Subversion Repositories ALCASAR

#	If you are using 802.1X (EAP) authentication, please see also

#	the "inner-tunnel" virtual server.  You will likely have to edit

#	that, too, for authentication to work.

#

server default {

#  therefore authentication and accounting have to be configured in

#  different sections.

#

#  The server ignore all "listen" section if you are using '-i' and '-p'

#  on the command line.

#

listen {

	#  Type of packets to listen for.

	#  Allowed values are:

	#	auth	listen for authentication packets

	#	acct	listen for accounting packets

	#	proxy   IP to use for sending proxied packets

	#	detail  Read from the detail file.  For examples, see

	#               raddb/sites-available/copy-acct-to-home-server

	#	status  listen for Status-Server packets.  For examples,

	#		see raddb/sites-available/status

	#	coa     listen for CoA-Request and Disconnect-Request

	#		packets.  For examples, see the file

	#		raddb/sites-available/coa

	#

	type = auth

	#  Note: "type = proxy" lets you control the source IP used for

	#        proxying packets, with some limitations:

	#

	#    * A proxy listener CANNOT be used in a virtual server section.

	#    * You should probably set "port = 0".

	#    * Any "clients" configuration will be ignored.

	#

	#  See also proxy.conf, and the "src_ipaddr" configuration entry

	#  in the sample "home_server" section.  When you specify the

	#  source IP address for packets sent to a home server, the

	#  proxy listeners are automatically created.

	#  ipaddr/ipv4addr/ipv6addr - IP address on which to listen.

	#  If multiple ones are listed, only the first one will

	#  be used, and the others will be ignored.

	#

	#  The configuration options accept the following syntax:

	#

	#  ipv4addr - IPv4 address (e.g.192.0.2.3)

	#  	    - wildcard (i.e. *)

	#  	    - hostname (radius.example.com)

	#  	      Only the A record for the host name is used.

	#	      If there is no A record, an error is returned,

	#	      and the server fails to start.

	#

	#  ipv6addr - IPv6 address (e.g. 2001:db8::1)

	#  	    - wildcard (i.e. *)

	#  	    - hostname (radius.example.com)

	#  	      Only the AAAA record for the host name is used.

	#	      If there is no AAAA record, an error is returned,

	#	      and the server fails to start.

	#

	#  ipaddr   - IPv4 address as above

	#  	    - IPv6 address as above

	#  	    - wildcard (i.e. *), which means IPv4 wildcard.

	#	    - hostname

	#	      If there is only one A or AAAA record returned

	#	      for the host name, it is used.

	#	      If multiple A or AAAA records are returned

	#	      for the host name, only the first one is used.

	#	      If both A and AAAA records are returned

	#	      for the host name, only the A record is used.

	#

	# ipv4addr = *

	# ipv6addr = *

	ipaddr = 127.0.0.1

	#  Port on which to listen.

	#  Allowed values are:

	#	integer port number (1812)

	#	0 means "use /etc/services for the proper port"

	port = 0

	#  Some systems support binding to an interface, in addition

	#  to the IP address.  This feature isn't strictly necessary,

	#  but for sites with many IP addresses on one interface,

	#  it's useful to say "listen on all addresses for eth0".

	#

	#  If your system does not support this feature, you will

	#  get an error if you try to use it.

	#

#	interface = eth0

	#  Per-socket lists of clients.  This is a very useful feature.

	#

	#  The name here is a reference to a section elsewhere in

	#  radiusd.conf, or clients.conf.  Having the name as

	#  a reference allows multiple sockets to use the same

	#  set of clients.

	#

	#  If this configuration is used, then the global list of clients

	#  is IGNORED for this "listen" section.  Take care configuring

	#  this feature, to ensure you don't accidentally disable a

	#  client you need.

	#

	#  See clients.conf for the configuration of "per_socket_clients".

	#

#	clients = per_socket_clients

	#

	#  Connection limiting for sockets with "proto = tcp".

	#

	#  This section is ignored for other kinds of sockets.

	#

	limit {

	      #

	      #  Limit the number of simultaneous TCP connections to the socket

	      #

	      #  The default is 16.

	      #  Setting this to 0 means "no limit"

	      max_connections = 16

	      #  The per-socket "max_requests" option does not exist.

	      #

	      #  The lifetime, in seconds, of a TCP connection.  After

	      #  this lifetime, the connection will be closed.

	      #

	      #  Setting this to 0 means "forever".

	      lifetime = 0

	      #

	      #  The idle timeout, in seconds, of a TCP connection.

	      #  If no packets have been received over the connection for

	      #

	      #  Setting this to 0 means "no timeout".

	      #

	      #  We STRONGLY RECOMMEND that you set an idle timeout.

	      #

	      idle_timeout = 30

	}

}

listen {

	ipaddr = 127.0.0.1

