3 ## radiusd.conf -- FreeRADIUS server configuration file.
5 ## http://www.freeradius.org/
9 ######################################################################
11 # Read "man radiusd" before editing this file. See the section
12 # titled DEBUGGING. It outlines a method where you can quickly
13 # obtain the configuration you want, without running into
16 # Run the server in debugging mode, and READ the output.
20 # We cannot emphasize this point strongly enough. The vast
21 # majority of problems can be solved by carefully reading the
22 # debugging output, which includes warnings about common issues,
23 # and suggestions for how they may be fixed.
25 # There may be a lot of output, but look carefully for words like:
26 # "warning", "error", "reject", or "failure". The messages there
27 # will usually be enough to guide you to a solution.
29 # If you are going to ask a question on the mailing list, then
30 # explain what you are trying to do, and include the output from
31 # debugging mode (radiusd -X). Failure to do so means that all
32 # of the responses to your question will be people telling you
33 # to "post the output of radiusd -X".
35 ######################################################################
37 # The location of other config files and logfiles are declared
40 # Also general configuration for modules can be done in this
41 # file, it is exported through the API to modules that ask for
44 # See "man radiusd.conf" for documentation on the format of this
45 # file. Note that the individual configuration items are NOT
46 # documented in that "man" page. They are only documented here,
49 # As of 2.0.0, FreeRADIUS supports a simple processing language
50 # in the "authorize", "authenticate", "accounting", etc. sections.
51 # See "man unlang" for details.
55 exec_prefix = @exec_prefix@
56 sysconfdir = @sysconfdir@
57 localstatedir = @localstatedir@
61 radacctdir = @radacctdir@
63 # Location of config and logfiles.
65 run_dir = ${localstatedir}/run/radiusd
67 # Should likely be ${localstatedir}/lib/radiusd
71 # libdir: Where to find the rlm_* modules.
73 # This should be automatically set at configuration time.
75 # If the server builds and installs, but fails at execution time
76 # with an 'undefined symbol' error, then you can use the libdir
77 # directive to work around the problem.
79 # The cause is usually that a library has been installed on your
80 # system in a place where the dynamic linker CANNOT find it. When
81 # executing as root (or another user), your personal environment MAY
82 # be set up to allow the dynamic linker to find the library. When
83 # executing as a daemon, FreeRADIUS MAY NOT have the same
84 # personalized configuration.
86 # To work around the problem, find out which library contains that symbol,
87 # and add the directory containing that library to the end of 'libdir',
88 # with a colon separating the directory names. NO spaces are allowed.
90 # e.g. libdir = /usr/local/lib:/opt/package/lib
92 # You can also try setting the LD_LIBRARY_PATH environment variable
93 # in a script which starts the server.
95 # If that does not work, then you can re-configure and re-build the
96 # server to NOT use shared libraries, via:
98 # ./configure --disable-shared
104 # pidfile: Where to place the PID of the RADIUS server.
106 # The server may be signalled while it's running by using this
109 # This file is written when ONLY running in daemon mode.
111 # e.g.: kill -HUP `cat /var/run/radiusd/radiusd.pid`
113 pidfile = ${run_dir}/radiusd.pid
115 # chroot: directory where the server does "chroot".
117 # The chroot is done very early in the process of starting the server.
118 # After the chroot has been performed it switches to the "user" listed
119 # below (which MUST be specified). If "group" is specified, it switchs
120 # to that group, too. Any other groups listed for the specified "user"
121 # in "/etc/group" are also added as part of this process.
123 # The current working directory (chdir / cd) is left *outside* of the
124 # chroot until all of the modules have been initialized. This allows
125 # the "raddb" directory to be left outside of the chroot. Once the
126 # modules have been initialized, it does a "chdir" to ${logdir}. This
127 # means that it should be impossible to break out of the chroot.
129 # If you are worried about security issues related to this use of chdir,
130 # then simply ensure that the "raddb" directory is inside of the chroot,
131 # end be sure to do "cd raddb" BEFORE starting the server.
133 # If the server is statically linked, then the only files that have
134 # to exist in the chroot are ${run_dir} and ${logdir}. If you do the
135 # "cd raddb" as discussed above, then the "raddb" directory has to be
136 # inside of the chroot directory, too.
138 #chroot = /path/to/chroot/directory
140 # user/group: The name (or #number) of the user/group to run radiusd as.
