initial config files
This commit is contained in:
parent
b3843f123f
commit
65a2d8c1d8
|
@ -0,0 +1,18 @@
|
||||||
|
#!/bin/sh
|
||||||
|
# Do initial configuration of freeradius
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
CONF_DIR = '/etc/freeradius'
|
||||||
|
BASEDIR=`dirname $0`
|
||||||
|
|
||||||
|
service freeradius stop
|
||||||
|
|
||||||
|
cp "$CONF_DIR/sites-available/default" "$CONF_DIR/sites-available/default.backup"
|
||||||
|
cp "$BASEDIR/radius-default.conf" "$CONF_DIR/sites-available/default"
|
||||||
|
|
||||||
|
service freeradius start
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
|
@ -0,0 +1,76 @@
|
||||||
|
dn: cn=config
|
||||||
|
objectClass: olcGlobal
|
||||||
|
cn: config
|
||||||
|
olcArgsFile: /var/run/slapd/slapd.args
|
||||||
|
olcPidFile: /var/run/slapd/slapd.pid
|
||||||
|
olcToolThreads: 1
|
||||||
|
olcLogLevel: none
|
||||||
|
olcServerId: 1
|
||||||
|
|
||||||
|
dn: cn=module{0},cn=config
|
||||||
|
objectClass: olcModuleList
|
||||||
|
cn: module{0}
|
||||||
|
olcModulePath: /usr/lib/ldap
|
||||||
|
olcModuleLoad: {0}back_hdb
|
||||||
|
olcModuleLoad: {1}back_monitor
|
||||||
|
olcModuleLoad: {2}back_mdb
|
||||||
|
olcModuleLoad: {3}accesslog
|
||||||
|
olcModuleLoad: {4}unique
|
||||||
|
olcModuleLoad: {5}refint
|
||||||
|
olcModuleLoad: {6}constraint
|
||||||
|
olcModuleLoad: {7}syncprov
|
||||||
|
|
||||||
|
dn: cn=schema,cn=config
|
||||||
|
objectClass: olcSchemaConfig
|
||||||
|
cn: schema
|
||||||
|
|
||||||
|
dn: olcDatabase={-1}frontend,cn=config
|
||||||
|
objectClass: olcDatabaseConfig
|
||||||
|
objectClass: olcFrontendConfig
|
||||||
|
olcDatabase: {-1}frontend
|
||||||
|
olcAccess: {0}to *
|
||||||
|
by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage
|
||||||
|
by * break
|
||||||
|
olcAccess: {1}to dn.exact="" by * read
|
||||||
|
olcAccess: {2}to dn.base="cn=Subschema" by * read
|
||||||
|
olcSizeLimit: 500
|
||||||
|
|
||||||
|
dn: olcDatabase={0}config,cn=config
|
||||||
|
objectClass: olcDatabaseConfig
|
||||||
|
olcDatabase: {0}config
|
||||||
|
olcAccess: {0}to *
|
||||||
|
by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage
|
||||||
|
by * break
|
||||||
|
olcRootDN: cn=admin,cn=config
|
||||||
|
|
||||||
|
dn: olcDatabase={1}mdb,cn=config
|
||||||
|
objectClass: olcDatabaseConfig
|
||||||
|
objectClass: olcMdbConfig
|
||||||
|
olcSuffix: cn=config-accesslog
|
||||||
|
olcDbDirectory: /var/lib/ldap/config-accesslog/
|
||||||
|
# Allow reading accesslog only by root
|
||||||
|
olcAccess: {0}to *
|
||||||
|
by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
|
||||||
|
by * break
|
||||||
|
|
||||||
|
dn: olcDatabase={1}monitor,cn=config
|
||||||
|
objectClass: olcDatabaseConfig
|
||||||
|
objectClass: olcMonitorConfig
|
||||||
|
olcDatabase: {1}monitor
|
||||||
|
# Allow reading monitoring only by root
|
||||||
|
olcAccess: {0}to *
|
||||||
|
by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
|
||||||
|
by * break
|
||||||
|
|
||||||
|
# Log all writes to the configuration
|
||||||
|
dn: olcOverlay={0}accesslog,olcDatabase={0}config,cn=config
|
||||||
|
objectClass: olcAccesslogConfig
|
||||||
|
objectClass: olcOverlayConfig
|
||||||
|
objectClass: olcConfig
|
||||||
|
objectClass: top
|
||||||
|
olcOverlay: {0}accesslog
|
||||||
|
olcAccessLogDB: cn=config-accesslog
|
||||||
|
olcAccessLogOps: writes
|
||||||
|
# log are conserved one year and purged every day
|
||||||
|
olcAccessLogPurge: 365+00:00 1+00:00
|
||||||
|
olcAccessLogOld: objectClass=olcConfig
|
|
@ -0,0 +1,613 @@
|
||||||
|
client local {
|
||||||
|
shortname = "Dynamic client"
