Re: Accounting assisstance

# -*- text -*-
##
## clients.conf -- client configuration directives
##
##	$Id: b1dfe966986b24ad7b6c05189a810751bf835fbb $

#######################################################################
#
#  Define RADIUS clients (usually a NAS, Access Point, etc.).

#
#  There are a number of security practices which are critical in the
#  modern era.
#
#  * don't use RADIUS/UDP or RADIUS/TCP over the Internet.  Use RADIUS/TLS.
#
#  * If you do send RADIUS over UDP or TCP, don't send MS-CHAPv2.
#    Anyone who can see the MS-CHAPv2 data can crack it in milliseconds.
#
#  * use the "radsecret" program to generate secrets.  It uses Perl (sorry).
#    Every time you run it, it will generate a new strong secret.
#
#  * don't create shared secrets yourself.  Anything you create is likely to
#    be in a "cracking" dictionary, and will allow a hobbyist attacker
#    to crack the shared secret in a few minutes.
#
#  * Don't trust anyone who tells you to ignore the above recommendations.
#

#
#  Defines a RADIUS client.
#
#  '127.0.0.1' is another name for 'localhost'.  It is enabled by default,
#  to allow testing of the server after an initial installation.  If you
#  are not going to be permitting RADIUS queries from localhost, we suggest
#  that you delete, or comment out, this entry.
#
#

#
#  Each client has a "short name" that is used to distinguish it from
#  other clients.
#
#  In version 1.x, the string after the word "client" was the IP
#  address of the client.  In 2.0, the IP address is configured via
#  the "ipaddr" or "ipv6addr" fields.  For compatibility, the 1.x
#  format is still accepted.
#
client localhost {
	#  Only *one* of ipaddr, ipv4addr, ipv6addr may be specified for
	#  a client.
	#
	#  ipaddr will accept IPv4 or IPv6 addresses with optional CIDR
	#  notation '/<mask>' to specify ranges.
	#
	#  ipaddr will accept domain names e.g. example.org resolving
	#  them via DNS.
	#
	#  If both A and AAAA records are found, A records will be
	#  used in preference to AAAA.
	ipaddr = 127.0.0.1

	#  Same as ipaddr but allows v4 addresses only. Requires A
	#  record for domain names.
#	ipv4addr = *	# any.  127.0.0.1 == localhost

	#  Same as ipaddr but allows v6 addresses only. Requires AAAA
	#  record for domain names.
#	ipv6addr = ::	# any.  ::1 == localhost

	#
	#  A note on DNS:  We STRONGLY recommend using IP addresses
	#  rather than host names.  Using host names means that the
	#  server will do DNS lookups when it starts, making it
	#  dependent on DNS.  i.e. If anything goes wrong with DNS,
	#  the server won't start!
	#
	#  The server also looks up the IP address from DNS once, and
	#  only once, when it starts.  If the DNS record is later
	#  updated, the server WILL NOT see that update.
	#

	#
	#  The transport protocol.
	#
	#  If unspecified, defaults to "udp", which is the traditional
	#  RADIUS transport.  It may also be "tcp", in which case the
	#  server will accept connections from this client ONLY over TCP.
	#
	proto = *

	#
	#  The shared secret use to "encrypt" and "sign" packets between
	#  the NAS and FreeRADIUS.  You MUST change this secret from the
	#  default, otherwise it's not a secret any more!
	#
	#  The secret can be any string, up to 8k characters in length.
	#
	#  Control codes can be entered vi octal encoding,
	#	e.g. "\101\102" == "AB"
	#  Quotation marks can be entered by escaping them,
	#	e.g. "foo\"bar"
	#
	#  A note on security: The security of the RADIUS protocol
	#  depends COMPLETELY on this secret!  We recommend using a
	#  shared secret that at LEAST 16 characters long.  It should
	#  preferably be 32 characters in length.  The secret MUST be
	#  random, and should not be words, phrase, or anything else
	#  that is recognisable.
	#
	#  Computing power has increased enormously since RADIUS was
	#  first defined.  A hobbyist with a high-end GPU can try ALL
	#  of the 8-character shared secrets in about a day.  The
	#  security of shared secrets increases MUCH more with the
	#  length of the shared secret, than with number of different
	#  characters used in it.  So don't bother trying to use
	#  "special characters" or anything else in an attempt to get
	#  un-guessable secrets.  Instead, just get data from a secure
	#  random number generator, and use that.
	#
	#  You should create shared secrets using a method like this:
	#
	#	dd if=/dev/random bs=1 count=24 | base64
	#
	#  This process will give output which takes 24 random bytes,
	#  and converts them to 32 characters of ASCII.  The output
	#  should be accepted by all RADIUS clients.
	#
	#  You should NOT create shared secrets by hand.  They will
	#  not be random.  They will will be trivial to crack.
	#
	#  The default secret below is only for testing, and should
	#  not be used in any real environment.
	#
	secret = <Removed>

	#
	#  The global configuration "security.require_message_authenticator"
	#  flag sets the default for all clients.  That default can be
	#  over-ridden here, by setting it to a value.  If no value is set,
	#  then the default from the "radiusd.conf" file is used.
	#
	#  See that file for full documentation on the flag, along
	#  with allowed values and meanings.
	#
	#  This flag exists solely for legacy clients which do not send
	#  Message-Authenticator in all Access-Request packets.  We do not
	#  recommend setting it to "no".
	#
	#  The number one way to protect yourself from the BlastRADIUS
	#  attack is to update all RADIUS servers, and then set this
	#  flag to "yes".  If all RADIUS servers are updated, and if
	#  all of them have this flag set to "yes" for all clients,
	#  then your network is safe.  You can then upgrade the
	#  clients when it is convenient, instead of rushing the
	#  upgrades.
	#
	#  allowed values: yes, no, auto
	#
#	require_message_authenticator = no

	#
	#  The global configuration "security.limit_proxy_state"
	#  flag sets the default for all clients.  That default can be
	#  over-ridden here, by setting it to "no".
	#
	#  See that file for full documentation on the flag, along
	#  with allowed values,and meanings.
	#
	#  This flag exists solely for legacy clients which do not send
	#  Message-Authenticator in all Access-Request packets.  We do not
	#  recommend setting it to "no".
	#
	#  allowed values: yes, no, auto
	#
#	limit_proxy_state = yes

