API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Mar 22nd, 2018
157
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 34.22 KB | None | 0 0
raw download clone embed print report
  1. root@pr104:/etc/freeradius/3.0/sites-enabled# cat default
  2. ######################################################################
  3. #
  4. # As of 2.0.0, FreeRADIUS supports virtual hosts using the
  5. # "server" section, and configuration directives.
  6. #
  7. # Virtual hosts should be put into the "sites-available"
  8. # directory. Soft links should be created in the "sites-enabled"
  9. # directory to these files. This is done in a normal installation.
  10. #
  11. # If you are using 802.1X (EAP) authentication, please see also
  12. # the "inner-tunnel" virtual server. You will likely have to edit
  13. # that, too, for authentication to work.
  14. #
  15. # $Id: 083407596aa5074d665adac9606e7de655b634aa $
  16. #
  17. ######################################################################
  18. #
  19. # Read "man radiusd" before editing this file. See the section
  20. # titled DEBUGGING. It outlines a method where you can quickly
  21. # obtain the configuration you want, without running into
  22. # trouble. See also "man unlang", which documents the format
  23. # of this file.
  24. #
  25. # This configuration is designed to work in the widest possible
  26. # set of circumstances, with the widest possible number of
  27. # authentication methods. This means that in general, you should
  28. # need to make very few changes to this file.
  29. #
  30. # The best way to configure the server for your local system
  31. # is to CAREFULLY edit this file. Most attempts to make large
  32. # edits to this file will BREAK THE SERVER. Any edits should
  33. # be small, and tested by running the server with "radiusd -X".
  34. # Once the edits have been verified to work, save a copy of these
  35. # configuration files somewhere. (e.g. as a "tar" file). Then,
  36. # make more edits, and test, as above.
  37. #
  38. # There are many "commented out" references to modules such
  39. # as ldap, sql, etc. These references serve as place-holders.
  40. # If you need the functionality of that module, then configure
  41. # it in radiusd.conf, and un-comment the references to it in
  42. # this file. In most cases, those small changes will result
  43. # in the server being able to connect to the DB, and to
  44. # authenticate users.
  45. #
  46. ######################################################################
  47.  
  48. server default {
  49. #
  50. # If you want the server to listen on additional addresses, or on
  51. # additional ports, you can use multiple "listen" sections.
  52. #
  53. # Each section make the server listen for only one type of packet,
  54. # therefore authentication and accounting have to be configured in
  55. # different sections.
  56. #
  57. # The server ignore all "listen" section if you are using '-i' and '-p'
  58. # on the command line.
  59. #
  60. listen {
  61. # Type of packets to listen for.
  62. # Allowed values are:
  63. # auth listen for authentication packets
  64. # acct listen for accounting packets
  65. # proxy IP to use for sending proxied packets
  66. # detail Read from the detail file. For examples, see
  67. # raddb/sites-available/copy-acct-to-home-server
  68. # status listen for Status-Server packets. For examples,
  69. # see raddb/sites-available/status
  70. # coa listen for CoA-Request and Disconnect-Request
  71. # packets. For examples, see the file
  72. # raddb/sites-available/coa
  73. #
  74. type = auth
  75.  
  76. # Note: "type = proxy" lets you control the source IP used for
  77. # proxying packets, with some limitations:
  78. #
  79. # * A proxy listener CANNOT be used in a virtual server section.
  80. # * You should probably set "port = 0".
  81. # * Any "clients" configuration will be ignored.
  82. #
  83. # See also proxy.conf, and the "src_ipaddr" configuration entry
  84. # in the sample "home_server" section. When you specify the
  85. # source IP address for packets sent to a home server, the
  86. # proxy listeners are automatically created.
  87.  
  88. # ipaddr/ipv4addr/ipv6addr - IP address on which to listen.
  89. # Out of several options the first one will be used.
  90. #
  91. # Allowed values are:
  92. # IPv4 address (e.g. 1.2.3.4, for ipv4addr/ipaddr)
  93. # IPv6 address (e.g. 2001:db8::1, for ipv6addr/ipaddr)
  94. # hostname (radius.example.com,
  95. # A record for ipv4addr,
  96. # AAAA record for ipv6addr,
  97. # A or AAAA record for ipaddr)
  98. # wildcard (*)
  99. #
  100. # ipv4addr = *
  101. # ipv6addr = *
  102. # ipaddr = *
  103. #2018.03.22 Maksel
  104. ipaddr = 127.0.0.1
  105.  
