-$INCLUDE ${confdir}/eap.conf
-
- # Microsoft CHAP authentication
- #
- # This module supports MS-CHAP and MS-CHAPv2 authentication.
- # It also enforces the SMB-Account-Ctrl attribute.
- #
- mschap {
- #
- # As of 0.9, the mschap module does NOT support
- # reading from /etc/smbpasswd.
- #
- # If you are using /etc/smbpasswd, see the 'passwd'
- # module for an example of how to use /etc/smbpasswd
-
- # if use_mppe is not set to no mschap will
- # add MS-CHAP-MPPE-Keys for MS-CHAPv1 and
- # MS-MPPE-Recv-Key/MS-MPPE-Send-Key for MS-CHAPv2
- #
- #use_mppe = no
-
- # if mppe is enabled require_encryption makes
- # encryption moderate
- #
- #require_encryption = yes
-
- # require_strong always requires 128 bit key
- # encryption
- #
- #require_strong = yes
-
- # Windows sends us a username in the form of
- # DOMAIN\user, but sends the challenge response
- # based on only the user portion. This hack
- # corrects for that incorrect behavior.
- #
- #with_ntdomain_hack = no
-
- # The module can perform authentication itself, OR
- # use a Windows Domain Controller. This configuration
- # directive tells the module to call the ntlm_auth
- # program, which will do the authentication, and return
- # the NT-Key. Note that you MUST have "winbindd" and
- # "nmbd" running on the local machine for ntlm_auth
- # to work. See the ntlm_auth program documentation
- # for details.
- #
- # Be VERY careful when editing the following line!
- #
- #ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
- }
-
- # Lightweight Directory Access Protocol (LDAP)
- #
- # This module definition allows you to use LDAP for
- # authorization and authentication.
- #
- # See doc/rlm_ldap for description of configuration options
- # and sample authorize{} and authenticate{} blocks
- #
- # However, LDAP can be used for authentication ONLY when the
- # Access-Request packet contains a clear-text User-Password
- # attribute. LDAP authentication will NOT work for any other
- # authentication method.
- #
- # This means that LDAP servers don't understand EAP. If you
- # force "Auth-Type = LDAP", and then send the server a
- # request containing EAP authentication, then authentication
- # WILL NOT WORK.
- #
- # The solution is to use the default configuration, which does
- # work.
- #
- # Setting "Auth-Type = LDAP" is ALMOST ALWAYS WRONG. We
- # really can't emphasize this enough.
- #
- ldap {
- server = "ldap.your.domain"
- #identity = "cn=admin,o=My Org,c=UA"
- #password = mypass
- basedn = "o=My Org,c=UA"
- filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
- #base_filter = "(objectclass=radiusprofile)"
-
- # How many connections to keep open to the LDAP server.
- # This saves time over opening a new LDAP socket for
- # every authentication request.
- ldap_connections_number = 5
-
- timeout = 4
- timelimit = 3
- net_timeout = 1
-
- #
- # This subsection configures the tls related items
- # that control how FreeRADIUS connects to an LDAP
- # server. It contains all of the "tls_*" configuration
- # entries used in older versions of FreeRADIUS. Those
- # configuration entries can still be used, but we recommend
- # using these.
- #
- tls {
- # Set this to 'yes' to use TLS encrypted connections
- # to the LDAP database by using the StartTLS extended
- # operation.
- #
- # The StartTLS operation is supposed to be
- # used with normal ldap connections instead of
- # using ldaps (port 689) connections
- start_tls = no
-
- # cacertfile = /path/to/cacert.pem
- # cacertdir = /path/to/ca/dir/
- # certfile = /path/to/radius.crt
- # keyfile = /path/to/radius.key
- # randfile = /path/to/rnd
- # require_cert = "demand"
- }
-
- # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA"
- # profile_attribute = "radiusProfileDn"
- # access_attr = "dialupAccess"
-
- # Mapping of RADIUS dictionary attributes to LDAP
- # directory attributes.
- dictionary_mapping = ${raddbdir}/ldap.attrmap
-
- # Set password_attribute = nspmPassword to get the
- # user's password from a Novell eDirectory
- # backend. This will work ONLY IF FreeRADIUS has been
- # built with the --with-edir configure option.
- #
- # password_attribute = userPassword
-
- # As of 1.1.0, the LDAP module will auto-discover
- # the password headers (which are non-standard).
- # It will use the following table to map passwords
- # to RADIUS attributes. The PAP module (see above)
- # can then automatically determine the hashing
- # method to use to authenticate the user.