	#
	#  The short name is used as an alias for the fully qualified
	#  domain name, or the IP address.
	#
	#  It is accepted for compatibility with 1.x, but it is no
	#  longer necessary in >= 2.0
	#
#	shortname = localhost

	#
	# the following three fields are optional, but may be used by
	# checkrad.pl for simultaneous use checks
	#

	#
	# The nas_type tells 'checkrad.pl' which NAS-specific method to
	#  use to query the NAS for simultaneous use.
	#
	#  Permitted NAS types are:
	#
	#	cisco
	#	computone
	#	livingston
	#	juniper
	#	max40xx
	#	multitech
	#	netserver
	#	pathras
	#	patton
	#	portslave
	#	tc
	#	usrhiper
	#	other		# for all other types

	#
	nas_type	 = cisco	# localhost isn't usually a NAS...

	#
	#  The following two configurations are for future use.
	#  The 'naspasswd' file is currently used to store the NAS
	#  login name and password, which is used by checkrad.pl
	#  when querying the NAS for simultaneous use.
	#
#	login	   = !root
#	password	= someadminpas

	#
	#  As of 2.0, clients can also be tied to a virtual server.
	#  This is done by setting the "virtual_server" configuration
	#  item, as in the example below.
	#
#	virtual_server = home1

	#
	#  A pointer to the "home_server_pool" OR a "home_server"
	#  section that contains the CoA configuration for this
	#  client.  For an example of a coa home server or pool,
	#  see raddb/sites-available/originate-coa
#	coa_server = coa

	#
	#  Response window for proxied packets.  If non-zero,
	#  then the lower of (home, client) response_window
	#  will be used.
	#
	#  i.e. it can be used to lower the response_window
	#  packets from one client to a home server.  It cannot
	#  be used to raise the response_window.
	#
#	response_window = 10.0

	#
	#  Connection limiting for clients using "proto = tcp".
	#
	#  This section is ignored for clients sending UDP traffic
	#
	limit {
		#
		#  Limit the number of simultaneous TCP connections from a client
		#
		#  The default is 16.
		#  Setting this to 0 means "no limit"
		max_connections = 16

		#  The per-socket "max_requests" option does not exist.

		#
		#  The lifetime, in seconds, of a TCP connection.  After
		#  this lifetime, the connection will be closed.
		#
		#  Setting this to 0 means "forever".
		lifetime = 0

		#
		#  The idle timeout, in seconds, of a TCP connection.
		#  If no packets have been received over the connection for
		#  this time, the connection will be closed.
		#
		#  In general, the client should close connections
		#  when they are idle.  This setting is here just to
		#  make sure that bad clients do not leave connections open for days.
		#
		#  If an idle timeout is set for only a "client" or a
		#  "listen" section, that timeout is used.
		#
		#  If an idle timeout is set for both a "client" and a
		#  "listen" section, then the smaller timeout is used.
		#
		#  Setting this to 0 means "no timeout".
		#
		#  We STRONGLY RECOMMEND that you set an idle timeout.
		#
		#  Systems with many incoming connections (500+) should
		#  set this value to a lower number.  There are only a
		#  limited number of usable file descriptors (usually
		#  1024) due to Posix API issues.  If many sockets are
		#  idle, it can prevent the server from opening new
		#  connections.
		#
		idle_timeout = 900
	}

	#
	#  TLS Configuration
	#
	#  A client can have TLS settings. The settings here are the
	#  settings used by the server when a client connects to it.
	#
	#  The TLS configuration for RADIUS/TLS clients is the same as
	#  the listener TLS configuration.  See sites-available/tls,
	#  and "listen { ... tls { ... } }" for examples of the server
	#  TLS configuration.
	#
#	tls {
#		...
#	}
}

# IPv6 Client
client localhost_ipv6 {
	ipv6addr	= ::1
	secret		= FreeRadiusSecret#1
}

# All IPv6 Site-local clients
#client sitelocal_ipv6 {
#	ipv6addr	= fe80::/16
#	secret		= testing123
#}

#client example.org {
#	ipaddr		= radius.example.org
#	secret		= testing123
#}

#
#  You can now specify one secret for a network of clients.
#  When a client request comes in, the BEST match is chosen.
#  i.e. The entry from the smallest possible network.
#
#client private-network-1 {
#	ipaddr		= 192.0.2.0/24
#	secret		= testing123-1
#}

#client private-network-2 {
#	ipaddr		= 198.51.100.0/24
#	secret		= testing123-2
#}

#######################################################################
#
#  Per-socket client lists.  The configuration entries are exactly
#  the same as above, but they are nested inside of a section.
#
#  You can have as many per-socket client lists as you have "listen"
#  sections, or you can re-use a list among multiple "listen" sections.
#
#  Un-comment this section, and edit a "listen" section to add:
#  "clients = per_socket_clients".  That IP address/port combination
#  will then accept ONLY the clients listed in this section.
#
#  There are additional considerations when using clients from SQL.
#
#  A client can be link to a virtual server via modules such as SQL.
#  This link is done via the following process:
#
#  If there is no listener in a virtual server, SQL clients are added
#  to the global list for that virtual server.
#
#  If there is a listener, and the first listener does not have a
#  "clients=..." configuration item, SQL clients are added to the
#  global list.
#
#  If there is a listener, and the first one does have a "clients=..."
#  configuration item, SQL clients are added to that list.  The client
#  { ...} ` configured in that list are also added for that listener.
#
#  The only issue is if you have multiple listeners in a virtual
#  server, each with a different client list, then the SQL clients are
#  added only to the first listener.
#
#clients per_socket_clients {
#	client socket_client {
#		ipaddr = 192.0.2.4
#		secret = testing123
#	}
#	}

client 10.0.0.0/8 {
ipv4addr = 10.0.0.0/8
secret = <Removed>
nastype = cisco
shortname = Butter.Net
}

# -*- text -*-
##
## radiusd.conf	-- FreeRADIUS server configuration file - 3.2.7
##
##	http://www.freeradius.org/
##	$Id: 376892e151857fa35c22662769acef3dcea08ecc $
##