  106. # Port on which to listen.
  107. # Allowed values are:
  108. # integer port number (1812)
  109. # 0 means "use /etc/services for the proper port"
  110. port = 0
  111.  
  112. # Some systems support binding to an interface, in addition
  113. # to the IP address. This feature isn't strictly necessary,
  114. # but for sites with many IP addresses on one interface,
  115. # it's useful to say "listen on all addresses for eth0".
  116. #
  117. # If your system does not support this feature, you will
  118. # get an error if you try to use it.
  119. #
  120. # interface = eth0
  121.  
  122. # Per-socket lists of clients. This is a very useful feature.
  123. #
  124. # The name here is a reference to a section elsewhere in
  125. # radiusd.conf, or clients.conf. Having the name as
  126. # a reference allows multiple sockets to use the same
  127. # set of clients.
  128. #
  129. # If this configuration is used, then the global list of clients
  130. # is IGNORED for this "listen" section. Take care configuring
  131. # this feature, to ensure you don't accidentally disable a
  132. # client you need.
  133. #
  134. # See clients.conf for the configuration of "per_socket_clients".
  135. #
  136. # clients = per_socket_clients
  137.  
  138. #
  139. # Connection limiting for sockets with "proto = tcp".
  140. #
  141. # This section is ignored for other kinds of sockets.
  142. #
  143. limit {
  144. #
  145. # Limit the number of simultaneous TCP connections to the socket
  146. #
  147. # The default is 16.
  148. # Setting this to 0 means "no limit"
  149. # max_connections = 16
  150. #2018.03.22 Maksel
  151. max_connections = 0
  152.  
  153. # The per-socket "max_requests" option does not exist.
  154.  
  155. #
  156. # The lifetime, in seconds, of a TCP connection. After
  157. # this lifetime, the connection will be closed.
  158. #
  159. # Setting this to 0 means "forever".
  160. lifetime = 0
  161.  
  162. #
  163. # The idle timeout, in seconds, of a TCP connection.
  164. # If no packets have been received over the connection for
  165. # this time, the connection will be closed.
  166. #
  167. # Setting this to 0 means "no timeout".
  168. #
  169. # We STRONGLY RECOMMEND that you set an idle timeout.
  170. #
  171. # idle_timeout = 30
  172. #2018.03.22 Maksel
  173. idle_timeout = 300
  174. }
  175. }
  176.  
  177. #
  178. # This second "listen" section is for listening on the accounting
  179. # port, too.
  180. #
  181. listen {
  182. # ipaddr = *
  183. #2018.03.22 Maksel
  184. ipaddr = 127.0.0.1
  185. # ipv6addr = ::
  186. port = 0
  187. type = acct
  188. # interface = eth0
  189. # clients = per_socket_clients
  190.  
  191. limit {
  192. # The number of packets received can be rate limited via the
  193. # "max_pps" configuration item. When it is set, the server
  194. # tracks the total number of packets received in the previous
  195. # second. If the count is greater than "max_pps", then the
  196. # new packet is silently discarded. This helps the server
  197. # deal with overload situations.
  198. #
  199. # The packets/s counter is tracked in a sliding window. This
  200. # means that the pps calculation is done for the second
  201. # before the current packet was received. NOT for the current
  202. # wall-clock second, and NOT for the previous wall-clock second.
  203. #
  204. # Useful values are 0 (no limit), or 100 to 10000.
  205. # Values lower than 100 will likely cause the server to ignore
  206. # normal traffic. Few systems are capable of handling more than
  207. # 10K packets/s.
  208. #
  209. # It is most useful for accounting systems. Set it to 50%
  210. # more than the normal accounting load, and you can be sure that
  211. # the server will never get overloaded
  212. #
  213. # max_pps = 0
  214.  
  215. # Only for "proto = tcp". These are ignored for "udp" sockets.
  216. #
  217. # idle_timeout = 0
  218. # lifetime = 0
  219. # max_connections = 0
  220. }
  221. }
  222.  