142 # If these are commented out, the server will run as the user/group
143 # that started it. In order to change to a different user/group, you
144 # MUST be root ( or have root privleges ) to start the server.
146 # We STRONGLY recommend that you run the server with as few permissions
147 # as possible. That is, if you're not using shadow passwords, the
148 # user and group items below should be set to radius'.
150 # NOTE that some kernels refuse to setgid(group) when the value of
151 # (unsigned)group is above 60000; don't use group nobody on these systems!
153 # On systems with shadow passwords, you might have to set 'group = shadow'
154 # for the server to be able to read the shadow password file. If you can
155 # authenticate users while in debug mode, but not in daemon mode, it may be
156 # that the debugging mode server is running as a user that can read the
157 # shadow info, and the user listed below can not.
159 # The server will also try to use "initgroups" to read /etc/groups.
160 # It will join all groups where "user" is a member. This can allow
161 # for some finer-grained access controls.
166 # max_request_time: The maximum time (in seconds) to handle a request.
168 # Requests which take more time than this to process may be killed, and
169 # a REJECT message is returned.
171 # WARNING: If you notice that requests take a long time to be handled,
172 # then this MAY INDICATE a bug in the server, in one of the modules
173 # used to handle a request, OR in your local configuration.
175 # This problem is most often seen when using an SQL database. If it takes
176 # more than a second or two to receive an answer from the SQL database,
177 # then it probably means that you haven't indexed the database. See your
178 # SQL server documentation for more information.
180 # Useful range of values: 5 to 120
182 max_request_time = 30
184 # cleanup_delay: The time to wait (in seconds) before cleaning up
185 # a reply which was sent to the NAS.
187 # The RADIUS request is normally cached internally for a short period
188 # of time, after the reply is sent to the NAS. The reply packet may be
189 # lost in the network, and the NAS will not see it. The NAS will then
190 # re-send the request, and the server will respond quickly with the
193 # If this value is set too low, then duplicate requests from the NAS
194 # MAY NOT be detected, and will instead be handled as seperate requests.
196 # If this value is set too high, then the server will cache too many
197 # requests, and some new requests may get blocked. (See 'max_requests'.)
199 # Useful range of values: 2 to 10
203 # max_requests: The maximum number of requests which the server keeps
204 # track of. This should be 256 multiplied by the number of clients.
205 # e.g. With 4 clients, this number should be 1024.
207 # If this number is too low, then when the server becomes busy,
208 # it will not respond to any new requests, until the 'cleanup_delay'
209 # time has passed, and it has removed the old requests.
211 # If this number is set too high, then the server will use a bit more
212 # memory for no real benefit.
214 # If you aren't sure what it should be set to, it's better to set it
215 # too high than too low. Setting it to 1000 per client is probably
216 # the highest it should be.
218 # Useful range of values: 256 to infinity
222 # listen: Make the server listen on a particular IP address, and send
223 # replies out from that address. This directive is most useful for
224 # hosts with multiple IP addresses on one interface.
226 # If you want the server to listen on additional addresses, or on
227 # additionnal ports, you can use multiple "listen" sections.
229 # Each section make the server listen for only one type of packet,
230 # therefore authentication and accounting have to be configured in
231 # different sections.
233 # The server ignore all "listen" section if you are using '-i' and '-p'
234 # on the command line.
237 # Type of packets to listen for.
238 # Allowed values are:
239 # auth listen for authentication packets
240 # acct listen for accounting packets
241 # proxy IP to use for sending proxied packets
242 # detail Read from the detail file. For examples, see
243 # raddb/sites-available/copy-acct-to-home-server
247 # Note: "type = proxy" lets you control the source IP used for
248 # proxying packets, with some limitations:
250 # * Only ONE proxy listener can be defined.
251 # * A proxy listener CANNOT be used in a virtual server section.
252 # * You should probably set "port = 0".
253 # * Any "clients" configuration will be ignored.
255 # IP address on which to listen.
256 # Allowed values are:
257 # dotted quad (1.2.3.4)
258 # hostname (radius.example.com)
262 # OR, you can use an IPv6 address, but not both
264 # ipv6addr = :: # any. ::1 == localhost
266 # Port on which to listen.