######################################################################
#
#	The format of this (and other) configuration file is
#	documented in "man unlang".  There are also READMEs in many
#	subdirectories:
#
#	  raddb/README.rst
#		How to upgrade from v2.
#
#	  raddb/mods-available/README.rst
#		How to use mods-available / mods-enabled.
#		All of the modules are in individual files,
#		along with configuration items and full documentation.
#
#	  raddb/sites-available/README
#		virtual servers, "listen" sections, clients, etc.
#		The "sites-available" directory contains many
#		worked examples of common configurations.
#
#	  raddb/certs/README.md
#		How to create certificates for EAP or RadSec.
#
#	Every configuration item in the server is documented
#	extensively in the comments in the example configuration
#	files.
#
#	Before editing this (or any other) configuration file, PLEASE
#	read "man radiusd".  See the section titled DEBUGGING.  It
#	outlines a method where you can quickly create the
#	configuration you want, with minimal effort.
#
#	Run the server in debugging mode, and READ the output.
#
#		$ radiusd -X
#
#	We cannot emphasize this point strongly enough.  The vast
#	majority of problems can be solved by carefully reading the
#	debugging output, which includes warnings about common issues,
#	and suggestions for how they may be fixed.
#
#	There may be a lot of output, but look carefully for words like:
#	"warning", "error", "reject", or "failure".  The messages there
#	will usually be enough to guide you to a solution.
#
#	More documentation on "radiusd -X" is available on the wiki:
#		https://wiki.freeradius.org/radiusd-X
#
#	If you are going to ask a question on the mailing list, then
#	explain what you are trying to do, and include the output from
#	debugging mode (radiusd -X).  Failure to do so means that all
#	of the responses to your question will be people telling you
#	to "post the output of radiusd -X".
#
#	Guidelines for posting to the mailing list are on the wiki:
#		https://wiki.freeradius.org/list-help
#
#	Please read those guidelines before posting to the list.
#
#	Further documentation is available in the "doc" directory
#	of the server distribution, or on the wiki at:
#		https://wiki.freeradius.org/
#
#	New users to RADIUS should read the Technical Guide.  That guide
#	explains how RADIUS works, how FreeRADIUS works, and what each
#	part of a RADIUS system does.  It is not just "configure FreeRADIUS"!
#		https://networkradius.com/doc/FreeRADIUS-Technical-Guide.pdf
#
#	More documentation on dictionaries, modules, unlang, etc. is also
#	available on the Network RADIUS web site:
#		https://networkradius.com/freeradius-documentation/
#

######################################################################

# Define Listening socket
listen {
	ipv4addr = 10.0.0.1,
	port = 1812,
	type = auth
}

#listen {
#	ipv4addr =  127.0.0.1,
#	port = 1812,
#	type = auth
#}

listen {
	ipv4addr = 10.0.0.1,
	port = 1813,
	type = acct
}

#listen {
#	ipv4addr = 127.0.0.1,
#	port 1813,
#	type = acct
#}



# bind_address = 192.168.1.250 port = 1817

prefix = /usr
exec_prefix = /usr
sysconfdir = /etc
localstatedir = /var
sbindir = ${exec_prefix}/sbin
logdir = /var/log/freeradius
raddbdir = /etc/freeradius/3.0
radacctdir = ${logdir}/radacct

#
#  name of the running server.  See also the "-n" command-line option.
name = freeradius

#  Location of config and logfiles.
confdir = ${raddbdir}
modconfdir = ${confdir}/mods-config
certdir = ${confdir}/certs
cadir   = ${confdir}/certs
run_dir = ${localstatedir}/run/${name}

# Should likely be ${localstatedir}/lib/radiusd
db_dir = ${raddbdir}

#
# libdir: Where to find the rlm_* modules.
#
#   This should be automatically set at configuration time.
#
#   If the server builds and installs, but fails at execution time
#   with an 'undefined symbol' error, then you can use the libdir
#   directive to work around the problem.
#
#   The cause is usually that a library has been installed on your
#   system in a place where the dynamic linker CANNOT find it.  When
#   executing as root (or another user), your personal environment MAY
#   be set up to allow the dynamic linker to find the library.  When
#   executing as a daemon, FreeRADIUS MAY NOT have the same
#   personalized configuration.
#
#   To work around the problem, find out which library contains that symbol,
#   and add the directory containing that library to the end of 'libdir',
#   with a colon separating the directory names.  NO spaces are allowed.
#
#   e.g. libdir = /usr/local/lib:/opt/package/lib
#
#   You can also try setting the LD_LIBRARY_PATH environment variable
#   in a script which starts the server.
#
#   If that does not work, then you can re-configure and re-build the
#   server to NOT use shared libraries, via:
#
#	./configure --disable-shared
#	make
#	make install
#
libdir = /usr/lib/freeradius

#  pidfile: Where to place the PID of the RADIUS server.
#
#  The server may be signalled while it's running by using this
#  file.
#
#  This file is written when ONLY running in daemon mode.
#
#  e.g.:  kill -HUP `cat /var/run/radiusd/radiusd.pid`
#
pidfile = ${run_dir}/${name}.pid

#  panic_action: Command to execute if the server dies unexpectedly.
#
#  FOR PRODUCTION SYSTEMS, ACTIONS SHOULD ALWAYS EXIT.
#  AN INTERACTIVE ACTION MEANS THE SERVER IS NOT RESPONDING TO REQUESTS.
#  AN INTERACTICE ACTION MEANS THE SERVER WILL NOT RESTART.
#
#  THE SERVER MUST NOT BE ALLOWED EXECUTE UNTRUSTED PANIC ACTION CODE
#  PATTACH CAN BE USED AS AN ATTACK VECTOR.
#
#  The panic action is a command which will be executed if the server
#  receives a fatal, non user generated signal, i.e. SIGSEGV, SIGBUS,
#  SIGABRT or SIGFPE.
#
#  This can be used to start an interactive debugging session so
#  that information regarding the current state of the server can
#  be acquired.
#
#  The following string substitutions are available:
#  - %e   The currently executing program e.g. /sbin/radiusd
#  - %p   The PID of the currently executing program e.g. 12345
#
#  Standard ${} substitutions are also allowed.
#
#  An example panic action for opening an interactive session in GDB would be:
#
#panic_action = "gdb %e %p"
#
#  Again, don't use that on a production system.
#
#  An example panic action for opening an automated session in GDB would be:
#
#panic_action = "gdb -silent -x ${raddbdir}/panic.gdb %e %p 2>&1 | tee ${logdir}/gdb-${name}-%p.log"
#
#  That command can be used on a production system.
#

