3 ## radiusd.conf -- FreeRADIUS server configuration file - @RADIUSD_VERSION@
5 ## http://www.freeradius.org/
9 ######################################################################
11 # Read "man radiusd" before editing this file. See the section
12 # titled DEBUGGING. It outlines a method where you can quickly
13 # obtain the configuration you want, without running into
16 # Run the server in debugging mode, and READ the output.
20 # We cannot emphasize this point strongly enough. The vast
21 # majority of problems can be solved by carefully reading the
22 # debugging output, which includes warnings about common issues,
23 # and suggestions for how they may be fixed.
25 # There may be a lot of output, but look carefully for words like:
26 # "warning", "error", "reject", or "failure". The messages there
27 # will usually be enough to guide you to a solution.
29 # If you are going to ask a question on the mailing list, then
30 # explain what you are trying to do, and include the output from
31 # debugging mode (radiusd -X). Failure to do so means that all
32 # of the responses to your question will be people telling you
33 # to "post the output of radiusd -X".
35 ######################################################################
37 # The location of other config files and logfiles are declared
40 # Also general configuration for modules can be done in this
41 # file, it is exported through the API to modules that ask for
44 # See "man radiusd.conf" for documentation on the format of this
45 # file. Note that the individual configuration items are NOT
46 # documented in that "man" page. They are only documented here,
49 # As of 2.0.0, FreeRADIUS supports a simple processing language
50 # in the "authorize", "authenticate", "accounting", etc. sections.
51 # See "man unlang" for details.
55 exec_prefix = @exec_prefix@
56 sysconfdir = @sysconfdir@
57 localstatedir = @localstatedir@
61 radacctdir = @radacctdir@
64 # name of the running server. See also the "-n" command-line option.
67 # Location of config and logfiles.
69 certdir = ${confdir}/certs
70 cadir = ${confdir}/certs
71 run_dir = ${localstatedir}/run/${name}
73 # Should likely be ${localstatedir}/lib/radiusd
77 # libdir: Where to find the rlm_* modules.
79 # This should be automatically set at configuration time.
81 # If the server builds and installs, but fails at execution time
82 # with an 'undefined symbol' error, then you can use the libdir
83 # directive to work around the problem.
85 # The cause is usually that a library has been installed on your
86 # system in a place where the dynamic linker CANNOT find it. When
87 # executing as root (or another user), your personal environment MAY
88 # be set up to allow the dynamic linker to find the library. When
89 # executing as a daemon, FreeRADIUS MAY NOT have the same
90 # personalized configuration.
92 # To work around the problem, find out which library contains that symbol,
93 # and add the directory containing that library to the end of 'libdir',
94 # with a colon separating the directory names. NO spaces are allowed.
96 # e.g. libdir = /usr/local/lib:/opt/package/lib
98 # You can also try setting the LD_LIBRARY_PATH environment variable
99 # in a script which starts the server.
101 # If that does not work, then you can re-configure and re-build the
102 # server to NOT use shared libraries, via:
104 # ./configure --disable-shared
110 # pidfile: Where to place the PID of the RADIUS server.
112 # The server may be signalled while it's running by using this
115 # This file is written when ONLY running in daemon mode.
117 # e.g.: kill -HUP `cat /var/run/radiusd/radiusd.pid`
119 pidfile = ${run_dir}/${name}.pid
121 # max_request_time: The maximum time (in seconds) to handle a request.
123 # Requests which take more time than this to process may be killed, and
124 # a REJECT message is returned.
126 # WARNING: If you notice that requests take a long time to be handled,
127 # then this MAY INDICATE a bug in the server, in one of the modules
128 # used to handle a request, OR in your local configuration.
130 # This problem is most often seen when using an SQL database. If it takes
131 # more than a second or two to receive an answer from the SQL database,
132 # then it probably means that you haven't indexed the database. See your
133 # SQL server documentation for more information.
135 # Useful range of values: 5 to 120
137 max_request_time = 30
139 # cleanup_delay: The time to wait (in seconds) before cleaning up
140 # a reply which was sent to the NAS.