  223. # IPv6 versions of the above - read their full config to understand options
  224. #listen {
  225. # type = auth
  226. # ipv6addr = :: # any. ::1 == localhost
  227. # port = 0
  228. ## interface = eth0
  229. ## clients = per_socket_clients
  230. # limit {
  231. # max_connections = 16
  232. # lifetime = 0
  233. # idle_timeout = 30
  234. # }
  235. #}
  236. #
  237. #listen {
  238. # ipv6addr = ::
  239. # port = 0
  240. # type = acct
  241. ## interface = eth0
  242. ## clients = per_socket_clients
  243. #
  244. # limit {
  245. ## max_pps = 0
  246. ## idle_timeout = 0
  247. ## lifetime = 0
  248. ## max_connections = 0
  249. # }
  250. #}
  251.  
  252. # Authorization. First preprocess (hints and huntgroups files),
  253. # then realms, and finally look in the "users" file.
  254. #
  255. # Any changes made here should also be made to the "inner-tunnel"
  256. # virtual server.
  257. #
  258. # The order of the realm modules will determine the order that
  259. # we try to find a matching realm.
  260. #
  261. # Make *sure* that 'preprocess' comes before any realm if you
  262. # need to setup hints for the remote radius server
  263. authorize {
  264. #
  265. # Take a User-Name, and perform some checks on it, for spaces and other
  266. # invalid characters. If the User-Name appears invalid, reject the
  267. # request.
  268. #
  269. # See policy.d/filter for the definition of the filter_username policy.
  270. #
  271. filter_username
  272.  
  273. #
  274. # Some broken equipment sends passwords with embedded zeros.
  275. # i.e. the debug output will show
  276. #
  277. # User-Password = "password\000\000"
  278. #
  279. # This policy will fix it to just be "password".
  280. #
  281. # filter_password
  282.  
  283. #
  284. # The preprocess module takes care of sanitizing some bizarre
  285. # attributes in the request, and turning them into attributes
  286. # which are more standard.
  287. #
  288. # It takes care of processing the 'raddb/mods-config/preprocess/hints'
  289. # and the 'raddb/mods-config/preprocess/huntgroups' files.
  290. #2018.03.22 Maksel - need for sql
  291. # preprocess
  292.  
  293. # If you intend to use CUI and you require that the Operator-Name
  294. # be set for CUI generation and you want to generate CUI also
  295. # for your local clients then uncomment the operator-name
  296. # below and set the operator-name for your clients in clients.conf
  297. # operator-name
  298.  
  299. #
  300. # If you want to generate CUI for some clients that do not
  301. # send proper CUI requests, then uncomment the
  302. # cui below and set "add_cui = yes" for these clients in clients.conf
  303. # cui
  304.  
  305. #
  306. # If you want to have a log of authentication requests,
  307. # un-comment the following line.
  308. #2018.03.22 Maksel раскоминтим посмотрим чт даем
  309. auth_log
  310.  
  311. #
  312. # The chap module will set 'Auth-Type := CHAP' if we are
  313. # handling a CHAP request and Auth-Type has not already been set
  314. #2018.03.22 Maksel need for sql
  315. # chap
  316.  
  317. #
  318. # If the users are logging in with an MS-CHAP-Challenge
  319. # attribute for authentication, the mschap module will find
  320. # the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP'
  321. # to the request, which will cause the server to then use
  322. # the mschap module for authentication.
  323. #2018.03.22 Maksel need for sql
  324. # mschap
  325.  
  326. #
  327. # If you have a Cisco SIP server authenticating against
  328. # FreeRADIUS, uncomment the following line, and the 'digest'
  329. # line in the 'authenticate' section.
  330. #2018.03.22 Maksel need for sql
  331. # digest
  332.  
  333. #
  334. # The WiMAX specification says that the Calling-Station-Id
  335. # is 6 octets of the MAC. This definition conflicts with
  336. # RFC 3580, and all common RADIUS practices. Un-commenting
  337. # the "wimax" module here means that it will fix the
  338. # Calling-Station-Id attribute to the normal format as
  339. # specified in RFC 3580 Section 3.21
  340. # wimax
  341.  
  342. #
  343. # Look for IPASS style 'realm/', and if not found, look for
  344. # '@realm', and decide whether or not to proxy, based on
  345. # that.
