| /conf/radius/user_edit.attrs |
|---|
| 0,0 → 1,60 |
| # |
| # Attributes which will be visible in the user/group edit pages |
| # File from free-radiusweb project. |
| # Addons for ALCASAR by Steweb and Rexy |
| # |
| # Format: Attribute Comment |
| # |
| Expiration <a href="help/expiration_help.html" target=lt_help onclick=window.open("help/expiration_help.html","lt_help","width=600,height=250,toolbar=no,scrollbars=no,resizable=yes") title="Expiration Help Page"><font color="blue">Date d'expiration</font></a> |
| Max-All-Session <a href="help/max_all_session_help.html" target=st_help onclick=window.open("help/max_all_session_help.html","st_help","width=600,height=250,toolbar=no,scrollbars=no,resizable=yes") title="Max connection Time Help Page"><font color="blue">Durée totale de connexion autorisée</font></a><BR>(en secondes) |
| Session-Timeout <a href="help/session_timeout_help.html" target=st_help onclick=window.open("help/session_timeout_help.html","st_help","width=600,height=250,toolbar=no,scrollbars=no,resizable=yes") title="Session Timeout Help Page"><font color="blue">Durée maximale d'une session</font></a><BR>(en secondes) |
| Max-Daily-Session <a href="help/session_timeout_help.html" target=st_help onclick=window.open("help/session_timeout_help.html","st_help","width=600,height=250,toolbar=no,scrollbars=no,resizable=yes") title="Session Timeout Help Page"><font color="blue">Durée limite journalière</font></a><BR>(en secondes) |
| #Max-Weekly-Session Weekly Limit (secs) |
| Max-Monthly-Session <a href="help/session_timeout_help.html" target=st_help onclick=window.open("help/session_timeout_help.html","st_help","width=600,height=250,toolbar=no,scrollbars=no,resizable=yes") title="Session Timeout Help Page"><font color="blue">Durée limite mensuelle</font></a><BR>(en secondes) |
| Simultaneous-Use <a href="help/simultaneous_use_help.html" target=su_help onclick=window.open("help/simultaneous_use_help.html","su_help","width=600,height=250,toolbar=no,scrollbars=no,resizable=yes") title="Simultaneous Use Help Page"><font color="blue">Nombre de sessions simultanées</font></a> |
| Login-Time <a href="help/login_time_help.html" target=lt_help onclick=window.open("help/login_time_help.html","lt_help","width=600,height=370,toolbar=no,scrollbars=no,resizable=yes") title="Login-Time Help Page"><font color="blue">Période hebdomadaire</font></a> |
| ChilliSpot-Max-Input-Octets <a href="help/chillispot_max_input_octets_help.html" target=st_help onclick=window.open("help/chillispot_max_input_octets_help.html","st_help","width=600,height=250,toolbar=no,scrollbars=no,resizable=yes") title="ChilliSpot Max Input Octets Help Page"><font color="blue">Nombre d'octets max. en émission</font></a><BR>(en octets) |
| ChilliSpot-Max-Output-Octets <a href="help/chillispot_max_output_octets_help.html" target=st_help onclick=window.open("help/chillispot_max_output_octets_help.html","st_help","width=600,height=250,toolbar=no,scrollbars=no,resizable=yes") title="ChilliSpot Max Output Octets Help Page"><font color="blue">Nombre d'octets max. en réception</font></a><BR>(en octets) |
| ChilliSpot-Max-Total-Octets <a href="help/chillispot_max_total_octets_help.html" target=st_help onclick=window.open("help/chillispot_max_total_octets_help.html","st_help","width=600,height=250,toolbar=no,scrollbars=no,resizable=yes") title="ChilliSpot Max Total Octets Help Page"><font color="blue">Nombre d'octets max. total transmit</font></a><BR>(en octets) |
| ChilliSpot-Bandwidth-Max-Up <a href="help/chillispot_bandwidth_max_up_help.html" target=st_help onclick=window.open("help/chillispot_bandwidth_max_up_help.html","st_help","width=600,height=250,toolbar=no,scrollbars=no,resizable=yes") title="ChilliSpot Bandwidth Max Up Help Page"><font color="blue">Bande passante montante max.</font></a><BR>(en kbits/seconde) |
| ChilliSpot-Bandwidth-Max-Down <a href="help/chillispot_bandwidth_max_down_help.html" target=st_help onclick=window.open("help/chillispot_bandwidth_max_down_help.html","st_help","width=600,height=250,toolbar=no,scrollbars=no,resizable=yes") title="ChilliSpot Bandwidth Max Down Help Page"><font color="blue">Bande passante descendante max.</font></a><BR>(en kbits/seconde) |
| WISPr-Redirection-URL <a href="help/wispr_redirection_url_help.html" target=st_help onclick=window.open("help/wispr_redirection_url_help.html","st_help","width=600,height=250,toolbar=no,scrollbars=no,resizable=yes") title="ChilliSpot Bandwidth Max Down Help Page"><font color="blue">URL de redirection</font></a><BR> |
| # |
| # |
| ##Auth-Type <a href="help/auth_type_help.html" target=su_help onclick=window.open("help/auth_type_help.html","su_help","width=560,height=230,toolbar=no,scrollbars=no,resizable=yes") title="Auth-Type Help Page"><font color="blue">Auth-Type</font></a> |
| #Framed-Protocol <a href="help/framed_protocol_help.html" target=fpr_help onclick=window.open("help/framed_protocol_help.htlml","fpr_help","width=560,height=230,toolbar=no,scrollbars=no,resizable=yes") title="Framed-Protocol Help PPage"><font color="blue">Protocol</font></a> |
| #Framed-IP-Address <a href="help/framed_ip_address_help.html" target=fia_help onclick=window.open("help/framed_ip_address_help.html","fia_help","width=560,height=230,toolbar=no,scrollbars=no,resizable=yes") title="Framed-IP-Address Help Page"><font color="blue">IP Address</font></a> |
| #Framed-IP-Netmask IP Netmask |
| #Framed-Route Route |
| #Framed-Routing |
| #Filter-Id <a href="help/filter_id_help.html" target=fid_help onclick=window.open("help/filter_id_help.html","fid_help","width=560,height=230,toolbar=no,scrollbars=no,resizable=yes") title="Filter-ID Help Page"><font color="blue">Filter ID</font></a> |
| #Framed-MTU <a href="help/framed_mtu_help.html" target=fid_help onclick=window.open("help/framed_mtu_help.html","fid_help","width=560,height=230,toolbar=no,scrollbars=no,resizable=yes") title="Framed-MTU Help Page"><font color="blue">Framed-MTU</font></a> |
| #Framed-Compression <a href="help/framed_compression_help.html" target=fc_help onclick=window.open("help/framed_compression_help.html","fc_help","width=600,height=210,toolbar=no,scrollbars=no,resizable=yes") title="Framed Compression Help Page"><font color="blue">Compression Used</font></a> |
