//conf/radius/user_edit.attrs |
---|
0,0 → 1,60 |
# |
# Attributes which will be visible in the user/group edit pages |
# File from free-radiusweb project. |
# Addons for ALCASAR by Steweb and Rexy |
# |
# Format: Attribute Comment |
# |
Expiration <a href="help/expiration_help.html" target=lt_help onclick=window.open("help/expiration_help.html","lt_help","width=600,height=250,toolbar=no,scrollbars=no,resizable=yes") title="Expiration Help Page"><font color="blue">Date d'expiration</font></a> |
Max-All-Session <a href="help/max_all_session_help.html" target=st_help onclick=window.open("help/max_all_session_help.html","st_help","width=600,height=250,toolbar=no,scrollbars=no,resizable=yes") title="Max connection Time Help Page"><font color="blue">Durée totale de connexion autorisée</font></a><BR>(en secondes) |
Session-Timeout <a href="help/session_timeout_help.html" target=st_help onclick=window.open("help/session_timeout_help.html","st_help","width=600,height=250,toolbar=no,scrollbars=no,resizable=yes") title="Session Timeout Help Page"><font color="blue">Durée maximale d'une session</font></a><BR>(en secondes) |
Max-Daily-Session <a href="help/session_timeout_help.html" target=st_help onclick=window.open("help/session_timeout_help.html","st_help","width=600,height=250,toolbar=no,scrollbars=no,resizable=yes") title="Session Timeout Help Page"><font color="blue">Durée limite journalière</font></a><BR>(en secondes) |
#Max-Weekly-Session Weekly Limit (secs) |
Max-Monthly-Session <a href="help/session_timeout_help.html" target=st_help onclick=window.open("help/session_timeout_help.html","st_help","width=600,height=250,toolbar=no,scrollbars=no,resizable=yes") title="Session Timeout Help Page"><font color="blue">Durée limite mensuelle</font></a><BR>(en secondes) |
Simultaneous-Use <a href="help/simultaneous_use_help.html" target=su_help onclick=window.open("help/simultaneous_use_help.html","su_help","width=600,height=250,toolbar=no,scrollbars=no,resizable=yes") title="Simultaneous Use Help Page"><font color="blue">Nombre de sessions simultanées</font></a> |
Login-Time <a href="help/login_time_help.html" target=lt_help onclick=window.open("help/login_time_help.html","lt_help","width=600,height=370,toolbar=no,scrollbars=no,resizable=yes") title="Login-Time Help Page"><font color="blue">Période hebdomadaire</font></a> |
ChilliSpot-Max-Input-Octets <a href="help/chillispot_max_input_octets_help.html" target=st_help onclick=window.open("help/chillispot_max_input_octets_help.html","st_help","width=600,height=250,toolbar=no,scrollbars=no,resizable=yes") title="ChilliSpot Max Input Octets Help Page"><font color="blue">Nombre d'octets max. en émission</font></a><BR>(en octets) |
ChilliSpot-Max-Output-Octets <a href="help/chillispot_max_output_octets_help.html" target=st_help onclick=window.open("help/chillispot_max_output_octets_help.html","st_help","width=600,height=250,toolbar=no,scrollbars=no,resizable=yes") title="ChilliSpot Max Output Octets Help Page"><font color="blue">Nombre d'octets max. en réception</font></a><BR>(en octets) |
ChilliSpot-Max-Total-Octets <a href="help/chillispot_max_total_octets_help.html" target=st_help onclick=window.open("help/chillispot_max_total_octets_help.html","st_help","width=600,height=250,toolbar=no,scrollbars=no,resizable=yes") title="ChilliSpot Max Total Octets Help Page"><font color="blue">Nombre d'octets max. total transmit</font></a><BR>(en octets) |
ChilliSpot-Bandwidth-Max-Up <a href="help/chillispot_bandwidth_max_up_help.html" target=st_help onclick=window.open("help/chillispot_bandwidth_max_up_help.html","st_help","width=600,height=250,toolbar=no,scrollbars=no,resizable=yes") title="ChilliSpot Bandwidth Max Up Help Page"><font color="blue">Bande passante montante max.</font></a><BR>(en kbits/seconde) |
ChilliSpot-Bandwidth-Max-Down <a href="help/chillispot_bandwidth_max_down_help.html" target=st_help onclick=window.open("help/chillispot_bandwidth_max_down_help.html","st_help","width=600,height=250,toolbar=no,scrollbars=no,resizable=yes") title="ChilliSpot Bandwidth Max Down Help Page"><font color="blue">Bande passante descendante max.</font></a><BR>(en kbits/seconde) |
WISPr-Redirection-URL <a href="help/wispr_redirection_url_help.html" target=st_help onclick=window.open("help/wispr_redirection_url_help.html","st_help","width=600,height=250,toolbar=no,scrollbars=no,resizable=yes") title="ChilliSpot Bandwidth Max Down Help Page"><font color="blue">URL de redirection</font></a><BR> |
# |
# |
##Auth-Type <a href="help/auth_type_help.html" target=su_help onclick=window.open("help/auth_type_help.html","su_help","width=560,height=230,toolbar=no,scrollbars=no,resizable=yes") title="Auth-Type Help Page"><font color="blue">Auth-Type</font></a> |
#Framed-Protocol <a href="help/framed_protocol_help.html" target=fpr_help onclick=window.open("help/framed_protocol_help.htlml","fpr_help","width=560,height=230,toolbar=no,scrollbars=no,resizable=yes") title="Framed-Protocol Help PPage"><font color="blue">Protocol</font></a> |
#Framed-IP-Address <a href="help/framed_ip_address_help.html" target=fia_help onclick=window.open("help/framed_ip_address_help.html","fia_help","width=560,height=230,toolbar=no,scrollbars=no,resizable=yes") title="Framed-IP-Address Help Page"><font color="blue">IP Address</font></a> |
#Framed-IP-Netmask IP Netmask |
#Framed-Route Route |
#Framed-Routing |
#Filter-Id <a href="help/filter_id_help.html" target=fid_help onclick=window.open("help/filter_id_help.html","fid_help","width=560,height=230,toolbar=no,scrollbars=no,resizable=yes") title="Filter-ID Help Page"><font color="blue">Filter ID</font></a> |
#Framed-MTU <a href="help/framed_mtu_help.html" target=fid_help onclick=window.open("help/framed_mtu_help.html","fid_help","width=560,height=230,toolbar=no,scrollbars=no,resizable=yes") title="Framed-MTU Help Page"><font color="blue">Framed-MTU</font></a> |
