Moved otp.conf to modules/otp

diff --git a/raddb/modules/otp b/raddb/modules/otp
new file mode 100644 (file)
index 0000000..3ae59e1
--- /dev/null
+++ b/raddb/modules/otp
@@ -0,0 +1,78 @@
+#
+#  Configuration for the OTP module.
+#
+
+#  This module allows you to use various handheld OTP tokens
+#  for authentication (Auth-Type := otp).  These tokens are
+#  available from various vendors.
+#
+#  It works in conjunction with otpd, which implements token
+#  management and OTP verification functions; and lsmd or gsmd,
+#  which implements synchronous state management functions.
+#  otpd, lsmd and gsmd are available from TRI-D Systems:
+#              <http://www.tri-dsystems.com/>
+
+#  You must list this module in BOTH the authorize and authenticate
+#  sections in order to use it.
+otp {
+       # otpd rendezvous point.
+       # (default: /var/run/otpd/socket)
+       #otpd_rp = /var/run/otpd/socket
+
+       # Text to use for the challenge.  The '%' character is
+       # disallowed, except that you MUST have a single "%s"
+       # sequence in the string; the challenge itself is
+       # inserted there.  (default "Challenge: %s\n Response: ")
+       #challenge_prompt = "Challenge: %s\n Response: "
+
+       # Length of the challenge.  Most tokens probably support a
+       # max of 8 digits.  (range: 5-32 digits, default 6)
+       #challenge_length = 6
+
+       # Maximum time, in seconds, that a challenge is valid.
+       # (The user must respond to a challenge within this time.)
+       # It is also the minimal time between consecutive async mode
+       # authentications, a necessary restriction due to an inherent
+       # weakness of the RADIUS protocol which allows replay attacks.
+       # (default: 30)
+       #challenge_delay = 30
+
+       # Whether or not to allow asynchronous ("pure" challenge/
+       # response) mode authentication.  Since sync mode is much more
+       # usable, and all reasonable tokens support it, the typical
+       # use of async mode is to allow resync of event based tokens.
+       # But because of the vulnerability of async mode with some tokens,
+       # you probably want to disable this and require that out-of-sync
+       # users resync from specifically secured terminals.
+       # See the otpd docs for more info.
+       # (default: no)
+       #allow_async = no
+
+       # Whether or not to allow synchronous mode authentication.
+       # When using otpd with lsmd, it is *CRITICALLY IMPORTANT*
+       # that if your OTP users can authenticate to multiple RADIUS
+       # servers, this must be "yes" for the primary/default server,
+       # and "no" for the others.  This is because lsmd does not
+       # share state information across multiple servers.  Using "yes"
+       # on all your RADIUS servers would allow replay attacks!
+       # Also, for event based tokens, the user will be out of sync
+       # on the "other" servers.  In order to use "yes" on all your
+       # servers, you must either use gsmd, which synchronizes state
+       # globally, or implement your own state synchronization method.
+       # (default: yes)
+       #allow_sync = yes
+
+       # If both allow_async and allow_sync are "yes", a challenge is
+       # always presented to the user.  This is incompatible with NAS's
+       # that can't present or don't handle Access-Challenge's, e.g.
+       # PPTP servers.  Even though a challenge is presented, the user
+       # can still enter their synchronous passcode.
+
+       # The following are MPPE settings.  Note that MS-CHAP (v1) is
+       # strongly discouraged.  All possible values are listed as
+       # {value = meaning}.  Default values are first.
+       #mschapv2_mppe = {2 = required, 1 = optional, 0 = forbidden}
+       #mschapv2_mppe_bits = {2 = 128, 1 = 128 or 40, 0 = 40}
+       #mschap_mppe = {2 = required, 1 = optional, 0 = forbidden}
+       #mschap_mppe_bits = {2 = 128}
+}

diff --git a/raddb/radiusd.conf.in b/raddb/radiusd.conf.in
index 83d0cb2..72fb7e6 100644 (file)
--- a/raddb/radiusd.conf.in
+++ b/raddb/radiusd.conf.in
@@ -679,10 +679,6 @@ modules {
        #  IP addresses managed in an SQL table.
        #
 #      $INCLUDE sqlippool.conf
-
-       # OTP token support.  Not included by default.
-#      $INCLUDE otp.conf
-
 }
 
 # Instantiation