feat: add hosted install [ci skip]
This commit is contained in:
Georg K
@@ -39,7 +39,7 @@ RUN git checkout ${RADIUS_TAG}; \
|
||||
#
|
||||
# Build the server
|
||||
#
|
||||
RUN make -j2 deb && ls -la ..
|
||||
RUN make -j2 deb
|
||||
|
||||
WORKDIR /usr/local/src/repositories
|
||||
ADD upload.sh .
|
||||
|
||||
40
hosted/config/clients.conf
Normal file
40
hosted/config/clients.conf
Normal file
@@ -0,0 +1,40 @@
|
||||
#
|
||||
# Define a network where clients may be dynamically defined.
|
||||
client dynamic {
|
||||
#
|
||||
# You MUST specify a netmask!
|
||||
# IPv4 /32 or IPv6 /128 are NOT allowed!
|
||||
ipaddr = 0.0.0.0/0
|
||||
|
||||
#
|
||||
# Any other configuration normally found in a "client"
|
||||
# entry can be used here.
|
||||
|
||||
#
|
||||
# A shared secret does NOT have to be defined. It can
|
||||
# be left out.
|
||||
|
||||
#
|
||||
# Define the virtual server used to discover dynamic clients.
|
||||
dynamic_clients = dynamic_clients
|
||||
|
||||
#
|
||||
# The directory where client definitions are stored. This
|
||||
# needs to be used ONLY if the client definitions are stored
|
||||
# in flat-text files. Each file in that directory should be
|
||||
# ONE and only one client definition. The name of the file
|
||||
# should be the IP address of the client.
|
||||
#
|
||||
# If you are storing clients in SQL, this entry should not
|
||||
# be used.
|
||||
# directory = ${confdir}/dynamic-clients/
|
||||
|
||||
#
|
||||
# Define the lifetime (in seconds) for dynamic clients.
|
||||
# They will be cached for this lifetime, and deleted afterwards.
|
||||
#
|
||||
# If the lifetime is "0", then the dynamic client is never
|
||||
# deleted. The only way to delete the client is to re-start
|
||||
# the server.
|
||||
lifetime = 10
|
||||
}
|
||||
97
hosted/config/dictionary
Normal file
97
hosted/config/dictionary
Normal file
@@ -0,0 +1,97 @@
|
||||
#
|
||||
# This is the local dictionary file which can be
|
||||
# edited by local administrators. It will be loaded
|
||||
# AFTER the main dictionary files are loaded.
|
||||
#
|
||||
# FreeRADIUS will automatically load the main dictionary files
|
||||
# from:
|
||||
#
|
||||
# ${prefix}/share/freeradius/dictionary
|
||||
#
|
||||
# It is no longer necessary for this file to $INCLUDE
|
||||
# the main dictionaries. However, if the $INCLUDE
|
||||
# line is here, nothing bad will happen.
|
||||
#
|
||||
# Any new/changed attributes MUST be placed in this file.
|
||||
# The pre-defined dictionaries SHOULD NOT be edited.
|
||||
#
|
||||
# See "man dictionary" for documentation on its format.
|
||||
#
|
||||
# $Id: ad56be71fdfcbc8b577a93ce55a32e5c7865811d $
|
||||
#
|
||||
|
||||
#
|
||||
# All local attributes and $INCLUDE's should go into
|
||||
# this file.
|
||||
#
|
||||
|
||||
# If you want to add entries to the dictionary file,
|
||||
# which are NOT going to be placed in a RADIUS packet,
|
||||
# add them to the 'dictionary.local' file.
|
||||
#
|
||||
# The numbers you pick should be between 3000 and 4000.
|
||||
# These attributes will NOT go into a RADIUS packet.
|
||||
#
|
||||
# If you want that, you will need to use VSAs. This means
|
||||
# requesting allocation of a Private Enterprise Code from
|
||||
# http://iana.org. We STRONGLY suggest doing that only if
|
||||
# you are a vendor of RADIUS equipment.
|
||||
#
|
||||
# See RFC 6158 for more details.
|
||||
# http://ietf.org/rfc/rfc6158.txt
|
||||
#
|
||||
|
||||
#
|
||||
# These attributes are examples
|
||||
#
|
||||
#ATTRIBUTE My-Local-String 3000 string
|
||||
#ATTRIBUTE My-Local-IPAddr 3001 ipaddr
|
||||
#ATTRIBUTE My-Local-Integer 3002 integer
|
||||
|
||||
# MikroTik Attributes
|
||||
|
||||
VENDOR Mikrotik 14988
|
||||
|
||||
BEGIN-VENDOR Mikrotik
|
||||
|
||||
ATTRIBUTE Mikrotik-Recv-Limit 1 integer
|
||||
ATTRIBUTE Mikrotik-Xmit-Limit 2 integer
|
||||
ATTRIBUTE Mikrotik-Group 3 string
|
||||
ATTRIBUTE Mikrotik-Wireless-Forward 4 integer
|
||||
ATTRIBUTE Mikrotik-Wireless-Skip-Dot1x 5 integer
|
||||
ATTRIBUTE Mikrotik-Wireless-Enc-Algo 6 integer
|
||||
ATTRIBUTE Mikrotik-Wireless-Enc-Key 7 string
|
||||
ATTRIBUTE Mikrotik-Rate-Limit 8 string
|
||||
ATTRIBUTE Mikrotik-Realm 9 string
|
||||
ATTRIBUTE Mikrotik-Host-IP 10 ipaddr
|
||||
ATTRIBUTE Mikrotik-Mark-Id 11 string
|
||||
ATTRIBUTE Mikrotik-Advertise-URL 12 string
|
||||
ATTRIBUTE Mikrotik-Advertise-Interval 13 integer
|
||||
ATTRIBUTE Mikrotik-Recv-Limit-Gigawords 14 integer
|
||||
ATTRIBUTE Mikrotik-Xmit-Limit-Gigawords 15 integer
|
||||
ATTRIBUTE Mikrotik-Wireless-PSK 16 string
|
||||
ATTRIBUTE Mikrotik-Total-Limit 17 integer
|
||||
ATTRIBUTE Mikrotik-Total-Limit-Gigawords 18 integer
|
||||
ATTRIBUTE Mikrotik-Address-List 19 string
|
||||
ATTRIBUTE Mikrotik-Wireless-MPKey 20 string
|
||||
ATTRIBUTE Mikrotik-Wireless-Comment 21 string
|
||||
ATTRIBUTE Mikrotik-Delegated-IPv6-Pool 22 string
|
||||
ATTRIBUTE Mikrotik_DHCP_Option_Set 23 string
|
||||
ATTRIBUTE Mikrotik_DHCP_Option_Param_STR1 24 string
|
||||
ATTRIBUTE Mikortik_DHCP_Option_Param_STR2 25 string
|
||||
ATTRIBUTE Mikrotik_Wireless_VLANID 26 integer
|
||||
ATTRIBUTE Mikrotik_Wireless_VLANIDtype 27 integer
|
||||
ATTRIBUTE Mikrotik_Wireless_Minsignal 28 string
|
||||
ATTRIBUTE Mikrotik_Wireless_Maxsignal 29 string
|
||||
|
||||
# MikroTik Values
|
||||
|
||||
VALUE Mikrotik-Wireless-Enc-Algo No-encryption 0
|
||||
VALUE Mikrotik-Wireless-Enc-Algo 40-bit-WEP 1
|
||||
VALUE Mikrotik-Wireless-Enc-Algo 104-bit-WEP 2
|
||||
VALUE Mikrotik-Wireless-Enc-Algo AES-CCM 3
|
||||
VALUE Mikrotik-Wireless-Enc-Algo TKIP 4
|
||||
VALUE Mikrotik_Wireless_VLANIDtype 802.1q 0
|
||||
VALUE Mikrotik_Wireless_VLANIDtype 802.1ad 1
|
||||
|
||||
END-VENDOR Mikrotik
|
||||
2
hosted/config/mods-enabled/raw
Normal file
2
hosted/config/mods-enabled/raw
Normal file
@@ -0,0 +1,2 @@
|
||||
raw {
|
||||
}
|
||||
300
hosted/config/mods-enabled/rest
Normal file
300
hosted/config/mods-enabled/rest
Normal file
@@ -0,0 +1,300 @@
|
||||
rest {
|
||||
#
|
||||
# This subsection configures the tls related items
|
||||
# that control how FreeRADIUS connects to a HTTPS
|
||||
# server.
|
||||
#
|
||||
tls {
|
||||
# Certificate Authorities:
|
||||
# "ca_file" (libcurl option CURLOPT_ISSUERCERT).
|
||||
# File containing a single CA, which is the issuer of the server
|
||||
# certificate.
|
||||
# "ca_info_file" (libcurl option CURLOPT_CAINFO).
|
||||
# File containing a bundle of certificates, which allow to handle
|
||||
# certificate chain validation.
|
||||
# "ca_path" (libcurl option CURLOPT_CAPATH).
|
||||
# Directory holding CA certificates to verify the peer with.
|
||||
# ca_file = ${certdir}/cacert.pem
|
||||
# ca_info_file = ${certdir}/cacert_bundle.pem
|
||||
# ca_path = ${certdir}
|
||||
|
||||
# certificate_file = /path/to/radius.crt
|
||||
# private_key_file = /path/to/radius.key
|
||||
# private_key_password = "supersecret"
|
||||
# random_file = /dev/urandom
|
||||
|
||||
# Server certificate verification requirements. Can be:
|
||||
# "no" (don't even bother trying)
|
||||
# "yes" (verify the cert was issued by one of the
|
||||
# trusted CAs)
|
||||
#
|
||||
# The default is "yes"
|
||||
# check_cert = yes
|
||||
|
||||
# Server certificate CN verification requirements. Can be:
|
||||
# "no" (don't even bother trying)
|
||||
# "yes" (verify the CN in the certificate matches the host
|
||||
# in the URI)
|
||||
#
|
||||
# The default is "yes"
|
||||
# check_cert_cn = yes
|
||||
}
|
||||
|
||||
# rlm_rest will open a connection to the server specified in connect_uri
|
||||
# to populate the connection cache, ready for the first request.
|
||||
# The server will not start if the server specified is unreachable.
|
||||
#
|
||||
# If you wish to disable this pre-caching and reachability check,
|
||||
# comment out the configuration item below.
|
||||
#connect_uri = "http://connectone.me:31668"
|
||||
connect_uri = "http://#API_HOST#:#API_PORT#/"
