2 # This file contains the configuration for experimental modules.
4 # By default, it is NOT included in the build.
9 # Configuration for the Python module.
11 # Where radiusd is a Python module, radiusd.py, and the
12 # function 'authorize' is called. Here is a dummy piece
15 # def authorize(params):
17 # return (5, ('Reply-Message', 'banned'))
19 # The RADIUS value-pairs are passed as a tuple of tuple
20 # pairs as the first argument, e.g. (('attribute1',
21 # 'value1'), ('attribute2', 'value2'))
23 # The function return is a tuple with the first element
24 # being the return value of the function.
25 # The 5 corresponds to RLM_MODULE_USERLOCK. I plan to
26 # write the return values as Python symbols to avoid
29 # The remaining tuple members are the string form of
30 # value-pairs which are passed on to pairmake().
33 mod_instantiate = radiusd_test
34 func_instantiate = instantiate
36 mod_authorize = radiusd_test
37 func_authorize = authorize
39 mod_accounting = radiusd_test
40 func_accounting = accounting
42 mod_preproxy = radiusd_test
43 func_preproxy = preproxy
45 mod_postproxy = radiusd_test
46 func_postproxy = postproxy
48 mod_postauth = radiusd_test
49 func_postauth = postauth
51 mod_detach = radiusd_test
56 # Configuration for the example module. Uncommenting it will cause it
57 # to get loaded and initialized, but should have no real effect as long
58 # it is not referencened in one of the autz/auth/preacct/acct sections
61 # allowed values: {no, yes}
64 # An integer, of any value.
68 string = "This is an example configuration string"
70 # An IP address, either in dotted quad (1.2.3.4) or hostname
79 string = "This is a different string"
85 # To create a dbm users file, do:
87 # cat test.users | rlm_dbm_parser -f /etc/raddb/users_db
89 # Then add 'dbm' in 'authorize' section.
91 # Note that even if the file has a ".db" or ".dbm" extension,
92 # you may have to specify it here without that extension. This
93 # is because the DBM libraries "helpfully" add a ".db" to the
94 # filename, but don't check if it's already there.
97 usersfile = ${confdir}/users_db
101 # Persistent, embedded Perl interpreter.
105 # The Perl script to execute on authorize, authenticate,
106 # accounting, xlat, etc. This is very similar to using
107 # 'rlm_exec' module, but it is persistent, and therefore
110 module = /path/to/your/perl_module.pm
113 # The following hashes are given to the module and
114 # filled with value-pairs (Attribute names and values)
116 # %RAD_CHECK Read-only Check items
117 # %RAD_REQUEST Read-only Attributes from the request
118 # %RAD_REPLY Read-write Attributes for the reply
120 # The return codes from functions in the perl_script
121 # are passed directly back to the server. These
122 # codes are defined in doc/configurable_failover,
123 # src/include/modules.h (RLM_MODULE_REJECT, etc),
124 # and are pre-defined in the 'example.pl' program
129 # List of functions in the module to call.
130 # Uncomment and change if you want to use function
131 # names other than the defaults.
133 #func_authenticate = authenticate
134 #func_authorize = authorize
135 #func_preacct = preacct
136 #func_accounting = accounting
137 #func_checksimul = checksimul
138 #func_pre_proxy = pre_proxy
139 #func_post_proxy = post_proxy
140 #func_post_auth = post_auth
142 #func_detach = detach
145 # Uncomment the following lines if you wish
146 # to use separate functions for Start and Stop
147 # accounting packets. In that case, the
148 # func_accounting function is not called.
150 #func_start_accounting = accounting_start
151 #func_stop_accounting = accounting_stop
153 # Uncomment the following lines if your perl is
154 # compiled with threads support.
155 # The settings below are the defaults.
159 #min_spare_clones = 0
160 #max_spare_clones = 32
162 #max_request_per_clone = 0
167 # Perform NT-Domain authentication. This only works
168 # with PAP authentication. That is, Authentication-Request
169 # packets containing a User-Password attribute.
171 # To use it, add 'smb' into the 'authenticate' section,
172 # and then in another module (usually the 'users' file),
173 # set 'Auth-Type := SMB'
175 # WARNING: this module is not only experimental, it's also
176 # a security threat. It's not recommended to use it until
180 server = ntdomain.server.example.com
181 backup = backup.server.example.com
185 # See doc/rlm_fastusers before using this
186 # module or changing these values.
