# In 2.0, the server is always "synchronous", and setting
# "synchronous = no" is impossible. This simplifies the
# server and increases the stability of the network.
+ # However, it means that the server (i.e. proxy) NEVER
+ # originates packets. It proxies packets ONLY when it receives
+ # a packet or a re-transmission from the NAS. If the NAS never
+ # re-transmits, the proxy never re-transmits, either. This can
+ # affect fail-over, where a packet does *not* fail over to a
+ # second home server.. because the NAS never retransmits the
+ # packet.
#
# If you need to set "synchronous = no", please send a
# message to the list <freeradius-users@lists.freeradius.org>
port = 1812
#
+ # The transport protocol.
+ #
+ # If unspecified, defaults to "udp", which is the traditional
+ # RADIUS transport. It may also be "tcp", in which case TCP
+ # will be used to talk to this home server.
+ #
+ # When home servers are put into pools, the pool can contain
+ # home servers with both UDP and TCP transports.
+ #
+ #proto = udp
+
+ #
# The shared secret use to "encrypt" and "sign" packets between
# FreeRADIUS and the home server.
#
# packets sent to that home server will have a
# Message-Authenticator attribute.
#
+ # We STRONGLY recommend that this flag be set to "yes"
+ # for ALL home servers. Doing so will have no performance
+ # impact on the proxy or on the home servers. It will,
+ # however, allow administrators to detect problems earlier.
+ #
# allowed values: yes, no
- require_message_authenticator = no
+ require_message_authenticator = yes
#
- # If the home server doesn't respond to the request within
- # this time, this server will consider the request dead, and
- # respond to the NAS with an Access-Reject.
+ # If the home server does not respond to a request within
+ # this time, this server will initiate "zombie_period".
#
- # If NO responses are received to any requests sent within this
- # time period, the home server will be marked "zombie", as below.
+ # The response window is large because responses MAY be slow,
+ # especially when proxying across the Internet.
#
# Useful range of values: 5 to 60
response_window = 20
#
- # If the home server does not respond to ANY packets for
- # a certain time, consider it dead. This time period is
- # called the "zombie" period, because the server is neither
- # alive nor dead.
+ # If you want the old behavior of the server rejecting
+ # proxied requests after "response_window" timeout, set
+ # the following configuration item to "yes".
+ #
+ # This configuration WILL be removed in a future release
+ # If you believe you need it, email the freeradius-users
+ # list, and explain why it should stay in the server.
+ #
+# no_response_fail = no
+
+ #
+ # If the home server does not respond to ANY packets during
+ # the "zombie period", it will be considered to be dead.
+ #
+ # A home server that is marked "zombie" will be used for
+ # proxying as a low priority. If there are live servers,
+ # they will always be preferred to a zombie. Requests will
+ # be proxied to a zombie server ONLY when there are no
+ # live servers.
+ #
+ # Any request that is proxied to a home server will continue
+ # to be sent to that home server until the home server is
+ # marked dead. At that point, it will fail over to another
+ # server, if a live server is available. If none is available,
+ # then the "post-proxy-type fail" handler will be called.
#
# If "status_check" below is something other than "none", then
# the server will start sending status checks at the start of
# we do NOT recommend using "revive_interval".
#
# The "revive_interval" is used ONLY if the "status_check"
- # entry below is not "none". Otherwise, it will not be used,
+ # entry below is "none". Otherwise, it will not be used,
# and should be deleted.
#
# Useful range of values: 60 to 3600
# Maximum Retransmit Duration: 5..60
mrd = 30
}
+
+ #
+ # Connection limiting for home servers with "proto = tcp".
+ #
+ # This section is ignored for other home servers.
+ #
+ limit {
+ #
+ # Limit the number of TCP connections to the home server.
+ #
+ # The default is 16.
+ # Setting this to 0 means "no limit"
+ max_connections = 16
+
+ #
+ # Limit the total number of requests sent over one
+ # TCP connection. After this number of requests, the
+ # connection will be closed. Any new packets that are
+ # proxied to the home server will result in a new TCP
+ # connection being made.
+ #
+ # Setting this to 0 means "no limit"
+ max_requests = 0
+
+ #
+ # The lifetime, in seconds, of a TCP connection. After
+ # this lifetime, the connection will be closed.
+ #
+ # Setting this to 0 means "forever".
+ lifetime = 0
+
+ #
+ # The idle timeout, in seconds, of a TCP connection.
+ # If no packets have been sent over the connection for
+ # this time, the connection will be closed.
+ #
+ # Setting this to 0 means "no timeout".
+ idle_timeout = 0
+ }
+
}
# Sample virtual home server.
-home_server virtual.example.com {
- virtual_server = virtual.example.com
-}
+#
+#
+#home_server virtual.example.com {
+# virtual_server = virtual.example.com
+#}
######################################################################
#
# 3) If no realm is found, return the DEFAULT realm, if any.
#
# The order of the realms matters in step (2). For example, defining
-# two realms "*.example.com" and "*.test.example.com" will result in
+# two realms ".*\.example.net$" and ".*\.test\.example\.net$" will result in
# the second realm NEVER matching. This is because all of the realms
# which match the second regex also match the first one. Since the
# first regex matches, it is returned.
#
# The solution is to list the realms in the opposite order,. e.g.
-# "*.test.example.com", followed by "*.example.com".
+# ".*\.test\.example.net$", followed by ".*\.example\.net$".
#
#
# Some helpful rules:
# regular expressions. That may be fixed in a future release.
#
# - use two back-slashes '\\' whenever you need one backslash in the
-# regex. e.g. "~*\\.example\\.com", and not "~*\.example\.com".
+# regex. e.g. "~.*\\.example\\.net$", and not "~\.example\.net$".
# This is because the regex is in a double-quoted string, and normal
# rules apply for double-quoted strings.
#
# - If you are matching domain names, use two backslashes in front of
# every '.' (dot or period). This is because '.' has special meaning
# in a regular expression: match any character. If you do not do this,
-# then "~*.example.com" will match "fooXexampleYcom", which is likely
+# then "~.*.example.net$" will match "fooXexampleYnet", which is likely
# not what you want
#
# - If you are matching domain names, put a '$' at the end of the regex
# that matches the domain name. This tells the regex matching code
# that the realm ENDS with the domain name, so it does not match
-# realms with the domain name in the middle. e.g. "~*\\.example\\.com"
-# will match "test.example.comFOO", which is likely not what you want.
-# Using "~*\\.example\\.com$" is better.
+# realms with the domain name in the middle. e.g. "~.*\\.example\\.net"
+# will match "test.example.netFOO", which is likely not what you want.
+# Using "~.*\\.example\\.net$" is better.
#
# The more regex realms that are defined, the more time it takes to
# process them. You should define as few regex realms as possible
# in order to maximize server performance.
#
-#realm "~*\\.example\\.com$" {
-# authhost = LOCAL # not strictly necessary
-# accthost = LOCAL # not strictly necessary
+#realm "~.*\\.example\\.net$" {
#}
projects / freeradius.git / blobdiff