- #
- # Header Attribute
- # ------ ---------
- # {clear} User-Password
- # {cleartext} User-Password
- # {md5} MD5-Password
- # {smd5} SMD5-Password
- # {crypt} Crypt-Password
- # {sha} SHA-Password
- # {ssha} SSHA-Password
- # {nt} NT-Password
- # {ns-mta-md5} NS-MTA-MD5-Password
- #
- #
- # The headers are compared in a case-insensitive manner.
- # The format of the password in LDAP (base 64-encoded, hex,
- # clear-text, whatever) is not that important. The PAP
- # module will figure it out.
- #
- # The default for "auto_header" is "no", to enable backwards
- # compatibility with the "password_header" directive,
- # which is now deprecated. If this is set to "yes",
- # then the above table will be used, and the
- # "password_header" directive will be ignored.
-
- #auto_header = yes
-
- # Un-comment the following to disable Novell
- # eDirectory account policy check and intruder
- # detection. This will work *only if* FreeRADIUS is
- # configured to build with --with-edir option.
- #
- #edir_account_policy_check = no
-
- #
- # Group membership checking. Disabled by default.
- #
- # groupname_attribute = cn
- # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"
- # groupmembership_attribute = radiusGroupName
-
- # compare_check_items = yes
- # do_xlat = yes
- # access_attr_used_for_allow = yes
-
- #
- # By default, if the packet contains a User-Password,
- # and no other module is configured to handle the
- # authentication, the LDAP module sets itself to do
- # LDAP bind for authentication.
- #
- # You can disable this behavior by setting the following
- # configuration entry to "no".
- #
- # allowed values: {no, yes}
- # set_auth_type = yes
- }
-
- # passwd module allows to do authorization via any passwd-like
- # file and to extract any attributes from these modules
- #
- # parameters are:
- # filename - path to filename
- # format - format for filename record. This parameters
- # correlates record in the passwd file and RADIUS
- # attributes.
- #
- # Field marked as '*' is key field. That is, the parameter
- # with this name from the request is used to search for
- # the record from passwd file
- # Attribute marked as '=' is added to reply_itmes instead
- # of default configure_itmes
- # Attribute marked as '~' is added to request_items
- #
- # Field marked as ',' may contain a comma separated list
- # of attributes.
- # hashsize - hashtable size. If 0 or not specified records are not
- # stored in memory and file is red on every request.
- # allowmultiplekeys - if few records for every key are allowed
- # ignorenislike - ignore NIS-related records
- # delimiter - symbol to use as a field separator in passwd file,
- # for format ':' symbol is always used. '\0', '\n' are
- # not allowed
- #
-
- # An example configuration for using /etc/smbpasswd.
- #
- #passwd etc_smbpasswd {
- # filename = /etc/smbpasswd
- # format = "*User-Name::LM-Password:NT-Password:SMB-Account-CTRL-TEXT::"
- # hashsize = 100
- # ignorenislike = no
- # allowmultiplekeys = no
- #}
-
- # Similar configuration, for the /etc/group file. Adds a Group-Name
- # attribute for every group that the user is member of.
- #
- #passwd etc_group {
- # filename = /etc/group
- # format = "=Group-Name:::*,User-Name"
- # hashsize = 50
- # ignorenislike = yes
- # allowmultiplekeys = yes
- # delimiter = ":"
- #}
-
- # Realm module, for proxying.
- #
- # You can have multiple instances of the realm module to
- # support multiple realm syntaxs at the same time. The
- # search order is defined by the order in the authorize and
- # preacct sections.
- #
- # Four config options:
- # format - must be "prefix" or "suffix"
- # The special cases of "DEFAULT"
- # and "NULL" are allowed, too.
- # delimiter - must be a single character
-
- # 'realm/username'
- #
- # Using this entry, IPASS users have their realm set to "IPASS".
- realm IPASS {
- format = prefix
- delimiter = "/"
- }
-
- # 'username@realm'
- #
- realm suffix {
- format = suffix
- delimiter = "@"
- }
-
- # 'username%realm'
- #
- realm realmpercent {
- format = suffix
- delimiter = "%"
- }
-
- #
- # 'domain\user'
- #
- realm ntdomain {
- format = prefix
- delimiter = "\\"
- }
-
- # A simple value checking module
- #
- # It can be used to check if an attribute value in the request
- # matches a (possibly multi valued) attribute in the check
- # items This can be used for example for caller-id
- # authentication. For the module to run, both the request
- # attribute and the check items attribute must exist
- #
- # i.e.
- # A user has an ldap entry with 2 radiusCallingStationId
- # attributes with values "12345678" and "12345679". If we
- # enable rlm_checkval, then any request which contains a
- # Calling-Station-Id with one of those two values will be
- # accepted. Requests with other values for
- # Calling-Station-Id will be rejected.