189 usersfile = ${confdir}/users_fast
192 # Reload the hash every 600 seconds (10mins)
198 # Should be added in the post-auth section (after all other modules)
199 # and in the authorize section (before any other modules)
205 # [... other modules ...]
208 # [... other modules ...]
212 # The caching module will cache the Auth-Type and reply items
213 # and send them back on any subsequent requests for the same key
217 # filename: The gdbm file to use for the cache database
218 # (can be memory mapped for more speed)
220 # key: A string to xlat and use as a key. For instance,
221 # "%{Acct-Unique-Session-Id}"
223 # post-auth: If we find a cached entry, set the post-auth to that value
225 # cache-ttl: The time to cache the entry. The same time format
226 # as the counter module apply here.
228 # h: hours, d: days, w: weeks, m: months
229 # If the letter is ommited days will be assumed.
232 # cache-size: The gdbm cache size to request (default 1000)
234 # hit-ratio: If set to non-zero we print out statistical
235 # information after so many cache requests
237 # cache-rejects: Do we also cache rejects, or not? (default 'yes')
240 filename = ${confdir}/db.cache
243 key = "%{Acct-Unique-Session-Id}"
246 # cache-rejects = yes
250 # Simple module for logging of Account packets to radiusd.log
251 # You need to declare it in the accounting section for it to work
254 acctlog_start = "Connect: [%{User-Name}] (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} ip %{Framed-IP-Address})"
255 acctlog_stop = "Disconnect: [%{User-Name}] (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} ip %{Framed-IP-Address}) %{Acct-Session-Time} seconds"
256 acctlog_on = "NAS %C (%{NAS-IP-Address}) just came online"
257 acctlog_off = "NAS %C (%{NAS-IP-Address}) just went offline"
260 # Another implementation of the EAP module.
262 # This module requires the libeap.so file from the hostap
263 # software (http://hostap.epitest.fi/hostapd/). It has been
264 # tested on the development version of hostapd (0.6.1) ONLY.
266 # In order to use it, you MUST build a "libeap.so" in hostapd,
267 # which is not done by default.
269 # You MUST also edit the file: src/modules/rlm_eap2/Makefile
270 # to point to the location of the hostap include files.
272 # This module CANNOT be used in the same way as the current
273 # FreeRADIUS "eap" module. There is NO way to look inside of
274 # a tunneled request. There is NO way to proxy a tunneled
275 # request. There is NO way to even look at the user name inside
276 # of the tunneled request. There is NO way to control the
277 # choice of EAP types inside of the tunnel. You MUST force
278 # the server to choose "eap2" for authentication, because this
279 # module has no "authorize" section.
281 # If you want to use this module for experimentation, please
282 # post your comments to the freeradius-devel list:
284 # http://lists.freeradius.org/mailman/listinfo/freeradius-devel
286 # If you want to use this module in a production (i.e. real-world)
289 # !!! DO NOT USE IT IN A PRODUCTION ENVIRONMENT !!!
291 # The module needs additional work to make it ready for
292 # production use.. Please supply patches, or sponsor the
293 # work by hiring a developer. Do NOT ask when the work will
294 # be done, because there is no plan to finish this module
295 # unless there is demand for it.
298 # EAP types are chosen in the order that they are
299 # listed in this section. There is no "default_eap_type"
300 # as with rlm_eap. Instead, the *first* EAP type is
301 # used as the default type.
309 # This is the ONLY EAP type that has any configuration.
310 # All other EAP types have no configuration.
313 ca_cert = ${confdir}/certs/ca.pem
314 server_cert = ${confdir}/certs/server.pem
315 private_key_file = ${confdir}/certs/server.pem
316 private_key_password = whatever
320 # These next two methods do not supply keying material.
328 # LEAP is NOT supported by this module.
329 # Use the "eap" module instead.
331 # For other methods that MIGHT work, see the
332 # configuration of hostap. The methods are statically
333 # linked in at compile time, and cannot be controlled
337 # Configuration for experimental EAP types. The sub-sections
338 # can be copied into eap.conf.
