radiusd-example.txt

linux1.0内核的源代码,欢迎大家使用

	#  one section (e.g. 'authorize', 'pre_proxy', etc), then it
	#  is probably best to define a different instance of the
	#  'exec' module for every section.	
	#	
	exec echo {
		#
		#  Wait for the program to finish.
		#
		#  If we do NOT wait, then the program is "fire and
		#  forget", and any output attributes from it are ignored.
		#
		#  If we are looking for the program to output
		#  attributes, and want to add those attributes to the
		#  request, then we MUST wait for the program to
		#  finish, and therefore set 'wait=yes'
		#
		# allowed values: {no, yes}
		wait = yes

		#
		#  The name of the program to execute, and it's
		#  arguments.  Dynamic translation is done on this
		#  field, so things like the following example will
		#  work.
		#
		program = "/bin/echo %{User-Name}"

		#
		#  The attributes which are placed into the
		#  environment variables for the program.
		#
		#  Allowed values are:
		#
		#	request		attributes from the request
		#	reply		attributes from the reply
		#	proxy-request	attributes from the proxy request
		#	proxy-reply	attributes from the proxy reply
		#
		#  Note that some attributes may not exist at some
		#  stages.  e.g. There may be no proxy-reply
		#  attributes if this module is used in the
		#  'authorize' section.
		#
		input_pairs = request

		#
		#  Where to place the output attributes (if any) from
		#  the executed program.  The values allowed, and the
		#  restrictions as to availability, are the same as
		#  for the input_pairs.
		#
		output_pairs = reply

		#
		#  When to execute the program.  If the packet
		#  type does NOT match what's listed here, then
		#  the module does NOT execute the program.
		#
		#  For a list of allowed packet types, see
		#  the 'dictionary' file, and look for VALUEs
		#  of the Packet-Type attribute.
		#
		#  By default, the module executes on ANY packet.
		#  Un-comment out the following line to tell the
		#  module to execute only if an Access-Accept is
		#  being sent to the NAS.
		#
		#packet_type = Access-Accept
	}

	#  Do server side ip pool management. Should be added in post-auth and
	#  accounting sections.
	#
	#  The module also requires the existance of the Pool-Name
	#  attribute. That way the administrator can add the Pool-Name
	#  attribute in the user profiles and use different pools
	#  for different users. The Pool-Name attribute is a *check* item not
	#  a reply item.
	#
	# Example:
	# radiusd.conf: ippool students { [...] }
	# users file  : DEFAULT Group == students, Pool-Name := "students"
	#
	# ********* IF YOU CHANGE THE RANGE PARAMETERS YOU MUST THEN ERASE THE DB FILES *******
	#
	ippool main_pool {

		#  range-start,range-stop: The start and end ip
		#  addresses for the ip pool
		range-start = 192.168.1.1
		range-stop = 192.168.3.254

		#  netmask: The network mask used for the ip's
		netmask = 255.255.255.0

		#  cache-size: The gdbm cache size for the db
		#  files. Should be equal to the number of ip's
		#  available in the ip pool
		cache-size = 800

		# session-db: The main db file used to allocate ip's to clients
		session-db = ${raddbdir}/db.ippool

		# ip-index: Helper db index file used in multilink
		ip-index = ${raddbdir}/db.ipindex

		# override: Will this ippool override a Framed-IP-Address already set
		override = no
	}

	# ANSI X9.9 token support.  Not included by default.
	# $INCLUDE  ${confdir}/x99.conf

}

# Instantiation
#
#  This section orders the loading of the modules.  Modules
#  listed here will get loaded BEFORE the later sections like
#  authorize, authenticate, etc. get examined.
#
#  This section is not strictly needed.  When a section like
#  authorize refers to a module, it's automatically loaded and
#  initialized.  However, some modules may not be listed in any
#  of the following sections, so they can be listed here.
#
#  Also, listing modules here ensures that you have control over
#  the order in which they are initalized.  If one module needs
#  something defined by another module, you can list them in order
#  here, and ensure that the configuration will be OK.
#
instantiate {
	#
	#  The expression module doesn't do authorization,
	#  authentication, or accounting.  It only does dynamic
	#  translation, of the form:
	#
	#	Session-Timeout = `%{expr:2 + 3}`
	#
	#  So the module needs to be instantiated, but CANNOT be
	#  listed in any other section.  See 'doc/rlm_expr' for
	#  more information.
	#
	expr

	#
	# We add the counter module here so that it registers
	# the check-name attribute before any module which sets
	# it
#	daily
}

#  Authorization. First preprocess (hints and huntgroups files),
#  then realms, and finally look in the "users" file.
#
#  The order of the realm modules will determine the order that
#  we try to find a matching realm.
#
#  Make *sure* that 'preprocess' comes before any realm if you 
#  need to setup hints for the remote radius server
authorize {
	#
	#  The preprocess module takes care of sanitizing some bizarre
	#  attributes in the request, and turning them into attributes
	#  which are more standard.
	#
	#  It takes care of processing the 'raddb/hints' and the
	#  'raddb/huntgroups' files.
	#
	#  It also adds a Client-IP-Address attribute to the request.
	preprocess
	
	#
	#  The chap module will set 'Auth-Type := CHAP' if we are
	#  handling a CHAP request and Auth-Type has not already been set
	chap

