Merge pull request #1991 from spaetow/v3.0.x

[freeradius.git] / raddb / sites-available / inner-tunnel

diff --git a/raddb/sites-available/inner-tunnel b/raddb/sites-available/inner-tunnel
index 5d983a3..70b1d8d 100644 (file)
--- a/raddb/sites-available/inner-tunnel
+++ b/raddb/sites-available/inner-tunnel
@@ -47,6 +47,21 @@ listen {
 #  need to setup hints for the remote radius server
 authorize {
        #
+       #  Take a User-Name, and perform some checks on it, for spaces and other
+       #  invalid characters.  If the User-Name appears invalid, reject the
+       #  request.
+       #
+       #  See policy.d/filter for the definition of the filter_username policy.
+       #
+       filter_username
+
+       #
+       #  Do checks on outer / inner User-Name, so that users
+       #  can't spoof us by using incompatible identities
+       #
+#      filter_inner_identity
+
+       #
        #  The chap module will set 'Auth-Type := CHAP' if we are
        #  handling a CHAP request and Auth-Type has not already been set
        chap
@@ -134,8 +149,8 @@ authorize {
        #
        #  If you are using /etc/smbpasswd, and are also doing
        #  mschap authentication, the un-comment this line, and
-       #  configure the 'etc_smbpasswd' module, above.
-#      etc_smbpasswd
+       #  enable the "smbpasswd" module.
+#      smbpasswd
 
        #
        #  The ldap module reads passwords from the LDAP database.
@@ -207,6 +222,11 @@ authenticate {
        }
 
        #
+       #  For old names, too.
+       #
+       mschap
+
+       #
        #  Pluggable Authentication Modules.
 #      pam
 
@@ -282,12 +302,6 @@ post-auth {
        -sql
 
        #
-       #  Instead of sending the query to the SQL server,
-       #  write it into a log file.
-       #
-#      sql_log
-
-       #
        #  Un-comment the following if you have set
        #  'edir_account_policy_check = yes' in the ldap module sub-section of
        #  the 'modules' section.
@@ -296,30 +310,50 @@ post-auth {
 
 
        #
-       #  Instead of "use_tunneled_reply", uncomment the
-       #  next two "update" blocks.
+       #  Un-comment the following if you want to generate Moonshot (ABFAB) TargetedIds
        #
-#      update {
-#              &outer.session-state: += &reply:
-#      }
-
+       #  IMPORTANT: This requires the UUID package to be installed, and a targeted_id_salt
+       #             to be configured.
        #
-       #  These attributes are for the inner session only.
-       #  They MUST NOT be sent in the outer reply.
+       #  This functionality also supports SQL backing. To use this functionality, enable
+       #  and configure the moonshot-targeted-ids SQL module in the mods-enabled directory.
+       #  Then remove the comments from the appropriate lines in each of the below
+       #  policies in the policy.d/moonshot-targeted-ids file.
        #
-       #  If you uncomment the previous block and leave
-       #  this one commented out, WiFi WILL NOT WORK,
-       #  because the client will get two MS-MPPE-keys
+#      moonshot_host_tid
+#      moonshot_realm_tid
+#      moonshot_coi_tid
+
        #
-#      update outer.session-state {
-#              MS-MPPE-Encryption-Policy !* ANY
-#              MS-MPPE-Encryption-Types !* ANY
-#              MS-MPPE-Send-Key !* ANY
-#              MS-MPPE-Recv-Key !* ANY
-#              Message-Authenticator !* ANY
-#              EAP-Message !* ANY
-#              Proxy-State !* ANY
-#      }
+       #  Instead of "use_tunneled_reply", change this "if (0)" to an
+       #  "if (1)".
+       #
+       if (0) {
+               #
+               #  These attributes are for the inner-tunnel only,
+               #  and MUST NOT be copied to the outer reply.
+               #
+               update reply {
+                       User-Name !* ANY
+                       Message-Authenticator !* ANY
+                       EAP-Message !* ANY
+                       Proxy-State !* ANY
+                       MS-MPPE-Encryption-Types !* ANY
+                       MS-MPPE-Encryption-Policy !* ANY
+                       MS-MPPE-Send-Key !* ANY
+                       MS-MPPE-Recv-Key !* ANY
+               }
+
+               #
+               #  Copy the inner reply attributes to the outer
+               #  session-state list.  The post-auth policy will take
+               #  care of copying the outer session-state list to the
+               #  outer reply.
+               #
+               update {
+                       &outer.session-state: += &reply:
+               }
+       }
 
        #
        #  Access-Reject packets are sent through the REJECT sub-section of the