343 # Allowed values are:
344 # cert - for certificate based server authentication,
345 # other required settings for this type are
346 # 'private_key_file' and 'certificate_file'
347 # secret - for shared secret based server authentication,
348 # other required settings for this type is 'id'
349 # Default value of this option is 'secret'
350 # server_authtype=cert
352 # Allowed default client auth types
353 # Allowed values are:
354 # secret - for shared secret based client authentication
355 # cert - for certificate based client authentication
356 # both - shared secret and certificate is allowed
357 # none - authentication will always fail
358 # Default value for this option is 'both'. This option could
359 # be overwritten within 'usersfile' file by EAP-IKEv2-Auth
361 # default_authtype = both
363 # path to trusted CA certificate file
364 CA_file="/path/to/CA/cacert.pem"
366 # path to CRL file, if not set, then there will be no
368 # crl_file="/path/to/crl.pem"
370 # path to file with user settings
372 # Note that this file is read ONLY on module initialization!
374 # default ${confdir}/eap_ikev2_users
375 # usersfile=${confdir}/eap_ikev2_users
378 # Sample "eap_ikev2_users" file entry:
380 #username EAP-IKEv2-IDType := KEY_ID, EAP-IKEv2-Secret := "tajne"
383 ## username - client user name from IKE-AUTH (IDr) or CommonName
384 ## from x509 certificate
385 ## EAP-IKEv2-IDType - ID Type - same as in expected IDType payload
386 ## allowable attributes for EAP-IKEv2-IDType:
387 ## IPV4_ADDR FQDN RFC822_ADDR IPV6_ADDR DER_ASN1_DN
388 ## DER_ASN1_GN KEY_ID
389 ## EAP-IKEv2-Secret - shared secret
390 ## EAP-IKEv2-AuthType - optional parameter which defines expected client auth
391 ## type. Allowed values are: secret,cert,both,none.
392 ## For the meaning of this values, please see the
393 ## description of 'default_authtype'.
394 ## This attribute can overwrite 'default_authtype' value.
398 # path to file with server private key
399 private_key_file="/path/to/srv-private-key.pem"
401 # password to private key file
402 private_key_password="passwd"
404 # path to file with server certificate
405 certificate_file="/path/to/srv-cert.pem"
407 # server identity string
410 # Server identity type. Allowed values are:
411 # IPV4_ADDR, FQDN, RFC822_ADDR, IPV6_ADDR, ASN1_DN, ASN1_GN,
413 # Default value is: KEY_ID
417 # MTU (default: 1398)
418 # fragment_size = 1398
420 # maximal allowed number of resends SA_INIT after receiving
421 # 'invalid KEY' notification (default 3)
424 # option which is used to control whenever send CERT REQ
426 # Allowed values for this option are "yes" or "no".
427 #Default value is "no".
430 # option which cotrols fast reconnect capability.
431 # Allowed valuse for this option are "yes" or "no".
432 # Default value is "yes".
433 # enable_fast_reauth = "no"
435 # option which is used to control performing of DH exchange
436 # during fast rekeying protocol run.
437 # Allowed values for this option are "yes" or "no".
438 # Default value is "no"
439 # fast_DH_exchange = "yes"
441 # Option which is used to set up expiration time of inactive
443 # After selected period of time (in seconds), inactive
444 # session data will be deleted.
445 # Default value of this option is set to 900 seconds
446 # fast_timer_expire = 900
448 # list of server proposals of available cryptographic
454 # Supported transforms types: encryption,
455 # prf, integrity, dhgroup. For multiple
456 # transforms just simple repeat key (i.e.
459 # encryption algorithm
460 # supported algorithms:
461 # null,3des,aes_128_cbc,aes_192_cbc,
463 # blowfish:n, where n range from 8 to 448 bits,
465 # cast:n, where n range from 40 to 128 bits,
469 # pseudo random function. Supported prf's:
470 # hmac_md5, hmac_sha1, hmac_tiger
473 # integrity algorithm. Supported algorithms:
474 # hmac_md5_96, hmac_sha1_96,des_mac
475 integrity = hmac_sha1_96
476 integrity = hmac_md5_96
478 # Diffie-Hellman groups:
479 # modp768, modp1024, modp1536, modp2048,
480 # modp3072, modp4096, modp6144, modp8192
488 integrity = hmac_md5_96
496 integrity=hmac_md5_96