#  max_request_time: The maximum time (in seconds) to handle a request.
#
#  Requests which take more time than this to process may be killed, and
#  a REJECT message is returned.
#
#  WARNING: If you notice that requests take a long time to be handled,
#  then this MAY INDICATE a bug in the server, in one of the modules
#  used to handle a request, OR in your local configuration.
#
#  This problem is most often seen when using an SQL database.  If it takes
#  more than a second or two to receive an answer from the SQL database,
#  then it probably means that you haven't indexed the database.  See your
#  SQL server documentation for more information.
#
#  Useful range of values: 5 to 120
#
max_request_time = 30

#  cleanup_delay: The time to wait (in seconds) before cleaning up
#  a reply which was sent to the NAS.
#
#  The RADIUS request is normally cached internally for a short period
#  of time, after the reply is sent to the NAS.  The reply packet may be
#  lost in the network, and the NAS will not see it.  The NAS will then
#  re-send the request, and the server will respond quickly with the
#  cached reply.
#
#  If this value is set too low, then duplicate requests from the NAS
#  MAY NOT be detected, and will instead be handled as separate requests.
#
#  If this value is set too high, then the server will cache too many
#  requests, and some new requests may get blocked.  (See 'max_requests'.)
#
#  Useful range of values: 2 to 30
#
cleanup_delay = 5

#  max_requests: The maximum number of requests which the server keeps
#  track of.  This should be 256 multiplied by the number of clients.
#  e.g. With 4 clients, this number should be 1024.
#
#  If this number is too low, then when the server becomes busy,
#  it will not respond to any new requests, until the 'cleanup_delay'
#  time has passed, and it has removed the old requests.
#
#  If this number is set too high, then the server will use a bit more
#  memory for no real benefit.
#
#  If you aren't sure what it should be set to, it's better to set it
#  too high than too low.  Setting it to 1000 per client is probably
#  the highest it should be.
#
#  Useful range of values: 256 to infinity
#
max_requests = 16384

#  hostname_lookups: Log the names of clients or just their IP addresses
#  e.g., www.freeradius.org (on) or 206.47.27.232 (off).
#
#  The default is 'off' because it would be overall better for the net
#  if people had to knowingly turn this feature on, since enabling it
#  means that each client request will result in AT LEAST one lookup
#  request to the nameserver.   Enabling hostname_lookups will also
#  mean that your server may stop randomly for 30 seconds from time
#  to time, if the DNS requests take too long.
#
#  Turning hostname lookups off also means that the server won't block
#  for 30 seconds, if it sees an IP address which has no name associated
#  with it.
#
#  allowed values: {no, yes}
#
hostname_lookups = no

#
#  Run a "Post-Auth-Type Client-Lost" section.  This ONLY happens when
#  the server sends an Access-Challenge, and then client does not
#  respond to it.  The goal is to allow administrators to log
#  something when the client does not respond.
#
#  See sites-available/default, "Post-Auth-Type Client-Lost" for more
#  information.
#
#postauth_client_lost = no

#
#  Some NASes will aggressively retransmit packets, and cause a DoS of
#  the RADIUS infrastructure.  They should follow he recommended
#  retransmission behavior of RFC 5080 Section 2.2.2, but it seems
#  that only (some) RADIUS servers follow that guidance.
#
#  When a duplicate packet is received from the NAS, the server will
#  see when the last retransmission was done.  If it is within the
#  "proxy_dedup_window", the retransmitted packet is dropped.
#
#  i.e. There is zero benefit to sending the same RADIUS packet
#  multiple times in one second.  There is, in fact, serious harm
#  in doing so.  Aggressive retransmissions can result in network
#  congestion, and ultimately failure of the RADIUS infrastructure.
#
#  This behavior *cannot* be disabled.
#
#  Allowed values here are 1..10.  Only integers are supported.
#
#proxy_dedup_window = 1

#
#  Unlang behavior options
#
unlang {
	#
	#  By default, the "return" keyword will cause the current process
	#  section to complete.  These two options allow "return" to be
	#  used to just exit "group" sections or "policy" sections
	#
	#  Setting this to yes, will cause "return" within a group to
	#  exit the group but continue processing after that.
	#
#	group_stop_return = no

	#
	#  Setting this to yes, will cause "return" within a policy to
	#  exit the policy but continue processing after that.
	#
#	policy_stop_return = no
}

#
#  Logging section.  The various "log_*" configuration items
#  will eventually be moved here.
#
log {
	#
	#  Destination for log messages.  This can be one of:
	#
	#	files - log to "file", as defined below.
	#	syslog - to syslog (see also the "syslog_facility", below.
	#	stdout - standard output
	#	stderr - standard error.
	#
	#  The command-line option "-X" over-rides this option, and forces
	#  logging to go to stdout.
	#
	destination = files

	#
	#  Highlight important messages sent to stderr and stdout.
	#
	#  Option will be ignored (disabled) if output if TERM is not
	#  an xterm or output is not to a TTY.
	#
	colourise = yes

	#
	#  The logging messages for the server are appended to the
	#  tail of this file if destination == "files"
	#
	#  If the server is running in debugging mode, this file is
	#  NOT used.
	#
	file = ${logdir}/radius.log

	#
	#  Which syslog facility to use, if ${destination} == "syslog"
	#
	#  The exact values permitted here are OS-dependent.  You probably
	#  don't want to change this.
	#
	syslog_facility = daemon

	#  Log the full User-Name attribute, as it was found in the request.
	#
	# allowed values: {no, yes}
	#
	stripped_names = no

	#  Log all (accept and reject) authentication results to the log file.
	#
	#  This is the same as setting "auth_accept = yes" and
	#  "auth_reject = yes"
	#
	#  allowed values: {no, yes}
	#
	auth = no

	#  Log Access-Accept results to the log file.
	#
	#  This is only used if "auth = no"
	#
	#  allowed values: {no, yes}
	#
#	auth_accept = no

	#  Log Access-Reject results to the log file.
	#
	#  This is only used if "auth = no"
	#
	#  allowed values: {no, yes}
	#
#	auth_reject = no

	#  Log passwords with the authentication requests.
	#  auth_badpass  - logs password if it's rejected
	#  auth_goodpass - logs password if it's correct
	#
	#  allowed values: {no, yes}
	#
	auth_badpass = no
	auth_goodpass = no