#Framed-Compression <a href="help/framed_compression_help.html" target=fc_help onclick=window.open("help/framed_compression_help.html","fc_help","width=600,height=210,toolbar=no,scrollbars=no,resizable=yes") title="Framed Compression Help Page"><font color="blue">Compression Used</font></a> |
#Service-Type <a href="help/service_type_help.html" target=st_help onclick=window.open("help/service_type_help.html","st_help","width=560,height=230,toolbar=no,scrollbars=no,resizable=yes") title="Service-Type Help Page"><font color="blue">Service Type</font></a> |
#Login-IP-Host |
#Login-Service |
#Login-TCP-Port |
#Callback-Number <a href="help/callback_number_help.html" target=fid_help onclick=window.open("help/callback_number_help.html","fid_help","width=560,height=230,toolbar=no,scrollbars=no,resizable=yes") title="Callback-Number Help Page"><font color="blue">Callback-Number</font></a> |
#Callback-Id <a href="help/callback_id_help.html" target=fid_help onclick=window.open("help/callback_id_help.html","fid_help","width=560,height=230,toolbar=no,scrollbars=no,resizable=yes") title="Callback-ID Help Page"><font color="blue">Callback-ID</font></a> |
#Framed-IPX-Network |
#Class <a href="help/class_help.html" target=fid_help onclick=window.open("help/class_help.html","fid_help","width=560,height=230,toolbar=no,scrollbars=no,resizable=yes") title="Class Help Page"><font color="blue">Class</font></a> |
#Idle-Timeout <a href="help/idle_timeout_help.html" target=it_help onclick=window.open("help/idle_timeout_help.html","it_help","width=600,height=170,toolbar=no,scrollbars=no,resizable=yes") title="Idle Timeout Help Page"><font color="blue">Idle Timeout</font></a> |
#Termination-Action |
#Login-LAT-Service |
#Login-LAT-Node |
#Login-LAT-Group |
#Framed-AppleTalk-Link |
#Framed-AppleTalk-Network |
#Framed-AppleTalk-Zone |
#Port-Limit <a href="help/port_limit_help.html" target=pl_help onclick=window.open("help/port_limit_help.html","pl_help","width=600,height=170,toolbar=no,scrollbars=no,resizable=yes") title="Port Limit Help Page"><font color="blue">Port Limit</font></a> |
#Login-LAT-Port |
#Dialup-Access <a href="help/dialup_access_help.html" target=da_help onclick=window.open("help/dialup_access_help.html","da_help","width=560,height=200,toolbar=no,scrollbars=no,resizable=yes") title="Dialup Access Help Page"><font color="blue">Dialup Access (use FALSE to lock)</font></a> |
#Dialup-Lock-Msg <a href="help/lock_message_help.html" target=lm_help onclick=window.open("help/lock_message_help.html","lm_help","width=600,height=210,toolbar=no,scrollbars=no,resizable=yes") title="Lock Message Help Page"><font color="blue">Lock Message</font></a> |
#Reply-Message <a href="help/reply_message_help.html" target=lm_help onclick=window.open("help/reply_message_help.html","lm_help","width=600,height=210,toolbar=no,scrollbars=no,resizable=yes") title="Reply-Message Help Page"><font color="blue">Reply-Message</font></a> |
#Login-Time <a href="login_time_create.php?val=$name1&first=yes" target=lt_create onclick=window.open("login_time_create.php?val=$name1&first=yes","lt_create","width=600,height=490,toolbar=no,scrollbars=yes,resizable=yes") title="Login-Time Creation Page"><font color="blue">Période hebdomadaire</font></a><a href="help/login_time_help.html" target=lt_help onclick=window.open("help/login_time_help.html","lt_help","width=600,height=370,toolbar=no,scrollbars=no,resizable=yes") title="Login-Time Help Page"><font color="blue"><BR>(Format UUCP)</font></a> |
# |
# Uncomment this if you are using ldap and you are using user regular profiles. |
# Also make sure that Regular-Profile maps to the correct ldap attribute in |
# extra.ldap-attrmap |
# |
#Regular-Profile User Regular Profile DN |
//conf/radius/freeradiusweb-config.php |
---|
0,0 → 1,115 |
<?php |
# |
# Things should work even if register_globals is set to off |
# |
$testVer=intval(str_replace(".", "",'4.1.0')); |
$curVer=intval(str_replace(".", "",phpversion())); |
if( $curVer >= $testVer ) |
import_request_variables('GPC'); |
# If using sessions set use_session to 1 to also cache the config file |
# |
$use_session = 0; |
unset($config); |
unset($nas_list); |
if ($use_session){ |
// Start session |
@session_start(); |
if (isset($_SESSION['config'])) |
$config = $_SESSION['config']; |
if (isset($_SESSION['nas_list'])) |
$nas_list = $_SESSION['nas_list']; |
} |
if (!isset($config)){ |
$ARR=file("/etc/freeradius-web/admin.conf"); |
$EXTRA_ARR = array(); |
foreach($ARR as $val) { |
$val=chop($val); |
if (ereg('^[[:space:]]*#',$val) || ereg('^[[:space:]]*$',$val)) |
continue; |
list($key,$v)=split(":[[:space:]]*",$val,2); |
if (preg_match("/%\{(.+)\}/",$v,$matches)){ |
$val=$config[$matches[1]]; |
$v=preg_replace("/%\{$matches[1]\}/",$val,$v); |
} |
if (preg_match("/^nas(\d+)_(\w+)$/",$key,$matches)) |
$nas_list[$matches[1]][$matches[2]] = $v; |
if ($key == 'INCLUDE'){ |
if (is_readable($v)) |
array_push($EXTRA_ARR,file($v)); |
else |
echo "<b>Error: File '$v' does not exist or is not readable</b><br>\n"; |
} |
else |
$config["$key"]="$v"; |
} |
foreach($EXTRA_ARR as $val1) { |
foreach($val1 as $val){ |
$val=chop($val); |
if (ereg('^[[:space:]]*#',$val) || ereg('^[[:space:]]*$',$val)) |
continue; |
list($key,$v)=split(":[[:space:]]*",$val,2); |
if (preg_match("/%\{(.+)\}/",$v,$matches)){ |
$val=$config[$matches[1]]; |
$v=preg_replace("/%\{$matches[1]\}/",$val,$v); |
} |
if (preg_match("/^nas(\d+)_(\w+)$/",$key,$matches)) |
$nas_list[$matches[1]][$matches[2]] = $v; |
$config["$key"]="$v"; |
} |
} |
if ($use_session){ |
session_register('config'); |
session_register('nas_list'); |
} |
} |
if ($use_session == 0 && $config['general_use_session'] == 'yes'){ |
// Start session |
@session_start(); |
if (isset($nas_list)) |
session_register('nas_list'); |
} |
//Make sure we are only passed allowed strings in username |
if (isset($login)){ |
if ($login != '') |
$login = preg_replace("/[^\w\.\/\@\:\-]/",'',$login); |
if ($login != '' && $config['general_strip_realms'] == 'yes'){ |