| #Service-Type <a href="help/service_type_help.html" target=st_help onclick=window.open("help/service_type_help.html","st_help","width=560,height=230,toolbar=no,scrollbars=no,resizable=yes") title="Service-Type Help Page"><font color="blue">Service Type</font></a> |
| #Login-IP-Host |
| #Login-Service |
| #Login-TCP-Port |
| #Callback-Number <a href="help/callback_number_help.html" target=fid_help onclick=window.open("help/callback_number_help.html","fid_help","width=560,height=230,toolbar=no,scrollbars=no,resizable=yes") title="Callback-Number Help Page"><font color="blue">Callback-Number</font></a> |
| #Callback-Id <a href="help/callback_id_help.html" target=fid_help onclick=window.open("help/callback_id_help.html","fid_help","width=560,height=230,toolbar=no,scrollbars=no,resizable=yes") title="Callback-ID Help Page"><font color="blue">Callback-ID</font></a> |
| #Framed-IPX-Network |
| #Class <a href="help/class_help.html" target=fid_help onclick=window.open("help/class_help.html","fid_help","width=560,height=230,toolbar=no,scrollbars=no,resizable=yes") title="Class Help Page"><font color="blue">Class</font></a> |
| #Idle-Timeout <a href="help/idle_timeout_help.html" target=it_help onclick=window.open("help/idle_timeout_help.html","it_help","width=600,height=170,toolbar=no,scrollbars=no,resizable=yes") title="Idle Timeout Help Page"><font color="blue">Idle Timeout</font></a> |
| #Termination-Action |
| #Login-LAT-Service |
| #Login-LAT-Node |
| #Login-LAT-Group |
| #Framed-AppleTalk-Link |
| #Framed-AppleTalk-Network |
| #Framed-AppleTalk-Zone |
| #Port-Limit <a href="help/port_limit_help.html" target=pl_help onclick=window.open("help/port_limit_help.html","pl_help","width=600,height=170,toolbar=no,scrollbars=no,resizable=yes") title="Port Limit Help Page"><font color="blue">Port Limit</font></a> |
| #Login-LAT-Port |
| #Dialup-Access <a href="help/dialup_access_help.html" target=da_help onclick=window.open("help/dialup_access_help.html","da_help","width=560,height=200,toolbar=no,scrollbars=no,resizable=yes") title="Dialup Access Help Page"><font color="blue">Dialup Access (use FALSE to lock)</font></a> |
| #Dialup-Lock-Msg <a href="help/lock_message_help.html" target=lm_help onclick=window.open("help/lock_message_help.html","lm_help","width=600,height=210,toolbar=no,scrollbars=no,resizable=yes") title="Lock Message Help Page"><font color="blue">Lock Message</font></a> |
| #Reply-Message <a href="help/reply_message_help.html" target=lm_help onclick=window.open("help/reply_message_help.html","lm_help","width=600,height=210,toolbar=no,scrollbars=no,resizable=yes") title="Reply-Message Help Page"><font color="blue">Reply-Message</font></a> |
| #Login-Time <a href="login_time_create.php?val=$name1&first=yes" target=lt_create onclick=window.open("login_time_create.php?val=$name1&first=yes","lt_create","width=600,height=490,toolbar=no,scrollbars=yes,resizable=yes") title="Login-Time Creation Page"><font color="blue">Période hebdomadaire</font></a><a href="help/login_time_help.html" target=lt_help onclick=window.open("help/login_time_help.html","lt_help","width=600,height=370,toolbar=no,scrollbars=no,resizable=yes") title="Login-Time Help Page"><font color="blue"><BR>(Format UUCP)</font></a> |
| # |
| # Uncomment this if you are using ldap and you are using user regular profiles. |
| # Also make sure that Regular-Profile maps to the correct ldap attribute in |
| # extra.ldap-attrmap |
| # |
| #Regular-Profile User Regular Profile DN |
| /conf/radius/freeradiusweb-config.php |
|---|
| 0,0 → 1,115 |
| <?php |
| # |
| # Things should work even if register_globals is set to off |
| # |
| $testVer=intval(str_replace(".", "",'4.1.0')); |
| $curVer=intval(str_replace(".", "",phpversion())); |
| if( $curVer >= $testVer ) |
| import_request_variables('GPC'); |
| # If using sessions set use_session to 1 to also cache the config file |
| # |
| $use_session = 0; |
| unset($config); |
| unset($nas_list); |
| if ($use_session){ |
| // Start session |
| @session_start(); |
| if (isset($_SESSION['config'])) |
| $config = $_SESSION['config']; |
| if (isset($_SESSION['nas_list'])) |
| $nas_list = $_SESSION['nas_list']; |
| } |
| if (!isset($config)){ |
| $ARR=file("/etc/freeradius-web/admin.conf"); |
| $EXTRA_ARR = array(); |
| foreach($ARR as $val) { |
| $val=chop($val); |
| if (ereg('^[[:space:]]*#',$val) || ereg('^[[:space:]]*$',$val)) |
| continue; |
| list($key,$v)=split(":[[:space:]]*",$val,2); |
| if (preg_match("/%\{(.+)\}/",$v,$matches)){ |
| $val=$config[$matches[1]]; |
| $v=preg_replace("/%\{$matches[1]\}/",$val,$v); |
| } |
| if (preg_match("/^nas(\d+)_(\w+)$/",$key,$matches)) |
| $nas_list[$matches[1]][$matches[2]] = $v; |
| if ($key == 'INCLUDE'){ |
| if (is_readable($v)) |
| array_push($EXTRA_ARR,file($v)); |
| else |
| echo "<b>Error: File '$v' does not exist or is not readable</b><br>\n"; |
| } |
| else |
| $config["$key"]="$v"; |
| } |
| foreach($EXTRA_ARR as $val1) { |
| foreach($val1 as $val){ |
| $val=chop($val); |
| if (ereg('^[[:space:]]*#',$val) || ereg('^[[:space:]]*$',$val)) |
| continue; |
| list($key,$v)=split(":[[:space:]]*",$val,2); |
| if (preg_match("/%\{(.+)\}/",$v,$matches)){ |
| $val=$config[$matches[1]]; |
| $v=preg_replace("/%\{$matches[1]\}/",$val,$v); |
| } |
| if (preg_match("/^nas(\d+)_(\w+)$/",$key,$matches)) |
| $nas_list[$matches[1]][$matches[2]] = $v; |
| $config["$key"]="$v"; |
| } |
| } |
| if ($use_session){ |
| session_register('config'); |
| session_register('nas_list'); |
| } |
| } |
| if ($use_session == 0 && $config['general_use_session'] == 'yes'){ |
| // Start session |
| @session_start(); |
| if (isset($nas_list)) |
| session_register('nas_list'); |
| } |
| //Make sure we are only passed allowed strings in username |
| if (isset($login)){ |
| if ($login != '') |
| $login = preg_replace("/[^\w\.\/\@\:\-]/",'',$login); |
| if ($login != '' && $config['general_strip_realms'] == 'yes'){ |
| $realm_del = ($config['general_realm_delimiter'] != '') ? $config['general_realm_delimiter'] : '@'; |
| $realm_for = ($config['general_realm_format'] != '') ? $config['general_realm_format'] : 'suffix'; |
| $new = explode($realm_del,$login,2); |