	#  Log additional text at the end of the "Login OK" messages.
	#  for these to work, the "auth" and "auth_goodpass" or "auth_badpass"
	#  configurations above have to be set to "yes".
	#
	#  The strings below are dynamically expanded, which means that
	#  you can put anything you want in them.  However, note that
	#  this expansion can be slow, and can negatively impact server
	#  performance.
	#
#	msg_goodpass = ""
#	msg_badpass = ""

	#  The message when the user exceeds the Simultaneous-Use limit.
	#
	msg_denied = "You are already logged in - access denied"

	#  Suppress "secret" attributes when printing them in debug mode.
	#
	#  Secrets are NOT tracked across xlat expansions.  If your
	#  configuration puts secrets into other strings, they will
	#  still get printed.
	#
	#  Setting this to "yes" means that the server prints
	#
	#	<<< secret >>>
	#
	#  instead of the value, for attriburtes which contain secret
	#  information.  e.g. User-Name, Tunnel-Password, etc.
	#
	#  This configuration is disabled by default.  It is extremely
	#  important for administrators to be able to debug user logins
	#  by seeing what is actually being sent.
	#
#	suppress_secrets = no
}

#  The program to execute to do concurrency checks.
checkrad = ${sbindir}/checkrad

#
#  ENVIRONMENT VARIABLES
#
#  You can reference environment variables using an expansion like
#  `$ENV{PATH}`.  However it is sometimes useful to be able to also set
#  environment variables.  This section lets you do that.
#
#  The main purpose of this section is to allow administrators to keep
#  RADIUS-specific configuration in the RADIUS configuration files.
#  For example, if you need to set an environment variable which is
#  used by a module.  You could put that variable into a shell script,
#  but that's awkward.  Instead, just list it here.
#
#  Note that these environment variables are set AFTER the
#  configuration file is loaded.  So you cannot set FOO here, and
#  expect to reference it via `$ENV{FOO}` in another configuration file.
#  You should instead just use a normal configuration variable for
#  that.
#
ENV {
	#
	#  Set environment varable `FOO` to value '/bar/baz'.
	#
	#  NOTE: Note that you MUST use '='.  You CANNOT use '+=' to append
	#  values.
	#
#	FOO = '/bar/baz'

	#
	#  Delete environment variable `BAR`.
	#
#	BAR


	#
	#  If the server needs kerberos credentials, then they can be placed
	#  into the following keytab file.
	#
	#  This also permits the server to use those credentials when it is
	#  run in debug mode.
	#
#	KRB5_CLIENT_KTNAME = ${raddbdir}/radiusd.keytab

	#
	#  `LD_PRELOAD` is special.  It is normally set before the
	#  application runs, and is interpreted by the dynamic linker.
	#  Which means you cannot set it inside of an application, and
	#  expect it to load libraries.
	#
	#  Since this functionality is useful, we extend it here.
	#
	#  You can set
	#
	#  LD_PRELOAD = /path/to/library.so
	#
	#  and the server will load the named libraries.  Multiple
	#  libraries can be loaded by specificing multiple individual
	#  `LD_PRELOAD` entries.
	#
	#
#	LD_PRELOAD = /path/to/library1.so
#	LD_PRELOAD = /path/to/library2.so
}

# SECURITY CONFIGURATION
#
#  There may be multiple methods of attacking on the server.  This
#  section holds the configuration items which minimize the impact
#  of those attacks
#
security {
	#  chroot: directory where the server does "chroot".
	#
	#  The chroot is done very early in the process of starting
	#  the server.  After the chroot has been performed it
	#  switches to the "user" listed below (which MUST be
	#  specified).  If "group" is specified, it switches to that
	#  group, too.  Any other groups listed for the specified
	#  "user" in "/etc/group" are also added as part of this
	#  process.
	#
	#  The current working directory (chdir / cd) is left
	#  *outside* of the chroot until all of the modules have been
	#  initialized.  This allows the "raddb" directory to be left
	#  outside of the chroot.  Once the modules have been
	#  initialized, it does a "chdir" to ${logdir}.  This means
	#  that it should be impossible to break out of the chroot.
	#
	#  If you are worried about security issues related to this
	#  use of chdir, then simply ensure that the "raddb" directory
	#  is inside of the chroot, and be sure to do "cd raddb"
	#  BEFORE starting the server.
	#
	#  If the server is statically linked, then the only files
	#  that have to exist in the chroot are ${run_dir} and
	#  ${logdir}.  If you do the "cd raddb" as discussed above,
	#  then the "raddb" directory has to be inside of the chroot
	#  directory, too.
	#
#	chroot = /path/to/chroot/directory

	# user/group: The name (or #number) of the user/group to run radiusd as.
	#
	#   If these are commented out, the server will run as the
	#   user/group that started it.  In order to change to a
	#   different user/group, you MUST be root ( or have root
	#   privileges ) to start the server.
	#
	#   We STRONGLY recommend that you run the server with as few
	#   permissions as possible.  That is, if you're not using
	#   shadow passwords, the user and group items below should be
	#   set to radius'.
	#
	#  NOTE that some kernels refuse to setgid(group) when the
	#  value of (unsigned)group is above 60000; don't use group
	#  "nobody" on these systems!
	#
	#  On systems with shadow passwords, you might have to set
	#  'group = shadow' for the server to be able to read the
	#  shadow password file.  If you can authenticate users while
	#  in debug mode, but not in daemon mode, it may be that the
	#  debugging mode server is running as a user that can read
	#  the shadow info, and the user listed below can not.
	#
	#  The server will also try to use "initgroups" to read
	#  /etc/groups.  It will join all groups where "user" is a
	#  member.  This can allow for some finer-grained access
	#  controls.
	#
	user = freerad
	group = freerad

	#  Core dumps are a bad thing.  This should only be set to
	#  'yes' if you're debugging a problem with the server.
	#
	#  allowed values: {no, yes}
	#
	allow_core_dumps = no

	#
	#  max_attributes: The maximum number of attributes
	#  permitted in a RADIUS packet.  Packets which have MORE
	#  than this number of attributes in them will be dropped.
	#
	#  If this number is set too low, then no RADIUS packets
	#  will be accepted.
	#
	#  If this number is set too high, then an attacker may be
	#  able to send a small number of packets which will cause
	#  the server to use all available memory on the machine.
	#
	#  Setting this number to 0 means "allow any number of attributes"
	max_attributes = 200

