- # If the CUI isn't in the packet, see if we can find it
- # in the DB.
+ # If the CUI isn't in the packet, see if we can find it in the DB.
#
if (!Chargeable-User-Identity) {
request.Chargeable-User-Identity := %cuisql("SELECT cui FROM cui WHERE clientipaddress = '%{Net.Src.IP}' AND callingstationid = '%{Calling-Station-Id}'AND username = '%{User-Name}'")
}
#
- # If it exists now, then write out when we last saw
- # this CUI.
+ # If it exists now, then write out when we last saw this CUI.
#
if (Chargeable-User-Identity && (Chargeable-User-Identity != '')) {
cuisql
}
#
-# Outputs the contents of the session state list in debugging (-X) mode
+# Outputs the contents of the session state list in debugging (-X)
+# mode
#
debug_session_state {
if (%pairs.debug('session-state')) {
# A policy to set options required in all DHCP replies
dhcp_common {
#
- # The contents here are invented. Change them!
- # Lease time is referencing the lease time set in the
- # named module instance configuration
+ # The contents here are invented. Change them! Lease time is
+ # referencing the lease time set in the named module instance
+ # configuration
#
reply += {
#
permit_only_eap {
if (!EAP-Message) {
- # We MAY be inside of a TTLS tunnel.
- # PEAP and EAP-FAST require EAP inside of
- # the tunnel, so this check is OK.
- # If so, then there MUST be an outer EAP message.
+ # We MAY be inside of a TTLS tunnel. PEAP and EAP-FAST require EAP
+ # inside of the tunnel, so this check is OK. If so, then there MUST
+ # be an outer EAP message.
if (!outer.request || !outer.request.EAP-Message) {
reject
}
#
use_tunneled_reply {
#
- # These attributes are for the inner-tunnel only,
- # and MUST NOT be copied to the outer reply.
+ # These attributes are for the inner-tunnel only, and MUST NOT be
+ # copied to the outer reply.
#
reply -= User-Name[*]
#
# Copy the remaining inner reply attributes to the outer
- # session-state list. This list is preserved across multiple
+ # session-state list. This list is preserved across multiple
# Access-Request / Access-Challenge exchanges.
#
- # When the final Access-Accept is ready to be sent, The
- # 'send Access-Accept' policy in sites-available/default will
- # copy the outer session-state list to the final reply.
+ # When the final Access-Accept is ready to be sent, The 'send
+ # Access-Accept' policy in sites-available/default will copy the
+ # outer session-state list to the final reply.
#
outer.session-state += reply
}
#
# Filter the username
#
-# Force some sanity on User-Name. This helps to avoid issues
-# issues where the back-end database is "forgiving" about
-# what constitutes a user name.
+# Force some sanity on User-Name. This helps to avoid issues issues
+# where the back-end database is "forgiving" about what constitutes a
+# user name.
#
filter_username {
if (State) {
#
# reject mixed case e.g. "UseRNaMe"
#
- #if (User-Name != %str.lower(User-Name)) {
+ # if (User-Name != %str.lower(User-Name)) {
# reject
- #}
+ # }
#
- # reject all whitespace
- # e.g. "user@ site.com", or "us er", or " user", or "user "
+ # reject all whitespace e.g. "user@ site.com", or "us er", or "
+ # user", or "user "
#
if (User-Name =~ / /) {
request += {
}
#
- # reject Multiple @'s
- # e.g. "user@site.com@site.com"
+ # reject Multiple @'s e.g. "user@site.com@site.com"
#
if (User-Name =~ /@[^@]*@/ ) {
request += {
}
#
- # reject double dots
- # e.g. "user@site..com"
+ # reject double dots e.g. "user@site..com"
#
if (User-Name =~ /\.\./ ) {
request += {
}
#
- # must have at least 1 string-dot-string after @
- # e.g. "user@site.com"
+ # must have at least 1 string-dot-string after @ e.g.
+ # "user@site.com"
#
if ((User-Name =~ /@/) && (User-Name !~ /@[^.]+(\.[^.]+)+$/)) {
request += {
}
#
- # Realm ends with a dot
- # e.g. "user@site.com."
+ # Realm ends with a dot e.g. "user@site.com."
#
if (User-Name =~ /\.$/) {
request += {
}
#
- # Realm begins with a dot
- # e.g. "user@.site.com"
+ # Realm begins with a dot e.g. "user@.site.com"
#
if (User-Name =~ /@\./) {
request += {
#
# Filter the User-Password
#
-# Some equipment sends passwords with embedded zeros.
-# This policy filters them out.
+# Some equipment sends passwords with embedded zeros. This policy
+# filters them out.
#
filter_password {
if User-Password {
- group tmp
+ group tmp
octets delim
#
}
#
- # Do detailed checks only if the inner and outer
- # NAIs are different.
+ # Do detailed checks only if the inner and outer NAIs are different.
#
- # If the NAIs are the same, it violates user privacy,
- # but is allowed.
+ # If the NAIs are the same, it violates user privacy, but is
+ # allowed.
#
if (outer.request.User-Name != User-Name) {
#
request.Outer-Realm-Name = %{1}
#
- # When we have an outer realm name, the user portion
- # MUST either be empty, or begin with "anon".
+ # When we have an outer realm name, the user portion MUST either
+ # be empty, or begin with "anon".
#
- # We don't check for the full "anonymous", because
- # some vendors don't follow the standards.
+ # We don't check for the full "anonymous", because some vendors
+ # don't follow the standards.
#
if (outer.request.User-Name !~ /^(anon|@)/) {
request += {
}
#
- # There's no outer realm. The outer NAI is different from the
- # inner NAI. The User-Name MUST be anonymized.
+ # There's no outer realm. The outer NAI is different from the inner
+ # NAI. The User-Name MUST be anonymized.
#
- # Otherwise, you could log in as outer "bob", and inner "doug",
- # and we'd have no idea which one was correct.
+ # Otherwise, you could log in as outer "bob", and inner "doug", and
+ # we'd have no idea which one was correct.
#
elsif (outer.request.User-Name !~ /^anon/) {
request += {
request.Inner-Realm-Name = %{1}
#
- # Note that we do EQUALITY checks for realm names.
- # There is no simple way to do case insensitive checks
- # on internationalized domain names. There is no reason
- # to allow outer "anonymous@EXAMPLE.COM" and inner
- # "user@example.com". The user should enter the same
- # realm for both identities.
+ # Note that we do EQUALITY checks for realm names. There is no
+ # simple way to do case insensitive checks on internationalized
+ # domain names. There is no reason to allow outer
+ # "anonymous@EXAMPLE.COM" and inner "user@example.com". The user
+ # should enter the same realm for both identities.
#
- # If the inner realm isn't the same as the outer realm,
- # the inner realm MUST be a subdomain of the outer realm.
+ # If the inner realm isn't the same as the outer realm, the inner
+ # realm MUST be a subdomain of the outer realm.
#
- if (Outer-Realm-Name && \
+ if (Outer-Realm-Name &&
(Inner-Realm-Name != Outer-Realm-Name) && \
(Inner-Realm-Name !~ /\.%{Outer-Realm-Name}$/)) {
request += {
#
# It's OK to have an inner realm and no outer realm.
#
- # That won't work for roaming, but the local RADIUS server
- # can still authenticate the user.
+ # That won't work for roaming, but the local RADIUS server can
+ # still authenticate the user.
#
}
#
# It's OK to have an outer realm and no inner realm.
#
- # It will work for roaming, and the local RADIUS server
- # can authenticate the user without the realm.
+ # It will work for roaming, and the local RADIUS server can
+ # authenticate the user without the realm.
#
}
}
#
-# The following policies are for the Operator-Name
-# configuration.
+# The following policies are for the Operator-Name configuration.
#
# The policies below can be called as just 'operator-name' (not
-# operator-name.authorize etc..) from the various config sections.
+# operator-name.authorize etc..) from the various config sections.
#
-# If you require that the Operator-Name be set
-# for local clients then call the 'operator-name' policy
-# in the "recv Access-Request" section of the virtual-server for your clients in clients.conf
+# If you require that the Operator-Name be set for local clients then
+# call the 'operator-name' policy in the "recv Access-Request"
+# section of the virtual-server for your clients in clients.conf
# To inject an Operator-Name whilst proxying, call the
-# 'operator-name' policy in the pre-proxy section of the virtual server
-# No need to call this if you have already enabled this in
-# the "recv Access-Request" section.
+# 'operator-name' policy in the pre-proxy section of the virtual
+# server No need to call this if you have already enabled this in the
+# "recv Access-Request" section.
#
-# We assume that clients can have the operator-name definition
-# in the client.conf, e.g.
-# client xxxx {
+# We assume that clients can have the operator-name definition in the
+# client.conf, e.g. client xxxx {
# ...
# Operator-Name = 1your.domain
-# }
-# If this parameter is found for a client, then we add
-# an Operator-Name attribute
+# } If this parameter is found for a client, then we add an
+# Operator-Name attribute
#
operator-name.authorize {
if ("%client('Operator-Name')") {
#
-# Handles the Expiration attribute
+# Handles the Expiration attribute
#
expiration {
if (control.Expiration) {
#
-# Convert broadsoft 255 attributes in the form <attr number>=value
-# to internal broadsoft attributes with numbers > 256.
-# There is currently no way to automatically re-encode those
-# attributes, but it can be done with unlang for specific ones.
+# Convert broadsoft 255 attributes in the form <attr number>=value to
+# internal broadsoft attributes with numbers > 256. There is
+# currently no way to automatically re-encode those attributes, but
+# it can be done with unlang for specific ones.
#
broadsoft-decode {
foreach value ( BroadSoft-Attr-255 ) {
#
# = Proxy Configuration
#
-# The `proxy.conf` file is not used in version 4. The functionality
+# The `proxy.conf` file is not used in version 4. The functionality
# in the old proxy.conf has moved.
#
# For detailed information on upgrading, see:
#
# The `home_server` definitions are now just RADIUS modules.
#
-# See `mods-available/radius`. You can create a module for each home
-# server. The configuration is very similar.
+# See `mods-available/radius`. You can create a module for each home
+# server. The configuration is very similar.
#
# You can also send packets to dynamic home servers, without updating
-# the configuration or adding new modules!. See the
+# the configuration or adding new modules!. See the
# `%proxy.sendto.ipaddr()` function in `mods-enabled/radius`.
#
# == home_server_pool sections
# The `home_server_pool` sections are now just virtual modules.
#
# See the `load-balance`, `redundant`, and `redundant-load-balance`
-# keywords. Since a `home_server` is now just a RADIUS module, there
+# keywords. Since a `home_server` is now just a RADIUS module, there
# is no need to have a separate configuration for load-balanced pools
# of home servers!
#
# take an optional parameter which can be used to do keyed load
# balancing.
#
-# The `instantiate` section is also gone from v4. Instead, you can
-# just create a "virtual" module, by putting a `load-balance`
-# section as a file directly in the `mods-enabled/` directory.
+# The `instantiate` section is also gone from v4. Instead, you can
+# just create a "virtual" module, by putting a `load-balance` section
+# as a file directly in the `mods-enabled/` directory.
#
# i.e. instead of using this in `proxy.conf`:
#
#
# == Realms
#
-# There is "realm" configuration section. The `realms` module has also been removed.
+# There is "realm" configuration section. The `realms` module has
+# also been removed.
#
# @todo - this should really be addressed before a v4 release.
#
# radiusd -n radrelay
#
# This file is a sample configuration that replaces the old
-# `radrelay` program. It is a _minimal_ configuration that
-# does little more than read the `detail` file, and proxy the
-# packets to a home server. If you need it to do more than
-# just replace `radrelay`, you will need to add additional
-# configuration.
-#
-# See `sites-available/copy-acct-to-home-server` for a
-# more complete example. That example is intended to be run
-# as part of a larger RADIUS configuration, where the server
-# also listens on ports 1812, etc. The example given here
-# is a minimal example that has *only* `radrelay` functionality.
+# `radrelay` program. It is a _minimal_ configuration that does
+# little more than read the `detail` file, and proxy the packets to a
+# home server. If you need it to do more than just replace
+# `radrelay`, you will need to add additional configuration.
+#
+# See `sites-available/copy-acct-to-home-server` for a more complete
+# example. That example is intended to be run as part of a larger
+# RADIUS configuration, where the server also listens on ports 1812,
+# etc. The example given here is a minimal example that has *only*
+# `radrelay` functionality.
#
# See `radiusd.conf` for a complete description of the configuration
# parameters used here.
#
-# ## Why radrelay is needed
+# == Why radrelay is needed
#
-# Many sites run multiple radius servers; at least one primary and one
-# backup server. When the primary goes down, most NASes will detect that
-# and switch to the backup server.
+# Many sites run multiple radius servers; at least one primary and
+# one backup server. When the primary goes down, most NASes will
+# detect that and switch to the backup server.
#
# That change will cause your accounting packets to go the backup
# server - and some NASes will not switch back to the primary server
#
# The result is that accounting records are missed, and/or the
# administrator must jump through hoops in order to combine the
-# different detail files from multiple servers. It also means that the
-# accounting database gets out of sync.
+# different detail files from multiple servers. It also means that
+# the accounting database gets out of sync.
#
-# `radrelay` solves this issue by "relaying" packets from one server to
-# another, so they both have the same set of accounting data.
+# `radrelay` solves this issue by "relaying" packets from one server
+# to another, so they both have the same set of accounting data.
#
# == Overload
#
# If the RADIUS server suddenly receives a many accounting packets,
# there may be insufficient CPU power to process them all in a timely
-# manner. This problem is especially noticeable when the accounting
+# manner. This problem is especially noticeable when the accounting
# packets are going to a back-end database.
#
-# Similarly, you may have one database that tracks "live" sessions, and
-# another that tracks historical accounting data. In that case,
-# accessing the first database is fast, as it is small. Accessing the
-# second database many be slower, as it may contain multiple gigabytes
-# of data. In addition, writing to the first database in a timely
-# manner is important, while data may be written to the second database
-# with a few minutes delay, without any harm being done.
+# Similarly, you may have one database that tracks "live" sessions,
+# and another that tracks historical accounting data. In that case,
+# accessing the first database is fast, as it is small. Accessing the
+# second database many be slower, as it may contain multiple
+# gigabytes of data. In addition, writing to the first database in a
+# timely manner is important, while data may be written to the second
+# database with a few minutes delay, without any harm being done.
#
#
# == General definitions
#
-# The following options define where the server files are stored
-# when installed. They are set by 'make' at compile time, and it
-# is unlikely to need to change them.
+# The following options define where the server files are stored when
+# installed. They are set by 'make' at compile time, and it is
+# unlikely to need to change them.
#
prefix = @prefix@
exec_prefix = @exec_prefix@
pidfile = ${run_dir}/${name}.pid
#
-# Request handling configuration.
-# See radiusd.conf for documentation.
+# Request handling configuration. See radiusd.conf for documentation.
#
max_request_time = 30
cleanup_delay = 5
#
# == Logging configuration
#
-# The following section defines global server logging options.
-# For more configurable and detailed logging, the logging modules
-# should be used (`rlm_detail`, `rlm_linelog` etc.)
+# The following section defines global server logging options. For
+# more configurable and detailed logging, the logging modules should
+# be used (`rlm_detail`, `rlm_linelog` etc.)
#
log {
#
# file:: The logging messages for the server are appended to the
# tail of this file `if ${destination} == "file"`
#
- # NOTE: If the server is running in debugging mode, this file is
- # NOT used.
+ # NOTE: If the server is running in debugging mode, this file is NOT
+ # used.
#
file = ${logdir}/${name}.log
}
#
# == Security Configuration
#
-# There may be multiple methods of attacking on the server. This
-# section holds the configuration items which minimize the impact
-# of those attacks
+# There may be multiple methods of attacking on the server. This
+# section holds the configuration items which minimize the impact of
+# those attacks
#
security {
#
- # max_attributes:: The maximum number of attributes
- # permitted in a RADIUS packet. Packets which have MORE
- # than this number of attributes in them will be dropped.
+ # max_attributes:: The maximum number of attributes permitted in a
+ # RADIUS packet. Packets which have MORE than this number of
+ # attributes in them will be dropped.
#
- # If this number is set too low, then no RADIUS packets
- # will be accepted.
+ # If this number is set too low, then no RADIUS packets will be
+ # accepted.
#
- # If this number is set too high, then an attacker may be
- # able to send a small number of packets which will cause
- # the server to use all available memory on the machine.
+ # If this number is set too high, then an attacker may be able to
+ # send a small number of packets which will cause the server to use
+ # all available memory on the machine.
#
# Setting this number to 0 means "allow any number of attributes"
#
max_attributes = 200
#
- # reject_delay && status_server don't apply when we are
- # only reading accounting packets from the detail file
+ # reject_delay && status_server don't apply when we are only reading
+ # accounting packets from the detail file
#
@openssl_version_check_config@
# == Home server configuration
#
#
-# NOTE: Proxying has changed in v4. This example is no longer correct.
+# NOTE: Proxying has changed in v4. This example is no longer
+# correct.
#
#
-# Define a `home server`, which is where packets should be
-# relayed to.
+# Define a `home server`, which is where packets should be relayed
+# to.
#
home_server home1 {
#
type = acct
#
- # ipaddr:: This directive replaces the `-r` command-line option
- # in `radrelay`.
+ # ipaddr:: This directive replaces the `-r` command-line option in
+ # `radrelay`.
#
ipaddr = 192.0.2.20
# src_ipaddr = 192.0.2.1
#
- # secret:: This directive replaces the `-s`, `-S`, and `-n` command-line
- # options in `radrelay`.
+ # secret:: This directive replaces the `-s`, `-S`, and `-n`
+ # command-line options in `radrelay`.
#
secret = testing123
}
#
-# List one or more home servers here for fail-over,
-# load-balancing, etc. By default we just send all relayed
-# packets to the one home server, `home1`, defined above.
+# List one or more home servers here for fail-over, load-balancing,
+# etc. By default we just send all relayed packets to the one home
+# server, `home1`, defined above.
#
home_server_pool radrelay {
type = fail-over
type = detail
#
- # filename:: The filename here should be the same as the one used by the
- # main `radiusd` program.
+ # filename:: The filename here should be the same as the one used
+ # by the main `radiusd` program.
#
- # It writes the file using the `detail` module (see `modules/detail`).
+ # It writes the file using the `detail` module (see
+ # `modules/detail`).
#
filename = ${radacctdir}/detail
#
# This section is called when the server receives an
- # Accounting-Request packet (which will be from the
- # "detail" reader above.
+ # Accounting-Request packet (which will be from the "detail" reader
+ # above.
#
- # See also `sites-available/copy-acct-to-home-server`
- # for additional description.
+ # See also `sites-available/copy-acct-to-home-server` for additional
+ # description.
#
recv Accounting-Request {
#
- # Proxy the packet using the given realm.
- # Note that we do not use the realm for anything else such
- # as prefix/suffix stripping, or comparisons.
+ # Proxy the packet using the given realm. Note that we do not use
+ # the realm for anything else such as prefix/suffix stripping, or
+ # comparisons.
#
update control {
Proxy-To-Realm := "radrelay"
# This is a virtual server which reads ARP packets
#
# It allows the administrator to log ARP packets on the local
-# network. The idea is that the ARP packets can be checked against a
-# database (e.g. DHCP), or stored in an ARP-specific database. If
+# network. The idea is that the ARP packets can be checked against a
+# database (e.g. DHCP), or stored in an ARP-specific database. If
# something funny is going on, this virtual server can produce syslog
# messages informing the administrator as to what happened.
#
# namespace::
#
# In v4, all "server" sections MUST start with a "namespace"
- # parameter. This tells the server which protocol is being used.
+ # parameter. This tells the server which protocol is being used.
#
- # All of the "listen" sections in this virtual server will
- # only accept packets for that protocol.
+ # All of the "listen" sections in this virtual server will only
+ # accept packets for that protocol.
#
namespace = arp
#
# === The listen section
#
- # The `listen` sections in v4 are very different from the
- # `listen sections in v3. The changes were necessary in
- # order to make FreeRADIUS more flexible, and to make the
- # configuration simpler and more consistent.
+ # The `listen` sections in v4 are very different from the `listen
+ # sections in v3. The changes were necessary in order to make
+ # FreeRADIUS more flexible, and to make the configuration simpler
+ # and more consistent.
#
listen {
#
#
# filter:: An optional PCAP filter.
#
- # If we want to receive only ARPs for a particular
- # IP address, then we list it here as `host foo`
+ # If we want to receive only ARPs for a particular IP address, then
+ # we list it here as `host foo`
#
- # You can also filter on ethernet via
- # `ether src foo` or `ether dst foo`.
+ # You can also filter on ethernet via `ether src foo` or `ether dst
+ # foo`.
#
- # Or to accept only ARP Request packets, and filter
- # out replies, use:
+ # Or to accept only ARP Request packets, and filter out replies,
+ # use:
#
# `(arp[6] == 0) and (arp[7] == 1)`
#
#
# active:: Whether or not we response to ARP requests
#
- # Generally we want an "arpwatch" style functionality,
- # so the default is `active = no`
+ # Generally we want an "arpwatch" style functionality, so the
+ # default is `active = no`
#
- # When `active = no`, the virtual server will NEVER
- # send an ARP reply.
+ # When `active = no`, the virtual server will NEVER send an ARP
+ # reply.
#
# active = no
}
#
# We are using it to determine if a `peer` application is up or down.
# For example, when two servers are configured in primary / secondary
-# mode, they should be set up as BFD peers. They can then detect
-# when the other one goes down.
+# mode, they should be set up as BFD peers. They can then detect when
+# the other one goes down.
#
-# The code is in FreeRADIUS because we want to know if the *application*
-# is running. It doesn't matter if the link is up, or if the host system
-# is running. If the FreeRADIUS daemon is down, then we want to know ASAP.
+# The code is in FreeRADIUS because we want to know if the
+# *application* is running. It doesn't matter if the link is up, or
+# if the host system is running. If the FreeRADIUS daemon is down,
+# then we want to know ASAP.
#
-# NOTE: See also `trigger.conf`. There are BFD-specific triggers
+# NOTE: See also `trigger.conf`. There are BFD-specific triggers
# which are executed when the link is started, goes up, down, or is
# administratively down.
#
namespace = bfd
#
- # Common configuration for the BFD state machine.
- # For now, unused.
+ # Common configuration for the BFD state machine. For now, unused.
#
bfd {
#
listen {
#
- # Only IP transport is supported for BFD.
- # There is no ethernet type for BFD.
+ # Only IP transport is supported for BFD. There is no ethernet type
+ # for BFD.
#
transport = udp
#
# ipaddr::
#
- # IP address, or IPv6 address as with other
+ # IP address, or IPv6 address as with other
#
ipaddr = 192.0.2.1
#
# only_state_changes::
#
- # In general the server only needs to know if the BFD session state has changed. Set
- # this value to "false" if you want every received and every sent packet to be
- # processed through this virtual server.
+ # In general the server only needs to know if the BFD session
+ # state has changed. Set this value to "false" if you want every
+ # received and every sent packet to be processed through this
+ # virtual server.
#
only_state_changes = true
}
#
# peer:: BFD peer
#
-# The peer definition is based on the `client` definition. The standard client configuration items will work
-# here.
+# The peer definition is based on the `client` definition. The
+# standard client configuration items will work here.
#
peer other {
#
port = 3784
#
- # src_ipaddr:: Source address used when sending packets to this peer.
+ # src_ipaddr:: Source address used when sending packets to this
+ # peer.
#
- # This source address should match a `listen` section above. If not source address is given, then a
- # "wildcard" listener will be chosen. i.e. A listener which has `ipaddr = *`
+ # This source address should match a `listen` section above. If not
+ # source address is given, then a "wildcard" listener will be
+ # chosen. i.e. A listener which has `ipaddr = *`
#
- # If the source IP address does not match any listener, then the peer will be ignored.
+ # If the source IP address does not match any listener, then the
+ # peer will be ignored.
#
# src_ipaddr = 192.0.2.1
#
# secret:: The secret key used for authentication.
#
- # If it starts with "0x", then it is treated as a hex string. This is recommended
- # for security. The secrets should be no more than 16 octets long, and random.
+ # If it starts with "0x", then it is treated as a hex string. This
+ # is recommended for security. The secrets should be no more than 16
+ # octets long, and random.
#
# secret = "hello"
min_receive_interval = 250ms
#
- # max_timeouts:: Max number of timeouts before the session is declared dead.
+ # max_timeouts:: Max number of timeouts before the session is
+ # declared dead.
#
max_timeouts = 3
#
# == Packet Processing sections
#
-# Unlike other protocols, BFD does not follow a "request / reply" process. Instead, there are two
-# independent streams of packets. One where the peer sends us packets (`recv foo { ... }`), and the other
+# Unlike other protocols, BFD does not follow a "request / reply"
+# process. Instead, there are two independent streams of packets. One
+# where the peer sends us packets (`recv foo { ... }`), and the other
# where we send packets to the peer (`send foo { ... }`).
#
-# Note that when running `send`, the packet contents *cannot be changed*. The contents of the BFD packet
-# are defined by the protocol. The `send` section is called only for informational purposes.
+# Note that when running `send`, the packet contents *cannot be
+# changed*. The contents of the BFD packet are defined by the
+# protocol. The `send` section is called only for informational
+# purposes.
#
#
#
# = Buffered SQL
#
-# The `radrelay` functionality is integrated into the
-# server core. This virtual server gives an example of
-# using `radrelay` functionality inside of the server.
+# The `radrelay` functionality is integrated into the server core.
+# This virtual server gives an example of using `radrelay`
+# functionality inside of the server.
#
-# In this example, the `detail` file is read, and the data
-# is put into SQL. This configuration is used when a RADIUS
-# server on this machine is receiving accounting packets,
-# and writing them to the detail file.
+# In this example, the `detail` file is read, and the data is put
+# into SQL. This configuration is used when a RADIUS server on this
+# machine is receiving accounting packets, and writing them to the
+# detail file.
#
-# The purpose of this virtual server is to decouple the storage
-# of long-term accounting data in SQL from "live" information
-# needed by the RADIUS server as it is running.
+# The purpose of this virtual server is to decouple the storage of
+# long-term accounting data in SQL from "live" information needed by
+# the RADIUS server as it is running.
#
# The benefit of this approach is that for a busy server, the
-# overhead of performing SQL queries may be significant. Also,
-# if the SQL databases are large (as is typical for ones storing
-# months of data), the `INSERTs` and `UPDATEs` may take a relatively
-# long time. Rather than slowing down the RADIUS server by
-# having it interact with a database, you can just log the
-# packets to a detail file, and then read that file later at a
-# time when the RADIUS server is typically lightly loaded.
+# overhead of performing SQL queries may be significant. Also, if the
+# SQL databases are large (as is typical for ones storing months of
+# data), the `INSERTs` and `UPDATEs` may take a relatively long time.
+# Rather than slowing down the RADIUS server by having it interact
+# with a database, you can just log the packets to a detail file, and
+# then read that file later at a time when the RADIUS server is
+# typically lightly loaded.
#
-# If you use on virtual server to log to the detail file,
-# and another virtual server (i.e. this one) to read from
-# the detail file, then this process will happen automatically.
-# A sudden spike of RADIUS traffic means that the detail file
-# will grow in size, and the server will be able to handle
-# large volumes of traffic quickly. When the traffic dies down,
-# the server will have time to read the detail file, and insert
-# the data into a long-term SQL database.
+# If you use on virtual server to log to the detail file, and another
+# virtual server (i.e. this one) to read from the detail file, then
+# this process will happen automatically. A sudden spike of RADIUS
+# traffic means that the detail file will grow in size, and the
+# server will be able to handle large volumes of traffic quickly.
+# When the traffic dies down, the server will have time to read the
+# detail file, and insert the data into a long-term SQL database.
#
#
#
# filename:: The location where the detail file is located.
#
- # IMPORTANT: This should be on local disk, and NOT on an NFS mounted location!
+ # IMPORTANT: This should be on local disk, and NOT on an NFS
+ # mounted location!
#
- # On most systems, this should support file globbing e.g. `${radacctdir}/detail-*:*"`
+ # On most systems, this should support file globbing e.g.
+ # `${radacctdir}/detail-*:*"`
#
- # This lets you write many smaller detail files as in the example in radiusd.conf:
- # `.../detail-%Y%m%d:%H` Writing many small files is often better than writing
- # one large file. File globbing also means that with a common naming scheme for
- # detail files, then you can have many detail file writers, and only one reader.
+ # This lets you write many smaller detail files as in the example
+ # in radiusd.conf: `.../detail-%Y%m%d:%H` Writing many small files
+ # is often better than writing one large file. File globbing also
+ # means that with a common naming scheme for detail files, then you
+ # can have many detail file writers, and only one reader.
#
filename = "${radacctdir}/detail-*"
#
# load_factor::
#
- # The server can read accounting packets from the detail file much more quickly
- # than those packets can be written to a database. If the database is overloaded,
- # then bad things can happen.
+ # The server can read accounting packets from the detail file much
+ # more quickly than those packets can be written to a database. If
+ # the database is overloaded, then bad things can happen.
#
- # The server will keep track of how long it takes to process an entry from the detail
- # file. It will then pause between handling entries. This pause allows databases to
- # "catch up", and gives the server time to notice that other packets may have arrived.
+ # The server will keep track of how long it takes to process an
+ # entry from the detail file. It will then pause between handling
+ # entries. This pause allows databases to "catch up", and gives the
+ # server time to notice that other packets may have arrived.
#
- # The pause is calculated dynamically, to ensure that the load due to reading the detail
- # files is limited to a small percentage of CPU time. The server will try to keep the
- # percentage of time taken by "detail" file entries to `load_factor` percentage of
- # the CPU time.
+ # The pause is calculated dynamically, to ensure that the load due
+ # to reading the detail files is limited to a small percentage of
+ # CPU time. The server will try to keep the percentage of time
+ # taken by "detail" file entries to `load_factor` percentage of the
+ # CPU time.
#
- # NOTE: If the `load_factor` is set to 100, then the server will read packets as fast as
- # it can, usually causing databases to go into overload.
+ # NOTE: If the `load_factor` is set to 100, then the server will
+ # read packets as fast as it can, usually causing databases to go
+ # into overload.
#
# allowed values: `1 to 100`
#
#
# poll_interval:: Interval for polling the detail file.
#
- # If the detail file doesn't exist, the server will wake up, and poll for it every N seconds.
+ # If the detail file doesn't exist, the server will wake up, and
+ # poll for it every N seconds.
#
# Useful range of values: `1 to 60`
#
poll_interval = 1
#
- # retry_interval:: Set the retry interval for when the home server does not respond.
+ # retry_interval:: Set the retry interval for when the home server
+ # does not respond.
#
- # The current packet will be sent repeatedly, at this interval, until the home server responds.
+ # The current packet will be sent repeatedly, at this interval,
+ # until the home server responds.
#
# Useful range of values: `5 to 30`
#
#
# track:: Track progress through the detail file.
#
- # When the detail file is large, and the server is restarted, it will read from the START of
- # the file.
+ # When the detail file is large, and the server is restarted, it
+ # will read from the START of the file.
#
- # Setting `track = yes` means it will skip packets which have already been processed.
+ # Setting `track = yes` means it will skip packets which have
+ # already been processed.
#
# The default is `no`.
#
#
# one_shot::
#
- # In some circumstances it may be desirable for the server to start up, process a detail file,
- # and immediately quit. To do this enable the `one_shot` option below.
+ # In some circumstances it may be desirable for the server to start
+ # up, process a detail file, and immediately quit. To do this
+ # enable the `one_shot` option below.
#
# NOTE: Do not enable this for normal server operation.
#
#
recv Accounting-Request {
#
- # Ensure that we have a semi-unique identifier for every request, and many NAS
- # boxes are broken.
+ # Ensure that we have a semi-unique identifier for every request,
+ # and many NAS boxes are broken.
#
acct_unique
#
- # Read the `acct_users` file. This isn't always necessary, and can be deleted
- # if you do not use it.
+ # Read the `acct_users` file. This isn't always necessary, and can
+ # be deleted if you do not use it.
#
files
}
#
# Log traffic to an SQL database.
#
- # See `Accounting queries` in `mods-config/sql/main/$driver/queries.conf`
+ # See `Accounting queries` in
+ # `mods-config/sql/main/$driver/queries.conf`
#
-# sql
+ # sql
#
# Cisco VoIP specific bulk accounting.
#
-# pgsql-voip
+ # pgsql-voip
}
}
-# -*- text -*-
-# $Id$
+# -*- text -*- $Id$
#######################################################################
recv Access-Request {
#
- # If there's no State attribute, then this is the request from
- # the user.
+ # If there's no State attribute, then this is the request from the
+ # user.
#
if (!State) {
control.Auth-Type := ::Step1
}
else {
#
- # Do authentication for step 2.
- # Set the "known good" password to the number
- # saved in the session-state list.
+ # Do authentication for step 2. Set the "known good" password to
+ # the number saved in the session-state list.
#
control.Auth-Type := ::Step2
control.Password.Cleartext := session-state.challenge-string
authenticate step1 {
- # If the password doesn't match, the user is rejected
- # immediately.
+ # If the password doesn't match, the user is rejected immediately.
pap
#
reply.Reply-Message := "Please enter %{session-state.challenge-string}: "
#
- # Send an Access-Challenge.
- # See policy.d/control for the definition
+ # Send an Access-Challenge. See policy.d/control for the definition
# of "challenge"
#
challenge
# -*- text -*-
######################################################################
#
-# Sample virtual server for receiving a CoA or Disconnect-Request packet.
+# Sample virtual server for receiving a CoA or Disconnect-Request
+# packet.