267 # Allowed values are:
268 # integer port number (1812)
269 # 0 means "use /etc/services for the proper port"
272 # Some systems support binding to an interface, in addition
273 # to the IP address. This feature isn't strictly necessary,
274 # but for sites with many IP addresses on one interface,
275 # it's useful to say "listen on all addresses for eth0".
277 # If your system does not support this feature, you will
278 # get an error if you try to use it.
282 # Per-socket lists of clients. This is a very useful feature.
284 # The name here is a reference to a section elsewhere in
285 # radiusd.conf, or clients.conf. Having the name as
286 # a reference allows multiple sockets to use the same
289 # If this configuration is used, then the global list of clients
290 # is IGNORED for this "listen" section. Take care configuring
291 # this feature, to ensure you don't accidentally disable a
294 # See clients.conf for the configuration of "per_socket_clients".
296 # clients = per_socket_clients
299 # This second "listen" section is for listening on the accounting
308 # clients = per_socket_clients
311 # hostname_lookups: Log the names of clients or just their IP addresses
312 # e.g., www.freeradius.org (on) or 206.47.27.232 (off).
314 # The default is 'off' because it would be overall better for the net
315 # if people had to knowingly turn this feature on, since enabling it
316 # means that each client request will result in AT LEAST one lookup
317 # request to the nameserver. Enabling hostname_lookups will also
318 # mean that your server may stop randomly for 30 seconds from time
319 # to time, if the DNS requests take too long.
321 # Turning hostname lookups off also means that the server won't block
322 # for 30 seconds, if it sees an IP address which has no name associated
325 # allowed values: {no, yes}
327 hostname_lookups = no
329 # Core dumps are a bad thing. This should only be set to 'yes'
330 # if you're debugging a problem with the server.
332 # allowed values: {no, yes}
334 allow_core_dumps = no
336 # Regular expressions
338 # These items are set at configure time. If they're set to "yes",
339 # then setting them to "no" turns off regular expression support.
341 # If they're set to "no" at configure time, then setting them to "yes"
342 # WILL NOT WORK. It will give you an error.
344 regular_expressions = @REGEX@
345 extended_expressions = @REGEX_EXTENDED@
348 # Logging section. The various "log_*" configuration items
349 # will eventually be moved here.
353 # Destination for log messages. This can be one of:
355 # files - log to "file", as defined below.
356 # syslog - to syslog (see also the "syslog_facility", below.
357 # stdout - standard output
358 # stderr - standard error.
360 # The command-line option "-X" over-rides this option, and forces
361 # logging to go to stdout.
366 # The logging messages for the server are appended to the
367 # tail of this file if destination == "files"
369 # If the server is running in debugging mode, this file is
372 file = ${logdir}/radius.log
375 # If this configuration parameter is set, then log messages for
376 # a *request* go to this file, rather than to radius.log.
378 # i.e. This is a log file per request, once the server has accepted
379 # the request as being from a valid client. Messages that are
380 # not associated with a request still go to radius.log.
382 # Not all log messages in the server core have been updated to use
383 # this new internal API. As a result, some messages will still
384 # go to radius.log. Please submit patches to fix this behavior.
386 # The file name is expanded dynamically. You should ONLY user
387 # server-side attributes for the filename (e.g. things you control).
388 # Using this feature MAY also slow down the server substantially,
389 # especially if you do thinks like SQL calls as part of the
390 # expansion of the filename.
392 # The name of the log file should use attributes that don't change
393 # over the lifetime of a request, such as User-Name,
394 # Virtual-Server or Packet-Src-IP-Address. Otherwise, the log
395 # messages will be distributed over multiple files.
397 #requests = ${logdir}/radiusd-%{%{Virtual-Server}:-DEFAULT}-%Y%m%d.log
400 # Which syslog facility to use, if ${destination} == "syslog"
402 # The exact values permitted here are OS-dependent. You probably
403 # don't want to change this.
405 syslog_facility = daemon
407 # Log the full User-Name attribute, as it was found in the request.
409 # allowed values: {no, yes}
413 # Log authentication requests to the log file.
415 # allowed values: {no, yes}
419 # Log passwords with the authentication requests.
420 # auth_badpass - logs password if it's rejected
421 # auth_goodpass - logs password if it's correct
423 # allowed values: {no, yes}
429 # The program to execute to do concurrency checks.
