1 #Master config file, must be in /etc/radsecproxy or specified with -c option
2 # All possible config options are listed below
4 # First you may define any global options, these are:
6 # You can optionally specify addresses and ports to listen on
7 # Max one of each, below are just multiple examples
10 #listenTCP 10.10.10.10:2084
11 #ListenTCP [2001:700:1:7:215:f2ff:fe35:307d]:2084
12 # To listen to the default or other Accounting port for UDP you need e.g.
13 #ListenAccountingUDP *:1813
15 # To specify a certain address/port for UDP/TLS requests you can use e.g.
16 #SourceUDP 127.0.0.1:33000
18 # Optional log level. 3 is default, 1 is less, 4 is more
20 #Optional LogDestinatinon, else stderr used for logging
22 #LogDestination file:///tmp/rp.log
23 # Or logging with Syslog. LOG_DAEMON used if facility not specified
24 # The supported facilities are LOG_DAEMON, LOG_MAIL, LOG_USER and
25 # LOG_LOCAL0, ..., LOG_LOCAL7
26 #LogDestination x-syslog:///
27 #LogDestination x-syslog:///log_local2
29 #There is an option for doing some simple loop prevention
32 #If we have TLS clients or servers we must define at least one tls block.
33 #You can name them whatever you like and then reference them by name when
34 #specifying clients or servers later. There are however three special names
35 #"default", "defaultclient" and "defaultserver". If no name is defined for
36 #a client, the "defaultclient" block will be used if it exists, if not the
37 #"default" will be used. For a server, "defaultserver" followed by "default"
40 #The simplest configuration you can do is:
42 # You must specify at least one of CACertificateFile or CACertificatePath
43 # for TLS to work. We always verify peer certificate (client and server)
44 # CACertificateFile /etc/cacerts/CA.pem
45 CACertificatePath /etc/cacerts
47 # You must specify the below for TLS, we always present our certificate
48 CertificateFile /etc/hostcertkey/host.example.com.pem
49 CertificateKeyFile /etc/hostcertkey/host.example.com.key.pem
50 # Optionally specify password if key is encrypted (not very secure)
51 CertificateKeyPassword "follow the white rabbit"
52 # Optionally enable CRL checking
56 #If you want one cert for all clients and another for all servers, use
57 #defaultclient and defaultserver instead of default. If we wanted some
58 #particular server to use something else you could specify a block
59 #"tls myserver" and then reference that for that server. If you always
60 #name the tls block in the client/server config you don't need a default
62 #Now we configure clients, servers and realms. Note that these and
63 #also the lines above may be in any order, except that a realm
64 #can only be configured to use a server that is previously configured.
66 #A realm can be a literal domain name, * which matches all, or a
67 #regexp. A regexp is specified by the character prefix /
68 #For regexp we do case insensitive matching of the entire username string.
69 #The matching of realms is done in the order they are specified, using the
70 #first match found. Some examples are
71 #"@example\.com$", "\.com$", ".*" and "^[a-z].*@example\.com$".
72 #To treat local users separately you might try first specifying "@"
78 #we could specify tls here, e.g.
80 #in order to use tls parameters named myclient. We don't, so we will
81 #use "tls defaultclient" if defined, or look for "tls default" as a
88 client radius.example.com {
90 # secret is optional for TLS
99 # If also want to use this server for accounting, specify
100 # accountingServer 127.0.0.1
106 # secret is optional for TLS
107 #we could specify tls here, e.g.
109 #in order to use tls parameters named myserver. We don't, so we will
110 #use "tls defaultserver" if defined, or look for "tls default" as a
113 server radius.example.com {
117 # statusserver is optional, can be on or off. Off is default
120 # Equivalent to example.com
121 realm /@example\.com$ {
124 # One can define a realm without servers, the proxy will then reject
125 # and requests matching this. Optionally one can specify ReplyMessage
126 # attribute to be included in the reject message. One can also use
127 # AccountingResponse option to specify that the proxy should send such.
131 replymessage "No Access"
132 # AccountingResponse On
134 # The realm below is equivalent to /.*
136 server radius.example.com
138 #If you don't have a default server you probably want to
139 #reject all unknowns. Optionally you can also include a message
141 # replymessage "User unknown"