$realm_del = ($config['general_realm_delimiter'] != '') ? $config['general_realm_delimiter'] : '@'; |
$realm_for = ($config['general_realm_format'] != '') ? $config['general_realm_format'] : 'suffix'; |
$new = explode($realm_del,$login,2); |
if (count($new) == 2) |
$login = ($realm_for == 'suffix') ? $new[0] : $new[1]; |
} |
} |
unset($mappings); |
if (isset($_SESSION['mappings'])) |
$mappings = $_SESSION['mappings']; |
if (!isset($mappings) && $config['general_username_mappings_file'] != ''){ |
$ARR = file($config['general_username_mappings_file']); |
foreach($ARR as $val){ |
$val=chop($val); |
if (ereg('^[[:space:]]*#',$val) || ereg('^[[:space:]]*$',$val)) |
continue; |
list($key,$realm,$v)=split(":[[:space:]]*",$val,3); |
if ($realm == 'accounting' || $realm == 'userdb' || $realm == 'nasdb' || $realm == 'nasadmin') |
$mappings["$key"][$realm] = $v; |
if ($realm == 'nasdb'){ |
$NAS_ARR = array(); |
$NAS_ARR = split(',',$v); |
foreach ($nas_list as $key => $nas){ |
foreach ($NAS_ARR as $nas_check){ |
if ($nas_check == $nas['name']) |
unset($nas_list[$key]); |
} |
} |
} |
} |
if ($config['general_use_session'] == 'yes') |
session_register('mappings'); |
} |
//Include missing.php if needed |
if (!function_exists('array_change_key_case')) |
include_once('../lib/missing.php'); |
@header('Content-type: text/html; charset='.$config['general_charset'].';'); |
?> |
//conf/radius/dialup.conf |
---|
0,0 → 1,303 |
# -*- text -*- |
## |
## dialup.conf -- MySQL configuration for default schema (schema.sql) |
## |
## $Id: dialup.conf 983 2012-08-16 13:34:14Z franck $ |
# Safe characters list for sql queries. Everything else is replaced |
# with their mime-encoded equivalents. |
# The default list should be ok |
#safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" |
####################################################################### |
# Query config: Username |
####################################################################### |
# This is the username that will get substituted, escaped, and added |
# as attribute 'SQL-User-Name'. '%{SQL-User-Name}' should be used below |
# everywhere a username substitution is needed so you you can be sure |
# the username passed from the client is escaped properly. |
# |
# Uncomment the next line, if you want the sql_user_name to mean: |
# |
# Use Stripped-User-Name, if it's there. |
# Else use User-Name, if it's there, |
# Else use hard-coded string "DEFAULT" as the user name. |
#sql_user_name = "%{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}" |
# |
sql_user_name = "%{User-Name}" |
####################################################################### |
# Default profile |
####################################################################### |
# This is the default profile. It is found in SQL by group membership. |
# That means that this profile must be a member of at least one group |
# which will contain the corresponding check and reply items. |
# This profile will be queried in the authorize section for every user. |
# The point is to assign all users a default profile without having to |
# manually add each one to a group that will contain the profile. |
# The SQL module will also honor the User-Profile attribute. This |
# attribute can be set anywhere in the authorize section (ie the users |
# file). It is found exactly as the default profile is found. |
# If it is set then it will *overwrite* the default profile setting. |
# The idea is to select profiles based on checks on the incoming packets, |
# not on user group membership. For example: |
# -- users file -- |
# DEFAULT Service-Type == Outbound-User, User-Profile := "outbound" |
# DEFAULT Service-Type == Framed-User, User-Profile := "framed" |
# |
# By default the default_user_profile is not set |
# |
default_user_profile = "ldap" |
####################################################################### |
# NAS Query |
####################################################################### |
# This query retrieves the radius clients |
# |
# 0. Row ID (currently unused) |
# 1. Name (or IP address) |
# 2. Shortname |
# 3. Type |
# 4. Secret |
####################################################################### |
nas_query = "SELECT id, nasname, shortname, type, secret FROM ${nas_table}" |
####################################################################### |
# Authorization Queries |
####################################################################### |
# These queries compare the check items for the user |
# in ${authcheck_table} and setup the reply items in |
# ${authreply_table}. You can use any query/tables |
# you want, but the return data for each row MUST |
# be in the following order: |
# |
# 0. Row ID (currently unused) |
# 1. UserName/GroupName |
# 2. Item Attr Name |
# 3. Item Attr Value |
# 4. Item Attr Operation |
####################################################################### |
# Use these for case sensitive usernames. |
authorize_check_query = "SELECT id, username, attribute, value, op \ |
FROM ${authcheck_table} \ |
WHERE username = BINARY '%{SQL-User-Name}' \ |
ORDER BY id" |
authorize_reply_query = "SELECT id, username, attribute, value, op \ |
FROM ${authreply_table} \ |
WHERE username = BINARY '%{SQL-User-Name}' \ |
ORDER BY id" |
# The default queries are case insensitive. (for compatibility with |
# older versions of FreeRADIUS) |
# authorize_check_query = "SELECT id, username, attribute, value, op \ |
# FROM ${authcheck_table} \ |
# WHERE username = '%{SQL-User-Name}' \ |
# ORDER BY id" |
# authorize_reply_query = "SELECT id, username, attribute, value, op \ |
# FROM ${authreply_table} \ |
# WHERE username = '%{SQL-User-Name}' \ |
# ORDER BY id" |
# Use these for case sensitive usernames. |
group_membership_query = "SELECT groupname \ |
FROM ${usergroup_table} \ |
WHERE username = BINARY '%{SQL-User-Name}' \ |
ORDER BY priority" |
