295 lines
8.6 KiB
Plaintext
295 lines
8.6 KiB
Plaintext
client ALL-DEVICES {
|
|
secret = ciscoradiuskey
|
|
nastype = cisco
|
|
ipaddr = 0.0.0.0/0
|
|
}
|
|
|
|
# -*- text -*-
|
|
##
|
|
## clients.conf -- client configuration directives
|
|
##
|
|
## $Id: 60f9f4bf8a32804182e4516ac69ac510d25215d1 $
|
|
|
|
#######################################################################
|
|
#
|
|
# Define RADIUS clients (usually a NAS, Access Point, etc.).
|
|
|
|
#
|
|
# Defines a RADIUS client.
|
|
#
|
|
# '127.0.0.1' is another name for 'localhost'. It is enabled by default,
|
|
# to allow testing of the server after an initial installation. If you
|
|
# are not going to be permitting RADIUS queries from localhost, we suggest
|
|
# that you delete, or comment out, this entry.
|
|
#
|
|
#
|
|
|
|
#
|
|
# Each client has a "short name" that is used to distinguish it from
|
|
# other clients.
|
|
#
|
|
# In version 1.x, the string after the word "client" was the IP
|
|
# address of the client. In 2.0, the IP address is configured via
|
|
# the "ipaddr" or "ipv6addr" fields. For compatibility, the 1.x
|
|
# format is still accepted.
|
|
#
|
|
# client localhost {
|
|
# # Only *one* of ipaddr, ipv4addr, ipv6addr may be specified for
|
|
# # a client.
|
|
# #
|
|
# # ipaddr will accept IPv4 or IPv6 addresses with optional CIDR
|
|
# # notation '/<mask>' to specify ranges.
|
|
# #
|
|
# # ipaddr will accept domain names e.g. example.org resolving
|
|
# # them via DNS.
|
|
# #
|
|
# # If both A and AAAA records are found, A records will be
|
|
# # used in preference to AAAA.
|
|
# ipaddr = 127.0.0.1
|
|
|
|
# # Same as ipaddr but allows v4 addresses only. Requires A
|
|
# # record for domain names.
|
|
# # ipv4addr = * # any. 127.0.0.1 == localhost
|
|
|
|
# # Same as ipaddr but allows v6 addresses only. Requires AAAA
|
|
# # record for domain names.
|
|
# # ipv6addr = :: # any. ::1 == localhost
|
|
|
|
# #
|
|
# # A note on DNS: We STRONGLY recommend using IP addresses
|
|
# # rather than host names. Using host names means that the
|
|
# # server will do DNS lookups when it starts, making it
|
|
# # dependent on DNS. i.e. If anything goes wrong with DNS,
|
|
# # the server won't start!
|
|
# #
|
|
# # The server also looks up the IP address from DNS once, and
|
|
# # only once, when it starts. If the DNS record is later
|
|
# # updated, the server WILL NOT see that update.
|
|
# #
|
|
|
|
# #
|
|
# # The transport protocol.
|
|
# #
|
|
# # If unspecified, defaults to "udp", which is the traditional
|
|
# # RADIUS transport. It may also be "tcp", in which case the
|
|
# # server will accept connections from this client ONLY over TCP.
|
|
# #
|
|
# proto = *
|
|
|
|
# #
|
|
# # The shared secret use to "encrypt" and "sign" packets between
|
|
# # the NAS and FreeRADIUS. You MUST change this secret from the
|
|
# # default, otherwise it's not a secret any more!
|
|
# #
|
|
# # The secret can be any string, up to 8k characters in length.
|
|
# #
|
|
# # Control codes can be entered vi octal encoding,
|
|
# # e.g. "\101\102" == "AB"
|
|
# # Quotation marks can be entered by escaping them,
|
|
# # e.g. "foo\"bar"
|
|
# #
|
|
# # A note on security: The security of the RADIUS protocol
|
|
# # depends COMPLETELY on this secret! We recommend using a
|
|
# # shared secret that is composed of:
|
|
# #
|
|
# # upper case letters
|
|
# # lower case letters
|
|
# # numbers
|
|
# #
|
|
# # And is at LEAST 8 characters long, preferably 16 characters in
|
|
# # length. The secret MUST be random, and should not be words,
|
|
# # phrase, or anything else that is recognisable.
|
|
# #
|
|
# # The default secret below is only for testing, and should
|
|
# # not be used in any real environment.
|
|
# #
|
|
# secret = testing123
|
|
|
|
# #
|
|
# # Old-style clients do not send a Message-Authenticator
|
|
# # in an Access-Request. RFC 5080 suggests that all clients
|
|
# # SHOULD include it in an Access-Request. The configuration
|
|
# # item below allows the server to require it. If a client
|
|
# # is required to include a Message-Authenticator and it does
|
|
# # not, then the packet will be silently discarded.
|
|
# #
|
|
# # allowed values: yes, no
|
|
# require_message_authenticator = no
|
|
|
|
# #
|
|
# # The short name is used as an alias for the fully qualified
|
|
# # domain name, or the IP address.
|
|
# #
|
|
# # It is accepted for compatibility with 1.x, but it is no
|
|
# # longer necessary in >= 2.0
|
|
# #
|
|
# # shortname = localhost
|
|
|
|
# #
|
|
# # the following three fields are optional, but may be used by
|
|
# # checkrad.pl for simultaneous use checks
|
|
# #
|
|
|
|
# #
|
|
# # The nas_type tells 'checkrad.pl' which NAS-specific method to
|
|
# # use to query the NAS for simultaneous use.
|
|
# #
|
|
# # Permitted NAS types are:
|