  346. # IPASS
  347.  
  348. #
  349. # If you are using multiple kinds of realms, you probably
  350. # want to set "ignore_null = yes" for all of them.
  351. # Otherwise, when the first style of realm doesn't match,
  352. # the other styles won't be checked.
  353. #
  354. #2018.03.22 Maksel need for sql
  355. # suffix
  356. # ntdomain
  357.  
  358. #
  359. # This module takes care of EAP-MD5, EAP-TLS, and EAP-LEAP
  360. # authentication.
  361. #
  362. # It also sets the EAP-Type attribute in the request
  363. # attribute list to the EAP type from the packet.
  364. #
  365. # The EAP module returns "ok" if it is not yet ready to
  366. # authenticate the user. The configuration below checks for
  367. # that code, and stops processing the "authorize" section if
  368. # so.
  369. #
  370. # Any LDAP and/or SQL servers will not be queried for the
  371. # initial set of packets that go back and forth to set up
  372. # TTLS or PEAP.
  373. #
  374. #2018.03.22 Maksel need for sql
  375. # eap {
  376. # ok = return
  377. # }
  378.  
  379. #
  380. # Pull crypt'd passwords from /etc/passwd or /etc/shadow,
  381. # using the system API's to get the password. If you want
  382. # to read /etc/passwd or /etc/shadow directly, see the
  383. # mods-available/passwd module.
  384. #
  385. # unix
  386.  
  387. #
  388. # Read the 'users' file. In v3, this is located in
  389. # raddb/mods-config/files/authorize
  390. #2018.03.22 Maksel need for sql
  391. # files
  392.  
  393. #
  394. # Look in an SQL database. The schema of the database
  395. # is meant to mirror the "users" file.
  396. #
  397. # See "Authorization Queries" in mods-available/sql
  398. # -sql
  399. #2018.03.22 Maksel need for sql
  400. sql
  401.  
  402. #
  403. # If you are using /etc/smbpasswd, and are also doing
  404. # mschap authentication, the un-comment this line, and
  405. # configure the 'smbpasswd' module.
  406. # smbpasswd
  407.  
  408. #
  409. # The ldap module reads passwords from the LDAP database.
  410. -ldap
  411.  
  412. #
  413. # Enforce daily limits on time spent logged in.
  414. # daily
  415.  
  416. #
  417. #2018.03.22 Maksel need for sql вроде как должно быть оба отключено,
  418. #но осавлю включеным так отключил в radius.conf
  419. expiration
  420. logintime
  421.  
  422. #
  423. # If no other module has claimed responsibility for
  424. # authentication, then try to use PAP. This allows the
  425. # other modules listed above to add a "known good" password
  426. # to the request, and to do nothing else. The PAP module
  427. # will then see that password, and use it to do PAP
  428. # authentication.
  429. #
  430. # This module should be listed last, so that the other modules
  431. # get a chance to set Auth-Type for themselves.
  432. #
  433. #2018.03.22 Maksel need for sql
  434. # pap
  435.  
  436. #
  437. # If "status_server = yes", then Status-Server messages are passed
  438. # through the following section, and ONLY the following section.
  439. # This permits you to do DB queries, for example. If the modules
  440. # listed here return "fail", then NO response is sent.
  441. #
  442. # Autz-Type Status-Server {
  443. #
  444. # }
  445. }
  446.  
  447.  
  448. # Authentication.
  449. #
  450. #
  451. # This section lists which modules are available for authentication.
  452. # Note that it does NOT mean 'try each module in order'. It means
  453. # that a module from the 'authorize' section adds a configuration
  454. # attribute 'Auth-Type := FOO'. That authentication type is then
  455. # used to pick the appropriate module from the list below.
  456. #
  457.  
  458. # In general, you SHOULD NOT set the Auth-Type attribute. The server
  459. # will figure it out on its own, and will do the right thing. The
  460. # most common side effect of erroneously setting the Auth-Type
  461. # attribute is that one authentication method will work, but the
  462. # others will not.
  463. #
  464. # The common reasons to set the Auth-Type attribute by hand
  465. # is to either forcibly reject the user (Auth-Type := Reject),
  466. # or to or forcibly accept the user (Auth-Type := Accept).
  467. #
  468. # Note that Auth-Type := Accept will NOT work with EAP.