# group_membership_query = "SELECT groupname \ |
# FROM ${usergroup_table} \ |
# WHERE username = '%{SQL-User-Name}' \ |
# ORDER BY priority" |
authorize_group_check_query = "SELECT id, groupname, attribute, \ |
Value, op \ |
FROM ${groupcheck_table} \ |
WHERE groupname = '%{Sql-Group}' \ |
ORDER BY id" |
authorize_group_reply_query = "SELECT id, groupname, attribute, \ |
value, op \ |
FROM ${groupreply_table} \ |
WHERE groupname = '%{Sql-Group}' \ |
ORDER BY id" |
####################################################################### |
# Accounting Queries |
####################################################################### |
# accounting_onoff_query - query for Accounting On/Off packets |
# accounting_update_query - query for Accounting update packets |
# accounting_update_query_alt - query for Accounting update packets |
# (alternate in case first query fails) |
# accounting_start_query - query for Accounting start packets |
# accounting_start_query_alt - query for Accounting start packets |
# (alternate in case first query fails) |
# accounting_stop_query - query for Accounting stop packets |
# accounting_stop_query_alt - query for Accounting start packets |
# (alternate in case first query doesn't |
# affect any existing rows in the table) |
####################################################################### |
accounting_onoff_query = "\ |
UPDATE ${acct_table1} \ |
SET \ |
acctstoptime = '%S', \ |
acctsessiontime = unix_timestamp('%S') - \ |
unix_timestamp(acctstarttime), \ |
acctterminatecause = '%{Acct-Terminate-Cause}', \ |
acctstopdelay = %{%{Acct-Delay-Time}:-0} \ |
WHERE acctstoptime IS NULL \ |
AND nasipaddress = '%{NAS-IP-Address}' \ |
AND acctstarttime <= '%S'" |
accounting_update_query = " \ |
UPDATE ${acct_table1} \ |
SET \ |
framedipaddress = '%{Framed-IP-Address}', \ |
acctsessiontime = '%{Acct-Session-Time}', \ |
acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | \ |
'%{%{Acct-Input-Octets}:-0}', \ |
acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | \ |
'%{%{Acct-Output-Octets}:-0}' \ |
WHERE acctsessionid = '%{Acct-Session-Id}' \ |
AND username = '%{SQL-User-Name}' \ |
AND nasipaddress = '%{NAS-IP-Address}'" |
accounting_update_query_alt = " \ |
INSERT INTO ${acct_table1} \ |
(acctsessionid, acctuniqueid, username, \ |
realm, nasipaddress, nasportid, \ |
nasporttype, acctstarttime, acctsessiontime, \ |
acctauthentic, connectinfo_start, acctinputoctets, \ |
acctoutputoctets, calledstationid, callingstationid, \ |
servicetype, framedprotocol, framedipaddress, \ |
acctstartdelay, xascendsessionsvrkey) \ |
VALUES \ |
('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ |
'%{SQL-User-Name}', \ |
'%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', \ |
'%{NAS-Port-Type}', \ |
DATE_SUB('%S', \ |
INTERVAL (%{%{Acct-Session-Time}:-0} + \ |
%{%{Acct-Delay-Time}:-0}) SECOND), \ |
'%{Acct-Session-Time}', \ |
'%{Acct-Authentic}', '', \ |
'%{%{Acct-Input-Gigawords}:-0}' << 32 | \ |
'%{%{Acct-Input-Octets}:-0}', \ |
'%{%{Acct-Output-Gigawords}:-0}' << 32 | \ |
'%{%{Acct-Output-Octets}:-0}', \ |
'%{Called-Station-Id}', '%{Calling-Station-Id}', \ |
'%{Service-Type}', '%{Framed-Protocol}', \ |
'%{Framed-IP-Address}', \ |
'0', '%{X-Ascend-Session-Svr-Key}')" |
accounting_start_query = " \ |
INSERT INTO ${acct_table1} \ |
(acctsessionid, acctuniqueid, username, \ |
realm, nasipaddress, nasportid, \ |
nasporttype, acctstarttime, acctstoptime, \ |
acctsessiontime, acctauthentic, connectinfo_start, \ |
connectinfo_stop, acctinputoctets, acctoutputoctets, \ |
calledstationid, callingstationid, acctterminatecause, \ |
servicetype, framedprotocol, framedipaddress, \ |
acctstartdelay, acctstopdelay, xascendsessionsvrkey) \ |
VALUES \ |
('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ |
'%{SQL-User-Name}', \ |
'%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', \ |
'%{NAS-Port-Type}', '%S', NULL, \ |
'0', '%{Acct-Authentic}', '%{Connect-Info}', \ |
'', '0', '0', \ |
'%{Called-Station-Id}', '%{Calling-Station-Id}', '', \ |
'%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', \ |
'%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" |
accounting_start_query_alt = " \ |
UPDATE ${acct_table1} SET \ |
acctstarttime = '%S', \ |
acctstartdelay = '%{%{Acct-Delay-Time}:-0}', \ |
connectinfo_start = '%{Connect-Info}' \ |
WHERE acctsessionid = '%{Acct-Session-Id}' \ |
AND username = '%{SQL-User-Name}' \ |
AND nasipaddress = '%{NAS-IP-Address}'" |
accounting_stop_query = " \ |
UPDATE ${acct_table2} SET \ |
acctstoptime = '%S', \ |
acctsessiontime = '%{Acct-Session-Time}', \ |
acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | \ |
'%{%{Acct-Input-Octets}:-0}', \ |
acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | \ |
'%{%{Acct-Output-Octets}:-0}', \ |
acctterminatecause = '%{Acct-Terminate-Cause}', \ |
acctstopdelay = '%{%{Acct-Delay-Time}:-0}', \ |
connectinfo_stop = '%{Connect-Info}' \ |
WHERE acctsessionid = '%{Acct-Session-Id}' \ |
AND username = '%{SQL-User-Name}' \ |
AND nasipaddress = '%{NAS-IP-Address}'" |
accounting_stop_query_alt = " \ |
INSERT INTO ${acct_table2} \ |
(acctsessionid, acctuniqueid, username, \ |
realm, nasipaddress, nasportid, \ |
nasporttype, acctstarttime, acctstoptime, \ |
acctsessiontime, acctauthentic, connectinfo_start, \ |
connectinfo_stop, acctinputoctets, acctoutputoctets, \ |
calledstationid, callingstationid, acctterminatecause, \ |
servicetype, framedprotocol, framedipaddress, \ |
acctstartdelay, acctstopdelay) \ |
VALUES \ |
('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ |
'%{SQL-User-Name}', \ |
'%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', \ |
'%{NAS-Port-Type}', \ |
DATE_SUB('%S', \ |
INTERVAL (%{%{Acct-Session-Time}:-0} + \ |
%{%{Acct-Delay-Time}:-0}) SECOND), \ |
'%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', \ |
'%{Connect-Info}', \ |
'%{%{Acct-Input-Gigawords}:-0}' << 32 | \ |
'%{%{Acct-Input-Octets}:-0}', \ |
'%{%{Acct-Output-Gigawords}:-0}' << 32 | \ |
