3 ## clients.conf -- client configuration directives
7 #######################################################################
9 # Define RADIUS clients (usually a NAS, Access Point, etc.).
12 # Defines a RADIUS client.
14 # '127.0.0.1' is another name for 'localhost'. It is enabled by default,
15 # to allow testing of the server after an initial installation. If you
16 # are not going to be permitting RADIUS queries from localhost, we suggest
17 # that you delete, or comment out, this entry.
22 # Each client has a "short name" that is used to distinguish it from
25 # In version 1.x, the string after the word "client" was the IP
26 # address of the client. In 2.0, the IP address is configured via
27 # the "ipaddr" or "ipv6addr" fields. For compatibility, the 1.x
28 # format is still accepted.
32 # dotted quad (1.2.3.4)
33 # hostname (radius.example.com)
36 # OR, you can use an IPv6 address, but not both
38 # ipv6addr = :: # any. ::1 == localhost
41 # The transport protocol.
43 # If unspecified, defaults to "udp", which is the traditional
44 # RADIUS transport. It may also be "tcp", in which case the
45 # server will accept connections from this client ONLY over TCP.
50 # A note on DNS: We STRONGLY recommend using IP addresses
51 # rather than host names. Using host names means that the
52 # server will do DNS lookups when it starts, making it
53 # dependent on DNS. i.e. If anything goes wrong with DNS,
54 # the server won't start!
56 # The server also looks up the IP address from DNS once, and
57 # only once, when it starts. If the DNS record is later
58 # updated, the server WILL NOT see that update.
61 # One client definition can be applied to an entire network.
62 # e.g. 127/8 should be defined with "ipaddr = 127.0.0.0" and
65 # If not specified, the default netmask is 32 (i.e. /32)
67 # We do NOT recommend using anything other than 32. There
68 # are usually other, better ways to achieve the same goal.
69 # Using netmasks of other than 32 can cause security issues.
71 # You can specify overlapping networks (127/8 and 127.0/16)
72 # In that case, the smallest possible network will be used
73 # as the "best match" for the client.
75 # Clients can also be defined dynamically at run time, based
76 # on any criteria. e.g. SQL lookups, keying off of NAS-Identifier,
78 # See raddb/sites-available/dynamic-clients for details.
84 # The shared secret use to "encrypt" and "sign" packets between
85 # the NAS and FreeRADIUS. You MUST change this secret from the
86 # default, otherwise it's not a secret any more!
88 # The secret can be any string, up to 8k characters in length.
90 # Control codes can be entered vi octal encoding,
91 # e.g. "\101\102" == "AB"
92 # Quotation marks can be entered by escaping them,
95 # A note on security: The security of the RADIUS protocol
96 # depends COMPLETELY on this secret! We recommend using a
97 # shared secret that is composed of:
103 # And is at LEAST 8 characters long, preferably 16 characters in
104 # length. The secret MUST be random, and should not be words,
105 # phrase, or anything else that is recognizable.
107 # The default secret below is only for testing, and should
108 # not be used in any real environment.
113 # Old-style clients do not send a Message-Authenticator
114 # in an Access-Request. RFC 5080 suggests that all clients
115 # SHOULD include it in an Access-Request. The configuration
116 # item below allows the server to require it. If a client
117 # is required to include a Message-Authenticator and it does
118 # not, then the packet will be silently discarded.
120 # allowed values: yes, no
121 require_message_authenticator = no
124 # The short name is used as an alias for the fully qualified
125 # domain name, or the IP address.
127 # It is accepted for compatibility with 1.x, but it is no
128 # longer necessary in 2.0
130 # shortname = localhost
133 # the following three fields are optional, but may be used by
134 # checkrad.pl for simultaneous use checks
138 # The nastype tells 'checkrad.pl' which NAS-specific method to
139 # use to query the NAS for simultaneous use.
141 # Permitted NAS types are:
155 # other # for all other types
158 nastype = other # localhost isn't usually a NAS...
161 # The following two configurations are for future use.
162 # The 'naspasswd' file is currently used to store the NAS
163 # login name and password, which is used by checkrad.pl
164 # when querying the NAS for simultaneous use.
167 # password = someadminpas
170 # As of 2.0, clients can also be tied to a virtual server.
171 # This is done by setting the "virtual_server" configuration
172 # item, as in the example below.
174 # virtual_server = home1
177 # A pointer to the "home_server_pool" OR a "home_server"
178 # section that contains the CoA configuration for this
179 # client. For an example of a coa home server or pool,
180 # see raddb/sites-available/originate-coa
184 # Connection limiting for clients using "proto = tcp".
186 # This section is ignored for clients sending UDP traffic
190 # Limit the number of simultaneous TCP connections from a client
193 # Setting this to 0 means "no limit"
196 # The per-socket "max_requests" option does not exist.
199 # The lifetime, in seconds, of a TCP connection. After
200 # this lifetime, the connection will be closed.
202 # Setting this to 0 means "forever".
206 # The idle timeout, in seconds, of a TCP connection.
207 # If no packets have been received over the connection for
208 # this time, the connection will be closed.
210 # Setting this to 0 means "no timeout".
212 # We STRONGLY RECOMMEND that you set an idle timeout.
220 # secret = testing123
221 # shortname = localhost
224 # All IPv6 Site-local clients
226 # secret = testing123
227 # shortname = localhost
230 #client some.host.org {
231 # secret = testing123
232 # shortname = localhost
236 # You can now specify one secret for a network of clients.
237 # When a client request comes in, the BEST match is chosen.
238 # i.e. The entry from the smallest possible network.
240 #client 192.168.0.0/24 {
241 # secret = testing123-1
242 # shortname = private-network-1
245 #client 192.168.0.0/16 {
246 # secret = testing123-2
247 # shortname = private-network-2
251 #client 10.10.10.10 {
252 # # secret and password are mapped through the "secrets" file.
253 # secret = testing123
255 # # the following three fields are optional, but may be used by
256 # # checkrad.pl for simultaneous usage checks
257 # nastype = livingston
259 # password = someadminpas
262 #######################################################################
264 # Per-socket client lists. The configuration entries are exactly
265 # the same as above, but they are nested inside of a section.
267 # You can have as many per-socket client lists as you have "listen"
268 # sections, or you can re-use a list among multiple "listen" sections.
270 # Un-comment this section, and edit a "listen" section to add:
271 # "clients = per_socket_clients". That IP address/port combination
272 # will then accept ONLY the clients listed in this section.
274 #clients per_socket_clients {
275 # client 192.168.3.4 {
276 # secret = testing123