#
server coa {
namespace = radius
# -*- text -*-
######################################################################
#
-# This virtual server simplifies the process of sending CoA-Request or
-# Disconnect-Request packets to a NAS.
+# This virtual server simplifies the process of sending CoA-Request
+# or Disconnect-Request packets to a NAS.
#
# This virtual server will receive CoA-Request or Disconnect-Request
-# packets that contain *minimal* identifying information. e.g. Just
-# a User-Name, or maybe just an Acct-Session-Id attribute. It will
-# look up that information in a database in order to find the rest of
-# the session data. e.g. NAS-IP-Address, NAS-Identifier, NAS-Port,
-# etc. That information will be added to the packet, which will then
-# be sent to the NAS.
+# packets that contain *minimal* identifying information. e.g. Just a
+# User-Name, or maybe just an Acct-Session-Id attribute. It will look
+# up that information in a database in order to find the rest of the
+# session data. e.g. NAS-IP-Address, NAS-Identifier, NAS-Port, etc.
+# That information will be added to the packet, which will then be
+# sent to the NAS.
#
# This process is useful because NASes require the CoA packets to
# contain "session identification" attributes in order to to do CoA
-# or Disconnect. If the attributes aren't in the packet, then the
-# NAS will NAK the request. This NAK happens even if you ask to
+# or Disconnect. If the attributes aren't in the packet, then the NAS
+# will NAK the request. This NAK happens even if you ask to
# disconnect "User-Name = bob", and there is only one session with a
# "bob" active.
#
# Using this virtual server makes the CoA or Disconnect process
-# easier. Just tell FreeRADIUS to disconnect "User-Name = bob", and
+# easier. Just tell FreeRADIUS to disconnect "User-Name = bob", and
# FreeRADIUS will take care of adding the "session identification"
# attributes.
#
# filtered as required, with session identification added, to the
# corresponding NAS for each session.
#
-# This simplifies scripting directly against a set of NAS devices since a
-# script need only send a single CoA/Disconnect to FreeRADIUS which will
-# then:
+# This simplifies scripting directly against a set of NAS devices
+# since a script need only send a single CoA/Disconnect to FreeRADIUS
+# which will then:
#
# - Lookup all active sessions belonging to a user, in the case that only a
# User-Name attribute is provided in the request
# EOF
# ```
#
-# In addition to configuring and activating this site, instances of the radius
-# client module must be created for each NAS, for example:
+# In addition to configuring and activating this site, instances of
+# the radius client module must be created for each NAS, for example:
#
# ```
# radius radius-originate-coa-192.0.2.1 {
# }
# ```
#
-# Refer to `mods-enabled/radius` as a detailed reference for configuring
-# client access to each NAS.
+# Refer to `mods-enabled/radius` as a detailed reference for
+# configuring client access to each NAS.
server coa {
#
# NasIpAddress1#AcctSessionId1|NasIPAddress2#AcctSessionId2|...
#
- # i.e. each session is separated by '|', and attributes
- # within a session are separated by '#'
+ # i.e. each session is separated by '|', and attributes within a
+ # session are separated by '#'
#
- # You will likely have to update the SELECT to add in
- # any other "session identification" attributes
- # needed by the NAS. These may include NAS-Port,
- # NAS-Identifier, etc. Only the NAS vendor knows
- # what these attributes are unfortunately, so we
- # cannot give more detailed advice here.
+ # You will likely have to update the SELECT to add in any other
+ # "session identification" attributes needed by the NAS. These may
+ # include NAS-Port, NAS-Identifier, etc. Only the NAS vendor knows
+ # what these attributes are unfortunately, so we cannot give more
+ # detailed advice here.
#
#
# Example MySQL lookup
#
-# control.user-session := %sql("SELECT IFNULL(GROUP_CONCAT(CONCAT(nasipaddress,'#',acctsessionid) separator '|'),'') FROM (SELECT * FROM radacct WHERE ('%{User-Name}'='' OR UserName='%{User-Name}') AND ('%{Acct-Session-Id}'='' OR acctsessionid = '%{Acct-Session-Id}') AND AcctStopTime IS NULL) a")
+ # control.user-session := %sql("SELECT IFNULL(GROUP_CONCAT(CONCAT(nasipaddress,'#',acctsessionid) separator '|'),'') FROM (SELECT * FROM radacct WHERE ('%{User-Name}'='' OR UserName='%{User-Name}') AND ('%{Acct-Session-Id}'='' OR acctsessionid = '%{Acct-Session-Id}') AND AcctStopTime IS NULL) a")
#
# Example PostgreSQL lookup
#
-# control.user-session := %sql("SELECT STRING_AGG(CONCAT(nasipaddress,'#',acctsessionid),'|') FROM (SELECT * FROM radacct WHERE ('%{User-Name}'='' OR UserName='%{User-Name}') AND ('%{Acct-Session-Id}'='' OR acctsessionid = '%{Acct-Session-Id}') AND AcctStopTime IS NULL) a")
+ # control.user-session := %sql("SELECT STRING_AGG(CONCAT(nasipaddress,'#',acctsessionid),'|') FROM (SELECT * FROM radacct WHERE ('%{User-Name}'='' OR UserName='%{User-Name}') AND ('%{Acct-Session-Id}'='' OR acctsessionid = '%{Acct-Session-Id}') AND AcctStopTime IS NULL) a")
#
# Keep a count of what we send.
subrequest ::CoA-Request {
#
- # The subrequest begins empty, so initially copy all attributes
- # from the incoming request.
+ # The subrequest begins empty, so initially copy all attributes from the incoming
+ # request.
#
request := parent.request
#
# Remove attributes which will confuse the NAS
#
- # The NAS will "helpfully" NAK the packet
- # if it contains attributes which are NOT
+ # The NAS will "helpfully" NAK the packet if it contains attributes which are NOT
# "session identification" attributes.
#
#
# Uncomment if the NAS does not expect User-Name
#
- #request -= User-Name[*]
+ # request -= User-Name[*]
#
# Call the radius client module instance for the NAS-IP-Address
#
recv Disconnect-Request {
#
- # Populate this section as above, but use "subrequest Disconnect-Request"
+ # Populate this section as above, but use "subrequest
+ # Disconnect-Request"
#
}
type = detail
#
- # See sites-available/buffered-sql for more details on
- # all the options available for the detail reader.
+ # See sites-available/buffered-sql for more details on all the
+ # options available for the detail reader.
#
######################################################
#
# The detail file reader acts just like a NAS.
#
- # This means that if accounting fails, the packet
- # is re-tried FOREVER. It is YOUR responsibility
- # to write an accounting policy that returns "ok"
- # if the packet was processed properly, "fail" on
- # a database error, AND "ok" if you want to ignore
- # the packet (e.g. no Acct-Status-Type).
+ # This means that if accounting fails, the packet is re-tried
+ # FOREVER. It is YOUR responsibility to write an accounting policy
+ # that returns "ok" if the packet was processed properly, "fail" on
+ # a database error, AND "ok" if you want to ignore the packet (e.g.
+ # no Acct-Status-Type).
#
- # Neither the detail file write OR the detail file
- # reader look at the contents of the packets. They
- # just either dump the packet verbatim to the file,
- # or read it verbatim from the file and pass it to
- # the server.
+ # Neither the detail file write OR the detail file reader look at
+ # the contents of the packets. They just either dump the packet
+ # verbatim to the file, or read it verbatim from the file and pass
+ # it to the server.
#
######################################################
- # The location where the detail file is located.
- # This should be on local disk, and NOT on an NFS
- # mounted location!
- #
- # On most systems, this should support file globbing
- # e.g. "${radacctdir}/detail-*:*"
- # This lets you write many smaller detail files as in
- # the example in radiusd.conf: ".../detail-%Y%m%d:%H"
- # Writing many small files is often better than writing
- # one large file. File globbing also means that with
- # a common naming scheme for detail files, then you can
- # have many detail file writers, and only one reader.
+ # The location where the detail file is located. This should be on
+ # local disk, and NOT on an NFS mounted location!
+ #
+ # On most systems, this should support file globbing e.g.
+ # "${radacctdir}/detail-*:*" This lets you write many smaller
+ # detail files as in the example in radiusd.conf:
+ # ".../detail-%Y%m%d:%H" Writing many small files is often better
+ # than writing one large file. File globbing also means that with a
+ # common naming scheme for detail files, then you can have many
+ # detail file writers, and only one reader.
#
filename = ${radacctdir}/detail
#
- # The server can read accounting packets from the
- # detail file much more quickly than those packets
- # can be written to a database. If the database is
- # overloaded, then bad things can happen.
- #
- # The server will keep track of how long it takes to
- # process an entry from the detail file. It will
- # then pause between handling entries. This pause
- # allows databases to "catch up", and gives the
- # server time to notice that other packets may have
- # arrived.
- #
- # The pause is calculated dynamically, to ensure that
- # the load due to reading the detail files is limited
- # to a small percentage of CPU time. The
- # "load_factor" configuration item is a number
- # between 1 and 100. The server will try to keep the
- # percentage of time taken by "detail" file entries
- # to "load_factor" percentage of the CPU time.
- #
- # If the "load_factor" is set to 100, then the server
- # will read packets as fast as it can, usually
- # causing databases to go into overload.
+ # The server can read accounting packets from the detail file much
+ # more quickly than those packets can be written to a database. If
+ # the database is overloaded, then bad things can happen.
+ #
+ # The server will keep track of how long it takes to process an
+ # entry from the detail file. It will then pause between handling
+ # entries. This pause allows databases to "catch up", and gives the
+ # server time to notice that other packets may have arrived.
+ #
+ # The pause is calculated dynamically, to ensure that the load due
+ # to reading the detail files is limited to a small percentage of
+ # CPU time. The "load_factor" configuration item is a number
+ # between 1 and 100. The server will try to keep the percentage of
+ # time taken by "detail" file entries to "load_factor" percentage
+ # of the CPU time.
+ #
+ # If the "load_factor" is set to 100, then the server will read
+ # packets as fast as it can, usually causing databases to go into
+ # overload.
#
load_factor = 10
#
- # Track progress through the detail file. When the detail
- # file is large, and the server is restarted, it will
- # read from the START of the file.
+ # Track progress through the detail file. When the detail file is
+ # large, and the server is restarted, it will read from the START
+ # of the file.
#
- # Setting "track = yes" means it will skip packets which
- # have already been processed. The default is "no".
+ # Setting "track = yes" means it will skip packets which have
+ # already been processed. The default is "no".
#
- # track = yes
+ # track = yes
}
#
- # Pre-accounting. Decide which accounting type to use.
+ # Pre-accounting. Decide which accounting type to use.
#
recv Accounting-Request {
#
- # Read the 'acct_users' file. This isn't always
- # necessary, and can be deleted if you do not use it.
+ # Read the 'acct_users' file. This isn't always necessary, and can
+ # be deleted if you do not use it.
files
}
#
- # Accounting. Log the accounting data.
+ # Accounting. Log the accounting data.
#
send Accounting-Response {
#
- # Since we're proxying, we don't log anything
- # locally. Ensure that the accounting section
- # "succeeds" by forcing an "ok" return.
+ # Since we're proxying, we don't log anything locally. Ensure
+ # that the accounting section "succeeds" by forcing an "ok"
+ # return.
ok
}
}
# force_refresh:: Maximum time between refreshing CRLs
#
# If the `nextUpdate` attribute of a CRL is closer than this
- # interval then that will be used as the point that the CRL
- # is refreshed.
+ # interval then that will be used as the point that the CRL is
+ # refreshed.
#
# force_refresh = 7d
# force_delta_refresh = 1d
#
- # early_refresh:: Time before `nextUpdate` which the CRL will be refreshed
+ # early_refresh:: Time before `nextUpdate` which the CRL will be
+ # refreshed
#
early_refresh = 1h
#
# allow_expired:: Should an expired CRL be accepted.
#
- # The nextUpdate value extracted from a CRL will be compared
- # to the current time, and if this option is `no` (the default)
- # then, if that time is in the past, the CRL will not be
- # accepted.
+ # The nextUpdate value extracted from a CRL will be compared to the
+ # current time, and if this option is `no` (the default) then, if
+ # that time is in the past, the CRL will not be accepted.
# allow_expired = yes
#
- # allow_not_yet_valid:: Should a not yet valid expired CRL be accepted.
- #
- # The lastUpdate value extracted from a CRL will be compared
- # to the current time, and if this option is `no` (the default)
- # then, if that time is in the future, the CRL will not be
+ # allow_not_yet_valid:: Should a not yet valid expired CRL be
# accepted.
+ #
+ # The lastUpdate value extracted from a CRL will be compared to the
+ # current time, and if this option is `no` (the default) then, if
+ # that time is in the future, the CRL will not be accepted.
# allow_not_yet_valid = yes
}
#
# This section will be run to fetch CRL data
#
- # One or more instances of attribute CDP-URL will contain the
- # urls from which the CRL can be fetched.
+ # One or more instances of attribute CDP-URL will contain the urls
+ # from which the CRL can be fetched.
#
# RFC 5280 details the use of HTTP, LDAP or FTP in CRL distribution
# points.
}
#
- # This section is called after successful fetching and validating
- # of a CRL and can be used for logging purposes.
+ # This section is called after successful fetching and validating of
+ # a CRL and can be used for logging purposes.
#
send Fetch-OK {
ok
#
# = The cron Virtual Server
#
-# The `cron` virtual server is an example of using `cron` style functionality in FreeRADIUS.
+# The `cron` virtual server is an example of using `cron` style
+# functionality in FreeRADIUS.
#
# == The Virtual Server
#
namespace = radius
#
- # You can have a `radius` subsection here. See the `default`
- # virtual server for documentation.
+ # You can have a `radius` subsection here. See the `default` virtual
+ # server for documentation.
#
#
- # Create a `cron` listener. Note that leaving off the `cron` name
+ # Create a `cron` listener. Note that leaving off the `cron` name
# will result in the protocol trying to open a socket!
#
listen cron {
# * month of year (1-12)
# * day of week (0-6)
#
- # The allowed values follow the specification given in
- # `man 5 crontab`, or https://man7.org/linux/man-pages/man5/crontab.5.html
+ # The allowed values follow the specification given in `man 5
+ # crontab`, or
+ # https://man7.org/linux/man-pages/man5/crontab.5.html
#
# Multiple values can be given, separated by comma:
# * 1,2,3
# When the timer hits, the `cron` section processes the attributes
# from this file, as if they had been received from the network.
#
- # Nothing is done with the reply packet (if
- # anything). The `cron` functionality
- # assumes that all of the work necessary for
- # `cron` is done inside of the processing
- # sections.
+ # Nothing is done with the reply packet (if anything). The `cron`
+ # functionality assumes that all of the work necessary for `cron`
+ # is done inside of the processing sections.
#
filename = /Users/alandekok/git/wrapper/freeradius-server/user_password
}
#
######################################################################
-# Define a virtual server to write the accounting packets.
-# Any "listen" section that listens on an accounting port should
-# set "virtual_server = write-detail.example.com
+# Define a virtual server to write the accounting packets. Any
+# "listen" section that listens on an accounting port should set
+# "virtual_server = write-detail.example.com
server write_detail.example.com {
recv Accounting-Request {
#
# Define a virtual server to process the accounting packets.
server read-detail.example.com {
- # Read accounting packets from the detail file(s) for
- # the home server.
+ # Read accounting packets from the detail file(s) for the home
+ # server.
listen {
type = detail
filename = "${radacctdir}/detail.example.com/detail-*:*"
track = yes
}
- # All packets read from the detail file are processed through
- # the preacct && accounting sections.
+ # All packets read from the detail file are processed through the
+ # preacct && accounting sections.
#
- # The following text is copied verbatim from sites-available/default.
- # You should edit it for your own local configuration.
+ # The following text is copied verbatim from
+ # sites-available/default. You should edit it for your own local
+ # configuration.
#
-# Pre-accounting. Decide which accounting type to use.
+# Pre-accounting. Decide which accounting type to use.
#
recv Accounting-Request {
#
- # Ensure that we have a semi-unique identifier for every
- # request, and many NAS boxes are broken.
+ # Ensure that we have a semi-unique identifier for every request,
+ # and many NAS boxes are broken.
acct_unique
#
}
#
-# Accounting. Log the accounting data.
+# Accounting. Log the accounting data.
#
send Accounting-Response {
#
- # Create a 'detail'ed log of the packets.
- # Note that accounting requests which are proxied
- # are also logged in the detail file.
+ # Create a 'detail'ed log of the packets. Note that accounting
+ # requests which are proxied are also logged in the detail file.
detail
# daily
#
# Return an address to the IP Pool when we see a stop record.
#
- # Ensure that control.IP-Pool.Name is set to determine which
- # pool of IPs are used.
+ # Ensure that control.IP-Pool.Name is set to determine which pool of
+ # IPs are used.
#
sqlippool
#
# Log traffic to an SQL database.
#
- # NOTE! You will have to ensure that any accounting packets
- # NOT handled by the SQL module (e.g. "stop with zero session length"
+ # NOTE! You will have to ensure that any accounting packets NOT
+ # handled by the SQL module (e.g. "stop with zero session length"
# result in the accounting section still returning "ok".
#
- # Otherwise, the server will think that the accounting packet
- # was NOT handled properly, and will keep trying to process it
- # through this virtual server!
+ # Otherwise, the server will think that the accounting packet was
+ # NOT handled properly, and will keep trying to process it through
+ # this virtual server!
#
- # See "Accounting queries" in `mods-config/sql/main/$driver/queries.conf`
-# sql
+ # See "Accounting queries" in
+ # `mods-config/sql/main/$driver/queries.conf`
+ # sql
#
- # Instead of sending the query to the SQL server,
- # write it into a log file.
+ # Instead of sending the query to the SQL server, write it into a
+ # log file.
#
-# sql_log
+ # sql_log
# Cisco VoIP specific bulk accounting
-# pgsql-voip
+ # pgsql-voip
# Filter attributes from the accounting response.
attr_filter.accounting_response
-# -*- text -*-
-# $Id$
+# -*- text -*- $Id$
#######################################################################
#
# = The default Virtual Server
#
# The `default` virtual server is the first one that is enabled on a
-# default installation of FreeRADIUS. This configuration is
-# designed to work in the widest possible set of circumstances, with
-# the widest possible number of authentication methods. This means
-# that in general, you should need to make very few changes to this
-# file.
+# default installation of FreeRADIUS. This configuration is designed
+# to work in the widest possible set of circumstances, with the
+# widest possible number of authentication methods. This means that
+# in general, you should need to make very few changes to this file.
#
# The usual approach is as follows:
#
# * If using EAP / 802.1X, configure the certificates in
# the `certs/` directory.
#
-# Then, run the server. This process will ensure that users can log
-# in via PAP, CHAP, MS-CHAP, etc. You should also test the server via
+# Then, run the server. This process will ensure that users can log
+# in via PAP, CHAP, MS-CHAP, etc. You should also test the server via
# `radtest` to verify that it works.
#
# == Editing this file
#
-# Please read "man radiusd" before editing this file. See the
-# section titled DEBUGGING. It outlines a method where you can
-# quickly obtain the configuration you want, without running into
-# trouble. And finally, the debug output can be complex. Please read
+# Please read "man radiusd" before editing this file. See the section
+# titled DEBUGGING. It outlines a method where you can quickly obtain
+# the configuration you want, without running into trouble. And
+# finally, the debug output can be complex. Please read
# https://www.freeradius.org/documentation/freeradius-server/4.0.0/debugging/radiusd_X.html
#
# The best way to configure the server for your local system is to
-# *carefully* edit this file. Most attempts to make large edits to
-# this file will *break the server*. Any edits should be small, and
-# tested by running the server with `radiusd -X`. Once the edits
-# have been verified to work, save a copy of these configuration
-# files somewhere. We recommend using a revision control system such
-# as `git`, or even a "tar" file. Then, make more edits, and test,
-# as above.
+# *carefully* edit this file. Most attempts to make large edits to
+# this file will *break the server*. Any edits should be small, and
+# tested by running the server with `radiusd -X`. Once the edits have
+# been verified to work, save a copy of these configuration files
+# somewhere. We recommend using a revision control system such as
+# `git`, or even a "tar" file. Then, make more edits, and test, as
+# above.
#
# There are many "commented out" references to modules and
# configurations These references serve as place-holders, and as
-# documentation. If you need the functionality of that module, then:
+# documentation. If you need the functionality of that module, then:
#
# * configure the module in `mods-available/`
# * enable the module in `mods-enabled/`. e.g. for LDAP, do: `cd mods-enabled;ln -s ../mods-available/ldap`
# namespace:: The protocol namespace (i.e. dictionary) to use.
#
# In v4, all "server" sections MUST start with a "namespace"
- # parameter. This tells the server which protocol is being used.
+ # parameter. This tells the server which protocol is being used.
#
- # All of the "listen" sections in this virtual server will
- # only accept packets for that protocol.
+ # All of the "listen" sections in this virtual server will only
+ # accept packets for that protocol.
#
namespace = radius
#
# log:: The name of the logging section to use.
#
- # The top configuration section can contain multiple section "log foo { ... }".
- # Each of those sections is a different named logging destination.
+ # The top configuration section can contain multiple section "log
+ # foo { ... }". Each of those sections is a different named logging
+ # destination.
#
- # This configuration item allows setting a different logging destination for an
- # individual virtual server.
+ # This configuration item allows setting a different logging
+ # destination for an individual virtual server.
#
# There are some limitations.
#
#
# ==== Access-Request subsection
#
- # This section contains configuration which is
- # specific to processing `Access-Request` packets.
+ # This section contains configuration which is specific to
+ # processing `Access-Request` packets.
#
- # Similar sections can be added, but are not
- # necessary for Accounting-Request (and other)
- # packets. At this time, there is no configuration
- # needed for other packet types.
+ # Similar sections can be added, but are not necessary for
+ # Accounting-Request (and other) packets. At this time, there is no
+ # configuration needed for other packet types.
#
Access-Request {
#
- # session:: Controls how ongoing
- # (multi-round) sessions are handled
+ # session:: Controls how ongoing (multi-round) sessions are
+ # handled
#
- # This section is primarily useful for EAP.
- # It controls the number of EAP
- # authentication attempts that can occur
- # concurrently.
+ # This section is primarily useful for EAP. It controls the number
+ # of EAP authentication attempts that can occur concurrently.
#
session {
#
#
- # max_rounds:: The maximum number of message exchanges
- # before the server gives up
+ # max_rounds:: The maximum number of message exchanges before the server
+ # gives up
#
# max_rounds = 40
#
- # timeout:: How long to wait before expiring a
- # session.
+ # timeout:: How long to wait before expiring a session.
#
- # The timer starts when a response
- # with a state value is sent. The
- # timer stops when a request
- # containing the previously sent
- # state value is received.
+ # The timer starts when a response with a state value is sent. The timer
+ # stops when a request containing the previously sent state value is
+ # received.
#
# timeout = 15
#
- # dedup_key:: Key to enforce only one active session per
- # supplicant.
+ # dedup_key:: Key to enforce only one active session per supplicant.
#
- # Some supplicants may misbehave by starting many thousands
- # of EAP sessions, but never finishing them. These sessions
- # can cause the server to hit 'max_sessions' very quickly.
- # The 'timer_expire' configuration above does not help as
- # much as it could, because the old (duplicate) session
- # should be deleted as soon as the new one comes in.
+ # Some supplicants may misbehave by starting many thousands of EAP
+ # sessions, but never finishing them. These sessions can cause the server
+ # to hit 'max_sessions' very quickly. The 'timer_expire' configuration
+ # above does not help as much as it could, because the old (duplicate)
+ # session should be deleted as soon as the new one comes in.
#
- # If you set the 'dedup_key' below, whenever the EAP module
- # starts a new session, it will check for a previous session
- # which has the same dedup key. If a previous session
- # is found, it is deleted.
+ # If you set the 'dedup_key' below, whenever the EAP module starts a new
+ # session, it will check for a previous session which has the same dedup
+ # key. If a previous session is found, it is deleted.
#
- # Setting this configuration item may cause issues if the
- # same device uses multiple EAP sessions at the same time.
- # But that device behavior should be rare to non-existent.
+ # Setting this configuration item may cause issues if the same device
+ # uses multiple EAP sessions at the same time. But that device behavior
+ # should be rare to non-existent.
#
- # The configuration item is commented out so that upgrades
- # do not change existing behavior.
+ # The configuration item is commented out so that upgrades do not change
+ # existing behavior.
#
# dedup_key = Calling-Station-Id
}
#
# === Local Dictionaries
#
- # It is now possible to have dictionaries which are local to a virtual
- # server. The attributes defined here can be used in policies in this
- # virtual server.
+ # It is now possible to have dictionaries which are local to a
+ # virtual server. The attributes defined here can be used in
+ # policies in this virtual server.
#
- # Any attribute defined in this section can only be used in policies in
- # this virtual server. The attributes are "internal", and cannot go
- # into a packet which is sent on the network.
+ # Any attribute defined in this section can only be used in policies
+ # in this virtual server. The attributes are "internal", and cannot
+ # go into a packet which is sent on the network.
#
- # When a request is proxied internally to another virtual server, these
- # attributes are still sent with the proxied request. However, as the
- # definitions do not exist in the other virtual server, they cannot be
- # used in policies.
+ # When a request is proxied internally to another virtual server,
+ # these attributes are still sent with the proxied request. However,
+ # as the definitions do not exist in the other virtual server, they
+ # cannot be used in policies.
#
- # The other virtual server can even define attributes of the same name.
- # That virtual server will use those definitions for its policies, and
- # will never match the proxied attributes.
+ # The other virtual server can even define attributes of the same
+ # name. That virtual server will use those definitions for its
+ # policies, and will never match the proxied attributes.
#
- # In all other aspects, the attributes defined here are just the same
- # as if they had been assigned in a dictionary file.
+ # In all other aspects, the attributes defined here are just the
+ # same as if they had been assigned in a dictionary file.
#
dictionary {
#
# The syntax is _<type>_ followed by _<name>_.
#
- # The _<type>_ MUST be a leaf type or a `group`. i.e. not
- # `struct`, `vsa`, or `vendor`.
+ # The _<type>_ MUST be a leaf type or a `group`. i.e. not `struct`,
+ # `vsa`, or `vendor`.
#
# The _<name>_ MUST NOT exist in the `namespace` dictionary.
#
-# uint32 foo
+ # uint32 foo
#
# tlv:: Define a TLV variable using _tlv <name> { ...}_.
# The contents of the `tlv` subsection are more variable
# definitions, including child `tlv`s.
#
-# tlv bar {
-# uint32 baz
-# string arg
-# }
+ # tlv bar {
+ # uint32 baz
+ # string arg
+ # }
#
# values:: Define a set of values for attribute _<name>_.
# The contents of the `values` section are a list of names and
# values.
#
-# values foo {
- #
- # _<name>_ = _<value>_
- #
- # The _<name>_ must be unique.
- #
- # The _<value>_ is parsed according to the data type of
- # the attribute.
- #
+ # values foo {
+ #
+ # _<name>_ = _<value>_
+ #
+ # The _<name>_ must be unique.
+ #
+ # The _<value>_ is parsed according to the data type of the
+ # attribute.
+ #
# bar = 1
# baz = 2
-# }
+ # }
}
#
# === The listen section
#
- # The `listen` sections in v4 are very different from the
- # `listen sections in v3. The changes were necessary in
- # order to make FreeRADIUS more flexible, and to make the
- # configuration simpler and more consistent.
+ # The `listen` sections in v4 are very different from the `listen
+ # sections in v3. The changes were necessary in order to make
+ # FreeRADIUS more flexible, and to make the configuration simpler
+ # and more consistent.
#
- # If there are multiple `listen` sections in the same
- # virtual server, they need to be given a second name.
+ # If there are multiple `listen` sections in the same virtual
+ # server, they need to be given a second name.
#
- # Listen sections are identified by virtual server name,
- # then by the namespace, then by transport, finally by
- # a second name.
+ # Listen sections are identified by virtual server name, then by the
+ # namespace, then by transport, finally by a second name.
#
listen authentication {
#
# type:: The type of packet to accept.
#
- # Multiple types can be accepted by using multiple
- # lines of `type = ...`.
+ # Multiple types can be accepted by using multiple lines of `type =
+ # ...`.
#
- # This change from v3 makes it much clearer what kind
- # of packet is being accepted. The old `auth+acct`
- # configuration was awkward and potentially
- # confusing.
+ # This change from v3 makes it much clearer what kind of packet is
+ # being accepted. The old `auth+acct` configuration was awkward and
+ # potentially confusing.
#
type = Access-Request
type = Status-Server
#
# transport:: The transport protocol.
#
- # The allowed transports for RADIUS are currently
- # `udp` and `tcp`. A `listen` section can only have
- # one `transport` defined. For multiple transports,
- # use multiple `listen` sections.
+ # The allowed transports for RADIUS are currently `udp` and `tcp`.
+ # A `listen` section can only have one `transport` defined. For
+ # multiple transports, use multiple `listen` sections.
#
- # You can have a "headless" server by commenting out
- # the "transport" configuration. A "headless" server
- # will process packets from other virtual servers,
- # but will not accept packets from the network.
+ # You can have a "headless" server by commenting out the
+ # "transport" configuration. A "headless" server will process
+ # packets from other virtual servers, but will not accept packets
+ # from the network.
#
- # The `inner-tunnel` server is an example of a
- # headless server. It accepts packets from the
- # "inner tunnel" portion of PEAP and TTLS. But it
- # does not accept those packets from the network.
+ # The `inner-tunnel` server is an example of a headless server. It
+ # accepts packets from the "inner tunnel" portion of PEAP and TTLS.
+ # But it does not accept those packets from the network.
#
transport = udp
#
- # require_message_authenticator::Require Message-Authenticator
- # in Access-Requests.
+ # require_message_authenticator::Require Message-Authenticator in
+ # Access-Requests.
#
# RFC 5080 suggests that all clients *should* include it in an
- # Access-Request. The configuration item below allows the server
- # to require it. If a client is required to include a `Message-Authenticator`
- # and it does not, then the packet will be silently discarded.
+ # Access-Request. The configuration item below allows the server to
+ # require it. If a client is required to include a
+ # `Message-Authenticator` and it does not, then the packet will be
+ # silently discarded.
#
# If value is auto, then if any packet received from the client
# contains a valid Message-Authenticator attribute, then the server
#
# limit_proxy_state:: Control whether Proxy-State is allowed in
- # packets from this client which do not have a Message-Authenticator.
+ # packets from this client which do not have a
+ # Message-Authenticator.
#
# The blastradius prefix attack allows an attacker to manipulate
- # the contents of response packets without knowing the shared secret.
+ # the contents of response packets without knowing the shared
+ # secret.
#
# The attack relies on controlling a portion of the data sent back
# in the response by the RADIUS server. As Proxy-State is always
# attack.
#
# The attack also relies on defficiencies in the original RADIUS
- # standards that provided no integrity protection for Access-Requests.
+ # standards that provided no integrity protection for
+ # Access-Requests.
#
# The attack is mitigated by requiring the Message-Authenticator,
# which contains a HMAC over the entire request, preventing
#
# limit:: limits for this socket.
#
- # The `limit` section contains configuration items
- # which enforce various limits on the socket. These
- # limits are usually transport-specific.
+ # The `limit` section contains configuration items which enforce
+ # various limits on the socket. These limits are usually
+ # transport-specific.
#
# Limits are used to prevent "run-away" problems.
#
limit {
#
- # max_clients:: The maximum number of dynamic
- # clients which can be defined for this
- # listener.
+ # max_clients:: The maximum number of dynamic clients which can be
+ # defined for this listener.
#
- # If dynamic clients are not used, then this
- # configuration item is ignored.
+ # If dynamic clients are not used, then this configuration item is
+ # ignored.
#
- # The special value of `0` means "no limit".
- # We do not recommend using `0`, as attackers
- # could forge packets from the entire
- # Internet, and cause FreeRADIUS to run out
- # of memory.
+ # The special value of `0` means "no limit". We do not recommend
+ # using `0`, as attackers could forge packets from the entire
+ # Internet, and cause FreeRADIUS to run out of memory.
#
- # This configuration item should be set to
- # the number of individual RADIUS clients
- # (e.g. NAS, AP, etc.) which will be sending
- # packets to FreeRADIUS.
+ # This configuration item should be set to the number of
+ # individual RADIUS clients (e.g. NAS, AP, etc.) which will be
+ # sending packets to FreeRADIUS.
#
max_clients = 256
#
- # max_connections:: The maximum number of
- # connected sockets which will be accepted
- # for this listener.
+ # max_connections:: The maximum number of connected sockets which
+ # will be accepted for this listener.
#
- # Each connection opens a new socket, so be
- # aware of system file descriptor
- # limitations.
+ # Each connection opens a new socket, so be aware of system file
+ # descriptor limitations.
#
- # If the listeners do not use connected
- # sockets (e.g. TCP), then this configuration
- # item is ignored.
+ # If the listeners do not use connected sockets (e.g. TCP), then
+ # this configuration item is ignored.
#
max_connections = 256
#
- # idle_timeout:: Time after which idle
- # connections are deleted.
+ # idle_timeout:: Time after which idle connections are deleted.
#
# Useful range of values: 5 to 600
#
idle_timeout = 60.0
#
- # dynamic_timeout:: Time after which idle
- # dynamic clients are deleted.
+ # dynamic_timeout:: Time after which idle dynamic clients are
+ # deleted.
#
dynamic_timeout = 600.0
#
- # nak_lifetime:: Time for which blocked
- # clients are placed into a NAK cache.
+ # nak_lifetime:: Time for which blocked clients are placed into a
+ # NAK cache.