142 # The RADIUS request is normally cached internally for a short period
143 # of time, after the reply is sent to the NAS. The reply packet may be
144 # lost in the network, and the NAS will not see it. The NAS will then
145 # re-send the request, and the server will respond quickly with the
148 # If this value is set too low, then duplicate requests from the NAS
149 # MAY NOT be detected, and will instead be handled as seperate requests.
151 # If this value is set too high, then the server will cache too many
152 # requests, and some new requests may get blocked. (See 'max_requests'.)
154 # Useful range of values: 2 to 10
158 # max_requests: The maximum number of requests which the server keeps
159 # track of. This should be 256 multiplied by the number of clients.
160 # e.g. With 4 clients, this number should be 1024.
162 # If this number is too low, then when the server becomes busy,
163 # it will not respond to any new requests, until the 'cleanup_delay'
164 # time has passed, and it has removed the old requests.
166 # If this number is set too high, then the server will use a bit more
167 # memory for no real benefit.
169 # If you aren't sure what it should be set to, it's better to set it
170 # too high than too low. Setting it to 1000 per client is probably
171 # the highest it should be.
173 # Useful range of values: 256 to infinity
177 # listen: Make the server listen on a particular IP address, and send
178 # replies out from that address. This directive is most useful for
179 # hosts with multiple IP addresses on one interface.
181 # If you want the server to listen on additional addresses, or on
182 # additionnal ports, you can use multiple "listen" sections.
184 # Each section make the server listen for only one type of packet,
185 # therefore authentication and accounting have to be configured in
186 # different sections.
188 # The server ignore all "listen" section if you are using '-i' and '-p'
189 # on the command line.
192 # Type of packets to listen for.
193 # Allowed values are:
194 # auth listen for authentication packets
195 # acct listen for accounting packets
196 # proxy IP to use for sending proxied packets
197 # detail Read from the detail file. For examples, see
198 # raddb/sites-available/copy-acct-to-home-server
199 # status listen for Status-Server packets. For examples,
200 # see raddb/sites-available/status
201 # coa listen for CoA-Request and Disconnect-Request
202 # packets. For examples, see the file
203 # raddb/sites-available/coa-server
207 # Note: "type = proxy" lets you control the source IP used for
208 # proxying packets, with some limitations:
210 # * A proxy listener CANNOT be used in a virtual server section.
211 # * You should probably set "port = 0".
212 # * Any "clients" configuration will be ignored.
214 # See also proxy.conf, and the "src_ipaddr" configuration entry
215 # in the sample "home_server" section. When you specify the
216 # source IP address for packets sent to a home server, the
217 # proxy listeners are automatically created.
219 # IP address on which to listen.
220 # Allowed values are:
221 # dotted quad (1.2.3.4)
222 # hostname (radius.example.com)
226 # OR, you can use an IPv6 address, but not both
228 # ipv6addr = :: # any. ::1 == localhost
230 # Port on which to listen.
231 # Allowed values are:
232 # integer port number (1812)
233 # 0 means "use /etc/services for the proper port"
236 # Some systems support binding to an interface, in addition
237 # to the IP address. This feature isn't strictly necessary,
238 # but for sites with many IP addresses on one interface,
239 # it's useful to say "listen on all addresses for eth0".
241 # If your system does not support this feature, you will
242 # get an error if you try to use it.
246 # Per-socket lists of clients. This is a very useful feature.
248 # The name here is a reference to a section elsewhere in
249 # radiusd.conf, or clients.conf. Having the name as
250 # a reference allows multiple sockets to use the same
253 # If this configuration is used, then the global list of clients
254 # is IGNORED for this "listen" section. Take care configuring
255 # this feature, to ensure you don't accidentally disable a
258 # See clients.conf for the configuration of "per_socket_clients".
260 # clients = per_socket_clients
263 # Connection limiting for sockets with "proto = tcp".
265 # This section is ignored for other kinds of sockets.
269 # Limit the number of simultaneous TCP connections to the socket
272 # Setting this to 0 means "no limit"
275 # The per-socket "max_requests" option does not exist.
278 # The lifetime, in seconds, of a TCP connection. After
279 # this lifetime, the connection will be closed.
281 # Setting this to 0 means "forever".
285 # The idle timeout, in seconds, of a TCP connection.
286 # If no packets have been received over the connection for
287 # this time, the connection will be closed.