|
# #
|
|
# # cisco
|
|
# # computone
|
|
# # livingston
|
|
# # juniper
|
|
# # max40xx
|
|
# # multitech
|
|
# # netserver
|
|
# # pathras
|
|
# # patton
|
|
# # portslave
|
|
# # tc
|
|
# # usrhiper
|
|
# # other # for all other types
|
|
|
|
# #
|
|
# nas_type = other # localhost isn't usually a NAS...
|
|
|
|
# #
|
|
# # The following two configurations are for future use.
|
|
# # The 'naspasswd' file is currently used to store the NAS
|
|
# # login name and password, which is used by checkrad.pl
|
|
# # when querying the NAS for simultaneous use.
|
|
# #
|
|
# # login = !root
|
|
# # password = someadminpas
|
|
|
|
# #
|
|
# # As of 2.0, clients can also be tied to a virtual server.
|
|
# # This is done by setting the "virtual_server" configuration
|
|
# # item, as in the example below.
|
|
# #
|
|
# # virtual_server = home1
|
|
|
|
# #
|
|
# # A pointer to the "home_server_pool" OR a "home_server"
|
|
# # section that contains the CoA configuration for this
|
|
# # client. For an example of a coa home server or pool,
|
|
# # see raddb/sites-available/originate-coa
|
|
# # coa_server = coa
|
|
|
|
# #
|
|
# # Response window for proxied packets. If non-zero,
|
|
# # then the lower of (home, client) response_window
|
|
# # will be used.
|
|
# #
|
|
# # i.e. it can be used to lower the response_window
|
|
# # packets from one client to a home server. It cannot
|
|
# # be used to raise the response_window.
|
|
# #
|
|
# # response_window = 10.0
|
|
|
|
# #
|
|
# # Connection limiting for clients using "proto = tcp".
|
|
# #
|
|
# # This section is ignored for clients sending UDP traffic
|
|
# #
|
|
# limit {
|
|
# #
|
|
# # Limit the number of simultaneous TCP connections from a client
|
|
# #
|
|
# # The default is 16.
|
|
# # Setting this to 0 means "no limit"
|
|
# max_connections = 16
|
|
|
|
# # The per-socket "max_requests" option does not exist.
|
|
|
|
# #
|
|
# # The lifetime, in seconds, of a TCP connection. After
|
|
# # this lifetime, the connection will be closed.
|
|
# #
|
|
# # Setting this to 0 means "forever".
|
|
# lifetime = 0
|
|
|
|
# #
|
|
# # The idle timeout, in seconds, of a TCP connection.
|
|
# # If no packets have been received over the connection for
|
|
# # this time, the connection will be closed.
|
|
# #
|
|
# # Setting this to 0 means "no timeout".
|
|
# #
|
|
# # We STRONGLY RECOMMEND that you set an idle timeout.
|
|
# #
|
|
# idle_timeout = 30
|
|
# }
|
|
# }
|
|
|
|
# IPv6 Client
|
|
# client localhost_ipv6 {
|
|
# ipv6addr = ::1
|
|
# secret = testing123
|
|
# }
|
|
|
|
# All IPv6 Site-local clients
|
|
#client sitelocal_ipv6 {
|
|
# ipv6addr = fe80::/16
|
|
# secret = testing123
|
|
#}
|
|
|
|
#client example.org {
|
|
# ipaddr = radius.example.org
|
|
# secret = testing123
|
|
#}
|
|
|
|
#
|
|
# You can now specify one secret for a network of clients.
|
|
# When a client request comes in, the BEST match is chosen.
|
|
# i.e. The entry from the smallest possible network.
|
|
#
|
|
#client private-network-1 {
|
|
# ipaddr = 192.0.2.0/24
|
|
# secret = testing123-1
|
|
#}
|
|
|
|
#client private-network-2 {
|
|
# ipaddr = 198.51.100.0/24
|
|
# secret = testing123-2
|
|
#}
|
|
|
|
#######################################################################
|
|
#
|
|
# Per-socket client lists. The configuration entries are exactly
|
|
# the same as above, but they are nested inside of a section.
|
|
#
|
|
# You can have as many per-socket client lists as you have "listen"
|
|
# sections, or you can re-use a list among multiple "listen" sections.
|
|
#
|
|
# Un-comment this section, and edit a "listen" section to add:
|
|
# "clients = per_socket_clients". That IP address/port combination
|
|
# will then accept ONLY the clients listed in this section.
|
|
#
|
|
# There are additional considerations when using clients from SQL.
|
|
#
|
|
# A client can be link to a virtual server via modules such as SQL.
|
|
# This link is done via the following process:
|
|
#
|
|
# If there is no listener in a virtual server, SQL clients are added
|
|
# to the global list for that virtual server.
|
|
#
|
|
# If there is a listener, and the first listener does not have a
|
|
# "clients=..." configuration item, SQL clients are added to the
|
|
# global list.
|
|
#
|
|
# If there is a listener, and the first one does have a "clients=..."
|
|
# configuration item, SQL clients are added to that list. The client
|
|
# { ...} ` configured in that list are also added for that listener.
|
|
#
|
|
# The only issue is if you have multiple listeners in a virtual
|
|
# server, each with a different client list, then the SQL clients are
|
|
# added only to the first listener.
|
|
#
|
|
#clients per_socket_clients {
|
|
# client socket_client {
|
|
# ipaddr = 192.0.2.4
|
|
# secret = testing123
|
|
# }
|
|
#}
|