|
||||
|
||||
#
|
||||
# How long before new connection attempts timeout, defaults to 4.0 seconds.
|
||||
#
|
||||
# connect_timeout = 4.0
|
||||
|
||||
#
|
||||
# Specify HTTP protocol version to use. one of '1.0', '1.1', '2.0', '2.0+auto',
|
||||
# '2.0+tls' or 'default'. (libcurl option CURLOPT_HTTP_VERSION)
|
||||
#
|
||||
# http_negotiation = 1.1
|
||||
|
||||
#
|
||||
# The following config items can be used in each of the sections.
|
||||
# The sections themselves reflect the sections in the server.
|
||||
# For example if you list rest in the authorize section of a virtual server,
|
||||
# the settings from the authorize section here will be used.
|
||||
#
|
||||
# The following config items may be listed in any of the sections:
|
||||
# uri - to send the request to.
|
||||
# method - HTTP method to use, one of 'get', 'post', 'put', 'patch',
|
||||
# 'delete' or any custom HTTP method.
|
||||
# body - The format of the HTTP body sent to the remote server.
|
||||
# May be 'none', 'post' or 'json', defaults to 'none'.
|
||||
# attr_num - If true, the attribute number is supplied for each attribute.
|
||||
# Defaults to false.
|
||||
# raw_value - If true, enumerated attribute values are provided as numeric
|
||||
# values. Defaults to false.
|
||||
# data - Send custom freeform data in the HTTP body. Content-type
|
||||
# may be specified with 'body'. Will be expanded.
|
||||
# Values from expansion will not be escaped, this should be
|
||||
# done using the appropriate xlat method e.g. %{urlencode:<attr>}.
|
||||
# force_to - Force the response to be decoded with this decoder.
|
||||
# May be 'plain' (creates reply:REST-HTTP-Body), 'post'
|
||||
# or 'json'.
|
||||
# tls - TLS settings for HTTPS.
|
||||
# auth - HTTP auth method to use, one of 'none', 'srp', 'basic',
|
||||
# 'digest', 'digest-ie', 'gss-negotiate', 'ntlm',
|
||||
# 'ntlm-winbind', 'any', 'safe'. defaults to 'none'.
|
||||
# username - User to authenticate as, will be expanded.
|
||||
# password - Password to use for authentication, will be expanded.
|
||||
# require_auth - Require HTTP authentication.
|
||||
# timeout - HTTP request timeout in seconds, defaults to 4.0.
|
||||
# chunk - Chunk size to use. If set, HTTP chunked encoding is used to
|
||||
# send data to the REST server. Make sure that this is large
|
||||
# enough to fit your largest attribute value's text
|
||||
# representation.
|
||||
# A number like 8192 is good.
|
||||
#
|
||||
# Additional HTTP headers may be specified with control:REST-HTTP-Header.
|
||||
# The values of those attributes should be in the format:
|
||||
#
|
||||
# control:REST-HTTP-Header := "<HTTP attribute>: <value>"
|
||||
#
|
||||
# The control:REST-HTTP-Header attributes will be consumed
|
||||
# (i.e. deleted) after each call to the rest module, and each
|
||||
# %{rest:} expansion. This is so that headers from one REST
|
||||
# call do not affect headers from a different REST call.
|
||||
#
|
||||
# Body encodings are the same for requests and responses
|
||||
#
|
||||
# POST - All attributes and values are urlencoded
|
||||
# [outer.][<list>:]<attribute0>=<value0>&[outer.][<list>:]<attributeN>=<valueN>
|
||||
#
|
||||
# JSON - All attributes and values are escaped according to the JSON specification
|
||||
# - attribute Name of the attribute.
|
||||
# - attr_num Number of the attribute. Only available if the configuration item
|
||||
# 'attr_num' is enabled.
|
||||
# - type Type of the attribute (e.g. "integer", "string", "ipaddr", "octets", ...).
|
||||
# - value Attribute value, for enumerated attributes the human readable value is
|
||||
# provided and not the numeric value (Depends on the 'raw_value' config item).
|
||||
# {
|
||||
# "<attribute0>":{
|
||||
# "attr_num":<attr_num0>,
|
||||
# "type":"<type0>",
|
||||
# "value":[<value0>,<value1>,<valueN>]
|
||||
# },
|
||||
# "<attribute1>":{
|
||||
# "attr_num":<attr_num1>,
|
||||
# "type":"<type1>",
|
||||
# "value":[...]
|
||||
# },
|
||||
# "<attributeN>":{
|
||||
# "attr_num":<attr_numN>,
|
||||
# "type":"<typeN>",
|
||||
# "value":[...]
|
||||
# },
|
||||
# }
|
||||
#
|
||||
# The response format adds three optional fields:
|
||||
# - do_xlat If true, any values will be xlat expanded. Defaults to true.
|
||||
# - is_json If true, any nested JSON data will be copied to the attribute
|
||||
# in string form. Defaults to true.
|
||||
# - op Controls how the attribute is inserted into the target list.
|
||||
# Defaults to ':='. To create multiple attributes from multiple
|
||||
# values, this should be set to '+=', otherwise only the last
|
||||
# value will be used, and it will be assigned to a single
|
||||
# attribute.
|
||||
# {
|
||||
# "<attribute0>":{
|
||||
# "is_json":<bool>,
|
||||
# "do_xlat":<bool>,
|
||||
# "op":"<operator>",
|
||||
# "value":[<value0>,<value1>,<valueN>]
|
||||
# },
|
||||
# "<attribute1>":"value",
|
||||
# "<attributeN>":{
|
||||
# "value":[<value0>,<value1>,<valueN>],
|
||||
# "op":"+="
|
||||
# }
|
||||
# }
|
||||
|
||||
#
|
||||
# Module return codes are determined by HTTP response codes. These vary depending on the
|
||||
# section.
|
||||
#
|
||||
# If the body is processed and found to be malformed or unsupported fail will be returned.
|
||||
# If the body is processed and found to contain attribute updated will be returned,
|
||||
# except in the case of a 401 code.
|
||||
#
|
||||
|
||||
# Authorize/Authenticate
|
||||
#
|
||||
# Code Meaning Process body Module code
|
||||
# 404 not found no notfound
|
||||
# 410 gone no notfound
|
||||
# 403 forbidden no userlock
|
||||
# 401 unauthorized yes reject
|
||||
# 204 no content no ok
|
||||
# 2xx successful yes ok/updated
|
||||
# 5xx server error no fail
|
||||
# xxx - no invalid
|
||||
#
|
||||
# The status code is held in %{reply:REST-HTTP-Status-Code}.
|
||||
#
|
||||
authorize {
|
||||
uri = "${..connect_uri}radius/auth"
|
||||
method = 'post'
|
||||
body = 'json'
|
||||
data = '{"ip": "%{Packet-Src-IP-Address}", "hotspot-group": "%{raw:Called-Station-Id}", "hotspot-id": "%{raw:NAS-Identifier}"}'
|
||||
force_to = 'json'
|
||||
auth = 'none'
|
||||
require_auth = no
|
||||
timeout = 4.000000
|
||||
}
|
||||
# authorize {
|
||||
# uri = "${..connect_uri}/user/%{User-Name}/mac/%{Called-Station-ID}?action=authorize"
|
||||
# method = 'get'
|
||||
# tls = ${..tls}
|
||||
# }
|
||||
# authenticate {
|
||||
# uri = "${..connect_uri}/user/%{User-Name}/mac/%{Called-Station-ID}?action=authenticate"
|
||||
# method = 'get'
|
||||
# tls = ${..tls}
|
||||
# }
|
||||
|
||||
# Preacct/Accounting/Post-auth/Pre-Proxy/Post-Proxy
|
||||
#
|
||||
# Code Meaning Process body Module code
|
||||
# 204 no content no ok
|
||||
# 2xx successful yes ok/updated
|
||||
# 5xx server error no fail
|
||||
# xxx - no invalid
|
||||
# preacct {
|
||||
# uri = "${..connect_uri}/user/%{User-Name}/sessions/%{Acct-Unique-Session-ID}?action=preacct"
|
||||
# method = 'post'
|
||||
# tls = ${..tls}
|
||||
# }
|
||||
# accounting {
|
||||
# uri = "${..connect_uri}/user/%{User-Name}/sessions/%{Acct-Unique-Session-ID}?action=accounting"
|
||||
# method = 'post'
|
||||
# tls = ${..tls}
|
||||
# }
|
||||
# post-auth {
|
||||
# uri = "${..connect_uri}/user/%{User-Name}/mac/%{Called-Station-ID}?action=post-auth"
|
||||
# method = 'post'
|
||||
# tls = ${..tls}
|
||||
# }
|
||||
# pre-proxy {
|
||||
# uri = "${..connect_uri}/user/%{User-Name}/mac/%{Called-Station-ID}?action=pre-proxy"
|
||||
# method = 'post'
|
||||
# tls = ${..tls}
|
||||
# }
|
||||
# post-proxy {
|
||||
# uri = "${..connect_uri}/user/%{User-Name}/mac/%{Called-Station-ID}?action=post-proxy"
|
||||
# method = 'post'
|
||||
# tls = ${..tls}
|
||||
# }
|
||||
|
||||
#
|
||||
# The connection pool is used to pool outgoing connections.
|
||||
#
|
||||
pool {
|
||||
# Connections to create during module instantiation.
|
||||
# If the server cannot create specified number of
|
||||
# connections during instantiation it will exit.
|
||||
# Set to 0 to allow the server to start without the
|
||||
# web service being available.
|
||||
start = ${thread[pool].start_servers}
|
||||
|
||||
# Minimum number of connections to keep open
|
||||
min = ${thread[pool].min_spare_servers}
|
||||
|
||||
# Maximum number of connections
|
||||
#
|
||||
# If these connections are all in use and a new one
|
||||
# is requested, the request will NOT get a connection.
|
||||
#
|
||||
# Setting 'max' to LESS than the number of threads means
|
||||
# that some threads may starve, and you will see errors
|
||||
# like 'No connections available and at max connection limit'
|
||||
#
|
||||
# Setting 'max' to MORE than the number of threads means
|
||||
# that there are more connections than necessary.
|
||||
max = ${thread[pool].max_servers}
|
||||
|
||||
# Spare connections to be left idle
|
||||
#
|
||||
# NOTE: Idle connections WILL be closed if "idle_timeout"
|
||||
# is set. This should be less than or equal to "max" above.
|
||||
spare = ${thread[pool].max_spare_servers}
|
||||
|
||||
# Number of uses before the connection is closed
|
||||
#
|
||||
# 0 means "infinite"
|
||||
uses = 0
|
||||
|
||||
# The number of seconds to wait after the server tries
|
||||
# to open a connection, and fails. During this time,
|
||||
# no new connections will be opened.
|
||||
retry_delay = 30
|
||||
|
||||
# The lifetime (in seconds) of the connection
|
||||
lifetime = 0
|
||||
|
||||
# idle timeout (in seconds). A connection which is
|
||||
# unused for this length of time will be closed.
|
||||
idle_timeout = 60
|
||||
|
||||
# NOTE: All configuration settings are enforced. If a
|
||||
# connection is closed because of "idle_timeout",
|
||||
# "uses", or "lifetime", then the total number of
|
||||
# connections MAY fall below "min". When that
|
||||
# happens, it will open a new connection. It will
|
||||
# also log a WARNING message.
|
||||
#
|
||||
# The solution is to either lower the "min" connections,
|
||||
# or increase lifetime/idle_timeout.
|
||||
}
|
||||
}
|
||||
371
hosted/config/mods-enabled/sql
Normal file
371
hosted/config/mods-enabled/sql
Normal file
@@ -0,0 +1,371 @@
|
||||
# -*- text -*-
|
||||
##
|
||||
## mods-available/sql -- SQL modules
|
||||
##
|
||||
## $Id: 7bcb664d32fecca0cd20c1d81bac13f0e1b9991b $
|
||||
|
||||
######################################################################
|
||||
#
|
||||
# Configuration for the SQL module
|
||||
#
|
||||
# The database schemas and queries are located in subdirectories:
|
||||
#
|
||||
# sql/<DB>/main/schema.sql Schema
|
||||
# sql/<DB>/main/queries.conf Authorisation and Accounting queries
|
||||
#
|
||||
# Where "DB" is mysql, mssql, oracle, or postgresql.
|
||||
#
|
||||
# The name used to query SQL is sql_user_name, which is set in the file
|
||||
#
|
||||
# raddb/mods-config/sql/main/${dialect}/queries.conf
|
||||
#
|
||||
# If you are using realms, that configuration should be changed to use
|
||||
# the Stripped-User-Name attribute. See the comments around sql_user_name
|
||||
# for more information.
|
||||
#
|
||||
|
||||
sql {
|
||||
#
|
||||
# The dialect of SQL being used.
|
||||
#
|
||||
# Allowed dialects are:
|
||||
#
|
||||
# mssql
|
||||
# mysql
|
||||
# oracle
|
||||
# postgresql
|
||||
# sqlite
|
||||
# mongo
|
||||
#
|
||||
dialect = "postgresql"
|
||||
|
||||
#
|
||||
# The driver module used to execute the queries. Since we
|
||||
# don't know which SQL drivers are being used, the default is
|
||||
# "rlm_sql_null", which just logs the queries to disk via the
|
||||
# "logfile" directive, below.
|
||||
#
|
||||
# In order to talk to a real database, delete the next line,
|
||||
# and uncomment the one after it.
|
||||
#
|
||||
# If the dialect is "mssql", then the driver should be set to
|
||||
# one of the following values, depending on your system:
|
||||
#
|
||||
# rlm_sql_db2
|
||||
# rlm_sql_firebird
|
||||
# rlm_sql_freetds
|
||||
# rlm_sql_iodbc
|
||||
# rlm_sql_unixodbc
|
||||
#
|
||||
# driver = "rlm_sql_null"
|
||||
driver = "rlm_sql_${dialect}"
|
||||
|
||||
#
|
||||
# Driver-specific subsections. They will only be loaded and
|
||||
# used if "driver" is something other than "rlm_sql_null".
|
||||
# When a real driver is used, the relevant driver
|
||||
# configuration section is loaded, and all other driver
|
||||
# configuration sections are ignored.
|
||||
#
|
||||
sqlite {
|
||||
# Path to the sqlite database
|
||||
filename = "/etc/freeradius/freeradius.db"
|
||||
|
||||
# How long to wait for write locks on the database to be
|
||||
# released (in ms) before giving up.
|
||||
busy_timeout = 200
|
||||
|
||||
# If the file above does not exist and bootstrap is set
|
||||
# a new database file will be created, and the SQL statements
|
||||
# contained within the bootstrap file will be executed.
|
||||
bootstrap = "${modconfdir}/${..:name}/main/sqlite/schema.sql"
|
||||
}
|
||||
|
||||
mysql {
|
||||
# If any of the files below are set, TLS encryption is enabled
|
||||
tls {
|
||||
ca_file = "/etc/ssl/certs/my_ca.crt"
|
||||
ca_path = "/etc/ssl/certs/"
|
||||
certificate_file = "/etc/ssl/certs/private/client.crt"
|
||||
private_key_file = "/etc/ssl/certs/private/client.key"
|
||||
cipher = "DHE-RSA-AES256-SHA:AES128-SHA"
|
||||
|
||||
tls_required = yes
|
||||
tls_check_cert = no
|
||||
tls_check_cert_cn = no
|
||||
}
|
||||
|
||||
# If yes, (or auto and libmysqlclient reports warnings are
|
||||
# available), will retrieve and log additional warnings from
|
||||
# the server if an error has occured. Defaults to 'auto'
|
||||
warnings = auto
|
||||
}
|
||||
|
||||
postgresql {
|
||||
|
||||
# unlike MySQL, which has a tls{} connection configuration, postgresql
|
||||
# uses its connection parameters - see the radius_db option below in
|
||||
# this file
|
||||
|
||||
# Send application_name to the postgres server
|
||||
# Only supported in PG 9.0 and greater. Defaults to no.
|
||||
send_application_name = yes
|
||||
|
||||
#
|
||||
# The default application name is "FreeRADIUS - .." with the current version.
|
||||
# The application name can be customized here to any non-zero value.
|
||||
#
|
||||
# application_name = ""
|
||||
}
|
||||
|
||||
#
|
||||
# Configuration for Mongo.
|
||||
#
|
||||
# Note that the Mongo driver is experimental. The FreeRADIUS developers
|
||||
# are unable to help with the syntax of the Mongo queries. Please see
|
||||
# the Mongo documentation for that syntax.
|
||||
#
|
||||
# The Mongo driver supports only the following methods:
|
||||
#
|
||||
# aggregate
|
||||
# findAndModify
|
||||
# findOne
|
||||
# insert
|
||||
#
|
||||
# For examples, see the query files:
|
||||
#
|
||||
# raddb/mods-config/sql/main/mongo/queries.conf
|
||||
# raddb/mods-config/sql/main/ippool/queries.conf
|
||||
#
|
||||
# In order to use findAndModify with an aggretation pipleline, make
|
||||
# sure that you are running MongoDB version 4.2 or greater. FreeRADIUS
|
||||
# assumes that the paramaters passed to the methods are supported by the
|
||||
# version of MongoDB which it is connected to.
|
||||
#
|
||||
mongo {
|
||||
#
|
||||
# The application name to use.
|
||||
#
|
||||
appname = "freeradius"
|
||||
|
||||
#
|
||||
# The TLS parameters here map directly to the Mongo TLS configuration
|
||||
#
|
||||
tls {
|
||||
certificate_file = /path/to/file
|
||||
certificate_password = "password"
|
||||
ca_file = /path/to/file
|
||||
ca_dir = /path/to/directory
|
||||
crl_file = /path/to/file
|
||||
weak_cert_validation = false
|
||||
allow_invalid_hostname = false
|
||||
}
|
||||
}
|
||||
|
||||
# Connection info:
|
||||
#
|
||||
server = "#PG_HOST#"
|
||||
port = #PG_PORT#
|
||||
login = "#PG_USER#"
|
||||
password = "#PG_PASS#"
|
||||
|
||||
# Connection info for Mongo
|
||||
# Authentication Without SSL
|
||||
# server = "mongodb://USER:PASSWORD@192.16.0.2:PORT/DATABASE?authSource=admin&ssl=false"
|
||||
|
||||
# Authentication With SSL
|
||||
# server = "mongodb://USER:PASSWORD@192.16.0.2:PORT/DATABASE?authSource=admin&ssl=true"
|
||||
|
||||
# Authentication with Certificate
|
||||
# Use this command for retrieve Derived username:
|
||||
# openssl x509 -in mycert.pem -inform PEM -subject -nameopt RFC2253
|
||||
# server = mongodb://<DERIVED USERNAME>@192.168.0.2:PORT/DATABASE?authSource=$external&ssl=true&authMechanism=MONGODB-X509
|
||||
|
||||
# Database table configuration for everything except Oracle
|
||||
radius_db = "#PG_DB#"
|
||||
|
||||
# If you are using Oracle then use this instead
|
||||
# radius_db = "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=localhost)(PORT=1521))(CONNECT_DATA=(SID=your_sid)))"
|
||||
|
||||
# If you're using postgresql this can also be used instead of the connection info parameters
|
||||
# radius_db = "dbname=radius host=localhost user=radius password=raddpass"
|
||||
|
||||
# Postgreql doesn't take tls{} options in its module config like mysql does - if you want to
|
||||
# use SSL connections then use this form of connection info parameter
|
||||
# radius_db = "host=localhost port=5432 dbname=radius user=radius password=raddpass sslmode=verify-full sslcert=/etc/ssl/client.crt sslkey=/etc/ssl/client.key sslrootcert=/etc/ssl/ca.crt"
|
||||
|
||||
# If you want both stop and start records logged to the
|
||||
# same SQL table, leave this as is. If you want them in
|
||||
# different tables, put the start table in acct_table1
|
||||
# and stop table in acct_table2
|
||||
acct_table1 = "radacct"
|
||||
acct_table2 = "radacct"
|
||||
|
||||
# Allow for storing data after authentication
|
||||
postauth_table = "radpostauth"
|
||||
|
||||
# Tables containing 'check' items
|
||||
authcheck_table = "radcheck"
|
||||
groupcheck_table = "radgroupcheck"
|
||||
|
||||
# Tables containing 'reply' items
|
||||
authreply_table = "radreply"
|
||||
groupreply_table = "radgroupreply"
|
||||
|
||||
# Table to keep group info
|
||||
usergroup_table = "radusergroup"