'%{%{Acct-Output-Octets}:-0}', \ |
'%{Called-Station-Id}', '%{Calling-Station-Id}', \ |
'%{Acct-Terminate-Cause}', \ |
'%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', \ |
'0', '%{%{Acct-Delay-Time}:-0}')" |
####################################################################### |
# Simultaneous Use Checking Queries |
####################################################################### |
# simul_count_query - query for the number of current connections |
# - If this is not defined, no simultaneouls use checking |
# - will be performed by this module instance |
# simul_verify_query - query to return details of current connections for verification |
# - Leave blank or commented out to disable verification step |
# - Note that the returned field order should not be changed. |
####################################################################### |
# Uncomment simul_count_query to enable simultaneous use checking |
simul_count_query = "SELECT COUNT(*) \ |
FROM ${acct_table1} \ |
WHERE username = '%{SQL-User-Name}' \ |
AND acctstoptime IS NULL" |
#simul_verify_query = "SELECT radacctid, acctsessionid, username, \ |
#nasipaddress, nasportid, framedipaddress, \ |
#callingstationid, framedprotocol \ |
#FROM ${acct_table1} \ |
#WHERE username = '%{SQL-User-Name}' \ |
#AND acctstoptime IS NULL" |
####################################################################### |
# Authentication Logging Queries |
####################################################################### |
# postauth_query - Insert some info after authentication |
####################################################################### |
# (username, pass, reply, authdate) \ |
# '%{%{User-Password}:-%{Chap-Password}}', \ |
postauth_query = "INSERT INTO ${postauth_table} \ |
(username, reply, authdate) \ |
VALUES ( \ |
'%{User-Name}', \ |
'%{reply:Packet-Type}', '%S')" |
//conf/radius/counter.conf |
---|
0,0 → 1,124 |
# -*- text -*- |
## |
## counter.conf -- PostgreSQL queries for rlm_sqlcounter |
## |
## $Id$ |
# Rather than maintaining seperate (GDBM) databases of |
# accounting info for each counter, this module uses the data |
# stored in the raddacct table by the sql modules. This |
# module NEVER does any database INSERTs or UPDATEs. It is |
# totally dependent on the SQL module to process Accounting |
# packets. |
# |
# The 'sqlmod_inst' parameter holds the instance of the sql |
# module to use when querying the SQL database. Normally it |
# is just "sql". If you define more and one SQL module |
# instance (usually for failover situations), you can |
# specify which module has access to the Accounting Data |
# (radacct table). |
# |
# The 'reset' parameter defines when the counters are all |
# reset to zero. It can be hourly, daily, weekly, monthly or |
# never. It can also be user defined. It should be of the |
# form: |
# num[hdwm] where: |
# h: hours, d: days, w: weeks, m: months |
# If the letter is ommited days will be assumed. In example: |
# reset = 10h (reset every 10 hours) |
# reset = 12 (reset every 12 days) |
# |
# The 'key' parameter specifies the unique identifier for the |
# counter records (usually 'User-Name'). |
# |
# The 'query' parameter specifies the SQL query used to get |
# the current Counter value from the database. There are 3 |
# parameters that can be used in the query: |
# %k 'key' parameter |
# %b unix time value of beginning of reset period |
# %e unix time value of end of reset period |
# |
# The 'check-name' parameter is the name of the 'check' |
# attribute to use to access the counter in the 'users' file |
# or SQL radcheck or radcheckgroup tables. |
# |
# DEFAULT Max-Daily-Session > 3600, Auth-Type = Reject |
# Reply-Message = "You've used up more than one hour today" |
# |
sqlcounter dailycounter { |
counter-name = Daily-Session-Time |
check-name = Max-Daily-Session |
reply-name = Session-Timeout |
sqlmod-inst = sql |
key = User-Name |
reset = daily |
# This query properly handles calls that span from the |
# previous reset period into the current period but |
# involves more work for the SQL server than those |
# below |
query = "SELECT SUM(acctsessiontime - \ |
GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)) \ |
FROM radacct WHERE username = '%{%k}' AND \ |
UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" |
# This query ignores calls that started in a previous |
# reset period and continue into into this one. But it |
# is a little easier on the SQL server |
# query = "SELECT SUM(acctsessiontime) FROM radacct WHERE \ |
# username = '%{%k}' AND acctstarttime > FROM_UNIXTIME('%b')" |
# This query is the same as above, but demonstrates an |
# additional counter parameter '%e' which is the |
# timestamp for the end of the period |
# query = "SELECT SUM(acctsessiontime) FROM radacct \ |
# WHERE username = '%{%k}' AND acctstarttime BETWEEN \ |
# FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')" |
} |
sqlcounter monthlycounter { |
counter-name = Monthly-Session-Time |
check-name = Max-Monthly-Session |
reply-name = Session-Timeout |
sqlmod-inst = sql |
key = User-Name |
reset = monthly |
# This query properly handles calls that span from the |
# previous reset period into the current period but |
# involves more work for the SQL server than those |
# below |
query = "SELECT SUM(acctsessiontime - \ |
GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)) \ |
FROM radacct WHERE username='%{%k}' AND \ |
UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" |
# This query ignores calls that started in a previous |
# reset period and continue into into this one. But it |
# is a little easier on the SQL server |
# query = "SELECT SUM(acctsessiontime) FROM radacct WHERE \ |
# username='%{%k}' AND acctstarttime > FROM_UNIXTIME('%b')" |
# This query is the same as above, but demonstrates an |
# additional counter parameter '%e' which is the |
# timestamp for the end of the period |
# query = "SELECT SUM(acctsessiontime) FROM radacct \ |
# WHERE username='%{%k}' AND acctstarttime BETWEEN \ |
# FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')" |
} |