| if (count($new) == 2) |
| $login = ($realm_for == 'suffix') ? $new[0] : $new[1]; |
| } |
| } |
| unset($mappings); |
| if (isset($_SESSION['mappings'])) |
| $mappings = $_SESSION['mappings']; |
| if (!isset($mappings) && $config['general_username_mappings_file'] != ''){ |
| $ARR = file($config['general_username_mappings_file']); |
| foreach($ARR as $val){ |
| $val=chop($val); |
| if (ereg('^[[:space:]]*#',$val) || ereg('^[[:space:]]*$',$val)) |
| continue; |
| list($key,$realm,$v)=split(":[[:space:]]*",$val,3); |
| if ($realm == 'accounting' || $realm == 'userdb' || $realm == 'nasdb' || $realm == 'nasadmin') |
| $mappings["$key"][$realm] = $v; |
| if ($realm == 'nasdb'){ |
| $NAS_ARR = array(); |
| $NAS_ARR = split(',',$v); |
| foreach ($nas_list as $key => $nas){ |
| foreach ($NAS_ARR as $nas_check){ |
| if ($nas_check == $nas['name']) |
| unset($nas_list[$key]); |
| } |
| } |
| } |
| } |
| if ($config['general_use_session'] == 'yes') |
| session_register('mappings'); |
| } |
| //Include missing.php if needed |
| if (!function_exists('array_change_key_case')) |
| include_once('../lib/missing.php'); |
| @header('Content-type: text/html; charset='.$config['general_charset'].';'); |
| ?> |
| /conf/radius/dialup.conf |
|---|
| 0,0 → 1,303 |
| # -*- text -*- |
| ## |
| ## dialup.conf -- MySQL configuration for default schema (schema.sql) |
| ## |
| ## $Id: dialup.conf 983 2012-08-16 13:34:14Z franck $ |
| # Safe characters list for sql queries. Everything else is replaced |
| # with their mime-encoded equivalents. |
| # The default list should be ok |
| #safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" |
| ####################################################################### |
| # Query config: Username |
| ####################################################################### |
| # This is the username that will get substituted, escaped, and added |
| # as attribute 'SQL-User-Name'. '%{SQL-User-Name}' should be used below |
| # everywhere a username substitution is needed so you you can be sure |
| # the username passed from the client is escaped properly. |
| # |
| # Uncomment the next line, if you want the sql_user_name to mean: |
| # |
| # Use Stripped-User-Name, if it's there. |
| # Else use User-Name, if it's there, |
| # Else use hard-coded string "DEFAULT" as the user name. |
| #sql_user_name = "%{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}" |
| # |
| sql_user_name = "%{User-Name}" |
| ####################################################################### |
| # Default profile |
| ####################################################################### |
| # This is the default profile. It is found in SQL by group membership. |
| # That means that this profile must be a member of at least one group |
| # which will contain the corresponding check and reply items. |
| # This profile will be queried in the authorize section for every user. |
| # The point is to assign all users a default profile without having to |
| # manually add each one to a group that will contain the profile. |
| # The SQL module will also honor the User-Profile attribute. This |
| # attribute can be set anywhere in the authorize section (ie the users |
| # file). It is found exactly as the default profile is found. |
| # If it is set then it will *overwrite* the default profile setting. |
| # The idea is to select profiles based on checks on the incoming packets, |
| # not on user group membership. For example: |
| # -- users file -- |
| # DEFAULT Service-Type == Outbound-User, User-Profile := "outbound" |
| # DEFAULT Service-Type == Framed-User, User-Profile := "framed" |
| # |
| # By default the default_user_profile is not set |
| # |
| default_user_profile = "ldap" |
| ####################################################################### |
| # NAS Query |
| ####################################################################### |
| # This query retrieves the radius clients |
| # |
| # 0. Row ID (currently unused) |
| # 1. Name (or IP address) |
| # 2. Shortname |
| # 3. Type |
| # 4. Secret |
| ####################################################################### |
| nas_query = "SELECT id, nasname, shortname, type, secret FROM ${nas_table}" |
| ####################################################################### |
| # Authorization Queries |
| ####################################################################### |
| # These queries compare the check items for the user |
| # in ${authcheck_table} and setup the reply items in |
| # ${authreply_table}. You can use any query/tables |
| # you want, but the return data for each row MUST |
| # be in the following order: |
| # |
| # 0. Row ID (currently unused) |
| # 1. UserName/GroupName |
| # 2. Item Attr Name |
| # 3. Item Attr Value |
| # 4. Item Attr Operation |
| ####################################################################### |
| # Use these for case sensitive usernames. |
| authorize_check_query = "SELECT id, username, attribute, value, op \ |
| FROM ${authcheck_table} \ |
| WHERE username = BINARY '%{SQL-User-Name}' \ |
| ORDER BY id" |
| authorize_reply_query = "SELECT id, username, attribute, value, op \ |
| FROM ${authreply_table} \ |
| WHERE username = BINARY '%{SQL-User-Name}' \ |
| ORDER BY id" |
| # The default queries are case insensitive. (for compatibility with |
| # older versions of FreeRADIUS) |
| # authorize_check_query = "SELECT id, username, attribute, value, op \ |
| # FROM ${authcheck_table} \ |
| # WHERE username = '%{SQL-User-Name}' \ |
| # ORDER BY id" |
| # authorize_reply_query = "SELECT id, username, attribute, value, op \ |
| # FROM ${authreply_table} \ |
| # WHERE username = '%{SQL-User-Name}' \ |
| # ORDER BY id" |
| # Use these for case sensitive usernames. |
| group_membership_query = "SELECT groupname \ |
| FROM ${usergroup_table} \ |
| WHERE username = BINARY '%{SQL-User-Name}' \ |
| ORDER BY priority" |
| # group_membership_query = "SELECT groupname \ |
| # FROM ${usergroup_table} \ |
| # WHERE username = '%{SQL-User-Name}' \ |
| # ORDER BY priority" |
| authorize_group_check_query = "SELECT id, groupname, attribute, \ |
| Value, op \ |
| FROM ${groupcheck_table} \ |
| WHERE groupname = '%{Sql-Group}' \ |