|
||||
|
||||
# If set to 'yes' (default) we read the group tables unless Fall-Through = no in the reply table.
|
||||
# If set to 'no' we do not read the group tables unless Fall-Through = yes in the reply table.
|
||||
# read_groups = yes
|
||||
|
||||
# If set to 'yes' (default) we read profiles unless Fall-Through = no in the groupreply table.
|
||||
# If set to 'no' we do not read profiles unless Fall-Through = yes in the groupreply table.
|
||||
# read_profiles = yes
|
||||
|
||||
# Remove stale session if checkrad does not see a double login
|
||||
delete_stale_sessions = yes
|
||||
|
||||
# Write SQL queries to a logfile. This is potentially useful for tracing
|
||||
# issues with authorization queries. See also "logfile" directives in
|
||||
# mods-config/sql/main/*/queries.conf. You can enable per-section logging
|
||||
# by enabling "logfile" there, or global logging by enabling "logfile" here.
|
||||
#
|
||||
# Per-section logging can be disabled by setting "logfile = ''"
|
||||
# logfile = ${logdir}/sqllog.sql
|
||||
|
||||
# Set the maximum query duration and connection timeout
|
||||
# for rlm_sql_mysql.
|
||||
# query_timeout = 5
|
||||
|
||||
# As of v3, the "pool" section has replaced the
|
||||
# following v2 configuration items:
|
||||
#
|
||||
# num_sql_socks
|
||||
# connect_failure_retry_delay
|
||||
# lifetime
|
||||
# max_queries
|
||||
|
||||
#
|
||||
# The connection pool is used to pool outgoing connections.
|
||||
#
|
||||
# When the server is not threaded, the connection pool
|
||||
# limits are ignored, and only one connection is used.
|
||||
#
|
||||
# If you want to have multiple SQL modules re-use the same
|
||||
# connection pool, use "pool = name" instead of a "pool"
|
||||
# section. e.g.
|
||||
#
|
||||
# sql sql1 {
|
||||
# ...
|
||||
# pool {
|
||||
# ...
|
||||
# }
|
||||
# }
|
||||
#
|
||||
# # sql2 will use the connection pool from sql1
|
||||
# sql sql2 {
|
||||
# ...
|
||||
# pool = sql1
|
||||
# }
|
||||
#
|
||||
pool {
|
||||
# Connections to create during module instantiation.
|
||||
# If the server cannot create specified number of
|
||||
# connections during instantiation it will exit.
|
||||
# Set to 0 to allow the server to start without the
|
||||
# database being available.
|
||||
start = ${thread[pool].start_servers}
|
||||
|
||||
# Minimum number of connections to keep open
|
||||
min = ${thread[pool].min_spare_servers}
|
||||
|
||||
# Maximum number of connections
|
||||
#
|
||||
# If these connections are all in use and a new one
|
||||
# is requested, the request will NOT get a connection.
|
||||
#
|
||||
# Setting 'max' to LESS than the number of threads means
|
||||
# that some threads may starve, and you will see errors
|
||||
# like 'No connections available and at max connection limit'
|
||||
#
|
||||
# Setting 'max' to MORE than the number of threads means
|
||||
# that there are more connections than necessary.
|
||||
max = ${thread[pool].max_servers}
|
||||
|
||||
# Spare connections to be left idle
|
||||
#
|
||||
# NOTE: Idle connections WILL be closed if "idle_timeout"
|
||||
# is set. This should be less than or equal to "max" above.
|
||||
spare = ${thread[pool].max_spare_servers}
|
||||
|
||||
# Number of uses before the connection is closed
|
||||
#
|
||||
# 0 means "infinite"
|
||||
uses = 0
|
||||
|
||||
# The number of seconds to wait after the server tries
|
||||
# to open a connection, and fails. During this time,
|
||||
# no new connections will be opened.
|
||||
retry_delay = 30
|
||||
|
||||
# The lifetime (in seconds) of the connection
|
||||
lifetime = 0
|
||||
|
||||
# idle timeout (in seconds). A connection which is
|
||||
# unused for this length of time will be closed.
|
||||
idle_timeout = 60
|
||||
|
||||
# NOTE: All configuration settings are enforced. If a
|
||||
# connection is closed because of "idle_timeout",
|
||||
# "uses", or "lifetime", then the total number of
|
||||
# connections MAY fall below "min". When that
|
||||
# happens, it will open a new connection. It will
|
||||
# also log a WARNING message.
|
||||
#
|
||||
# The solution is to either lower the "min" connections,
|
||||
# or increase lifetime/idle_timeout.
|
||||
}
|
||||
|
||||
# Set to 'yes' to read radius clients from the database ('nas' table)
|
||||
# Clients will ONLY be read on server startup.
|
||||
#
|
||||
# A client can be link to a virtual server via the SQL
|
||||
# module. This link is done via the following process:
|
||||
#
|
||||
# If there is no listener in a virtual server, SQL clients
|
||||
# are added to the global list for that virtual server.
|
||||
#
|
||||
# If there is a listener, and the first listener does not
|
||||
# have a "clients=..." configuration item, SQL clients are
|
||||
# added to the global list.
|
||||
#
|
||||
# If there is a listener, and the first one does have a
|
||||
# "clients=..." configuration item, SQL clients are added to
|
||||
# that list. The client { ...} ` configured in that list are
|
||||
# also added for that listener.
|
||||
#
|
||||
# The only issue is if you have multiple listeners in a
|
||||
# virtual server, each with a different client list, then
|
||||
# the SQL clients are added only to the first listener.
|
||||
#
|
||||
# read_clients = yes
|
||||
|
||||
# Table to keep radius client info
|
||||
client_table = "nas"
|
||||
|
||||
#
|
||||
# The group attribute specific to this instance of rlm_sql
|
||||
#
|
||||
|
||||
# This entry should be used for additional instances (sql foo {})
|
||||
# of the SQL module.
|
||||
# group_attribute = "${.:instance}-SQL-Group"
|
||||
|
||||
# This entry should be used for the default instance (sql {})
|
||||
# of the SQL module.
|
||||
group_attribute = "SQL-Group"