289 # Setting this to 0 means "no timeout".
291 # We STRONGLY RECOMMEND that you set an idle timeout.
297 # This second "listen" section is for listening on the accounting
306 # clients = per_socket_clients
308 # The number of packets received can be rate limited via the
309 # "max_pps" configuration item. When it is set, the server
310 # tracks the total number of packets received in the previous
311 # second. If the count is greater than "max_pps", then the
312 # new packet is silently discarded. This helps the server
313 # deal with overload situations.
315 # The packets/s counter is tracked in a sliding window. This
316 # means that the pps calculation is done for the second
317 # before the current packet was received. NOT for the current
318 # wall-clock second, and NOT for the previous wall-clock second.
320 # Useful values are 0 (no limit), or 100 to 10000.
321 # Values lower than 100 will likely cause the server to ignore
322 # normal traffic. Few systems are capable of handling more than
325 # It is most useful for accounting systems. Set it to 50%
326 # more than the normal accounting load, and you can be sure that
327 # the server will never get overloaded
332 # hostname_lookups: Log the names of clients or just their IP addresses
333 # e.g., www.freeradius.org (on) or 206.47.27.232 (off).
335 # The default is 'off' because it would be overall better for the net
336 # if people had to knowingly turn this feature on, since enabling it
337 # means that each client request will result in AT LEAST one lookup
338 # request to the nameserver. Enabling hostname_lookups will also
339 # mean that your server may stop randomly for 30 seconds from time
340 # to time, if the DNS requests take too long.
342 # Turning hostname lookups off also means that the server won't block
343 # for 30 seconds, if it sees an IP address which has no name associated
346 # allowed values: {no, yes}
348 hostname_lookups = no
351 # Logging section. The various "log_*" configuration items
352 # will eventually be moved here.
356 # Destination for log messages. This can be one of:
358 # files - log to "file", as defined below.
359 # syslog - to syslog (see also the "syslog_facility", below.
360 # stdout - standard output
361 # stderr - standard error.
363 # The command-line option "-X" over-rides this option, and forces
364 # logging to go to stdout.
369 # The logging messages for the server are appended to the
370 # tail of this file if destination == "files"
372 # If the server is running in debugging mode, this file is
375 file = ${logdir}/radius.log
378 # If this configuration parameter is set, then log messages for
379 # a *request* go to this file, rather than to radius.log.
381 # i.e. This is a log file per request, once the server has accepted
382 # the request as being from a valid client. Messages that are
383 # not associated with a request still go to radius.log.
385 # Not all log messages in the server core have been updated to use
386 # this new internal API. As a result, some messages will still
387 # go to radius.log. Please submit patches to fix this behavior.
389 # The file name is expanded dynamically. You should ONLY user
390 # server-side attributes for the filename (e.g. things you control).
391 # Using this feature MAY also slow down the server substantially,
392 # especially if you do thinks like SQL calls as part of the
393 # expansion of the filename.
395 # The name of the log file should use attributes that don't change
396 # over the lifetime of a request, such as User-Name,
397 # Virtual-Server or Packet-Src-IP-Address. Otherwise, the log
398 # messages will be distributed over multiple files.
400 # Logging can be enabled for an individual request by a special
401 # dynamic expansion macro: %{debug: 1}, where the debug level
402 # for this request is set to '1' (or 2, 3, etc.). e.g.
406 # Tmp-String-0 = "%{debug:1}"
410 # The attribute that the value is assigned to is unimportant,
411 # and should be a "throw-away" attribute with no side effects.
413 #requests = ${logdir}/radiusd-%{%{Virtual-Server}:-DEFAULT}-%Y%m%d.log
416 # Which syslog facility to use, if ${destination} == "syslog"
418 # The exact values permitted here are OS-dependent. You probably
419 # don't want to change this.
421 syslog_facility = daemon
423 # Log the full User-Name attribute, as it was found in the request.
425 # allowed values: {no, yes}
429 # Log authentication requests to the log file.
431 # allowed values: {no, yes}
435 # Log passwords with the authentication requests.
436 # auth_badpass - logs password if it's rejected
437 # auth_goodpass - logs password if it's correct
439 # allowed values: {no, yes}
444 # Log additional text at the end of the "Login OK" messages.