#
- # If a dynamic client is disallowed, it is
- # placed onto a "NAK" list for a period
- # of time. This process helps to prevent
- # DoS attacks. When subsequent packets are
- # received from that IP address, they hit the
- # "NAK" cache, and are immediately discarded.
+ # If a dynamic client is disallowed, it is placed onto a "NAK"
+ # list for a period of time. This process helps to prevent DoS
+ # attacks. When subsequent packets are received from that IP
+ # address, they hit the "NAK" cache, and are immediately
+ # discarded.
#
- # After `nak_timeout` seconds, the blocked
- # entry will be removed, and the IP will be
- # allowed to try again to define a dynamic
+ # After `nak_timeout` seconds, the blocked entry will be removed,
+ # and the IP will be allowed to try again to define a dynamic
# client.
#
# Useful range of values: 1 to 600
nak_lifetime = 30.0
#
- # cleanup_delay:: The time to wait (in
- # seconds) before cleaning up a reply to an
- # `Access-Request` packet.
+ # cleanup_delay:: The time to wait (in seconds) before cleaning up
+ # a reply to an `Access-Request` packet.
#
- # The reply is normally cached internally for
- # a short period of time, after it is sent to
- # the NAS. The reply packet may be lost in
- # the network, and the NAS will not see it.
- # The NAS will then resend the request, and
- # the server will respond quickly with the
+ # The reply is normally cached internally for a short period of
+ # time, after it is sent to the NAS. The reply packet may be lost
+ # in the network, and the NAS will not see it. The NAS will then
+ # resend the request, and the server will respond quickly with the
# cached reply.
#
- # If this value is set too low, then
- # duplicate requests from the NAS MAY NOT be
- # detected, and will instead be handled as
- # separate requests.
+ # If this value is set too low, then duplicate requests from the
+ # NAS MAY NOT be detected, and will instead be handled as separate
+ # requests.
#
- # If this value is set too high, then the
- # server will use more memory for no benefit.
+ # If this value is set too high, then the server will use more
+ # memory for no benefit.
#
- # This value can include a decimal number of
- # seconds, e.g. "4.1".
+ # This value can include a decimal number of seconds, e.g. "4.1".
#
# Useful range of values: 2 to 30
#
#
# ==== UDP Transport
#
- # When the `listen` section contains `transport =
- # udp`, it looks for a "udp" subsection. This
- # subsection contains all of the configuration for
- # the UDP transport.
+ # When the `listen` section contains `transport = udp`, it looks
+ # for a "udp" subsection. This subsection contains all of the
+ # configuration for the UDP transport.
#
udp {
#
- # ipaddr:: The IP address where FreeRADIUS
- # accepts packets.
+ # ipaddr:: The IP address where FreeRADIUS accepts packets.
#
- # The address can be IPv4, IPv6, a numbered
- # IP address, or a host name. If a host name
- # is used, the IPv4 address is preferred.
- # When there is no IPv4 address for a host
- # name, the IPv6 address is used.
+ # The address can be IPv4, IPv6, a numbered IP address, or a host
+ # name. If a host name is used, the IPv4 address is preferred.
+ # When there is no IPv4 address for a host name, the IPv6 address
+ # is used.
#
- # As with UDP, `ipaddr`, `ipv4addr`, and `ipv6addr`
- # are all allowed.
+ # As with UDP, `ipaddr`, `ipv4addr`, and `ipv6addr` are all
+ # allowed.
#
# ipv4addr:: Use IPv4 addresses.
#
- # The same as `ipaddr`, but will only use
- # IPv4 addresses.
+ # The same as `ipaddr`, but will only use IPv4 addresses.
#
# ipv6addr:: Use IPv6 addresses.
#
- # The same as `ipaddr`, but will only use
- # IPv6 addresses.
+ # The same as `ipaddr`, but will only use IPv6 addresses.
#
ipaddr = *
#
- # port:: the UDP where FreeRADIUS accepts
- # packets.
+ # port:: the UDP where FreeRADIUS accepts packets.
#
- # The default port for Access-Accept packets
- # is `1812`.
+ # The default port for Access-Accept packets is `1812`.
#
port = 1812
#
- # dynamic_clients:: Whether or not we allow
- # dynamic clients.
+ # dynamic_clients:: Whether or not we allow dynamic clients.
#
- # If set to `true`, then packets from unknown
- # clients are passed through the `new
- # client` subsection below. See that section
- # for more information about how dynamic
- # clients work.
+ # If set to `true`, then packets from unknown clients are passed
+ # through the `new client` subsection below. See that section for
+ # more information about how dynamic clients work.
#
# dynamic_clients = true
#
- # networks:: The list of networks which are
- # allowed to send packets to FreeRADIUS for
- # dynamic clients.
+ # networks:: The list of networks which are allowed to send
+ # packets to FreeRADIUS for dynamic clients.
#
- # If there are no dynamic clients, then this
- # section is ignored.
+ # If there are no dynamic clients, then this section is ignored.
#
- # The purpose of the `networks` subsection is
- # to ensure that only a small set of source
- # IPs can trigger dynamic clients. If anyone
- # could trigger dynamic clients, then the
- # server would be subject to a DoS attack.
+ # The purpose of the `networks` subsection is to ensure that only
+ # a small set of source IPs can trigger dynamic clients. If anyone
+ # could trigger dynamic clients, then the server would be subject
+ # to a DoS attack.
#
networks {
#
- # allow:: Allow packets from these
- # networks to define dynamic clients.
+ # allow:: Allow packets from these networks to define dynamic clients.
#
- # Packets from all other sources will
- # be rejected.
+ # Packets from all other sources will be rejected.
#
- # When a packet is from an allowed
- # network, it will be run through the
- # `new client` subsection below.
- # That subsection can still reject
- # the client request.
+ # When a packet is from an allowed network, it will be run through the
+ # `new client` subsection below. That subsection can still reject the
+ # client request.
#
- # There is no limit to the number of
- # networks which can be listed here.
+ # There is no limit to the number of networks which can be listed here.
#
allow = 127/8
allow = 192.0.2/24
#
# deny:: deny some networks.
#
- # The default behavior is to only
- # allow packets from the `allow`
- # networks. The `deny` directive
- # allows you to carve out a subset of
- # an `allow` network, where some
- # packets are denied.
+ # The default behavior is to only allow packets from the `allow`
+ # networks. The `deny` directive allows you to carve out a subset of an
+ # `allow` network, where some packets are denied.
#
- # That is, a `deny` network MUST
- # exist within a previous `allow` network.
+ # That is, a `deny` network MUST exist within a previous `allow` network.
#
- # The `allow` and `deny` rules apply
- # only to networks. The order which
- # they appear in the configuration
- # file does not matter.
+ # The `allow` and `deny` rules apply only to networks. The order which
+ # they appear in the configuration file does not matter.
#
# deny = 127.0.0/24
}
#
# ==== TCP Transport
#
- # When the configuration has `transport = tcp`, it
- # looks for a `tcp` subsection. That subsection
- # contains all of the configuration for the TCP
- # transport.
+ # When the configuration has `transport = tcp`, it looks for a
+ # `tcp` subsection. That subsection contains all of the
+ # configuration for the TCP transport.
#
- # Since UDP and TCP are similar, the majority of the
- # configuration items are the same for both of them.
+ # Since UDP and TCP are similar, the majority of the configuration
+ # items are the same for both of them.
#
tcp {
#
- # ipaddr:: The IP address where FreeRADIUS
- # accepts packets.
+ # ipaddr:: The IP address where FreeRADIUS accepts packets.
#
- # It has the same definition and meaning as
- # the UDP `ipaddr` configuration above.
+ # It has the same definition and meaning as the UDP `ipaddr`
+ # configuration above.
#
ipaddr = *
#
- # NOTE: As with v3, `ipaddr`, `ipv4addr`, and `ipv6addr`
- # are all allowed.
+ # NOTE: As with v3, `ipaddr`, `ipv4addr`, and `ipv6addr` are all
+ # allowed.
#
#
- # port:: the TCP where FreeRADIUS accepts
- # packets.
+ # port:: the TCP where FreeRADIUS accepts packets.
#
- # The default port for Access-Accept packets
- # is `1812`.
+ # The default port for Access-Accept packets is `1812`.
#
port = 1812
#
# dynamic_clients:: Whether or not we allow dynamic clients.
#
- # If set to true, then packets from unknown
- # clients are passed through the "new client"
- # subsection below. See that section for
+ # If set to true, then packets from unknown clients are passed
+ # through the "new client" subsection below. See that section for
# more information.
#
# dynamic_clients = true
#
# networks { ... }::
#
- # If dynamic clients are allowed, then limit
- # them to only a small set of source
- # networks.
+ # If dynamic clients are allowed, then limit them to only a small
+ # set of source networks.
#
- # If dynamic clients are not allowed, then
- # this section is ignored.
+ # If dynamic clients are not allowed, then this section is
+ # ignored.
#
networks {
#
- # allow:: Allow packets from a network.
+ # allow:: Allow packets from a network.
#
# deny:: Deny packets from a network.
#
- # Allow or deny packets from these networks
- # to define dynamic clients.
+ # Allow or deny packets from these networks to define dynamic clients.
#
- # Packets from all other sources will
- # be discarded.
+ # Packets from all other sources will be discarded.
#
- # Even if a packet is from an allowed
- # network, it still must be permitted
+ # Even if a packet is from an allowed network, it still must be permitted
# by the "new client" subsection.
#
- # There is no limit to the number of
- # networks which can be listed here.
+ # There is no limit to the number of networks which can be listed here.
#
- # The allow / deny checks are organised by
- # address. The order of the items given here
- # does not matter.
+ # The allow / deny checks are organised by address. The order of the
+ # items given here does not matter.
#
allow = 127/8
allow = 192.0.2/24
tcp {
#
- # As with v3, "ipaddr", "ipv4addr", and "ipv6addr"
- # are all allowed.
+ # As with v3, "ipaddr", "ipv4addr", and "ipv6addr" are all
+ # allowed.
#
ipaddr = *
port = 1812
#
# Whether or not we allow dynamic clients.
#
- # If set to true, then packets from unknown
- # clients are passed through the "new client"
- # subsection below. See that section for
+ # If set to true, then packets from unknown clients are passed
+ # through the "new client" subsection below. See that section for
# more information.
#
# dynamic_clients = true
#
- # If dynamic clients are allowed, then limit
- # them to only a small set of source
- # networks.
+ # If dynamic clients are allowed, then limit them to only a small
+ # set of source networks.
#
- # If dynamic clients are not allowed, then
- # this section is ignored.
+ # If dynamic clients are not allowed, then this section is
+ # ignored.
#
networks {
#
- # Allow packets from these networks
- # to define dynamic clients.
+ # Allow packets from these networks to define dynamic clients.
#
- # Packets from all other sources will
- # be rejected.
+ # Packets from all other sources will be rejected.
#
- # Even if a packet is from an allowed
- # network, it still must be allowed
+ # Even if a packet is from an allowed network, it still must be allowed
# by the "new client" subsection.
#
- # There is no limit to the number of
- # networks which can be listed here.
+ # There is no limit to the number of networks which can be listed here.
#
allow = 127/8
allow = 192.0.2/24
#
# === Local Clients
#
- # The "client" sections can can also be placed here. Unlike
- # v3, they do not need to be wrapped in a "clients" section.
- # They can just co-exist beside the "listen" sections.
+ # The "client" sections can can also be placed here. Unlike v3, they
+ # do not need to be wrapped in a "clients" section. They can just
+ # co-exist beside the "listen" sections.
#
- # Clients listed here will apply to *all* listeners in this
- # virtual server.
+ # Clients listed here will apply to *all* listeners in this virtual
+ # server.
#
- # The clients listed here take precedence over the global
- # clients.
+ # The clients listed here take precedence over the global clients.
#
client localhost {
shortname = sample
ipaddr = 192.0.2.1
secret = testing123
- # The other "client" configuration items can be added
- # here, too.
+ # The other "client" configuration items can be added here, too.
}
#
recv Access-Request {
#
- # Take a `User-Name`, and perform some checks on it, for
- # spaces and other invalid characters. If the `User-Name`
- # is invalid, reject the request.
+ # Take a `User-Name`, and perform some checks on it, for spaces and
+ # other invalid characters. If the `User-Name` is invalid, reject
+ # the request.
#
- # See policy.d/filter for the definition of the
- # filter_username policy.
+ # See policy.d/filter for the definition of the filter_username
+ # policy.
#
filter_username
#
- # Some broken equipment sends passwords with embedded
- # zeros, i.e. the debug output will show:
+ # Some broken equipment sends passwords with embedded zeros, i.e.
+ # the debug output will show:
#
# User-Password = "password\000\000"
#
# This policy will fix the password to just be "password".
#
-# filter_password
+ # filter_password
#
- # If you intend to use CUI and you require that the
- # Operator-Name be set for CUI generation and you want to
- # generate CUI also for your local clients, then uncomment
- # operator-name below and set the operator-name for
- # your clients in clients.conf.
+ # If you intend to use CUI and you require that the Operator-Name be
+ # set for CUI generation and you want to generate CUI also for your
+ # local clients, then uncomment operator-name below and set the
+ # operator-name for your clients in clients.conf.
#
-# operator-name
+ # operator-name
#
# Proxying example
#
- # The following example will proxy the request if the
- # username ends in example.com.
+ # The following example will proxy the request if the username ends
+ # in example.com.
#
-# if (User-Name =~ /@example\.com$/) {
-# control.Auth-Type := "proxy-example.com"
-# }
+ # if (User-Name =~ /@example\.com$/) {
+ # control.Auth-Type := "proxy-example.com"
+ # }
#
- # If you want to generate CUI for some clients that do
- # not send proper CUI requests, then uncomment cui below
- # and set "add_cui = yes" for these clients in
- # clients.conf.
+ # If you want to generate CUI for some clients that do not send
+ # proper CUI requests, then uncomment cui below and set "add_cui =
+ # yes" for these clients in clients.conf.
#
-# cui
+ # cui
#
- # The `auth_log` module will write all `Access-Request` packets to a file.
+ # The `auth_log` module will write all `Access-Request` packets to a
+ # file.
#
- # Uncomment the next bit in order to have a log of
- # authentication requests. For more information, see
- # `mods-available/detail.log`.
+ # Uncomment the next bit in order to have a log of authentication
+ # requests. For more information, see `mods-available/detail.log`.
#
-# auth_log
+ # auth_log
#
- # The `chap` module will set `Auth-Type := ::CHAP` if the
- # packet contains a `CHAP-Challenge` attribute. The module
- # does this only if the `Auth-Type` attribute has not already
- # been set.
+ # The `chap` module will set `Auth-Type := ::CHAP` if the packet
+ # contains a `CHAP-Challenge` attribute. The module does this only
+ # if the `Auth-Type` attribute has not already been set.
#
chap
#
- # The `mschap` module will set `Auth-Type := ::mschap` if the
- # packet contains an `MS-CHAP-Challenge` attribute. The
- # module does this only if the `Auth-Type` attribute has not
- # already been set.
+ # The `mschap` module will set `Auth-Type := ::mschap` if the packet
+ # contains an `MS-CHAP-Challenge` attribute. The module does this
+ # only if the `Auth-Type` attribute has not already been set.
#
mschap
#
- # The `digest` module implements the SIP Digest
- # authentication method.
+ # The `digest` module implements the SIP Digest authentication
+ # method.
#
- # Note that the module does not implement RFC 4590. Instead,
- # it implements an earlier draft of the specification. Since
- # all of the NAS equipment also implements the earlier draft,
- # this limitation is fine.
+ # Note that the module does not implement RFC 4590. Instead, it
+ # implements an earlier draft of the specification. Since all of the
+ # NAS equipment also implements the earlier draft, this limitation
+ # is fine.
#
- # If you have a Cisco SIP server authenticating against
- # FreeRADIUS, the `digest` module will set `Auth-Type :=
- # "Digest"` if we are handling a SIP Digest request and the
- # `Auth-Type` has not already been set.
+ # If you have a Cisco SIP server authenticating against FreeRADIUS,
+ # the `digest` module will set `Auth-Type := "Digest"` if we are
+ # handling a SIP Digest request and the `Auth-Type` has not already
+ # been set.
#
digest
#
- # The `eap` module takes care of all EAP authentication,
- # including EAP-MD5, EAP-TLS, PEAP and EAP-TTLS.
+ # The `eap` module takes care of all EAP authentication, including
+ # EAP-MD5, EAP-TLS, PEAP and EAP-TTLS.
#
- # The module also sets the EAP-Type attribute in the request
- # list, to the incoming EAP type.
+ # The module also sets the EAP-Type attribute in the request list,
+ # to the incoming EAP type.
#
- # The `eap` module returns `ok` or `updated` if it is not yet ready to
- # authenticate the user. The configuration below checks for
- # that return value, and if so, stops processing the current
- # section.
+ # The `eap` module returns `ok` or `updated` if it is not yet ready
+ # to authenticate the user. The configuration below checks for that
+ # return value, and if so, stops processing the current section.
#
- # The result is that any LDAP and/or SQL servers will not be
- # queried during the initial set of packets that go back and
- # forth to set up EAP-TTLS or PEAP.
+ # The result is that any LDAP and/or SQL servers will not be queried
+ # during the initial set of packets that go back and forth to set up
+ # EAP-TTLS or PEAP.
#
- # We also recommend doing user lookups in the `inner-tunnel`
- # virtual server.
+ # We also recommend doing user lookups in the `inner-tunnel` virtual
+ # server.
#
eap {
ok = return
}
#
- # The `unix` module will obtain passwords from `/etc/passwd`
- # or `/etc/shadow`. It does this via the system API's, which
- # are not thread-safe. We do not recommend using the `unix` module.
+ # The `unix` module will obtain passwords from `/etc/passwd` or
+ # `/etc/shadow`. It does this via the system API's, which are not
+ # thread-safe. We do not recommend using the `unix` module.
#
-# unix
+ # unix
#
- # Read what used to be the `users` file. Since v3, this file
- # is located in `mods-config/files/authorize`.
+ # Read what used to be the `users` file. Since v3, this file is
+ # located in `mods-config/files/authorize`.
#
files
#
- # Look in an SQL database. The schema of the database is
- # meant to mirror the `users` file.
+ # Look in an SQL database. The schema of the database is meant to
+ # mirror the `users` file.
#
-sql
#
# If you are using /etc/smbpasswd, and are also doing mschap
- # authentication, the uncomment this line, configure the
- # module.
+ # authentication, the uncomment this line, configure the module.
#
-# smbpasswd
+ # smbpasswd
#
- # The `ldap` module reads passwords and other attributes from
- # an LDAP database.
+ # The `ldap` module reads passwords and other attributes from an
+ # LDAP database.
#
-ldap
#
- # Enforce daily limits on time spent logged in. This module
- # is a variant of the `counter` module.
+ # Enforce daily limits on time spent logged in. This module is a
+ # variant of the `counter` module.
#
-# dailycounter
+ # dailycounter
#
- # See if the account has expired: check the time in the
- # `Expiration` attribute and reject if we are past it.
- # If the account has not expired, set `Session-Timeout`.
+ # See if the account has expired: check the time in the `Expiration`
+ # attribute and reject if we are past it. If the account has not
+ # expired, set `Session-Timeout`.
#
expiration
#
- # The `pap` module will set `Auth-Type := ::PAP` if the
- # packet contains a `User-Password` attribute. The module
- # does this only if the `Auth-Type` attribute has not already
- # been set.
+ # The `pap` module will set `Auth-Type := ::PAP` if the packet
+ # contains a `User-Password` attribute. The module does this only if
+ # the `Auth-Type` attribute has not already been set.
#
- # The `pap` module is also responsible for "normalizing" the
- # various kinds of "known good" passwords.
- # e.g. `Password.NT` may come as a 16 byte blob, or as a
- # 32-byte hex string, or as a base-64 encoded string. The
- # `pap` module will look for common variations of password
- # encoding, and convert them all to a normal form.
+ # The `pap` module is also responsible for "normalizing" the various
+ # kinds of "known good" passwords. e.g. `Password.NT` may come as a
+ # 16 byte blob, or as a 32-byte hex string, or as a base-64 encoded
+ # string. The `pap` module will look for common variations of
+ # password encoding, and convert them all to a normal form.
#
- # This module should be listed last, so that the other
- # modules get a chance to set Auth-Type for themselves.
+ # This module should be listed last, so that the other modules get a
+ # chance to set Auth-Type for themselves.
#
pap
}
# === Receive Status-Server packets
#
#
-# This section is processed when the server receives a `Status-Server`
-# packet.
+# This section is processed when the server receives a
+# `Status-Server` packet.
#
recv Status-Server {
#
# `Auth-Type` attribute, which should have been set by the `recv
# Access-Request` section, above.
#
-# Since version 4, proxying also happens in this section. For more
+# Since version 4, proxying also happens in this section. For more
# information on how proxying has changed in version 4, please see
# https://www.freeradius.org/documentation/freeradius-server/4.0.0/howto/upgrade/proxy.html
#
# For authentication, you should generally NOT set the `Auth-Type`
-# attribute. As noted above, the modules will usually figure it what
-# to do, and will do the right thing. The most common side effect of
+# attribute. As noted above, the modules will usually figure it what
+# to do, and will do the right thing. The most common side effect of
# erroneously setting the `Auth-Type` attribute is that one
# authentication method will work, but all of the others will not.
#
-# The common reasons to set the `Auth-Type` attribute by hand are
-# to forcibly reject the user (`Auth-Type := ::Reject`), to or
-# forcibly accept the user (`Auth-Type := ::Accept`), or for
-# proxying.
+# The common reasons to set the `Auth-Type` attribute by hand are to
+# forcibly reject the user (`Auth-Type := ::Reject`), to or forcibly
+# accept the user (`Auth-Type := ::Accept`), or for proxying.
#
-# Note that `Auth-Type := ::Accept` will NOT work with EAP. The EAP
-# authentication protocol uses a series of handshake messages. All
-# of the messages must be exchanged correctly in order for EAP
-# authentication to succeed. Bypassing that process with `Auth-Type
+# Note that `Auth-Type := ::Accept` will NOT work with EAP. The EAP
+# authentication protocol uses a series of handshake messages. All of
+# the messages must be exchanged correctly in order for EAP
+# authentication to succeed. Bypassing that process with `Auth-Type
# := Accept` will just result in the user being rejected.
#
# Policy configuration should generally go in the `send ...` sections
#
# For users who are using PAP authentication. A back-end database
# listed in the "recv Access-Request" section MUST supply a "known
-# good" password for the user. The password can be clear-text, or
+# good" password for the user. The password can be clear-text, or
# encrypted via `crypt`, `bcrypt`, or other hashing.
#
authenticate pap {
#
# === MS-CHAP authentication
#
-# For users who are using MS-CHAP authentication. A back-end
-# database listed in the "recv Access-Request" section MUST supply
-# either a Password.Cleartext attribute, or a Password.NT
-# attribute. Encrypted passwords won't work.
+# For users who are using MS-CHAP authentication. A back-end database
+# listed in the "recv Access-Request" section MUST supply either a
+# Password.Cleartext attribute, or a Password.NT attribute. Encrypted
+# passwords won't work.
#
authenticate mschap {
mschap
#
# Authenticate with PAM (Pluggable Authentication Modules).
#
-# We do not recommend using PAM. The server has enough functionality
+# We do not recommend using PAM. The server has enough functionality
# that anything that can be done in PAM can be done easier in
# FreeRADIUS.
#
# === LDAP Authentication
#
# For users who are using PAP, and when you can't get the "known
-# good" password from LDAP. The module binds to the LDAP directory
-# as the user, along with the password taken from the User-Password
-# attribute. The "bind as user" method means that CHAP, MS-CHAP, and
+# good" password from LDAP. The module binds to the LDAP directory as
+# the user, along with the password taken from the User-Password
+# attribute. The "bind as user" method means that CHAP, MS-CHAP, and
# EAP won't work, as they do not supply a plain-text password.
#
# We do NOT recommend using this. LDAP servers are databases, not
-# authentication servers. It is only here as a last resort for
+# authentication servers. It is only here as a last resort for
# databases such as Active Directory.
#
# We strongly recommend using `ldap` in the `recv Access-Request`
-# section. And, ensuring that the account used by FreeRADIUS has
-# read permission on all of the users, groups, and passwords.
+# section. And, ensuring that the account used by FreeRADIUS has read
+# permission on all of the users, groups, and passwords.
#
authenticate ldap {
-ldap
#
# === Proxying
#
-# Proxying has changed substantially from v3 to v4. These changes
-# are complex, but were necessary in order to support new features.
-# The result is that configurations which were impossible in v3 are
-# now trivial in v4. For example:
+# Proxying has changed substantially from v3 to v4. These changes are
+# complex, but were necessary in order to support new features. The
+# result is that configurations which were impossible in v3 are now
+# trivial in v4. For example:
#
# * sending the same packet to multiple destinations, along with retransmissions
# * sending the same packet to multiple destinations in parallel
# defining the home servers in `mods-available/radius`.
#
# If you need to edit the request and/or the reply, you should use
-# the `subrequest` keyword. See the `subrequest` documentation
-# for more information.
+# the `subrequest` keyword. See the `subrequest` documentation for
+# more information.
#
##authenticate example.com {
# === send Access-Challenge packets
#
#
-# This section is called when sending an Access-Challenge
-# response. It is configured to filter out all attributes that should
-# not be in the packet.
+# This section is called when sending an Access-Challenge response.
+# It is configured to filter out all attributes that should not be in
+# the packet.
#
send Access-Challenge {
attr_filter.access_challenge
#
send Access-Accept {
#
- # If you need to have a State attribute, you can add it
- # here. e.g. for later CoA-Request with State, and
- # Service-Type = ::Authorize-Only.
+ # If you need to have a State attribute, you can add it here. e.g.
+ # for later CoA-Request with State, and Service-Type =
+ # ::Authorize-Only.
#
-# if (!reply.State) {
-# reply.State := "0x%str.rand(16h)"
-# }
+ # if (!reply.State) {
+ # reply.State := "0x%str.rand(16h)"
+ # }
#
- # For EAP-TTLS and PEAP, add any cached attributes to the
- # reply. The "session-state" attributes are automatically
- # cached when an Access-Challenge is sent, and retrieved
- # when an `Access-Request` is received.
+ # For EAP-TTLS and PEAP, add any cached attributes to the reply. The
+ # "session-state" attributes are automatically cached when an
+ # Access-Challenge is sent, and retrieved when an `Access-Request`
+ # is received.
#
# The `session-state` attributes are deleted after an
# `Access-Reject` or `Access-Accept` packet has been sent.
#
# Get an address from the IP Pool.
#
-# sqlippool
+ # sqlippool
#
- # Create the CUI value and add the attribute to
- # Access-Accept. Uncomment the line below if
- # *returning* the CUI to the NAS.
+ # Create the CUI value and add the attribute to Access-Accept.
+ # Uncomment the line below if *returning* the CUI to the NAS.
#
-# cui
+ # cui
#
- # If you want to have a log of authentication replies,
- # uncomment the following line. This is defined in
- # `mods-available/detail.log`.
+ # If you want to have a log of authentication replies, uncomment the
+ # following line. This is defined in `mods-available/detail.log`.
#
-# reply_log
+ # reply_log
#
# After authenticating the user, do another SQL query.
-sql
#
- # Uncomment the following if you want to modify the
- # user's object in LDAP after a successful login.
+ # Uncomment the following if you want to modify the user's object in
+ # LDAP after a successful login.
#
-# ldap
+ # ldap
#
- # If there is a client certificate (EAP-TLS, and very
- # occasionally PEAP and EAP-TTLS), then some attributes
- # are filled out after the certificate verification has
- # been performed. These fields MAY be available during
- # the authentication, or they may be available only in
- # the appropriate "send" section.
+ # If there is a client certificate (EAP-TLS, and very occasionally
+ # PEAP and EAP-TTLS), then some attributes are filled out after the
+ # certificate verification has been performed. These fields MAY be
+ # available during the authentication, or they may be available only
+ # in the appropriate "send" section.
#
- # The first set of attributes contains information about
- # the issuing certificate which is being used. The second
- # contains information about the client certificate (if
- # available).
+ # The first set of attributes contains information about the issuing
+ # certificate which is being used. The second contains information
+ # about the client certificate (if available).
#
## reply += {
## Reply-Message = "%{session-state.TLS-Certificate.Serial}"
#
# Insert the `Class` attribute with a unique value into the
- # response, which aids matching auth and acct records and
- # protects against duplicate Acct-Session-Id.
+ # response, which aids matching auth and acct records and protects
+ # against duplicate Acct-Session-Id.
#
- # NOTE: This only works if the NAS has implemented RFC
- # 2865 behaviour for the Class attribute, AND if the NAS
- # supports long Class attributes. Many older or cheap
- # NASes only support 16-octet Class attributes.
+ # NOTE: This only works if the NAS has implemented RFC 2865
+ # behaviour for the Class attribute, AND if the NAS supports long
+ # Class attributes. Many older or cheap NASes only support 16-octet
+ # Class attributes.
#
-# insert_acct_class
+ # insert_acct_class
#
- # MacSEC requires the use of `EAP-Key-Name`. However, we
- # don't want to send it for all EAP sessions. Therefore, the
- # EAP modules put required data into the `EAP-Session-Id`
- # attribute. This attribute is never put into a request or
- # reply packet.
+ # MacSEC requires the use of `EAP-Key-Name`. However, we don't want
+ # to send it for all EAP sessions. Therefore, the EAP modules put
+ # required data into the `EAP-Session-Id` attribute. This attribute
+ # is never put into a request or reply packet.
#
- # Uncomment the next few lines to copy the required data
- # into the EAP-Key-Name attribute.
+ # Uncomment the next few lines to copy the required data into the
+ # EAP-Key-Name attribute.
#
## if (reply.EAP-Session-Id) {
## reply.EAP-Key-Name := reply.EAP-Session-Id
# - equivalent to the previous log `auth = yes` option in v3.
# See `mods-enabled/linelog` for message formats and destinations.
#
-# log_auth_access_accept
+ # log_auth_access_accept
#
- # Remove `Reply-Message` if the response contains an
- # `EAP-Message` attribute. Some NAS equipment will
- # automatically convert the `Reply-Message` to an "EAP
- # notification" packet, which will cause end-user machines to
- # drop the network connection.
+ # Remove `Reply-Message` if the response contains an `EAP-Message`
+ # attribute. Some NAS equipment will automatically convert the
+ # `Reply-Message` to an "EAP notification" packet, which will cause
+ # end-user machines to drop the network connection.
#
remove_reply_message_if_eap
}
# to the NAS.
#
# The `session-state` list is available while this section is being
-# processed. But all of the attributes in that list are discarded as
+# processed. But all of the attributes in that list are discarded as
# soon as the section is finished.
#
send Access-Reject {
-sql
#
- # Filter out attributes that should not be in
- # Access-Reject packets.
+ # Filter out attributes that should not be in Access-Reject packets.
#
attr_filter.access_reject
# - equivalent to the previous log `auth = yes` option in v3.
# See `mods-enabled/linelog` for message formats and destinations.
#
-# log_auth_access_reject
+ # log_auth_access_reject
#
- # Remove `Reply-Message` if the response contains an
- # `EAP-Message` attribute. Some NAS equipment will
- # automatically convert the `Reply-Message` to an "EAP
- # notification" packet, which will cause end-user machines to
- # drop the network connection.
+ # Remove `Reply-Message` if the response contains an `EAP-Message`
+ # attribute. Some NAS equipment will automatically convert the
+ # `Reply-Message` to an "EAP notification" packet, which will cause
+ # end-user machines to drop the network connection.
#
remove_reply_message_if_eap
#
- # Delay sending the `Access-Reject` packet. This is no
- # longer automatic as it was in version 3.
+ # Delay sending the `Access-Reject` packet. This is no longer
+ # automatic as it was in version 3.
#
delay_reject
}
# == Accounting
#
#
-# This section deals with receiving Accounting requests and
-# sending Accounting responses.
+# This section deals with receiving Accounting requests and sending
+# Accounting responses.
#
######################################################################
#
recv Accounting-Request {
#
- # Merge Acct-[Input|Output]-Gigawords and
- # Acct-[Input-Output]-Octets into a single 64-bit
- # counter, Acct-[Input|Output]-Octets64.
+ # Merge Acct-[Input|Output]-Gigawords and Acct-[Input-Output]-Octets
+ # into a single 64-bit counter, Acct-[Input|Output]-Octets64.
#
-# acct_counters64
+ # acct_counters64
#
- # Session start times are *implied* in RADIUS. The NAS never
- # sends a "start time". Instead, it sends a start packet,
- # *possibly* with an Acct-Delay-Time, or an Event-Timestamp.
- # The server is supposed to conclude that the start time was
- # "Acct-Delay-Time" seconds in the past.
+ # Session start times are *implied* in RADIUS. The NAS never sends a
+ # "start time". Instead, it sends a start packet, *possibly* with an
+ # Acct-Delay-Time, or an Event-Timestamp. The server is supposed to
+ # conclude that the start time was "Acct-Delay-Time" seconds in the
+ # past.
#
# If there's no Event-Timestamp, then we create one, using
- # Acct-Delay-Time as an offset if it exists. BUT we only do
- # this if Acct-Delay-Time exists, and has a reasonable value.
+ # Acct-Delay-Time as an offset if it exists. BUT we only do this if
+ # Acct-Delay-Time exists, and has a reasonable value.
#
if (!Event-Timestamp) {
Event-Timestamp := %time.request()
}
#
- # Ensure that we have a semi-unique identifier for every
- # request, as many NAS boxes are broken.
+ # Ensure that we have a semi-unique identifier for every request, as
+ # many NAS boxes are broken.