|
||||
|
||||
# Read database-specific queries
|
||||
$INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf
|
||||
}
|
||||
901
hosted/config/radiusd.conf
Normal file
901
hosted/config/radiusd.conf
Normal file
@@ -0,0 +1,901 @@
|
||||
# -*- text -*-
|
||||
##
|
||||
## radiusd.conf -- FreeRADIUS server configuration file - 3.2.2
|
||||
##
|
||||
## http://www.freeradius.org/
|
||||
## $Id: 79603c90020ddd2c1d80a47f945afecaf2fac671 $
|
||||
##
|
||||
|
||||
######################################################################
|
||||
#
|
||||
# The format of this (and other) configuration file is
|
||||
# documented in "man unlang". There are also READMEs in many
|
||||
# subdirectories:
|
||||
#
|
||||
# raddb/README.rst
|
||||
# How to upgrade from v2.
|
||||
#
|
||||
# raddb/mods-available/README.rst
|
||||
# How to use mods-available / mods-enabled.
|
||||
# All of the modules are in individual files,
|
||||
# along with configuration items and full documentation.
|
||||
#
|
||||
# raddb/sites-available/README
|
||||
# virtual servers, "listen" sections, clients, etc.
|
||||
# The "sites-available" directory contains many
|
||||
# worked examples of common configurations.
|
||||
#
|
||||
# raddb/certs/README.md
|
||||
# How to create certificates for EAP or RadSec.
|
||||
#
|
||||
# Every configuration item in the server is documented
|
||||
# extensively in the comments in the example configuration
|
||||
# files.
|
||||
#
|
||||
# Before editing this (or any other) configuration file, PLEASE
|
||||
# read "man radiusd". See the section titled DEBUGGING. It
|
||||
# outlines a method where you can quickly create the
|
||||
# configuration you want, with minimal effort.
|
||||
#
|
||||
# Run the server in debugging mode, and READ the output.
|
||||
#
|
||||
# $ radiusd -X
|
||||
#
|
||||
# We cannot emphasize this point strongly enough. The vast
|
||||
# majority of problems can be solved by carefully reading the
|
||||
# debugging output, which includes warnings about common issues,
|
||||
# and suggestions for how they may be fixed.
|
||||
#
|
||||
# There may be a lot of output, but look carefully for words like:
|
||||
# "warning", "error", "reject", or "failure". The messages there
|
||||
# will usually be enough to guide you to a solution.
|
||||
#
|
||||
# More documentation on "radiusd -X" is available on the wiki:
|
||||
# https://wiki.freeradius.org/radiusd-X
|
||||
#
|
||||
# If you are going to ask a question on the mailing list, then
|
||||
# explain what you are trying to do, and include the output from
|
||||
# debugging mode (radiusd -X). Failure to do so means that all
|
||||
# of the responses to your question will be people telling you
|
||||
# to "post the output of radiusd -X".
|
||||
#
|
||||
# Guidelines for posting to the mailing list are on the wiki:
|
||||
# https://wiki.freeradius.org/list-help
|
||||
#
|
||||
# Please read those guidelines before posting to the list.
|
||||
#
|
||||
# Further documentation is available in the "doc" directory
|
||||
# of the server distribution, or on the wiki at:
|
||||
# https://wiki.freeradius.org/
|
||||
#
|
||||
# New users to RADIUS should read the Technical Guide. That guide
|
||||
# explains how RADIUS works, how FreeRADIUS works, and what each
|
||||
# part of a RADIUS system does. It is not just "configure FreeRADIUS"!
|
||||
# https://networkradius.com/doc/FreeRADIUS-Technical-Guide.pdf
|
||||
#
|
||||
# More documentation on dictionaries, modules, unlang, etc. is also
|
||||
# available on the Network RADIUS web site:
|
||||
# https://networkradius.com/freeradius-documentation/
|
||||
#
|
||||
|
||||
######################################################################
|
||||
|
||||
prefix = /usr
|
||||
exec_prefix = /usr
|
||||
sysconfdir = /etc
|
||||
localstatedir = /var
|
||||
sbindir = ${exec_prefix}/sbin
|
||||
logdir = /var/log/freeradius
|
||||
raddbdir = /etc/freeradius
|
||||
radacctdir = ${logdir}/radacct
|
||||
|
||||
#
|
||||
# name of the running server. See also the "-n" command-line option.
|
||||
name = freeradius
|
||||
|
||||
# Location of config and logfiles.
|
||||
confdir = ${raddbdir}
|
||||
modconfdir = ${confdir}/mods-config
|
||||
certdir = ${confdir}/certs
|
||||
cadir = ${confdir}/certs
|
||||
run_dir = ${localstatedir}/run/${name}
|
||||
|
||||
# Should likely be ${localstatedir}/lib/radiusd
|
||||
db_dir = ${raddbdir}
|
||||
|
||||
#
|
||||
# libdir: Where to find the rlm_* modules.
|
||||
#
|
||||
# This should be automatically set at configuration time.
|
||||
#
|
||||
# If the server builds and installs, but fails at execution time
|
||||
# with an 'undefined symbol' error, then you can use the libdir
|
||||
# directive to work around the problem.
|
||||
#
|
||||
# The cause is usually that a library has been installed on your
|
||||
# system in a place where the dynamic linker CANNOT find it. When
|
||||
# executing as root (or another user), your personal environment MAY
|
||||
# be set up to allow the dynamic linker to find the library. When
|
||||
# executing as a daemon, FreeRADIUS MAY NOT have the same
|
||||
# personalized configuration.
|
||||
#
|
||||
# To work around the problem, find out which library contains that symbol,
|
||||
# and add the directory containing that library to the end of 'libdir',
|
||||
# with a colon separating the directory names. NO spaces are allowed.
|
||||
#
|
||||
# e.g. libdir = /usr/local/lib:/opt/package/lib
|
||||
#
|
||||
# You can also try setting the LD_LIBRARY_PATH environment variable
|
||||
# in a script which starts the server.
|
||||
#
|
||||
# If that does not work, then you can re-configure and re-build the
|
||||
# server to NOT use shared libraries, via:
|
||||
#
|
||||
# ./configure --disable-shared
|
||||
# make
|
||||
# make install
|
||||
#
|
||||
libdir = /usr/lib/freeradius
|
||||
|
||||
# pidfile: Where to place the PID of the RADIUS server.
|
||||
#
|
||||
# The server may be signalled while it's running by using this
|
||||
# file.
|
||||
#
|
||||
# This file is written when ONLY running in daemon mode.
|
||||
#
|
||||
# e.g.: kill -HUP `cat /var/run/radiusd/radiusd.pid`
|
||||
#
|
||||
pidfile = ${run_dir}/${name}.pid
|
||||
|
||||
# panic_action: Command to execute if the server dies unexpectedly.
|
||||
#
|
||||
# FOR PRODUCTION SYSTEMS, ACTIONS SHOULD ALWAYS EXIT.
|
||||
# AN INTERACTIVE ACTION MEANS THE SERVER IS NOT RESPONDING TO REQUESTS.
|
||||
# AN INTERACTICE ACTION MEANS THE SERVER WILL NOT RESTART.
|
||||
#
|
||||
# THE SERVER MUST NOT BE ALLOWED EXECUTE UNTRUSTED PANIC ACTION CODE
|
||||
# PATTACH CAN BE USED AS AN ATTACK VECTOR.
|
||||
#
|
||||
# The panic action is a command which will be executed if the server
|
||||
# receives a fatal, non user generated signal, i.e. SIGSEGV, SIGBUS,
|
||||
# SIGABRT or SIGFPE.
|
||||
#
|
||||
# This can be used to start an interactive debugging session so
|
||||
# that information regarding the current state of the server can
|
||||
# be acquired.
|
||||
#
|
||||
# The following string substitutions are available:
|
||||
# - %e The currently executing program e.g. /sbin/radiusd
|
||||
# - %p The PID of the currently executing program e.g. 12345
|
||||
#
|
||||
# Standard ${} substitutions are also allowed.
|
||||
#
|
||||
# An example panic action for opening an interactive session in GDB would be:
|
||||
#
|
||||
#panic_action = "gdb %e %p"
|
||||
#
|
||||
# Again, don't use that on a production system.
|
||||
#
|
||||
# An example panic action for opening an automated session in GDB would be:
|
||||
#
|
||||
#panic_action = "gdb -silent -x ${raddbdir}/panic.gdb %e %p 2>&1 | tee ${logdir}/gdb-${name}-%p.log"
|
||||
#
|
||||
# That command can be used on a production system.
|
||||
#
|
||||
|
||||
# max_request_time: The maximum time (in seconds) to handle a request.
|
||||
#
|
||||
# Requests which take more time than this to process may be killed, and
|
||||
# a REJECT message is returned.
|
||||
#
|
||||
# WARNING: If you notice that requests take a long time to be handled,
|
||||
# then this MAY INDICATE a bug in the server, in one of the modules
|
||||
# used to handle a request, OR in your local configuration.
|
||||
#
|
||||
# This problem is most often seen when using an SQL database. If it takes
|
||||
# more than a second or two to receive an answer from the SQL database,
|
||||
# then it probably means that you haven't indexed the database. See your
|
||||
# SQL server documentation for more information.
|
||||
#
|
||||
# Useful range of values: 5 to 120
|
||||
#
|
||||
max_request_time = 10
|
||||
|
||||
# cleanup_delay: The time to wait (in seconds) before cleaning up
|
||||
# a reply which was sent to the NAS.
|
||||
#
|
||||
# The RADIUS request is normally cached internally for a short period
|
||||
# of time, after the reply is sent to the NAS. The reply packet may be
|
||||
# lost in the network, and the NAS will not see it. The NAS will then
|
||||
# re-send the request, and the server will respond quickly with the
|
||||
# cached reply.
|
||||
#
|
||||
# If this value is set too low, then duplicate requests from the NAS
|
||||
# MAY NOT be detected, and will instead be handled as separate requests.
|
||||
#
|
||||
# If this value is set too high, then the server will cache too many
|
||||
# requests, and some new requests may get blocked. (See 'max_requests'.)
|
||||
#
|
||||
# Useful range of values: 2 to 30
|
||||
#
|
||||
cleanup_delay = 5
|
||||
|
||||
# max_requests: The maximum number of requests which the server keeps
|
||||
# track of. This should be 256 multiplied by the number of clients.
|
||||
# e.g. With 4 clients, this number should be 1024.
|
||||
#
|
||||
# If this number is too low, then when the server becomes busy,
|
||||
# it will not respond to any new requests, until the 'cleanup_delay'
|
||||
# time has passed, and it has removed the old requests.
|
||||
#
|
||||
# If this number is set too high, then the server will use a bit more
|
||||
# memory for no real benefit.
|
||||
#
|
||||
# If you aren't sure what it should be set to, it's better to set it
|
||||
# too high than too low. Setting it to 1000 per client is probably
|
||||
# the highest it should be.
|
||||
#
|
||||
# Useful range of values: 256 to infinity
|
||||
#
|
||||
max_requests = 16384
|
||||
|
||||
# hostname_lookups: Log the names of clients or just their IP addresses
|
||||
# e.g., www.freeradius.org (on) or 206.47.27.232 (off).
|
||||
#
|
||||
# The default is 'off' because it would be overall better for the net
|
||||
# if people had to knowingly turn this feature on, since enabling it
|
||||
# means that each client request will result in AT LEAST one lookup
|
||||
# request to the nameserver. Enabling hostname_lookups will also
|
||||
# mean that your server may stop randomly for 30 seconds from time
|
||||
# to time, if the DNS requests take too long.
|
||||
#
|
||||
# Turning hostname lookups off also means that the server won't block
|
||||
# for 30 seconds, if it sees an IP address which has no name associated
|
||||
# with it.
|
||||
#
|
||||
# allowed values: {no, yes}
|
||||
#
|
||||
hostname_lookups = no
|
||||
|
||||
#
|
||||
# Run a "Post-Auth-Type Client-Lost" section. This ONLY happens when
|
||||
# the server sends an Access-Challenge, and then client does not
|
||||
# respond to it. The goal is to allow administrators to log
|
||||
# something when the client does not respond.
|
||||
#
|
||||
# See sites-available/default, "Post-Auth-Type Client-Lost" for more
|
||||
# information.
|
||||
#
|
||||
#postauth_client_lost = no
|
||||
|
||||
#
|
||||
# Logging section. The various "log_*" configuration items
|
||||
# will eventually be moved here.
|
||||
#
|
||||
log {
|
||||
#
|
||||
# Destination for log messages. This can be one of:
|
||||
#
|
||||
# files - log to "file", as defined below.
|
||||
# syslog - to syslog (see also the "syslog_facility", below.
|
||||
# stdout - standard output
|
||||
# stderr - standard error.
|
||||
#
|
||||
# The command-line option "-X" over-rides this option, and forces
|
||||
# logging to go to stdout.
|
||||
#
|
||||
destination = files
|
||||
|
||||
#
|
||||
# Highlight important messages sent to stderr and stdout.
|
||||
#
|
||||
# Option will be ignored (disabled) if output if TERM is not
|
||||
# an xterm or output is not to a TTY.
|
||||
#
|
||||
colourise = yes
|
||||
|
||||
#
|
||||
# The logging messages for the server are appended to the
|
||||
# tail of this file if destination == "files"
|
||||
#
|
||||
# If the server is running in debugging mode, this file is
|
||||
# NOT used.
|
||||
#
|
||||
file = ${logdir}/radius.log
|
||||
|
||||
#
|
||||
# Which syslog facility to use, if ${destination} == "syslog"
|
||||
#
|
||||
# The exact values permitted here are OS-dependent. You probably
|
||||
# don't want to change this.
|
||||
#
|
||||
syslog_facility = daemon
|
||||
|
||||
# Log the full User-Name attribute, as it was found in the request.
|
||||
#
|
||||
# allowed values: {no, yes}
|
||||
#
|
||||
stripped_names = no
|
||||
|
||||
# Log all (accept and reject) authentication results to the log file.
|
||||
#
|
||||
# This is the same as setting "auth_accept = yes" and
|
||||
# "auth_reject = yes"
|
||||
#
|
||||
# allowed values: {no, yes}
|
||||
#
|
||||
auth = no
|
||||
|
||||
# Log Access-Accept results to the log file.
|
||||
#
|
||||
# This is only used if "auth = no"
|
||||
#
|
||||
# allowed values: {no, yes}
|
||||
#
|
||||
# auth_accept = no
|
||||
|
||||
# Log Access-Reject results to the log file.
|
||||
#
|
||||
# This is only used if "auth = no"
|
||||
#
|
||||
# allowed values: {no, yes}
|
||||
#
|
||||
# auth_reject = no
|
||||
|
||||
# Log passwords with the authentication requests.
|
||||
# auth_badpass - logs password if it's rejected
|
||||
# auth_goodpass - logs password if it's correct
|
||||
#
|
||||
# allowed values: {no, yes}
|
||||
#
|
||||
auth_badpass = no
|
||||
auth_goodpass = no
|
||||
|
||||
# Log additional text at the end of the "Login OK" messages.
|
||||
# for these to work, the "auth" and "auth_goodpass" or "auth_badpass"
|
||||
# configurations above have to be set to "yes".
|
||||
#
|
||||
# The strings below are dynamically expanded, which means that
|
||||
# you can put anything you want in them. However, note that
|
||||
# this expansion can be slow, and can negatively impact server
|
||||
# performance.
|
||||
#
|
||||
# msg_goodpass = ""
|
||||
# msg_badpass = ""
|
||||
|
||||
# The message when the user exceeds the Simultaneous-Use limit.
|
||||
#
|
||||
msg_denied = "You are already logged in - access denied"