|
||||||
|
ipaddr = 192.168.5.224
|
||||||
|
netmask = 32
|
||||||
|
lifetime = 3600
|
||||||
|
secret = mystrongsecret
|
||||||
|
}
|
||||||
|
|
||||||
|
# Authorization. First preprocess (hints and huntgroups files),
|
||||||
|
# then realms, and finally look in the "users" file.
|
||||||
|
#
|
||||||
|
# Any changes made here should also be made to the "inner-tunnel"
|
||||||
|
# virtual server.
|
||||||
|
#
|
||||||
|
# The order of the realm modules will determine the order that
|
||||||
|
# we try to find a matching realm.
|
||||||
|
#
|
||||||
|
# Make *sure* that 'preprocess' comes before any realm if you
|
||||||
|
# need to setup hints for the remote radius server
|
||||||
|
authorize {
|
||||||
|
|
||||||
|
#
|
||||||
|
# Security settings. Take a User-Name, and do some simple
|
||||||
|
# checks on it, for spaces and other invalid characters. If
|
||||||
|
# it looks like the user is trying to play games, reject it.
|
||||||
|
#
|
||||||
|
# This should probably be enabled by default.
|
||||||
|
#
|
||||||
|
# See policy.conf for the definition of the filter_username policy.
|
||||||
|
#
|
||||||
|
# filter_username
|
||||||
|
|
||||||
|
#
|
||||||
|
# The preprocess module takes care of sanitizing some bizarre
|
||||||
|
# attributes in the request, and turning them into attributes
|
||||||
|
# which are more standard.
|
||||||
|
#
|
||||||
|
# It takes care of processing the 'raddb/hints' and the
|
||||||
|
# 'raddb/huntgroups' files.
|
||||||
|
preprocess
|
||||||
|
|
||||||
|
#
|
||||||
|
# If you want to have a log of authentication requests,
|
||||||
|
# un-comment the following line, and the 'detail auth_log'
|
||||||
|
# section, above.
|
||||||
|
auth_log
|
||||||
|
|
||||||
|
ldap
|
||||||
|
|
||||||
|
#
|
||||||
|
# The chap module will set 'Auth-Type := CHAP' if we are
|
||||||
|
# handling a CHAP request and Auth-Type has not already been set
|
||||||
|
chap
|
||||||
|
|
||||||
|
#
|
||||||
|
# If the users are logging in with an MS-CHAP-Challenge
|
||||||
|
# attribute for authentication, the mschap module will find
|
||||||
|
# the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP'
|
||||||
|
# to the request, which will cause the server to then use
|
||||||
|
# the mschap module for authentication.
|
||||||
|
mschap
|
||||||
|
|
||||||
|
#
|
||||||
|
# If you have a Cisco SIP server authenticating against
|
||||||
|
# FreeRADIUS, uncomment the following line, and the 'digest'
|
||||||
|
# line in the 'authenticate' section.
|
||||||
|
digest
|
||||||
|
|
||||||
|
#
|
||||||
|
# The WiMAX specification says that the Calling-Station-Id
|
||||||
|
# is 6 octets of the MAC. This definition conflicts with
|
||||||
|
# RFC 3580, and all common RADIUS practices. Un-commenting
|
||||||
|
# the "wimax" module here means that it will fix the
|
||||||
|
# Calling-Station-Id attribute to the normal format as
|
||||||
|
# specified in RFC 3580 Section 3.21
|
||||||
|
# wimax
|
||||||
|
|
||||||
|
#
|
||||||
|
# Look for IPASS style 'realm/', and if not found, look for
|
||||||
|
# '@realm', and decide whether or not to proxy, based on
|
||||||
|
# that.
|
||||||
|
# IPASS
|
||||||
|
|
||||||
|
#
|
||||||
|
# If you are using multiple kinds of realms, you probably
|
||||||
|
# want to set "ignore_null = yes" for all of them.
|
||||||
|
# Otherwise, when the first style of realm doesn't match,
|
||||||
|
# the other styles won't be checked.
|
||||||
|
#
|
||||||
|
suffix
|
||||||
|
# ntdomain
|
||||||
|
|
||||||
|
#
|
||||||
|
# This module takes care of EAP-MD5, EAP-TLS, and EAP-LEAP
|
||||||
|
# authentication.
|
||||||
|
#
|
||||||
|
# It also sets the EAP-Type attribute in the request
|
||||||
|
# attribute list to the EAP type from the packet.
|
||||||
|
#
|
||||||
|
