-#
-# clients.conf - client configuration directives
-#
-#######################################################################
+# -*- text -*-
+##
+## clients.conf -- client configuration directives
+##
+## $Id$
#######################################################################
#
-# Definition of a RADIUS client (usually a NAS).
-#
-# The information given here over rides anything given in the
-# 'clients' file, or in the 'naslist' file. The configuration here
-# contains all of the information from those two files, and allows
-# for more configuration items.
-#
-# The "shortname" is be used for logging. The "nastype", "login" and
-# "password" fields are mainly used for checkrad and are optional.
-#
+# Define RADIUS clients (usually a NAS, Access Point, etc.).
#
# Defines a RADIUS client.
# Each client has a "short name" that is used to distinguish it from
# other clients.
#
-# In version 1.x, this field was the IP address of the client.
-# In 2.0, the IP address is configured via the "ipaddr" or "ipv6addr"
-# fields. For compatibility, the 1.x format is still accepted.
+# In version 1.x, the string after the word "client" was the IP
+# address of the client. In 2.0, the IP address is configured via
+# the "ipaddr" or "ipv6addr" fields. For compatibility, the 1.x
+# format is still accepted.
#
client localhost {
- # Allowed values are:
- # dotted quad (1.2.3.4)
- # hostname (radius.example.com)
+ # Only *one* of ipaddr, ipv4addr, ipv6addr may be specified for
+ # a client.
+ #
+ # ipaddr will accept IPv4 or IPv6 addresses with optional CIDR
+ # notation '/<mask>' to specify ranges.
+ #
+ # ipaddr will accept domain names e.g. example.org resolving
+ # them via DNS.
+ #
+ # If both A and AAAA records are found, A records will be
+ # used in preference to AAAA.
ipaddr = 127.0.0.1
- # OR, you can use an IPv6 address, but not both
- # at the same time.
+ # Same as ipaddr but allows v4 addresses only. Requires A
+ # record for domain names.
+# ipv4addr = * # any. 127.0.0.1 == localhost
+
+ # Same as ipaddr but allows v6 addresses only. Requires AAAA
+ # record for domain names.
# ipv6addr = :: # any. ::1 == localhost
#
# updated, the server WILL NOT see that update.
#
- # One client definition can be applied to an entire network.
- # e.g. 127/8 should be defined with "ipaddr = 127.0.0.0" and
- # "netmask = 8"
#
- # If not specified, the default netmask is 32 (i.e. /32)
+ # The transport protocol.
#
- # We do NOT recommend using anything other than 32. There
- # are usually other, better ways to acheive the same goal.
- # Using netmasks of other than 32 can cause security issues.
+ # If unspecified, defaults to "udp", which is the traditional
+ # RADIUS transport. It may also be "tcp", in which case the
+ # server will accept connections from this client ONLY over TCP.
#
- # You can specify overlapping networks (127/8 and 127.0/16)
- # In that case, the smallest possible network will be used
- # as the "best match" for the client.
- #
-# netmask = 32
+ proto = *
#
# The shared secret use to "encrypt" and "sign" packets between
#
# And is at LEAST 8 characters long, preferably 16 characters in
# length. The secret MUST be random, and should not be words,
- # phrase, or anything else that is recognizable.
+ # phrase, or anything else that is recognisable.
#
# The default secret below is only for testing, and should
# not be used in any real environment.
#
- secret = testing123
+ secret = testing123
+
+ #
+ # Old-style clients do not send a Message-Authenticator
+ # in an Access-Request. RFC 5080 suggests that all clients
+ # SHOULD include it in an Access-Request. The configuration
+ # item below allows the server to require it. If a client
+ # is required to include a Message-Authenticator and it does
+ # not, then the packet will be silently discarded.
+ #
+ # allowed values: yes, no
+ require_message_authenticator = no
#
# The short name is used as an alias for the fully qualified
# domain name, or the IP address.
#
# It is accepted for compatibility with 1.x, but it is no
- # longer necessary in 2.0
+ # longer necessary in >= 2.0
#
-# shortname = localhost
+# shortname = localhost
#
# the following three fields are optional, but may be used by
#
#
- # The nastype tells 'checkrad.pl' which NAS-specific method to
+ # The nas_type tells 'checkrad.pl' which NAS-specific method to
# use to query the NAS for simultaneous use.
#
# Permitted NAS types are:
# cisco
# computone
# livingston
+ # juniper
# max40xx
# multitech
# netserver
# other # for all other types
#
- nastype = other # localhost isn't usually a NAS...