  469. #
  470. # Please do not put "unlang" configurations into the "authenticate"
  471. # section. Put them in the "post-auth" section instead. That's what
  472. # the post-auth section is for.
  473. #
  474. authenticate {
  475. #
  476. # PAP authentication, when a back-end database listed
  477. # in the 'authorize' section supplies a password. The
  478. # password can be clear-text, or encrypted.
  479. Auth-Type PAP {
  480. pap
  481. }
  482.  
  483. #
  484. # Most people want CHAP authentication
  485. # A back-end database listed in the 'authorize' section
  486. # MUST supply a CLEAR TEXT password. Encrypted passwords
  487. # won't work.
  488. Auth-Type CHAP {
  489. chap
  490. }
  491.  
  492. #
  493. # MSCHAP authentication.
  494. Auth-Type MS-CHAP {
  495. mschap
  496. }
  497.  
  498. #
  499. # For old names, too.
  500. #
  501. #2018.03.22 Maksel отключил на всяз случай
  502. # mschap
  503.  
  504. #
  505. # If you have a Cisco SIP server authenticating against
  506. # FreeRADIUS, uncomment the following line, and the 'digest'
  507. # line in the 'authorize' section.
  508. #2018.03.22 Maksel need fot sql
  509. # digest
  510.  
  511. #
  512. # Pluggable Authentication Modules.
  513. # pam
  514.  
  515. # Uncomment it if you want to use ldap for authentication
  516. #
  517. # Note that this means "check plain-text password against
  518. # the ldap database", which means that EAP won't work,
  519. # as it does not supply a plain-text password.
  520. #
  521. # We do NOT recommend using this. LDAP servers are databases.
  522. # They are NOT authentication servers. FreeRADIUS is an
  523. # authentication server, and knows what to do with authentication.
  524. # LDAP servers do not.
  525. #
  526. # Auth-Type LDAP {
  527. # ldap
  528. # }
  529.  
  530. #
  531. # Allow EAP authentication.
  532. #2018.03.22 Maksel
  533. # eap
  534.  
  535. #
  536. # The older configurations sent a number of attributes in
  537. # Access-Challenge packets, which wasn't strictly correct.
  538. # If you want to filter out these attributes, uncomment
  539. # the following lines.
  540. #
  541. # Auth-Type eap {
  542. # eap {
  543. # handled = 1
  544. # }
  545. # if (handled && (Response-Packet-Type == Access-Challenge)) {
  546. # attr_filter.access_challenge.post-auth
  547. # handled # override the "updated" code from attr_filter
  548. # }
  549. # }
  550. }
  551.  
  552.  
  553. #
  554. # Pre-accounting. Decide which accounting type to use.
  555. #
  556. preacct {
  557. preprocess
  558.  
  559. #
  560. # Merge Acct-[Input|Output]-Gigawords and Acct-[Input-Output]-Octets
  561. # into a single 64bit counter Acct-[Input|Output]-Octets64.
  562. #
  563. # acct_counters64
  564.  
  565. #
  566. # Session start times are *implied* in RADIUS.
  567. # The NAS never sends a "start time". Instead, it sends
  568. # a start packet, *possibly* with an Acct-Delay-Time.
  569. # The server is supposed to conclude that the start time
  570. # was "Acct-Delay-Time" seconds in the past.
  571. #
  572. # The code below creates an explicit start time, which can
  573. # then be used in other modules. It will be *mostly* correct.
  574. # Any errors are due to the 1-second resolution of RADIUS,
  575. # and the possibility that the time on the NAS may be off.
  576. #
  577. # The start time is: NOW - delay - session_length
  578. #
  579.  
  580. # update request {
  581. # FreeRADIUS-Acct-Session-Start-Time = "%{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}}"
  582. # }
  583.  
  584.  
  585. #
  586. # Ensure that we have a semi-unique identifier for every
  587. # request, and many NAS boxes are broken.
  588. acct_unique
  589.  
  590. #
  591. # Look for IPASS-style 'realm/', and if not found, look for
  592. # '@realm', and decide whether or not to proxy, based on
  593. # that.
  594. #
  595. # Accounting requests are generally proxied to the same
  596. # home server as authentication requests.
  597. # IPASS
  598. suffix
  599. # ntdomain
  600.  