# As of 2.0, the EAP module returns "ok" in the authorize stage
|
||||||
|
# for TTLS and PEAP. In 1.x, it never returned "ok" here, so
|
||||||
|
# this change is compatible with older configurations.
|
||||||
|
#
|
||||||
|
# The example below uses module failover to avoid querying all
|
||||||
|
# of the following modules if the EAP module returns "ok".
|
||||||
|
# Therefore, your LDAP and/or SQL servers will not be queried
|
||||||
|
# for the many packets that go back and forth to set up TTLS
|
||||||
|
# or PEAP. The load on those servers will therefore be reduced.
|
||||||
|
#
|
||||||
|
eap {
|
||||||
|
ok = return
|
||||||
|
}
|
||||||
|
|
||||||
|
#
|
||||||
|
# Pull crypt'd passwords from /etc/passwd or /etc/shadow,
|
||||||
|
# using the system API's to get the password. If you want
|
||||||
|
# to read /etc/passwd or /etc/shadow directly, see the
|
||||||
|
# passwd module in radiusd.conf.
|
||||||
|
#
|
||||||
|
# unix
|
||||||
|
|
||||||
|
#
|
||||||
|
# Read the 'users' file
|
||||||
|
# files
|
||||||
|
|
||||||
|
#
|
||||||
|
# Look in an SQL database. The schema of the database
|
||||||
|
# is meant to mirror the "users" file.
|
||||||
|
#
|
||||||
|
# See "Authorization Queries" in sql.conf
|
||||||
|
# sql
|
||||||
|
|
||||||
|
#
|
||||||
|
# If you are using /etc/smbpasswd, and are also doing
|
||||||
|
# mschap authentication, the un-comment this line, and
|
||||||
|
# configure the 'smbpasswd' module.
|
||||||
|
# smbpasswd
|
||||||
|
|
||||||
|
exec
|
||||||
|
#
|
||||||
|
# The ldap module will set Auth-Type to LDAP if it has not
|
||||||
|
# already been set
|
||||||
|
|
||||||
|
#
|
||||||
|
# Enforce daily limits on time spent logged in.
|
||||||
|
# daily
|
||||||
|
|
||||||
|
#
|
||||||
|
# Use the checkval module
|
||||||
|
# checkval
|
||||||
|
|
||||||
|
expiration
|
||||||
|
logintime
|
||||||
|
|
||||||
|
#
|
||||||
|
# If no other module has claimed responsibility for
|
||||||
|
# authentication, then try to use PAP. This allows the
|
||||||
|
# other modules listed above to add a "known good" password
|
||||||
|
# to the request, and to do nothing else. The PAP module
|
||||||
|
# will then see that password, and use it to do PAP
|
||||||
|
# authentication.
|
||||||
|
#
|
||||||
|
# This module should be listed last, so that the other modules
|
||||||
|
# get a chance to set Auth-Type for themselves.
|
||||||
|
#
|
||||||
|
pap
|
||||||
|
|
||||||
|
#
|
||||||
|
# If "status_server = yes", then Status-Server messages are passed
|
||||||
|
# through the following section, and ONLY the following section.
|
||||||
|
# This permits you to do DB queries, for example. If the modules
|
||||||
|
# listed here return "fail", then NO response is sent.
|
||||||
|
#
|
||||||
|
# Autz-Type Status-Server {
|
||||||
|
#
|
||||||
|
# }
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
# Authentication.
|
||||||
|
#
|
||||||
|
#
|
||||||
|
# This section lists which modules are available for authentication.
|
||||||
|
# Note that it does NOT mean 'try each module in order'. It means
|
||||||
|
# that a module from the 'authorize' section adds a configuration
|
||||||
|
# attribute 'Auth-Type := FOO'. That authentication type is then
|
||||||
|
# used to pick the apropriate module from the list below.
|
||||||
|
#
|
||||||
|
|
||||||
|
# In general, you SHOULD NOT set the Auth-Type attribute. The server
|
||||||
|
# will figure it out on its own, and will do the right thing. The
|
||||||
|
# most common side effect of erroneously setting the Auth-Type
|
||||||
|
# attribute is that one authentication method will work, but the
|
||||||
|
# others will not.
|
||||||
|
#
|
||||||
|
# The common reasons to set the Auth-Type attribute by hand
|
||||||
|
# is to either forcibly reject the user (Auth-Type := Reject),
|