#
acct_unique
# Version 4 allows for sections specific to Acct-Status-Type.
#
# Once the `recv Accounting-Request` section is processed, one of the
-# `accounting ... { ... }` sections will be run, based on the
-# value of the `Acct-Status-Type` attribute.
+# `accounting ... { ... }` sections will be run, based on the value
+# of the `Acct-Status-Type` attribute.
#
# After the `accounting ... { ... }` section has been run, it will
# then process the `send Accounting-Response` section
#
# Refresh leases when we see a start.
#
- # Ensure that control.IP-Pool.Name is set to determine which
- # pool of IPs are used. Set this in `recv Accounting-Request` so
- # it is available for all the accounting sections.
+ # Ensure that control.IP-Pool.Name is set to determine which pool of
+ # IPs are used. Set this in `recv Accounting-Request` so it is
+ # available for all the accounting sections.
#
-# sqlippool
+ # sqlippool
}
#
-sql
#
- # If you receive stop packets with zero session length,
- # they will NOT be logged in the database. The SQL
- # module will print a message (only in debugging mode),
- # and will return "noop".
+ # If you receive stop packets with zero session length, they will
+ # NOT be logged in the database. The SQL module will print a message
+ # (only in debugging mode), and will return "noop".
#
- # You can ignore these packets by uncommenting the
- # following three lines. Otherwise, the server will not
- # respond to the accounting request, and the NAS will
- # retransmit.
+ # You can ignore these packets by uncommenting the following three
+ # lines. Otherwise, the server will not respond to the accounting
+ # request, and the NAS will retransmit.
#
## if (noop) {
## ok
#
# Return an address to the IP Pool when we see a stop record.
#
-# sqlippool
+ # sqlippool
}
#
#
# Refresh leases when we see an alive.
#
-# sqlippool
+ # sqlippool
}
#
#
# Return all addresses related to this NAS to the IP Pool
#
-# sqlippool
+ # sqlippool
}
#
#
# Return all addresses related to this NAS to the IP Pool
#
-# sqlippool
+ # sqlippool
}
#
# * Tunnel-Link-Stop
# * Tunnel-Link-Reject
#
-# Some vendors also define their own values, which is a very bad idea.
+# Some vendors also define their own values, which is a very bad
+# idea.
#
#
# === Send Accounting-Response.
#
-# Log the accounting data before replying. If logging fails then
-# the reply will not be sent, which means the NAS will send the
-# request again.
+# Log the accounting data before replying. If logging fails then the
+# reply will not be sent, which means the NAS will send the request
+# again.
#
send Accounting-Response {
#
- # Add the CUI attribute from the corresponding
- # Access-Accept to the Accounting-Response.
+ # Add the CUI attribute from the corresponding Access-Accept to the
+ # Accounting-Response.
#
- # Use it only if your NAS boxes do not support CUI
- # themselves.
+ # Use it only if your NAS boxes do not support CUI themselves.
#
-# cui
+ # cui
#
- # Create a 'detail'ed log of the packets. Note that
- # accounting requests which are proxied are also logged
- # in the detail file.
+ # Create a 'detail'ed log of the packets. Note that accounting
+ # requests which are proxied are also logged in the detail file.
#
detail
#
# Update counters for daily usage calculations.
#
-# daily
+ # daily
#
# Cisco VoIP specific bulk accounting.
#
-# pgsql-voip
+ # pgsql-voip
#
# Filter attributes from the accounting response.
#
# == Finally
#
-# If a `finally` section is defined, then all packets will be processed
-# through it.
+# If a `finally` section is defined, then all packets will be
+# processed through it.
#
-# This includes packets whose processing has been stopped due to reaching
-# `request.timeout`. Such packets can be detected by testing for the
-# `timeout` rcode.
+# This includes packets whose processing has been stopped due to
+# reaching `request.timeout`. Such packets can be detected by testing
+# for the `timeout` rcode.
#
# The `finally` section can be used as a common logging section for
# all packets, allowing their final state to be captured.
server detail {
#
# In v4, all "server" sections MUST start with a "namespace"
- # parameter. This tells the server which protocol is being used.
+ # parameter. This tells the server which protocol is being used.
#
# RADIUS, or DHCPv4, or any other protocol supported by the server.
#
namespace = radius
#
- # This virtual server will read detail files from the
- # following directory.
+ # This virtual server will read detail files from the following
+ # directory.
#
directory = ${radacctdir}/detail
#
listen detail {
#
- # A special-case over-ride for detail files. We are
- # in the RADIUS namespace, but we load a special
- # "detail" handler, instead of the generic RADIUS udp
- # / tcp transports.
+ # A special-case over-ride for detail files. We are in the RADIUS
+ # namespace, but we load a special "detail" handler, instead of the
+ # generic RADIUS udp / tcp transports.
#
- # This configuration also enables "transport = file",
- # which is not normally allowed for RADIUS.
+ # This configuration also enables "transport = file", which is not
+ # normally allowed for RADIUS.
#
handler = detail
type = Accounting-Request
#
- # There is no need to specify a transport.
- # The default is `file`, which is the only
- # one supported.
+ # There is no need to specify a transport. The default is `file`,
+ # which is the only one supported.
#
#
# Unlike v3, there is no "load_factor" configuration.
#
- # Instead, the detail file listener is "self
- # clocking". The listener reads one entry, and as
- # soon as it gets a response to that entry, the
- # listener reads a second entry.
+ # Instead, the detail file listener is "self clocking". The
+ # listener reads one entry, and as soon as it gets a response to
+ # that entry, the listener reads a second entry.
#
- # Packets from the detail listener are low priority,
- # so they are processed only when there is nothing
- # else to do. i.e. if the server receives many
- # Access-Request or Accounting-Request packets from
- # the network, they will be processed *before* any
- # packets from the detail file.
+ # Packets from the detail listener are low priority, so they are
+ # processed only when there is nothing else to do. i.e. if the
+ # server receives many Access-Request or Accounting-Request packets
+ # from the network, they will be processed *before* any packets
+ # from the detail file.
#
- # This behavior ensures that the detail file is read
- # as fast as possible. At the same time, it ensures
- # that the detail file does not affect higher
- # priority packets from the network.
+ # This behavior ensures that the detail file is read as fast as
+ # possible. At the same time, it ensures that the detail file does
+ # not affect higher priority packets from the network.
#
#
- # Set the priority for packets from the detail
- # listener. For safety, it should be set low. This
- # means that "real" packets from a NAS will be
- # processed before packets from the detail listener.
+ # Set the priority for packets from the detail listener. For
+ # safety, it should be set low. This means that "real" packets from
+ # a NAS will be processed before packets from the detail listener.
#
- # i.e. the packets from the detail listener won't be
- # processed until ALL OTHER packets in the system
- # have been received, processed, and responded to.
+ # i.e. the packets from the detail listener won't be processed
+ # until ALL OTHER packets in the system have been received,
+ # processed, and responded to.
#
- # The default is for the server to process packets in
- # the following priority:
+ # The default is for the server to process packets in the following
+ # priority:
#
# Status-Server
# Access-Request
# Accounting-Request
# packets from the "detail" listener.
#
- # This priority setting ensures that the server will
- # be responsive and stable.
+ # This priority setting ensures that the server will be responsive
+ # and stable.
#
# Allowed values: 1 to 65536.
#
# Setting it to "1" means "very low priority".
#
- # Setting it to "65536" means "higher priority than
- # Access-Request packet"
+ # Setting it to "65536" means "higher priority than Access-Request
+ # packet"
#
# priority = 1
filename = "${...directory}/detail-*"
#
- # If there are no detail files in the directory,
- # the listener will periodically wake up to check
- # for new entries.
+ # If there are no detail files in the directory, the listener will
+ # periodically wake up to check for new entries.
#
- # If this is set to `0`. then the server will
- # rely on file system notifications to
- # discover when a detail file has been added.
- # Setting it to `0` only works on Linux. On
- # other operating systems, it MUST be set to
- # a non-zero value.
+ # If this is set to `0`. then the server will rely on file system
+ # notifications to discover when a detail file has been added.
+ # Setting it to `0` only works on Linux. On other operating
+ # systems, it MUST be set to a non-zero value.
#
# Allowed values: 0 to 3600
poll_interval = 5
}
#
- # Configuration related to processing the
- # "detail.work" file.
+ # Configuration related to processing the "detail.work" file.
#
- # This MUST also be specified, along with the "file"
- # subsection above.
+ # This MUST also be specified, along with the "file" subsection
+ # above.
#
work {
#
- # The name of the current working file. If
- # omitted, it is the directory from the
- # `file` subsection, `filename` argument
- # given above, with "/detail.work" appended
- # to it.
+ # The name of the current working file. If omitted, it is the
+ # directory from the `file` subsection, `filename` argument given
+ # above, with "/detail.work" appended to it.
#
- # As of v4, you can have multiple detail file
- # readers in the same directory. The only
- # caveat is that the wildcards CANNOT overlap.
+ # As of v4, you can have multiple detail file readers in the same
+ # directory. The only caveat is that the wildcards CANNOT overlap.
#
- # The best way to enforce that is to give the
- # the files different prefixes.
+ # The best way to enforce that is to give the the files different
+ # prefixes.
#
filename = "${...directory}/detail.work"
#
- # Track progress through the detail file. When the detail
- # file is large, and the server is restarted, it will
- # read from the START of the file.
+ # Track progress through the detail file. When the detail file is
+ # large, and the server is restarted, it will read from the START
+ # of the file.
#
- # Setting `track = yes` means it will skip packets which
- # have already been processed. The default is `no`.
+ # Setting `track = yes` means it will skip packets which have
+ # already been processed. The default is `no`.
#
track = yes
#
- # The maximum size (in bytes) of one entry in
- # the detail file. If this setting is too
- # low, then the "too large" entries in the
+ # The maximum size (in bytes) of one entry in the detail file. If
+ # this setting is too low, then the "too large" entries in the
# detail file will be ignored.
#
max_entry_size = 65536
#
- # Whether or not the detail.work file reader
- # retransmits packets which have failed.
+ # Whether or not the detail.work file reader retransmits packets
+ # which have failed.
#
- # If this configuration item is set to `no`, then
- # the reader will ignore any failures, and will
- # go to the next entry as soon as the current
- # entry is finished, even if it failed to process
- # that entry.
+ # If this configuration item is set to `no`, then the reader will
+ # ignore any failures, and will go to the next entry as soon as
+ # the current entry is finished, even if it failed to process that
+ # entry.
#
# default = yes
#
#
limit {
#
- # Number of simultaneous packets it
- # will read from the file and feed
- # into the server core.
+ # Number of simultaneous packets it will read from the file and feed into
+ # the server core.
#
# Useful values: 1..256
max_outstanding = 1
#
# Initial retransmit time: 1..60
#
- # If there is no response within this time,
- # the module will retransmit the packet.
+ # If there is no response within this time, the module will retransmit
+ # the packet.
#
initial_rtx_time = 1
max_rtx_time = 30
#
- # The following are maximums that *all* apply.
- # i.e. if any one of the limits is hit, the
- # retransmission stops.
+ # The following are maximums that *all* apply. i.e. if any one of the
+ # limits is hit, the retransmission stops.
#
#
# Maximum Retransmit Count: 0..20
#
- # How many times the module will send the packet
- # before giving up.
+ # How many times the module will send the packet before giving up.
#
# A special value of "0" means "retransmit forever".
#
#
# Maximum Retransmit Duration: 0..600
#
- # The total length of time the module will try to
- # retransmit the packet
+ # The total length of time the module will try to retransmit the packet
#
# A special value of "0" means "retransmit forever".
#
}
#
-# The detail file reader runs the normal RADIUS / DHCP / etc. processing sections.
+# The detail file reader runs the normal RADIUS / DHCP / etc.
+# processing sections.
#
recv Accounting-Request {
#
# If there's an Acct-Delay-Time, increase its value based on the
- # difference between when the packet was written, and the current time.
+ # difference between when the packet was written, and the current
+ # time.
#
- # Note that we do NOT rely on any Event-Timestamp in the original packet,
- # it could be wrong.
+ # Note that we do NOT rely on any Event-Timestamp in the original
+ # packet, it could be wrong.
#
if (Acct-Delay-Time) {
Acct-Delay-Time += %l - Packet-Original-Timestamp
}
#
- # We handled the packet successfully. Run the "send ok" section.
+ # We handled the packet successfully. Run the "send ok" section.
#
ok
#
- # If the "recv" section returns "ok" or "updated", it
- # will run the "send ok" section to send the reply.
+ # If the "recv" section returns "ok" or "updated", it will run the
+ # "send ok" section to send the reply.
#
- # All other return codes (e.g. "fail") will cause it to run
- # the "send fail" section.
+ # All other return codes (e.g. "fail") will cause it to run the
+ # "send fail" section.
#
}
#
# If the listener is configured with 'track = yes', then the entry in
-# the detail file is marked up as being "done". Subsequent re-reads
+# the detail file is marked up as being "done". Subsequent re-reads
# of the same detail file (e.g. on server restart) will skip the
# "done" entries.
#
#
# If the listener is configured with 'track = yes', then the packet
# will be retransmitted by the detail file reader, until the packet
-# returns "success". See the "limit" subsection above for retransmission
-# configuration.
+# returns "success". See the "limit" subsection above for
+# retransmission configuration.
#
send Do-Not-Respond {
ok
#
# See mods-config/sql/ippool/ for the schemas.
#
-# See sites-available/dhcp for instructions on how to configure
-# the DHCP server.
+# See sites-available/dhcp for instructions on how to configure the
+# DHCP server.
#
# $Id$
#
# Define a DHCP socket.
#
-# The default port below is 6700, so you don't break your network.
-# If you want it to do real DHCP, change this to 67, and good luck!
+# The default port below is 6700, so you don't break your network. If
+# you want it to do real DHCP, change this to 67, and good luck!
#
-# You can also bind the DHCP socket to an interface.
-# See below, and radiusd.conf for examples.
+# You can also bind the DHCP socket to an interface. See below, and
+# radiusd.conf for examples.
#
# This lets you run *one* DHCP server instance and have it listen on
# multiple interfaces, each with a separate policy.
#
# If you have multiple interfaces, it is a good idea to bind the
-# listen section to an interface. You will also need one listen
+# listen section to an interface. You will also need one listen
# section per interface.
#
listen {
transport = udp
udp {
- # IP address to listen on. Will usually be the IP of the
- # interface, or 0.0.0.0
+ # IP address to listen on. Will usually be the IP of the interface,
+ # or 0.0.0.0
ipaddr = 127.0.0.1
- # The port should be 67 for a production network. Don't set
- # it to 67 on a production network unless you really know
- # what you're doing. Even if nothing is configured below, the
- # server may still NAK legitimate responses from clients.
- # This is also the destination port when sending to a giaddr.
+ # The port should be 67 for a production network. Don't set it to
+ # 67 on a production network unless you really know what you're
+ # doing. Even if nothing is configured below, the server may still
+ # NAK legitimate responses from clients. This is also the
+ # destination port when sending to a giaddr.
port = 6700
- # The port to which server -> client messages should be sent.
- # This should be 68 on a production network, though other ports
- # can be useful for testing.
+ # The port to which server -> client messages should be sent. This
+ # should be 68 on a production network, though other ports can be
+ # useful for testing.
#
- # If this is not set then server -> client replies will be sent
- # to the source port of the client -> server request.
+ # If this is not set then server -> client replies will be sent to
+ # the source port of the client -> server request.
client_port = 68
# Interface name we are listening on. See comments above.
# interface = lo0
- # source IP address for unicast packets sent by the
- # DHCP server.
+ # source IP address for unicast packets sent by the DHCP server.
#
- # The source IP for unicast packets is chosen from the first
- # one of the following items which returns a valid IP
- # address:
+ # The source IP for unicast packets is chosen from the first one of
+ # the following items which returns a valid IP address:
#
# src_ipaddr
# ipaddr
#
# src_ipaddr = 127.0.0.1
- # The DHCP server defaults to allowing broadcast packets.
- # Set this to "no" only when the server receives *all* packets
- # from a relay agent. i.e. when *no* clients are on the same
- # LAN as the DHCP server.
+ # The DHCP server defaults to allowing broadcast packets. Set this
+ # to "no" only when the server receives *all* packets from a relay
+ # agent. i.e. when *no* clients are on the same LAN as the DHCP
+ # server.
#
- # It's set to "no" here for testing. It will usually want to
- # be "yes" in production, unless you are only dealing with
- # relayed packets.
+ # It's set to "no" here for testing. It will usually want to be
+ # "yes" in production, unless you are only dealing with relayed
+ # packets.
broadcast = no
- # On Linux if you're running the server as non-root, you
- # will need to do:
+ # On Linux if you're running the server as non-root, you will need
+ # to do:
#
# sudo setcap cap_net_admin=ei /path/to/radiusd
#
- # This will allow the server to set ARP table entries
- # for newly allocated IPs
+ # This will allow the server to set ARP table entries for newly
+ # allocated IPs
}
}
##}
-# Packets received on the socket will be processed through one
-# of the following sections, named after the DHCP packet type.
-# See dictionary.dhcpv4 for the packet types.
+# Packets received on the socket will be processed through one of the
+# following sections, named after the DHCP packet type. See
+# dictionary.dhcpv4 for the packet types.
# Return packets will be sent to, in preference order:
# Gateway-IP-Address
recv Discover {
- # The DHCP Server Identifier is set here since it is returned in OFFERs
+ # The DHCP Server Identifier is set here since it is returned in
+ # OFFERs
control.Server-Identifier = 192.0.2.1
- # Call a policy (defined in policy.d/dhcp) to set common reply attributes
+ # Call a policy (defined in policy.d/dhcp) to set common reply
+ # attributes
dhcp_common
# Do a simple mapping of MAC to assigned IP.
#
- # See below for the definition of the "mac2ip"
- # module.
+ # See below for the definition of the "mac2ip" module.
#
-# mac2ip
+ # mac2ip
- # If the MAC wasn't found in that list, do something else.
- # You could call a Perl, Python, or Java script here.
+ # If the MAC wasn't found in that list, do something else. You could
+ # call a Perl, Python, or Java script here.
## if (notfound) {
## ...
## }
- # Or, allocate IPs from the DHCP pool in SQL. You may need to
- # set the pool name here if you haven't set it elsewhere.
-# control.IP-Pool.Name := "local"
-# sqlippool
+ # Or, allocate IPs from the DHCP pool in SQL. You may need to set
+ # the pool name here if you haven't set it elsewhere.
+ # control.IP-Pool.Name := "local"
+ # sqlippool
- # If Message-Type is not set, returning "ok" or
- # "updated" from this section will respond with a Offer
- # message.
+ # If Message-Type is not set, returning "ok" or "updated" from this
+ # section will respond with a Offer message.
#
# Other rcodes will tell the server to not return any response.
-# ok
+ # ok
}
recv Request {
- # The DHCP Server Identifier is set here since it is returned in OFFERs
+ # The DHCP Server Identifier is set here since it is returned in
+ # OFFERs
control.Server-Identifier = 192.0.2.1
# If the request is not for this server then silently discard it
do_not_respond
}
- # Call a policy (defined in policy.d/dhcp) to set common reply attributes
+ # Call a policy (defined in policy.d/dhcp) to set common reply
+ # attributes
dhcp_common
# Do a simple mapping of MAC to assigned IP.
#
- # See below for the definition of the "mac2ip"
- # module.
+ # See below for the definition of the "mac2ip" module.
#
-# mac2ip
+ # mac2ip
- # If the MAC wasn't found in that list, do something else.
- # You could call a Perl, Python, or Java script here.
+ # If the MAC wasn't found in that list, do something else. You could
+ # call a Perl, Python, or Java script here.
- #if (notfound) {
- # ...
- #}
+ # if (notfound) { ... }
- # Or, allocate IPs from the DHCP pool in SQL. You may need to
- # set the pool name here if you haven't set it elsewhere.
-# control.IP-Pool.Name := "local"
-# sqlippool
+ # Or, allocate IPs from the DHCP pool in SQL. You may need to set
+ # the pool name here if you haven't set it elsewhere.
+ # control.IP-Pool.Name := "local"
+ # sqlippool
if (ok) {
reply.Your-IP-Address := "%{request.Requested-IP-Address || request.Client-IP-Address}"
}
- # If Message-Type is not set, returning "ok" or
- # "updated" from this section will respond with a Ack
- # packet.
+ # If Message-Type is not set, returning "ok" or "updated" from this
+ # section will respond with a Ack packet.
#
- # "handled" will not return a packet, all other rcodes will
- # send back a NAK.
-# ok
+ # "handled" will not return a packet, all other rcodes will send
+ # back a NAK.
+ # ok
}
#
# Other DHCP packet types
#
-# There should be a separate section for each DHCP message type.
-# By default this configuration will ignore them all. Any packet type
+# There should be a separate section for each DHCP message type. By
+# default this configuration will ignore them all. Any packet type
# not defined here will be responded to with a NAK.
recv Decline {
# If using IPs from a DHCP pool in SQL then you may need to set the
- # pool name here if you haven't set it elsewhere and mark the IP as declined.
+ # pool name here if you haven't set it elsewhere and mark the IP as
+ # declined.
## control.IP-Pool.Name := "local"
## sqlippool
}
#
-# A dummy config for Inform packets - this should match the
-# options set in the Request section above, except Inform replies
-# must not set Your-IP-Address or IP-Address-Lease-Time
+# A dummy config for Inform packets - this should match the options
+# set in the Request section above, except Inform replies must not
+# set Your-IP-Address or IP-Address-Lease-Time
#
recv Inform {
- # Call a policy (defined in policy.d/dhcp) to set common reply attributes
+ # Call a policy (defined in policy.d/dhcp) to set common reply
+ # attributes
dhcp_common
ok
}
recv Lease-Query {
- # The thing being queried for is implicit
- # in the packets.
+ # The thing being queried for is implicit in the packets.
# has MAC, asking for IP, etc.
if (Client-Hardware-Address) {
}
#
- # We presume that the database lookup returns "notfound"
- # if it can't find anything.
+ # We presume that the database lookup returns "notfound" if it can't
+ # find anything.
#
if (notfound) {
reply.Message-Type = ::Lease-Unknown
######################################################################
#
# This next section is a sample configuration for the "passwd"
-# module, that reads flat-text files. It should go into
-# radiusd.conf, in the "modules" section.
+# module, that reads flat-text files. It should go into radiusd.conf,
+# in the "modules" section.
#
# The file is in the format <mac>,<ip>
#
######################################################################
-# This is an example only - see mods-available/mac2ip instead; do
-# not uncomment these lines here.
+# This is an example only - see mods-available/mac2ip instead; do not
+# uncomment these lines here.
#
##passwd mac2ip {
## filename = ${confdir}/mac2ip
transport = udp
#
- # See sample dhcp virtual server for details of
- # these options.
+ # See sample dhcp virtual server for details of these options.
#
udp {
ipaddr = *
}
#
-# Packets received on the socket will be processed through one
-# of the following sections, named after the DHCP packet type.
-# See dictionary.dhcp for the packet types.
+# Packets received on the socket will be processed through one of the
+# following sections, named after the DHCP packet type. See
+# dictionary.dhcp for the packet types.
#
recv Discover {
# IP Address of the DHCP server
control.Net.Dst.IP := 192.0.2.2
- # IP Address of the DHCP relay (where the reply should go to)
- # If requests are coming from an upstream relay, this will
- # already be set in the packet
+ # IP Address of the DHCP relay (where the reply should go to) If
+ # requests are coming from an upstream relay, this will already be
+ # set in the packet
request.Gateway-IP-Address := 192.0.2.1
# Call the dhcpv4 module to do the relay
}
#
-# A repeat of the Discover section to handle Request packets
-# This can be repeated for Inform, Release and Decline as required.
+# A repeat of the Discover section to handle Request packets This can
+# be repeated for Inform, Release and Decline as required.
#
recv Request {
control.Net.Dst.IP := 192.0.2.2
namespace = dhcpv6
#
- # all_dhcp_servers_and_relays:: Predefined multicast address
- # for DHCPv6 servers and relays.
+ # all_dhcp_servers_and_relays:: Predefined multicast address for
+ # DHCPv6 servers and relays.
#
- # This configuration item is here for convenience. It allows
- # each `listen` section below to use this definition, so that
- # those sections do not need to list magic numbers.
+ # This configuration item is here for convenience. It allows each
+ # `listen` section below to use this definition, so that those
+ # sections do not need to list magic numbers.
#
all_dhcp_servers_and_relays = FF02::1:2
# interface:: Ethernet interface for DHCPv6.
#
# DHCPv6 servers require multiple listeners, one for multicast
- # packets, and one for unicast packets. Both listeners should
- # use the same interface. So it is defined here once, and used
- # below.
+ # packets, and one for unicast packets. Both listeners should use
+ # the same interface. So it is defined here once, and used below.
#
interface = en0
# port:: The port where we accept packets.
#
# DHCPv6 servers require multiple listeners, one for multicast
- # packets, and one for unicast packets. Both listeners should
- # use the same interface. So it is defined here once, and used
- # below.
+ # packets, and one for unicast packets. Both listeners should use
+ # the same interface. So it is defined here once, and used below.
#
- # The default DHCPv6 port is `547`. We use `5470` here, so that
- # testing will not affect production systems. This value should
- # be changed to `547` for production use.
+ # The default DHCPv6 port is `547`. We use `5470` here, so that
+ # testing will not affect production systems. This value should be
+ # changed to `547` for production use.
#
port = 5470
#
# === The listen section
#
- # DHCPv6 relies on multicast packets to work. We suggest
- # defining only one DHCPv6 "listen" per host machine. This
- # suggestion is because all DHCPv6 listeners will receive all
- # DHCPv6 packets.
+ # DHCPv6 relies on multicast packets to work. We suggest defining
+ # only one DHCPv6 "listen" per host machine. This suggestion is
+ # because all DHCPv6 listeners will receive all DHCPv6 packets.
#
listen all_dhcp_servers_and_relays {
#
# type:: The type of packet to accept.
#
- # Multiple types can be accepted by using multiple
- # lines of `type = ...`.
+ # Multiple types can be accepted by using multiple lines of `type =
+ # ...`.
#
- # All DHCPv6 request types are supported. Relaying
- # is not supported.
+ # All DHCPv6 request types are supported. Relaying is not
+ # supported.
#
type = Solicit
type = Request
#
# server-id:: The Server-ID option for this listener.
#
- # If this configuration item is set, this listener
- # will discard all packets that do not have a
- # matching Server-ID. The listener will also add
- # this Server-ID option to all replies.
+ # If this configuration item is set, this listener will discard all
+ # packets that do not have a matching Server-ID. The listener will
+ # also add this Server-ID option to all replies.
#
- # If this configuration item is not set, then it is
- # your responsibility in the policies below to check
- # the incoming Server-Id values, and to always add
- # the Server-ID option to the replies.
+ # If this configuration item is not set, then it is your
+ # responsibility in the policies below to check the incoming
+ # Server-Id values, and to always add the Server-ID option to the
+ # replies.
#
- # The format of the string is just the contents of a
- # "Server-Id { ...}" attribute that would normally
- # be passed in an "unlang" statement, e.g.:
+ # The format of the string is just the contents of a "Server-Id {
+ # ...}" attribute that would normally be passed in an "unlang"
+ # statement, e.g.:
#
# ```
# server-id = "DUID = ::LLT, LLT = { Hardware-Type = ::Ethernet, Time = "2012-11-21T08:36:00Z", Ethernet = { Address = 00:11:22:33:44:55 }"
#
# ==== UDP Transport
#
- # When the `listen` section contains `transport =
- # udp`, it looks for a "udp" subsection. This
- # subsection contains all of the configuration for
- # the UDP transport.
+ # When the `listen` section contains `transport = udp`, it looks
+ # for a "udp" subsection. This subsection contains all of the
+ # configuration for the UDP transport.
#
udp {
#
- # ipaddr:: The IP address where we accept
- # packets.
+ # ipaddr:: The IP address where we accept packets.
#
- # The address can be IPv6, or a host name.
- # If a host name is used, the IPv6 address is
- # preferred. When there is no IPv6 address
- # for a host name, an error will occur.
+ # The address can be IPv6, or a host name. If a host name is used,
+ # the IPv6 address is preferred. When there is no IPv6 address for
+ # a host name, an error will occur.
#
ipaddr = ${...all_dhcp_servers_and_relays}
#
# port:: The port where we accept packets.
#
- # The port should be 547 for a production
- # network. We do NOT suggest setting it to
- # 547 on a production network unless you
- # know what you are doing. Even if nothing
- # is configured below, the server may still
- # NAK legitimate responses from clients.
+ # The port should be 547 for a production network. We do NOT
+ # suggest setting it to 547 on a production network unless you
+ # know what you are doing. Even if nothing is configured below,
+ # the server may still NAK legitimate responses from clients.
#
port = ${...port}
#
# interface:: Interface where we receive packets.
#
- # When a multicast address is used for `ipaddr` above,
- # and `interface` configuration MUST be given.
+ # When a multicast address is used for `ipaddr` above, and
+ # `interface` configuration MUST be given.
#
interface = ${...interface}
#
- # src_ipaddr:: The source IP address used for
- # unicast messages.
+ # src_ipaddr:: The source IP address used for unicast messages.
#
- # If a `src_ipaddr` is not specified, then
- # the server will try to choose one automatically:
+ # If a `src_ipaddr` is not specified, then the server will try to
+ # choose one automatically:
#
# * If `ipaddr` is unicast, then the server will use
# that as `src_ipaddr`, too.
# look for the first "link local" address on the
# `interface` defined above, and use that.
#
- # In most cases, you should not need to specify
- # `src_ipaddr`.
+ # In most cases, you should not need to specify `src_ipaddr`.
#
# src_ipaddr = ${ipaddr}
}
#
# === The listen section
#
- # DHCPv6 relies on multicast packets to work. We suggest
- # defining only one DHCPv6 "listen" per host machine. This
- # suggestion is because all DHCPv6 listeners will receive all
- # DHCPv6 packets.
+ # DHCPv6 relies on multicast packets to work. We suggest defining
+ # only one DHCPv6 "listen" per host machine. This suggestion is
+ # because all DHCPv6 listeners will receive all DHCPv6 packets.
#
listen local_network {
#
# type:: The type of packet to accept.
#
- # Multiple types can be accepted by using multiple
- # lines of `type = ...`.
+ # Multiple types can be accepted by using multiple lines of `type =
+ # ...`.
#
- # A listener which is using a unicast `ipaddr`
- # should not receive Solicit, Rebind, or Reconfirm
- # packets. Those packets MUST be sent to a multicast
- # address.
+ # A listener which is using a unicast `ipaddr` should not receive
+ # Solicit, Rebind, or Reconfirm packets. Those packets MUST be sent
+ # to a multicast address.
#
type = Request
type = Information-Request
#
# ==== UDP Transport
#
- # When the `listen` section contains `transport =
- # udp`, it looks for a "udp" subsection. This
- # subsection contains all of the configuration for
- # the UDP transport.
+ # When the `listen` section contains `transport = udp`, it looks
+ # for a "udp" subsection. This subsection contains all of the
+ # configuration for the UDP transport.
#
udp {
#
- # ipaddr:: The IP address where we accept
- # packets.
+ # ipaddr:: The IP address where we accept packets.
#
- # The address can be IPv6, or a host name.
- # If a host name is used, the IPv6 address is
- # preferred. When there is no IPv6 address
- # for a host name, an error will occur.
+ # The address can be IPv6, or a host name. If a host name is used,
+ # the IPv6 address is preferred. When there is no IPv6 address for
+ # a host name, an error will occur.
#
- # If an `ipaddr` is not defined, then the
- # configuration MUST specify an `interface`.
- # The server will look for the first
- # "link local" address on that interface,
- # and use that as the value for `ipaddr`.
+ # If an `ipaddr` is not defined, then the configuration MUST
+ # specify an `interface`. The server will look for the first "link
+ # local" address on that interface, and use that as the value for
+ # `ipaddr`.
#
# ipaddr = 2001:db8::
#
dhcpv6 {
#
- # status_code_on_success:: Include a status-code
- # option in the packet even when the operation is
- # successful (status code 0).
+ # status_code_on_success:: Include a status-code option in the
+ # packet even when the operation is successful (status code 0).
#
- # RFC8415 states that the absence of a status-code
- # option is identical to a status-code option with
- # value (0). This option is included in case
- # there are broken DHCPv6 clients that require an
+ # RFC8415 states that the absence of a status-code option is
+ # identical to a status-code option with value (0). This option is
+ # included in case there are broken DHCPv6 clients that require an
# explicit success notification.
#
- # This config item is disabled by default as
- # including status-code adds approximately 6 bytes
- # per nested message, and some clients are buggy
- # and count any status-code option as a failure
+ # This config item is disabled by default as including status-code
+ # adds approximately 6 bytes per nested message, and some clients
+ # are buggy and count any status-code option as a failure
# indication.
#
# status_code_on_success = no
#
- # send_failure_message:: Concatenate the contents
- # of any Module-Failure-Message attribute in the
- # request, and include it in the message field
- # of the status-code option when status-code is
- # not 0 or when `status_code_on_success = yes`.
+ # send_failure_message:: Concatenate the contents of any
+ # Module-Failure-Message attribute in the request, and include it
+ # in the message field of the status-code option when status-code
+ # is not 0 or when `status_code_on_success = yes`.
#
- # This is disabled by default as these messages
- # may reveal sensitive information about the
- # internal state of the server.
+ # This is disabled by default as these messages may reveal
+ # sensitive information about the internal state of the server.
#
- # It's recommended to only enable this config item
- # for debugging, or in conjunction with
- # move_failure_message_to_parent where the upstream
- # relay is trusted and secure.