  601. #
  602. # Read the 'acct_users' file
  603. files
  604. }
  605.  
  606. #
  607. # Accounting. Log the accounting data.
  608. #
  609. accounting {
  610. # Update accounting packet by adding the CUI attribute
  611. # recorded from the corresponding Access-Accept
  612. # use it only if your NAS boxes do not support CUI themselves
  613. # cui
  614. #
  615. # Create a 'detail'ed log of the packets.
  616. # Note that accounting requests which are proxied
  617. # are also logged in the detail file.
  618. #2018.03.22 Maksel логи пока будут включены потом нужно отключить
  619. #log -> /var/log/freeradius/radacct/127.0.0.1
  620. detail
  621. # daily
  622.  
  623. # Update the wtmp file
  624. #
  625. # If you don't use "radlast", you can delete this line.
  626. #2018.03.22 Maksel
  627. # unix
  628.  
  629. #
  630. # For Simultaneous-Use tracking.
  631. #
  632. # Due to packet losses in the network, the data here
  633. # may be incorrect. There is little we can do about it.
  634. # radutmp
  635. # sradutmp
  636.  
  637. # Return an address to the IP Pool when we see a stop record.
  638. # main_pool
  639.  
  640. #
  641. # Log traffic to an SQL database.
  642. #
  643. # See "Accounting queries" in mods-available/sql
  644. #2018.03.22 Maksel need for sql
  645. # -sql
  646. sql
  647.  
  648. #
  649. # If you receive stop packets with zero session length,
  650. # they will NOT be logged in the database. The SQL module
  651. # will print a message (only in debugging mode), and will
  652. # return "noop".
  653. #
  654. # You can ignore these packets by uncommenting the following
  655. # three lines. Otherwise, the server will not respond to the
  656. # accounting request, and the NAS will retransmit.
  657. #
  658. # if (noop) {
  659. # ok
  660. # }
  661.  
  662. #
  663. # Instead of sending the query to the SQL server,
  664. # write it into a log file.
  665. #
  666. # sql_log
  667.  
  668. # Cisco VoIP specific bulk accounting
  669. # pgsql-voip
  670.  
  671. # For Exec-Program and Exec-Program-Wait
  672. #2018.03.22 Maksel
  673. # exec
  674.  
  675. # Filter attributes from the accounting response.
  676. #2018.03.22 Maksel это и было раскомментировано
  677. attr_filter.accounting_response
  678.  
  679. #
  680. # See "Autz-Type Status-Server" for how this works.
  681. #
  682. # Acct-Type Status-Server {
  683. #
  684. # }
  685. }
  686.  
  687.  
  688. # Session database, used for checking Simultaneous-Use. Either the radutmp
  689. # or rlm_sql module can handle this.
  690. # The rlm_sql module is *much* faster
  691. session {
  692. #2018.03.22 Maksel в 2м радиусе жто открыто
  693. radutmp
  694.  
  695. #
  696. # See "Simultaneous Use Checking Queries" in mods-available/sql
  697. # sql
  698. }
  699.  
  700.  
  701. # Post-Authentication
  702. # Once we KNOW that the user has been authenticated, there are
  703. # additional steps we can take.
  704. post-auth {
  705. #
  706. # If you need to have a State attribute, you can
  707. # add it here. e.g. for later CoA-Request with
  708. # State, and Service-Type = Authorize-Only.
  709. #
  710. # if (!&reply:State) {
  711. # update reply {
  712. # State := "0x%{randstr:16h}"
  713. # }
  714. # }
  715.  
  716. #
  717. # For EAP-TTLS and PEAP, add the cached attributes to the reply.
  718. # The "session-state" attributes are automatically cached when
  719. # an Access-Challenge is sent, and automatically retrieved
  720. # when an Access-Request is received.
  721. #
  722. # The session-state attributes are automatically deleted after
  723. # an Access-Reject or Access-Accept is sent.
  724. #
  725. update {
  726. &reply: += &session-state:
  727. }
  728.  
  729. # Get an address from the IP Pool.
  730. # main_pool
  731.  
  732.  
  733. # Create the CUI value and add the attribute to Access-Accept.
  734. # Uncomment the line below if *returning* the CUI.
  735. # cui
  736.  