|
||||
|
||||
# Suppress "secret" attributes when printing them in debug mode.
|
||||
#
|
||||
# Secrets are NOT tracked across xlat expansions. If your
|
||||
# configuration puts secrets into other strings, they will
|
||||
# still get printed.
|
||||
#
|
||||
# Setting this to "yes" means that the server prints
|
||||
#
|
||||
# <<< secret >>>
|
||||
#
|
||||
# instead of the value, for attriburtes which contain secret
|
||||
# information. e.g. User-Name, Tunnel-Password, etc.
|
||||
#
|
||||
# This configuration is disabled by default. It is extremely
|
||||
# important for administrators to be able to debug user logins
|
||||
# by seeing what is actually being sent.
|
||||
#
|
||||
# suppress_secrets = no
|
||||
}
|
||||
|
||||
# The program to execute to do concurrency checks.
|
||||
checkrad = ${sbindir}/checkrad
|
||||
|
||||
#
|
||||
# ENVIRONMENT VARIABLES
|
||||
#
|
||||
# You can reference environment variables using an expansion like
|
||||
# `$ENV{PATH}`. However it is sometimes useful to be able to also set
|
||||
# environment variables. This section lets you do that.
|
||||
#
|
||||
# The main purpose of this section is to allow administrators to keep
|
||||
# RADIUS-specific configuration in the RADIUS configuration files.
|
||||
# For example, if you need to set an environment variable which is
|
||||
# used by a module. You could put that variable into a shell script,
|
||||
# but that's awkward. Instead, just list it here.
|
||||
#
|
||||
# Note that these environment variables are set AFTER the
|
||||
# configuration file is loaded. So you cannot set FOO here, and
|
||||
# expect to reference it via `$ENV{FOO}` in another configuration file.
|
||||
# You should instead just use a normal configuration variable for
|
||||
# that.
|
||||
#
|
||||
ENV {
|
||||
#
|
||||
# Set environment varable `FOO` to value '/bar/baz'.
|
||||
#
|
||||
# NOTE: Note that you MUST use '='. You CANNOT use '+=' to append
|
||||
# values.
|
||||
#
|
||||
# FOO = '/bar/baz'
|
||||
|
||||
#
|
||||
# Delete environment variable `BAR`.
|
||||
#
|
||||
# BAR
|
||||
|
||||
#
|
||||
# `LD_PRELOAD` is special. It is normally set before the
|
||||
# application runs, and is interpreted by the dynamic linker.
|
||||
# Which means you cannot set it inside of an application, and
|
||||
# expect it to load libraries.
|
||||
#
|
||||
# Since this functionality is useful, we extend it here.
|
||||
#
|
||||
# You can set
|
||||
#
|
||||
# LD_PRELOAD = /path/to/library.so
|
||||
#
|
||||
# and the server will load the named libraries. Multiple
|
||||
# libraries can be loaded by specificing multiple individual
|
||||
# `LD_PRELOAD` entries.
|
||||
#
|
||||
#
|
||||
# LD_PRELOAD = /path/to/library1.so
|
||||
# LD_PRELOAD = /path/to/library2.so
|
||||
}
|
||||
|
||||
# SECURITY CONFIGURATION
|
||||
#
|
||||
# There may be multiple methods of attacking on the server. This
|
||||
# section holds the configuration items which minimize the impact
|
||||
# of those attacks
|
||||
#
|
||||
security {
|
||||
# chroot: directory where the server does "chroot".
|
||||
#
|
||||
# The chroot is done very early in the process of starting
|
||||
# the server. After the chroot has been performed it
|
||||
# switches to the "user" listed below (which MUST be
|
||||
# specified). If "group" is specified, it switches to that
|
||||
# group, too. Any other groups listed for the specified
|
||||
# "user" in "/etc/group" are also added as part of this
|
||||
# process.
|
||||
#
|
||||
# The current working directory (chdir / cd) is left
|
||||
# *outside* of the chroot until all of the modules have been
|
||||
# initialized. This allows the "raddb" directory to be left
|
||||
# outside of the chroot. Once the modules have been
|
||||
# initialized, it does a "chdir" to ${logdir}. This means
|
||||
# that it should be impossible to break out of the chroot.
|
||||
#
|
||||
# If you are worried about security issues related to this
|
||||
# use of chdir, then simply ensure that the "raddb" directory
|
||||
# is inside of the chroot, end be sure to do "cd raddb"
|
||||
# BEFORE starting the server.
|
||||
#
|
||||
# If the server is statically linked, then the only files
|
||||
# that have to exist in the chroot are ${run_dir} and
|
||||
# ${logdir}. If you do the "cd raddb" as discussed above,
|
||||
# then the "raddb" directory has to be inside of the chroot
|
||||
# directory, too.
|
||||
#
|
||||
# chroot = /path/to/chroot/directory
|
||||
|
||||
# user/group: The name (or #number) of the user/group to run radiusd as.
|
||||
#
|
||||
# If these are commented out, the server will run as the
|
||||
# user/group that started it. In order to change to a
|
||||
# different user/group, you MUST be root ( or have root
|
||||
# privileges ) to start the server.
|
||||
#
|
||||
# We STRONGLY recommend that you run the server with as few
|
||||
# permissions as possible. That is, if you're not using
|
||||
# shadow passwords, the user and group items below should be
|
||||
# set to radius'.
|
||||
#
|
||||
# NOTE that some kernels refuse to setgid(group) when the
|
||||
# value of (unsigned)group is above 60000; don't use group
|
||||
# "nobody" on these systems!
|
||||
#
|
||||
# On systems with shadow passwords, you might have to set
|
||||
# 'group = shadow' for the server to be able to read the
|
||||
# shadow password file. If you can authenticate users while
|
||||
# in debug mode, but not in daemon mode, it may be that the
|
||||
# debugging mode server is running as a user that can read
|
||||
# the shadow info, and the user listed below can not.
|
||||
#
|
||||
# The server will also try to use "initgroups" to read
|
||||
# /etc/groups. It will join all groups where "user" is a
|
||||
# member. This can allow for some finer-grained access
|
||||
# controls.
|
||||
#
|
||||
user = freerad
|
||||
group = freerad
|
||||
|
||||
# Core dumps are a bad thing. This should only be set to
|
||||
# 'yes' if you're debugging a problem with the server.
|
||||
#
|
||||
# allowed values: {no, yes}
|
||||
#
|
||||
allow_core_dumps = no
|
||||
|
||||
#
|
||||
# max_attributes: The maximum number of attributes
|
||||
# permitted in a RADIUS packet. Packets which have MORE
|
||||
# than this number of attributes in them will be dropped.
|
||||
#
|
||||
# If this number is set too low, then no RADIUS packets
|
||||
# will be accepted.
|
||||
#
|
||||
# If this number is set too high, then an attacker may be
|
||||
# able to send a small number of packets which will cause
|
||||
# the server to use all available memory on the machine.
|
||||
#
|
||||
# Setting this number to 0 means "allow any number of attributes"
|
||||
max_attributes = 200
|
||||
|
||||
#
|
||||
# reject_delay: When sending an Access-Reject, it can be
|
||||
# delayed for a few seconds. This may help slow down a DoS
|
||||
# attack. It also helps to slow down people trying to brute-force
|
||||
# crack a users password.
|
||||
#
|
||||
# Setting this number to 0 means "send rejects immediately"
|
||||
#
|
||||
# If this number is set higher than 'cleanup_delay', then the
|
||||
# rejects will be sent at 'cleanup_delay' time, when the request
|
||||
# is deleted from the internal cache of requests.
|
||||
#
|
||||
# This number can be a decimal, e.g. 3.4
|
||||
#
|
||||
# Useful ranges: 1 to 5
|
||||
reject_delay = 1
|
||||
|
||||
#
|
||||
# status_server: Whether or not the server will respond
|
||||
# to Status-Server requests.
|
||||
#
|
||||
# When sent a Status-Server message, the server responds with
|
||||
# an Access-Accept or Accounting-Response packet.
|
||||
#
|
||||
# This is mainly useful for administrators who want to "ping"
|
||||
# the server, without adding test users, or creating fake
|
||||
# accounting packets.
|
||||
#
|
||||
# It's also useful when a NAS marks a RADIUS server "dead".
|
||||
# The NAS can periodically "ping" the server with a Status-Server
|
||||
# packet. If the server responds, it must be alive, and the
|
||||
# NAS can start using it for real requests.
|
||||
#
|
||||
# See also raddb/sites-available/status
|
||||
#
|
||||
status_server = yes
|
||||
}
|
||||
|
||||
# PROXY CONFIGURATION
|
||||
#
|
||||
# proxy_requests: Turns proxying of RADIUS requests on or off.
|
||||
#
|
||||
# The server has proxying turned on by default. If your system is NOT
|
||||
# set up to proxy requests to another server, then you can turn proxying
|
||||
# off here. This will save a small amount of resources on the server.
|
||||
#
|
||||
# If you have proxying turned off, and your configuration files say
|
||||
# to proxy a request, then an error message will be logged.
|
||||
#
|
||||
# To disable proxying, change the "yes" to "no", and comment the
|
||||
# $INCLUDE line.
|
||||
#
|
||||
# allowed values: {no, yes}
|
||||
#
|
||||
proxy_requests = no
|
||||
# $INCLUDE proxy.conf
|
||||
|
||||
|
||||
# CLIENTS CONFIGURATION
|
||||
#
|
||||
# Client configuration is defined in "clients.conf".
|
||||
#
|
||||
|
||||
# The 'clients.conf' file contains all of the information from the old
|
||||
# 'clients' and 'naslist' configuration files. We recommend that you
|
||||
# do NOT use 'client's or 'naslist', although they are still
|
||||
# supported.
|
||||
#
|
||||
# Anything listed in 'clients.conf' will take precedence over the
|
||||
# information from the old-style configuration files.
|
||||
#
|
||||
$INCLUDE clients.conf
|
||||
|
||||
|
||||
# THREAD POOL CONFIGURATION
|
||||
#
|
||||
# The thread pool is a long-lived group of threads which
|
||||
# take turns (round-robin) handling any incoming requests.
|
||||
#
|
||||
# You probably want to have a few spare threads around,
|
||||
# so that high-load situations can be handled immediately. If you
|
||||
# don't have any spare threads, then the request handling will
|
||||
# be delayed while a new thread is created, and added to the pool.
|
||||
#
|
||||
# You probably don't want too many spare threads around,
|
||||
# otherwise they'll be sitting there taking up resources, and
|
||||
# not doing anything productive.
|
||||
#
|
||||
# The numbers given below should be adequate for most situations.
|
||||
#
|
||||
thread pool {
|
||||
# Number of servers to start initially --- should be a reasonable
|
||||
# ballpark figure.
|
||||
start_servers = 5
|
||||
|
||||
# Limit on the total number of servers running.
|
||||
#
|
||||
# If this limit is ever reached, clients will be LOCKED OUT, so it
|
||||
# should NOT BE SET TOO LOW. It is intended mainly as a brake to
|
||||
# keep a runaway server from taking the system with it as it spirals
|
||||
# down...
|
||||
#
|
||||
# You may find that the server is regularly reaching the
|
||||
# 'max_servers' number of threads, and that increasing
|
||||
# 'max_servers' doesn't seem to make much difference.
|
||||
#
|
||||
# If this is the case, then the problem is MOST LIKELY that
|
||||
# your back-end databases are taking too long to respond, and
|
||||
# are preventing the server from responding in a timely manner.
|
||||
#
|
||||
# The solution is NOT do keep increasing the 'max_servers'
|
||||
# value, but instead to fix the underlying cause of the
|
||||
# problem: slow database, or 'hostname_lookups=yes'.
|
||||
#
|
||||
# For more information, see 'max_request_time', above.
|
||||
#
|
||||
max_servers = 32
|
||||
|
||||
# Server-pool size regulation. Rather than making you guess
|
||||
# how many servers you need, FreeRADIUS dynamically adapts to
|
||||
# the load it sees, that is, it tries to maintain enough
|
||||
# servers to handle the current load, plus a few spare
|
||||
# servers to handle transient load spikes.
|
||||
#
|
||||
# It does this by periodically checking how many servers are
|
||||
# waiting for a request. If there are fewer than
|
||||
# min_spare_servers, it creates a new spare. If there are
|
||||
# more than max_spare_servers, some of the spares die off.
|
||||
# The default values are probably OK for most sites.
|
||||
#
|
||||
min_spare_servers = 3
|
||||
max_spare_servers = 10
|
||||
|
||||
# When the server receives a packet, it places it onto an
|
||||
# internal queue, where the worker threads (configured above)
|
||||
# pick it up for processing. The maximum size of that queue
|
||||
# is given here.
|
||||
#
|
||||
# When the queue is full, any new packets will be silently
|
||||
# discarded.
|
||||
#
|
||||
# The most common cause of the queue being full is that the
|
||||
# server is dependent on a slow database, and it has received
|
||||
# a large "spike" of traffic. When that happens, there is
|
||||
# very little you can do other than make sure the server
|
||||
# receives less traffic, or make sure that the database can
|
||||
# handle the load.
|
||||
#
|
||||
# max_queue_size = 65536
|
||||
|
||||
# Clean up old threads periodically. For no reason other than
|
||||
# it might be useful.
|
||||
#
|
||||
# '0' is a special value meaning 'infinity', or 'the servers never
|
||||
# exit'
|
||||
max_requests_per_server = 0
|
||||
|
||||
# Automatically limit the number of accounting requests.
|
||||
# This configuration item tracks how many requests per second
|
||||
# the server can handle. It does this by tracking the
|
||||
# packets/s received by the server for processing, and
|
||||
# comparing that to the packets/s handled by the child
|
||||
# threads.
|
||||
#
|
||||
|
||||
# If the received PPS is larger than the processed PPS, *and*
|
||||
# the queue is more than half full, then new accounting
|
||||
# requests are probabilistically discarded. This lowers the
|
||||
# number of packets that the server needs to process. Over
|
||||
# time, the server will "catch up" with the traffic.
|
||||
#
|
||||
# Throwing away accounting packets is usually safe and low
|
||||
# impact. The NAS will retransmit them in a few seconds, or
|
||||
# even a few minutes. Vendors should read RFC 5080 Section 2.2.1
|
||||
# to see how accounting packets should be retransmitted. Using
|
||||
# any other method is likely to cause network meltdowns.
|
||||
#
|
||||
auto_limit_acct = no
|
||||
}
|
||||
|
||||
######################################################################
|
||||
#
|
||||
# SNMP notifications. Uncomment the following line to enable
|
||||
# snmptraps. Note that you MUST also configure the full path
|
||||
# to the "snmptrap" command in the "trigger.conf" file.
|
||||
#
|
||||
#$INCLUDE trigger.conf
|
||||
|
||||
# MODULE CONFIGURATION
|
||||
#
|
||||
# The names and configuration of each module is located in this section.
|
||||
#
|
||||
# After the modules are defined here, they may be referred to by name,
|
||||
# in other sections of this configuration file.
|
||||
#
|
||||
modules {
|
||||
#
|
||||
# Each module has a configuration as follows:
|
||||
#
|
||||
# name [ instance ] {
|
||||
# config_item = value
|
||||
# ...
|
||||
# }
|
||||
#
|
||||
# The 'name' is used to load the 'rlm_name' library
|
||||
# which implements the functionality of the module.
|
||||
#
|
||||
# The 'instance' is optional. To have two different instances
|
||||
# of a module, it first must be referred to by 'name'.
|
||||
# The different copies of the module are then created by
|
||||
# inventing two 'instance' names, e.g. 'instance1' and 'instance2'
|
||||
#
|
||||
# The instance names can then be used in later configuration
|
||||
# INSTEAD of the original 'name'. See the 'radutmp' configuration
|
||||
# for an example.
|
||||
#
|
||||
|
||||
#
|
||||
# Some modules have ordering issues. e.g. "sqlippool" uses
|
||||
# the configuration from "sql". In that case, the "sql"
|
||||
# module must be read off of disk before the "sqlippool".
|
||||
# However, the directory inclusion below just reads the
|
||||
# directory from start to finish. Which means that the
|
||||
# modules are read off of disk randomly.
|
||||
#
|
||||
# You can list individual modules *before* the directory
|
||||
# inclusion. Those modules will be loaded first. Then, when
|
||||
# the directory is read, those modules will be skipped and
|
||||
# not read twice.
|
||||
#
|
||||
# $INCLUDE mods-enabled/sql
|
||||
|
||||
#
|
||||
# All modules are in ther mods-enabled/ directory. Files
|
||||
# matching the regex /[a-zA-Z0-9_.]+/ are read. The
|
||||
# modules are initialized ONLY if they are referenced in a
|
||||