| ORDER BY id" |
| authorize_group_reply_query = "SELECT id, groupname, attribute, \ |
| value, op \ |
| FROM ${groupreply_table} \ |
| WHERE groupname = '%{Sql-Group}' \ |
| ORDER BY id" |
| ####################################################################### |
| # Accounting Queries |
| ####################################################################### |
| # accounting_onoff_query - query for Accounting On/Off packets |
| # accounting_update_query - query for Accounting update packets |
| # accounting_update_query_alt - query for Accounting update packets |
| # (alternate in case first query fails) |
| # accounting_start_query - query for Accounting start packets |
| # accounting_start_query_alt - query for Accounting start packets |
| # (alternate in case first query fails) |
| # accounting_stop_query - query for Accounting stop packets |
| # accounting_stop_query_alt - query for Accounting start packets |
| # (alternate in case first query doesn't |
| # affect any existing rows in the table) |
| ####################################################################### |
| accounting_onoff_query = "\ |
| UPDATE ${acct_table1} \ |
| SET \ |
| acctstoptime = '%S', \ |
| acctsessiontime = unix_timestamp('%S') - \ |
| unix_timestamp(acctstarttime), \ |
| acctterminatecause = '%{Acct-Terminate-Cause}', \ |
| acctstopdelay = %{%{Acct-Delay-Time}:-0} \ |
| WHERE acctstoptime IS NULL \ |
| AND nasipaddress = '%{NAS-IP-Address}' \ |
| AND acctstarttime <= '%S'" |
| accounting_update_query = " \ |
| UPDATE ${acct_table1} \ |
| SET \ |
| framedipaddress = '%{Framed-IP-Address}', \ |
| acctsessiontime = '%{Acct-Session-Time}', \ |
| acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | \ |
| '%{%{Acct-Input-Octets}:-0}', \ |
| acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | \ |
| '%{%{Acct-Output-Octets}:-0}' \ |
| WHERE acctsessionid = '%{Acct-Session-Id}' \ |
| AND username = '%{SQL-User-Name}' \ |
| AND nasipaddress = '%{NAS-IP-Address}'" |
| accounting_update_query_alt = " \ |
| INSERT INTO ${acct_table1} \ |
| (acctsessionid, acctuniqueid, username, \ |
| realm, nasipaddress, nasportid, \ |
| nasporttype, acctstarttime, acctsessiontime, \ |
| acctauthentic, connectinfo_start, acctinputoctets, \ |
| acctoutputoctets, calledstationid, callingstationid, \ |
| servicetype, framedprotocol, framedipaddress, \ |
| acctstartdelay, xascendsessionsvrkey) \ |
| VALUES \ |
| ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ |
| '%{SQL-User-Name}', \ |
| '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', \ |
| '%{NAS-Port-Type}', \ |
| DATE_SUB('%S', \ |
| INTERVAL (%{%{Acct-Session-Time}:-0} + \ |
| %{%{Acct-Delay-Time}:-0}) SECOND), \ |
| '%{Acct-Session-Time}', \ |
| '%{Acct-Authentic}', '', \ |
| '%{%{Acct-Input-Gigawords}:-0}' << 32 | \ |
| '%{%{Acct-Input-Octets}:-0}', \ |
| '%{%{Acct-Output-Gigawords}:-0}' << 32 | \ |
| '%{%{Acct-Output-Octets}:-0}', \ |
| '%{Called-Station-Id}', '%{Calling-Station-Id}', \ |
| '%{Service-Type}', '%{Framed-Protocol}', \ |
| '%{Framed-IP-Address}', \ |
| '0', '%{X-Ascend-Session-Svr-Key}')" |
| accounting_start_query = " \ |
| INSERT INTO ${acct_table1} \ |
| (acctsessionid, acctuniqueid, username, \ |
| realm, nasipaddress, nasportid, \ |
| nasporttype, acctstarttime, acctstoptime, \ |
| acctsessiontime, acctauthentic, connectinfo_start, \ |
| connectinfo_stop, acctinputoctets, acctoutputoctets, \ |
| calledstationid, callingstationid, acctterminatecause, \ |
| servicetype, framedprotocol, framedipaddress, \ |
| acctstartdelay, acctstopdelay, xascendsessionsvrkey) \ |
| VALUES \ |
| ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ |
| '%{SQL-User-Name}', \ |
| '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', \ |
| '%{NAS-Port-Type}', '%S', NULL, \ |
| '0', '%{Acct-Authentic}', '%{Connect-Info}', \ |
| '', '0', '0', \ |
| '%{Called-Station-Id}', '%{Calling-Station-Id}', '', \ |
| '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', \ |
| '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" |
| accounting_start_query_alt = " \ |
| UPDATE ${acct_table1} SET \ |
| acctstarttime = '%S', \ |
| acctstartdelay = '%{%{Acct-Delay-Time}:-0}', \ |
| connectinfo_start = '%{Connect-Info}' \ |
| WHERE acctsessionid = '%{Acct-Session-Id}' \ |
| AND username = '%{SQL-User-Name}' \ |
| AND nasipaddress = '%{NAS-IP-Address}'" |
| accounting_stop_query = " \ |
| UPDATE ${acct_table2} SET \ |
| acctstoptime = '%S', \ |
| acctsessiontime = '%{Acct-Session-Time}', \ |
| acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | \ |
| '%{%{Acct-Input-Octets}:-0}', \ |
| acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | \ |
| '%{%{Acct-Output-Octets}:-0}', \ |
| acctterminatecause = '%{Acct-Terminate-Cause}', \ |
| acctstopdelay = '%{%{Acct-Delay-Time}:-0}', \ |
| connectinfo_stop = '%{Connect-Info}' \ |
| WHERE acctsessionid = '%{Acct-Session-Id}' \ |
| AND username = '%{SQL-User-Name}' \ |
| AND nasipaddress = '%{NAS-IP-Address}'" |
| accounting_stop_query_alt = " \ |
| INSERT INTO ${acct_table2} \ |
| (acctsessionid, acctuniqueid, username, \ |
| realm, nasipaddress, nasportid, \ |
| nasporttype, acctstarttime, acctstoptime, \ |
| acctsessiontime, acctauthentic, connectinfo_start, \ |
| connectinfo_stop, acctinputoctets, acctoutputoctets, \ |
| calledstationid, callingstationid, acctterminatecause, \ |
| servicetype, framedprotocol, framedipaddress, \ |
| acctstartdelay, acctstopdelay) \ |
| VALUES \ |
| ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ |
| '%{SQL-User-Name}', \ |
| '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', \ |
| '%{NAS-Port-Type}', \ |
| DATE_SUB('%S', \ |
| INTERVAL (%{%{Acct-Session-Time}:-0} + \ |
| %{%{Acct-Delay-Time}:-0}) SECOND), \ |
| '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', \ |
| '%{Connect-Info}', \ |
| '%{%{Acct-Input-Gigawords}:-0}' << 32 | \ |
| '%{%{Acct-Input-Octets}:-0}', \ |
| '%{%{Acct-Output-Gigawords}:-0}' << 32 | \ |
| '%{%{Acct-Output-Octets}:-0}', \ |
| '%{Called-Station-Id}', '%{Calling-Station-Id}', \ |
| '%{Acct-Terminate-Cause}', \ |
| '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', \ |
| '0', '%{%{Acct-Delay-Time}:-0}')" |