445 # for these to work, the "auth" and "auth_goopass" or "auth_badpass"
446 # configurations above have to be set to "yes".
448 # The strings below are dynamically expanded, which means that
449 # you can put anything you want in them. However, note that
450 # this expansion can be slow, and can negatively impact server
457 # The program to execute to do concurrency checks.
458 checkrad = ${sbindir}/checkrad
460 # SECURITY CONFIGURATION
462 # There may be multiple methods of attacking on the server. This
463 # section holds the configuration items which minimize the impact
467 # chroot: directory where the server does "chroot".
469 # The chroot is done very early in the process of starting
470 # the server. After the chroot has been performed it
471 # switches to the "user" listed below (which MUST be
472 # specified). If "group" is specified, it switches to that
473 # group, too. Any other groups listed for the specified
474 # "user" in "/etc/group" are also added as part of this
477 # The current working directory (chdir / cd) is left
478 # *outside* of the chroot until all of the modules have been
479 # initialized. This allows the "raddb" directory to be left
480 # outside of the chroot. Once the modules have been
481 # initialized, it does a "chdir" to ${logdir}. This means
482 # that it should be impossible to break out of the chroot.
484 # If you are worried about security issues related to this
485 # use of chdir, then simply ensure that the "raddb" directory
486 # is inside of the chroot, end be sure to do "cd raddb"
487 # BEFORE starting the server.
489 # If the server is statically linked, then the only files
490 # that have to exist in the chroot are ${run_dir} and
491 # ${logdir}. If you do the "cd raddb" as discussed above,
492 # then the "raddb" directory has to be inside of the chroot
495 # chroot = /path/to/chroot/directory
497 # user/group: The name (or #number) of the user/group to run radiusd as.
499 # If these are commented out, the server will run as the
500 # user/group that started it. In order to change to a
501 # different user/group, you MUST be root ( or have root
502 # privleges ) to start the server.
504 # We STRONGLY recommend that you run the server with as few
505 # permissions as possible. That is, if you're not using
506 # shadow passwords, the user and group items below should be
509 # NOTE that some kernels refuse to setgid(group) when the
510 # value of (unsigned)group is above 60000; don't use group
511 # "nobody" on these systems!
513 # On systems with shadow passwords, you might have to set
514 # 'group = shadow' for the server to be able to read the
515 # shadow password file. If you can authenticate users while
516 # in debug mode, but not in daemon mode, it may be that the
517 # debugging mode server is running as a user that can read
518 # the shadow info, and the user listed below can not.
520 # The server will also try to use "initgroups" to read
521 # /etc/groups. It will join all groups where "user" is a
522 # member. This can allow for some finer-grained access
528 # Core dumps are a bad thing. This should only be set to
529 # 'yes' if you're debugging a problem with the server.
531 # allowed values: {no, yes}
533 allow_core_dumps = no
536 # max_attributes: The maximum number of attributes
537 # permitted in a RADIUS packet. Packets which have MORE
538 # than this number of attributes in them will be dropped.
540 # If this number is set too low, then no RADIUS packets
543 # If this number is set too high, then an attacker may be
544 # able to send a small number of packets which will cause
545 # the server to use all available memory on the machine.
547 # Setting this number to 0 means "allow any number of attributes"
551 # reject_delay: When sending an Access-Reject, it can be
552 # delayed for a few seconds. This may help slow down a DoS
553 # attack. It also helps to slow down people trying to brute-force
554 # crack a users password.
556 # Setting this number to 0 means "send rejects immediately"
558 # If this number is set higher than 'cleanup_delay', then the
559 # rejects will be sent at 'cleanup_delay' time, when the request
560 # is deleted from the internal cache of requests.
562 # Useful ranges: 1 to 5
566 # status_server: Whether or not the server will respond
567 # to Status-Server requests.
569 # When sent a Status-Server message, the server responds with
570 # an Access-Accept or Accounting-Response packet.
572 # This is mainly useful for administrators who want to "ping"
573 # the server, without adding test users, or creating fake
574 # accounting packets.
576 # It's also useful when a NAS marks a RADIUS server "dead".
