##
## radiusd.conf	-- FreeRADIUS server configuration file.
##

prefix = /usr/local
exec_prefix = ${prefix}
sysconfdir = ${prefix}/etc
localstatedir = ${prefix}/var
sbindir = ${exec_prefix}/sbin
logdir = ${localstatedir}/log/radius
raddbdir = ${sysconfdir}/raddb
radacctdir = ${logdir}/radacct

confdir = ${raddbdir}
run_dir = ${localstatedir}/run/radiusd

log_file = ${logdir}/radius.log

libdir = ${exec_prefix}/lib

pidfile = ${run_dir}/radiusd.pid


max_request_time = 30

delete_blocked_requests = no

cleanup_delay = 5

max_requests = 1024

bind_address = *

#port = 0
port = 1645

hostname_lookups = no

allow_core_dumps = no

regular_expressions	= yes
extended_expressions	= yes

log_stripped_names = no

log_auth = yes

log_auth_badpass = yes
log_auth_goodpass = yes

usercollide = no

lower_user = no
lower_pass = no

nospace_user = no
nospace_pass = no

security {
	max_attributes = 200

	reject_delay = 1

	status_server = no
}

proxy_requests  = no
#$INCLUDE  ${confdir}/proxy.conf


$INCLUDE  ${confdir}/clients.conf


snmp	= no
$INCLUDE  ${confdir}/snmp.conf


thread pool {
	start_servers = 5

	max_servers = 32

	min_spare_servers = 3
	max_spare_servers = 10

	max_requests_per_server = 0
}

modules {
	pap {
		encryption_scheme = crypt
	}

	chap {
		authtype = CHAP
	}

	pam {
		pam_auth = radiusd
	}

	unix {
		cache = no

		cache_reload = 600

		radwtmp = ${logdir}/radwtmp
	}

	eap {
		default_eap_type = md5

		timer_expire     = 60

		ignore_unknown_eap_types = no

		md5 {
		}

		leap {
		}

		tls {
			private_key_password = <deleted>
			private_key_file = ${raddbdir}/certs/cert-srv.pem

			certificate_file = ${raddbdir}/certs/cert-srv.pem

			CA_file = ${raddbdir}/certs/demoCA/cacert.pem

			dh_file = ${raddbdir}/certs/dh
			random_file = ${raddbdir}/certs/random

			fragment_size = 1024

			include_length = yes

		#	check_crl = yes
		}

		#ttls {
		#	default_eap_type = md5

		#	copy_request_to_tunnel = no

		#	use_tunneled_reply = no			
			   
		#}

		 peap {
			default_eap_type = mschapv2
		}

		mschapv2 {
		}
	}

	mschap {
		authtype = MS-CHAP
		
		#	use_mppe = no

			require_encryption = yes

		#	require_strong = yes
	}

	ldap {
		server = "ldap.your.domain"
		# identity = "cn=admin,o=My Org,c=UA"
		# password = mypass
		basedn = "o=My Org,c=UA"
		filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
		# base_filter = "(objectclass=radiusprofile)"

		# set this to 'yes' to use TLS encrypted connections
		# to the LDAP database by using the StartTLS extended
		# operation.
		# The StartTLS operation is supposed to be used with normal
		# ldap connections instead of using ldaps (port 689) connections
		start_tls = no

		# tls_cacertfile	= /path/to/cacert.pem
		# tls_cacertdir		= /path/to/ca/dir/
		# tls_certfile		= /path/to/radius.crt
		# tls_keyfile		= /path/to/radius.key
		# tls_randfile		= /path/to/rnd
		# tls_require_cert	= "demand"

		# default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA"
		# profile_attribute = "radiusProfileDn"
		access_attr = "dialupAccess"