#	ipv6addr = ::

	port = 0

	type = acct

#	interface = eth0

#	clients = per_socket_clients

	limit {

		#  The number of packets received can be rate limited via the

		#  "max_pps" configuration item.  When it is set, the server

		#  tracks the total number of packets received in the previous

		#  second.  If the count is greater than "max_pps", then the

		#  new packet is silently discarded.  This helps the server

		#  deal with overload situations.

		#

		#  The packets/s counter is tracked in a sliding window.  This

		#  means that the pps calculation is done for the second

		#  before the current packet was received.  NOT for the current

		#  wall-clock second, and NOT for the previous wall-clock second.

		#

		#  Useful values are 0 (no limit), or 100 to 10000.

		#  Values lower than 100 will likely cause the server to ignore

		#  normal traffic.  Few systems are capable of handling more than

		#  10K packets/s.

		#

		#  It is most useful for accounting systems.  Set it to 50%

		#  more than the normal accounting load, and you can be sure that

		#  the server will never get overloaded

		#

#		max_pps = 0

		# Only for "proto = tcp". These are ignored for "udp" sockets.

		#

#		idle_timeout = 0

#		lifetime = 0

#		max_connections = 0

	}

}

# IPv6 versions of the above - read their full config to understand options

#listen {

#	type = auth

#	ipv6addr = ::1

#	ipv6addr = ::	# any.  ::1 == localhost

#	port = 0

#	interface = eth0

#	clients = per_socket_clients

#	limit {

#	      max_connections = 16

#	      lifetime = 0

#	      idle_timeout = 30

#	}

#}

#listen {

#	type = acct

#	ipv6addr = ::1

#	ipv6addr = ::	# any.  ::1 == localhost

#	port = 0

#	interface = eth0

#	clients = per_socket_clients

#	limit {

#		max_pps = 0

#		idle_timeout = 0

#		lifetime = 0

#		max_connections = 0

#	}

#}

#  Any changes made here should also be made to the "inner-tunnel"

#  virtual server.

#

	#  Take a User-Name, and perform some checks on it, for spaces and other

	#  invalid characters.  If the User-Name appears invalid, reject the

	#  request.

	#

	#  See policy.d/filter for the definition of the filter_username policy.

	#

	filter_username

	#

	#  Some broken equipment sends passwords with embedded zeros.

	#  i.e. the debug output will show

	#

	#	User-Password = "password\000\000"

	#

	#  This policy will fix it to just be "password".

	#

	filter_password

	#

	preprocess

	#  If you intend to use CUI and you require that the Operator-Name

	#  be set for CUI generation and you want to generate CUI also

	#  for your local clients then uncomment the operator-name

	#  below and set the operator-name for your clients in clients.conf

#	operator-name

	#  send proper CUI requests, then uncomment the

	#  cui below and set "add_cui = yes" for these clients in clients.conf

	#  The WiMAX specification says that the Calling-Station-Id

	#  is 6 octets of the MAC.  This definition conflicts with

	#  RFC 3580, and all common RADIUS practices.  Un-commenting

	#  the "wimax" module here means that it will fix the

	#  Calling-Station-Id attribute to the normal format as

	#  specified in RFC 3580 Section 3.21

#	wimax

	#

	#  TTLS or PEAP.

	#

	#  LDAP and/or SQL queries for TTLS or PEAP.

#		updated = return

	#  raddb/mods-config/files/authorize

	#

	#  For old names, too.

#	mschap

	#  Uncomment it if you want to use ldap for authentication

	#

	#

	#  The older configurations sent a number of attributes in

	#  Access-Challenge packets, which wasn't strictly correct.

	#  If you want to filter out these attributes, uncomment

	#  the following lines.

	#

#	Auth-Type eap {

#		eap {

#			handled = 1

#		}

#		if (handled && (Response-Packet-Type == Access-Challenge)) {

#			attr_filter.access_challenge.post-auth

#			handled  # override the "updated" code from attr_filter

#		}

#	}

	#  Merge Acct-[Input|Output]-Gigawords and Acct-[Input-Output]-Octets

	#  into a single 64bit counter Acct-[Input|Output]-Octets64.

	#

#	acct_counters64

	#

	#  Session start times are *implied* in RADIUS.

	#  The NAS never sends a "start time".  Instead, it sends

	#  a start packet, *possibly* with an Acct-Delay-Time.

	#  The server is supposed to conclude that the start time

	#  was "Acct-Delay-Time" seconds in the past.

	#

	#  The code below creates an explicit start time, which can

	#  then be used in other modules.  It will be *mostly* correct.

	#  Any errors are due to the 1-second resolution of RADIUS,

	#  and the possibility that the time on the NAS may be off.

	#

	#  The start time is: NOW - delay - session_length

	#

#	update request {

#	  	&FreeRADIUS-Acct-Session-Start-Time = "%{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}}"

#	}

	#

	#  Update accounting packet by adding the CUI attribute

	#  recorded from the corresponding Access-Accept