+ # It's recommended to only enable this config item for debugging,
+ # or in conjunction with move_failure_message_to_parent where the
+ # upstream relay is trusted and secure.
#
# send_failure_message = no
#
- # move_failure_message_to_parent:: Move all
- # Module-Failure-Message attributes to the parent
- # request.
+ # move_failure_message_to_parent:: Move all Module-Failure-Message
+ # attributes to the parent request.
#
# Attributes are only moved when:
#
# - The parent request of type DHCPv6.
# - status-code != 0, or `status_code_on_success = yes`
#
- # When combined with send_failure_message and
- # a secure upstream DHCPv6 relay this provides a
- # useful debugging tool where the reason for a
- # given allocation failure can be determined from
- # packet traces, or trace functionality on the
- # upstream relay.
- #
- # As relays will strip off the outer relay-message
- # as the packet moves through them, the contents
- # of the Module-Failure-Message will not reach
- # the end DHCPv6 client.
+ # When combined with send_failure_message and a secure upstream
+ # DHCPv6 relay this provides a useful debugging tool where the
+ # reason for a given allocation failure can be determined from
+ # packet traces, or trace functionality on the upstream relay.
+ #
+ # As relays will strip off the outer relay-message as the packet
+ # moves through them, the contents of the Module-Failure-Message
+ # will not reach the end DHCPv6 client.
#
# move_failure_message_to_parent = yes
}
#
# = The DNS Virtual Server
#
-# The `dns` virtual server is an example of using `dns` style functionality in FreeRADIUS.
+# The `dns` virtual server is an example of using `dns` style
+# functionality in FreeRADIUS.
#
# == The Virtual Server
#
# This is the `dns` virtual server.
#
-# It's not meant to be fast. Don't use it as a root server, or as a server for an ISP
-# with millions of users. But it should be able to do thousands to tens of thousands
-# of queries per second, without really trying hard.
+# It's not meant to be fast. Don't use it as a root server, or as a
+# server for an ISP with millions of users. But it should be able to
+# do thousands to tens of thousands of queries per second, without
+# really trying hard.
#
-# It's meant to be a _flexible_ DNS server. Want to give different answers to VoIP phones
-# and desktops, or other types of split horizon? It can do that.
+# It's meant to be a _flexible_ DNS server. Want to give different
+# answers to VoIP phones and desktops, or other types of split
+# horizon? It can do that.
#
-# Because DNS uses the Header.Rcode to communicate the result of a query (instead of opcode)
-# the DNS state machine works differently to other protocols.
+# Because DNS uses the Header.Rcode to communicate the result of a
+# query (instead of opcode) the DNS state machine works differently
+# to other protocols.
#
# Requests will pass through the following processing sections:
# - A `recv { ... }` section matching the opcode. e.g. `recv Query { ... }`. Query processing
# To enable dynamic clients in an existing virtual server, copy the
# "dynamic_clients" sub-section of the "udp" listener from the below
# example. Then copy the "new client", "add client", and "deny
-# client" sub-sections into the virtual server. Set `dynamic_clients
+# client" sub-sections into the virtual server. Set `dynamic_clients
# = yes` in the listener, and then the virtual server will be enabled
# for dynamic clients.
#
# When clients are added to a listener, they exist ONLY for that
-# listener. Dynamic clients can process packets ONLY through the
-# virtual server in which they are defined. Unlike v3, you CANNOT
+# listener. Dynamic clients can process packets ONLY through the
+# virtual server in which they are defined. Unlike v3, you CANNOT
# define a global client, and point it to a different virtual server,
#
server dynamic_clients {
namespace = radius
#
- # See the "default" virtual server for examples of how to
- # configure a "listen" section. Only the "dynamic_clients"
- # changes are documented here.
+ # See the "default" virtual server for examples of how to configure
+ # a "listen" section. Only the "dynamic_clients" changes are
+ # documented here.
#
listen {
type = Access-Request
#
limit {
#
- # Limit the number of dynamic clients which
- # can be defined.
+ # Limit the number of dynamic clients which can be defined.
#
- # If there are no dynamic clients, this
- # configuration item is ignored.
+ # If there are no dynamic clients, this configuration item is
+ # ignored.
#
- # The special value of "0" means "no limit".
- # We do not recommend this.
+ # The special value of "0" means "no limit". We do not recommend
+ # this.
#
max_clients = 256
#
- # Limit the total number of connections which
- # used. Each connection opens a new socket,
- # so be aware of system file descriptor
- # limitations.
+ # Limit the total number of connections which used. Each
+ # connection opens a new socket, so be aware of system file
+ # descriptor limitations.
#
- # If the listeners do not use connected
- # sockets, then this configuration item is
- # ignored.
+ # If the listeners do not use connected sockets, then this
+ # configuration item is ignored.
#
max_connections = 256
#
- # Close a connection if it does not receive
- # a packet within this time.
+ # Close a connection if it does not receive a packet within this
+ # time.
#
# Useful range of values: 5 to 600
#
dynamic_timeout = 600.0
#
- # nak_lifetime:: Time for which blocked
- # clients are placed into a NAK cache.
+ # nak_lifetime:: Time for which blocked clients are placed into a
+ # NAK cache.
#
- # If a dynamic client is disallowed, it is
- # placed onto a "NAK" list for a period
- # of time. This process helps to prevent
- # DoS attacks. When subsequent packets are
- # received from that IP address, they hit the
- # "NAK" cache, and are immediately discarded.
+ # If a dynamic client is disallowed, it is placed onto a "NAK"
+ # list for a period of time. This process helps to prevent DoS
+ # attacks. When subsequent packets are received from that IP
+ # address, they hit the "NAK" cache, and are immediately
+ # discarded.
#
- # After `nak_timeout` seconds, the blocked
- # entry will be removed, and the IP will be
- # allowed to try again to define a dynamic
+ # After `nak_timeout` seconds, the blocked entry will be removed,
+ # and the IP will be allowed to try again to define a dynamic
# client.
#
# Useful range of values: 1 to 600
nak_lifetime = 30.0
#
- # cleanup_delay:: The time to wait (in
- # seconds) before cleaning up a reply to an
- # Access-Request packet.
+ # cleanup_delay:: The time to wait (in seconds) before cleaning up
+ # a reply to an Access-Request packet.
#
- # The reply is normally cached internally for
- # a short period of time, after it is sent to
- # the NAS. The reply packet may be lost in
- # the network, and the NAS will not see it.
- # The NAS will then resend the request, and
- # the server will respond quickly with the
+ # The reply is normally cached internally for a short period of
+ # time, after it is sent to the NAS. The reply packet may be lost
+ # in the network, and the NAS will not see it. The NAS will then
+ # resend the request, and the server will respond quickly with the
# cached reply.
#
- # If this value is set too low, then
- # duplicate requests from the NAS MAY NOT be
- # detected, and will instead be handled as
- # separate requests.
+ # If this value is set too low, then duplicate requests from the
+ # NAS MAY NOT be detected, and will instead be handled as separate
+ # requests.
#
- # If this value is set too high, then the
- # server will use more memory for no benefit.
+ # If this value is set too high, then the server will use more
+ # memory for no benefit.
#
# Useful range of values: 2 to 10
#
#
# Whether or not we allow dynamic clients.
#
- # If set to true, then packets from unknown
- # clients are passed through the "new client"
- # subsection below. See that section for
+ # If set to true, then packets from unknown clients are passed
+ # through the "new client" subsection below. See that section for
# more information.
#
dynamic_clients = true
#
- # If dynamic clients are allowed, then limit
- # them to only a small set of source
- # networks.
+ # If dynamic clients are allowed, then limit them to only a small
+ # set of source networks.
#
- # If dynamic clients are not allowed, then
- # this section is ignored.
+ # If dynamic clients are not allowed, then this section is
+ # ignored.
#
networks {
#
- # Allow packets from these networks
- # to define dynamic clients.
+ # Allow packets from these networks to define dynamic clients.
#
- # Packets from all other sources will
- # be rejected.
+ # Packets from all other sources will be rejected.
#
- # Even if a packet is from an allowed
- # network, it still must be
- # configured by the "new client"
- # subsection.
+ # Even if a packet is from an allowed network, it still must be
+ # configured by the "new client" subsection.
#
- # There is no limit to the number of
- # networks which can be listed here.
- # Networks are put into a patricia
- # trie, so lookups are fast and
+ # There is no limit to the number of networks which can be listed here.
+ # Networks are put into a patricia trie, so lookups are fast and
# efficient.
#
allow = 127/8
allow = 192.0.2/24
#
- # The default is to deny all networks
- # which are not in the "allow" list.
+ # The default is to deny all networks which are not in the "allow" list.
#
- # However, it may be useful to allow
- # a large range, and then deny a
- # subset of IPs in that range. For
- # that situation, use a "deny"
+ # However, it may be useful to allow a large range, and then deny a
+ # subset of IPs in that range. For that situation, use a "deny"
#
- # In this example, 127.0.0.1 can be
- # used to define a dynamic client.
- # But the (hypothetical) 127.1.0.1
- # address cannot be used to define
- # a dynamic client.
+ # In this example, 127.0.0.1 can be used to define a dynamic client. But
+ # the (hypothetical) 127.1.0.1 address cannot be used to define a dynamic
+ # client.
#
deny = 127.1/16
}
}
#
- # When a request is received from an unknown client, it is
- # initially passed through this 'new client' section to
- # determine whether to add the client or not.
+ # When a request is received from an unknown client, it is initially
+ # passed through this 'new client' section to determine whether to
+ # add the client or not.
#
- # This section should define the client fields as attributes,
- # and return `ok` to add the client.
+ # This section should define the client fields as attributes, and
+ # return `ok` to add the client.
#
# If this section returns `fail`, then the client is denied.
#
new client {
#
- # Put any modules you want here. SQL, LDAP, "exec",
- # Perl, etc. The only requirements is that the
- # attributes to define a new client MUST go into the
- # control list.
+ # Put any modules you want here. SQL, LDAP, "exec", Perl, etc. The
+ # only requirements is that the attributes to define a new client
+ # MUST go into the control list.
#
- # The packet received here is a complete, normal,
- # packet. All attributes are decoded and available.
- # However, all attributes that depend on the shared
- # secret (e.g. User-Password, etc.) are blank.
+ # The packet received here is a complete, normal, packet. All
+ # attributes are decoded and available. However, all attributes
+ # that depend on the shared secret (e.g. User-Password, etc.) are
+ # blank.
#
#
- # Example 1: Hard-code a client IP. This example is
+ # Example 1: Hard-code a client IP. This example is
# useless, but it documents the attributes
# you need.
#
- # Copy the IP address of the client from
- # the request just received
+ # Copy the IP address of the client from the request just received
control += {
FreeRADIUS-Client-IP-Address = "%{Net.Src.IP}"
#
# This subsection is called when the client was added.
#
- # The main purpose of this section is to enable logging when
- # a client is added.
+ # The main purpose of this section is to enable logging when a
+ # client is added.
#
# If this section is empty, you can just delete it entirely.
#
#
# This subsection is called if the client was NOT added.
#
- # The main purpose of this section is to enable logging when
- # a client is denied.
+ # The main purpose of this section is to enable logging when a
+ # client is denied.
#
# If this section is empty, you can just delete it entirely.
#
#
# = EAP-SIM/EAP-AKA/EAP-AKA-Prime policy server
#
-# This server is an example of applying custom, site-specific policies
-# to eap-aka['] based authentication.
-# As much control is given to the user to make decisions about which
-# AT_* attributes will be returned to the supplicant. Wherever
-# possible the internal state of the EAP-AKA module will be updated
-# to reflect the attributes returned from sections.
+# This server is an example of applying custom, site-specific
+# policies to eap-aka['] based authentication. As much control is
+# given to the user to make decisions about which AT_* attributes
+# will be returned to the supplicant. Wherever possible the internal
+# state of the EAP-AKA module will be updated to reflect the
+# attributes returned from sections.
#
######################################################################
# - `invalid`
# - `userlock`
#
-# Returning failure rcodes in the majority of sections will caused the
-# authentication to fail.
+# Returning failure rcodes in the majority of sections will caused
+# the authentication to fail.
#
-# In some instances however, we ignore the section rcode, as the standard
-# does not allow for an orderly rejection of the supplicant.
+# In some instances however, we ignore the section rcode, as the
+# standard does not allow for an orderly rejection of the supplicant.
#
-# Returning failure rcodes will be ignored in the following sections, and
-# will instead generate a warning:
+# Returning failure rcodes will be ignored in the following sections,
+# and will instead generate a WARNING:
#
# - `send EAP-Failure` already rejecting the auth attempt.
# - `send Failure-Notification` already rejecting the auth attempt.
# - `clear session` nothing more we can do...
#
# For sections dealing with identity processing the `notfound` rcode
-# will trigger identity negotiation. The EAP-AKA module will then request
-# additional identity values from the supplicant. See the `recv
-# EAP-Identity-Response` and `recv AKA-Identity-Response` sections for more
-# details.
+# will trigger identity negotiation. The EAP-AKA module will then
+# request additional identity values from the supplicant. See the
+# `recv EAP-Identity-Response` and `recv AKA-Identity-Response`
+# sections for more details.
#
-# NOTE: Setting the EAP-AKA subtype attribute is not supported, and any
-# attempts to modify it will be ignored (you are not trusted to know how to
-# run the EAP-AKA state machine better than the EAP-AKA module).
+# NOTE: Setting the EAP-AKA subtype attribute is not supported, and
+# any attempts to modify it will be ignored (you are not trusted to
+# know how to run the EAP-AKA state machine better than the EAP-AKA
+# module).
#
######################################################################
server eap-aka-sim {
#
- # This is a unified configuration example for EAP-SIM, EAP-AKA
- # and EAP-AKA-Prime. Many of the sections are identical between
- # the three EAP methods.
+ # This is a unified configuration example for EAP-SIM, EAP-AKA and
+ # EAP-AKA-Prime. Many of the sections are identical between the
+ # three EAP methods.
#
# The main differences are between EAP-SIM and EAP-AKA['] where
# additional identity processing sections are used.
# namespace = eap-aka-prime
# eap-sim {
- #
- # request_identity:: Send a SIM-Start message to Requests
- # an additional identity to the one from the EAP-Identity-Response.
- #
- # If `yes` - We send a request with AT_SUBTYPE SIM-start
- # with an AT_ANY_ID_REQ attribute to prompt the supplicant
- # to send a new identity.
- #
- # The type of identity requested can be controlled by adding
- # one of the following attributes from the
- # `recv Identity-Response { ... }` section of the specified
- # EAP-SIM virtual_server, to the reply list:
- #
- # - reply.Any-Id-Req
- # - reply.Fullauth-Id-Req
- # - reply.Permanent-Id-Req
- #
- # Even if this configuration item is set to 'no', additional
- # identities can be requested by policy.
- # See sites-available/eap-aka-sim for details.
- #
+#
+# request_identity:: Send a SIM-Start message to Requests an
+# additional identity to the one from the EAP-Identity-Response.
+#
+# If `yes` - We send a request with AT_SUBTYPE SIM-start with an
+# AT_ANY_ID_REQ attribute to prompt the supplicant to send a new
+# identity.
+#
+# The type of identity requested can be controlled by adding one of
+# the following attributes from the `recv Identity-Response { ... }`
+# section of the specified EAP-SIM virtual_server, to the reply list:
+#
+# - reply.Any-Id-Req
+# - reply.Fullauth-Id-Req
+# - reply.Permanent-Id-Req
+#
+# Even if this configuration item is set to 'no', additional
+# identities can be requested by policy. See
+# sites-available/eap-aka-sim for details.
+#
# request_identity = no
#
- # ephemeral_id_length:: The length of any pseudonyms or
- # fastauth identities we generate (not including hint byte).
+ # ephemeral_id_length:: The length of any pseudonyms or fastauth
+ # identities we generate (not including hint byte).
#
- # See sites-available/eap-aka-sim for details on how to trigger
- # the generation of pseudonym or fastauth identities.
+ # See sites-available/eap-aka-sim for details on how to trigger the
+ # generation of pseudonym or fastauth identities.
#
# ephemeral_id_length = 14
# strip_permanent_identity_hint:: Strip the identity hint when
# copying EAP-Identity or Identity to Permanant-Identity.
#
- # The stripping is only performed if this config item is set
- # to yes, and the hint byte matches what we'd expect for the
+ # The stripping is only performed if this config item is set to
+ # yes, and the hint byte matches what we'd expect for the
# EAP-Method being executed.
#
# strip_permanent_identity_hint = yes
#
# protected_success:: Send a protected success message.
#
- # If `yes` - indicate to the peer that we'd like to send
- # a protected success message. If the peer agrees and
- # authentication succeeds, send a `SIM-Notification` (Success)
- # packet protected with an `AT_MAC` attribute.
+ # If `yes` - indicate to the peer that we'd like to send a
+ # protected success message. If the peer agrees and authentication
+ # succeeds, send a `SIM-Notification` (Success) packet protected
+ # with an `AT_MAC` attribute.
#
- # After the Notification is ACKed by the peer, we send
- # the final `EAP-Success` packet containing `MPPE` keys.
+ # After the Notification is ACKed by the peer, we send the final
+ # `EAP-Success` packet containing `MPPE` keys.
#
# protected_success = yes
-# }
+ # }
eap-aka {
- # request_identity:: Send a AKA-Identity message to request
- # an additional identity to the one from the EAP-Identity-Response.
+ # request_identity:: Send a AKA-Identity message to request an
+ # additional identity to the one from the EAP-Identity-Response.
#
- # If `yes` - We send a request with AT_SUBTYPE AKA-Identity
- # with an AT_ANY_ID_REQ attribute to prompt the supplicant
- # to send a new identity.
+ # If `yes` - We send a request with AT_SUBTYPE AKA-Identity with an
+ # AT_ANY_ID_REQ attribute to prompt the supplicant to send a new
+ # identity.
#
- # The type of identity requested can be controlled by adding
- # one of the following attributes from the
- # `recv Identity-Response { ... }` section of the specified
- # EAP-AKA virtual_server, to the reply list:
+ # The type of identity requested can be controlled by adding one of
+ # the following attributes from the `recv Identity-Response { ...
+ # }` section of the specified EAP-AKA virtual_server, to the reply
+ # list:
#
# - reply.Any-Id-Req
# - reply.Fullauth-Id-Req
# - reply.Permanent-Id-Req
#
# Even if this configuration item is set to 'no', additional
- # identities can be requested by policy.
- # See sites-available/eap-aka-sim for details.
+ # identities can be requested by policy. See
+ # sites-available/eap-aka-sim for details.
#
# request_identity = no
#
- # ephemeral_id_length:: The length of any pseudonyms or
- # fastauth identities we generate (not including hint byte).
+ # ephemeral_id_length:: The length of any pseudonyms or fastauth
+ # identities we generate (not including hint byte).
#
# ephemeral_id_length = 14
# strip_permanent_identity_hint:: Strip the identity hint when
# copying EAP-Identity or Identity to Permanant-Identity.
#
- # The stripping is only performed if this config item is set
- # to yes, and the hint byte matches what we'd expect for the
+ # The stripping is only performed if this config item is set to
+ # yes, and the hint byte matches what we'd expect for the
# EAP-Method being executed.
#
# strip_permanent_identity_hint = yes
#
# protected_success:: Send a protected success message.
#
- # If `yes` - indicate to the peer that we'd like to send
- # a protected success message. If the peer agrees and
- # authentication succeeds, send a `AKA-Notification` (Success)
- # packet protected with an `AT_MAC` attribute.
+ # If `yes` - indicate to the peer that we'd like to send a
+ # protected success message. If the peer agrees and authentication
+ # succeeds, send a `AKA-Notification` (Success) packet protected
+ # with an `AT_MAC` attribute.
#
- # After the Notification is ACKed by the peer, we send
- # the final `EAP-Success` packet containing `MPPE` keys.
+ # After the Notification is ACKed by the peer, we send the final
+ # `EAP-Success` packet containing `MPPE` keys.
#
# protected_success = yes
}
# eap-aka-prime {
- #
- # network_name:: The default value used for AT_KDF_INPUT
- #
- # EAP-AKA-Prime mixes various keys with a network identifier
- # specifying the user's point of connection into the network
- # to prevent vectors being used where they were not intended
- # to be.
- #
- # The value of the AT_KDF_INPUT can be overridden in the
- # eap-aka-prime virtual server with reply.KDF-Input if
- # this value needs to be determined dynamically.
- #
- # How this value should be created and formatted is specified
- # in 3GPP.24.302.
- #
+#
+# network_name:: The default value used for AT_KDF_INPUT
+#
+# EAP-AKA-Prime mixes various keys with a network identifier
+# specifying the user's point of connection into the network to
+# prevent vectors being used where they were not intended to be.
+#
+# The value of the AT_KDF_INPUT can be overridden in the
+# eap-aka-prime virtual server with reply.KDF-Input if this value
+# needs to be determined dynamically.
+#
+# How this value should be created and formatted is specified in
+# 3GPP.24.302.
+#
# network_name = ""
#
- # request_identity:: Send a AKA-Identity message to request
- # an additional identity to the one from the EAP-Identity-Response.
+ # request_identity:: Send a AKA-Identity message to request an
+ # additional identity to the one from the EAP-Identity-Response.
#
- # If `yes` - We send a request with AT_SUBTYPE AKA-Identity
- # with an AT_ANY_ID_REQ attribute to prompt the supplicant
- # to send a new identity.
+ # If `yes` - We send a request with AT_SUBTYPE AKA-Identity with an
+ # AT_ANY_ID_REQ attribute to prompt the supplicant to send a new
+ # identity.
#
- # The type of identity requested can be controlled by adding
- # one of the following attributes from the
- # `recv Identity-Response { ... }` section of the specified
- # EAP-AKA virtual_server, to the reply list:
+ # The type of identity requested can be controlled by adding one of
+ # the following attributes from the `recv Identity-Response { ...
+ # }` section of the specified EAP-AKA virtual_server, to the reply
+ # list:
#
# - reply.Any-Id-Req
# - reply.Fullauth-Id-Req
# - reply.Permanent-Id-Req
#
# Even if this configuration item is set to 'no', additional
- # identities can be requested by policy.
- # See sites-available/eap-aka-sim for details.
+ # identities can be requested by policy. See
+ # sites-available/eap-aka-sim for details.
#
# request_identity = no
#
- # ephemeral_id_length:: The length of any pseudonyms or
- # fastauth identities we generate (not including hint byte).
+ # ephemeral_id_length:: The length of any pseudonyms or fastauth
+ # identities we generate (not including hint byte).
#
- # See sites-available/eap-aka-sim for details on how to trigger
- # the generation of pseudonym or fastauth identities.
+ # See sites-available/eap-aka-sim for details on how to trigger the
+ # generation of pseudonym or fastauth identities.
#
# ephemeral_id_length = 14
# strip_permanent_identity_hint:: Strip the identity hint when
# copying EAP-Identity or Identity to Permanant-Identity.
#
- # The stripping is only performed if this config item is set
- # to yes, and the hint byte matches what we'd expect for the
+ # The stripping is only performed if this config item is set to
+ # yes, and the hint byte matches what we'd expect for the
# EAP-Method being executed.
#
# strip_permanent_identity_hint = yes
#
# protected_success:: Send a protected success message.
#
- # If `yes` - indicate to the peer that we'd like to send
- # a protected success message. If the peer agrees and
- # authentication succeeds, send a `AKA-Notification` (Success)
- # packet protected with an `AT_MAC` attribute.
+ # If `yes` - indicate to the peer that we'd like to send a
+ # protected success message. If the peer agrees and authentication
+ # succeeds, send a `AKA-Notification` (Success) packet protected
+ # with an `AT_MAC` attribute.
#
- # After the Notification is ACKed by the peer, we send
- # the final `EAP-Success` packet containing `MPPE` keys.
+ # After the Notification is ACKed by the peer, we send the final
+ # `EAP-Success` packet containing `MPPE` keys.
#
# protected_success = yes
-# }
+ # }
#
# === `recv Identity-Response { ... }` - Process an EAP-Identity-Response or AKA-Identity value
#
- # This is usually the first section called when starting a new EAP-AKA
- # session, and will be called for each round of identity negotiation.
+ # This is usually the first section called when starting a new
+ # EAP-AKA session, and will be called for each round of identity
+ # negotiation.
#
# The following request attributes are available:
# - `Identity` the identity value received in the
- # EAP-Identity-Response.
+ # EAP-Identity-Response.
# - `Permanent-Identity` If the hint byte at the start of the
# identity string indicated it was
# permanent.
#
# ==== Identity hints
#
- # In EAP-AKA['] and EAP-SIM, the first byte of the identity is used as
- # a hint about what type of identity has been provided by the
+ # In EAP-AKA['] and EAP-SIM, the first byte of the identity is used
+ # as a hint about what type of identity has been provided by the
# supplicant and which EAP method should be started.
#
- # `Identity-Type` and `Method-Hint` are added by the EAP-AKA module as
- # a convenience to help determine if additional identities should be
- # requested.
+ # `Identity-Type` and `Method-Hint` are added by the EAP-AKA module
+ # as a convenience to help determine if additional identities should
+ # be requested.
#
# If for whatever reason the provided ID isn't not recognised or
- # cannot be processed, you should return `notfound` from this section
- # to request an additional identity from the supplicant.
+ # cannot be processed, you should return `notfound` from this
+ # section to request an additional identity from the supplicant.
#
# Adding any of the following attributes to the reply list will also
# cause an additional identity to bre request from the supplicant.
# (`Fastauth`, `Pseudonym`, `Permanent``).
#
# NOTE: We do not currently support handover between the EAP-AKA/SIM
- # modules. Usually this is not an issue because EAP Negotiation
- # allows the supplicant and server to negotiate a mutually acceptable
- # EAP type. If, however, you want to avoid the additional round trips
- # involved in that negotiation, you can use
- # `%aka_sim_id_method(%{User-Name})` in the top level virtual server,
- # which will return the EAP method hinted by the identity, and then
- # set `control.EAP-Type` to an appropriate value before calling the
- # EAP module.
+ # modules. Usually this is not an issue because EAP Negotiation
+ # allows the supplicant and server to negotiate a mutually
+ # acceptable EAP type. If, however, you want to avoid the additional
+ # round trips involved in that negotiation, you can use
+ # `%aka_sim_id_method(%{User-Name})` in the top level virtual
+ # server, which will return the EAP method hinted by the identity,
+ # and then set `control.EAP-Type` to an appropriate value before
+ # calling the EAP module.
#
# ==== Pseudonyms
#
- # When receiving a `Identity-Type = Pseudonym` request, the pseudonym
- # should either be decrypted or resolved to a permanent identity.
- # Identity resolution can be done here, or in the `load pseudonym { ... }`
- # section.
+ # When receiving a `Identity-Type = Pseudonym` request, the
+ # pseudonym should either be decrypted or resolved to a permanent
+ # identity. Identity resolution can be done here, or in the `load
+ # pseudonym { ... }` section.
#
- # If for whatever reason the identity cannot be validated, you should
- # return `notfound` to request an additional identity.
+ # If for whatever reason the identity cannot be validated, you
+ # should return `notfound` to request an additional identity.
#
# NOTE: Setting `Method-Hint = Pseudonym` here will cause the server
- # to execute the `load pseudonym { ... }` section next. This is
- # sometimes useful when dealing with non-standard pseudonym identities.
+ # to execute the `load pseudonym { ... }` section next. This is
+ # sometimes useful when dealing with non-standard pseudonym
+ # identities.
#
# ==== Reauthentication
#
# When receiving a `Identity-Type = Fastauth` request, the fastauth
# identity should be resolved in a datastore of valid fastauth
- # identities.
- # Session resolution can be done here, or in the `load session { ... }`
- # section.
+ # identities. Session resolution can be done here, or in the `load
+ # session { ... }` section.
#
- # If the identity cannot be resolved, you should return `notfound` to
- # request an additional identity.
+ # If the identity cannot be resolved, you should return `notfound`
+ # to request an additional identity.
#
# NOTE: Setting `Method-Hint = Fastauth` here will cause the server
- # to execute the `load session { ... }` section next. This is
- # sometimes useful when dealing with non-standard fastauth identities.
+ # to execute the `load session { ... }` section next. This is
+ # sometimes useful when dealing with non-standard fastauth
+ # identities.
#
# ==== Custom identity schemes
#
# Multiple identity privacy schemes have been proposed for
- # EAP-SIM/AKA/AKA'. Instead of hard coding implementations in the server
- # source we've provided the necessary cryptographic functions for them to be
- # implemented in policy.
+ # EAP-SIM/AKA/AKA'. Instead of hard coding implementations in the
+ # server source we've provided the necessary cryptographic functions
+ # for them to be implemented in policy.
#
- # The notable exception to this is the scheme described in
- # 3GPP TS 33.234 which is supported via the following expansions functions:
+ # The notable exception to this is the scheme described in 3GPP TS
+ # 33.234 which is supported via the following expansions functions:
#
# - 3gpp_temporary_id_key_index
# - 3gpp_temporary_id_decrypt
# - 3gpp_temporary_id_encrypt
#
- # The rlm_cipher module and the control.KDF-Identity attribute override
- # (see notes below) are provided to allow the "Privacy Protection for EAP-AKA"
- # scheme described by 3GPP S3-170116 and the Wireless Broadband Allowance
- # document "IMSI PRIVACY PROTECTION FOR WI-FI".
+ # The rlm_cipher module and the control.KDF-Identity attribute
+ # override (see notes below) are provided to allow the "Privacy
+ # Protection for EAP-AKA" scheme described by 3GPP S3-170116 and the
+ # Wireless Broadband Allowance document "IMSI PRIVACY PROTECTION FOR
+ # WI-FI".
#
recv Identity-Response {
ok
#
# This section is called when a new Start or AKA-Identity request is
# sent to the supplicant, unless `send Start { ... }` or `send
- # AKA-Identity { ... }` sections are provided, in which case they will
- # be used instead.
+ # AKA-Identity { ... }` sections are provided, in which case they
+ # will be used instead.
#
send Identity-Request {
ok
# EAP-SIM/EAP-AKA, the main difference being, Start messages also
# allow the version of EAP-SIM to be negotiated.
#
-# send Start-Request {
-# ok
-# }
+ # send Start-Request {
+ # ok
+ # }
#
# === `send Start-Request { ... }` - Allow specific policies to be applied to SIM start responses
# EAP-SIM/EAP-AKA, the main difference being, Start messages also
# allow the version of EAP-SIM to be negotiated.
#
-# recv Start-Response {
-# ok
-# }
+ # recv Start-Response {
+ # ok
+ # }
#
# === `send AKA-Identity-Request { ... }` - Allow specific policies to be applied to AKA identity requests
# EAP-SIM/EAP-AKA, the main difference being, Start messages also
# allow the version of EAP-SIM to be negotiated.
#
-# send AKA-Identity-Request {
-# ok
-# }
+ # send AKA-Identity-Request {
+ # ok
+ # }
#
# === `send Challenge-Request { ... }` - Acquire GSM triplets or UMTS quintuplets for the Challenge-Request
# retrieving UMTS quintuplets that the AMF
# separation bit should be high.
#
- # The following attributes are added by the EAP-AKA module to the reply
- # list, to be modified by policy:
+ # The following attributes are added by the EAP-AKA module to the
+ # reply list, to be modified by policy:
#
# - `KDF-Input` Only set when using EAP-AKA'
# Is initially set to the value of the
# Two sets of control attributes are used depending on how the
# quintuplets are being acquired.
#
- # If generating triplets or quintuplets locally you should provide the
- # following control attributes:
+ # If generating triplets or quintuplets locally you should provide
+ # the following control attributes:
#
# - `SIM-Ki`:: Secret shared by the AuC and SIM card.
# - `SIM-SQN`:: Sequence number. Must be stored/incremented
#
# For identity privacy you may include a `reply.Next-Pseudonym`
# attribute. `reply.Next-Pseudonym` must be a valid UTF8 string and
- # MUST NOT contain a realm. The supplicant will decorate the identity
- # as appropriate to ensure correct routing.
+ # MUST NOT contain a realm. The supplicant will decorate the
+ # identity as appropriate to ensure correct routing.
#
# The following facilitates may be useful when generating pseudonym
# values:
#
# NOTE: Add a `reply.Next-Pseudonym-Id` attribute in this section to
# avoid having the permanent Id of the SIM exposed during subsequent
- # authentication attempts.
- # The value of this attribute may be empty (a zero length string) if
- # which case a random value with the correct hint character will be
- # generated for you.
+ # authentication attempts. The value of this attribute may be empty
+ # (a zero length string) if which case a random value with the
+ # correct hint character will be generated for you.
#
# === Fast-Reauth
#
# For identity privacy, to reduce load on the AuC, and to improve
- # authentication times/user experience, fast re-authentication may be
- # used.
+ # authentication times/user experience, fast re-authentication may
+ # be used.
#
- # Fast re-authentication is very similar to session-resumption in TLS
- # based EAP methods, where the original MK (Master Key) is stored and
- # then used to generate new MSKs (Master Session Keys) for subsequent
- # authentication attempts.
+ # Fast re-authentication is very similar to session-resumption in
+ # TLS based EAP methods, where the original MK (Master Key) is
+ # stored and then used to generate new MSKs (Master Session Keys)
+ # for subsequent authentication attempts.