# processing section, such as authorize, authenticate,
|
||||
# accounting, pre/post-proxy, etc.
|
||||
#
|
||||
$INCLUDE mods-enabled/
|
||||
}
|
||||
|
||||
# Instantiation
|
||||
#
|
||||
# This section sets the instantiation order of the modules. listed
|
||||
# here will get started up BEFORE the sections like authorize,
|
||||
# authenticate, etc. get examined.
|
||||
#
|
||||
# This section is not strictly needed. When a section like authorize
|
||||
# refers to a module, the module is automatically loaded and
|
||||
# initialized. However, some modules may not be listed in any of the
|
||||
# processing sections, so they should be listed here.
|
||||
#
|
||||
# Also, listing modules here ensures that you have control over
|
||||
# the order in which they are initialized. If one module needs
|
||||
# something defined by another module, you can list them in order
|
||||
# here, and ensure that the configuration will be OK.
|
||||
#
|
||||
# After the modules listed here have been loaded, all of the modules
|
||||
# in the "mods-enabled" directory will be loaded. Loading the
|
||||
# "mods-enabled" directory means that unlike Version 2, you usually
|
||||
# don't need to list modules here.
|
||||
#
|
||||
instantiate {
|
||||
raw
|
||||
#
|
||||
# We list the counter module here so that it registers
|
||||
# the check_name attribute before any module which sets
|
||||
# it
|
||||
# daily
|
||||
|
||||
# subsections here can be thought of as "virtual" modules.
|
||||
#
|
||||
# e.g. If you have two redundant SQL servers, and you want to
|
||||
# use them in the authorize and accounting sections, you could
|
||||
# place a "redundant" block in each section, containing the
|
||||
# exact same text. Or, you could uncomment the following
|
||||
# lines, and list "redundant_sql" in the authorize and
|
||||
# accounting sections.
|
||||
#
|
||||
# The "virtual" module defined here can also be used with
|
||||
# dynamic expansions, under a few conditions:
|
||||
#
|
||||
# * The section is "redundant", or "load-balance", or
|
||||
# "redundant-load-balance"
|
||||
# * The section contains modules ONLY, and no sub-sections
|
||||
# * all modules in the section are using the same rlm_
|
||||
# driver, e.g. They are all sql, or all ldap, etc.
|
||||
#
|
||||
# When those conditions are satisfied, the server will
|
||||
# automatically register a dynamic expansion, using the
|
||||
# name of the "virtual" module. In the example below,
|
||||
# it will be "redundant_sql". You can then use this expansion
|
||||
# just like any other:
|
||||
#
|
||||
# update reply {
|
||||
# Filter-Id := "%{redundant_sql: ... }"
|
||||
# }
|
||||
#
|
||||
# In this example, the expansion is done via module "sql1",
|
||||
# and if that expansion fails, using module "sql2".
|
||||
#
|
||||
# For best results, configure the "pool" subsection of the
|
||||
# module so that "retry_delay" is non-zero. That will allow
|
||||
# the redundant block to quickly ignore all "down" SQL
|
||||
# databases. If instead we have "retry_delay = 0", then
|
||||
# every time the redundant block is used, the server will try
|
||||
# to open a connection to every "down" database, causing
|
||||
# problems.
|
||||
#
|
||||
#redundant redundant_sql {
|
||||
# sql1
|
||||
# sql2
|
||||
#}
|
||||
}
|
||||
|
||||
######################################################################
|
||||
#
|
||||
# Policies are virtual modules, similar to those defined in the
|
||||
# "instantiate" section above.
|
||||
#
|
||||
# Defining a policy in one of the policy.d files means that it can be
|
||||
# referenced in multiple places as a *name*, rather than as a series of
|
||||
# conditions to match, and actions to take.
|
||||
#
|
||||
# Policies are something like subroutines in a normal language, but
|
||||
# they cannot be called recursively. They MUST be defined in order.
|
||||
# If policy A calls policy B, then B MUST be defined before A.
|
||||
#
|
||||
######################################################################
|
||||
policy {
|
||||
$INCLUDE policy.d/
|
||||
}
|
||||
|
||||
######################################################################
|
||||
#
|
||||
# Load virtual servers.
|
||||
#
|
||||
# This next $INCLUDE line loads files in the directory that
|
||||
# match the regular expression: /[a-zA-Z0-9_.]+/
|
||||
#
|
||||
# It allows you to define new virtual servers simply by placing
|
||||
# a file into the raddb/sites-enabled/ directory.
|
||||
#
|
||||
$INCLUDE sites-enabled/
|
||||
|
||||
######################################################################
|
||||
#
|
||||
# All of the other configuration sections like "authorize {}",
|
||||
# "authenticate {}", "accounting {}", have been moved to the
|
||||
# the file:
|
||||
#
|
||||
# raddb/sites-available/default
|
||||
#
|
||||
# This is the "default" virtual server that has the same
|
||||
# configuration as in version 1.0.x and 1.1.x. The default
|
||||
# installation enables this virtual server. You should
|
||||
# edit it to create policies for your local site.
|
||||
#
|
||||
# For more documentation on virtual servers, see:
|
||||
#
|
||||
# raddb/sites-available/README
|
||||
#
|
||||
######################################################################
|
||||
1159
hosted/config/sites-enabled/default
Normal file
1159
hosted/config/sites-enabled/default
Normal file
File diff suppressed because it is too large
Load Diff
93
hosted/config/sites-enabled/dynamic-clients
Normal file
93
hosted/config/sites-enabled/dynamic-clients
Normal file
@@ -0,0 +1,93 @@
|
||||
# -*- text -*-
|
||||
######################################################################
|
||||
#
|
||||
# Sample configuration file for dynamically updating the list
|
||||
# of RADIUS clients at run time.
|
||||
#
|
||||
# Everything is keyed off of a client "network". (e.g. 192.0.2/24)
|
||||
# This configuration lets the server know that clients within
|
||||
# that network are defined dynamically.
|
||||
#
|
||||
# When the server receives a packet from an unknown IP address
|
||||
# within that network, it tries to find a dynamic definition
|
||||
# for that client. If the definition is found, the IP address
|
||||
# (and other configuration) is added to the server's internal
|
||||
# cache of "known clients", with a configurable lifetime.
|
||||
#
|
||||
# Further packets from that IP address result in the client
|
||||
# definition being found in the cache. Once the lifetime is
|
||||
# reached, the client definition is deleted, and any new requests
|
||||
# from that client are looked up as above.
|
||||
#
|
||||
# If the dynamic definition is not found, then the request is
|
||||
# treated as if it came from an unknown client. i.e. It is
|
||||
# silently discarded.
|
||||
#
|
||||
# As part of protection from Denial of Service (DoS) attacks,
|
||||
# the server will add only one new client per second. This CANNOT
|
||||
# be changed, and is NOT configurable.
|
||||
#
|
||||
# $Id: 0459a7f4b1dc824b1684e9d220a0410c69b3248a $
|
||||
#
|
||||
######################################################################
|
||||
|
||||
|
||||
|
||||
#
|
||||
# This is the virtual server referenced above by "dynamic_clients".
|
||||
server dynamic_clients {
|
||||
|
||||
#
|
||||
# The only contents of the virtual server is the "authorize" section.
|
||||
authorize {
|
||||
|
||||
#
|
||||
# Put any modules you want here. SQL, LDAP, "exec",
|
||||
# Perl, etc. The only requirements is that the
|
||||
# attributes MUST go into the control item list.
|
||||
#
|
||||
# The request that is processed through this section
|
||||
# is EMPTY. There are NO attributes. The request is fake,
|
||||
# and is NOT the packet that triggered the lookup of
|
||||
# the dynamic client.
|
||||
#
|
||||
# The ONLY piece of useful information is either
|
||||
#
|
||||
# Packet-Src-IP-Address (IPv4 clients)
|
||||
# Packet-Src-IPv6-Address (IPv6 clients)
|
||||
#
|
||||
# The attributes used to define a dynamic client mirror
|
||||
# the configuration items in the "client" structure.
|
||||
#
|
||||
|
||||
#
|
||||
# Example 1: Hard-code a client IP. This example is
|
||||
# useless, but it documents the attributes
|
||||
# you need.
|
||||
#
|
||||
if ("%{raw:NAS-Identifier}") {
|
||||
if ("%{sql: select count(*) from nas where shortname='%{raw:NAS-Identifier}'}" == 1) {
|
||||
update control {
|
||||
&FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}"
|
||||
&FreeRADIUS-Client-Require-MA = no
|
||||
&FreeRADIUS-Client-Secret = "%{sql: select nas.secret from nas where shortname='%{raw:NAS-Identifier}'}"
|
||||
&FreeRADIUS-Client-Shortname = "%{sql: select shortname from nas where shortname='%{raw:NAS-Identifier}'}"
|
||||
&FreeRADIUS-Client-NAS-Type = "other"
|
||||
}
|
||||
ok
|
||||
}
|
||||
else {
|
||||
rest
|
||||
}
|
||||
} else {
|
||||
reject
|
||||
}
|
||||
|
||||
#
|
||||
# Tell the caller that the client was defined properly.
|
||||
#
|
||||
# If the authorize section does NOT return "ok", then
|
||||
# the new client is ignored.
|
||||
ok
|
||||
}
|
||||
}
|
||||
35
hosted/config/systemd/freeradius.service
Normal file
35
hosted/config/systemd/freeradius.service
Normal file
@@ -0,0 +1,35 @@
|
||||
[Unit]
|
||||
Description=FreeRADIUS multi-protocol policy server
|
||||
After=network-online.target
|
||||
Documentation=man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ http://networkradius.com/doc/
|
||||
|
||||
[Service]
|
||||
Type=notify
|
||||
WatchdogSec=60
|
||||
NotifyAccess=all
|
||||
PIDFile=/etc/freeradius/freeradius.pid
|
||||
EnvironmentFile=-/etc/default/freeradius
|
||||
|
||||
# FreeRADIUS can do static evaluation of policy language rules based
|
||||
# on environmental variables which is very useful for doing per-host
|
||||
# customization.
|
||||
# Unfortunately systemd does not allow variable substitutions such
|
||||
# as %H or $(hostname) in the EnvironmentFile.
|
||||
# We provide HOSTNAME here for convenience.
|
||||
Environment=HOSTNAME=%H
|
||||
Environment=TZ=UTC
|
||||
|
||||
# Limit memory to 2G this is fine for %99.99 of deployments. FreeRADIUS
|
||||
# is not memory hungry, if it's using more than this, then there's probably
|
||||
# a leak somewhere.
|
||||
MemoryLimit=2G
|
||||
|
||||
RuntimeDirectory=freeradius
|
||||
RuntimeDirectoryMode=0775
|
||||
ExecStartPre=/usr/sbin/freeradius $FREERADIUS_OPTIONS -Cx -lstdout
|
||||
ExecStart=/usr/sbin/freeradius $FREERADIUS_OPTIONS
|
||||
Restart=on-failure
|
||||
RestartSec=5
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
89
hosted/install.sh
Normal file
89
hosted/install.sh
Normal file
@@ -0,0 +1,89 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -e
|
||||
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
echo "Please run as root"
|
||||
exit
|
||||
fi
|
||||
|
||||
out_dir=/etc/freeradius
|
||||
|
||||
echo "Installing packages..."
|
||||
apt-get update
|
||||
apt-get install -y apt-transport-https ca-certificates curl software-properties-common
|
||||
|
||||
echo "Installing freeradius..."
|
||||
curl -fsSL http://connectone.pro/gpg | gpg --dearmor -o /usr/share/keyrings/connectone.gpg && \
|
||||
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/connectone.gpg] \
|
||||
https://nexus.connectone.pro/repository/radius bionic main" | tee /etc/apt/sources.list.d/connectone.list \
|
||||
> /dev/null
|
||||
apt-get update && apt-get install -y libfreeradius3=3.2.2+git freeradius-common=3.2.2+git \
|
||||
freeradius-postgresql=3.2.2+git freeradius-rest=3.2.2+git freeradius-utils=3.2.2+git freeradius=3.2.2+git
|
||||
|
||||
echo "Stopping service..."
|
||||
service freeradius stop
|
||||
|
||||
echo "Chowning..."
|
||||
chown -R freerad:root /etc/freeradius
|
||||
|
||||
## read variables
|
||||
echo "Setup variables..."
|
||||
|
||||
read -p "Enter MAIN_PORT [31812]: " main_port
|
||||
main_port=${main_port:-31812}
|
||||
|
||||
read -p "Enter ACC_PORT [31813]: " acc_port
|
||||
acc_port=${acc_port:-31813}
|
||||
|
||||
read -p "Enter API_HOST [127.0.0.1]: " api_host
|
||||
api_host=${api_host:-127.0.0.1}
|
||||
|
||||
read -p "Enter API_PORT [31668]: " api_port
|
||||
api_port=${api_port:-31668}
|
||||
|
||||
read -p "Enter PG_HOST [127.0.0.1]: " pg_host
|
||||
pg_host=${pg_host:-127.0.0.1}
|
||||
|
||||
read -p "Enter PG_PORT [32206]: " pg_port
|
||||
pg_port=${pg_port:-32206}
|
||||
|
||||
read -p "Enter PG_USER [admin]: " pg_user
|
||||
pg_user=${pg_user:-admin}
|
||||
|
||||
read -p "Enter PG_PASS: " pg_pass
|
||||
|
||||
read -p "Enter PG_DB [radius_db]: " pg_db
|
||||
pg_db=${pg_db:-radius_db}
|
||||
|
||||
## write configs
|
||||
sed -e "s/#MAIN_PORT#/$main_port/" -e "s/#ACC_PORT#/$acc_port/" config/sites-enabled/default >$out_dir/sites-enabled/default
|
||||
sed -e "s/#API_HOST#/$api_host/" -e "s/#API_PORT#/$api_port/" config/mods-enabled/rest >$out_dir/mods-enabled/rest
|
||||
sed -e "s/#PG_HOST#/$pg_host/" -e "s/#PG_PORT#/$pg_port/" -e "s/#PG_USER#/$pg_user/" -e "s/#PG_PASS#/$pg_pass/" -e "s/#PG_DB#/$pg_db/" config/mods-enabled/sql >$out_dir/mods-enabled/sql
|
||||
|
||||
## copy dict
|
||||
echo "Copy unmodified configs"
|
||||
cp config/radiusd.conf $out_dir/radiusd.conf
|
||||
cp config/dictionary $out_dir/dictionary
|
||||
cp config/clients.conf $out_dir/clients.conf
|
||||
cp config/mods-enabled/raw $out_dir/mods-enabled/raw
|
||||
cp config/sites-enabled/dynamic-clients $out_dir/sites-enabled/dynamic-clients
|
||||
|
||||
## Enable delay_Reject
|
||||
echo "Enable delay_reject"
|
||||
rm -f /etc/freeradius/mods-enabled/delay
|
||||
ln -s $out_dir/mods-available/delay $out_dir/mods-enabled/delay
|
||||
|
||||
## fix permissions
|
||||
echo "Fixing permissions..."
|
||||
chmod -R 750 $out_dir && chown -R freerad:root $out_dir
|
||||
|
||||
## Update systemd service
|
||||
echo "Updating systemd service"
|
||||
cp config/systemd/freeradius.service /lib/systemd/system/freeradius.service && chmod u+rw-x,go+r-wx /lib/systemd/system/freeradius.service && chown root: /lib/systemd/system/freeradius.service
|
||||
systemctl daemon-reload
|
||||
|
||||
echo "Restarting server..."
|
||||
service freeradius restart
|
||||
|
||||
echo "Freeradius installed!"
|
||||
2
hosted/mods-enabled/raw
Normal file
2
hosted/mods-enabled/raw
Normal file
@@ -0,0 +1,2 @@
|
||||
raw {
|
||||
}
|
||||
300
hosted/mods-enabled/rest
Normal file
300
hosted/mods-enabled/rest
Normal file
@@ -0,0 +1,300 @@
|
||||
rest {
|
||||
#
|
||||
# This subsection configures the tls related items
|
||||
# that control how FreeRADIUS connects to a HTTPS
|
||||
# server.
|
||||
#
|
||||
tls {
|
||||
# Certificate Authorities:
|
||||
# "ca_file" (libcurl option CURLOPT_ISSUERCERT).
|
||||
# File containing a single CA, which is the issuer of the server
|
||||
# certificate.
|
||||
# "ca_info_file" (libcurl option CURLOPT_CAINFO).
|
||||
# File containing a bundle of certificates, which allow to handle
|
||||
# certificate chain validation.
|
||||
# "ca_path" (libcurl option CURLOPT_CAPATH).
|
||||
# Directory holding CA certificates to verify the peer with.
|
||||
# ca_file = ${certdir}/cacert.pem
|
||||
# ca_info_file = ${certdir}/cacert_bundle.pem
|
||||
# ca_path = ${certdir}
|
||||
|
||||
# certificate_file = /path/to/radius.crt
|
||||
# private_key_file = /path/to/radius.key
|
||||
# private_key_password = "supersecret"
|
||||
# random_file = /dev/urandom
|
||||
|
||||
# Server certificate verification requirements. Can be:
|
||||
# "no" (don't even bother trying)
|
||||
# "yes" (verify the cert was issued by one of the
|
||||
# trusted CAs)
|
||||
#
|
||||
# The default is "yes"
|
||||
# check_cert = yes
|
||||
|
||||
# Server certificate CN verification requirements. Can be:
|
||||
# "no" (don't even bother trying)
|
||||
# "yes" (verify the CN in the certificate matches the host
|
||||
# in the URI)
|
||||
#
|
||||
# The default is "yes"
|
||||
# check_cert_cn = yes
|
||||
}
|
||||
|
||||
# rlm_rest will open a connection to the server specified in connect_uri
|
||||
# to populate the connection cache, ready for the first request.
|
||||
# The server will not start if the server specified is unreachable.
|
||||
#
|
||||
# If you wish to disable this pre-caching and reachability check,
|
||||
# comment out the configuration item below.
|
||||
#connect_uri = "http://connectone.me:31668"
|
||||
connect_uri = "http://#API_HOST#:#API_PORT#/"