||||||
|
# or to or forcibly accept the user (Auth-Type := Accept).
|
||||||
|
#
|
||||||
|
# Note that Auth-Type := Accept will NOT work with EAP.
|
||||||
|
#
|
||||||
|
# Please do not put "unlang" configurations into the "authenticate"
|
||||||
|
# section. Put them in the "post-auth" section instead. That's what
|
||||||
|
# the post-auth section is for.
|
||||||
|
#
|
||||||
|
authenticate {
|
||||||
|
#
|
||||||
|
# PAP authentication, when a back-end database listed
|
||||||
|
# in the 'authorize' section supplies a password. The
|
||||||
|
# password can be clear-text, or encrypted.
|
||||||
|
Auth-Type PAP {
|
||||||
|
pap
|
||||||
|
}
|
||||||
|
|
||||||
|
#
|
||||||
|
# Most people want CHAP authentication
|
||||||
|
# A back-end database listed in the 'authorize' section
|
||||||
|
# MUST supply a CLEAR TEXT password. Encrypted passwords
|
||||||
|
# won't work.
|
||||||
|
Auth-Type CHAP {
|
||||||
|
chap
|
||||||
|
}
|
||||||
|
|
||||||
|
#
|
||||||
|
# MSCHAP authentication.
|
||||||
|
Auth-Type MS-CHAP {
|
||||||
|
mschap
|
||||||
|
}
|
||||||
|
|
||||||
|
#
|
||||||
|
# If you have a Cisco SIP server authenticating against
|
||||||
|
# FreeRADIUS, uncomment the following line, and the 'digest'
|
||||||
|
# line in the 'authorize' section.
|
||||||
|
digest
|
||||||
|
|
||||||
|
#
|
||||||
|
# Pluggable Authentication Modules.
|
||||||
|
# pam
|
||||||
|
|
||||||
|
#
|
||||||
|
# See 'man getpwent' for information on how the 'unix'
|
||||||
|
# module checks the users password. Note that packets
|
||||||
|
# containing CHAP-Password attributes CANNOT be authenticated
|
||||||
|
# against /etc/passwd! See the FAQ for details.
|
||||||
|
#
|
||||||
|
# For normal "crypt" authentication, the "pap" module should
|
||||||
|
# be used instead of the "unix" module. The "unix" module should
|
||||||
|
# be used for authentication ONLY for compatibility with legacy
|
||||||
|
# FreeRADIUS configurations.
|
||||||
|
#
|
||||||
|
unix
|
||||||
|
|
||||||
|
# Uncomment it if you want to use ldap for authentication
|
||||||
|
#
|
||||||
|
# Note that this means "check plain-text password against
|
||||||
|
# the ldap database", which means that EAP won't work,
|
||||||
|
# as it does not supply a plain-text password.
|
||||||
|
Auth-Type LDAP {
|
||||||
|
ldap
|
||||||
|
}
|
||||||
|
|
||||||
|
#
|
||||||
|
# Allow EAP authentication.
|
||||||
|
eap
|
||||||
|
|
||||||
|
#
|
||||||
|
# The older configurations sent a number of attributes in
|
||||||
|
# Access-Challenge packets, which wasn't strictly correct.
|
||||||
|
# If you want to filter out these attributes, uncomment
|
||||||
|
# the following lines.
|
||||||
|
#
|
||||||
|
# Auth-Type eap {
|
||||||
|
# eap {
|
||||||
|
# handled = 1
|
||||||
|
# }
|
||||||
|
# if (handled && (Response-Packet-Type == Access-Challenge)) {
|
||||||
|
# attr_filter.access_challenge.post-auth
|
||||||
|
# handled # override the "updated" code from attr_filter
|
||||||
|
# }
|
||||||
|
# }
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
#
|
||||||
|
# Pre-accounting. Decide which accounting type to use.
|
||||||
|
#
|
||||||
|
preacct {
|
||||||
|
preprocess
|
||||||
|
|
||||||
|
#
|
||||||
|
# Session start times are *implied* in RADIUS.
|
||||||
|
# The NAS never sends a "start time". Instead, it sends
|
||||||
|
# a start packet, *possibly* with an Acct-Delay-Time.
|
||||||
|
# The server is supposed to conclude that the start time
|
||||||
|
# was "Acct-Delay-Time" seconds in the past.
|
||||||
|
#
|
||||||
|
# The code below creates an explicit start time, which can
|
||||||
|
# then be used in other modules.
|
||||||
|
#
|
||||||
|
# The start time is: NOW - delay - session_length
|
||||||
|
#
|
||||||
|
|
||||||
|