	#
	#  reject_delay: When sending an Access-Reject, it can be
	#  delayed for a few seconds.  This may help slow down a DoS
	#  attack.  It also helps to slow down people trying to brute-force
	#  crack a users password.
	#
	#  Setting this number to 0 means "send rejects immediately"
	#
	#  If this number is set higher than 'cleanup_delay', then the
	#  rejects will be sent at 'cleanup_delay' time, when the request
	#  is deleted from the internal cache of requests.
	#
	#  This number can be a decimal, e.g. 3.4
	#
	#  Useful ranges: 1 to 5
	reject_delay = 1

	#
	#  status_server: Whether or not the server will respond
	#  to Status-Server requests.
	#
	#  When sent a Status-Server message, the server responds with
	#  an Access-Accept or Accounting-Response packet.
	#
	#  This is mainly useful for administrators who want to "ping"
	#  the server, without adding test users, or creating fake
	#  accounting packets.
	#
	#  It's also useful when a NAS marks a RADIUS server "dead".
	#  The NAS can periodically "ping" the server with a Status-Server
	#  packet.  If the server responds, it must be alive, and the
	#  NAS can start using it for real requests.
	#
	#  See also raddb/sites-available/status
	#
	status_server = yes

	#
	#  Global configuration for requiring Message-Authenticator in
	#  all Access-* packets sent over UDP or TCP.  This flag is
	#  ignored for TLS.
	#
	#  The number one way to protect yourself from the BlastRADIUS
	#  attack is to update all RADIUS servers, and then set this
	#  flag to "yes".  If all RADIUS servers are updated, and if
	#  all of them have this flag set to "yes" for all clients,
	#  then your network is safe.  You can then upgrade the
	#  clients when it is convenient, instead of rushing the
	#  upgrades.
	#
	#  This flag sets the global default for all clients and home
	#  servers.  It can be over-ridden in an individual client or
	#  home_server definition by adding the same flag to that
	#  section with an appropriate value.
	#
	#  All upgraded RADIUS implementations should send
	#  Message-Authenticator in all Access-Request, Access-Accept,
	#  Access-Reject, and Access-Challenge packets.  Once all
	#  systems are upgraded, setting this flag to "yes" is the
	#  best protection from the attack.
	#
	#  The possible values and meanings for
	#  "require_message_authenticator" are;
	#
	#  * "no" - allow Access-* packet which do not contain
	#    Message-Authenticator
	#
	#    For a client, if this flag is set to "no", then the
	#    "limit_proxy_state" flag, below, is also checked.
	#
	#    For a home_server, if this flag is set to "no", then the
	#    Access-Accept, Access-Reject, and Access-Challenge
	#    packets do not need to contain Message-Authenticator.
	#
	#    The only reason to set this flag to "no" is when the
	#    RADIUS client or home server has not been updated.  It is
	#    always safer to set this flag "no" in the individual
	#    client or home_server definition.  The global flag SHOULD
	#    still be set to a safe value: "yes".
	#
	#    WARNING: Setting this flag and the "limit_proxy_state"
	#    flag to "no" will allow MITM attackers to create fake
	#    Access-Accept packets to the NAS!  At least one of them
	#    MUST be set to "yes" for the system to have any
	#    protection against the attack.
	#
	#  * "yes" - Require that all Access-* packets (client and
	#    home_server) contain Message-Authenticator.  If a packet
	#    does not contain Message-Authenticator, then it is
	#    discarded.
	#
	#  * "auto" - Automatically determine the value of the flag,
	#    based on the first packet received from that client or
	#    home_server.
	#
	#    If the packet does not contain Message-Authenticator,
	#    then the value of the flag is automatically switched to
	#    "no".
	#
	#    If the packet contains Message-Authenticator but not
	#    EAP-Message, then the value of the flag is automatically
	#    switched to "yes".  The server has to check for
	#    EAP-Message, because the previous RFCs require that the
	#    packet contains Message-Authenticator when it also
	#    contains EAP-Message.  So having a Message-Authenticator
	#    in those packets doesn't give the server enough
	#    information to determined if the client or home_server
	#    has been updated.
	#
	#    If the packet contains Message-Authenticator and
	#    EAP-Message, then the flag is left at the "auto" value.
	#
	#    WARNING: This switch is done for the first packet
	#    received from that client or home server.  The change
	#    does NOT persist across server restarts.  You MUST change
	#    the to "yes" manually, in order to make a permanent
	#    change to the configuration.
	#
	#    WARNING: If there are multiple NASes with the same source
	#    IP and client definitions, BUT the NASes have different
	#    behavior, then this flag WILL LIKELY BREAK YOUR NETWORK.
	#
	#    That is, when there are multiple different RADIUS clients
	#    behind one NATed IP address, then these security settings
	#    have to be set to allow the MOST INSECURE packets to be
	#    processed.  This is a terrible idea, and will leave your
	#    network vulnerable to the attack.  Please upgrade all
	#    clients immediately.
	#
	#    The only solution to that rare configuration is to set
	#    this flag to "no", in which case the network will work,
	#    but will be vulnerable to the attack.
	#
	require_message_authenticator = auto