  737. #
  738. # If you want to have a log of authentication replies,
  739. # un-comment the following line, and enable the
  740. # 'detail reply_log' module.
  741. #2018.03.22 Maksel логи пока будут включены потом нужно отключить
  742. #log -> /var/log/freeradius/radacct/127.0.0.1
  743. reply_log
  744.  
  745. #
  746. # After authenticating the user, do another SQL query.
  747. #
  748. # See "Authentication Logging Queries" in mods-available/sql
  749. #2018.03.22 Maksel
  750. # -sql
  751.  
  752. #
  753. # Instead of sending the query to the SQL server,
  754. # write it into a log file.
  755. #
  756. # sql_log
  757.  
  758. #
  759. # Un-comment the following if you want to modify the user's object
  760. # in LDAP after a successful login.
  761. #
  762. # ldap
  763.  
  764. # For Exec-Program and Exec-Program-Wait
  765. #2018.03.22 Maksel
  766. # exec
  767.  
  768. #
  769. # Calculate the various WiMAX keys. In order for this to work,
  770. # you will need to define the WiMAX NAI, usually via
  771. #
  772. # update request {
  773. # WiMAX-MN-NAI = "%{User-Name}"
  774. # }
  775. #
  776. # If you want various keys to be calculated, you will need to
  777. # update the reply with "template" values. The module will see
  778. # this, and replace the template values with the correct ones
  779. # taken from the cryptographic calculations. e.g.
  780. #
  781. # update reply {
  782. # WiMAX-FA-RK-Key = 0x00
  783. # WiMAX-MSK = "%{EAP-MSK}"
  784. # }
  785. #
  786. # You may want to delete the MS-MPPE-*-Keys from the reply,
  787. # as some WiMAX clients behave badly when those attributes
  788. # are included. See "raddb/modules/wimax", configuration
  789. # entry "delete_mppe_keys" for more information.
  790. #
  791. # wimax
  792.  
  793.  
  794. # If there is a client certificate (EAP-TLS, sometimes PEAP
  795. # and TTLS), then some attributes are filled out after the
  796. # certificate verification has been performed. These fields
  797. # MAY be available during the authentication, or they may be
  798. # available only in the "post-auth" section.
  799. #
  800. # The first set of attributes contains information about the
  801. # issuing certificate which is being used. The second
  802. # contains information about the client certificate (if
  803. # available).
  804. #
  805. # update reply {
  806. # Reply-Message += "%{TLS-Cert-Serial}"
  807. # Reply-Message += "%{TLS-Cert-Expiration}"
  808. # Reply-Message += "%{TLS-Cert-Subject}"
  809. # Reply-Message += "%{TLS-Cert-Issuer}"
  810. # Reply-Message += "%{TLS-Cert-Common-Name}"
  811. # Reply-Message += "%{TLS-Cert-Subject-Alt-Name-Email}"
  812. #
  813. # Reply-Message += "%{TLS-Client-Cert-Serial}"
  814. # Reply-Message += "%{TLS-Client-Cert-Expiration}"
  815. # Reply-Message += "%{TLS-Client-Cert-Subject}"
  816. # Reply-Message += "%{TLS-Client-Cert-Issuer}"
  817. # Reply-Message += "%{TLS-Client-Cert-Common-Name}"
  818. # Reply-Message += "%{TLS-Client-Cert-Subject-Alt-Name-Email}"
  819. # }
  820.  
  821. # Insert class attribute (with unique value) into response,
  822. # aids matching auth and acct records, and protects against duplicate
  823. # Acct-Session-Id. Note: Only works if the NAS has implemented
  824. # RFC 2865 behaviour for the class attribute, AND if the NAS
  825. # supports long Class attributes. Many older or cheap NASes
  826. # only support 16-octet Class attributes.
  827. # insert_acct_class
  828.  
  829. # MacSEC requires the use of EAP-Key-Name. However, we don't
  830. # want to send it for all EAP sessions. Therefore, the EAP
  831. # modules put required data into the EAP-Session-Id attribute.
  832. # This attribute is never put into a request or reply packet.
  833. #
  834. # Uncomment the next few lines to copy the required data into
  835. # the EAP-Key-Name attribute
  836. # if (&reply:EAP-Session-Id) {
  837. # update reply {
  838. # EAP-Key-Name := &reply:EAP-Session-Id
  839. # }
  840. # }
  841.  
