"http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd">
<refentry>
<refentryinfo>
- <date>2012-04-11</date>
+ <date>2012-10-25</date>
</refentryinfo>
<refmeta>
<refentrytitle>
<application>radsecproxy.conf</application>
</refentrytitle>
<manvolnum>5</manvolnum>
- <refmiscinfo>radsecproxy 1.6-dev</refmiscinfo>
+ <refmiscinfo>radsecproxy 1.6.4</refmiscinfo>
</refmeta>
<refnamediv>
<refname>
When the proxy server starts, it will first check the command
line arguments, and then read the configuration file. Normally
radsecproxy will read the configuration file
- <filename>/etc/radsecproxy.conf</filename>. The command line
+ <filename>/usr/local/etc/radsecproxy.conf</filename>. The command line
<option>-c</option> option can be used to instead read an
alternate file (see
<citerefentry>
shell globbing to specify multiple files, e.g.:
<blockquote>
<para>
- include /etc/radsecproxy.conf.d/*.conf
+ include /usr/local/etc/radsecproxy.conf.d/*.conf
</para>
</blockquote>
The files are sorted alphabetically. Included files are read in
</listitem>
</varlistentry>
<varlistentry>
+ <term><literal>IPv4Only and IPv6Only</literal></term>
+ <listitem>
+ <para>
+ These can be set to <literal>on</literal> or
+ <literal>off</literal> with <literal>off</literal> being
+ the default. At most one of <literal>IPv4Only</literal>
+ and <literal>IPv6Only</literal> can be enabled. Enabling
+ <literal>IPv4Only</literal> or <literal>IPv6Only</literal>
+ makes radsecproxy resolve DNS names to the corresponding
+ address family only, and not the other. This is done for
+ both clients and servers. Note that this can be
+ overridden in <literal>client</literal> and
+ <literal>server</literal> blocks, see below.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
<term><literal>Include</literal></term>
<listitem>
<para>
that client. The name of the client block must (with one
exception, see below) be either the IP address (IPv4 or IPv6) of
the client, an IP prefix (IPv4 or IPv6) on the form
- IpAddress/PrefixLength, or a domain name (FQDN). Note that
- literal IPv6 addresses must be enclosed in brackets.
+ IpAddress/PrefixLength, or a domain name (FQDN). The way an
+ FQDN is resolved into an IP address may be influenced by the use
+ of the <literal>IPv4Only</literal> and
+ <literal>IPv6Only</literal> options. Note that literal IPv6
+ addresses must be enclosed in brackets.
</para>
<para>
If a domain name is specified, then this will be resolved
</para>
<para>
The allowed options in a client block are
- <literal>host</literal>, <literal>type</literal>,
+ <literal>host</literal>, <literal>IPv4Only</literal>,
+ <literal>IPv6Only</literal>, <literal>type</literal>,
<literal>secret</literal>, <literal>tls</literal>,
<literal>certificateNameCheck</literal>,
<literal>matchCertificateAttribute</literal>,
<literal>duplicateInterval</literal>, <literal>AddTTL</literal>,
- <literal>fticksVISCOUNTRY</literal>, <literal>fticksVISINST</literal>,
- <literal>rewrite</literal>, <literal>rewriteIn</literal>,
- <literal>rewriteOut</literal>, and <literal>rewriteAttribute</literal>.
+ <literal>fticksVISCOUNTRY</literal>,
+ <literal>fticksVISINST</literal>, <literal>rewrite</literal>,
+ <literal>rewriteIn</literal>, <literal>rewriteOut</literal>, and
+ <literal>rewriteAttribute</literal>.
- We already discussed the <literal>host</literal> option. The
- value of <literal>type</literal> must be one of
+ We already discussed the <literal>host</literal> option. To
+ specify how radsecproxy should resolve a <literal>host</literal>
+ given as a DNS name, the <literal>IPv4Only</literal> or the
+ <literal>IPv6Only</literal> can be set to <literal>on</literal>.