sqlcounter noresetcounter { |
counter-name = Max-All-Session-Time |
check-name = Max-All-Session |
sqlmod-inst = sql |
key = User-Name |
reset = never |
# This is the original query |
# query = "SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='%{%k}'" |
# This is the query modified for ALCASAR needs (thanks to Daniel Laliberte --> authorized period after the first connection) |
query = "SELECT IFNULL((SELECT TIME_TO_SEC(TIMEDIFF(NOW(), acctstarttime)) \ |
FROM radacct \ |
WHERE UserName='%{%k}' \ |
ORDER BY acctstarttime \ |
LIMIT 1),0)" |
} |
//conf/radius/sql.attrmap |
---|
0,0 → 1,59 |
# |
# A mapping between the attributes used by dialup_admin and the attribute |
# names that will be stored in the SQL database |
# |
# Attributes that are not contained in this file are assumed to be reply |
# items and map to the same name as the one used by dialup_admin |
# |
# Format: |
# checkItem|replyItem Attribute-In-Dialup-Admin Attribute-In-SQL |
# |
# |
checkItem Auth-Type Auth-Type |
checkItem Simultaneous-Use Simultaneous-Use |
checkItem Called-Station-Id Called-Station-Id |
checkItem Calling-Station-Id Calling-Station-Id |
checkItem Dialup-Access none |
checkItem Max-All-Session Max-All-Session |
checkItem Max-Daily-Session Max-Daily-Session |
checkItem Max-Weekly-Session Max-Weekly-Session |
checkItem Max-Monthly-Session Max-Monthly-Session |
checkItem Login-Time Login-Time |
checkItem Expiration Expiration |
replyItem Service-Type Service-Type |
replyItem Framed-Protocol Framed-Protocol |
replyItem Framed-IP-Address Framed-IP-Address |
replyItem Framed-IP-Netmask Framed-IP-Netmask |
replyItem Framed-Route Framed-Route |
replyItem Framed-Routing Framed-Routing |
replyItem Filter-Id Filter-Id |
replyItem Framed-MTU Framed-MTU |
replyItem Framed-Compression Framed-Compression |
replyItem Login-IP-Host Login-IP-Host |
replyItem Login-Service Login-Service |
replyItem Login-TCP-Port Login-TCP-Port |
replyItem Callback-Number Callback-Number |
replyItem Callback-Id Callback-Id |
replyItem Framed-IPX-Network Framed-IPX-Network |
replyItem Class Class |
replyItem Session-Timeout Session-Timeout |
replyItem Idle-Timeout Idle-Timeout |
replyItem Termination-Action Termination-Action |
replyItem Login-LAT-Service Login-LAT-Service |
replyItem Login-LAT-Node Login-LAT-Node |
replyItem Login-LAT-Group Login-LAT-Group |
replyItem Framed-AppleTalk-Link Framed-AppleTalk-Link |
replyItem Framed-AppleTalk-Network Framed-AppleTalk-Network |
replyItem Framed-AppleTalk-Zone Framed-AppleTalk-Zone |
replyItem Port-Limit Port-Limit |
replyItem Login-LAT-Port Login-LAT-Port |
replyitem Reply-Message Reply-Message |
replyItem Dialup-Lock-Msg Reply-Message |
replyItem User-Password User-Password |
replyItem ChilliSpot-Max-Input-Octets ChilliSpot-Max-Input-Octets |
replyItem ChilliSpot-max-Output-Octets ChilliSpot-Max-Output-Octets |
replyItem ChilliSpot-Max-Total-Octets ChilliSpot-Max-Total-Octets |
replyItem ChilliSpot-Bandwidth-Max-Up ChilliSpot-Bandwidth-Max-Up |
replyItem ChilliSpot-Bandwidth-Max-Down ChilliSpot-Bandwidth-Max-Down |
replyItem WISPr-Redirection-URL WISPr-Redirection-URL |
//conf/radius/alcasar-radius |
---|
0,0 → 1,510 |
###################################################################### |
# |
# As of 2.0.0, FreeRADIUS supports virtual hosts using the |
# "server" section, and configuration directives. |
# |
# Virtual hosts should be put into the "sites-available" |
# directory. Soft links should be created in the "sites-enabled" |
# directory to these files. This is done in a normal installation. |
# |
# $Id: alcasar-radius 845 2012-03-29 21:17:03Z richard $ |
# |
###################################################################### |
# |
# Read "man radiusd" before editing this file. See the section |
# titled DEBUGGING. It outlines a method where you can quickly |
# obtain the configuration you want, without running into |
# trouble. See also "man unlang", which documents the format |
# of this file. |
# |
# This configuration is designed to work in the widest possible |
# set of circumstances, with the widest possible number of |
# authentication methods. This means that in general, you should |
# need to make very few changes to this file. |
# |
# The best way to configure the server for your local system |
# is to CAREFULLY edit this file. Most attempts to make large |
# edits to this file will BREAK THE SERVER. Any edits should |
# be small, and tested by running the server with "radiusd -X". |
# Once the edits have been verified to work, save a copy of these |
# configuration files somewhere. (e.g. as a "tar" file). Then, |
# make more edits, and test, as above. |
# |
# There are many "commented out" references to modules such |
# as ldap, sql, etc. These references serve as place-holders. |
# If you need the functionality of that module, then configure |
# it in radiusd.conf, and un-comment the references to it in |
# this file. In most cases, those small changes will result |
# in the server being able to connect to the DB, and to |
# authenticate users. |
# |
###################################################################### |
# |
# In 1.x, the "authorize", etc. sections were global in |
# radiusd.conf. As of 2.0, they SHOULD be in a server section. |
# |
# The server section with no virtual server name is the "default" |
# section. It is used when no server name is specified. |
# |
# We don't indent the rest of this file, because doing so |
# would make it harder to read. |
# |
# Authorization. First preprocess (hints and huntgroups files), |
# then realms, and finally look in the "users" file. |
# |
# The order of the realm modules will determine the order that |
# we try to find a matching realm. |
# |
# Make *sure* that 'preprocess' comes before any realm if you |
# need to setup hints for the remote radius server |
authorize { |