+ nas_type = other # localhost isn't usually a NAS...
#
# The following two configurations are for future use.
# login name and password, which is used by checkrad.pl
# when querying the NAS for simultaneous use.
#
-# login = !root
-# password = someadminpas
+# login = !root
+# password = someadminpas
#
# As of 2.0, clients can also be tied to a virtual server.
- # This is done by setting the "server" configuration item,
- # as in the example below.
+ # This is done by setting the "virtual_server" configuration
+ # item, as in the example below.
+ #
+# virtual_server = home1
+
+ #
+ # A pointer to the "home_server_pool" OR a "home_server"
+ # section that contains the CoA configuration for this
+ # client. For an example of a coa home server or pool,
+ # see raddb/sites-available/originate-coa
+# coa_server = coa
+
+ #
+ # Response window for proxied packets. If non-zero,
+ # then the lower of (home, client) response_window
+ # will be used.
#
-# server = home1
+ # i.e. it can be used to lower the response_window
+ # packets from one client to a home server. It cannot
+ # be used to raise the response_window.
+ #
+# response_window = 10.0
+
+ #
+ # Connection limiting for clients using "proto = tcp".
+ #
+ # This section is ignored for clients sending UDP traffic
+ #
+ limit {
+ #
+ # Limit the number of simultaneous TCP connections from a client
+ #
+ # The default is 16.
+ # Setting this to 0 means "no limit"
+ max_connections = 16
+
+ # The per-socket "max_requests" option does not exist.
+
+ #
+ # The lifetime, in seconds, of a TCP connection. After
+ # this lifetime, the connection will be closed.
+ #
+ # Setting this to 0 means "forever".
+ lifetime = 0
+
+ #
+ # The idle timeout, in seconds, of a TCP connection.
+ # If no packets have been received over the connection for
+ # this time, the connection will be closed.
+ #
+ # Setting this to 0 means "no timeout".
+ #
+ # We STRONGLY RECOMMEND that you set an idle timeout.
+ #
+ idle_timeout = 30
+ }
}
# IPv6 Client
-#client ::1 {
-# secret = testing123
-# shortname = localhost
-#}
-#
+client localhost_ipv6 {
+ ipv6addr = ::1
+ secret = testing123
+}
+
# All IPv6 Site-local clients
-#client fe80::/16 {
+#client sitelocal_ipv6 {
+# ipv6addr = fe80::/16
# secret = testing123
-# shortname = localhost
#}
-#client some.host.org {
+#client example.org {
+# ipaddr = radius.example.org
# secret = testing123
-# shortname = localhost
#}
#
# When a client request comes in, the BEST match is chosen.
# i.e. The entry from the smallest possible network.
#
-#client 192.168.0.0/24 {
+#client private-network-1 {
+# ipaddr = 192.0.2.0/24
# secret = testing123-1
-# shortname = private-network-1
-#}
-#
-#client 192.168.0.0/16 {
-# secret = testing123-2
-# shortname = private-network-2
#}
-
-#client 10.10.10.10 {
-# # secret and password are mapped through the "secrets" file.
-# secret = testing123
-# shortname = liv1
-# # the following three fields are optional, but may be used by
-# # checkrad.pl for simultaneous usage checks
-# nastype = livingston
-# login = !root
-# password = someadminpas
+#client private-network-2 {
+# ipaddr = 198.51.100.0/24
+# secret = testing123-2
#}
#######################################################################
# You can have as many per-socket client lists as you have "listen"
# sections, or you can re-use a list among multiple "listen" sections.
#
-#per_socket_clients {
-# client 192.168.3.4 {
+# Un-comment this section, and edit a "listen" section to add:
+# "clients = per_socket_clients". That IP address/port combination
+# will then accept ONLY the clients listed in this section.
+#
+#clients per_socket_clients {
+# client socket_client {
+# ipaddr = 192.0.2.4
# secret = testing123
-# }
+# }
#}
projects / freeradius.git / blobdiff