#
# NOTE: Add a `reply.Next-Reauth-Id` attribute in this section, to
# allow session-resumption for subsequent authentication attempts.
#
# Some handset manufacturers have implemented identity schemes which
# require an identity not provided in the EAP-Response/Identity
- # message, or sent as an AT_IDENTITY value. One such identity privacy
- # scheme described by 3GPP S3-170116 "Privacy Protection for EAP-AKA",
- # where the cryptographic identity is the plaintext extracted from
- # the encrypted identity blob. The same behaviour is required for the
- # evolution of that standard published by the WBA
+ # message, or sent as an AT_IDENTITY value. One such identity
+ # privacy scheme described by 3GPP S3-170116 "Privacy Protection for
+ # EAP-AKA", where the cryptographic identity is the plaintext
+ # extracted from the encrypted identity blob. The same behaviour is
+ # required for the evolution of that standard published by the WBA
# "IMSI PRIVACY PROTECTION FOR WI-FI".
#
# Both standards as implemented in iOS and Android violate RFC 4186,
# RFC 4187,and RFC 5448 in requiring that the Identity input to the
- # cryptographic function used to derive the MK for the session be set
- # to the decrypted identity, not the last value of AT_IDENTITY as
- # stated by the original RFCs.
+ # cryptographic function used to derive the MK for the session be
+ # set to the decrypted identity, not the last value of AT_IDENTITY
+ # as stated by the original RFCs.
#
- # No where is this mentioned in either the original 3GPP proposal or the
- # WBA document.
+ # No where is this mentioned in either the original 3GPP proposal or
+ # the WBA document.
#
- # If you need to implement one of these identity privacy schemes, the
- # cryptographic identity can be specified with `control.KDF-Identity`.
+ # If you need to implement one of these identity privacy schemes,
+ # the cryptographic identity can be specified with
+ # `control.KDF-Identity`.
#
send Challenge-Request {
ok
# - `noop` Continue with reauthentication.
# - Anything else Fall back to full authentication.
#
- # NOTE: You should use fresh reauthentication ID values here, else the
- # supplicant may be tracked as they would if their permanent Id has been
- # used.
+ # NOTE: You should use fresh reauthentication ID values here, else
+ # the supplicant may be tracked as they would if their permanent Id
+ # has been used.
#
send Reauthentication-Request {
ok
#
# === `recv Client-Error { ... }` - Log the fact that the supplicant has terminated authentication
#
- # The reason for the error should be available in `Client-Error-Code`
+ # The reason for the error should be available in
+ # `Client-Error-Code`
#
# After this section is run authentication fails immediately with no
# EAP-Response/AKA-Notification round.
#
# NOTE: Only used for EAP-AKA and EAP-AKA'
#
- # The supplicant will respond with EAP-Response/AKA-Authentication-Reject
- # whenever it cannot validate the AUTN (authentication) value provided in the
+ # The supplicant will respond with
+ # EAP-Response/AKA-Authentication-Reject whenever it cannot validate
+ # the AUTN (authentication) value provided in the
# EAP-Request/AKA-Challenge packet.
#
- # No additional attributes are provided by the supplicant that specify
- # the error.
+ # No additional attributes are provided by the supplicant that
+ # specify the error.
#
# After this section is run authentication fails immediately with no
# EAP-Response/AKA-Notification round.
#
# NOTE: Only used for EAP-AKA and EAP-AKA'
#
- # In some instances the SQN on the SIM card and the SQN in the AuC can
- # get out of sync. When this happens the supplicant will send a
- # EAP-Response/Synchronization-Failure message with an AUTS attribute.
+ # In some instances the SQN on the SIM card and the SQN in the AuC
+ # can get out of sync. When this happens the supplicant will send a
+ # EAP-Response/Synchronization-Failure message with an AUTS
+ # attribute.
#
# If the original UMTS quintuplets were calculated locally and you
# provided Ki and OP/OPc in the Challenge-Request round, then the
# EAP-AKA module will automatically calculate a new SQN for you and
- # place it in `control.SIM-SQN`. You should store this new SQN.
+ # place it in `control.SIM-SQN`. You should store this new SQN.
#
# As a convenience, the EAP-AKA module will also repopulate
# control.SIM-Ki and control.SIM-OPc so you do not need to retrieve
#
# If the UMTS quintuplets were provided by an AuC, you should submit
# the AUTS value to the AuC to allow it to calculate a new SQN, then
- # retrieve a new UMTS quintuplet in the
- # `send Challenge-Request { ... }` section.
+ # retrieve a new UMTS quintuplet in the `send Challenge-Request {
+ # ... }` section.
#
# If the rcode returned from this section does not indicate failure
# and a control.SQN value is provided, we send a new challenge to
#
# === `send EAP-Success { ... }` - Allow massaging/logging of success notifications
#
- # NOTE: The rcode returned from this section is ignored if we have already sent
- # a Success-Notification, otherwise the same rcode mappings as
- # `recv Challenge-Response { ... }` are used.
+ # NOTE: The rcode returned from this section is ignored if we have
+ # already sent a Success-Notification, otherwise the same rcode
+ # mappings as `recv Challenge-Response { ... }` are used.
#
send EAP-Success {
ok
# `reply.Next-Pseudonym-Id` attribute is found, this section will be
# called.
#
- # If `reply.Next-Pseudonym-Id` is empty, it will be filled with a random
- # string of alphanumeric characters.
+ # If `reply.Next-Pseudonym-Id` is empty, it will be filled with a
+ # random string of alphanumeric characters.
#
- # For consistency, reply.Next-Pseudonym-Id will also be made available
- # temporarily in `Next-Pseudonym-Id` for use as a key.
+ # For consistency, reply.Next-Pseudonym-Id will also be made
+ # available temporarily in `Next-Pseudonym-Id` for use as a key.
#
# You should store the following attributes against the key
# `Next-Paeudonym-Id`:
# Next-Pseudonym-Id will not be sent to the supplicant.
#
# NOTE: The cache module is ideally suited for storing pseudonym
- # data. If you're using multiple instances of FreeRADIUS in a
- # failover cluster, you may wish to use the redis or memcached drivers
- # to provide a unified pseudonym store.
+ # data. If you're using multiple instances of FreeRADIUS in a
+ # failover cluster, you may wish to use the redis or memcached
+ # drivers to provide a unified pseudonym store.
#
# NOTE: If you're using 3GPP style encrypted pseudonyms you do not
- # need populate this section. You should however, provide a policy
+ # need populate this section. You should however, provide a policy
# for `load session { ... }`, and use that to decrypt the pseudonym.
#
store pseudonym {
#
# === `load pseudonym { ... }`
#
- # This section will be called prior to entering the AKA-CHALLENGE state.
+ # This section will be called prior to entering the AKA-CHALLENGE
+ # state.
#
# You should restore the contents of the following attributes using
# `Next-Pseudonym-Id` as a key:
#
# === `clear pseudonym { ... }`
#
- # This section we be called if authentication or re-authentication fails.
+ # This section we be called if authentication or re-authentication
+ # fails.
#
# You should remove any session information stored against
# `Next-Pseudonym-Id`.
#
# === `store session { ... }`
#
- # If when sending a Reauthentication-Request a `reply.Next-Reauth-Id`
- # attribute is found, this section will be called.
+ # If when sending a Reauthentication-Request a
+ # `reply.Next-Reauth-Id` attribute is found, this section will be
+ # called.
#
# You should restore the contents of the following attributes using
# `request.Session-ID` as a key:
#
# === `clear session { ... }`
#
- # This section we be called if authentication or re-authentication fails.
+ # This section we be called if authentication or re-authentication
+ # fails.
#
- # You should remove any session information stored against `request.Session-ID`.
+ # You should remove any session information stored against
+ # `request.Session-ID`.
#
clear session {
ok
#
# This next section is here to allow testing of the "inner-tunnel"
-# authentication methods, independently from the "default" server.
-# It is listening on "localhost", so that it can only be used from
-# the same machine.
+# authentication methods, independently from the "default" server. It
+# is listening on "localhost", so that it can only be used from the
+# same machine.
#
# $ radtest USER PASSWORD 127.0.0.1:18120 0 testing123
#
-# If it works, you have configured the inner tunnel correctly. To check
-# if PEAP will work, use:
+# If it works, you have configured the inner tunnel correctly. To
+# check if PEAP will work, use:
#
# $ radtest -t mschap USER PASSWORD 127.0.0.1:18120 0 testing123
#
-# If that works, PEAP should work. If that command doesn't work, then
+# If that works, PEAP should work. If that command doesn't work, then
#
# FIX THE INNER TUNNEL CONFIGURATION SO THAT IT WORKS.
#
-# Do NOT do any PEAP tests. It won't help. Instead, concentrate
-# on fixing the inner tunnel configuration. DO NOTHING ELSE.
+# Do NOT do any PEAP tests. It won't help. Instead, concentrate on
+# fixing the inner tunnel configuration. DO NOTHING ELSE.
#
listen innertunnel {
type = Access-Request
#
recv Access-Request {
#
- # The 'copy_request_to_tunnel' option has been removed
- # from v4.0.
+ # The 'copy_request_to_tunnel' option has been removed from v4.0.
#
- # Individual attributes from the outer request may be
- # accessed with:
+ # Individual attributes from the outer request may be accessed with:
#
# outer.request.<attribute>
#
- # The following policy in policy.d/eap can be used
- # to copy attributes over.
+ # The following policy in policy.d/eap can be used to copy
+ # attributes over.
#
-# copy_request_to_tunnel
+ # copy_request_to_tunnel
#
- # Take a User-Name, and perform some checks on it, for spaces and other
- # invalid characters. If the User-Name appears invalid, reject the
- # request.
+ # Take a User-Name, and perform some checks on it, for spaces and
+ # other invalid characters. If the User-Name appears invalid, reject
+ # the request.
#
- # See policy.d/filter for the definition of the filter_username policy.
+ # See policy.d/filter for the definition of the filter_username
+ # policy.
#
filter_username
#
- # Do checks on outer / inner User-Name, so that users
- # can't spoof us by using incompatible identities
+ # Do checks on outer / inner User-Name, so that users can't spoof us
+ # by using incompatible identities
#
filter_inner_identity
#
- # The chap module will set 'Auth-Type := ::CHAP' if we are
- # handling a CHAP request and Auth-Type has not already been set
+ # The chap module will set 'Auth-Type := ::CHAP' if we are handling
+ # a CHAP request and Auth-Type has not already been set
chap
#
- # If the users are logging in with an MS-CHAP-Challenge
- # attribute for authentication, the mschap module will find
- # the MS-CHAP-Challenge attribute, and add 'Auth-Type := ::MS-CHAP'
- # to the request, which will cause the server to then use
- # the mschap module for authentication.
+ # If the users are logging in with an MS-CHAP-Challenge attribute
+ # for authentication, the mschap module will find the
+ # MS-CHAP-Challenge attribute, and add 'Auth-Type := ::MS-CHAP' to
+ # the request, which will cause the server to then use the mschap
+ # module for authentication.
mschap
#
- # Pull crypt'd passwords from /etc/passwd or /etc/shadow,
- # using the system API's to get the password. If you want
- # to read /etc/passwd or /etc/shadow directly, see the
- # passwd module, above.
+ # Pull crypt'd passwords from /etc/passwd or /etc/shadow, using the
+ # system API's to get the password. If you want to read /etc/passwd
+ # or /etc/shadow directly, see the passwd module, above.
#
-# unix
+ # unix
#
# This module takes care of EAP-MSCHAPv2 authentication.
#
- # It also sets the EAP-Type attribute in the request
- # attribute list to the EAP type from the packet.
+ # It also sets the EAP-Type attribute in the request attribute list
+ # to the EAP type from the packet.
#
- # The example below uses module failover to avoid querying all
- # of the following modules if the EAP module returns "ok".
- # Therefore, your LDAP and/or SQL servers will not be queried
- # for the many packets that go back and forth to set up TTLS
- # or PEAP. The load on those servers will therefore be reduced.
+ # The example below uses module failover to avoid querying all of
+ # the following modules if the EAP module returns "ok". Therefore,
+ # your LDAP and/or SQL servers will not be queried for the many
+ # packets that go back and forth to set up TTLS or PEAP. The load on
+ # those servers will therefore be reduced.
#
eap {
ok = return
files
#
- # Look in an SQL database. The schema of the database
- # is meant to mirror the "users" file.
+ # Look in an SQL database. The schema of the database is meant to
+ # mirror the "users" file.
#
- # See "Authorization Queries" in `mods-config/sql/main/$driver/queries.conf`
+ # See "Authorization Queries" in
+ # `mods-config/sql/main/$driver/queries.conf`
-sql
#
- # If you are using /etc/smbpasswd, and are also doing
- # mschap authentication, then uncomment this line, and
- # enable the "smbpasswd" module.
-# smbpasswd
+ # If you are using /etc/smbpasswd, and are also doing mschap
+ # authentication, then uncomment this line, and enable the
+ # "smbpasswd" module.
+ # smbpasswd
#
# The ldap module reads passwords from the LDAP database.
#
# Enforce daily limits on time spent logged in.
-# daily
+ # daily
expiration
#
- # If no other module has claimed responsibility for
- # authentication, then try to use PAP. This allows the
- # other modules listed above to add a "known good" password
- # to the request, and to do nothing else. The PAP module
- # will then see that password, and use it to do PAP
- # authentication.
+ # If no other module has claimed responsibility for authentication,
+ # then try to use PAP. This allows the other modules listed above to
+ # add a "known good" password to the request, and to do nothing
+ # else. The PAP module will then see that password, and use it to do
+ # PAP authentication.
#
- # This module should be listed last, so that the other modules
- # get a chance to set Auth-Type for themselves.
+ # This module should be listed last, so that the other modules get a
+ # chance to set Auth-Type for themselves.
#
pap
}
#
#
# This section lists which modules are available for authentication.
-# Note that it does NOT mean 'try each module in order'. It means
-# that a module from the 'recv Access-Request' section adds a configuration
-# attribute 'Auth-Type := ::FOO'. That authentication type is then
-# used to pick the appropriate module from the list below.
+# Note that it does NOT mean 'try each module in order'. It means
+# that a module from the 'recv Access-Request' section adds a
+# configuration attribute 'Auth-Type := ::FOO'. That authentication
+# type is then used to pick the appropriate module from the list
+# below.
#
-# In general, you SHOULD NOT set the Auth-Type attribute. The server
-# will figure it out on its own, and will do the right thing. The
+# In general, you SHOULD NOT set the Auth-Type attribute. The server
+# will figure it out on its own, and will do the right thing. The
# most common side effect of erroneously setting the Auth-Type
# attribute is that one authentication method will work, but the
# others will not.
#
-# The common reasons to set the Auth-Type attribute by hand
-# is to either forcibly reject the user, or forcibly accept him.
+# The common reasons to set the Auth-Type attribute by hand is to
+# either forcibly reject the user, or forcibly accept him.
#
# NB You cannot forcibly accept an EAP authentication!
#
-# PAP authentication, when a back-end database listed
-# in the 'recv Access-Request' section supplies a password. The
-# password can be clear-text, or encrypted.
+# PAP authentication, when a back-end database listed in the 'recv
+# Access-Request' section supplies a password. The password can be
+# clear-text, or encrypted.
authenticate pap {
pap
}
#
-# Most people want CHAP authentication
-# A back-end database listed in the 'recv Access-Request' section
-# MUST supply a CLEAR TEXT password. Encrypted passwords
-# won't work.
+# Most people want CHAP authentication A back-end database listed in
+# the 'recv Access-Request' section MUST supply a CLEAR TEXT
+# password. Encrypted passwords won't work.
authenticate chap {
chap
}
}
#
-# Pluggable Authentication Modules.
-#authenticate pam {
+# Pluggable Authentication Modules. authenticate pam {
# pam
-#}
+# }
# Uncomment it if you want to use ldap for authentication
#
-# Note that this means "check plain-text password against
-# the ldap database", which means that EAP won't work,
-# as it does not supply a plain-text password.
+# Note that this means "check plain-text password against the ldap
+# database", which means that EAP won't work, as it does not supply a
+# plain-text password.
#
-# We do NOT recommend using this. LDAP servers are databases.
-# They are NOT authentication servers. FreeRADIUS is an
-# authentication server, and knows what to do with authentication.
-# LDAP servers do not.
+# We do NOT recommend using this. LDAP servers are databases. They
+# are NOT authentication servers. FreeRADIUS is an authentication
+# server, and knows what to do with authentication. LDAP servers do
+# not.
#
-#authenticate ldap {
+# authenticate ldap {
# ldap
-#}
+# }
#
# Allow EAP authentication.
}
-# Post-Authentication
-# Once we KNOW that the user has been authenticated, there are
-# additional steps we can take.
+# Post-Authentication Once we KNOW that the user has been
+# authenticated, there are additional steps we can take.
#
-# Note that the last packet of the inner-tunnel authentication
-# MAY NOT BE the last packet of the outer session. So updating
-# the outer reply MIGHT work, and sometimes MIGHT NOT. The
-# exact functionality depends on both the inner and outer
-# authentication methods.
+# Note that the last packet of the inner-tunnel authentication MAY
+# NOT BE the last packet of the outer session. So updating the outer
+# reply MIGHT work, and sometimes MIGHT NOT. The exact functionality
+# depends on both the inner and outer authentication methods.
#
-# If you need to send a reply attribute in the outer session,
-# the ONLY safe way is to set the outer session-state list.
-# Attributes that should be provided in the reply should be
-# copied to the outer.session-state list:
+# If you need to send a reply attribute in the outer session, the
+# ONLY safe way is to set the outer session-state list. Attributes
+# that should be provided in the reply should be copied to the
+# outer.session-state list:
#
# outer.session-state.Attribute := <Value>
#
# "use_tunneled_reply" below.
#
send Access-Accept {
- # If you want privacy to remain, see the
- # Chargeable-User-Identity attribute from RFC 4372.
- # If you want to use it just uncomment the line below.
-# cui-inner
+ # If you want privacy to remain, see the Chargeable-User-Identity
+ # attribute from RFC 4372. If you want to use it just uncomment the
+ # line below.
+ # cui-inner
#
- # If you want to have a log of authentication replies,
- # uncomment the following line, and enable the
- # 'detail reply_log' module.
-# reply_log
+ # If you want to have a log of authentication replies, uncomment the
+ # following line, and enable the 'detail reply_log' module.
+ # reply_log
#
# After authenticating the user, do another SQL query.
#
- # See "Authentication Logging Queries" in `mods-config/sql/main/$driver/queries.conf`
+ # See "Authentication Logging Queries" in
+ # `mods-config/sql/main/$driver/queries.conf`
-sql
#
- # Instead of sending the query to the SQL server,
- # write it into a log file.
+ # Instead of sending the query to the SQL server, write it into a
+ # log file.
#
-# sql_log
+ # sql_log
#
- # Uncomment the following if you have set
- # 'edir = yes' in the ldap module sub-section of
- # the 'modules' section.
+ # Uncomment the following if you have set 'edir = yes' in the ldap
+ # module sub-section of the 'modules' section.
#
-# ldap
+ # ldap
#
- # Instead of the "use_tunneled_reply" option in previous
- # versions of the server, uncomment the following line to
- # copy reply attributes from the inner-tunnel back to the
- # outer session-state. The outer "send Access-Accept"
- # section will then copy them from the session-state into
- # the reply.
+ # Instead of the "use_tunneled_reply" option in previous versions of
+ # the server, uncomment the following line to copy reply attributes
+ # from the inner-tunnel back to the outer session-state. The outer
+ # "send Access-Accept" section will then copy them from the
+ # session-state into the reply.
#
-# use_tunneled_reply
+ # use_tunneled_reply
#
# Call an instance of `linelog` to log the authentication success
# - equivalent to the previous log `auth = yes` option in v3.
# See `mods-enabled/linelog` for message formats and destinations.
#
-# log_auth_result
+ # log_auth_result
}
#
-# Access-Reject packets are sent through the REJECT sub-section of the
-# post-auth section.
+# Access-Reject packets are sent through the REJECT sub-section of
+# the post-auth section.
#
-# Add the ldap module name (or instance) if you have set
-# 'edir = yes' in the ldap module configuration
+# Add the ldap module name (or instance) if you have set 'edir = yes'
+# in the ldap module configuration
#
send Access-Reject {
# log failed authentications in SQL, too.
# - equivalent to the previous log `auth = yes` option in v3.
# See `mods-enabled/linelog` for message formats and destinations.
#
-# log_auth_result
+ # log_auth_result
attr_filter.access_reject
#
# Sample virtual server for receiving entries from an LDAP directory
# using the RFC 4533 (LDAP Content Synchronization Operation) in
-# refreshAndPersist mode, Active Directory using its LDAP_SERVER_NOTIFY_OID
-# server control, or a directory implementing Persistent Search as
-# described in https://tools.ietf.org/id/draft-ietf-ldapext-psearch-03.txt
+# refreshAndPersist mode, Active Directory using its
+# LDAP_SERVER_NOTIFY_OID server control, or a directory implementing
+# Persistent Search as described in
+# https://tools.ietf.org/id/draft-ietf-ldapext-psearch-03.txt
#
# Persistent searches work in a similar way to normal searches except
-# they continue running indefinitely. We continue to receive notifications
-# of changes (add, delete, modify) to entries that would have been returned
-# by a normal search with the base_dn, filter, and scope specified.
+# they continue running indefinitely. We continue to receive
+# notifications of changes (add, delete, modify) to entries that
+# would have been returned by a normal search with the base_dn,
+# filter, and scope specified.
#
-# The intent of persistent searches is usually to allow directory content
-# to be replicated by another LDAP server, here the primary use case is
-# to receive notifications of changes to entries so we can disseminate that
-# information or act on it.
+# The intent of persistent searches is usually to allow directory
+# content to be replicated by another LDAP server, here the primary
+# use case is to receive notifications of changes to entries so we
+# can disseminate that information or act on it.
#
-# NOTE: Each of the three implementations of LDAP synchronisation behave
-# differently:
+# NOTE: Each of the three implementations of LDAP synchronisation
+# behave differently:
#
#
# == RFC 4533
#
# This provides a robust mechanism to allow clients to maintain a
-# cached copy of a fragment of a directory by the use of cookies which
-# can be returned to the server indicating the last successfully processed
-# updates from the server.
+# cached copy of a fragment of a directory by the use of cookies
+# which can be returned to the server indicating the last
+# successfully processed updates from the server.
#
-# However, when an object is deleted from the directory, the entry which is
-# received only contains the DN, or, if the deletion is reported as part of
-# the initial refresh phase it may only be the UUID.
+# However, when an object is deleted from the directory, the entry
+# which is received only contains the DN, or, if the deletion is
+# reported as part of the initial refresh phase it may only be the
+# UUID.
#
#
# == Active Directory
#
-# Active Directory will only provide updates from the time the query started;
-# there is no mechanism to catch up on changes which occurred while the
-# client was not connected. In addition it is not possible to apply a
-# filter to the query so that only a subset of objects are considered.
+# Active Directory will only provide updates from the time the query
+# started; there is no mechanism to catch up on changes which
+# occurred while the client was not connected. In addition it is not
+# possible to apply a filter to the query so that only a subset of
+# objects are considered.
#
-# If notification is required when objects are deleted, then the Recycle Bin
-# has to be enabled on Active Directory and a query must be running which
-# includes the Deleted Objects container.
+# If notification is required when objects are deleted, then the
+# Recycle Bin has to be enabled on Active Directory and a query must
+# be running which includes the Deleted Objects container.
#
-# Active Directory will only perform persistent searches if the filter is
-# `(objectClass=*)`. To overcome this limitation, FreeRADIUS allows other
-# LDAP filters to be specified which are applied in FreeRADIUS before passing
-# packets to the relevant processing sections.
+# Active Directory will only perform persistent searches if the
+# filter is `(objectClass=*)`. To overcome this limitation,
+# FreeRADIUS allows other LDAP filters to be specified which are
+# applied in FreeRADIUS before passing packets to the relevant
+# processing sections.
#
-# This implementation of LDAP filters is not intended to be complete, but
-# covers the most likely to be required.
+# This implementation of LDAP filters is not intended to be complete,
+# but covers the most likely to be required.
#
-# One key limitation, due to not having the LDAP schema to interpret attribute
-# types, is that `>=`, `<=` and bitwise filters are assumed to be on integer values.
+# One key limitation, due to not having the LDAP schema to interpret
+# attribute types, is that `>=`, `<=` and bitwise filters are assumed
+# to be on integer values.
#
-# If your Active Directory tree contains multiple domains, you will need a
-# query for each domain that is of interest; running a query at the base
-# of the tree with a scope of "sub" does not include any domains other than
-# the base.
+# If your Active Directory tree contains multiple domains, you will
+# need a query for each domain that is of interest; running a query
+# at the base of the tree with a scope of "sub" does not include any
+# domains other than the base.
#
-# Depending on the attributes of interest, the number of notifications of
-# changes received can be reduced by running the LDAP query against the
-# Global Catalog rather than the normal AD LDAP server.
+# Depending on the attributes of interest, the number of
+# notifications of changes received can be reduced by running the
+# LDAP query against the Global Catalog rather than the normal AD
+# LDAP server.
#
#
# == Persistent Search
#
-# Servers implementing Persistent Search have the option to return the full
-# directory contents, or simply start reporting changes from the point when
-# the query was run.
+# Servers implementing Persistent Search have the option to return
+# the full directory contents, or simply start reporting changes from
+# the point when the query was run.
#
-# The draft says that servers SHOULD include a changeNumber when reporting
-# changes to keep track of progress - however this has not been observed in
-# any testing. If this is implemented, then it can behave in a similar
-# manner to the cookie defined in RFC 4533; a search against the change log
-# with a filter of `(changeNumber>=n)` could be used to read changes since
-# change number 'n'.
+# The draft says that servers SHOULD include a changeNumber when
+# reporting changes to keep track of progress - however this has not
+# been observed in any testing. If this is implemented, then it can
+# behave in a similar manner to the cookie defined in RFC 4533; a
+# search against the change log with a filter of `(changeNumber>=n)`
+# could be used to read changes since change number 'n'.
#
#
# == Note on user group membership
# which groups a user is a member of.
#
# With the directories which have been tested, including OpenLDAP and
-# Active Directory, it has been observed that modifying group member lists
-# does not result in notification of changes to the users, even though
-# other modifications to the user will result in a notification which
-# can include the `memberOf` attribute.
+# Active Directory, it has been observed that modifying group member
+# lists does not result in notification of changes to the users, even
+# though other modifications to the user will result in a
+# notification which can include the `memberOf` attribute.
#
-# Instead group membership changes are reported as changes to the group object.
+# Instead group membership changes are reported as changes to the
+# group object.
#
#
# Each virtual-server may have multiple listen sections, with each
# listen section containing multiple sync sections.
#
-# The listen section represents a single connection, and a sync represents
-# a single persistent search.
+# The listen section represents a single connection, and a sync
+# represents a single persistent search.
#
# Most options within the listen section are identical to rlm_ldap.
# See mods-available/ldap for more detailed descriptions of
# - ldapc:// (Connectionless LDAP)
server = "localhost"
- # Port to connect on, defaults to 389, will be ignored for LDAP URIs.
+ # Port to connect on, defaults to 389, will be ignored for LDAP
+ # URIs.
# port = 389
- # Administrator account for persistent search.
- # If using SASL + KRB5 these should be commented out.
+ # Administrator account for persistent search. If using SASL +
+ # KRB5 these should be commented out.
identity = 'cn=admin,dc=example,dc=com'
password = mypass
options {
#
- # timeouts may need to be longer than for normal LDAP queries
- # if a refresh phase returns a lot of data.
+ # timeouts may need to be longer than for normal LDAP queries if a
+ # refresh phase returns a lot of data.
#
res_timeout = 20
srv_timelimit = 120
# recv_buff = 1048576
#
- # Maximum number of updates to have outstanding
- # When this number is reached, no more are read, potentially
- # causing the receive buffer to fill which will cause the
- # change notifications to queue up on the LDAP server
+ # Maximum number of updates to have outstanding When this number
+ # is reached, no more are read, potentially causing the receive
+ # buffer to fill which will cause the change notifications to
+ # queue up on the LDAP server
#
# max_outstanding = 65536
}
#
- # When directories provide cookies to track progress through
- # the list of changes, these can be provided on every update,
- # which can be an excessive rate.
+ # When directories provide cookies to track progress through the
+ # list of changes, these can be provided on every update, which can
+ # be an excessive rate.
#
- # FreeRADIUS keeps track of pending change and will only call
- # store Cookie once the preceding changes have been processed.
+ # FreeRADIUS keeps track of pending change and will only call store
+ # Cookie once the preceding changes have been processed.
#
# These options rate limit how often cookies will be stored.
# Provided all preceding changes have been processed, cookie Store
cookie_interval = 10
#
- # Number of completed changes which will prompt the storing
- # of a cookie
+ # Number of completed changes which will prompt the storing of a
+ # cookie
#
cookie_changes = 100
#
# Persistent searches.
#
- # You can configure an unlimited (within reason, and any limitations
- # of the directory you are querying), number of syncs to retrieve
- # entries from the LDAP directory.
+ # You can configure an unlimited (within reason, and any
+ # limitations of the directory you are querying), number of syncs
+ # to retrieve entries from the LDAP directory.
#
sync {
# Where to start searching in the tree for entries
base_dn = "ou=people,dc=example,dc=com"
#
- # Only return entries matching this filter
- # Comment this out if all entries should be returned.
+ # Only return entries matching this filter Comment this out if all
+ # entries should be returned.
#
filter = "(objectClass=posixAccount)"
scope = 'sub'
#
- # Specify a map of LDAP attributes to FreeRADIUS dictionary attributes.
+ # Specify a map of LDAP attributes to FreeRADIUS dictionary
+ # attributes.
#
# The result of this map determines how attributes from the LDAP
# query are presented in the requests processed by the various
# "recv" sections below.
#
# This is a very limited form of map:
- # - the left hand side must be an attribute reference.
- # - the right hand side is LDAP attributes which will be
+ # - the left hand side must be an attribute reference.
+ # - the right hand side is LDAP attributes which will be
# included in the query.
- # - only = and += are valid operators with = setting a
+ # - only = and += are valid operators with = setting a
# single instance of the attribute and += setting as
# many as the LDAP query returns.
#
- # Protocol specific attributes must be qualified e.g. Proto.radius.User-Name
+ # Protocol specific attributes must be qualified e.g.
+ # Proto.radius.User-Name
#
update {
Proto.radius.User-Name = 'uid'
# scope = "sub"
#
- # Since there are likely to be multiple members of
- # a given group, the += operator should be used when
- # defining a mapping of LDAP attribute "member" to
- # FreeRADIUS attributes.
+ # Since there are likely to be multiple members of a given group,
+ # the += operator should be used when defining a mapping of LDAP
+ # attribute "member" to FreeRADIUS attributes.
#
-# update {
-# member += "member"
-# }
-# }
+ # update {
+ # member += "member"
+ # }
+ # }
#
- # If you are querying Active Directory, you are likely to
- # want two queries.
+ # If you are querying Active Directory, you are likely to want two
+ # queries.
#
- # It should be noted that Active Directory will only respond
- # to queries with the LDAP_SERER_NOTIFICATION_OID control if
- # the filter is (objectClass=*) - any other filter will result
- # in an error.
+ # It should be noted that Active Directory will only respond to
+ # queries with the LDAP_SERER_NOTIFICATION_OID control if the
+ # filter is (objectClass=*) - any other filter will result in an
+ # error.
#
- # To overcome this limitation, a subset of LDAP filter handling
- # has been implemented in FreeRADIUS allowing a filter to be
- # specified in this configuration. The key limitation is
- # <=, >= and bitwise filters assume attributes are numeric.
+ # To overcome this limitation, a subset of LDAP filter handling has
+ # been implemented in FreeRADIUS allowing a filter to be specified
+ # in this configuration. The key limitation is <=, >= and bitwise
+ # filters assume attributes are numeric.
#
# The only extensible match filters supported are the Active
# Directory bitwise AND and OR.
#
- # A suitable filter, to only receive notifications regarding
- # normal user accounts could be:
+ # A suitable filter, to only receive notifications regarding normal
+ # user accounts could be:
#
# (userAccountControl:1.2.840.113556.1.4.803:=512)
#
# In addition, there is nothing returned by Active Directory to
- # distinguish between an object being added or being modified.
- # All LDAP entries which are returned are therefore processed
- # through the recv Modify section when the directory is Active
- # Directory.
+ # distinguish between an object being added or being modified. All
+ # LDAP entries which are returned are therefore processed through
+ # the recv Modify section when the directory is Active Directory.
#
- # By default Active Directory puts a limit of 5 on the number
- # of persistent searches which can be active on a connection.
+ # By default Active Directory puts a limit of 5 on the number of
+ # persistent searches which can be active on a connection.
#
# To determine if an object is enabled or disabled, the attribute
- # userAccountControl can be evaluated. This is returned as
- # string data, so will want mapping to an integer attribute
- # for processing.
+ # userAccountControl can be evaluated. This is returned as string
+ # data, so will want mapping to an integer attribute for
+ # processing.
#
- # Firstly, one based on a naming context which covers all
- # user objects. This will return results when objects are
- # added, modified or restored from the Deleted Objects
- # container.
+ # Firstly, one based on a naming context which covers all user
+ # objects. This will return results when objects are added,
+ # modified or restored from the Deleted Objects container.
#
-# sync {
+ # sync {
# base_dn = 'cn=Users,dc=example,dc=com'
# filter = '(userAccountControl:1.2.840.113556.1.4.803:=512)'
# scope = 'sub'
-#
-# update {
+ #
+ # update {
# Proto.radius.User-Name = 'sAMAccountName'
# user-acct-control = 'userAccountControl'
-# }
-# }
+ # }
+ # }
#
- # Secondly, if you have the Recycle Bin enabled in Active
- # Directory and wish to be notified about deleted objects,
- # add a search covering the Deleted Objects container.
+ # Secondly, if you have the Recycle Bin enabled in Active Directory
+ # and wish to be notified about deleted objects, add a search
+ # covering the Deleted Objects container.