		# Mapping of RADIUS dictionary attributes to LDAP
		# directory attributes.
		dictionary_mapping = ${raddbdir}/ldap.attrmap

		ldap_connections_number = 5

		#
		# NOTICE: The password_header directive is NOT case insensitive
		#
		# password_header = "{clear}"
		#
		#  The server can usually figure this out on its own, and pull
		#  the correct User-Password or NT-Password from the database.
		#
		#  Note that NT-Passwords MUST be stored as a 32-digit hex
		#  string, and MUST start off with "0x", such as:
		#
		#	0x000102030405060708090a0b0c0d0e0f
		#
		#  Without the leading "0x", NT-Passwords will not work.
		#  This goes for NT-Passwords stored in SQL, too.
		#
		# password_attribute = userPassword
		# groupname_attribute = cn
		# groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"
		# groupmembership_attribute = radiusGroupName
		timeout = 4
		timelimit = 3
		net_timeout = 1
		# compare_check_items = yes
		# do_xlat = yes
		# access_attr_used_for_allow = yes
	}

	realm IPASS {
		format = prefix
		delimiter = "/"
	}

	#  'username@realm'
	#
	realm suffix {
		format = suffix
		delimiter = "@"
	}

	#  'username%realm'
	#
	realm realmpercent {
		format = suffix
		delimiter = "%"
	}
	
	preprocess {
		huntgroups = ${confdir}/huntgroups
		hints = ${confdir}/hints

		with_ascend_hack = no
		ascend_channels_per_line = 23

		with_ntdomain_hack = no

		with_specialix_jetstream_hack = no

		with_cisco_vsa_hack = no
	}

	files {
		usersfile = ${confdir}/users
		acctusersfile = ${confdir}/acct_users

		compat = no
	}

	detail {
		detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d

		detailperm = 0600
	}

	 detail auth_log {
		 detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d

		 detailperm = 0600
	 }

	 detail reply_log {
		 detailfile = ${radacctdir}/%{Client-IP-Address}/reply-detail-%Y%m%d

		 detailperm = 0600
	 }

	acct_unique {
		key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
	}


	$INCLUDE  ${confdir}/sql.conf

	radutmp {
		filename = ${logdir}/radutmp

		username = %{User-Name}

		case_sensitive = yes

		check_with_nas = yes		

		perm = 0600

		callerid = "yes"
	}

	radutmp sradutmp {
		filename = ${logdir}/sradutmp
		perm = 0644
		callerid = "no"
	}

	attr_filter {
		attrsfile = ${confdir}/attrs
	}

	counter daily {
		filename = ${raddbdir}/db.daily
		key = User-Name
		count-attribute = Acct-Session-Time
		reset = daily
		counter-name = Daily-Session-Time
		check-name = Max-Daily-Session
		allowed-servicetype = Framed-User
		cache-size = 5000
	}

	always fail {
		rcode = fail
	}
	always reject {
		rcode = reject
	}
	always ok {
		rcode = ok
		simulcount = 0
		mpp = no
	}

	expr {
	}

	digest {
	}

	exec {
		wait = yes
		input_pairs = request
	}

	exec echo {
		wait = yes

		program = "/bin/echo %{User-Name}"

		input_pairs = request

		output_pairs = reply

	}

	ippool main_pool {

		range-start = 192.168.1.1
		range-stop = 192.168.3.254

		netmask = 255.255.255.0

		cache-size = 800

		session-db = ${raddbdir}/db.ippool

		ip-index = ${raddbdir}/db.ipindex

		override = no
	}

	# ANSI X9.9 token support.  Not included by default.
	# $INCLUDE  ${confdir}/x99.conf

}

instantiate {
	exec

	expr

#	daily
}

authorize {
	preprocess

	auth_log
	
#	attr_filter

	chap

	mschap

#	digest

#	IPASS

	suffix

	eap

	files

#	sql

#	etc_smbpasswd

#	ldap

#	daily
}


authenticate {
	Auth-Type PAP {
		pap
	}

	Auth-Type CHAP {
		chap
	}

	Auth-Type MS-CHAP {
		mschap
	}

#	digest

#	pam

	unix

#	Auth-Type LDAP {
#		ldap
#	}

	eap
}


preacct {
	preprocess

#	IPASS
	suffix

	files
}

accounting {
	acct_unique

	detail
#	daily

	unix

	radutmp
#	sradutmp

#	main_pool

#	sql
}


session {
	radutmp

#	sql
}


post-auth {
#	main_pool

	reply_log

#	sql
}

pre-proxy {
#	attr_rewrite

#	pre_proxy_log
}

post-proxy {
#	post_proxy_log

#	attr_rewrite

#	attr_filter

	eap
}