# |
# The preprocess module takes care of sanitizing some bizarre |
# attributes in the request, and turning them into attributes |
# which are more standard. |
# |
# It takes care of processing the 'raddb/hints' and the |
# 'raddb/huntgroups' files. |
# |
# It also adds the %{Client-IP-Address} attribute to the request. |
preprocess |
# |
# If you want to have a log of authentication requests, |
# un-comment the following line, and the 'detail auth_log' |
# section, above. |
# auth_log |
# |
# The chap module will set 'Auth-Type := CHAP' if we are |
# handling a CHAP request and Auth-Type has not already been set |
# chap |
# |
# If the users are logging in with an MS-CHAP-Challenge |
# attribute for authentication, the mschap module will find |
# the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP' |
# to the request, which will cause the server to then use |
# the mschap module for authentication. |
# mschap |
# |
# If you have a Cisco SIP server authenticating against |
# FreeRADIUS, uncomment the following line, and the 'digest' |
# line in the 'authenticate' section. |
# digest |
# |
# Look for IPASS style 'realm/', and if not found, look for |
# '@realm', and decide whether or not to proxy, based on |
# that. |
# IPASS |
# |
# If you are using multiple kinds of realms, you probably |
# want to set "ignore_null = yes" for all of them. |
# Otherwise, when the first style of realm doesn't match, |
# the other styles won't be checked. |
# |
# suffix |
# ntdomain |
# |
# This module takes care of EAP-MD5, EAP-TLS, and EAP-LEAP |
# authentication. |
# |
# It also sets the EAP-Type attribute in the request |
# attribute list to the EAP type from the packet. |
# |
# As of 2.0, the EAP module returns "ok" in the authorize stage |
# for TTLS and PEAP. In 1.x, it never returned "ok" here, so |
# this change is compatible with older configurations. |
# |
# The example below uses module failover to avoid querying all |
# of the following modules if the EAP module returns "ok". |
# Therefore, your LDAP and/or SQL servers will not be queried |
# for the many packets that go back and forth to set up TTLS |
# or PEAP. The load on those servers will therefore be reduced. |
# |
# eap { |
# ok = return |
# } |
# |
# Pull crypt'd passwords from /etc/passwd or /etc/shadow, |
# using the system API's to get the password. If you want |
# to read /etc/passwd or /etc/shadow directly, see the |
# passwd module in radiusd.conf. |
# |
# unix |
# |
# Read the 'users' file |
# files |
# |
# Look in an SQL database. The schema of the database |
# is meant to mirror the "users" file. |
# |
# See "Authorization Queries" in sql.conf |
sql |
noresetcounter |
dailycounter |
monthlycounter |
# |
# If you are using /etc/smbpasswd, and are also doing |
# mschap authentication, the un-comment this line, and |
# configure the 'etc_smbpasswd' module, above. |
# etc_smbpasswd |
# |
# The ldap module will set Auth-Type to LDAP if it has not |
# already been set |
# ldap { |
# fail = 1 |
# } |
# |
# Enforce daily limits on time spent logged in. |
# daily |
# |
# Use the checkval module |
# checkval |
expiration |
logintime |
# |
# If no other module has claimed responsibility for |
# authentication, then try to use PAP. This allows the |
# other modules listed above to add a "known good" password |
# to the request, and to do nothing else. The PAP module |
# will then see that password, and use it to do PAP |
# authentication. |
# |
# This module should be listed last, so that the other modules |
# get a chance to set Auth-Type for themselves. |
# |
# pap |
# |
# If "status_server = yes", then Status-Server messages are passed |
# through the following section, and ONLY the following section. |
# This permits you to do DB queries, for example. If the modules |
# listed here return "fail", then NO response is sent. |
# |
# Autz-Type Status-Server { |
# |
# } |
update coa { |
User-Name = "%{User-Name}" |
Acct-Session-Id = "%{Acct-Session-Id}" |
NAS-IP-Address = "%{NAS-IP-Address}" |
} |
} |
# Authentication. |
# |
# |
# This section lists which modules are available for authentication. |
# Note that it does NOT mean 'try each module in order'. It means |
# that a module from the 'authorize' section adds a configuration |
# attribute 'Auth-Type := FOO'. That authentication type is then |
# used to pick the apropriate module from the list below. |
# |
# In general, you SHOULD NOT set the Auth-Type attribute. The server |
# will figure it out on its own, and will do the right thing. The |
# most common side effect of erroneously setting the Auth-Type |
# attribute is that one authentication method will work, but the |
# others will not. |
# |
# The common reasons to set the Auth-Type attribute by hand |
# is to either forcibly reject the user (Auth-Type := Reject), |
# or to or forcibly accept the user (Auth-Type := Accept). |
# |
# Note that Auth-Type := Accept will NOT work with EAP. |
# |
# Please do not put "unlang" configurations into the "authenticate" |
# section. Put them in the "post-auth" section instead. That's what |
# the post-auth section is for. |
# |
authenticate { |
# # |
# # PAP authentication, when a back-end database listed |
# # in the 'authorize' section supplies a password. The |
# # password can be clear-text, or encrypted. |
# Auth-Type PAP { |
# pap |
# } |
# |
# # |
# # Most people want CHAP authentication |
# # A back-end database listed in the 'authorize' section |
# # MUST supply a CLEAR TEXT password. Encrypted passwords |
# # won't work. |
# Auth-Type CHAP { |
# chap |
# } |
# |
# # |
# # MSCHAP authentication. |
# Auth-Type MS-CHAP { |
# mschap |
# } |
# |
# # |
# # If you have a Cisco SIP server authenticating against |
# # FreeRADIUS, uncomment the following line, and the 'digest' |
# # line in the 'authorize' section. |
# digest |
# |
# # |
# # Pluggable Authentication Modules. |
# pam |
# |
# # |
# # See 'man getpwent' for information on how the 'unix' |
# # module checks the users password. Note that packets |
# # containing CHAP-Password attributes CANNOT be authenticated |
# # against /etc/passwd! See the FAQ for details. |
# # |
# unix |
# |
# # Uncomment it if you want to use ldap for authentication |
# # |
# # Note that this means "check plain-text password against |
# # the ldap database", which means that EAP won't work, |
# # as it does not supply a plain-text password. |
# Auth-Type LDAP { |
# ldap |
# } |
# |
# # |
# # Allow EAP authentication. |
# eap |
} |