- #
- # Regular expressions in the check attribute value are allowed
- # as long as the operator is '=~'
- #
- checkval {
- # The attribute to look for in the request
- item-name = Calling-Station-Id
-
- # The attribute to look for in check items. Can be multi valued
- check-name = Calling-Station-Id
-
- # The data type. Can be
- # string,integer,ipaddr,date,abinary,octets
- data-type = string
-
- # If set to yes and we dont find the item-name attribute in the
- # request then we send back a reject
- # DEFAULT is no
- #notfound-reject = no
- }
-
- # rewrite arbitrary packets. Useful in accounting and authorization.
- #
- #
- # The module can also use the Rewrite-Rule attribute. If it
- # is set and matches the name of the module instance, then
- # that module instance will be the only one which runs.
- #
- # Also if new_attribute is set to yes then a new attribute
- # will be created containing the value replacewith and it
- # will be added to searchin (packet, reply, proxy, proxy_reply or config).
- # searchfor,ignore_case and max_matches will be ignored in that case.
- #
- # Backreferences are supported: %{0} will contain the string the whole match
- # and %{1} to %{8} will contain the contents of the 1st to the 8th parentheses
- #
- # If max_matches is greater than one the backreferences will correspond to the
- # first match
-
- #
- #attr_rewrite sanecallerid {
- # attribute = Called-Station-Id
- # may be "packet", "reply", "proxy", "proxy_reply" or "config"
- # searchin = packet
- # searchfor = "[+ ]"
- # replacewith = ""
- # ignore_case = no
- # new_attribute = no
- # max_matches = 10
- # ## If set to yes then the replace string will be appended to the original string
- # append = no
- #}
-
- # Preprocess the incoming RADIUS request, before handing it off
- # to other modules.
- #
- # This module processes the 'huntgroups' and 'hints' files.
- # In addition, it re-writes some weird attributes created
- # by some NASes, and converts the attributes into a form which
- # is a little more standard.
- #
- preprocess {
- huntgroups = ${confdir}/huntgroups
- hints = ${confdir}/hints
-
- # This hack changes Ascend's wierd port numberings
- # to standard 0-??? port numbers so that the "+" works
- # for IP address assignments.
- with_ascend_hack = no
- ascend_channels_per_line = 23
-
- # Windows NT machines often authenticate themselves as
- # NT_DOMAIN\username
- #
- # If this is set to 'yes', then the NT_DOMAIN portion
- # of the user-name is silently discarded.
- #
- # This configuration entry SHOULD NOT be used.
- # See the "realms" module for a better way to handle
- # NT domains.
- with_ntdomain_hack = no
-
- # Specialix Jetstream 8500 24 port access server.
- #
- # If the user name is 10 characters or longer, a "/"
- # and the excess characters after the 10th are
- # appended to the user name.
- #
- # If you're not running that NAS, you don't need
- # this hack.
- with_specialix_jetstream_hack = no
-
- # Cisco (and Quintum in Cisco mode) sends it's VSA attributes
- # with the attribute name *again* in the string, like:
- #
- # H323-Attribute = "h323-attribute=value".
- #
- # If this configuration item is set to 'yes', then
- # the redundant data in the the attribute text is stripped
- # out. The result is:
- #
- # H323-Attribute = "value"
- #
- # If you're not running a Cisco or Quintum NAS, you don't
- # need this hack.
- with_cisco_vsa_hack = no
- }
-
- # Livingston-style 'users' file
- #
- files {
- # The default key attribute to use for matches. The content
- # of this attribute is used to match the "name" of the
- # entry.
- #key = "%{Stripped-User-Name:-%{User-Name}}"
-
- usersfile = ${confdir}/users
- acctusersfile = ${confdir}/acct_users
- preproxy_usersfile = ${confdir}/preproxy_users
-
- # If you want to use the old Cistron 'users' file
- # with FreeRADIUS, you should change the next line
- # to 'compat = cistron'. You can the copy your 'users'
- # file from Cistron.
- compat = no
- }
-
- # Write a detailed log of all accounting records received.
- #
- detail {
- # Note that we do NOT use NAS-IP-Address here, as
- # that attribute MAY BE from the originating NAS, and
- # NOT from the proxy which actually sent us the
- # request. The Client-IP-Address attribute is ALWAYS
- # the address of the client which sent us the
- # request.
- #
- # The following line creates a new detail file for
- # every radius client (by IP address or hostname).
- # In addition, a new detail file is created every
- # day, so that the detail file doesn't have to go
- # through a 'log rotation'
- #
- # If your detail files are large, you may also want
- # to add a ':%H' (see doc/variables.txt) to the end
- # of it, to create a new detail file every hour, e.g.:
- #
- # ..../detail-%Y%m%d:%H
- #
- # This will create a new detail file for every hour.