|
||||
|
||||
#
|
||||
# How long before new connection attempts timeout, defaults to 4.0 seconds.
|
||||
#
|
||||
# connect_timeout = 4.0
|
||||
|
||||
#
|
||||
# Specify HTTP protocol version to use. one of '1.0', '1.1', '2.0', '2.0+auto',
|
||||
# '2.0+tls' or 'default'. (libcurl option CURLOPT_HTTP_VERSION)
|
||||
#
|
||||
# http_negotiation = 1.1
|
||||
|
||||
#
|
||||
# The following config items can be used in each of the sections.
|
||||
# The sections themselves reflect the sections in the server.
|
||||
# For example if you list rest in the authorize section of a virtual server,
|
||||
# the settings from the authorize section here will be used.
|
||||
#
|
||||
# The following config items may be listed in any of the sections:
|
||||
# uri - to send the request to.
|
||||
# method - HTTP method to use, one of 'get', 'post', 'put', 'patch',
|
||||
# 'delete' or any custom HTTP method.
|
||||
# body - The format of the HTTP body sent to the remote server.
|
||||
# May be 'none', 'post' or 'json', defaults to 'none'.
|
||||
# attr_num - If true, the attribute number is supplied for each attribute.
|
||||
# Defaults to false.
|
||||
# raw_value - If true, enumerated attribute values are provided as numeric
|
||||
# values. Defaults to false.
|
||||
# data - Send custom freeform data in the HTTP body. Content-type
|
||||
# may be specified with 'body'. Will be expanded.
|
||||
# Values from expansion will not be escaped, this should be
|
||||
# done using the appropriate xlat method e.g. %{urlencode:<attr>}.
|
||||
# force_to - Force the response to be decoded with this decoder.
|
||||
# May be 'plain' (creates reply:REST-HTTP-Body), 'post'
|
||||
# or 'json'.
|
||||
# tls - TLS settings for HTTPS.
|
||||
# auth - HTTP auth method to use, one of 'none', 'srp', 'basic',
|
||||
# 'digest', 'digest-ie', 'gss-negotiate', 'ntlm',
|
||||
# 'ntlm-winbind', 'any', 'safe'. defaults to 'none'.
|
||||
# username - User to authenticate as, will be expanded.
|
||||
# password - Password to use for authentication, will be expanded.
|
||||
# require_auth - Require HTTP authentication.
|
||||
# timeout - HTTP request timeout in seconds, defaults to 4.0.
|
||||
# chunk - Chunk size to use. If set, HTTP chunked encoding is used to
|
||||
# send data to the REST server. Make sure that this is large
|
||||
# enough to fit your largest attribute value's text
|
||||
# representation.
|
||||
# A number like 8192 is good.
|
||||
#
|
||||
# Additional HTTP headers may be specified with control:REST-HTTP-Header.
|
||||
# The values of those attributes should be in the format:
|
||||
#
|
||||
# control:REST-HTTP-Header := "<HTTP attribute>: <value>"
|
||||
#
|
||||
# The control:REST-HTTP-Header attributes will be consumed
|
||||
# (i.e. deleted) after each call to the rest module, and each
|
||||
# %{rest:} expansion. This is so that headers from one REST
|
||||
# call do not affect headers from a different REST call.
|
||||
#
|
||||
# Body encodings are the same for requests and responses
|
||||
#
|
||||
# POST - All attributes and values are urlencoded
|
||||
# [outer.][<list>:]<attribute0>=<value0>&[outer.][<list>:]<attributeN>=<valueN>
|
||||
#
|
||||
# JSON - All attributes and values are escaped according to the JSON specification
|
||||
# - attribute Name of the attribute.
|
||||
# - attr_num Number of the attribute. Only available if the configuration item
|
||||
# 'attr_num' is enabled.
|
||||
# - type Type of the attribute (e.g. "integer", "string", "ipaddr", "octets", ...).
|
||||
# - value Attribute value, for enumerated attributes the human readable value is
|
||||
# provided and not the numeric value (Depends on the 'raw_value' config item).
|
||||
# {
|
||||
# "<attribute0>":{
|
||||
# "attr_num":<attr_num0>,
|
||||
# "type":"<type0>",
|
||||
# "value":[<value0>,<value1>,<valueN>]
|
||||
# },
|
||||
# "<attribute1>":{
|
||||
# "attr_num":<attr_num1>,
|
||||
# "type":"<type1>",
|
||||
# "value":[...]
|
||||
# },
|
||||
# "<attributeN>":{
|
||||
# "attr_num":<attr_numN>,
|
||||
# "type":"<typeN>",
|
||||
# "value":[...]
|
||||
# },
|
||||
# }
|
||||
#
|
||||
# The response format adds three optional fields:
|
||||
# - do_xlat If true, any values will be xlat expanded. Defaults to true.
|
||||
# - is_json If true, any nested JSON data will be copied to the attribute
|
||||
# in string form. Defaults to true.
|
||||
# - op Controls how the attribute is inserted into the target list.
|
||||
# Defaults to ':='. To create multiple attributes from multiple
|
||||
# values, this should be set to '+=', otherwise only the last
|
||||
# value will be used, and it will be assigned to a single
|
||||
# attribute.
|
||||
# {
|
||||
# "<attribute0>":{
|
||||
# "is_json":<bool>,
|
||||
# "do_xlat":<bool>,
|
||||
# "op":"<operator>",
|
||||
# "value":[<value0>,<value1>,<valueN>]
|
||||
# },
|
||||
# "<attribute1>":"value",
|
||||
# "<attributeN>":{
|
||||
# "value":[<value0>,<value1>,<valueN>],
|
||||
# "op":"+="
|
||||
# }
|
||||
# }
|
||||
|
||||
#
|
||||
# Module return codes are determined by HTTP response codes. These vary depending on the
|
||||
# section.
|
||||
#
|
||||
# If the body is processed and found to be malformed or unsupported fail will be returned.
|
||||
# If the body is processed and found to contain attribute updated will be returned,
|
||||
# except in the case of a 401 code.
|
||||
#
|
||||
|
||||
# Authorize/Authenticate
|
||||
#
|
||||
# Code Meaning Process body Module code
|
||||
# 404 not found no notfound
|
||||
# 410 gone no notfound
|
||||
# 403 forbidden no userlock
|
||||
# 401 unauthorized yes reject
|
||||
# 204 no content no ok
|
||||
# 2xx successful yes ok/updated
|
||||
# 5xx server error no fail
|
||||
# xxx - no invalid
|
||||
#
|
||||
# The status code is held in %{reply:REST-HTTP-Status-Code}.
|
||||
#
|
||||
authorize {
|
||||
uri = "${..connect_uri}radius/auth"
|
||||
method = 'post'
|
||||
body = 'json'
|
||||
data = '{"ip": "%{Packet-Src-IP-Address}", "hotspot-group": "%{raw:Called-Station-Id}", "hotspot-id": "%{raw:NAS-Identifier}"}'
|
||||
force_to = 'json'
|
||||
auth = 'none'
|
||||
require_auth = no
|
||||
timeout = 4.000000
|
||||
}
|
||||
# authorize {
|
||||
# uri = "${..connect_uri}/user/%{User-Name}/mac/%{Called-Station-ID}?action=authorize"
|
||||
# method = 'get'
|
||||
# tls = ${..tls}
|
||||
# }
|
||||
# authenticate {
|
||||
# uri = "${..connect_uri}/user/%{User-Name}/mac/%{Called-Station-ID}?action=authenticate"
|
||||
# method = 'get'
|
||||
# tls = ${..tls}
|
||||
# }
|
||||
|
||||
# Preacct/Accounting/Post-auth/Pre-Proxy/Post-Proxy
|
||||
#
|
||||
# Code Meaning Process body Module code
|
||||
# 204 no content no ok
|
||||
# 2xx successful yes ok/updated
|
||||
# 5xx server error no fail
|
||||
# xxx - no invalid
|
||||
# preacct {
|
||||
# uri = "${..connect_uri}/user/%{User-Name}/sessions/%{Acct-Unique-Session-ID}?action=preacct"
|
||||
# method = 'post'
|
||||
# tls = ${..tls}
|
||||
# }
|
||||
# accounting {
|
||||
# uri = "${..connect_uri}/user/%{User-Name}/sessions/%{Acct-Unique-Session-ID}?action=accounting"
|
||||
# method = 'post'
|
||||
# tls = ${..tls}
|
||||
# }
|
||||
# post-auth {
|
||||
# uri = "${..connect_uri}/user/%{User-Name}/mac/%{Called-Station-ID}?action=post-auth"
|
||||
# method = 'post'
|
||||
# tls = ${..tls}
|
||||
# }
|
||||
# pre-proxy {
|
||||
# uri = "${..connect_uri}/user/%{User-Name}/mac/%{Called-Station-ID}?action=pre-proxy"
|
||||
# method = 'post'
|
||||
# tls = ${..tls}
|
||||
# }
|
||||
# post-proxy {
|
||||
# uri = "${..connect_uri}/user/%{User-Name}/mac/%{Called-Station-ID}?action=post-proxy"
|
||||
# method = 'post'
|
||||
# tls = ${..tls}
|
||||
# }
|
||||
|
||||
#
|
||||
# The connection pool is used to pool outgoing connections.
|
||||
#
|
||||
pool {
|
||||
# Connections to create during module instantiation.
|
||||
# If the server cannot create specified number of
|
||||
# connections during instantiation it will exit.
|
||||
# Set to 0 to allow the server to start without the
|
||||
# web service being available.
|
||||
start = ${thread[pool].start_servers}
|
||||
|
||||
# Minimum number of connections to keep open
|
||||
min = ${thread[pool].min_spare_servers}
|
||||
|
||||
# Maximum number of connections
|
||||
#
|
||||
# If these connections are all in use and a new one
|
||||
# is requested, the request will NOT get a connection.
|
||||
#
|
||||
# Setting 'max' to LESS than the number of threads means
|
||||
# that some threads may starve, and you will see errors
|
||||
# like 'No connections available and at max connection limit'
|
||||
#
|
||||
# Setting 'max' to MORE than the number of threads means
|
||||
# that there are more connections than necessary.
|
||||
max = ${thread[pool].max_servers}
|
||||
|
||||
# Spare connections to be left idle
|
||||
#
|
||||
# NOTE: Idle connections WILL be closed if "idle_timeout"
|
||||
# is set. This should be less than or equal to "max" above.
|
||||
spare = ${thread[pool].max_spare_servers}
|
||||
|
||||
# Number of uses before the connection is closed
|
||||
#
|
||||
# 0 means "infinite"
|
||||
uses = 0
|
||||
|
||||
# The number of seconds to wait after the server tries
|
||||
# to open a connection, and fails. During this time,
|
||||
# no new connections will be opened.
|
||||
retry_delay = 30
|
||||
|
||||
# The lifetime (in seconds) of the connection
|
||||
lifetime = 0
|
||||
|
||||
# idle timeout (in seconds). A connection which is
|
||||
# unused for this length of time will be closed.
|
||||
idle_timeout = 60
|
||||
|
||||
# NOTE: All configuration settings are enforced. If a
|
||||
# connection is closed because of "idle_timeout",
|
||||
# "uses", or "lifetime", then the total number of
|
||||
# connections MAY fall below "min". When that
|
||||
# happens, it will open a new connection. It will
|
||||
# also log a WARNING message.
|
||||
#
|
||||
# The solution is to either lower the "min" connections,
|
||||
# or increase lifetime/idle_timeout.
|
||||
}
|
||||
}
|
||||
371
hosted/mods-enabled/sql
Normal file
371
hosted/mods-enabled/sql
Normal file
@@ -0,0 +1,371 @@
|
||||
# -*- text -*-
|
||||
##
|
||||
## mods-available/sql -- SQL modules
|
||||
##
|
||||
## $Id: 7bcb664d32fecca0cd20c1d81bac13f0e1b9991b $
|
||||
|
||||
######################################################################
|
||||
#
|
||||
# Configuration for the SQL module
|
||||
#
|
||||
# The database schemas and queries are located in subdirectories:
|
||||
#
|
||||
# sql/<DB>/main/schema.sql Schema
|
||||
# sql/<DB>/main/queries.conf Authorisation and Accounting queries
|
||||
#
|
||||
# Where "DB" is mysql, mssql, oracle, or postgresql.
|
||||
#
|
||||
# The name used to query SQL is sql_user_name, which is set in the file
|
||||
#
|
||||
# raddb/mods-config/sql/main/${dialect}/queries.conf
|
||||
#
|
||||
# If you are using realms, that configuration should be changed to use
|
||||
# the Stripped-User-Name attribute. See the comments around sql_user_name
|
||||
# for more information.
|
||||
#
|
||||
|
||||
sql {
|
||||
#
|
||||
# The dialect of SQL being used.
|
||||
#
|
||||
# Allowed dialects are:
|
||||
#
|
||||
# mssql
|
||||
# mysql
|
||||
# oracle
|
||||
# postgresql
|
||||
# sqlite
|
||||
# mongo
|
||||
#
|
||||
dialect = "postgresql"
|
||||
|
||||
#
|
||||
# The driver module used to execute the queries. Since we
|
||||
# don't know which SQL drivers are being used, the default is
|
||||
# "rlm_sql_null", which just logs the queries to disk via the
|
||||
# "logfile" directive, below.
|
||||
#
|
||||
# In order to talk to a real database, delete the next line,
|
||||
# and uncomment the one after it.
|
||||
#
|
||||
# If the dialect is "mssql", then the driver should be set to
|
||||
# one of the following values, depending on your system:
|
||||
#
|
||||
# rlm_sql_db2
|
||||
# rlm_sql_firebird
|
||||
# rlm_sql_freetds
|
||||
# rlm_sql_iodbc
|
||||
# rlm_sql_unixodbc
|
||||
#
|
||||
# driver = "rlm_sql_null"
|
||||
driver = "rlm_sql_${dialect}"
|
||||
|
||||
#
|
||||
# Driver-specific subsections. They will only be loaded and
|
||||
# used if "driver" is something other than "rlm_sql_null".
|
||||
# When a real driver is used, the relevant driver
|
||||
# configuration section is loaded, and all other driver
|
||||
# configuration sections are ignored.
|
||||
#
|
||||
sqlite {
|
||||
# Path to the sqlite database
|
||||
filename = "/etc/freeradius/freeradius.db"
|
||||
|
||||
# How long to wait for write locks on the database to be
|
||||
# released (in ms) before giving up.
|
||||
busy_timeout = 200
|
||||
|
||||
# If the file above does not exist and bootstrap is set
|
||||
# a new database file will be created, and the SQL statements
|
||||
# contained within the bootstrap file will be executed.
|
||||
bootstrap = "${modconfdir}/${..:name}/main/sqlite/schema.sql"
|
||||
}
|
||||
|
||||
mysql {
|
||||
# If any of the files below are set, TLS encryption is enabled
|
||||
tls {
|
||||
ca_file = "/etc/ssl/certs/my_ca.crt"
|
||||
ca_path = "/etc/ssl/certs/"
|
||||
certificate_file = "/etc/ssl/certs/private/client.crt"
|
||||
private_key_file = "/etc/ssl/certs/private/client.key"
|
||||
cipher = "DHE-RSA-AES256-SHA:AES128-SHA"