#
- # This will return results when an object is deleted, however
- # the DN and CN of the object are changed. The attribute
- # lastKnownParent identifies where the object was deleted
- # from. However, lastKnownParent may not be returned when
- # searching the Global Catalog.
+ # This will return results when an object is deleted, however the
+ # DN and CN of the object are changed. The attribute
+ # lastKnownParent identifies where the object was deleted from.
+ # However, lastKnownParent may not be returned when searching the
+ # Global Catalog.
#
-# sync {
+ # sync {
# base_dn = "CN=Deleted Objects,dc=example,dc=com"
# filter = '(userAccountControl:1.2.840.113556.1.4.803:=512)'
# scope = "one"
-#
-# update {
+ #
+ # update {
# Proto.radius.User-Name = 'sAMAccountName'
# user-acct-control = 'userAccountControl'
# last-known-parent = 'lastKnownParent'
-# }
-# }
+ # }
+ # }
}
#
- # Provides FreeRADIUS with the last cookie value we received for the sync
+ # Provides FreeRADIUS with the last cookie value we received for the
+ # sync
#
- # This only applies to directories implementing RFC4533, such as OpenLDAP with
- # the syncprov overlay enabled.
+ # This only applies to directories implementing RFC4533, such as
+ # OpenLDAP with the syncprov overlay enabled.
#
- # For other directories, this will be called prior to the search query being
- # sent to the server, so could be used for any initial setup of cache datastores.
+ # For other directories, this will be called prior to the search
+ # query being sent to the server, so could be used for any initial
+ # setup of cache datastores.
#
# A request will be generated with the following attributes:
#
# - request.LDAP-Sync.Filter the filter of the sync (optional).
# - request.LDAP-Sync.Scope the scope of the sync (optional).
#
- # You should use these attributes to uniquely identify the sync when retrieving
- # previous cookie values.
+ # You should use these attributes to uniquely identify the sync when
+ # retrieving previous cookie values.
#
- # In addition the attribute request.LDAP-Sync.Directory-Root-DN will be
- # populated with the root DN of the directory to aid creating a cookie if one
- # has not previously been stored.
+ # In addition the attribute request.LDAP-Sync.Directory-Root-DN will
+ # be populated with the root DN of the directory to aid creating a
+ # cookie if one has not previously been stored.
#
# Called for a sync when:
# - FreeRADIUS first starts.
# If no cookie is returned for RFC 4533 servers, then the response
# to the initial search will be a complete copy of the directory.
# To avoid that, and just be notified about changes, a cookie which
- # matches that which OpenLDAP expects can be mocked up with the following,
- # presuming the ldap module is enabled and configured with the same
- # server settings as ldap_sync.
+ # matches that which OpenLDAP expects can be mocked up with the
+ # following, presuming the ldap module is enabled and configured
+ # with the same server settings as ldap_sync.
#
-# if (!reply.LDAP-Sync.Cookie) {
-# string csn
-#
-# csn := %str.concat(%ldap("ldap:///%ldap.uri.safe(%{LDAP-Sync.Directory-Root-DN})?contextCSN?base"), ';')
-# reply.LDAP-Sync.Cookie := "rid=000,csn=%{csn}"
-# }
+ # if (!reply.LDAP-Sync.Cookie) {
+ # string csn
+ #
+ # csn := %str.concat(%ldap("ldap:///%ldap.uri.safe(%{LDAP-Sync.Directory-Root-DN})?contextCSN?base"), ';')
+ # reply.LDAP-Sync.Cookie := "rid=000,csn=%{csn}"
+ # }
}
#
# Stores the latest cookie we've received for a sync
#
- # This only applies to directories implementing RFC4533, such as OpenLDAP with
- # the syncprov overlay enabled.
+ # This only applies to directories implementing RFC4533, such as
+ # OpenLDAP with the syncprov overlay enabled.
#
- # For directories implementing persistent search, which return changeNumber
- # in the Entry Change Notice control, this section will be called with the
- # changeNumber in LDAP-Sync.Cookie.
+ # For directories implementing persistent search, which return
+ # changeNumber in the Entry Change Notice control, this section will
+ # be called with the changeNumber in LDAP-Sync.Cookie.
#
# A request will be generated with the following attributes:
#
#
# Notification that a new entry has been added to the LDAP directory
#
- # For directories implementing RFC 4533, it is recommended that cached entries
- # use LDAP-Sync.Entry-UUID as the key.
- # This can usually be retrieved from the entryUUID operational attribute.
+ # For directories implementing RFC 4533, it is recommended that
+ # cached entries use LDAP-Sync.Entry-UUID as the key. This can
+ # usually be retrieved from the entryUUID operational attribute.
#
- # The entryUUID has the benefit that it will remain constant even if an object's
- # DN is changed.
+ # The entryUUID has the benefit that it will remain constant even if
+ # an object's DN is changed.
#
- # Delete and Present operations may not include the DN of the object if they occur
- # during a refresh stage.
+ # Delete and Present operations may not include the DN of the object
+ # if they occur during a refresh stage.
#
# A request will be generated with the following attributes:
#
#
# Notification that an entry has been modified in the LDAP directory
#
- # For directories implementing RFC 4533, it is recommended that cached entries
- # use LDAP-Sync.Entry-UUID as the key.
- # This can usually be retrieved from the entryUUID operational attribute.
+ # For directories implementing RFC 4533, it is recommended that
+ # cached entries use LDAP-Sync.Entry-UUID as the key. This can
+ # usually be retrieved from the entryUUID operational attribute.
#
- # Delete and Present operations may not include the DN of the object if they occur
- # during a refresh stage.
+ # Delete and Present operations may not include the DN of the object
+ # if they occur during a refresh stage.
#
# A request will be generated with the following attributes:
#
#
# Notification that an entry has been modified in the LDAP directory
#
- # It is recommended that cached entries use LDAP-Sync.Entry-UUID as the key.
- # This can usually be retrieved from the entryUUID operational attribute.
+ # It is recommended that cached entries use LDAP-Sync.Entry-UUID as
+ # the key. This can usually be retrieved from the entryUUID
+ # operational attribute.
#
- # Delete and Present operations may not include the DN of the object if they occur
- # during a refresh stage.
+ # Delete and Present operations may not include the DN of the object
+ # if they occur during a refresh stage.
#
# A request will be generated with the following attributes:
#
}
#
- # Notification that an entry is still present and unchanged in the LDAP directory.
+ # Notification that an entry is still present and unchanged in the
+ # LDAP directory.
#
- # These only occur with RFC 4533 servers during initial refresh when a sync starts
- # and a cookie has been provided to indicate the last known state of the directory
- # according to the client.
+ # These only occur with RFC 4533 servers during initial refresh when
+ # a sync starts and a cookie has been provided to indicate the last
+ # known state of the directory according to the client.
#
- # It is recommended that cached entries use LDAP-Sync.Entry-UUID as the key.
- # This can usually be retrieved from the entryUUID operational attribute.
+ # It is recommended that cached entries use LDAP-Sync.Entry-UUID as
+ # the key. This can usually be retrieved from the entryUUID
+ # operational attribute.
#
- # Delete and Present operations may not include the DN of the object if they occur
- # during a refresh stage.
+ # Delete and Present operations may not include the DN of the object
+ # if they occur during a refresh stage.
#
# A request will be generated with the following attributes:
#
#
listen load {
#
- # The main module is the proto module, even though we're
- # operating in the RADIUS namespace.
+ # The main module is the proto module, even though we're operating
+ # in the RADIUS namespace.
#
handler = load
#
step {
#
- # Filename with input packet. This is in the
- # same format as used by `radclient`.
+ # Filename with input packet. This is in the same format as used
+ # by `radclient`.
#
filename = ${confdir}/load.txt
#
# Where the statistics file goes, in CSV format.
#
- # One line will be written to the file for each
- # second of the load generation run.
+ # One line will be written to the file for each second of the load
+ # generation run.
#
# Each line will contain the following columns:
# - time - since the test started running
#
# How many packet/s to end up at.
#
- # When the load generator reaches this rate,
- # it prints the final statistics, and makes
- # the server exit.
+ # When the load generator reaches this rate, it prints the final
+ # statistics, and makes the server exit.
#
max_pps = 2000
step = 200
#
- # We don't want to overload the server. If
- # the server cannot process packets quickly
- # enough, we will get a backlog of
- # unprocessed packets. If the backlog gets
- # too high, then the load generator will
- # temporarily stop sending packets. Once the
+ # We don't want to overload the server. If the server cannot
+ # process packets quickly enough, we will get a backlog of
+ # unprocessed packets. If the backlog gets too high, then the load
+ # generator will temporarily stop sending packets. Once the
# backlog is low enough, it will continue.
#
max_backlog = 1000
#
- # How many packets to send immediately in
- # parallel, without waiting for a response.
- # When a reply is received, a new request may
- # be sent.
+ # How many packets to send immediately in parallel, without
+ # waiting for a response. When a reply is received, a new request
+ # may be sent.
#
parallel = 25
}
# = Originate CoA-Request packets
#
# The server can originate Change of Authorization (CoA) or
-# Disconnect request packets. These packets are used to dynamically
-# change the parameters of a users session (bandwidth, etc.), or
-# to forcibly disconnect the user.
+# Disconnect request packets. These packets are used to dynamically
+# change the parameters of a users session (bandwidth, etc.), or to
+# forcibly disconnect the user.
#
-# There are some caveats. Not all NAS vendors support this
-# functionality. Even for the ones that do, it may be difficult to
+# There are some caveats. Not all NAS vendors support this
+# functionality. Even for the ones that do, it may be difficult to
# find out what needs to go into a CoA-Request or Disconnect-Request
-# packet. All we can suggest is to read the NAS documentation
-# available from the vendor. That documentation SHOULD describe
-# what information their equipment needs to see in a CoA packet.
+# packet. All we can suggest is to read the NAS documentation
+# available from the vendor. That documentation SHOULD describe what
+# information their equipment needs to see in a CoA packet.
#
# This information is usually a list of attributes such as:
#
# Acct-Session-Id
#
# CoA packets can be originated when a normal Access-Request or
-# Accounting-Request packet is received. Simply create a subrequest,
+# Accounting-Request packet is received. Simply create a subrequest,
# and call the `radius` module to send the packet.
#
# ```
######################################################################
#
-# This is an *example* virtual server. It accepts `Accounting-Request`
-# packets. It then sends a `Disconnect-Request` packet for every
-# `Accounting-Request` packet it receives.
+# This is an *example* virtual server. It accepts
+# `Accounting-Request` packets. It then sends a `Disconnect-Request`
+# packet for every `Accounting-Request` packet it receives.
#
-# You should NOT enable this virtual server. Instead, use it as an
+# You should NOT enable this virtual server. Instead, use it as an
# example, and copy the "subrequest" section to the virtual server
# that is actually receiving `Accounting-Request` packets.
#
recv Accounting-Request {
subrequest ::Disconnect-Request {
#
- # The subrequest begins empty, so copy all necessary
- # attributes over.
+ # The subrequest begins empty, so copy all necessary attributes
+ # over.
#
request.User-Name := parent.request.User-Name
request.Acct-Session-Id := parent.request.Acct-Session-Id
#
# Call the `radius` module to send a CoA packet.
#
- # Note that you MUST create an instance of the
- # `radius` module, called "radius.coa" in order for
- # this to work.
+ # Note that you MUST create an instance of the `radius` module,
+ # called "radius.coa" in order for this to work.
#
- # See the `radius` module for more documentation on
- # how it works.
+ # See the `radius` module for more documentation on how it works.
#
radius.coa
# This virtual server replaces the old `pre-proxy` and `post-proxy`
# sections that were in v3.
#
-# It can be called from another virtual server via the `call` keyword:
+# It can be called from another virtual server via the `call`
+# keyword:
#
# subrequest {
# request := parent.request
# }
#
# For server pools with load-balancing, fail-over, etc., you can just
-# use the `load-balance` and `redundant` keywords. Those sections
+# use the `load-balance` and `redundant` keywords. Those sections
# should then include multiple `radius` modules, one for each home
-# server. See `mods-available/home_server_pool` for an example of
-# how to convert a v3 `home_server` and `home_server_pool`
-# configuration to v4.
+# server. See `mods-available/home_server_pool` for an example of how
+# to convert a v3 `home_server` and `home_server_pool` configuration
+# to v4.
#
# See also the proxy upgrade documentation for more examples of
# upgrading from v3 to v4:
#
# === Receive the Access-Request from the parent
#
-# This section replaces `pre-proxy`. It receives an Access-Request
+# This section replaces `pre-proxy`. It receives an Access-Request
# from the parent, and uses the `radius` module to proxy it.
#
-# Note that there is no `send Access-Request` section. If you add
+# Note that there is no `send Access-Request` section. If you add
# one, the server will give an error, and will refuse to start.
#
recv Access-Request {
authenticate proxy {
#
- # This is where you decide which home server the packet is
- # proxied to. See `mods-available/home_server_pool` for an
- # example of the `pool1` module configuration.
+ # This is where you decide which home server the packet is proxied
+ # to. See `mods-available/home_server_pool` for an example of the
+ # `pool1` module configuration.
#
-# pool1
+ # pool1
}
#
# As the last thing in the section, proxy it.
#
- # Unlike `Access-Request` packets, there is no `Acct-Type =
- # proxy`. There are sections like `accounting start {...}`, but
- # those sections are called based on the `Acct-Status-Type`
- # attribute in the request.
+ # Unlike `Access-Request` packets, there is no `Acct-Type = proxy`.
+ # There are sections like `accounting start {...}`, but those
+ # sections are called based on the `Acct-Status-Type` attribute in
+ # the request.
#
- # As a result, the `pool1` virtual module has to be listed in
- # this section.
+ # As a result, the `pool1` virtual module has to be listed in this
+ # section.
#
-# pool1
+ # pool1
}
#
#
# Remove all `Proxy-State` attributes from the response.
#
- # The `Proxy-State` attributes we get from the home server
- # are specific to the link between the proxy and the home
- # server. They must not be sent back to the client.
+ # The `Proxy-State` attributes we get from the home server are
+ # specific to the link between the proxy and the home server. They
+ # must not be sent back to the client.
#
reply -= Proxy-State[*]
#
- # Over-write all of the parents response attributes with our response.
+ # Over-write all of the parents response attributes with our
+ # response.
#
parent.reply := reply
}
server proxy-inner-tunnel {
#
-# This example is very simple. All inner tunnel requests get
-# proxied to another RADIUS server.
+# This example is very simple. All inner tunnel requests get proxied
+# to another RADIUS server.
#
recv Access-Request {
#
# Do other things here, as necessary.
#
- # e.g. run the "realms" module, to decide how to proxy
- # the inner tunnel request.
+ # e.g. run the "realms" module, to decide how to proxy the inner
+ # tunnel request.
#
# You should update this to be one of your realms.
authenticate eap {
#
- # This is necessary so that the inner tunnel EAP-MSCHAPv2
- # method can be called. That method takes care of turning
- # EAP-MSCHAPv2 into plain MS-CHAPv2, if necessary.
+ # This is necessary so that the inner tunnel EAP-MSCHAPv2 method can
+ # be called. That method takes care of turning EAP-MSCHAPv2 into
+ # plain MS-CHAPv2, if necessary.
eap
}
# -*- text -*-
######################################################################
#
-# This virtual server provides an example of how to dynamically amend the
-# control flow within some virtual server's policy on the basis of the status
-# of some resource, such as an external database.
-#
-# This resource-check virtual server receives periodic dummy server-status
-# requests that trigger an arbitrary set of checks. On the basis of those
-# checks the status of an instance of the rlm_always module, that we refer to
-# as the "control module", is updated to reflect the system status.
-#
-# Elsewhere, some other virtual server (the "controlled virtual server") uses
-# the control module to make decisions during the processing of incoming
-# requests. By amending the status of the control module in response to the
-# system status this virtual server is able to manipulate the outcome of the
-# controlled virtual server.
-#
-# Firstly, the "recv Status-Server" section of this virtual server will need to be
-# amended to check the status of the external resources and to set the status
-# of the control module appropriately, as described in the inline comments
-# below...
-#
-# In addition to configuring and activating this virtual server, a control
-# module must be configured as an instance of rlm_always in mods-enabled, for
-# example:
+# This virtual server provides an example of how to dynamically amend
+# the control flow within some virtual server's policy on the basis
+# of the status of some resource, such as an external database.
+#
+# This resource-check virtual server receives periodic dummy
+# server-status requests that trigger an arbitrary set of checks. On
+# the basis of those checks the status of an instance of the
+# rlm_always module, that we refer to as the "control module", is
+# updated to reflect the system status.
+#
+# Elsewhere, some other virtual server (the "controlled virtual
+# server") uses the control module to make decisions during the
+# processing of incoming requests. By amending the status of the
+# control module in response to the system status this virtual server
+# is able to manipulate the outcome of the controlled virtual server.
+#
+# Firstly, the "recv Status-Server" section of this virtual server
+# will need to be amended to check the status of the external
+# resources and to set the status of the control module
+# appropriately, as described in the inline comments below...
+#
+# In addition to configuring and activating this virtual server, a
+# control module must be configured as an instance of rlm_always in
+# mods-enabled, for example:
#
# ```
# always db_online {
# }
# ```
#
-# Now trigger the resource checks by sending a server-status request to this
-# virtual server, as follows:
+# Now trigger the resource checks by sending a server-status request
+# to this virtual server, as follows:
#
# ```
# echo "Message-Authenticator = 0x00" | \
# radclient -r 1 -t 3 -q 127.0.0.1:18122 status testing123
# ```
#
-# The trigger could be invoked by a cron job or if more frequent checks than
-# once per minute are required a systemd timer might be used.
+# The trigger could be invoked by a cron job or if more frequent
+# checks than once per minute are required a systemd timer might be
+# used.
#
-# The current status of the control module can be examined at any time using
-# radmin:
+# The current status of the control module can be examined at any
+# time using radmin:
#
# ```
# radmin -e 'show module status db_online'
# ```
#
-# For radmin to work requires that the control-socket virtual server is
-# configured and enabled.
+# For radmin to work requires that the control-socket virtual server
+# is configured and enabled.
#
-# The controlled virtual server will contain some control flow decision that
-# uses the control module, for example:
+# The controlled virtual server will contain some control flow
+# decision that uses the control module, for example:
#
# ```
# server default {
# ```
#
#
-# The configuration for this virtual server follows and should be amended as
-# required.
+# The configuration for this virtual server follows and should be
+# amended as required.
#
#
-# Listen on a local port for Server-Status requests that trigger the resource
-# checks.
+# Listen on a local port for Server-Status requests that trigger the
+# resource checks.
#
# This uses the normal set of clients, with the same secret as for
# authentication and accounting.
#
#
-# Within this virtual server we provide only a `recv Status-Server` section
-# whose task is to perform the resource checks and sets the status of the
-# "control module"
+# Within this virtual server we provide only a `recv Status-Server`
+# section whose task is to perform the resource checks and sets the
+# status of the "control module"
#
server resource-check {
#
# Other modules could be used here.
#
- # You can even invoke synchronous checks using the %exec(...) xlat in
- # which case timeout should be set to less than the check trigger
+ # You can even invoke synchronous checks using the %exec(...) xlat
+ # in which case timeout should be set to less than the check trigger
# interval to avoid buildup of checks when resources do not respond.
# See rlm_exec for details.
#
status_check = request
username = "test_user_status_check"
- # Set the response timeout aggressively low.
- # You MAY have to increase this, depending on tests with
- # your local installation.
+ # Set the response timeout aggressively low. You MAY have to
+ # increase this, depending on tests with your local installation.
response_window = 6
}
status_check = request
username = "test_user_status_check"
- # Set the response timeout aggressively low.
- # You MAY have to increase this, depending on tests with
- # your local installation.
+ # Set the response timeout aggressively low. You MAY have to
+ # increase this, depending on tests with your local installation.
response_window = 6
}
virtual_server = home.example.com
}
-# (3) Define a realm for these home servers.
-# It should NOT be used as part of normal proxying decisions!
+# (3) Define a realm for these home servers. It should NOT be used as
+# part of normal proxying decisions!
realm acct_realm.example.com {
acct_pool = acct_pool.example.com
}
-# (4) Define a detail file writer.
-# See mods-available/detail.example.com
+# (4) Define a detail file writer. See
+# mods-available/detail.example.com
# (5) Define a virtual server to handle pre/post-proxy re-writing
server home.example.com {
- # Read accounting packets from the detail file(s) for
- # the home server.
+ # Read accounting packets from the detail file(s) for the home
+ # server.
#
- # Note that you can have only ONE "listen" section reading
- # detail files from a particular directory. That is why the
- # destination host name is used as part of the directory name
- # below. Having two "listen" sections reading detail files
- # from the same directory WILL cause problems. The packets
- # may be read by one, the other, or both "listen" sections.
+ # Note that you can have only ONE "listen" section reading detail
+ # files from a particular directory. That is why the destination
+ # host name is used as part of the directory name below. Having two
+ # "listen" sections reading detail files from the same directory
+ # WILL cause problems. The packets may be read by one, the other, or
+ # both "listen" sections.
listen {
type = detail
filename = "${radacctdir}/detail.example.com/detail-*:*"
load_factor = 10
}
- # All packets read from the detail file are proxied back to
- # the home servers.
+ # All packets read from the detail file are proxied back to the home
+ # servers.
#
# The normal pre/post-proxy rules are applied to them, too.
#
- # If the home servers are STILL down, then the server stops
- # reading the detail file, and queues the packets for a later
- # retransmission. The Post-Proxy-Type "Fail" handler is NOT
- # called.
+ # If the home servers are STILL down, then the server stops reading
+ # the detail file, and queues the packets for a later
+ # retransmission. The Post-Proxy-Type "Fail" handler is NOT called.
#
- # When the home servers come back up, the packets are forwarded,
- # and the detail file processed as normal.
+ # When the home servers come back up, the packets are forwarded, and
+ # the detail file processed as normal.
recv Accounting-Request {
# You may want accounting policies here...
}
#
- # We recommend that you list ONLY management clients here.
- # i.e. NOT your NASes or Access Points, and for an ISP,
- # DEFINITELY not any RADIUS servers that are proxying packets
- # to you.
+ # We recommend that you list ONLY management clients here. i.e. NOT
+ # your NASes or Access Points, and for an ISP, DEFINITELY not any
+ # RADIUS servers that are proxying packets to you.
#
- # If you do NOT list a client here, then any client that is
- # globally defined (i.e. all of them) will be able to query
- # these statistics.
+ # If you do NOT list a client here, then any client that is globally
+ # defined (i.e. all of them) will be able to query these statistics.
#
- # Do you really want your partners seeing the internal details
- # of what your RADIUS server is doing?
+ # Do you really want your partners seeing the internal details of
+ # what your RADIUS server is doing?
#
client admin {
ipaddr = 127.0.0.1
#
recv Status-Server {
#
- # Add statistics based on the Vendor-Specific.FreeRADIUS.Stats4-* queries.
+ # Add statistics based on the Vendor-Specific.FreeRADIUS.Stats4-*
+ # queries.
#
stats
ok
#
# Due to internal limitations, the statistics might not be exactly up
-# to date. Do not expect all of the numbers to add up perfectly.
+# to date. Do not expect all of the numbers to add up perfectly.
#
}
#
# ==== Authentication subsection
#
- # This section contains configuration which is
- # specific to processing `Authentication` packets.
+ # This section contains configuration which is specific to
+ # processing `Authentication` packets.
#
- # Similar sections can be added, but are not
- # necessary for Accounting-Request (and other)
- # packets. At this time, there is no configuration
- # needed for other packet types.
+ # Similar sections can be added, but are not necessary for
+ # Accounting-Request (and other) packets. At this time, there is no
+ # configuration needed for other packet types.
#
Authentication {
#
- # session:: Controls how ongoing
- # (multi-round) sessions are handled
+ # session:: Controls how ongoing (multi-round) sessions are
+ # handled
#
- # This section is only useful for ASCII authentications.
- # It is the only authentication type which supports
- # sending challenges for further data.
+ # This section is only useful for ASCII authentications. It is the
+ # only authentication type which supports sending challenges for
+ # further data.
#
session {
#
#
# max_rounds: The maximum number of round trips which are allowed
#
- # This is only enforced for `Authentication-Type = ASCII`, when
- # the server replies with `GetUser` or `GetPass` or `GetData`.
+ # This is only enforced for `Authentication-Type = ASCII`, when the
+ # server replies with `GetUser` or `GetPass` or `GetData`.
#
- # Some broken clients will send packets in a loop, forever.
- # This configuration helps to catch and prevent that.
+ # Some broken clients will send packets in a loop, forever. This
+ # configuration helps to catch and prevent that.
#
max_rounds = 4
#
- # timeout:: How long to wait before expiring a
- # session.
+ # timeout:: How long to wait before expiring a session.
#
- # The timer starts when a response
- # with a state value is sent. The
- # timer stops when a request
- # containing the previously sent
- # state value is received.
+ # The timer starts when a response with a state value is sent. The timer
+ # stops when a request containing the previously sent state value is
+ # received.
#
# timeout = 15
}
#
# type:: The type of packet to accept.
#
- # Multiple types can be accepted by using multiple
- # lines of `type = ...`.
+ # Multiple types can be accepted by using multiple lines of `type =
+ # ...`.
#
# As described in RFC 8907, the packet types are:
#
#
# transport:: The transport protocol.
#
- # Only `tcp` is allowed. TACACS+ does not use UDP or TLS.
+ # Only `tcp` is allowed. TACACS+ does not use UDP or TLS.
#
transport = tcp
# interface = eth0
#
- # max_packet_size:: Our max packet size. may be different from the parent.
+ # max_packet_size:: Our max packet size. may be different from the
+ # parent.
#
# max_packet_size = 4096
#
# limit:: limits for this socket.
#
- # The `limit` section contains configuration items
- # which enforce various limits on the socket. These
- # limits are usually transport-specific.
+ # The `limit` section contains configuration items which enforce
+ # various limits on the socket. These limits are usually
+ # transport-specific.
#
# Limits are used to prevent "run-away" problems.
#
limit {
#
- # max_connections:: The maximum number of
- # connected sockets which will be accepted
- # for this listener.
+ # max_connections:: The maximum number of connected sockets which
+ # will be accepted for this listener.
#
- # Each connection opens a new socket, so be
- # aware of system file descriptor
- # limitations.
+ # Each connection opens a new socket, so be aware of system file
+ # descriptor limitations.
#
- # If the listeners do not use connected
- # sockets (e.g. TCP), then this configuration
- # item is ignored.
+ # If the listeners do not use connected sockets (e.g. TCP), then
+ # this configuration item is ignored.
#
max_connections = 256
#
- # idle_timeout:: Time after which idle
- # connections are deleted.
+ # idle_timeout:: Time after which idle connections are deleted.
#
# Useful range of values: 5 to 600
#
idle_timeout = 60.0
#
- # dynamic_timeout:: Time after which idle
- # dynamic clients are deleted.
+ # dynamic_timeout:: Time after which idle dynamic clients are
+ # deleted.
#
dynamic_timeout = 600.0
}
#
# == Clients
#
- # A virtual server can have multiple `client` definitions. These clients take priority
- # over the global `client` definitions.
+ # A virtual server can have multiple `client` definitions. These
+ # clients take priority over the global `client` definitions.
#
- # See the main `clients.conf` file for documentation on the `client` section.
+ # See the main `clients.conf` file for documentation on the `client`
+ # section.
#
client tacacs {
ipaddr = 127.0.0.1
proto = tcp
#
- # The TACACS+ key, or secret. If a secret is defined, then
- # it will be used. All packets coming from this client MUST be
- # encrypted with the shared secret.
+ # The TACACS+ key, or secret. If a secret is defined, then it will
+ # be used. All packets coming from this client MUST be encrypted
+ # with the shared secret.
#
- # The `secret` configuration item can be omitted or deleted,
- # in which case all of the information (including passwords)
- # are sent over the network in the clear. This practice is
- # not recommended.
+ # The `secret` configuration item can be omitted or deleted, in
+ # which case all of the information (including passwords) are sent
+ # over the network in the clear. This practice is not recommended.
#
secret = testing123
}
# === Recv
#
#
- # In general, it is not necessary to set `Auth-Type` in this section. The packet header
- # contains a TACACS `Authentication-Type` with value `PAP`, `CHAP`, etc. That value will
- # be used automatically by the server to set `Auth-Type`.
+ # In general, it is not necessary to set `Auth-Type` in this
+ # section. The packet header contains a TACACS `Authentication-Type`
+ # with value `PAP`, `CHAP`, etc. That value will be used
+ # automatically by the server to set `Auth-Type`.
#
- # The only reason to set `Auth-Type` here is when you want to use a custom
- # authentication method, such as `ldap`. You should ONLY set `Auth-Type := ldap` when
- # the packet contains `Authentication-Type = PAP` _and_ the passwords in LDAP are stored
- # in "crypt" or hashed form.
+ # The only reason to set `Auth-Type` here is when you want to use a
+ # custom authentication method, such as `ldap`. You should ONLY set
+ # `Auth-Type := ldap` when the packet contains `Authentication-Type
+ # = PAP` _and_ the passwords in LDAP are stored in "crypt" or hashed
+ # form.
#
recv Authentication-Start {
-sql
#
# LDAP authentication will only work with PAP authentication
#
-# authenticate ldap {
-# if (Authentication-Type != PAP) {
-# %log.warn("The packet is not PAP. LDAP authentication is likely to fail!")
-# }
-#
-# ldap
-# }
+ # authenticate ldap {
+ # if (Authentication-Type != PAP) {
+ # %log.warn("The packet is not PAP. LDAP authentication is likely to fail!")
+ # }
+ #
+ # ldap
+ # }
#
- # The automatic state machine will ensure that both User-Name
- # and User-Password have been provided by this point making
- # ASCII authentication equivalent to PAP.
+ # The automatic state machine will ensure that both User-Name and
+ # User-Password have been provided by this point making ASCII
+ # authentication equivalent to PAP.
#
- # Alternatively, if extra data is required, set
- # reply.Packet-Type := ::Authentication-GetData
- # to request the extra data, which will be in User-Message in
- # the next packet (if the client provides it)
+ # Alternatively, if extra data is required, set reply.Packet-Type :=
+ # ::Authentication-GetData to request the extra data, which will be
+ # in User-Message in the next packet (if the client provides it)
#
authenticate ASCII {
pap
# - equivalent to the previous log `auth = yes` option in v3.
# See `mods-enabled/linelog` for message formats and destinations.
#
-# log_auth_authentication_pass
+ # log_auth_authentication_pass
}
send Authentication-Fail {
# - equivalent to the previous log `auth = yes` option in v3.
# See `mods-enabled/linelog` for message formats and destinations.
#
-# log_auth_authentication_fail
+ # log_auth_authentication_fail
}
#
#
# == Authentication-Continue
#
- # This section handles responses to challenges for `Authentication-Type = ASCII`
+ # This section handles responses to challenges for
+ # `Authentication-Type = ASCII`
#
- # i.e. The server receives an `Authentication-Start` packet
- # with `Authentication-Type = ASCII`, and replies with a
- # challenge. The client returns the username or password in
- # an `Authentication-Continue` packet. The server should
- # then check the username or password.
+ # i.e. The server receives an `Authentication-Start` packet with
+ # `Authentication-Type = ASCII`, and replies with a challenge. The
+ # client returns the username or password in an
+ # `Authentication-Continue` packet. The server should then check the
+ # username or password.
#
- # The TACACS+ protocol puts the response username or password
- # into the "data" field. For simplicity, the server copies
- # that field into the User-Name or User-Password attribute as
- # appropriate. This automatic copyinh means that it is a lot
- # easier to understand and configure TACACS+.
+ # The TACACS+ protocol puts the response username or password into
+ # the "data" field. For simplicity, the server copies that field
+ # into the User-Name or User-Password attribute as appropriate. This
+ # automatic copyinh means that it is a lot easier to understand and
+ # configure TACACS+.
#
#
# === Recv
#
- # Receive `Authentication-Continue` packet. When this
- # section is done and has a User-Password, the server will
- # run an `authenticate ... { }` section. It will then call
- # one of the `send` sections to send the reply.
+ # Receive `Authentication-Continue` packet. When this section is
+ # done and has a User-Password, the server will run an `authenticate
+ # ... { }` section. It will then call one of the `send` sections to
+ # send the reply.
#
recv Authentication-Continue {
#
#
# === Accounting "type" Sections
#
- # Each type of accounting packet is run through its own
- # section. The section MUST return "ok" to indicate that
- # it successfully handled the accounting data.
+ # Each type of accounting packet is run through its own section. The
+ # section MUST return "ok" to indicate that it successfully handled
+ # the accounting data.
#
- # The "ok" return code is typically set automatically when
- # an accounting module succeeds in its work. The explicit
- # "ok" here is just so that the default configuration will
- # return success for all accounting packets.
+ # The "ok" return code is typically set automatically when an
+ # accounting module succeeds in its work. The explicit "ok" here is
+ # just so that the default configuration will return success for all
+ # accounting packets.
#
# First packet for a session
accounting Start {
#
limit {
#
- # Limit the number of simultaneous TCP connections to the socket
+ # Limit the number of simultaneous TCP connections to the
+ # socket
#
- # The default is 16.
- # Setting this to 0 means "no limit"
+ # The default is 16. Setting this to 0 means "no limit"
max_connections = 16
# The per-socket "max_requests" option does not exist.
#
- # The lifetime, in seconds, of a TCP connection. After
- # this lifetime, the connection will be closed.
+ # The lifetime, in seconds, of a TCP connection. After this
+ # lifetime, the connection will be closed.