# |
# Pre-accounting. Decide which accounting type to use. |
# |
preacct { |
preprocess |
# |
# Ensure that we have a semi-unique identifier for every |
# request, and many NAS boxes are broken. |
# acct_unique |
# |
# Look for IPASS-style 'realm/', and if not found, look for |
# '@realm', and decide whether or not to proxy, based on |
# that. |
# |
# Accounting requests are generally proxied to the same |
# home server as authentication requests. |
# IPASS |
# suffix |
# ntdomain |
# |
# Read the 'acct_users' file |
# files |
} |
# |
# Accounting. Log the accounting data. |
# |
accounting { |
# |
# Create a 'detail'ed log of the packets. |
# Note that accounting requests which are proxied |
# are also logged in the detail file. |
# detail |
# daily |
# Update the wtmp file |
# |
# If you don't use "radlast", you can delete this line. |
# unix |
# |
# For Simultaneous-Use tracking. |
# |
# Due to packet losses in the network, the data here |
# may be incorrect. There is little we can do about it. |
# radutmp |
sradutmp |
# Return an address to the IP Pool when we see a stop record. |
# main_pool |
# |
# Log traffic to an SQL database. |
# |
# See "Accounting queries" in sql.conf |
sql |
# |
# Instead of sending the query to the SQL server, |
# write it into a log file. |
# |
# sql_log |
# Cisco VoIP specific bulk accounting |
# pgsql-voip |
# Filter attributes from the accounting response. |
attr_filter.accounting_response |
# |
# See "Autz-Type Status-Server" for how this works. |
# |
# Acct-Type Status-Server { |
# |
# } |
} |
# Session database, used for checking Simultaneous-Use. Either the radutmp |
# or rlm_sql module can handle this. |
# The rlm_sql module is *much* faster |
session { |
# radutmp |
# |
# See "Simultaneous Use Checking Queries" in sql.conf |
sql |
} |
# Post-Authentication |
# Once we KNOW that the user has been authenticated, there are |
# additional steps we can take. |
post-auth { |
# Get an address from the IP Pool. |
# main_pool |
# |
# If you want to have a log of authentication replies, |
# un-comment the following line, and the 'detail reply_log' |
# section, above. |
# reply_log |
# |
# After authenticating the user, do another SQL query. |
# |
# See "Authentication Logging Queries" in sql.conf |
# sql |
# |
# Instead of sending the query to the SQL server, |
# write it into a log file. |
# |
# sql_log |
# |
# Un-comment the following if you have set |
# 'edir_account_policy_check = yes' in the ldap module sub-section of |
# the 'modules' section. |
# |
# ldap |
# exec |
# |
# Access-Reject packets are sent through the REJECT sub-section of the |
# post-auth section. |
# |
# Add the ldap module name (or instance) if you have set |
# 'edir_account_policy_check = yes' in the ldap module configuration |
# |
Post-Auth-Type REJECT { |
attr_filter.access_reject |
} |
} |
# |
# When the server decides to proxy a request to a home server, |
# the proxied request is first passed through the pre-proxy |
# stage. This stage can re-write the request, or decide to |
# cancel the proxy. |
# |
# Only a few modules currently have this method. |
# |
pre-proxy { |
# attr_rewrite |
# Uncomment the following line if you want to change attributes |
# as defined in the preproxy_users file. |
# files |
# Uncomment the following line if you want to filter requests |
# sent to remote servers based on the rules defined in the |
# 'attrs.pre-proxy' file. |
# attr_filter.pre-proxy |
# If you want to have a log of packets proxied to a home |
# server, un-comment the following line, and the |
# 'detail pre_proxy_log' section, above. |
# pre_proxy_log |
} |
# |
# When the server receives a reply to a request it proxied |
# to a home server, the request may be massaged here, in the |
# post-proxy stage. |
# |
post-proxy { |
# If you want to have a log of replies from a home server, |
# un-comment the following line, and the 'detail post_proxy_log' |
# section, above. |
# post_proxy_log |
# attr_rewrite |
# Uncomment the following line if you want to filter replies from |
# remote proxies based on the rules defined in the 'attrs' file. |
# attr_filter.post-proxy |
# |
# If you are proxying LEAP, you MUST configure the EAP |
# module, and you MUST list it here, in the post-proxy |
# stage. |
# |
# You MUST also use the 'nostrip' option in the 'realm' |
# configuration. Otherwise, the User-Name attribute |
# in the proxied request will not match the user name |
# hidden inside of the EAP packet, and the end server will |
# reject the EAP request. |
# |
# eap |
# |
# If the server tries to proxy a request and fails, then the |
# request is processed through the modules in this section. |
# |
# The main use of this section is to permit robust proxying |
# of accounting packets. The server can be configured to |
# proxy accounting packets as part of normal processing. |
# Then, if the home server goes down, accounting packets can |
# be logged to a local "detail" file, for processing with |
# radrelay. When the home server comes back up, radrelay |
# will read the detail file, and send the packets to the |
# home server. |
# |
# With this configuration, the server always responds to |
# Accounting-Requests from the NAS, but only writes |
# accounting packets to disk if the home server is down. |
# |
# Post-Proxy-Type Fail { |
# detail |
# } |
} |