+ At most one of these options can be enabled. Enabling
+ <literal>IPv4Only</literal> or <literal>IPv6Only</literal> here
+ overrides any basic settings set at the top level.
+
+ The value of <literal>type</literal> must be one of
<literal>udp</literal>, <literal>tcp</literal>,
<literal>tls</literal> or <literal>dtls</literal>. The value of
<literal>secret</literal> is the shared RADIUS key used with
this client. If the secret contains whitespace, the value must
be quoted. This option is optional for TLS/DTLS and if omitted
- will default to "mysecret". Note that the default value of
- <literal>secret</literal> will change in an upcoming release.
+ will default to "radsec". (Note that using a secret other than
+ "radsec" for TLS is a violation of the standard (RFC 6614) and
+ that the proposed standard for DTLS stipulates that the secret
+ must be "radius/dtls".)
</para>
<para>
For a TLS/DTLS client you may also specify the
<literal>default</literal>. If the specified TLS block name does
not exist, or the option is not specified and none of the
defaults exist, the proxy will exit with an error.
+
+ NOTE: All versions of radsecproxy up to and including 1.6
+ erroneously verify client certificate chains using the CA in the
+ very first matching client block regardless of which block is
+ used for the final decision. This was changed in version 1.6.1
+ so that a client block with a different <literal>tls</literal>
+ option than the first matching client block is no longer
+ considered for verification of clients.
+
</para>
<para>
For a TLS/DTLS client, the option
after startup. If the domain name resolves to multiple
addresses, then for UDP/DTLS the first address is used. For
TCP/TLS, the proxy will loop through the addresses until it can
- connect to one of them. In the case of TLS/DTLS, the name of the
- server must match the FQDN or IP address in the server
- certificate.
+ connect to one of them. The way an FQDN is resolved into an IP
+ address may be influenced by the use of the
+ <literal>IPv4Only</literal> and <literal>IPv6Only</literal>
+ options. In the case of TLS/DTLS, the name of the server must
+ match the FQDN or IP address in the server certificate.
</para>
<para>
Alternatively one may use the <literal>host</literal> option
<para>
The allowed options in a server block are
<literal>host</literal>, <literal>port</literal>,
+ <literal>IPv4Only</literal>, <literal>IPv6Only</literal>,
<literal>type</literal>, <literal>secret</literal>,
<literal>tls</literal>, <literal>certificateNameCheck</literal>,
<literal>matchCertificateAttribute</literal>,
<literal>LoopPrevention</literal>.
</para>
<para>
- We already discussed the <literal>host</literal> option. The
- <literal>port</literal> option allows you to specify which port
- number the server uses. The usage of <literal>type</literal>,
- <literal>secret</literal>, <literal>tls</literal>,
- <literal>certificateNameCheck</literal>,
+
+ We already discussed the <literal>host</literal> option. To
+ specify how radsecproxy should resolve a <literal>host</literal>
+ given as a DNS name, the <literal>IPv4Only</literal> or the
+ <literal>IPv6Only</literal> can be set to <literal>on</literal>.
+ At most one of these options can be enabled. Enabling
+ <literal>IPv4Only</literal> or <literal>IPv6Only</literal> here
+ overrides any basic settings set at the top level.
+
+ The <literal>port</literal> option allows you to specify which
+ port number the server uses. The usage of
+ <literal>type</literal>, <literal>secret</literal>,
+ <literal>tls</literal>, <literal>certificateNameCheck</literal>,
<literal>matchCertificateAttribute</literal>,
<literal>AddTTL</literal>, <literal>rewrite</literal>,
<literal>rewriteIn</literal> and <literal>rewriteOut</literal>
<literal>defaultClient</literal> and
<literal>defaultServer</literal>. Note that these defaults are
only used for rewrite on input. No rewriting is done on output
- unless explicitly specifed using the
+ unless explicitly specified using the
<literal>rewriteOut</literal> option.
</para>
<para>
projects / libradsec.git / blobdiff