| ####################################################################### |
| # Simultaneous Use Checking Queries |
| ####################################################################### |
| # simul_count_query - query for the number of current connections |
| # - If this is not defined, no simultaneouls use checking |
| # - will be performed by this module instance |
| # simul_verify_query - query to return details of current connections for verification |
| # - Leave blank or commented out to disable verification step |
| # - Note that the returned field order should not be changed. |
| ####################################################################### |
| # Uncomment simul_count_query to enable simultaneous use checking |
| simul_count_query = "SELECT COUNT(*) \ |
| FROM ${acct_table1} \ |
| WHERE username = '%{SQL-User-Name}' \ |
| AND acctstoptime IS NULL" |
| #simul_verify_query = "SELECT radacctid, acctsessionid, username, \ |
| #nasipaddress, nasportid, framedipaddress, \ |
| #callingstationid, framedprotocol \ |
| #FROM ${acct_table1} \ |
| #WHERE username = '%{SQL-User-Name}' \ |
| #AND acctstoptime IS NULL" |
| ####################################################################### |
| # Authentication Logging Queries |
| ####################################################################### |
| # postauth_query - Insert some info after authentication |
| ####################################################################### |
| # (username, pass, reply, authdate) \ |
| # '%{%{User-Password}:-%{Chap-Password}}', \ |
| postauth_query = "INSERT INTO ${postauth_table} \ |
| (username, reply, authdate) \ |
| VALUES ( \ |
| '%{User-Name}', \ |
| '%{reply:Packet-Type}', '%S')" |
| /conf/radius/counter.conf |
|---|
| 0,0 → 1,124 |
| # -*- text -*- |
| ## |
| ## counter.conf -- PostgreSQL queries for rlm_sqlcounter |
| ## |
| ## $Id$ |
| # Rather than maintaining seperate (GDBM) databases of |
| # accounting info for each counter, this module uses the data |
| # stored in the raddacct table by the sql modules. This |
| # module NEVER does any database INSERTs or UPDATEs. It is |
| # totally dependent on the SQL module to process Accounting |
| # packets. |
| # |
| # The 'sqlmod_inst' parameter holds the instance of the sql |
| # module to use when querying the SQL database. Normally it |
| # is just "sql". If you define more and one SQL module |
| # instance (usually for failover situations), you can |
| # specify which module has access to the Accounting Data |
| # (radacct table). |
| # |
| # The 'reset' parameter defines when the counters are all |
| # reset to zero. It can be hourly, daily, weekly, monthly or |
| # never. It can also be user defined. It should be of the |
| # form: |
| # num[hdwm] where: |
| # h: hours, d: days, w: weeks, m: months |
| # If the letter is ommited days will be assumed. In example: |
| # reset = 10h (reset every 10 hours) |
| # reset = 12 (reset every 12 days) |
| # |
| # The 'key' parameter specifies the unique identifier for the |
| # counter records (usually 'User-Name'). |
| # |
| # The 'query' parameter specifies the SQL query used to get |
| # the current Counter value from the database. There are 3 |
| # parameters that can be used in the query: |
| # %k 'key' parameter |
| # %b unix time value of beginning of reset period |
| # %e unix time value of end of reset period |
| # |
| # The 'check-name' parameter is the name of the 'check' |
| # attribute to use to access the counter in the 'users' file |
| # or SQL radcheck or radcheckgroup tables. |
| # |
| # DEFAULT Max-Daily-Session > 3600, Auth-Type = Reject |
| # Reply-Message = "You've used up more than one hour today" |
| # |
| sqlcounter dailycounter { |
| counter-name = Daily-Session-Time |
| check-name = Max-Daily-Session |
| reply-name = Session-Timeout |
| sqlmod-inst = sql |
| key = User-Name |
| reset = daily |
| # This query properly handles calls that span from the |
| # previous reset period into the current period but |
| # involves more work for the SQL server than those |
| # below |
| query = "SELECT SUM(acctsessiontime - \ |
| GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)) \ |
| FROM radacct WHERE username = '%{%k}' AND \ |
| UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" |
| # This query ignores calls that started in a previous |
| # reset period and continue into into this one. But it |
| # is a little easier on the SQL server |
| # query = "SELECT SUM(acctsessiontime) FROM radacct WHERE \ |
| # username = '%{%k}' AND acctstarttime > FROM_UNIXTIME('%b')" |
| # This query is the same as above, but demonstrates an |
| # additional counter parameter '%e' which is the |
| # timestamp for the end of the period |
| # query = "SELECT SUM(acctsessiontime) FROM radacct \ |
| # WHERE username = '%{%k}' AND acctstarttime BETWEEN \ |
| # FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')" |
| } |
| sqlcounter monthlycounter { |
| counter-name = Monthly-Session-Time |
| check-name = Max-Monthly-Session |
| reply-name = Session-Timeout |
| sqlmod-inst = sql |
| key = User-Name |
| reset = monthly |
| # This query properly handles calls that span from the |
| # previous reset period into the current period but |
| # involves more work for the SQL server than those |
| # below |
| query = "SELECT SUM(acctsessiontime - \ |
| GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)) \ |
| FROM radacct WHERE username='%{%k}' AND \ |
| UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" |
| # This query ignores calls that started in a previous |
| # reset period and continue into into this one. But it |
| # is a little easier on the SQL server |
| # query = "SELECT SUM(acctsessiontime) FROM radacct WHERE \ |
| # username='%{%k}' AND acctstarttime > FROM_UNIXTIME('%b')" |
| # This query is the same as above, but demonstrates an |
| # additional counter parameter '%e' which is the |
| # timestamp for the end of the period |
| # query = "SELECT SUM(acctsessiontime) FROM radacct \ |
| # WHERE username='%{%k}' AND acctstarttime BETWEEN \ |
| # FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')" |
| } |
| sqlcounter noresetcounter { |
| counter-name = Max-All-Session-Time |
| check-name = Max-All-Session |