#	attr_filter

	#
	#  This module takes care of EAP-MD5, EAP-TLS, and EAP-LEAP
	#  authentication.
	eap

	#
	#  If you have a Cisco SIP server authenticating against
	#  FreeRADIUS, uncomment the following line.
	# digest

	#
	#  Look for IPASS style 'realm/', and if not found, look for
	#  '@realm', and decide whether or not to proxy, based on
	#  that.
#	realmslash
	suffix

	#
	#  Read the 'users' file
	files

	#
	#  If you are using /etc/smbpasswd, and are also doing
	#  mschap authentication, the un-comment this line, and
	#  configure the 'etc_smbpasswd' module, above.
#	etc_smbpasswd

	#
	#  If the users are logging in with an MS-CHAP-Challenge
	#  attribute for authentication, the mschap module will find
	#  the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP'
	#  to the request, which will cause the server to then use
	#  the mschap module for authentication.
	mschap


# The ldap module will set Auth-Type to LDAP if it has not already been set
#	ldap
#	daily
}


# Authentication.
#
#  This section lists which modules are available for authentication.
#  Note that it does NOT mean 'try each module in order'.  It means
#  that you have to have a module from the 'authorize' section add
#  a configuration attribute 'Auth-Type := FOO'.  That authentication type
#  is then used to pick the apropriate module from the list below.
#
#  The default Auth-Type is Local.  That is, whatever is not included inside
# an authtype section will be called only if Auth-Type is set to Local.
#
# So you should do the following:
# - Set Auth-Type to an appropriate value in the authorize modules above.
#   For example, the chap module will set Auth-Type to CHAP, ldap to LDAP, etc.
# - After that create corresponding authtype sections in the
#   authenticate section below and call the appropriate modules.
authenticate {
	#
	#  PAP authentication, when a back-end database listed
	#  in the 'authorize' section supplies a password.  The
	#  password can be clear-text, or encrypted.
	Auth-Type PAP {
		pap
	}

	#
	#  Most people want CHAP authentication
	#  A back-end database listed in the 'authorize' section
	#  MUST supply a CLEAR TEXT password.  Encrypted passwords
	#  won't work.
	Auth-Type CHAP {
		chap
	}

	#
	#  MSCHAP authentication.
	Auth-Type MS-CHAP {
		mschap
	}

	#
	#  If you have a Cisco SIP server authenticating against
	#  FreeRADIUS, uncomment the following line.
	# digest

	#
	#  Pluggable Authentication Modules.
#	pam

	#
	#  See 'man getpwent' for information on how the 'unix'
	#  module checks the users password.  Note that packets
	#  containing CHAP-Password attributes CANNOT be authenticated
	#  against /etc/passwd!  See the FAQ for details.
	#  
	unix

	# Uncomment it if you want to use ldap for authentication
#	Auth-Type LDAP {
#		ldap
#	}


	#
	#  Allow EAP authentication.
	eap
}


#
#  Pre-accounting.  Decide which accounting type to use.
#
preacct {
	preprocess

	#
	#  Look for IPASS-style 'realm/', and if not found, look for
	#  '@realm', and decide whether or not to proxy, based on
	#  that.
	#
	#  Accounting requests are generally proxied to the same
	#  home server as authentication requests.
#	realmslash
	suffix

	#
	#  Read the 'acct_users' file
	files
}

#
#  Accounting.  Log the accounting data.
#
accounting {
	#
	#  Ensure that we have a semi-unique identifier for every
	#  request, and many NAS boxes are broken.
	acct_unique

	#
	#  Create a 'detail'ed log of the packets.
	#  Note that accounting requests which are proxied
	#  are also logged in the detail file.
	detail
#	daily

	unix		# wtmp file

	#
	#  For Simultaneous-Use tracking.
	#
	#  Due to packet losses in the network, the data here
	#  may be incorrect.  There's little we can do about it.
	radutmp
#	sradutmp

	#  Return an address to the IP Pool when we see a stop record.
#	main_pool
}


#  Session database, used for checking Simultaneous-Use. Either the radutmp 
#  or rlm_sql module can handle this.
#  The rlm_sql module is *much* faster
session {
	radutmp
#	sql
}


#  Post-Authentication
#  Once we KNOW that the user has been authenticated, there are
#  additional steps we can take.
post-auth {
	#  Get an address from the IP Pool.
#	main_pool
}

#
#  When the server decides to proxy a request to a home server,
#  the proxied request is first passed through the pre-proxy
#  stage.  This stage can re-write the request, or decide to
#  cancel the proxy.
#
#  Only a few modules currently have this method.
#
pre-proxy {
	# attr_rewrite
}

#
#  When the server receives a reply to a request it proxied
#  to a home server, the request may be massaged here, in the
#  post-proxy stage.
#
post-proxy {
	# attr_rewrite

	#
	#  If you are proxing LEAP, you MUST configure the EAP
	#  module, and you MUST list it here, in the post-proxy
	#  stage.
	#
	#  You MUST also use the 'nostrip' option in the 'realm'
	#  configuration.  Otherwise, the User-Name attribute
	#  in the proxied request will not match the user name
	#  hidden inside of the EAP packet, and the end server will
	#  reject the EAP request.
	#
	eap
}