577 # The NAS can periodically "ping" the server with a Status-Server
578 # packet. If the server responds, it must be alive, and the
579 # NAS can start using it for real requests.
581 # See also raddb/sites-available/status
586 # PROXY CONFIGURATION
588 # proxy_requests: Turns proxying of RADIUS requests on or off.
590 # The server has proxying turned on by default. If your system is NOT
591 # set up to proxy requests to another server, then you can turn proxying
592 # off here. This will save a small amount of resources on the server.
594 # If you have proxying turned off, and your configuration files say
595 # to proxy a request, then an error message will be logged.
597 # To disable proxying, change the "yes" to "no", and comment the
600 # allowed values: {no, yes}
606 # CLIENTS CONFIGURATION
608 # Client configuration is defined in "clients.conf".
611 # The 'clients.conf' file contains all of the information from the old
612 # 'clients' and 'naslist' configuration files. We recommend that you
613 # do NOT use 'client's or 'naslist', although they are still
616 # Anything listed in 'clients.conf' will take precedence over the
617 # information from the old-style configuration files.
619 $INCLUDE clients.conf
622 # THREAD POOL CONFIGURATION
624 # The thread pool is a long-lived group of threads which
625 # take turns (round-robin) handling any incoming requests.
627 # You probably want to have a few spare threads around,
628 # so that high-load situations can be handled immediately. If you
629 # don't have any spare threads, then the request handling will
630 # be delayed while a new thread is created, and added to the pool.
632 # You probably don't want too many spare threads around,
633 # otherwise they'll be sitting there taking up resources, and
634 # not doing anything productive.
636 # The numbers given below should be adequate for most situations.
639 # Number of servers to start initially --- should be a reasonable
643 # Limit on the total number of servers running.
645 # If this limit is ever reached, clients will be LOCKED OUT, so it
646 # should NOT BE SET TOO LOW. It is intended mainly as a brake to
647 # keep a runaway server from taking the system with it as it spirals
650 # You may find that the server is regularly reaching the
651 # 'max_servers' number of threads, and that increasing
652 # 'max_servers' doesn't seem to make much difference.
654 # If this is the case, then the problem is MOST LIKELY that
655 # your back-end databases are taking too long to respond, and
656 # are preventing the server from responding in a timely manner.
658 # The solution is NOT do keep increasing the 'max_servers'
659 # value, but instead to fix the underlying cause of the
660 # problem: slow database, or 'hostname_lookups=yes'.
662 # For more information, see 'max_request_time', above.
666 # Server-pool size regulation. Rather than making you guess
667 # how many servers you need, FreeRADIUS dynamically adapts to
668 # the load it sees, that is, it tries to maintain enough
669 # servers to handle the current load, plus a few spare
670 # servers to handle transient load spikes.
672 # It does this by periodically checking how many servers are
673 # waiting for a request. If there are fewer than
674 # min_spare_servers, it creates a new spare. If there are
675 # more than max_spare_servers, some of the spares die off.
676 # The default values are probably OK for most sites.
678 min_spare_servers = 3
679 max_spare_servers = 10
681 # When the server receives a packet, it places it onto an
682 # internal queue, where the worker threads (configured above)
683 # pick it up for processing. The maximum size of that queue
686 # When the queue is full, any new packets will be silently
689 # The most common cause of the queue being full is that the
690 # server is dependent on a slow database, and it has received
691 # a large "spike" of traffic. When that happens, there is
692 # very little you can do other than make sure the server
693 # receives less traffic, or make sure that the database can
696 # max_queue_size = 65536
698 # There may be memory leaks or resource allocation problems with
699 # the server. If so, set this value to 300 or so, so that the
700 # resources will be cleaned up periodically.
702 # This should only be necessary if there are serious bugs in the
703 # server which have not yet been fixed.
705 # '0' is a special value meaning 'infinity', or 'the servers never
707 max_requests_per_server = 0
709 # Automatically limit the number of accounting requests.
710 # This configuration item tracks how many requests per second
711 # the server can handle. It does this by tracking the
712 # packets/s received by the server for processing, and
713 # comparing that to the packets/s handled by the child
716 # If the received PPS is larger than the processed PPS, *and*
717 # the queue is more than half full, then all new accounting
718 # requests are discarded. This lowers the received rate,
719 # and over time allows the server to "catch up" to the traffic.