# update request {
|
||||||
|
# FreeRADIUS-Acct-Session-Start-Time = "%{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}}"
|
||||||
|
# }
|
||||||
|
|
||||||
|
|
||||||
|
#
|
||||||
|
# Ensure that we have a semi-unique identifier for every
|
||||||
|
# request, and many NAS boxes are broken.
|
||||||
|
acct_unique
|
||||||
|
|
||||||
|
#
|
||||||
|
# Look for IPASS-style 'realm/', and if not found, look for
|
||||||
|
# '@realm', and decide whether or not to proxy, based on
|
||||||
|
# that.
|
||||||
|
#
|
||||||
|
# Accounting requests are generally proxied to the same
|
||||||
|
# home server as authentication requests.
|
||||||
|
# IPASS
|
||||||
|
suffix
|
||||||
|
# ntdomain
|
||||||
|
|
||||||
|
#
|
||||||
|
# Read the 'acct_users' file
|
||||||
|
files
|
||||||
|
}
|
||||||
|
|
||||||
|
#
|
||||||
|
# Accounting. Log the accounting data.
|
||||||
|
#
|
||||||
|
accounting {
|
||||||
|
#
|
||||||
|
# Create a 'detail'ed log of the packets.
|
||||||
|
# Note that accounting requests which are proxied
|
||||||
|
# are also logged in the detail file.
|
||||||
|
detail
|
||||||
|
# daily
|
||||||
|
|
||||||
|
# Update the wtmp file
|
||||||
|
#
|
||||||
|
# If you don't use "radlast", you can delete this line.
|
||||||
|
# unix
|
||||||
|
|
||||||
|
#
|
||||||
|
# For Simultaneous-Use tracking.
|
||||||
|
#
|
||||||
|
# Due to packet losses in the network, the data here
|
||||||
|
# may be incorrect. There is little we can do about it.
|
||||||
|
# radutmp
|
||||||
|
# sradutmp
|
||||||
|
|
||||||
|
# Return an address to the IP Pool when we see a stop record.
|
||||||
|
# main_pool
|
||||||
|
|
||||||
|
#
|
||||||
|
# Log traffic to an SQL database.
|
||||||
|
#
|
||||||
|
# See "Accounting queries" in sql.conf
|
||||||
|
# sql
|
||||||
|
|
||||||
|
#
|
||||||
|
# If you receive stop packets with zero session length,
|
||||||
|
# they will NOT be logged in the database. The SQL module
|
||||||
|
# will print a message (only in debugging mode), and will
|
||||||
|
# return "noop".
|
||||||
|
#
|
||||||
|
# You can ignore these packets by uncommenting the following
|
||||||
|
# three lines. Otherwise, the server will not respond to the
|
||||||
|
# accounting request, and the NAS will retransmit.
|
||||||
|
#
|
||||||
|
# if (noop) {
|
||||||
|
# ok
|
||||||
|
# }
|
||||||
|
|
||||||
|
#
|
||||||
|
# Instead of sending the query to the SQL server,
|
||||||
|
# write it into a log file.
|
||||||
|
#
|
||||||
|
# sql_log
|
||||||
|
|
||||||
|
# Cisco VoIP specific bulk accounting
|
||||||
|
# pgsql-voip
|
||||||
|
|
||||||
|
# For Exec-Program and Exec-Program-Wait
|
||||||
|
exec
|
||||||
|
|
||||||
|
# Filter attributes from the accounting response.
|
||||||
|
attr_filter.accounting_response
|
||||||
|
|
||||||
|
#
|
||||||
|
# See "Autz-Type Status-Server" for how this works.
|
||||||
|
#
|
||||||
|
# Acct-Type Status-Server {
|
||||||
|
#
|
||||||
|
# }
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
# Session database, used for checking Simultaneous-Use. Either the radutmp
|
||||||
|
# or rlm_sql module can handle this.
|
||||||
|
# The rlm_sql module is *much* faster
|
||||||
|
session {
|
||||||
|
radutmp
|
||||||
|
|
||||||
|
#
|
||||||
|
# See "Simultaneous Use Checking Queries" in sql.conf
|
||||||
|
# sql
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
# Post-Authentication
|
||||||
|
# Once we KNOW that the user has been authenticated, there are
|
||||||
|
# additional steps we can take.
|
||||||
|
post-auth {
|
||||||
|
# Get an address from the IP Pool.
|
||||||
|
# main_pool
|
||||||
|
|
||||||
|
#
|
||||||
|
# If you want to have a log of authentication replies,
|
||||||
|
# un-comment the following line, and the 'detail reply_log'
|
||||||
|
# section, above.
|
