freeradius 2.1.12+dfsg-1.2 / etc / freeradius / experimental.conf

#
#  This file contains the configuration for experimental modules.
#
#  By default, it is NOT included in the build.
#
#  $Id$
#

	# Configuration for the Python module.
	#
	# Where radiusd is a Python module, radiusd.py, and the
	# function 'authorize' is called.  Here is a dummy piece
	# of code:
	# 
	#	def authorize(params):
	#	    print params
	#	    return (5, ('Reply-Message', 'banned'))
	#
	# The RADIUS value-pairs are passed as a tuple of tuple
	# pairs as the first argument, e.g. (('attribute1',
	# 'value1'), ('attribute2', 'value2'))
	#
	# The function return is a tuple with the first element
	# being the return value of the function.
	# The 5 corresponds to RLM_MODULE_USERLOCK. I plan to
	# write the return values as Python symbols to avoid
	# confusion.
	#
	# The remaining tuple members are the string form of
	# value-pairs which are passed on to pairmake().
	#
	python {
		mod_instantiate = radiusd_test
		func_instantiate = instantiate

		mod_authorize = radiusd_test
		func_authorize = authorize

		mod_accounting = radiusd_test
		func_accounting = accounting

		mod_pre_proxy = radiusd_test
		func_pre_proxy = pre_proxy

		mod_post_proxy = radiusd_test
		func_post_proxy = post_proxy

		mod_post_auth = radiusd_test
		func_post_auth = post_auth

		mod_recv_coa = radiusd_test
		func_recv_coa = recv_coa

		mod_send_coa = radiusd_test
		func_send_coa = send_coa

		mod_detach = radiusd_test
		func_detach = detach
	}

	
	# Configuration for the example module.  Uncommenting it will cause it
	# to get loaded and initialized, but should have no real effect as long
	# it is not referencened in one of the autz/auth/preacct/acct sections
	example {
		#  Boolean variable.
		# allowed values: {no, yes}
		boolean = yes

		#  An integer, of any value.
		integer = 16

		#  A string.
		string = "This is an example configuration string"

		# An IP address, either in dotted quad (1.2.3.4) or hostname
		# (example.com)
		ipaddr = 127.0.0.1

		# A subsection
		mysubsection {
			anotherinteger = 1000
			# They nest
			deeply nested {
				string = "This is a different string"
			}
		}
	}

	#
	#  To create a dbm users file, do:
	#
	#   cat test.users | rlm_dbm_parser -f /etc/raddb/users_db
	#
	#  Then add 'dbm' in 'authorize' section.
	#
	#  Note that even if the file has a ".db" or ".dbm" extension,
	#  you may have to specify it here without that extension.  This
	#  is because the DBM libraries "helpfully" add a ".db" to the
	#  filename, but don't check if it's already there.
	#
	dbm {
		usersfile = ${confdir}/users_db
	}

	#
	#  Perform NT-Domain authentication.  This only works
	#  with PAP authentication.  That is, Authentication-Request
	#  packets containing a User-Password attribute.
	#
	#  To use it, add 'smb' into the 'authenticate' section,
	#  and then in another module (usually the 'users' file),
	#  set 'Auth-Type := SMB'
	#
	#  WARNING: this module is not only experimental, it's also
	#  a security threat. It's not recommended to use it until
	#  it gets fixed.
	#
	smb {
		server = ntdomain.server.example.com
		backup = backup.server.example.com
		domain = NTDOMAIN
	}

	# See doc/rlm_fastusers before using this
	# module or changing these values.
	#
	fastusers {
		usersfile = ${confdir}/users_fast
		hashsize = 1000
		compat = no
		# Reload the hash every 600 seconds (10mins)
		hash_reload = 600
	}

	# Caching module
	#
	# Should be added in the post-auth section (after all other modules)
	# and in the authorize section (before any other modules)
	#
	# authorize {
	#	caching {
	#		ok = return
	#	}
	#	[... other modules ...]
	# }
	# post-auth {
	#	[... other modules ...]
	#	caching
	# }
	#
	# The caching module will cache the Auth-Type and reply items
	# and send them back on any subsequent requests for the same key
	#
	# Configuration:
	#
	# filename: The gdbm file to use for the cache database
	#		(can be memory mapped for more speed)
	#
	# key: A string to xlat and use as a key. For instance,
	#	"%{Acct-Unique-Session-Id}"
	#
	# post-auth: If we find a cached entry, set the post-auth to that value
	#
	# cache-ttl: The time to cache the entry. The same time format
	#		as the counter module apply here.
	#	  num[hdwm] where:
	#  	h: hours, d: days, w: weeks, m: months
	#  	If the letter is ommited days will be assumed.
	#	e.g. 1d == one day
	#
	# cache-size: The gdbm cache size to request (default 1000)
	#
	# hit-ratio: If set to non-zero we print out statistical
	#	information after so many cache requests
	#
	# cache-rejects: Do we also cache rejects, or not? (default 'yes')
	#
	caching {
		filename = ${db_dir}/db.cache
		cache-ttl = 1d
		hit-ratio = 1000
		key = "%{Acct-Unique-Session-Id}"
		#post-auth = ""
		# cache-size = 2000
		# cache-rejects = yes
	}