	#  use it only if your NAS boxes do not support CUI themselves

#	cui

	#  If you receive stop packets with zero session length,

	#  will print a message (only in debugging mode), and will

	#

	#  You can ignore these packets by uncommenting the following

	#  three lines.  Otherwise, the server will not respond to the

	#  accounting request, and the NAS will retransmit.

#	if (noop) {

#	}

	# For Exec-Program and Exec-Program-Wait

	exec

	#

	#  If you need to have a State attribute, you can

	#  add it here.  e.g. for later CoA-Request with

	#  State, and Service-Type = Authorize-Only.

	#

#	if (!&reply:State) {

#		update reply {

#			State := "0x%{randstr:16h}"

#		}

#	}

	#

	#  For EAP-TTLS and PEAP, add the cached attributes to the reply.

	#  The "session-state" attributes are automatically cached when

	#  an Access-Challenge is sent, and automatically retrieved

	#  when an Access-Request is received.

	#

	#  The session-state attributes are automatically deleted after

	#  an Access-Reject or Access-Accept is sent.

	#

	update {

		&reply: += &session-state:

	}

	#  Create the CUI value and add the attribute to Access-Accept.

	#  Uncomment the line below if *returning* the CUI.

#	cui

	# For Exec-Program and Exec-Program-Wait

#	exec

	#	update request {

	#	       WiMAX-MN-NAI = "%{User-Name}"

	#	}

	#

	#  If you want various keys to be calculated, you will need to

	#  update the reply with "template" values.  The module will see

	#  this, and replace the template values with the correct ones

	#  taken from the cryptographic calculations.  e.g.

	#

	# 	update reply {

	#		WiMAX-FA-RK-Key = 0x00

	#		WiMAX-MSK = "%{EAP-MSK}"

	#	}

	#

	#  You may want to delete the MS-MPPE-*-Keys from the reply,

	#  as some WiMAX clients behave badly when those attributes

	#  are included.  See "raddb/modules/wimax", configuration

	#  entry "delete_mppe_keys" for more information.

	#

	#  If there is a client certificate (EAP-TLS, sometimes PEAP

	#  and TTLS), then some attributes are filled out after the

	#  certificate verification has been performed.  These fields

	#  MAY be available during the authentication, or they may be

	#  available only in the "post-auth" section.

	#

	#  The first set of attributes contains information about the

	#  issuing certificate which is being used.  The second

	#  contains information about the client certificate (if

	#  available).

#

#	update reply {

#	       Reply-Message += "%{TLS-Cert-Serial}"

#	       Reply-Message += "%{TLS-Cert-Expiration}"

#	       Reply-Message += "%{TLS-Cert-Subject}"

#	       Reply-Message += "%{TLS-Cert-Issuer}"

#	       Reply-Message += "%{TLS-Cert-Common-Name}"

#	       Reply-Message += "%{TLS-Cert-Subject-Alt-Name-Email}"

#

#	       Reply-Message += "%{TLS-Client-Cert-Serial}"

#	       Reply-Message += "%{TLS-Client-Cert-Expiration}"

#	       Reply-Message += "%{TLS-Client-Cert-Subject}"

#	       Reply-Message += "%{TLS-Client-Cert-Issuer}"

#	       Reply-Message += "%{TLS-Client-Cert-Common-Name}"

#	       Reply-Message += "%{TLS-Client-Cert-Subject-Alt-Name-Email}"

#	}

	#  Insert class attribute (with unique value) into response,

	#  aids matching auth and acct records, and protects against duplicate

	#  Acct-Session-Id. Note: Only works if the NAS has implemented

	#  RFC 2865 behaviour for the class attribute, AND if the NAS

	#  supports long Class attributes.  Many older or cheap NASes

	#  only support 16-octet Class attributes.

#	insert_acct_class

	#  MacSEC requires the use of EAP-Key-Name.  However, we don't

	#  want to send it for all EAP sessions.  Therefore, the EAP

	#  modules put required data into the EAP-Session-Id attribute.

	#  This attribute is never put into a request or reply packet.

	#

	#  Uncomment the next few lines to copy the required data into

	#  the EAP-Key-Name attribute

#	if (&reply:EAP-Session-Id) {

#		update reply {

#			EAP-Key-Name := &reply:EAP-Session-Id

#	}

	#  Remove reply message if the response contains an EAP-Message

	remove_reply_message_if_eap

	#  The "session-state" attributes are not available here.

	#

		# log failed authentications in SQL, too.

		sql

		# Insert EAP-Failure message if the request was

		# rejected by policy instead of because of an

		# authentication failure

#		eap

		#  Remove reply message if the response contains an EAP-Message

#		remove_reply_message_if_eap

	#

	#  Filter access challenges.

	#

	Post-Auth-Type Challenge {

#		remove_reply_message_if_eap

#		attr_filter.access_challenge.post-auth

	}

	# Before proxing the request add an Operator-Name attribute identifying

	# if the operator-name is found for this client.

	# No need to uncomment this if you have already enabled this in

	# the authorize section.

	#  The client requests the CUI by sending a CUI attribute

	#  containing one zero byte.

	#  Uncomment the line below if *requesting* the CUI.

#	cui