||||||
|
# reply_log
|
||||||
|
|
||||||
|
#
|
||||||
|
# After authenticating the user, do another SQL query.
|
||||||
|
#
|
||||||
|
# See "Authentication Logging Queries" in sql.conf
|
||||||
|
# sql
|
||||||
|
|
||||||
|
#
|
||||||
|
# Instead of sending the query to the SQL server,
|
||||||
|
# write it into a log file.
|
||||||
|
#
|
||||||
|
# sql_log
|
||||||
|
|
||||||
|
#
|
||||||
|
# Un-comment the following if you have set
|
||||||
|
# 'edir_account_policy_check = yes' in the ldap module sub-section of
|
||||||
|
# the 'modules' section.
|
||||||
|
#
|
||||||
|
# ldap
|
||||||
|
|
||||||
|
# For Exec-Program and Exec-Program-Wait
|
||||||
|
exec
|
||||||
|
|
||||||
|
#
|
||||||
|
# Calculate the various WiMAX keys. In order for this to work,
|
||||||
|
# you will need to define the WiMAX NAI, usually via
|
||||||
|
#
|
||||||
|
# update request {
|
||||||
|
# WiMAX-MN-NAI = "%{User-Name}"
|
||||||
|
# }
|
||||||
|
#
|
||||||
|
# If you want various keys to be calculated, you will need to
|
||||||
|
# update the reply with "template" values. The module will see
|
||||||
|
# this, and replace the template values with the correct ones
|
||||||
|
# taken from the cryptographic calculations. e.g.
|
||||||
|
#
|
||||||
|
# update reply {
|
||||||
|
# WiMAX-FA-RK-Key = 0x00
|
||||||
|
# WiMAX-MSK = "%{EAP-MSK}"
|
||||||
|
# }
|
||||||
|
#
|
||||||
|
# You may want to delete the MS-MPPE-*-Keys from the reply,
|
||||||
|
# as some WiMAX clients behave badly when those attributes
|
||||||
|
# are included. See "raddb/modules/wimax", configuration
|
||||||
|
# entry "delete_mppe_keys" for more information.
|
||||||
|
#
|
||||||
|
# wimax
|
||||||
|
|
||||||
|
# If there is a client certificate (EAP-TLS, sometimes PEAP
|
||||||
|
# and TTLS), then some attributes are filled out after the
|
||||||
|
# certificate verification has been performed. These fields
|
||||||
|
# MAY be available during the authentication, or they may be
|
||||||
|
# available only in the "post-auth" section.
|
||||||
|
#
|
||||||
|
# The first set of attributes contains information about the
|
||||||
|
# issuing certificate which is being used. The second
|
||||||
|
# contains information about the client certificate (if
|
||||||
|
# available).
|
||||||
|
#
|
||||||
|
# update reply {
|
||||||
|
# Reply-Message += "%{TLS-Cert-Serial}"
|
||||||
|
# Reply-Message += "%{TLS-Cert-Expiration}"
|
||||||
|
# Reply-Message += "%{TLS-Cert-Subject}"
|
||||||
|
# Reply-Message += "%{TLS-Cert-Issuer}"
|
||||||
|
# Reply-Message += "%{TLS-Cert-Common-Name}"
|
||||||
|
# Reply-Message += "%{TLS-Cert-Subject-Alt-Name-Email}"
|
||||||
|
#
|
||||||
|
# Reply-Message += "%{TLS-Client-Cert-Serial}"
|
||||||
|
# Reply-Message += "%{TLS-Client-Cert-Expiration}"
|
||||||
|
# Reply-Message += "%{TLS-Client-Cert-Subject}"
|
||||||
|
# Reply-Message += "%{TLS-Client-Cert-Issuer}"
|
||||||
|
# Reply-Message += "%{TLS-Client-Cert-Common-Name}"
|
||||||
|
# Reply-Message += "%{TLS-Client-Cert-Subject-Alt-Name-Email}"
|
||||||
|
# }
|
||||||
|
|
||||||
|
# MacSEC requires the use of EAP-Key-Name. However, we don't
|
||||||
|
# want to send it for all EAP sessions. Therefore, the EAP
|
||||||
|
# modules put required data into the EAP-Session-Id attribute.
|
||||||
|
# This attribute is never put into a request or reply packet.
|
||||||
|
#
|
||||||
|
# Uncomment the next few lines to copy the required data into
|
||||||
|
# the EAP-Key-Name attribute
|
||||||
|
# if (reply:EAP-Session-Id) {
|
||||||
|
# update reply {
|
||||||
|
# EAP-Key-Name := "%{reply:EAP-Session-Id}"
|
||||||
|
# }
|
||||||
|
# }
|
||||||
|
|
||||||
|
# If the WiMAX module did it's work, you may want to do more
|
||||||
|
# things here, like delete the MS-MPPE-*-Key attributes.
|