430 checkrad = ${sbindir}/checkrad
432 # SECURITY CONFIGURATION
434 # There may be multiple methods of attacking on the server. This
435 # section holds the configuration items which minimize the impact
440 # max_attributes: The maximum number of attributes
441 # permitted in a RADIUS packet. Packets which have MORE
442 # than this number of attributes in them will be dropped.
444 # If this number is set too low, then no RADIUS packets
447 # If this number is set too high, then an attacker may be
448 # able to send a small number of packets which will cause
449 # the server to use all available memory on the machine.
451 # Setting this number to 0 means "allow any number of attributes"
455 # reject_delay: When sending an Access-Reject, it can be
456 # delayed for a few seconds. This may help slow down a DoS
457 # attack. It also helps to slow down people trying to brute-force
458 # crack a users password.
460 # Setting this number to 0 means "send rejects immediately"
462 # If this number is set higher than 'cleanup_delay', then the
463 # rejects will be sent at 'cleanup_delay' time, when the request
464 # is deleted from the internal cache of requests.
466 # Useful ranges: 1 to 5
470 # status_server: Whether or not the server will respond
471 # to Status-Server requests.
473 # When sent a Status-Server message, the server responds with
474 # an Access-Accept or Accounting-Response packet.
476 # This is mainly useful for administrators who want to "ping"
477 # the server, without adding test users, or creating fake
478 # accounting packets.
480 # It's also useful when a NAS marks a RADIUS server "dead".
481 # The NAS can periodically "ping" the server with a Status-Server
482 # packet. If the server responds, it must be alive, and the
483 # NAS can start using it for real requests.
488 # PROXY CONFIGURATION
490 # proxy_requests: Turns proxying of RADIUS requests on or off.
492 # The server has proxying turned on by default. If your system is NOT
493 # set up to proxy requests to another server, then you can turn proxying
494 # off here. This will save a small amount of resources on the server.
496 # If you have proxying turned off, and your configuration files say
497 # to proxy a request, then an error message will be logged.
499 # To disable proxying, change the "yes" to "no", and comment the
502 # allowed values: {no, yes}
508 # CLIENTS CONFIGURATION
510 # Client configuration is defined in "clients.conf".
513 # The 'clients.conf' file contains all of the information from the old
514 # 'clients' and 'naslist' configuration files. We recommend that you
515 # do NOT use 'client's or 'naslist', although they are still
518 # Anything listed in 'clients.conf' will take precedence over the
519 # information from the old-style configuration files.
521 $INCLUDE clients.conf
524 # THREAD POOL CONFIGURATION
526 # The thread pool is a long-lived group of threads which
527 # take turns (round-robin) handling any incoming requests.
529 # You probably want to have a few spare threads around,
530 # so that high-load situations can be handled immediately. If you
531 # don't have any spare threads, then the request handling will
532 # be delayed while a new thread is created, and added to the pool.
534 # You probably don't want too many spare threads around,
535 # otherwise they'll be sitting there taking up resources, and
536 # not doing anything productive.
538 # The numbers given below should be adequate for most situations.
541 # Number of servers to start initially --- should be a reasonable
545 # Limit on the total number of servers running.
547 # If this limit is ever reached, clients will be LOCKED OUT, so it
548 # should NOT BE SET TOO LOW. It is intended mainly as a brake to
549 # keep a runaway server from taking the system with it as it spirals
552 # You may find that the server is regularly reaching the
553 # 'max_servers' number of threads, and that increasing
554 # 'max_servers' doesn't seem to make much difference.
556 # If this is the case, then the problem is MOST LIKELY that
557 # your back-end databases are taking too long to respond, and
558 # are preventing the server from responding in a timely manner.
560 # The solution is NOT do keep increasing the 'max_servers'
561 # value, but instead to fix the underlying cause of the
562 # problem: slow database, or 'hostname_lookups=yes'.
564 # For more information, see 'max_request_time', above.
568 # Server-pool size regulation. Rather than making you guess
569 # how many servers you need, FreeRADIUS dynamically adapts to
570 # the load it sees, that is, it tries to maintain enough
571 # servers to handle the current load, plus a few spare
572 # servers to handle transient load spikes.
574 # It does this by periodically checking how many servers are
575 # waiting for a request. If there are fewer than
576 # min_spare_servers, it creates a new spare. If there are
577 # more than max_spare_servers, some of the spares die off.
578 # The default values are probably OK for most sites.