  842. # Remove reply message if the response contains an EAP-Message
  843. remove_reply_message_if_eap
  844.  
  845. #
  846. # Access-Reject packets are sent through the REJECT sub-section of the
  847. # post-auth section.
  848. #
  849. # Add the ldap module name (or instance) if you have set
  850. # 'edir_account_policy_check = yes' in the ldap module configuration
  851. #
  852. # The "session-state" attributes are not available here.
  853. #
  854. Post-Auth-Type REJECT {
  855. # log failed authentications in SQL, too.
  856. #2018.03.22 Maksel во 2м радиусе это закоментировано
  857. # -sql
  858. # attr_filter.access_reject
  859.  
  860. # Insert EAP-Failure message if the request was
  861. # rejected by policy instead of because of an
  862. # authentication failure
  863. #2018.03.22 Maksel
  864. # eap
  865.  
  866. # Remove reply message if the response contains an EAP-Message
  867. remove_reply_message_if_eap
  868. }
  869. }
  870.  
  871. #
  872. # When the server decides to proxy a request to a home server,
  873. # the proxied request is first passed through the pre-proxy
  874. # stage. This stage can re-write the request, or decide to
  875. # cancel the proxy.
  876. #
  877. # Only a few modules currently have this method.
  878. #
  879. pre-proxy {
  880. # Before proxing the request add an Operator-Name attribute identifying
  881. # if the operator-name is found for this client.
  882. # No need to uncomment this if you have already enabled this in
  883. # the authorize section.
  884. # operator-name
  885.  
  886. # The client requests the CUI by sending a CUI attribute
  887. # containing one zero byte.
  888. # Uncomment the line below if *requesting* the CUI.
  889. # cui
  890.  
  891. # Uncomment the following line if you want to change attributes
  892. # as defined in the preproxy_users file.
  893. # files
  894.  
  895. # Uncomment the following line if you want to filter requests
  896. # sent to remote servers based on the rules defined in the
  897. # 'attrs.pre-proxy' file.
  898. # attr_filter.pre-proxy
  899.  
  900. # If you want to have a log of packets proxied to a home
  901. # server, un-comment the following line, and the
  902. # 'detail pre_proxy_log' section, above.
  903. # pre_proxy_log
  904. }
  905.  
  906. #
  907. # When the server receives a reply to a request it proxied
  908. # to a home server, the request may be massaged here, in the
  909. # post-proxy stage.
  910. #
  911. post-proxy {
  912.  
  913. # If you want to have a log of replies from a home server,
  914. # un-comment the following line, and the 'detail post_proxy_log'
  915. # section, above.
  916. # post_proxy_log
  917.  
  918. # Uncomment the following line if you want to filter replies from
  919. # remote proxies based on the rules defined in the 'attrs' file.
  920. # attr_filter.post-proxy
  921.  
  922. #
  923. # If you are proxying LEAP, you MUST configure the EAP
  924. # module, and you MUST list it here, in the post-proxy
  925. # stage.
  926. #
  927. # You MUST also use the 'nostrip' option in the 'realm'
  928. # configuration. Otherwise, the User-Name attribute
  929. # in the proxied request will not match the user name
  930. # hidden inside of the EAP packet, and the end server will
  931. # reject the EAP request.
  932. #
  933. #2018.03.22 Maksel
  934. # eap
  935.  
  936. #
  937. # If the server tries to proxy a request and fails, then the
  938. # request is processed through the modules in this section.
  939. #
  940. # The main use of this section is to permit robust proxying
  941. # of accounting packets. The server can be configured to
  942. # proxy accounting packets as part of normal processing.
  943. # Then, if the home server goes down, accounting packets can
  944. # be logged to a local "detail" file, for processing with
  945. # radrelay. When the home server comes back up, radrelay
  946. # will read the detail file, and send the packets to the
  947. # home server.
  948. #
  949. # With this configuration, the server always responds to
  950. # Accounting-Requests from the NAS, but only writes
  951. # accounting packets to disk if the home server is down.
  952. #
  953. # Post-Proxy-Type Fail-Accounting {
  954. # detail
  955. # }
  956. }
  957. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!