||||||
|
#
|
||||||
|
# if (updated) {
|
||||||
|
# update reply {
|
||||||
|
# MS-MPPE-Recv-Key !* 0x00
|
||||||
|
# MS-MPPE-Send-Key !* 0x00
|
||||||
|
# }
|
||||||
|
# }
|
||||||
|
|
||||||
|
#
|
||||||
|
# Access-Reject packets are sent through the REJECT sub-section of the
|
||||||
|
# post-auth section.
|
||||||
|
#
|
||||||
|
# Add the ldap module name (or instance) if you have set
|
||||||
|
# 'edir_account_policy_check = yes' in the ldap module configuration
|
||||||
|
#
|
||||||
|
Post-Auth-Type REJECT {
|
||||||
|
# log failed authentications in SQL, too.
|
||||||
|
# sql
|
||||||
|
attr_filter.access_reject
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#
|
||||||
|
# When the server decides to proxy a request to a home server,
|
||||||
|
# the proxied request is first passed through the pre-proxy
|
||||||
|
# stage. This stage can re-write the request, or decide to
|
||||||
|
# cancel the proxy.
|
||||||
|
#
|
||||||
|
# Only a few modules currently have this method.
|
||||||
|
#
|
||||||
|
pre-proxy {
|
||||||
|
# attr_rewrite
|
||||||
|
|
||||||
|
# Uncomment the following line if you want to change attributes
|
||||||
|
# as defined in the preproxy_users file.
|
||||||
|
# files
|
||||||
|
|
||||||
|
# Uncomment the following line if you want to filter requests
|
||||||
|
# sent to remote servers based on the rules defined in the
|
||||||
|
# 'attrs.pre-proxy' file.
|
||||||
|
# attr_filter.pre-proxy
|
||||||
|
|
||||||
|
# If you want to have a log of packets proxied to a home
|
||||||
|
# server, un-comment the following line, and the
|
||||||
|
# 'detail pre_proxy_log' section, above.
|
||||||
|
# pre_proxy_log
|
||||||
|
}
|
||||||
|
|
||||||
|
#
|
||||||
|
# When the server receives a reply to a request it proxied
|
||||||
|
# to a home server, the request may be massaged here, in the
|
||||||
|
# post-proxy stage.
|
||||||
|
#
|
||||||
|
post-proxy {
|
||||||
|
|
||||||
|
# If you want to have a log of replies from a home server,
|
||||||
|
# un-comment the following line, and the 'detail post_proxy_log'
|
||||||
|
# section, above.
|
||||||
|
# post_proxy_log
|
||||||
|
|
||||||
|
# attr_rewrite
|
||||||
|
|
||||||
|
# Uncomment the following line if you want to filter replies from
|
||||||
|
# remote proxies based on the rules defined in the 'attrs' file.
|
||||||
|
# attr_filter.post-proxy
|
||||||
|
|
||||||
|
#
|
||||||
|
# If you are proxying LEAP, you MUST configure the EAP
|
||||||
|
# module, and you MUST list it here, in the post-proxy
|
||||||
|
# stage.
|
||||||
|
#
|
||||||
|
# You MUST also use the 'nostrip' option in the 'realm'
|
||||||
|
# configuration. Otherwise, the User-Name attribute
|
||||||
|
# in the proxied request will not match the user name
|
||||||
|
# hidden inside of the EAP packet, and the end server will
|
||||||
|
# reject the EAP request.
|
||||||
|
#
|
||||||
|
eap
|
||||||
|
|
||||||
|
#
|
||||||
|
# If the server tries to proxy a request and fails, then the
|
||||||
|
# request is processed through the modules in this section.
|
||||||
|
#
|
||||||
|
# The main use of this section is to permit robust proxying
|
||||||
|
# of accounting packets. The server can be configured to
|
||||||
|
# proxy accounting packets as part of normal processing.
|
||||||
|
# Then, if the home server goes down, accounting packets can
|
||||||
|
# be logged to a local "detail" file, for processing with
|
||||||
|
# radrelay. When the home server comes back up, radrelay
|
||||||
|
# will read the detail file, and send the packets to the
|
||||||
|
# home server.
|
||||||
|
#
|
||||||
|
# With this configuration, the server always responds to
|
||||||
|
# Accounting-Requests from the NAS, but only writes
|
||||||
|
# accounting packets to disk if the home server is down.
|