	#
	#  Global configuration for limiting the combination of
	#  Proxy-State and Message-Authenticator.  This flag only
	#  applies to Access-Request packets sent from a client, over
	#  UDP or TCP.  This flag is ignored for TLS.
	#
	#  This flag sets the global default for all clients.  It can
	#  be over-ridden in an individual client definition by adding
	#  the same flag to that section with an appropriate value.
	#
	#  If "require_message_authenticator" is set to "yes", this
	#  configuration item is ignored.
	#
	#  If "require_message_authenticator" is set to "no", this
	#  configuration item is checked.
	#
	#  The possible values and meanings for "limit_proxy_state" are;
	#
	#  * "no" - allow any Access-Request packets from the client,
	#    even packets which contain the BlastRADIUS attack.
	#    Please be aware that in this configuration the server
	#    will complain for EVERY packet which it receives.
	#
	#    The only reason to set this flag to "no" is when the
	#    client is a proxy, AND it does not send
	#    Message-Authenticator in Access-Request packets.  Even
	#    then, the best approach to fix the issue is to (1) update
	#    the proxy to send Message-Authenticator, and if that
	#    can't be done, then (2) set this flag to "no", but ONLY
	#    for that one client.  The global flag SHOULD still be set
	#    to a safe value: "yes".
	#
	#    WARNING: Setting both this flag and the
	#    "require_message_authenticator" flag to "no" will allow
	#    MITM attackers to spoof Access-Request packets, and then
	#    to create fake Access-Accept packets to the NAS!  At
	#    least one of these configuration items MUST be set to
	#    "yes" for the system to have any protection against the
	#    attack.
	#
	#  * "yes" - Allow Access-Request packets without
	#    Message-Authenticator, but only when they do not contain
	#    Proxy-State.  Packets which contain Proxy-State MUST also
	#    contain Message-Authenticator, otherwise they are
	#    discarded.
	#
	#    This setting is safe for most NASes, GGSNs, BRAS, etc.
	#    Most regular RADIUS clients do not send Proxy-State
	#    attributes for Access-Request packets that they originate.
	#    However some aggregators (e.g. Wireless LAN Controllers)
	#    may act as a RADIUS proxy for requests from their cohort
	#    of managed devices, and in such cases will provide a
	#    Proxy-State attribute. For those systems, you _must_ look
	#    at the actual packets to determine what to do. It may be
	#    that the only way to fix the vulnerability is to upgrade
	#    the WLC, and set "require_message_authenticator" to "yes".
	#
	#  * "auto" - Automatically determine the value of the flag,
	#    based on the first Access-Request packet received from
	#    that client.
	#
	#    If the packet contains Proxy-State but no
	#    Message-Authenticator, then the value of the flag is
	#    automatically switched to "no".
	#
	#    For all other situations, the value of the flag is
	#    automatically switched to "yes".
	#
	#    WARNING: This switch is done for the first packet
	#    received from that client.  The change does NOT persist
	#    across server restarts.  You MUST change the to "yes"
	#    manually, in order to make a permanent change to the
	#    configuration.
	#
	#    WARNING: If there are multiple NASes with the same source
	#    IP and client definitions, BUT the NASes have different
	#    behavior, then this flag WILL LIKELY BREAK YOUR NETWORK.
	#
	#    That is, when there are multiple different RADIUS clients
	#    behind one NATed IP address, then these security settings
	#    have to be set to allow the MOST INSECURE packets to be
	#    processed.  This is a terrible idea, and will leave your
	#    network vulnerable to the attack.  Please upgrade all
	#    clients immediately.
	#
	#    The only solution to that rare configuration is to set
	#    this flag to "no", in which case the network will work,
	#    but will be vulnerable to the attack.
	#
	limit_proxy_state = auto


}

# PROXY CONFIGURATION
#
#  proxy_requests: Turns proxying of RADIUS requests on or off.
#
#  The server has proxying turned on by default.  If your system is NOT
#  set up to proxy requests to another server, then you can turn proxying
#  off here.  This will save a small amount of resources on the server.
#
#  If you have proxying turned off, and your configuration files say
#  to proxy a request, then an error message will be logged.
#
#  To disable proxying, change the "yes" to "no", and comment the
#  $INCLUDE line.
#
#  allowed values: {no, yes}
#
proxy_requests  = yes
$INCLUDE proxy.conf


# CLIENTS CONFIGURATION
#
#  Client configuration is defined in "clients.conf".
#

#  The 'clients.conf' file contains all of the information from the old
#  'clients' and 'naslist' configuration files.  We recommend that you
#  do NOT use 'client's or 'naslist', although they are still
#  supported.
#
#  Anything listed in 'clients.conf' will take precedence over the
#  information from the old-style configuration files.
#
$INCLUDE clients.conf


# THREAD POOL CONFIGURATION
#
#  The thread pool is a long-lived group of threads which
#  take turns (round-robin) handling any incoming requests.
#
#  You probably want to have a few spare threads around,
#  so that high-load situations can be handled immediately.  If you
#  don't have any spare threads, then the request handling will
#  be delayed while a new thread is created, and added to the pool.
#
#  You probably don't want too many spare threads around,
#  otherwise they'll be sitting there taking up resources, and
#  not doing anything productive.
#
#  The numbers given below should be adequate for most situations.
#
thread pool {
	#  Number of servers to start initially --- should be a reasonable
	#  ballpark figure.
	start_servers = 5

	#  Limit on the total number of servers running.
	#
	#  If this limit is ever reached, clients will be LOCKED OUT, so it
	#  should NOT BE SET TOO LOW.  It is intended mainly as a brake to
	#  keep a runaway server from taking the system with it as it spirals
	#  down...
	#
	#  You may find that the server is regularly reaching the
	#  'max_servers' number of threads, and that increasing
	#  'max_servers' doesn't seem to make much difference.
	#
	#  If this is the case, then the problem is MOST LIKELY that
	#  your back-end databases are taking too long to respond, and
	#  are preventing the server from responding in a timely manner.
	#
	#  The solution is NOT do keep increasing the 'max_servers'
	#  value, but instead to fix the underlying cause of the
	#  problem: slow database, or 'hostname_lookups=yes'.
	#
	#  For more information, see 'max_request_time', above.
	#
	max_servers = 32

	#  Server-pool size regulation.  Rather than making you guess
	#  how many servers you need, FreeRADIUS dynamically adapts to
	#  the load it sees, that is, it tries to maintain enough
	#  servers to handle the current load, plus a few spare
	#  servers to handle transient load spikes.
	#
	#  It does this by periodically checking how many servers are
	#  waiting for a request.  If there are fewer than
	#  min_spare_servers, it creates a new spare.  If there are
	#  more than max_spare_servers, some of the spares die off.
	#  The default values are probably OK for most sites.
	#
	min_spare_servers = 3
	max_spare_servers = 10

	#  When the server receives a packet, it places it onto an
	#  internal queue, where the worker threads (configured above)
	#  pick it up for processing.  The maximum size of that queue
	#  is given here.
	#
	#  When the queue is full, any new packets will be silently
	#  discarded.
	#
	#  The most common cause of the queue being full is that the
	#  server is dependent on a slow database, and it has received
	#  a large "spike" of traffic.  When that happens, there is
	#  very little you can do other than make sure the server
	#  receives less traffic, or make sure that the database can
	#  handle the load.
	#
#	max_queue_size = 65536

	#  Clean up old threads periodically.  For no reason other than
	#  it might be useful.
	#
	#  '0' is a special value meaning 'infinity', or 'the servers never
	#  exit'
	max_requests_per_server = 0

	#  Automatically limit the number of accounting requests.
	#  This configuration item tracks how many requests per second
	#  the server can handle.  It does this by tracking the
	#  packets/s received by the server for processing, and
	#  comparing that to the packets/s handled by the child
	#  threads.
	#