	# Simple module for logging of Account packets to radiusd.log
	# You need to declare it in the accounting section for it to work
	acctlog {
		acctlog_update = ""
		acctlog_start = "Connect: [%{User-Name}] (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} ip %{Framed-IP-Address})"
		acctlog_stop = "Disconnect: [%{User-Name}] (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} ip %{Framed-IP-Address}) %{Acct-Session-Time} seconds"
		acctlog_on = "NAS %C (%{NAS-IP-Address}) just came online"
		acctlog_off = "NAS %C (%{NAS-IP-Address}) just went offline"
	}

	# Another implementation of the EAP module.
	#
	#  This module requires the libeap.so file from the hostap
	#  software (http://hostap.epitest.fi/hostapd/).  It has been
	#  tested on the development version of hostapd (0.6.1) ONLY.
	#
	#  In order to use it, you MUST build a "libeap.so" in hostapd,
	#  which is not done by default.
	#
	#  You MUST also edit the file: src/modules/rlm_eap2/Makefile
	#  to point to the location of the hostap include files.
	#
	#  This module CANNOT be used in the same way as the current
	#  FreeRADIUS "eap" module.  There is NO way to look inside of
	#  a tunneled request.  There is NO way to proxy a tunneled
	#  request.  There is NO way to even look at the user name inside
	#  of the tunneled request.  There is NO way to control the
	#  choice of EAP types inside of the tunnel.  You MUST force
	#  the server to choose "eap2" for authentication, because this
	#  module has no "authorize" section.
	#
	#  If you want to use this module for experimentation, please
	#  post your comments to the freeradius-devel list:
	#
	#    http://lists.freeradius.org/mailman/listinfo/freeradius-devel
	#
	#  If you want to use this module in a production (i.e. real-world)
	#  environment:
	#
	#	!!! DO NOT USE IT IN A PRODUCTION ENVIRONMENT !!!
	#
	#  The module needs additional work to make it ready for
	#  production use..  Please supply patches, or sponsor the
	#  work by hiring a developer.  Do NOT ask when the work will
	#  be done, because there is no plan to finish this module
	#  unless there is demand for it.
	#
	eap2 {
		#  EAP types are chosen in the order that they are
		#  listed in this section.  There is no "default_eap_type"
		#  as with rlm_eap.  Instead, the *first* EAP type is
		#  used as the default type.
		#
		peap {
		}

		ttls {
		}

		#  This is the ONLY EAP type that has any configuration.
		#  All other EAP types have no configuration.
		#
		tls {
			ca_cert = ${confdir}/certs/ca.pem
			server_cert = ${confdir}/certs/server.pem
			private_key_file = ${confdir}/certs/server.pem
			private_key_password = whatever
		}

		#
		#  These next two methods do not supply keying material.
		#
		md5 {
		}

		mschapv2 {
		}

		fast { 
			pac_opaque_encr_key = 000102030405060708090a0b0c0d0e0f 
			eap_fast_a_id = xxxxxx 
			eap_fast_a_id_info = my_server 
			eap_fast_prov = 3
			pac_key_lifetime = 604800 # 7 days
			pac_key_refresh_tim = 86400
		} 

		#  LEAP is NOT supported by this module.
		#  Use the "eap" module instead.

		#  For other methods that MIGHT work, see the
		#  configuration of hostap.  The methods are statically
		#  linked in at compile time, and cannot be controlled
		#  here.
	}

	#  Configuration for experimental EAP types.  The sub-sections
	#  can be copied into eap.conf.
	eap {
		ikev2 {

		# Server auth type 
		# Allowed values are:
		#  cert   - for certificate based server authentication,
		#           other required settings for this type are
		#	    'private_key_file' and 'certificate_file'
		#  secret - for shared secret based server authentication, 
		#           other required settings for this type is 'id'
		# Default value of this option is 'secret'
	#     server_authtype=cert