| sqlmod-inst = sql |
| key = User-Name |
| reset = never |
| # This is the original query |
| # query = "SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='%{%k}'" |
| # This is the query modified for ALCASAR needs (thanks to Daniel Laliberte --> authorized period after the first connection) |
| query = "SELECT IFNULL((SELECT TIME_TO_SEC(TIMEDIFF(NOW(), acctstarttime)) \ |
| FROM radacct \ |
| WHERE UserName='%{%k}' \ |
| ORDER BY acctstarttime \ |
| LIMIT 1),0)" |
| } |
| /conf/radius/sql.attrmap |
|---|
| 0,0 → 1,59 |
| # |
| # A mapping between the attributes used by dialup_admin and the attribute |
| # names that will be stored in the SQL database |
| # |
| # Attributes that are not contained in this file are assumed to be reply |
| # items and map to the same name as the one used by dialup_admin |
| # |
| # Format: |
| # checkItem|replyItem Attribute-In-Dialup-Admin Attribute-In-SQL |
| # |
| # |
| checkItem Auth-Type Auth-Type |
| checkItem Simultaneous-Use Simultaneous-Use |
| checkItem Called-Station-Id Called-Station-Id |
| checkItem Calling-Station-Id Calling-Station-Id |
| checkItem Dialup-Access none |
| checkItem Max-All-Session Max-All-Session |
| checkItem Max-Daily-Session Max-Daily-Session |
| checkItem Max-Weekly-Session Max-Weekly-Session |
| checkItem Max-Monthly-Session Max-Monthly-Session |
| checkItem Login-Time Login-Time |
| checkItem Expiration Expiration |
| replyItem Service-Type Service-Type |
| replyItem Framed-Protocol Framed-Protocol |
| replyItem Framed-IP-Address Framed-IP-Address |
| replyItem Framed-IP-Netmask Framed-IP-Netmask |
| replyItem Framed-Route Framed-Route |
| replyItem Framed-Routing Framed-Routing |
| replyItem Filter-Id Filter-Id |
| replyItem Framed-MTU Framed-MTU |
| replyItem Framed-Compression Framed-Compression |
| replyItem Login-IP-Host Login-IP-Host |
| replyItem Login-Service Login-Service |
| replyItem Login-TCP-Port Login-TCP-Port |
| replyItem Callback-Number Callback-Number |
| replyItem Callback-Id Callback-Id |
| replyItem Framed-IPX-Network Framed-IPX-Network |
| replyItem Class Class |
| replyItem Session-Timeout Session-Timeout |
| replyItem Idle-Timeout Idle-Timeout |
| replyItem Termination-Action Termination-Action |
| replyItem Login-LAT-Service Login-LAT-Service |
| replyItem Login-LAT-Node Login-LAT-Node |
| replyItem Login-LAT-Group Login-LAT-Group |
| replyItem Framed-AppleTalk-Link Framed-AppleTalk-Link |
| replyItem Framed-AppleTalk-Network Framed-AppleTalk-Network |
| replyItem Framed-AppleTalk-Zone Framed-AppleTalk-Zone |
| replyItem Port-Limit Port-Limit |
| replyItem Login-LAT-Port Login-LAT-Port |
| replyitem Reply-Message Reply-Message |
| replyItem Dialup-Lock-Msg Reply-Message |
| replyItem User-Password User-Password |
| replyItem ChilliSpot-Max-Input-Octets ChilliSpot-Max-Input-Octets |
| replyItem ChilliSpot-max-Output-Octets ChilliSpot-Max-Output-Octets |
| replyItem ChilliSpot-Max-Total-Octets ChilliSpot-Max-Total-Octets |
| replyItem ChilliSpot-Bandwidth-Max-Up ChilliSpot-Bandwidth-Max-Up |
| replyItem ChilliSpot-Bandwidth-Max-Down ChilliSpot-Bandwidth-Max-Down |
| replyItem WISPr-Redirection-URL WISPr-Redirection-URL |
| /conf/radius/alcasar-radius |
|---|
| 0,0 → 1,510 |
| ###################################################################### |
| # |
| # As of 2.0.0, FreeRADIUS supports virtual hosts using the |
| # "server" section, and configuration directives. |
| # |
| # Virtual hosts should be put into the "sites-available" |
| # directory. Soft links should be created in the "sites-enabled" |
| # directory to these files. This is done in a normal installation. |
| # |
| # $Id: alcasar-radius 845 2012-03-29 21:17:03Z richard $ |
| # |
| ###################################################################### |
| # |
| # Read "man radiusd" before editing this file. See the section |
| # titled DEBUGGING. It outlines a method where you can quickly |
| # obtain the configuration you want, without running into |
| # trouble. See also "man unlang", which documents the format |
| # of this file. |
| # |
| # This configuration is designed to work in the widest possible |
| # set of circumstances, with the widest possible number of |
| # authentication methods. This means that in general, you should |
| # need to make very few changes to this file. |
| # |
| # The best way to configure the server for your local system |
| # is to CAREFULLY edit this file. Most attempts to make large |
| # edits to this file will BREAK THE SERVER. Any edits should |
| # be small, and tested by running the server with "radiusd -X". |
| # Once the edits have been verified to work, save a copy of these |
| # configuration files somewhere. (e.g. as a "tar" file). Then, |
| # make more edits, and test, as above. |
| # |
| # There are many "commented out" references to modules such |
| # as ldap, sql, etc. These references serve as place-holders. |
| # If you need the functionality of that module, then configure |
| # it in radiusd.conf, and un-comment the references to it in |
| # this file. In most cases, those small changes will result |
| # in the server being able to connect to the DB, and to |
| # authenticate users. |
| # |
| ###################################################################### |
| # |
| # In 1.x, the "authorize", etc. sections were global in |
| # radiusd.conf. As of 2.0, they SHOULD be in a server section. |
| # |
| # The server section with no virtual server name is the "default" |
| # section. It is used when no server name is specified. |
| # |
| # We don't indent the rest of this file, because doing so |
| # would make it harder to read. |
| # |
| # Authorization. First preprocess (hints and huntgroups files), |
| # then realms, and finally look in the "users" file. |
| # |
| # The order of the realm modules will determine the order that |
| # we try to find a matching realm. |
| # |
| # Make *sure* that 'preprocess' comes before any realm if you |
| # need to setup hints for the remote radius server |
| authorize { |
| # |
| # The preprocess module takes care of sanitizing some bizarre |
| # attributes in the request, and turning them into attributes |
| # which are more standard. |
| # |