#
# Setting this to 0 means "forever".
lifetime = 0
#
- # The idle timeout, in seconds, of a TCP connection.
- # If no packets have been received over the connection for
- # this time, the connection will be closed.
+ # The idle timeout, in seconds, of a TCP connection. If no
+ # packets have been received over the connection for this
+ # time, the connection will be closed.
#
# Setting this to 0 means "no timeout".
#
private_key_password = whatever
private_key_file = ${certdir}/server.pem
- # If Private key and Certificate are located in
- # the same file, then the private_key_file and
- # certificate_file must contain the same file
- # name.
- #
- # If ca_file (below) is not used, then the
- # certificate_file below MUST include not
- # only the server certificate, but ALSO all
- # of the CA certificates used to sign the
- # server certificate.
+ # If Private key and Certificate are located in the same file,
+ # then the private_key_file and certificate_file must contain the
+ # same file name.
+ #
+ # If ca_file (below) is not used, then the certificate_file below
+ # MUST include not only the server certificate, but ALSO all of
+ # the CA certificates used to sign the server certificate.
certificate_file = ${certdir}/server.pem
# Trusted Root CA list
#
- # ALL of the CA's in this list will be trusted
- # to issue client certificates for authentication.
+ # ALL of the CA's in this list will be trusted to issue client
+ # certificates for authentication.
#
- # In general, you should use self-signed
- # certificates for 802.1x (EAP) authentication.
- # In that case, this CA file should contain
+ # In general, you should use self-signed certificates for 802.1x
+ # (EAP) authentication. In that case, this CA file should contain
# *one* CA certificate.
#
- # This parameter is used only for EAP-TLS,
- # when you issue client certificates. If you do
- # not use client certificates, and you do not want
- # to permit EAP-TLS authentication, then delete
- # this configuration item.
+ # This parameter is used only for EAP-TLS, when you issue client
+ # certificates. If you do not use client certificates, and you do
+ # not want to permit EAP-TLS authentication, then delete this
+ # configuration item.
ca_file = ${cadir}/ca.pem
#
- # You can create the DH parameters by running the
- # following command:
+ # You can create the DH parameters by running the following
+ # command:
#
- # openssl dhparam -out certs/dh 2048
+ # openssl dhparam -out certs/dh 2048
#
# The DH parameters will usually be ignored in FIPS mode.
#
- # If this file isn't specified, then OpenSSL will
- # automatically set the correct DH parameters.
+ # If this file isn't specified, then OpenSSL will automatically
+ # set the correct DH parameters.
#
# dh_file = ${certdir}/dh
#
- # If your system doesn't have /dev/urandom,
- # you will need to create this file, and
- # periodically change its contents.
+ # If your system doesn't have /dev/urandom, you will need to
+ # create this file, and periodically change its contents.
#
- # For security reasons, FreeRADIUS doesn't
- # write to files in its configuration
- # directory.
+ # For security reasons, FreeRADIUS doesn't write to files in its
+ # configuration directory.
#
# random_file = /dev/urandom
#
- # The default fragment size is 1K.
- # However, it's possible to send much more data than
- # that over a TCP connection. The upper limit is 64K.
- # Setting the fragment size to more than 1K means that
- # there are fewer round trips when setting up a TLS
- # connection. But only if the certificates are large.
+ # The default fragment size is 1K. However, it's possible to send
+ # much more data than that over a TCP connection. The upper limit
+ # is 64K. Setting the fragment size to more than 1K means that
+ # there are fewer round trips when setting up a TLS connection.
+ # But only if the certificates are large.
#
fragment_size = 8192
- # include_length is a flag which is
- # by default set to yes If set to
- # yes, Total Length of the message is
- # included in EVERY packet we send.
- # If set to no, Total Length of the
- # message is included ONLY in the
- # First packet of a fragment series.
+ # include_length is a flag which is by default set to yes If set
+ # to yes, Total Length of the message is included in EVERY packet
+ # we send. If set to no, Total Length of the message is included
+ # ONLY in the First packet of a fragment series.
#
# include_length = yes
ca_path = ${cadir}
#
- # If check_cert_issuer is set, the value will
- # be checked against the DN of the issuer in
- # the client certificate. If the values do not
- # match, the certificate verification will fail,
- # rejecting the user.
+ # If check_cert_issuer is set, the value will be checked against
+ # the DN of the issuer in the client certificate. If the values do
+ # not match, the certificate verification will fail, rejecting the
+ # user.
#
- # This check can be done more generally by checking
- # the value of the TLS-Client-Cert-Issuer attribute.
- # This check can be done via any mechanism you choose.
+ # This check can be done more generally by checking the value of
+ # the TLS-Client-Cert-Issuer attribute. This check can be done via
+ # any mechanism you choose.
#
# check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd"
#
- # If check_cert_cn is set, the value will
- # be xlat'ed and checked against the CN
- # in the client certificate. If the values
- # do not match, the certificate verification
- # will fail rejecting the user.
+ # If check_cert_cn is set, the value will be xlat'ed and checked
+ # against the CN in the client certificate. If the values do not
+ # match, the certificate verification will fail rejecting the
+ # user.
#
- # This check is done only if the previous
- # "check_cert_issuer" is not set, or if
- # the check succeeds.
+ # This check is done only if the previous "check_cert_issuer" is
+ # not set, or if the check succeeds.
#
- # This check can be done more generally by checking
- # the value of the TLS-Client-Cert-Common-Name attribute.
- # This check can be done via any mechanism you choose.
+ # This check can be done more generally by checking the value of
+ # the TLS-Client-Cert-Common-Name attribute. This check can be
+ # done via any mechanism you choose.
#
# check_cert_cn = %{User-Name}
- # Set this option to specify the allowed
- # TLS cipher suites. The format is listed
- # in "man 1 ciphers".
+ # Set this option to specify the allowed TLS cipher suites. The
+ # format is listed in "man 1 ciphers".
cipher_list = "DEFAULT"
- # If enabled, OpenSSL will use server cipher list
- # (possibly defined by cipher_list option above)
- # for choosing right cipher suite rather than
- # using client-specified list which is OpenSSl default
- # behavior. Having it set to 'yes' is best practice
- # for TLS.
+ # If enabled, OpenSSL will use server cipher list (possibly
+ # defined by cipher_list option above) for choosing right cipher
+ # suite rather than using client-specified list which is OpenSSl
+ # default behavior. Having it set to 'yes' is best practice for
+ # TLS.
cipher_server_preference = yes
#
- # Session resumption / fast reauthentication
- # cache.
+ # Session resumption / fast reauthentication cache.
#
# The cache contains the following information:
#
- # session Id - unique identifier, managed by SSL
- # User-Name - from the Access-Accept
- # Stripped-User-Name - from the Access-Request
+ # session Id - unique identifier, managed by SSL User-Name - from
+ # the Access-Accept Stripped-User-Name - from the Access-Request
# Cached-Session-Policy - from the Access-Accept
#
- # The "Cached-Session-Policy" is the name of a
- # policy which should be applied to the cached
- # session. This policy can be used to assign
- # VLANs, IP addresses, etc. It serves as a useful
- # way to re-apply the policy from the original
- # Access-Accept to the subsequent Access-Accept
- # for the cached session.
+ # The "Cached-Session-Policy" is the name of a policy which should
+ # be applied to the cached session. This policy can be used to
+ # assign VLANs, IP addresses, etc. It serves as a useful way to
+ # re-apply the policy from the original Access-Accept to the
+ # subsequent Access-Accept for the cached session.
#
- # On session resumption, these attributes are
- # copied from the cache, and placed into the
- # reply list.
+ # On session resumption, these attributes are copied from the
+ # cache, and placed into the reply list.
#
- # You probably also want "use_tunneled_reply = yes"
- # when using fast session resumption.
+ # You probably also want "use_tunneled_reply = yes" when using
+ # fast session resumption.
#
cache {
#
- # Lifetime of the cached entries, in hours.
- # The sessions will be deleted after this
- # time.
+ # Lifetime of the cached entries, in hours. The sessions
+ # will be deleted after this time.
#
lifetime = 24 # hours
#
- # Internal "name" of the session cache.
- # Used to distinguish which TLS context
- # sessions belong to.
+ # Internal "name" of the session cache. Used to distinguish
+ # which TLS context sessions belong to.
#
- # The server will generate a random value
- # if unset. This will change across server
- # restart so you MUST set the "name" if you
- # want to persist sessions (see below).
+ # The server will generate a random value if unset. This
+ # will change across server restart so you MUST set the
+ # "name" if you want to persist sessions (see below).
#
- # If you use IPv6, change the "ipaddr" below
- # to "ipv6addr"
+ # If you use IPv6, change the "ipaddr" below to "ipv6addr"
#
# name = "TLS ${..ipaddr} ${..port} ${..proto}"
#
- # Simple directory-based storage of sessions.
- # Two files per session will be written, the SSL
- # state and the cached VPs. This will persist session
- # across server restarts.
+ # Simple directory-based storage of sessions. Two files per
+ # session will be written, the SSL state and the cached VPs.
+ # This will persist session across server restarts.
#
- # The server will need write perms, and the directory
- # should be secured from anyone else. You might want
- # a script to remove old files from here periodically:
+ # The server will need write perms, and the directory should
+ # be secured from anyone else. You might want a script to
+ # remove old files from here periodically:
#
# find ${logdir}/tlscache -mtime +2 -exec rm -f {} \;
#
require_client_cert = yes
#
- # As of version 2.1.10, client certificates can be
- # validated via an external command. This allows
- # dynamic CRLs or OCSP to be used.
+ # As of version 2.1.10, client certificates can be validated via
+ # an external command. This allows dynamic CRLs or OCSP to be
+ # used.
#
- # This configuration is commented out in the
- # default configuration. Uncomment it, and configure
- # the correct paths below to enable it.
+ # This configuration is commented out in the default
+ # configuration. Uncomment it, and configure the correct paths
+ # below to enable it.
#
verify {
- # The command used to verify the client cert.
- # We recommend using the OpenSSL command-line
- # tool.
+ # The command used to verify the client cert. We recommend using the
+ # OpenSSL command-line tool.
#
- # The ${..ca_path} text is a reference to
- # the ca_path variable defined above.
+ # The ${..ca_path} text is a reference to the ca_path variable defined
+ # above.
#
- # The %{TLS-Client-Cert-Filename} is the name
- # of the temporary file containing the cert
- # in PEM format. This file is automatically
- # deleted by the server when the command
- # returns.
+ # The %{TLS-Client-Cert-Filename} is the name of the temporary file
+ # containing the cert in PEM format. This file is automatically deleted
+ # by the server when the command returns.
# client = "/path/to/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}"
}
}
#
# This section can be run to verify a client certificate if
- # additional checks need to be performed beyond standard
- # checks verification against a trust chain, CRLs and OCSP.
+ # additional checks need to be performed beyond standard checks
+ # verification against a trust chain, CRLs and OCSP.
#
- # Attributes extracted from the certificates forming the
- # client certificate chain will be in the session state list.
+ # Attributes extracted from the certificates forming the client
+ # certificate chain will be in the session state list.
#
- # Returning 'ok', 'updated' or 'noop' will cause the verification
- # to succeed. Other return codes will cause the verification
- # to fail.
+ # Returning 'ok', 'updated' or 'noop' will cause the verification to
+ # succeed. Other return codes will cause the verification to fail.
#
verify certificate {
#
- # Check the client certificate matches a string, and reject otherwise
+ # Check the client certificate matches a string, and reject
+ # otherwise
#
## if ("%{session-state.TLS-Certificate.Common-Name}" != 'client.example.com') {
## reject
## }
#
- # Check the client certificate common name against the supplied identity
+ # Check the client certificate common name against the supplied
+ # identity
#
## if (EAP-Identity != "host/%{session-state.TLS-Certificate.Common-Name}") {
## reject
#
# This is a convenient place to call LDAP, for example, when using
- # EAP-TLS, as it will only be called once, after all certificates as
- # part of the EAP-TLS challenge process have been verified.
+ # EAP-TLS, as it will only be called once, after all certificates
+ # as part of the EAP-TLS challenge process have been verified.
#
- # An example could be to use LDAP to check that the connecting host, as
- # well as presenting a valid certificate, is also in a group based on
- # the EAP-Identity (assuming this contains the service principal name).
- # Settings such as the following could be used in the ldap module
- # configuration:
+ # An example could be to use LDAP to check that the connecting
+ # host, as well as presenting a valid certificate, is also in a
+ # group based on the EAP-Identity (assuming this contains the
+ # service principal name). Settings such as the following could be
+ # used in the ldap module configuration:
#
- # basedn = "dc=example, dc=com"
- # filter = "(servicePrincipalName=%{EAP-Identity})"
- # base_filter = "(objectClass=computer)"
- # groupname_attribute = cn
- # groupmembership_filter = "(&(objectClass=group)(member=%{control.Ldap-UserDn}))"
+ # basedn = "dc=example, dc=com" filter =
+ # "(servicePrincipalName=%{EAP-Identity})" base_filter =
+ # "(objectClass=computer)" groupname_attribute = cn
+ # groupmembership_filter =
+ # "(&(objectClass=group)(member=%{control.Ldap-UserDn}))"
#
# ldap
#
- # Now let's test membership of an LDAP group (the ldap bind user will
- # need permission to read this group membership):
+ # Now let's test membership of an LDAP group (the ldap bind user
+ # will need permission to read this group membership):
#
## if (!%ldap.group("Permitted-Laptops")) {
## reject
## }
- # or, to be more specific, you could use the group's full DN:
- # if (!%ldap.group("CN=Permitted-Laptops,OU=Groups,DC=example,DC=org")) {
+ # or, to be more specific, you could use the group's full DN: if
+ # (!%ldap.group("CN=Permitted-Laptops,OU=Groups,DC=example,DC=org"))
+ # {
#
# This may be a better place to call the files modules when using
- # EAP-TLS, as it will only be called once, after the challenge-response
- # iteration has completed.
+ # EAP-TLS, as it will only be called once, after the
+ # challenge-response iteration has completed.
#
# files
}
#
- # This section is run prior to creating a new TLS session
- # and can be used to modify session parameters such as
- # max and min TLS versions.
+ # This section is run prior to creating a new TLS session and can be
+ # used to modify session parameters such as max and min TLS
+ # versions.
#
## new session {
## control.Max-Version := 1.3
## }
#
- # This section is run whenever the server needs to read an
- # entry from the TLS session cache.
+ # This section is run whenever the server needs to read an entry
+ # from the TLS session cache.
#
- # It should read the attribute session-state.TLS-Session-Data
- # from the cache, along with any other attributes which
- # were in the cache
+ # It should read the attribute session-state.TLS-Session-Data from
+ # the cache, along with any other attributes which were in the cache
#
# On success it should return 'ok' or 'updated'.
#
- # The return code has no real effect on session processing
- # and will just cause the server to emit a warning.
+ # The return code has no real effect on session processing and will
+ # just cause the server to emit a warning.
#
load session {
control.Cache-Allow-Insert := no
}
#
- # This section is run whenever the server needs to write an
- # entry to the TLS session cache.
+ # This section is run whenever the server needs to write an entry to
+ # the TLS session cache.
#
- # It should write the attribute session-state.Session-Data
- # to the cache, along with any other attributes which
- # need to be cached.
+ # It should write the attribute session-state.Session-Data to the
+ # cache, along with any other attributes which need to be cached.
#
# On success it should return 'ok' or 'updated'.
#
- # The return code has no real effect on session processing
- # and will just cause the server to emit a warning.
+ # The return code has no real effect on session processing and will
+ # just cause the server to emit a warning.
#
store session {
control.Cache-TTL := 0
}
#
- # This section is run whenever the server needs to delete an
- # entry from the TLS session cache.
+ # This section is run whenever the server needs to delete an entry
+ # from the TLS session cache.
#
# On success it should return 'ok', 'updated', 'noop' or 'notfound'
#
- # The return code has no real effect on session processing
- # and will just cause the server to emit a warning.
+ # The return code has no real effect on session processing and will
+ # just cause the server to emit a warning.
#
clear session {
control.Cache-TTL := 0
#
# This section is run after the TLS session is established.
#
- # It is intended for logging session details such as
- # TLS version or cipher suite.
+ # It is intended for logging session details such as TLS version or
+ # cipher suite.
#
## establish session {
##
## }
#
- # This section is run after certificate attributes are added
- # to the request list, and before performing OCSP validation.
+ # This section is run after certificate attributes are added to the
+ # request list, and before performing OCSP validation.
#
- # It should read the attribute control.TLS-OCSP-Cert-Valid
- # from the cache.
+ # It should read the attribute control.TLS-OCSP-Cert-Valid from the
+ # cache.
#
# On success it should return 'ok', 'updated', 'noop' or 'notfound'
# To force OCSP validation failure, it should return 'reject'.
#
# This section is run after OCSP validation has completed.
#
- # It should write the attribute reply.TLS-OCSP-Cert-Valid
- # to the cache.
+ # It should write the attribute reply.TLS-OCSP-Cert-Valid to the
+ # cache.
#
# On success it should return 'ok' or 'updated'.
#
- # The return code has no real effect on session processing
- # and will just cause the server to emit a warning.
+ # The return code has no real effect on session processing and will
+ # just cause the server to emit a warning.
#
store ocsp-state {
control.Cache-TTL := "%{reply.TLS-OCSP-Next-Update * -1}"
######################################################################
#
-# You will want to edit this to your local needs. We suggest copying
+# You will want to edit this to your local needs. We suggest copying
# the text from the "default" file here, and then editing the text.
# That way, any changes to the "default" file will not affect this
# virtual server, and vice-versa.
#
# When this virtual server receives the request, the original
-# attributes can be accessed as "outer.request", "outer.control", etc.
+# attributes can be accessed as "outer.request", "outer.control",
+# etc.
#
#
-# This example virtual server will listen on alternate ports
-# and perform basic authentication and accounting.
-# Consult the default file for information on the syntax and available options.
+# This example virtual server will listen on alternate ports and
+# perform basic authentication and accounting. Consult the default
+# file for information on the syntax and available options.
#
server virtual.example.com {
# In v4, all "server" sections MUST start with a "namespace"
- # parameter. This tells the server which protocol is being used.
- # Consult the sites-available/default for more information and documentation.
+ # parameter. This tells the server which protocol is being used.
+ # Consult the sites-available/default for more information and
+ # documentation.
namespace = radius
#
- # Define our listeners and the types of application packets we expect.
+ # Define our listeners and the types of application packets we
+ # expect.
#
listen {
type = Access-Request
}
#
- # Now we define our policy framework for how this virtual server will handle various application packets.
- # Consult the default file for information on the syntax and available options.
+ # Now we define our policy framework for how this virtual server
+ # will handle various application packets. Consult the default file
+ # for information on the syntax and available options.
recv Access-Request {
# insert policies here
# insert policies here
#
- # Ensure that we have a semi-unique identifier for every
- # request, and many NAS boxes are broken.
+ # Ensure that we have a semi-unique identifier for every request,
+ # and many NAS boxes are broken.
#
acct_unique
send Accounting-Response {
#
- # Create a 'detail'ed log of the packets.
- # Note that accounting requests which are proxied
- # are also logged in the detail file.
+ # Create a 'detail'ed log of the packets. Note that accounting
+ # requests which are proxied are also logged in the detail file.
#
detail
server vmps {
#
# In v4, all "server" sections MUST start with a "namespace"
- # parameter. This tells the server which protocol is being used.
+ # parameter. This tells the server which protocol is being used.
#
- # All of the subsequent "listen" sections in this server will
- # only accept packets for that protocol.
+ # All of the subsequent "listen" sections in this server will only
+ # accept packets for that protocol.
#
namespace = vmps
port = 1589
#
- # Some systems support binding to an interface, in addition
- # to the IP address. This feature isn't strictly necessary,
- # but for sites with many IP addresses on one interface,
- # it's useful to say "listen on all addresses for eth0".
+ # Some systems support binding to an interface, in addition to the
+ # IP address. This feature isn't strictly necessary, but for sites
+ # with many IP addresses on one interface, it's useful to say
+ # "listen on all addresses for eth0".
#
- # If your system does not support this feature, you will
- # get an error if you try to use it.
+ # If your system does not support this feature, you will get an
+ # error if you try to use it.
#
# interface = eth0
}
#
# You can list multiple "client" sections here in order to define
- # clients which apply only to this virtual server. i.e. only for
- # the VMPS protocol.
+ # clients which apply only to this virtual server. i.e. only for the
+ # VMPS protocol.
#
#
#
recv Join-Request {
#
- # Some requests may not have a MAC address. Try to
- # create one using other attributes.
+ # Some requests may not have a MAC address. Try to create one using
+ # other attributes.
if (!MAC-Address) {
if (Ethernet-Frame =~ /0x.{12}(..)(..)(..)(..)(..)(..).*/) {
request.MAC-Address = "%{1}:%{2}:%{3}:%{4}:%{5}:%{6}"
#
# Do a simple mapping of MAC to VLAN.
#
- # See `mods-available/mac2vlan` for the definition of the "mac2vlan"
- # module.
+ # See `mods-available/mac2vlan` for the definition of the
+ # "mac2vlan" module.
#
-# mac2vlan
+ # mac2vlan
#
# required VMPS reply attributes
reply.VLAN-Name = "please_use_real_vlan_here"
#
- # NOTE: If you have VLAN's in a database, you can `select`
- # the VLAN name based on the MAC address.
+ # NOTE: If you have VLAN's in a database, you can `select` the VLAN
+ # name based on the MAC address.
#
# reply.VLAN-Name = %sql("select ... where mac='%{MAC-Address}'")
}
#
# The goal of the templates is to have common configuration located
# in this file, and to list only the _differences_ in the individual
-# sections. This feature is most useful for sections like `clients`
+# sections. This feature is most useful for sections like `clients`
# where many may be defined, and each one has similar repeated
# configuration.
#
# Something similar to templates can be done by putting common
# configuration into separate files, and using `$INCLUDE file...`,
-# but templates are more flexible, and simpler to understand. It's also
-# cheaper for the server, because `$INCLUDE` makes a copy of the
-# configuration for inclusion, whereas templates are simply referenced.
+# but templates are more flexible, and simpler to understand. It's
+# also cheaper for the server, because `$INCLUDE` makes a copy of the
+# configuration for inclusion, whereas templates are simply
+# referenced.
#
-# The templates are defined in the `templates` section so that
-# they do not affect the rest of the server configuration. The
-# actual contents of the templates section are other
-# configuration sections that would normally go into the main
-# configuration files.
+# The templates are defined in the `templates` section so that they
+# do not affect the rest of the server configuration. The actual
+# contents of the templates section are other configuration sections
+# that would normally go into the main configuration files.
#
# Within the main server configuration, a section can reference a
# template by using `$template name`.
#
#
-# One use case would be if there are multiple instances of the
-# sql module for load balancing or failover.
-# These will typically share many common configuration options
-# which can be set in a template and then that template referred
-# to in each instances of the sql module
+# One use case would be if there are multiple instances of the sql
+# module for load balancing or failover. These will typically share
+# many common configuration options which can be set in a template
+# and then that template referred to in each instances of the sql
+# module
#
# sql sql01 {
# $template sql-common
#
# In that case the template `sql-common` could be as follows:
#
-#sql-common {
+# sql-common {
# acct_table = 'radacct'
# acct_table2 = 'radacct'
# postauth_table = 'radpostauth'
# min = 1
# spare = 1
# }
-#}
+# }
#
# Triggers are events in the server can cause a hook to be executed.
#
-# The triggers are named as `type.subtype.value`. These names refer
+# The triggers are named as `type.subtype.value`. These names refer
# to subsections and then configuration items in the `trigger`
-# section below. When an event occurs, the trigger is executed. The
+# section below. When an event occurs, the trigger is executed. The
# trigger is simply a program that is run, with optional arguments.
#
-# The server does not wait when a trigger is executed. It is simply
-# a `one-shot` event that is sent.
+# The server does not wait when a trigger is executed. It is simply a
+# `one-shot` event that is sent.
#
# NOTE: The trigger names should be self-explanatory.
#
#
# For now, this is only for SNMP traps.
#
-# They are enabled by uncommenting (or adding) `$INCLUDE trigger.conf`
-# in the main `radiusd.conf` file.
+# They are enabled by uncommenting (or adding) `$INCLUDE
+# trigger.conf` in the main `radiusd.conf` file.
#
-# The traps *require* that the files in the "mibs" directory be copied
-# to the global mibs directory, usually `/usr/share/snmp/mibs/`.
-# If this is not done, the `snmptrap` program has no idea what information
-# to send, and will not work. The MIB installation is *not* done as
-# part of the default installation, so that step *must* be done manually.
+# The traps *require* that the files in the "mibs" directory be
+# copied to the global mibs directory, usually
+# `/usr/share/snmp/mibs/`. If this is not done, the `snmptrap`
+# program has no idea what information to send, and will not work.
+# The MIB installation is *not* done as part of the default
+# installation, so that step *must* be done manually.
#
-# The global MIB directory can be found by running the following command:
+# The global MIB directory can be found by running the following
+# command:
#
# snmptranslate -Dinit_mib .1.3 2>&1 | grep MIBDIR | \
# sed "s/' .*//;s/.* '//;s/.*://"
# = 1.3.6.1.4.1.11344.4.1.1
#
# As always, run the server in debugging mode after enabling the
-# traps. You will see the `snmptrap` command being run, and it will
-# print out any errors or issues that it encounters. Those need to
-# be fixed before running the server in daemon mode.
+# traps. You will see the `snmptrap` command being run, and it will
+# print out any errors or issues that it encounters. Those need to be
+# fixed before running the server in daemon mode.
#
# We also suggest running in debugging mode as the `radiusd` user, if
-# you have "user" or "group" set in `radiusd.conf`. The `snmptrap`
+# you have "user" or "group" set in `radiusd.conf`. The `snmptrap`
# program may behave differently when run as `root` rather than the
# `radiusd` user.
#
# Configuration for SNMP traps / notifications, used in the
# "snmptrap" option below.
#
- # To disable traps, edit `radiusd.conf` and delete the line
- # which says `$INCLUDE trigger.conf`.
+ # To disable traps, edit `radiusd.conf` and delete the line which
+ # says `$INCLUDE trigger.conf`.
#
trap {
#
- # cmd:: Absolute path for the `snmptrap` command, and
- # default command-line arguments.
+ # cmd:: Absolute path for the `snmptrap` command, and default
+ # command-line arguments.
#
- # You can also temporarily disable traps by changing
- # the command to `/bin/echo`.
+ # You can also temporarily disable traps by changing the command to
+ # `/bin/echo`.
#
cmd = "/usr/bin/snmptrap -v2c"
#
# snmptrap:: Define the full command used to run the traps.
#
-# This entry should not be edited. Instead, edit the "trap" section above.
+# This entry should not be edited. Instead, edit the "trap" section
+# above.
#
snmptrap = "${snmp.trap.cmd} -c ${snmp.trap.community} ${snmp.trap.agent} FREERADIUS-NOTIFICATION-MIB"
#
# == Trigger definitions
#
-# The individual triggers are defined here. You can disable one by
-# deleting it, or by commenting it out. You can disable an entire
+# The individual triggers are defined here. You can disable one by
+# deleting it, or by commenting it out. You can disable an entire
# section of traps by deleting the section.
#
-# The entries below should not be edited. For example, the double colons
-# *must* immediately follow the `${snmptrap}` reference. Adding a space
-# before the double colons will break all SNMP traps.
+# The entries below should not be edited. For example, the double
+# colons *must* immediately follow the `${snmptrap}` reference.
+# Adding a space before the double colons will break all SNMP traps.
#
# The triggers just programs which are run when particular events
-# occur. If you want to replace an SNMP trap with another program,
-# you can. Just edit the definitions below, so that they run a
+# occur. If you want to replace an SNMP trap with another program,
+# you can. Just edit the definitions below, so that they run a
# program of your choice.
#
# For example, you can leverage the "start/stop" triggers to run a
-# program when the server starts, or when it stops. However, only
-# one program will be executed per trigger.
+# program when the server starts, or when it stops. However, only one
+# program will be executed per trigger.
#
trigger {
#
# === Server core triggers
#
- # The 'server' section is for events that happen in the
- # server core
+ # The 'server' section is for events that happen in the server core
#
server {
#
#
# === Module triggers
#
- # Triggers for specific modules. These are *not* in the
- # module configuration because they are global to all
- # instances of the module. You can have module-specific
- # triggers, by placing a `trigger` subsection in the module
- # configuration. Not all modules support a `trigger`
- # subsection.
+ # Triggers for specific modules. These are *not* in the module
+ # configuration because they are global to all instances of the
+ # module. You can have module-specific triggers, by placing a
+ # `trigger` subsection in the module configuration. Not all modules
+ # support a `trigger` subsection.
#
modules {
# and these all support the following triggers relating to trunk
# connection state changes.
#
- # Instead of globally configuring these triggers here, they could be configured per module instance
- # by including a `trigger` section within the module instance `pool` section. That allows for startup
- # expansions `${.:name}` and `${.:instance}` to reference the module name and instance name in place
- # of run-time expansions %{Module-Name} and %{Module-Instance}.
+ # Instead of globally configuring these triggers here, they could be
+ # configured per module instance by including a `trigger` section
+ # within the module instance `pool` section. That allows for startup
+ # expansions `${.:name}` and `${.:instance}` to reference the module
+ # name and instance name in place of run-time expansions
+ # %{Module-Name} and %{Module-Instance}.
#
- # In addition to either enabling the triggers here or within the module `pool` section, for triggers
- # to be enabled for a specific module instance, the `triggers` option within the `pool` section needs
- # to be set to `yes`.
+ # In addition to either enabling the triggers here or within the
+ # module `pool` section, for triggers to be enabled for a specific
+ # module instance, the `triggers` option within the `pool` section
+ # needs to be set to `yes`.
+ #
+ # pool {
+ #
+ # Define common arguments to use below:
#
-# pool {
- #
- # Define common arguments to use below:
- #
# args = "radiusdModuleName s '%{Module-Name}' radiusdModuleInstance s '%{Module-Instance}'"
#
# connection_halted:: A connection has entered the "halted" state.
#
- # All connections start in this state, and return to it after closing.
+ # All connections start in this state, and return to it after
+ # closing.
#
# connection_halted = `${snmptrap}::serverModuleConnectionHalted ${args}`
# connection_init = `${snmptrap}::serverModuleConnectionInit ${args}`
#
- # connection_connecting:: A connection has started connecting to the remote server
+ # connection_connecting:: A connection has started connecting to
+ # the remote server
#
# connection_connecting = `${snmptrap}::serverModuleConnectionInit ${args}`
#
- # active:: A connection has become active (able to service requests)
+ # active:: A connection has become active (able to service
+ # requests)
#
- # *NOTE:* This trigger should not be configured for SQL since due to the limitation of
- # one query per connection, every SQL query results in the connection switching from
- # `active` to `full` and then back again.
+ # *NOTE:* This trigger should not be configured for SQL since due
+ # to the limitation of one query per connection, every SQL query
+ # results in the connection switching from `active` to `full` and
+ # then back again.
#
# connection_active = `${snmptrap}::serverModuleConnectionUp ${args}`
#
- # connection_closed:: A connection has been closed.
+ # connection_closed:: A connection has been closed.
#
# connection_closed = `${snmptrap}::serverModuleConnectionDown ${args}`
#
- # connection_full:: A connection has become full.
+ # connection_full:: A connection has become full.
#
- # A full connection is one which has reached the maximum number of requests per connection.
+ # A full connection is one which has reached the maximum number of
+ # requests per connection.
#
- # *NOTE:* This trigger should not be configured for SQL as every query results in the
- # connection becoming full, due to the limit of one query per connection.
+ # *NOTE:* This trigger should not be configured for SQL as every
+ # query results in the connection becoming full, due to the limit
+ # of one query per connection.
#
# connection_full = `${snmptrap}::serverModuleConnectionFull ${args}`
#
- # connection_inactive:: A connection has become inactive (unable to accept new requests)
+ # connection_inactive:: A connection has become inactive (unable to
+ # accept new requests)
#
# connection_inactive = `${snmptrap}::serverModuleConnectionInactive ${args}`
#
- # connection_inactive_draining:: A connection has become inactive and is draining its requests.
+ # connection_inactive_draining:: A connection has become inactive
+ # and is draining its requests.
#
# connection_inactive_draining = `${snmptrap}::serverModuleConnectionInactiveDraining ${args}`
#
- # connection_draining:: A connection is draining its outstanding requests
+ # connection_draining:: A connection is draining its outstanding
+ # requests
#
# connection_draining = `${snmptrap}::serverModuleConnectionDraining ${args}`
#
- # connection_draining_to_free:: A connection is draining its outstanding requests before feeing.
+ # connection_draining_to_free:: A connection is draining its
+ # outstanding requests before feeing.
#
# connection_draining_to_free = `${snmptrap}::serverModuleConnectionDrainingToFree ${args}`
-# }
+ # }
}
#
# == Creating new triggers
#
-# Triggers are defined in the server source code. Those are the
-# only traps which are generated.
+# Triggers are defined in the server source code. Those are the only
+# traps which are generated.
#
-# WARNING: You *cannot* add new traps by defining them in one of the sections
-# in this file. New traps can be created only by editing both the
-# source code of the server *and* the MIBs. If you are not an expert
-# in C and SNMP, then creating new traps will be difficult.
+# WARNING: You *cannot* add new traps by defining them in one of the
+# sections in this file. New traps can be created only by editing
+# both the source code of the server *and* the MIBs. If you are not
+# an expert in C and SNMP, then creating new traps will be difficult.
#
projects / thirdparty / freeradius-server.git / commitdiff