724 # MODULE CONFIGURATION
726 # The names and configuration of each module is located in this section.
728 # After the modules are defined here, they may be referred to by name,
729 # in other sections of this configuration file.
733 # Each module has a configuration as follows:
735 # name [ instance ] {
736 # config_item = value
740 # The 'name' is used to load the 'rlm_name' library
741 # which implements the functionality of the module.
743 # The 'instance' is optional. To have two different instances
744 # of a module, it first must be referred to by 'name'.
745 # The different copies of the module are then created by
746 # inventing two 'instance' names, e.g. 'instance1' and 'instance2'
748 # The instance names can then be used in later configuration
749 # INSTEAD of the original 'name'. See the 'radutmp' configuration
754 # As of 3.0, modules are in mods-enabled/. Files matching
755 # the regex /[a-zA-Z0-9_.]+/ are loaded. The modules are
756 # initialized ONLY if they are referenced in a processing
757 # section, such as authorize, authenticate, accounting,
758 # pre/post-proxy, etc.
760 $INCLUDE ${confdir}/mods-enabled/
765 # This section orders the loading of the modules. Modules
766 # listed here will get loaded BEFORE the later sections like
767 # authorize, authenticate, etc. get examined.
769 # This section is not strictly needed. When a section like
770 # authorize refers to a module, it's automatically loaded and
771 # initialized. However, some modules may not be listed in any
772 # of the following sections, so they can be listed here.
774 # Also, listing modules here ensures that you have control over
775 # the order in which they are initalized. If one module needs
776 # something defined by another module, you can list them in order
777 # here, and ensure that the configuration will be OK.
781 # Allows the execution of external scripts.
782 # The entire command line (and output) must fit into 253 bytes.
784 # e.g. Framed-Pool = `%{exec:/bin/echo foo}`
788 # The expression module doesn't do authorization,
789 # authentication, or accounting. It only does dynamic
790 # translation, of the form:
792 # Session-Timeout = `%{expr:2 + 3}`
794 # So the module needs to be instantiated, but CANNOT be
795 # listed in any other section. See 'doc/rlm_expr' for
801 # We add the counter module here so that it registers
802 # the check-name attribute before any module which sets
808 # subsections here can be thought of as "virtual" modules.
810 # e.g. If you have two redundant SQL servers, and you want to
811 # use them in the authorize and accounting sections, you could
812 # place a "redundant" block in each section, containing the
813 # exact same text. Or, you could uncomment the following
814 # lines, and list "redundant_sql" in the authorize and
815 # accounting sections.
817 #redundant redundant_sql {
823 ######################################################################
825 # Policies are virtual modules, similar to those defined in the
826 # "instantate" section above.
828 # Defining a policy in one of the policy.d files means that it can be
829 # referenced in multiple places as a *name*, rather than as a series of
830 # conditions to match, and actions to take.
832 # Policies are something like subroutines in a normal language, but
833 # they cannot be called recursively. They MUST be defined in order.
834 # If policy A calls policy B, then B MUST be defined before A.
836 ######################################################################
841 ######################################################################
843 # SNMP notificiations. Uncomment the following line to enable
844 # snmptraps. Note that you MUST also configure the full path
845 # to the "snmptrap" command in the "trigger.conf" file.
847 #$INCLUDE trigger.conf
849 ######################################################################
851 # Load virtual servers.
853 # This next $INCLUDE line loads files in the directory that
854 # match the regular expression: /[a-zA-Z0-9_.]+/
856 # It allows you to define new virtual servers simply by placing
857 # a file into the raddb/sites-enabled/ directory.
859 $INCLUDE sites-enabled/
861 ######################################################################
863 # All of the other configuration sections like "authorize {}",
864 # "authenticate {}", "accounting {}", have been moved to the
867 # raddb/sites-available/default
869 # This is the "default" virtual server that has the same
870 # configuration as in version 1.0.x and 1.1.x. The default
871 # installation enables this virtual server. You should
872 # edit it to create policies for your local site.
874 # For more documentation on virtual servers, see:
876 # raddb/sites-available/README
878 ######################################################################