| # It takes care of processing the 'raddb/hints' and the |
| # 'raddb/huntgroups' files. |
| # |
| # It also adds the %{Client-IP-Address} attribute to the request. |
| preprocess |
| # |
| # If you want to have a log of authentication requests, |
| # un-comment the following line, and the 'detail auth_log' |
| # section, above. |
| # auth_log |
| # |
| # The chap module will set 'Auth-Type := CHAP' if we are |
| # handling a CHAP request and Auth-Type has not already been set |
| # chap |
| # |
| # If the users are logging in with an MS-CHAP-Challenge |
| # attribute for authentication, the mschap module will find |
| # the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP' |
| # to the request, which will cause the server to then use |
| # the mschap module for authentication. |
| # mschap |
| # |
| # If you have a Cisco SIP server authenticating against |
| # FreeRADIUS, uncomment the following line, and the 'digest' |
| # line in the 'authenticate' section. |
| # digest |
| # |
| # Look for IPASS style 'realm/', and if not found, look for |
| # '@realm', and decide whether or not to proxy, based on |
| # that. |
| # IPASS |
| # |
| # If you are using multiple kinds of realms, you probably |
| # want to set "ignore_null = yes" for all of them. |
| # Otherwise, when the first style of realm doesn't match, |
| # the other styles won't be checked. |
| # |
| # suffix |
| # ntdomain |
| # |
| # This module takes care of EAP-MD5, EAP-TLS, and EAP-LEAP |
| # authentication. |
| # |
| # It also sets the EAP-Type attribute in the request |
| # attribute list to the EAP type from the packet. |
| # |
| # As of 2.0, the EAP module returns "ok" in the authorize stage |
| # for TTLS and PEAP. In 1.x, it never returned "ok" here, so |
| # this change is compatible with older configurations. |
| # |
| # The example below uses module failover to avoid querying all |
| # of the following modules if the EAP module returns "ok". |
| # Therefore, your LDAP and/or SQL servers will not be queried |
| # for the many packets that go back and forth to set up TTLS |
| # or PEAP. The load on those servers will therefore be reduced. |
| # |
| # eap { |
| # ok = return |
| # } |
| # |
| # Pull crypt'd passwords from /etc/passwd or /etc/shadow, |
| # using the system API's to get the password. If you want |
| # to read /etc/passwd or /etc/shadow directly, see the |
| # passwd module in radiusd.conf. |
| # |
| # unix |
| # |
| # Read the 'users' file |
| # files |
| # |
| # Look in an SQL database. The schema of the database |
| # is meant to mirror the "users" file. |
| # |
| # See "Authorization Queries" in sql.conf |
| sql |
| noresetcounter |
| dailycounter |
| monthlycounter |
| # |
| # If you are using /etc/smbpasswd, and are also doing |
| # mschap authentication, the un-comment this line, and |
| # configure the 'etc_smbpasswd' module, above. |
| # etc_smbpasswd |
| # |
| # The ldap module will set Auth-Type to LDAP if it has not |
| # already been set |
| # ldap { |
| # fail = 1 |
| # } |
| # |
| # Enforce daily limits on time spent logged in. |
| # daily |
| # |
| # Use the checkval module |
| # checkval |
| expiration |
| logintime |
| # |
| # If no other module has claimed responsibility for |
| # authentication, then try to use PAP. This allows the |
| # other modules listed above to add a "known good" password |
| # to the request, and to do nothing else. The PAP module |
| # will then see that password, and use it to do PAP |
| # authentication. |
| # |
| # This module should be listed last, so that the other modules |
| # get a chance to set Auth-Type for themselves. |
| # |
| # pap |
| # |
| # If "status_server = yes", then Status-Server messages are passed |
| # through the following section, and ONLY the following section. |
| # This permits you to do DB queries, for example. If the modules |
| # listed here return "fail", then NO response is sent. |
| # |
| # Autz-Type Status-Server { |
| # |
| # } |
| update coa { |
| User-Name = "%{User-Name}" |
| Acct-Session-Id = "%{Acct-Session-Id}" |
| NAS-IP-Address = "%{NAS-IP-Address}" |
| } |
| } |
| # Authentication. |
| # |
| # |
| # This section lists which modules are available for authentication. |
| # Note that it does NOT mean 'try each module in order'. It means |
| # that a module from the 'authorize' section adds a configuration |
| # attribute 'Auth-Type := FOO'. That authentication type is then |
| # used to pick the apropriate module from the list below. |
| # |
| # In general, you SHOULD NOT set the Auth-Type attribute. The server |
| # will figure it out on its own, and will do the right thing. The |
| # most common side effect of erroneously setting the Auth-Type |
| # attribute is that one authentication method will work, but the |
| # others will not. |
| # |
| # The common reasons to set the Auth-Type attribute by hand |
| # is to either forcibly reject the user (Auth-Type := Reject), |
| # or to or forcibly accept the user (Auth-Type := Accept). |
| # |
| # Note that Auth-Type := Accept will NOT work with EAP. |
| # |
| # Please do not put "unlang" configurations into the "authenticate" |
| # section. Put them in the "post-auth" section instead. That's what |
| # the post-auth section is for. |
| # |
| authenticate { |
| # # |
| # # PAP authentication, when a back-end database listed |
| # # in the 'authorize' section supplies a password. The |
| # # password can be clear-text, or encrypted. |
| # Auth-Type PAP { |
| # pap |
| # } |
| # |
| # # |
| # # Most people want CHAP authentication |
| # # A back-end database listed in the 'authorize' section |
| # # MUST supply a CLEAR TEXT password. Encrypted passwords |
| # # won't work. |
| # Auth-Type CHAP { |
| # chap |
| # } |
| # |
| # # |
| # # MSCHAP authentication. |
| # Auth-Type MS-CHAP { |
| # mschap |
| # } |
| # |
| # # |
| # # If you have a Cisco SIP server authenticating against |
| # # FreeRADIUS, uncomment the following line, and the 'digest' |
| # # line in the 'authorize' section. |
| # digest |
| # |
| # # |
| # # Pluggable Authentication Modules. |
| # pam |
| # |
| # # |
| # # See 'man getpwent' for information on how the 'unix' |
| # # module checks the users password. Note that packets |