	#  If the received PPS is larger than the processed PPS, *and*
	#  the queue is more than half full, then new accounting
	#  requests are probabilistically discarded.  This lowers the
	#  number of packets that the server needs to process.  Over
	#  time, the server will "catch up" with the traffic.
	#
	#  Throwing away accounting packets is usually safe and low
	#  impact.  The NAS will retransmit them in a few seconds, or
	#  even a few minutes.  Vendors should read RFC 5080 Section 2.2.1
	#  to see how accounting packets should be retransmitted.  Using
	#  any other method is likely to cause network meltdowns.
	#
	auto_limit_acct = no
}

######################################################################
#
#  SNMP notifications.  Uncomment the following line to enable
#  snmptraps.  Note that you MUST also configure the full path
#  to the "snmptrap" command in the "trigger.conf" file.
#
#$INCLUDE trigger.conf

# MODULE CONFIGURATION
#
#  The names and configuration of each module is located in this section.
#
#  After the modules are defined here, they may be referred to by name,
#  in other sections of this configuration file.
#
modules {
	#
	#  Each module has a configuration as follows:
	#
	#	name [ instance ] {
	#		config_item = value
	#		...
	#	}
	#
	#  The 'name' is used to load the 'rlm_name' library
	#  which implements the functionality of the module.
	#
	#  The 'instance' is optional.  To have two different instances
	#  of a module, it first must be referred to by 'name'.
	#  The different copies of the module are then created by
	#  inventing two 'instance' names, e.g. 'instance1' and 'instance2'
	#
	#  The instance names can then be used in later configuration
	#  INSTEAD of the original 'name'.  See the 'radutmp' configuration
	#  for an example.
	#

	#
	#  Some modules have ordering issues.  e.g. "sqlippool" uses
	#  the configuration from "sql".  In that case, the "sql"
	#  module must be read off of disk before the "sqlippool".
	#  However, the directory inclusion below just reads the
	#  directory from start to finish.  Which means that the
	#  modules are read off of disk randomly.
	#
	#  You can list individual modules *before* the directory
	#  inclusion.  Those modules will be loaded first.  Then, when
	#  the directory is read, those modules will be skipped and
	#  not read twice.
	#
#	$INCLUDE mods-enabled/sql

	#
	#  All modules are in ther mods-enabled/ directory.  Files
	#  matching the regex /[a-zA-Z0-9_.]+/ are read.  The
	#  modules are initialized ONLY if they are referenced in a
	#  processing section, such as authorize, authenticate,
	#  accounting, pre/post-proxy, etc.
	#
	$INCLUDE mods-enabled/
}

# Instantiation
#
#  This section sets the instantiation order of the modules.  listed
#  here will get started up BEFORE the sections like authorize,
#  authenticate, etc. get examined.
#
#  This section is not strictly needed.  When a section like authorize
#  refers to a module, the module is automatically loaded and
#  initialized.  However, some modules may not be listed in any of the
#  processing sections, so they should be listed here.
#
#  Also, listing modules here ensures that you have control over
#  the order in which they are initialized.  If one module needs
#  something defined by another module, you can list them in order
#  here, and ensure that the configuration will be OK.
#
#  After the modules listed here have been loaded, all of the modules
#  in the "mods-enabled" directory will be loaded.  Loading the
#  "mods-enabled" directory means that unlike Version 2, you usually
#  don't need to list modules here.
#
instantiate {
	#
	# We list the counter module here so that it registers
	# the check_name attribute before any module which sets
	# it
#	daily

	# subsections here can be thought of as "virtual" modules.
	#
	# e.g. If you have two redundant SQL servers, and you want to
	# use them in the authorize and accounting sections, you could
	# place a "redundant" block in each section, containing the
	# exact same text.  Or, you could uncomment the following
	# lines, and list "redundant_sql" in the authorize and
	# accounting sections.
	#
	#  The "virtual" module defined here can also be used with
	#  dynamic expansions, under a few conditions:
	#
	#  * The section is "redundant", or "load-balance", or
	#    "redundant-load-balance"
	#  * The section contains modules ONLY, and no sub-sections
	#  * all modules in the section are using the same rlm_
	#    driver, e.g. They are all sql, or all ldap, etc.
	#
	#  When those conditions are satisfied, the server will
	#  automatically register a dynamic expansion, using the
	#  name of the "virtual" module.  In the example below,
	#  it will be "redundant_sql".  You can then use this expansion
	#  just like any other:
	#
	#	update reply {
	#		Filter-Id := "%{redundant_sql: ... }"
	#	}
	#
	#  In this example, the expansion is done via module "sql1",
	#  and if that expansion fails, using module "sql2".
	#
	#  For best results, configure the "pool" subsection of the
	#  module so that "retry_delay" is non-zero.  That will allow
	#  the redundant block to quickly ignore all "down" SQL
	#  databases.  If instead we have "retry_delay = 0", then
	#  every time the redundant block is used, the server will try
	#  to open a connection to every "down" database, causing
	#  problems.
	#
	#redundant redundant_sql {
	#	sql1
	#	sql2
	#}
}

######################################################################
#
#  Policies are virtual modules, similar to those defined in the
#  "instantiate" section above.
#
#  Defining a policy in one of the policy.d files means that it can be
#  referenced in multiple places as a *name*, rather than as a series of
#  conditions to match, and actions to take.
#
#  Policies are something like subroutines in a normal language, but
#  they cannot be called recursively. They MUST be defined in order.
#  If policy A calls policy B, then B MUST be defined before A.
#
######################################################################
policy {
	$INCLUDE policy.d/
}

######################################################################
#
#	Load virtual servers.
#
#	This next $INCLUDE line loads files in the directory that
#	match the regular expression: /[a-zA-Z0-9_.]+/
#
#	It allows you to define new virtual servers simply by placing
#	a file into the raddb/sites-enabled/ directory.
#
$INCLUDE sites-enabled/

######################################################################
#
#	All of the other configuration sections like "authorize {}",
#	"authenticate {}", "accounting {}", have been moved to the
#	the file:
#
#		raddb/sites-available/default
#
#	This is the "default" virtual server that has the same
#	configuration as in version 1.0.x and 1.1.x.  The default
#	installation enables this virtual server.  You should
#	edit it to create policies for your local site.
#
#	For more documentation on virtual servers, see:
#
#		raddb/sites-available/README
#
######################################################################