- #
- detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d
-
- #
- # The Unix-style permissions on the 'detail' file.
- #
- # The detail file often contains secret or private
- # information about users. So by keeping the file
- # permissions restrictive, we can prevent unwanted
- # people from seeing that information.
- detailperm = 0600
-
- #
- # Every entry in th edetail file has a header which
- # is a timestamp. By default, we use the ctime
- # format (see "man ctime" for details).
- #
- # The header can be customized by editing this
- # string. See "doc/variables.txt" for a description
- # of what can be put here.
- #
- header = "%t"
-
- #
- # Certain attributes such as User-Password may be
- # "sensitive", so they should not be printed in the
- # detail file. This section lists the attributes
- # that should be suppressed.
- #
- # The attributes should be listed one to a line.
- #
- #suppress {
- # User-Password
- #}
-
- }
-
- #
- # Many people want to log authentication requests.
- # Rather than modifying the server core to print out more
- # messages, we can use a different instance of the 'detail'
- # module, to log the authentication requests to a file.
- #
- # You will also need to un-comment the 'auth_log' line
- # in the 'authorize' section, below.
- #
- # detail auth_log {
- # detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d
-
- #
- # This MUST be 0600, otherwise anyone can read
- # the users passwords!
- # detailperm = 0600
- # }
-
- #
- # This module logs authentication reply packets sent
- # to a NAS. Both Access-Accept and Access-Reject packets
- # are logged.
- #
- # You will also need to un-comment the 'reply_log' line
- # in the 'post-auth' section, below.
- #
- # detail reply_log {
- # detailfile = ${radacctdir}/%{Client-IP-Address}/reply-detail-%Y%m%d
-
- #
- # This MUST be 0600, otherwise anyone can read
- # the users passwords!
- # detailperm = 0600
- # }
-
- #
- # This module logs packets proxied to a home server.
- #
- # You will also need to un-comment the 'pre_proxy_log' line
- # in the 'pre-proxy' section, below.
- #
- # detail pre_proxy_log {
- # detailfile = ${radacctdir}/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d
-
- #
- # This MUST be 0600, otherwise anyone can read
- # the users passwords!
- # detailperm = 0600
- # }
-
- #
- # This module logs response packets from a home server.
- #
- # You will also need to un-comment the 'post_proxy_log' line
- # in the 'post-proxy' section, below.
- #
- # detail post_proxy_log {
- # detailfile = ${radacctdir}/%{Client-IP-Address}/post-proxy-detail-%Y%m%d
-
- #
- # This MUST be 0600, otherwise anyone can read
- # the users passwords!
- # detailperm = 0600
- # }
-
- #
- # The rlm_sql_log module appends the SQL queries in a log
- # file which is read later by the radsqlrelay program.
- #
- # This module only performs the dynamic expansion of the
- # variables found in the SQL statements. No operation is
- # executed on the database server. (this could be done
- # later by an external program) That means the module is
- # useful only with non-"SELECT" statements.
- #
- # See rlm_sql_log(5) manpage.
- #
-# sql_log {
-# path = ${radacctdir}/sql-relay
-# acct_table = "radacct"
-# postauth_table = "radpostauth"
-#
-# Start = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \
-# NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \
-# AcctSessionTime, AcctTerminateCause) VALUES \
-# ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \
-# '%{Framed-IP-Address}', '%S', '0', '0', '');"
-# Stop = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \
-# NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \
-# AcctSessionTime, AcctTerminateCause) VALUES \
-# ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \
-# '%{Framed-IP-Address}', '0', '%S', '%{Acct-Session-Time}', \
-# '%{Acct-Terminate-Cause}');"
-# Alive = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \
-# NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \
-# AcctSessionTime, AcctTerminateCause) VALUES \
-# ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \
-# '%{Framed-IP-Address}', '0', '0', '%{Acct-Session-Time}','');"
-#
-# Post-Auth = "INSERT INTO ${postauth_table} \
-# (user, pass, reply, date) VALUES \
-# ('%{User-Name}', '%{User-Password:-Chap-Password}', \
-# '%{reply:Packet-Type}', '%S');"
-# }
-
- #
- # Create a unique accounting session Id. Many NASes re-use
- # or repeat values for Acct-Session-Id, causing no end of
- # confusion.
- #
- # This module will add a (probably) unique session id
- # to an accounting packet based on the attributes listed
- # below found in the packet. See doc/rlm_acct_unique for
- # more information.
- #
- acct_unique {
- key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
- }
-