| # # containing CHAP-Password attributes CANNOT be authenticated |
| # # against /etc/passwd! See the FAQ for details. |
| # # |
| # unix |
| # |
| # # Uncomment it if you want to use ldap for authentication |
| # # |
| # # Note that this means "check plain-text password against |
| # # the ldap database", which means that EAP won't work, |
| # # as it does not supply a plain-text password. |
| # Auth-Type LDAP { |
| # ldap |
| # } |
| # |
| # # |
| # # Allow EAP authentication. |
| # eap |
| } |
| # |
| # Pre-accounting. Decide which accounting type to use. |
| # |
| preacct { |
| preprocess |
| # |
| # Ensure that we have a semi-unique identifier for every |
| # request, and many NAS boxes are broken. |
| # acct_unique |
| # |
| # Look for IPASS-style 'realm/', and if not found, look for |
| # '@realm', and decide whether or not to proxy, based on |
| # that. |
| # |
| # Accounting requests are generally proxied to the same |
| # home server as authentication requests. |
| # IPASS |
| # suffix |
| # ntdomain |
| # |
| # Read the 'acct_users' file |
| # files |
| } |
| # |
| # Accounting. Log the accounting data. |
| # |
| accounting { |
| # |
| # Create a 'detail'ed log of the packets. |
| # Note that accounting requests which are proxied |
| # are also logged in the detail file. |
| # detail |
| # daily |
| # Update the wtmp file |
| # |
| # If you don't use "radlast", you can delete this line. |
| # unix |
| # |
| # For Simultaneous-Use tracking. |
| # |
| # Due to packet losses in the network, the data here |
| # may be incorrect. There is little we can do about it. |
| # radutmp |
| sradutmp |
| # Return an address to the IP Pool when we see a stop record. |
| # main_pool |
| # |
| # Log traffic to an SQL database. |
| # |
| # See "Accounting queries" in sql.conf |
| sql |
| # |
| # Instead of sending the query to the SQL server, |
| # write it into a log file. |
| # |
| # sql_log |
| # Cisco VoIP specific bulk accounting |
| # pgsql-voip |
| # Filter attributes from the accounting response. |
| attr_filter.accounting_response |
| # |
| # See "Autz-Type Status-Server" for how this works. |
| # |
| # Acct-Type Status-Server { |
| # |
| # } |
| } |
| # Session database, used for checking Simultaneous-Use. Either the radutmp |
| # or rlm_sql module can handle this. |
| # The rlm_sql module is *much* faster |
| session { |
| # radutmp |
| # |
| # See "Simultaneous Use Checking Queries" in sql.conf |
| sql |
| } |
| # Post-Authentication |
| # Once we KNOW that the user has been authenticated, there are |
| # additional steps we can take. |
| post-auth { |
| # Get an address from the IP Pool. |
| # main_pool |
| # |
| # If you want to have a log of authentication replies, |
| # un-comment the following line, and the 'detail reply_log' |
| # section, above. |
| # reply_log |
| # |
| # After authenticating the user, do another SQL query. |
| # |
| # See "Authentication Logging Queries" in sql.conf |
| # sql |
| # |
| # Instead of sending the query to the SQL server, |
| # write it into a log file. |
| # |
| # sql_log |
| # |
| # Un-comment the following if you have set |
| # 'edir_account_policy_check = yes' in the ldap module sub-section of |
| # the 'modules' section. |
| # |
| # ldap |
| # exec |
| # |
| # Access-Reject packets are sent through the REJECT sub-section of the |
| # post-auth section. |
| # |
| # Add the ldap module name (or instance) if you have set |
| # 'edir_account_policy_check = yes' in the ldap module configuration |
| # |
| Post-Auth-Type REJECT { |
| attr_filter.access_reject |
| } |
| } |
| # |
| # When the server decides to proxy a request to a home server, |
| # the proxied request is first passed through the pre-proxy |
| # stage. This stage can re-write the request, or decide to |
| # cancel the proxy. |
| # |
| # Only a few modules currently have this method. |
| # |
| pre-proxy { |
| # attr_rewrite |
| # Uncomment the following line if you want to change attributes |
| # as defined in the preproxy_users file. |
| # files |
| # Uncomment the following line if you want to filter requests |
| # sent to remote servers based on the rules defined in the |
| # 'attrs.pre-proxy' file. |
| # attr_filter.pre-proxy |
| # If you want to have a log of packets proxied to a home |
| # server, un-comment the following line, and the |
| # 'detail pre_proxy_log' section, above. |
| # pre_proxy_log |
| } |
| # |
| # When the server receives a reply to a request it proxied |
| # to a home server, the request may be massaged here, in the |
| # post-proxy stage. |
| # |
| post-proxy { |
| # If you want to have a log of replies from a home server, |
| # un-comment the following line, and the 'detail post_proxy_log' |
| # section, above. |
| # post_proxy_log |
| # attr_rewrite |
| # Uncomment the following line if you want to filter replies from |
| # remote proxies based on the rules defined in the 'attrs' file. |
| # attr_filter.post-proxy |
| # |
| # If you are proxying LEAP, you MUST configure the EAP |
| # module, and you MUST list it here, in the post-proxy |
| # stage. |
| # |
| # You MUST also use the 'nostrip' option in the 'realm' |
| # configuration. Otherwise, the User-Name attribute |
| # in the proxied request will not match the user name |
| # hidden inside of the EAP packet, and the end server will |
| # reject the EAP request. |
| # |
| # eap |
| # |
| # If the server tries to proxy a request and fails, then the |
| # request is processed through the modules in this section. |
| # |
| # The main use of this section is to permit robust proxying |
| # of accounting packets. The server can be configured to |
| # proxy accounting packets as part of normal processing. |
| # Then, if the home server goes down, accounting packets can |
| # be logged to a local "detail" file, for processing with |
| # radrelay. When the home server comes back up, radrelay |
| # will read the detail file, and send the packets to the |
| # home server. |
| # |
| # With this configuration, the server always responds to |
| # Accounting-Requests from the NAS, but only writes |
| # accounting packets to disk if the home server is down. |
| # |
| # Post-Proxy-Type Fail { |
| # detail |
| # } |
| } |