3 ## clients.conf -- client configuration directives
7 #######################################################################
9 # Definition of a RADIUS client (usually a NAS).
11 # The information given here over rides anything given in the
12 # 'clients' file, or in the 'naslist' file. The configuration here
13 # contains all of the information from those two files, and allows
14 # for more configuration items.
16 # The "shortname" is be used for logging. The "nastype", "login" and
17 # "password" fields are mainly used for checkrad and are optional.
21 # Defines a RADIUS client.
23 # '127.0.0.1' is another name for 'localhost'. It is enabled by default,
24 # to allow testing of the server after an initial installation. If you
25 # are not going to be permitting RADIUS queries from localhost, we suggest
26 # that you delete, or comment out, this entry.
31 # Each client has a "short name" that is used to distinguish it from
34 # In version 1.x, this field was the IP address of the client.
35 # In 2.0, the IP address is configured via the "ipaddr" or "ipv6addr"
36 # fields. For compatibility, the 1.x format is still accepted.
40 # dotted quad (1.2.3.4)
41 # hostname (radius.example.com)
44 # OR, you can use an IPv6 address, but not both
46 # ipv6addr = :: # any. ::1 == localhost
49 # A note on DNS: We STRONGLY recommend using IP addresses
50 # rather than host names. Using host names means that the
51 # server will do DNS lookups when it starts, making it
52 # dependent on DNS. i.e. If anything goes wrong with DNS,
53 # the server won't start!
55 # The server also looks up the IP address from DNS once, and
56 # only once, when it starts. If the DNS record is later
57 # updated, the server WILL NOT see that update.
60 # One client definition can be applied to an entire network.
61 # e.g. 127/8 should be defined with "ipaddr = 127.0.0.0" and
64 # If not specified, the default netmask is 32 (i.e. /32)
66 # We do NOT recommend using anything other than 32. There
67 # are usually other, better ways to acheive the same goal.
68 # Using netmasks of other than 32 can cause security issues.
70 # You can specify overlapping networks (127/8 and 127.0/16)
71 # In that case, the smallest possible network will be used
72 # as the "best match" for the client.
77 # The shared secret use to "encrypt" and "sign" packets between
78 # the NAS and FreeRADIUS. You MUST change this secret from the
79 # default, otherwise it's not a secret any more!
81 # The secret can be any string, up to 8k characters in length.
83 # Control codes can be entered vi octal encoding,
84 # e.g. "\101\102" == "AB"
85 # Quotation marks can be entered by escaping them,
88 # A note on security: The security of the RADIUS protocol
89 # depends COMPLETELY on this secret! We recommend using a
90 # shared secret that is composed of:
96 # And is at LEAST 8 characters long, preferably 16 characters in
97 # length. The secret MUST be random, and should not be words,
98 # phrase, or anything else that is recognizable.
100 # The default secret below is only for testing, and should
101 # not be used in any real environment.
106 # The short name is used as an alias for the fully qualified
107 # domain name, or the IP address.
109 # It is accepted for compatibility with 1.x, but it is no
110 # longer necessary in 2.0
112 # shortname = localhost
115 # the following three fields are optional, but may be used by
116 # checkrad.pl for simultaneous use checks
120 # The nastype tells 'checkrad.pl' which NAS-specific method to
121 # use to query the NAS for simultaneous use.
123 # Permitted NAS types are:
136 # other # for all other types
139 nastype = other # localhost isn't usually a NAS...
142 # The following two configurations are for future use.
143 # The 'naspasswd' file is currently used to store the NAS
144 # login name and password, which is used by checkrad.pl
145 # when querying the NAS for simultaneous use.
148 # password = someadminpas
151 # As of 2.0, clients can also be tied to a virtual server.
152 # This is done by setting the "server" configuration item,
153 # as in the example below.
160 # secret = testing123
161 # shortname = localhost
164 # All IPv6 Site-local clients
166 # secret = testing123
167 # shortname = localhost
170 #client some.host.org {
171 # secret = testing123
172 # shortname = localhost
176 # You can now specify one secret for a network of clients.
177 # When a client request comes in, the BEST match is chosen.
178 # i.e. The entry from the smallest possible network.
180 #client 192.168.0.0/24 {
181 # secret = testing123-1
182 # shortname = private-network-1
185 #client 192.168.0.0/16 {
186 # secret = testing123-2
187 # shortname = private-network-2
191 #client 10.10.10.10 {
192 # # secret and password are mapped through the "secrets" file.
193 # secret = testing123
195 # # the following three fields are optional, but may be used by
196 # # checkrad.pl for simultaneous usage checks
197 # nastype = livingston
199 # password = someadminpas
202 #######################################################################
204 # Per-socket client lists. The configuration entries are exactly
205 # the same as above, but they are nested inside of a section.
207 # You can have as many per-socket client lists as you have "listen"
208 # sections, or you can re-use a list among multiple "listen" sections.
210 # Un-comment this section, and edit a "listen" section to add:
211 # "clients = per_socket_clients". That IP address/port combination
212 # will then accept ONLY the clients listed in this section.
214 #per_socket_clients {
215 # client 192.168.3.4 {
216 # secret = testing123