580 min_spare_servers = 3
581 max_spare_servers = 10
583 # There may be memory leaks or resource allocation problems with
584 # the server. If so, set this value to 300 or so, so that the
585 # resources will be cleaned up periodically.
587 # This should only be necessary if there are serious bugs in the
588 # server which have not yet been fixed.
590 # '0' is a special value meaning 'infinity', or 'the servers never
592 max_requests_per_server = 0
595 # MODULE CONFIGURATION
597 # The names and configuration of each module is located in this section.
599 # After the modules are defined here, they may be referred to by name,
600 # in other sections of this configuration file.
604 # Each module has a configuration as follows:
606 # name [ instance ] {
607 # config_item = value
611 # The 'name' is used to load the 'rlm_name' library
612 # which implements the functionality of the module.
614 # The 'instance' is optional. To have two different instances
615 # of a module, it first must be referred to by 'name'.
616 # The different copies of the module are then created by
617 # inventing two 'instance' names, e.g. 'instance1' and 'instance2'
619 # The instance names can then be used in later configuration
620 # INSTEAD of the original 'name'. See the 'radutmp' configuration
625 # As of 2.0.5, most of the module configurations are in a
626 # sub-directory. Files matching the regex /[a-zA-Z0-9_.]+/
627 # are loaded. The modules are initialized ONLY if they are
628 # referenced in a processing section, such as authorize,
629 # authenticate, accounting, pre/post-proxy, etc.
631 $INCLUDE ${confdir}/modules/
633 # Extensible Authentication Protocol
635 # For all EAP related authentications.
636 # Now in another file, because it is very large.
640 # Include another file that has the SQL-related configuration.
641 # This is another file only because it tends to be big.
646 # This module is an SQL enabled version of the counter module.
648 # Rather than maintaining seperate (GDBM) databases of
649 # accounting info for each counter, this module uses the data
650 # stored in the raddacct table by the sql modules. This
651 # module NEVER does any database INSERTs or UPDATEs. It is
652 # totally dependent on the SQL module to process Accounting
655 $INCLUDE sql/mysql/counter.conf
656 #$INCLUDE sql/postgresql/counter.conf
659 # IP addresses managed in an SQL table.
661 #$INCLUDE sqlippool.conf
663 # OTP token support. Not included by default.
670 # This section orders the loading of the modules. Modules
671 # listed here will get loaded BEFORE the later sections like
672 # authorize, authenticate, etc. get examined.
674 # This section is not strictly needed. When a section like
675 # authorize refers to a module, it's automatically loaded and
676 # initialized. However, some modules may not be listed in any
677 # of the following sections, so they can be listed here.
679 # Also, listing modules here ensures that you have control over
680 # the order in which they are initalized. If one module needs
681 # something defined by another module, you can list them in order
682 # here, and ensure that the configuration will be OK.
686 # Allows the execution of external scripts.
687 # The entire command line (and output) must fit into 253 bytes.
689 # e.g. Framed-Pool = `%{exec:/bin/echo foo}`
693 # The expression module doesn't do authorization,
694 # authentication, or accounting. It only does dynamic
695 # translation, of the form:
697 # Session-Timeout = `%{expr:2 + 3}`
699 # So the module needs to be instantiated, but CANNOT be
700 # listed in any other section. See 'doc/rlm_expr' for
706 # We add the counter module here so that it registers
707 # the check-name attribute before any module which sets
713 # subsections here can be thought of as "virtual" modules.
715 # e.g. If you have two redundant SQL servers, and you want to
716 # use them in the authorize and accounting sections, you could
717 # place a "redundant" block in each section, containing the
718 # exact same text. Or, you could uncomment the following
719 # lines, and list "redundant_sql" in the authorize and
720 # accounting sections.
722 #redundant redundant_sql {
728 ######################################################################
730 # Policies that can be applied in multiple places are listed
731 # globally. That way, they can be defined once, and referred
734 ######################################################################
737 ######################################################################
739 # As of 2.0.0, the "authorize", "authenticate", etc. sections
740 # are in separate configuration files, per virtual host.
742 ######################################################################
744 ######################################################################
746 # Include all enabled virtual hosts.
748 # The following directory is searched for files that match
753 # The files are then included here, just as if they were cut
754 # and pasted into this file.
756 # See "sites-enabled/default" for some additional documentation.
758 $INCLUDE sites-enabled/