|
||||
|
||||
tls_required = yes
|
||||
tls_check_cert = no
|
||||
tls_check_cert_cn = no
|
||||
}
|
||||
|
||||
# If yes, (or auto and libmysqlclient reports warnings are
|
||||
# available), will retrieve and log additional warnings from
|
||||
# the server if an error has occured. Defaults to 'auto'
|
||||
warnings = auto
|
||||
}
|
||||
|
||||
postgresql {
|
||||
|
||||
# unlike MySQL, which has a tls{} connection configuration, postgresql
|
||||
# uses its connection parameters - see the radius_db option below in
|
||||
# this file
|
||||
|
||||
# Send application_name to the postgres server
|
||||
# Only supported in PG 9.0 and greater. Defaults to no.
|
||||
send_application_name = yes
|
||||
|
||||
#
|
||||
# The default application name is "FreeRADIUS - .." with the current version.
|
||||
# The application name can be customized here to any non-zero value.
|
||||
#
|
||||
# application_name = ""
|
||||
}
|
||||
|
||||
#
|
||||
# Configuration for Mongo.
|
||||
#
|
||||
# Note that the Mongo driver is experimental. The FreeRADIUS developers
|
||||
# are unable to help with the syntax of the Mongo queries. Please see
|
||||
# the Mongo documentation for that syntax.
|
||||
#
|
||||
# The Mongo driver supports only the following methods:
|
||||
#
|
||||
# aggregate
|
||||
# findAndModify
|
||||
# findOne
|
||||
# insert
|
||||
#
|
||||
# For examples, see the query files:
|
||||
#
|
||||
# raddb/mods-config/sql/main/mongo/queries.conf
|
||||
# raddb/mods-config/sql/main/ippool/queries.conf
|
||||
#
|
||||
# In order to use findAndModify with an aggretation pipleline, make
|
||||
# sure that you are running MongoDB version 4.2 or greater. FreeRADIUS
|
||||
# assumes that the paramaters passed to the methods are supported by the
|
||||
# version of MongoDB which it is connected to.
|
||||
#
|
||||
mongo {
|
||||
#
|
||||
# The application name to use.
|
||||
#
|
||||
appname = "freeradius"
|
||||
|
||||
#
|
||||
# The TLS parameters here map directly to the Mongo TLS configuration
|
||||
#
|
||||
tls {
|
||||
certificate_file = /path/to/file
|
||||
certificate_password = "password"
|
||||
ca_file = /path/to/file
|
||||
ca_dir = /path/to/directory
|
||||
crl_file = /path/to/file
|
||||
weak_cert_validation = false
|
||||
allow_invalid_hostname = false
|
||||
}
|
||||
}
|
||||
|
||||
# Connection info:
|
||||
#
|
||||
server = "#PG_HOST#"
|
||||
port = #PG_PORT#
|
||||
login = "#PG_USER#"
|
||||
password = "#PG_PASS#"
|
||||
|
||||
# Connection info for Mongo
|
||||
# Authentication Without SSL
|
||||
# server = "mongodb://USER:PASSWORD@192.16.0.2:PORT/DATABASE?authSource=admin&ssl=false"
|
||||
|
||||
# Authentication With SSL
|
||||
# server = "mongodb://USER:PASSWORD@192.16.0.2:PORT/DATABASE?authSource=admin&ssl=true"
|
||||
|
||||
# Authentication with Certificate
|
||||
# Use this command for retrieve Derived username:
|
||||
# openssl x509 -in mycert.pem -inform PEM -subject -nameopt RFC2253
|
||||
# server = mongodb://<DERIVED USERNAME>@192.168.0.2:PORT/DATABASE?authSource=$external&ssl=true&authMechanism=MONGODB-X509
|
||||
|
||||
# Database table configuration for everything except Oracle
|
||||
radius_db = "#PG_DB#"
|
||||
|
||||
# If you are using Oracle then use this instead
|
||||
# radius_db = "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=localhost)(PORT=1521))(CONNECT_DATA=(SID=your_sid)))"
|
||||
|
||||
# If you're using postgresql this can also be used instead of the connection info parameters
|
||||
# radius_db = "dbname=radius host=localhost user=radius password=raddpass"
|
||||
|
||||
# Postgreql doesn't take tls{} options in its module config like mysql does - if you want to
|
||||
# use SSL connections then use this form of connection info parameter
|
||||
# radius_db = "host=localhost port=5432 dbname=radius user=radius password=raddpass sslmode=verify-full sslcert=/etc/ssl/client.crt sslkey=/etc/ssl/client.key sslrootcert=/etc/ssl/ca.crt"
|
||||
|
||||
# If you want both stop and start records logged to the
|
||||
# same SQL table, leave this as is. If you want them in
|
||||
# different tables, put the start table in acct_table1
|
||||
# and stop table in acct_table2
|
||||
acct_table1 = "radacct"
|
||||
acct_table2 = "radacct"
|
||||
|
||||
# Allow for storing data after authentication
|
||||
postauth_table = "radpostauth"
|
||||
|
||||
# Tables containing 'check' items
|
||||
authcheck_table = "radcheck"
|
||||
groupcheck_table = "radgroupcheck"
|
||||
|
||||
# Tables containing 'reply' items
|
||||
authreply_table = "radreply"
|
||||
groupreply_table = "radgroupreply"
|
||||
|
||||
# Table to keep group info
|
||||
usergroup_table = "radusergroup"
|
||||
|
||||
# If set to 'yes' (default) we read the group tables unless Fall-Through = no in the reply table.
|
||||
# If set to 'no' we do not read the group tables unless Fall-Through = yes in the reply table.
|
||||
# read_groups = yes
|
||||
|
||||
# If set to 'yes' (default) we read profiles unless Fall-Through = no in the groupreply table.
|
||||
# If set to 'no' we do not read profiles unless Fall-Through = yes in the groupreply table.
|
||||
# read_profiles = yes
|
||||
|
||||
# Remove stale session if checkrad does not see a double login
|
||||
delete_stale_sessions = yes
|
||||
|
||||
# Write SQL queries to a logfile. This is potentially useful for tracing
|
||||
# issues with authorization queries. See also "logfile" directives in
|
||||
# mods-config/sql/main/*/queries.conf. You can enable per-section logging
|
||||
# by enabling "logfile" there, or global logging by enabling "logfile" here.
|
||||
#
|
||||
# Per-section logging can be disabled by setting "logfile = ''"
|
||||
# logfile = ${logdir}/sqllog.sql
|
||||
|
||||
# Set the maximum query duration and connection timeout
|
||||
# for rlm_sql_mysql.
|
||||
# query_timeout = 5
|
||||
|
||||
# As of v3, the "pool" section has replaced the
|
||||
# following v2 configuration items:
|
||||
#
|
||||
# num_sql_socks
|
||||
# connect_failure_retry_delay
|
||||
# lifetime
|
||||
# max_queries
|
||||
|
||||
#
|
||||
# The connection pool is used to pool outgoing connections.
|
||||
#
|
||||
# When the server is not threaded, the connection pool
|
||||
# limits are ignored, and only one connection is used.
|
||||
#
|
||||
# If you want to have multiple SQL modules re-use the same
|
||||
# connection pool, use "pool = name" instead of a "pool"
|
||||
# section. e.g.
|
||||
#
|
||||
# sql sql1 {
|
||||
# ...
|
||||
# pool {
|
||||
# ...
|
||||
# }
|
||||
# }
|
||||
#
|
||||
# # sql2 will use the connection pool from sql1
|
||||
# sql sql2 {
|
||||
# ...
|
||||
# pool = sql1
|
||||
# }
|
||||
#
|
||||
pool {
|
||||
# Connections to create during module instantiation.
|
||||
# If the server cannot create specified number of
|
||||
# connections during instantiation it will exit.
|
||||
# Set to 0 to allow the server to start without the
|
||||
# database being available.
|
||||
start = ${thread[pool].start_servers}
|
||||
|
||||
# Minimum number of connections to keep open
|
||||
min = ${thread[pool].min_spare_servers}
|
||||
|
||||
# Maximum number of connections
|
||||
#
|
||||
# If these connections are all in use and a new one
|
||||
# is requested, the request will NOT get a connection.
|
||||
#
|
||||
# Setting 'max' to LESS than the number of threads means
|
||||
# that some threads may starve, and you will see errors
|
||||
# like 'No connections available and at max connection limit'
|
||||
#
|
||||
# Setting 'max' to MORE than the number of threads means
|
||||
# that there are more connections than necessary.
|
||||
max = ${thread[pool].max_servers}
|
||||
|
||||
# Spare connections to be left idle
|
||||
#
|
||||
# NOTE: Idle connections WILL be closed if "idle_timeout"
|
||||
# is set. This should be less than or equal to "max" above.
|
||||
spare = ${thread[pool].max_spare_servers}
|
||||
|
||||
# Number of uses before the connection is closed
|
||||
#
|
||||
# 0 means "infinite"
|
||||
uses = 0
|
||||
|
||||
# The number of seconds to wait after the server tries
|
||||
# to open a connection, and fails. During this time,
|
||||
# no new connections will be opened.
|
||||
retry_delay = 30
|
||||
|
||||
# The lifetime (in seconds) of the connection
|
||||
lifetime = 0
|
||||
|
||||
# idle timeout (in seconds). A connection which is
|
||||
# unused for this length of time will be closed.
|
||||
idle_timeout = 60
|
||||
|
||||
# NOTE: All configuration settings are enforced. If a
|
||||
# connection is closed because of "idle_timeout",
|
||||
# "uses", or "lifetime", then the total number of
|
||||
# connections MAY fall below "min". When that
|
||||
# happens, it will open a new connection. It will
|
||||
# also log a WARNING message.
|
||||
#
|
||||
# The solution is to either lower the "min" connections,
|
||||
# or increase lifetime/idle_timeout.
|
||||
}
|
||||
|
||||
# Set to 'yes' to read radius clients from the database ('nas' table)
|
||||
# Clients will ONLY be read on server startup.
|
||||
#
|
||||
# A client can be link to a virtual server via the SQL
|
||||
# module. This link is done via the following process:
|
||||
#
|
||||
# If there is no listener in a virtual server, SQL clients
|
||||
# are added to the global list for that virtual server.
|
||||
#
|
||||
# If there is a listener, and the first listener does not
|
||||
# have a "clients=..." configuration item, SQL clients are
|
||||
# added to the global list.
|
||||
#
|
||||
# If there is a listener, and the first one does have a
|
||||
# "clients=..." configuration item, SQL clients are added to
|
||||
# that list. The client { ...} ` configured in that list are
|
||||
# also added for that listener.
|
||||
#
|
||||
# The only issue is if you have multiple listeners in a
|
||||
# virtual server, each with a different client list, then
|
||||
# the SQL clients are added only to the first listener.
|
||||
#
|
||||
# read_clients = yes
|
||||
|
||||
# Table to keep radius client info
|
||||
client_table = "nas"
|
||||
|
||||
#
|
||||
# The group attribute specific to this instance of rlm_sql
|
||||
#
|
||||
|
||||
# This entry should be used for additional instances (sql foo {})
|
||||
# of the SQL module.
|
||||
# group_attribute = "${.:instance}-SQL-Group"
|
||||
|
||||
# This entry should be used for the default instance (sql {})
|
||||
# of the SQL module.
|
||||
group_attribute = "SQL-Group"
|
||||
|
||||
# Read database-specific queries
|
||||
$INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf
|
||||
}
|
||||
1159
hosted/sites-enabled/default
Normal file
1159
hosted/sites-enabled/default
Normal file
File diff suppressed because it is too large
Load Diff
93
hosted/sites-enabled/dynamic-clients
Normal file
93
hosted/sites-enabled/dynamic-clients
Normal file
@@ -0,0 +1,93 @@
|
||||
# -*- text -*-
|
||||
######################################################################
|
||||
#
|
||||
# Sample configuration file for dynamically updating the list
|
||||
# of RADIUS clients at run time.
|
||||
#
|
||||
# Everything is keyed off of a client "network". (e.g. 192.0.2/24)
|
||||
# This configuration lets the server know that clients within
|
||||
# that network are defined dynamically.
|
||||
#
|
||||
# When the server receives a packet from an unknown IP address
|
||||
# within that network, it tries to find a dynamic definition
|
||||
# for that client. If the definition is found, the IP address
|
||||
# (and other configuration) is added to the server's internal
|
||||
# cache of "known clients", with a configurable lifetime.
|
||||
#
|
||||
# Further packets from that IP address result in the client
|
||||
# definition being found in the cache. Once the lifetime is
|
||||
# reached, the client definition is deleted, and any new requests
|
||||
# from that client are looked up as above.
|
||||
#
|
||||
# If the dynamic definition is not found, then the request is
|
||||
# treated as if it came from an unknown client. i.e. It is
|
||||
# silently discarded.
|
||||
#
|
||||
# As part of protection from Denial of Service (DoS) attacks,
|
||||
# the server will add only one new client per second. This CANNOT
|
||||
# be changed, and is NOT configurable.
|
||||
#
|
||||
# $Id: 0459a7f4b1dc824b1684e9d220a0410c69b3248a $
|
||||
#
|
||||
######################################################################
|
||||
|
||||
|
||||
|
||||
#
|
||||
# This is the virtual server referenced above by "dynamic_clients".
|
||||
server dynamic_clients {
|
||||
|
||||
#
|
||||
# The only contents of the virtual server is the "authorize" section.
|
||||
authorize {
|
||||
|
||||
#
|
||||
# Put any modules you want here. SQL, LDAP, "exec",
|
||||
# Perl, etc. The only requirements is that the
|
||||
# attributes MUST go into the control item list.
|
||||
#
|
||||
# The request that is processed through this section
|
||||
# is EMPTY. There are NO attributes. The request is fake,
|
||||
# and is NOT the packet that triggered the lookup of
|
||||
# the dynamic client.
|
||||
#
|
||||
# The ONLY piece of useful information is either
|
||||
#
|
||||
# Packet-Src-IP-Address (IPv4 clients)
|
||||
# Packet-Src-IPv6-Address (IPv6 clients)
|
||||
#
|
||||
# The attributes used to define a dynamic client mirror
|
||||
# the configuration items in the "client" structure.
|
||||
#
|
||||
|
||||
#
|
||||
# Example 1: Hard-code a client IP. This example is
|
||||
# useless, but it documents the attributes
|
||||
# you need.
|
||||
#
|
||||
if ("%{raw:NAS-Identifier}") {
|
||||
if ("%{sql: select count(*) from nas where shortname='%{raw:NAS-Identifier}'}" == 1) {
|
||||
update control {
|
||||
&FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}"
|
||||
&FreeRADIUS-Client-Require-MA = no
|
||||
&FreeRADIUS-Client-Secret = "%{sql: select nas.secret from nas where shortname='%{raw:NAS-Identifier}'}"
|
||||
&FreeRADIUS-Client-Shortname = "%{sql: select shortname from nas where shortname='%{raw:NAS-Identifier}'}"
|
||||
&FreeRADIUS-Client-NAS-Type = "other"
|
||||
}
|
||||
ok
|
||||
}
|
||||
else {
|
||||
rest
|
||||
}
|
||||
} else {
|
||||
reject
|
||||
}
|
||||
|
||||
#
|
||||
# Tell the caller that the client was defined properly.
|
||||
#
|
||||
# If the authorize section does NOT return "ok", then
|
||||
# the new client is ignored.
|
||||
ok
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user