		# Allowed default client auth types
		# Allowed values are:
		#   secret - for shared secret based client	authentication
		#   cert   - for certificate based client authentication
		#   both   - shared secret and certificate is allowed
		#   none   - authentication will always fail
		# Default value for this option is 'both'. This option could
		#  be overwritten within 'usersfile' file by EAP-IKEv2-Auth
		#  option. 
	#   default_authtype = both

		# path to trusted CA certificate file
		CA_file="/path/to/CA/cacert.pem"

		# path to CRL file, if not set, then there will be no
		#  checks against CRL
	#   crl_file="/path/to/crl.pem"

		# path to file with user settings 
		#
		#  Note that this file is read ONLY on module initialization!
		#
		# default ${confdir}/eap_ikev2_users
	#   usersfile=${confdir}/eap_ikev2_users

#
#  Sample "eap_ikev2_users" file entry:
#
#username  EAP-IKEv2-IDType := KEY_ID,  EAP-IKEv2-Secret := "tajne"

## where:
## username           - client user name from IKE-AUTH (IDr)  or CommonName
##                      from x509 certificate
## EAP-IKEv2-IDType   - ID Type - same as in expected IDType payload
##	                allowable attributes for EAP-IKEv2-IDType:
##	                IPV4_ADDR FQDN RFC822_ADDR IPV6_ADDR DER_ASN1_DN
##			DER_ASN1_GN KEY_ID
## EAP-IKEv2-Secret   - shared secret
## EAP-IKEv2-AuthType - optional parameter which defines expected client auth
##                      type. Allowed values are: secret,cert,both,none.
##			For the meaning of this values, please see the
##                      description of 'default_authtype'.
##                      This attribute can overwrite 'default_authtype' value.



		# path to  file with server private key
		private_key_file="/path/to/srv-private-key.pem"

		# password to private key file
		private_key_password="passwd"

		# path to file with server certificate
		certificate_file="/path/to/srv-cert.pem"

		# server identity string
		id="deMaio"

		# Server identity type. Allowed values are:
		# IPV4_ADDR, FQDN, RFC822_ADDR, IPV6_ADDR, ASN1_DN, ASN1_GN,
		#  KEY_ID
		# Default value is:	KEY_ID
	#   id_type = KEY_ID


		# MTU (default: 1398)
	#   fragment_size = 1398
    
		# maximal allowed number of resends SA_INIT after receiving
		# 'invalid KEY' notification (default 3)
	#   DH_counter_max = 3

		# option which is used to control whenever send CERT REQ
		#  payload or not.
		# Allowed values for this option are "yes" or "no".
		#Default value is "no".
	#   certreq = "yes"

		# option which cotrols fast reconnect capability.
		# Allowed valuse for this option are "yes" or "no".
		# Default value is "yes".
	#   enable_fast_reauth = "no"
    
		# option which is used to control performing of DH exchange
		#  during fast rekeying protocol run.
		# Allowed values for this option are "yes" or "no".
		# Default value is "no"
	#   fast_DH_exchange = "yes"

		# Option which is used to set up expiration time of inactive
		#  IKEv2 session.
		# After selected period of time (in seconds), inactive
		# session data will be deleted.
		# Default value of this option is set to 900 seconds
	#   fast_timer_expire = 900

		# list of server proposals of available cryptographic
		# suites
		proposals {
			# proposal number #1 
			proposal {

				# Supported transforms types: encryption,
				# prf, integrity, dhgroup. For multiple
				# transforms just simple repeat key (i.e.
				# integity).

				# encryption algorithm
				# supported algorithms:
				# null,3des,aes_128_cbc,aes_192_cbc,
				# aes_256_cbc,idea
	            		# blowfish:n, where n range from 8 to 448 bits,
				#  step 8 bits
				# cast:n, where n range from 40 to 128 bits,
				#  step 8 bits 
				encryption = 3des

				# pseudo random function. Supported prf's:
				# hmac_md5, hmac_sha1, hmac_tiger
				prf = hmac_sha1

				# integrity algorithm. Supported algorithms:
				# hmac_md5_96, hmac_sha1_96,des_mac
				integrity = hmac_sha1_96
				integrity = hmac_md5_96

				# Diffie-Hellman groups:
				# modp768, modp1024, modp1536, modp2048, 
				# modp3072, modp4096, modp6144, modp8192
				dhgroup = modp2048 
			}
		
			# proposal number #2 
			proposal {
				encryption = 3des
				prf = hmac_md5
				integrity = hmac_md5_96
				dhgroup = modp1024
			}	

			# proposal number #3 
			proposal {
				encryption=3des
				prf=hmac_md5
				integrity=hmac_md5_96
				dhgroup=modp2048
			} 
		}
		}
	}