||||||
|
#
|
||||||
|
# Post-Proxy-Type Fail {
|
||||||
|
# detail
|
||||||
|
# }
|
||||||
|
}
|
|
@ -0,0 +1,210 @@
|
||||||
|
# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
|
||||||
|
# CRC32 f395ae99
|
||||||
|
dn: cn=radius,cn=schema,cn=config
|
||||||
|
objectClass: olcSchemaConfig
|
||||||
|
cn: radius
|
||||||
|
olcAttributeTypes: {0}( 1.3.6.1.4.1.3317.4.3.1.1 NAME 'radiusArapFeatures' D
|
||||||
|
ESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SIN
|
||||||
|
GLE-VALUE )
|
||||||
|
olcAttributeTypes: {1}( 1.3.6.1.4.1.3317.4.3.1.2 NAME 'radiusArapSecurity' D
|
||||||
|
ESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SIN
|
||||||
|
GLE-VALUE )
|
||||||
|
olcAttributeTypes: {2}( 1.3.6.1.4.1.3317.4.3.1.3 NAME 'radiusArapZoneAccess'
|
||||||
|
DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 S
|
||||||
|
INGLE-VALUE )
|
||||||
|
olcAttributeTypes: {3}( 1.3.6.1.4.1.3317.4.3.1.44 NAME 'radiusAuthType' DESC
|
||||||
|
'checkItem: Auth-Type' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466
|
||||||
|
.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {4}( 1.3.6.1.4.1.3317.4.3.1.4 NAME 'radiusCallbackId' DES
|
||||||
|
C 'replyItem: Callback-Id' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1
|
||||||
|
466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {5}( 1.3.6.1.4.1.3317.4.3.1.5 NAME 'radiusCallbackNumber'
|
||||||
|
DESC 'replyItem: Callback-Number' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6
|
||||||
|
.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {6}( 1.3.6.1.4.1.3317.4.3.1.6 NAME 'radiusCalledStationId
|
||||||
|
' DESC 'checkItem: Called-Station-Id' EQUALITY caseIgnoreIA5Match SYNTAX 1.
|
||||||
|
3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {7}( 1.3.6.1.4.1.3317.4.3.1.7 NAME 'radiusCallingStationI
|
||||||
|
d' DESC 'checkItem: Calling-Station-Id' EQUALITY caseIgnoreIA5Match SYNTAX
|
||||||
|
1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {8}( 1.3.6.1.4.1.3317.4.3.1.8 NAME 'radiusClass' DESC 're
|
||||||
|
plyItem: Class' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121
|
||||||
|
.1.26 )
|
||||||
|
olcAttributeTypes: {9}( 1.3.6.1.4.1.3317.4.3.1.45 NAME 'radiusClientIPAddres
|
||||||
|
s' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
|
||||||
|
SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {10}( 1.3.6.1.4.1.3317.4.3.1.9 NAME 'radiusFilterId' DESC
|
||||||
|
'replyItem: Filter-Id' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466
|
||||||
|
.115.121.1.26 )
|
||||||
|
olcAttributeTypes: {11}( 1.3.6.1.4.1.3317.4.3.1.10 NAME 'radiusFramedAppleTa
|
||||||
|
lkLink' DESC 'replyItem: Framed-AppleTalk-Link' EQUALITY caseIgnoreIA5Match
|
||||||
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {12}( 1.3.6.1.4.1.3317.4.3.1.11 NAME 'radiusFramedAppleTa
|
||||||
|
lkNetwork' DESC 'replyItem: Framed-AppleTalk-Network' EQUALITY caseIgnoreIA
|
||||||
|
5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||||
|
olcAttributeTypes: {13}( 1.3.6.1.4.1.3317.4.3.1.12 NAME 'radiusFramedAppleTa
|
||||||
|
lkZone' DESC 'replyItem: Framed-AppleTalk-Zone' EQUALITY caseIgnoreIA5Match
|
||||||
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {14}( 1.3.6.1.4.1.3317.4.3.1.13 NAME 'radiusFramedCompres
|
||||||
|
sion' DESC 'replyItem: Framed-Compression' EQUALITY caseIgnoreIA5Match SYNT
|
||||||
|
AX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||||
|
olcAttributeTypes: {15}( 1.3.6.1.4.1.3317.4.3.1.14 NAME 'radiusFramedIPAddre
|
||||||
|
ss' DESC 'replyItem: Framed-IP-Address' EQUALITY caseIgnoreIA5Match SYNTAX
|
||||||
|
1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {16}( 1.3.6.1.4.1.3317.4.3.1.15 NAME 'radiusFramedIPNetma
|
||||||
|
sk' DESC 'replyItem: Framed-IP-Netmask' EQUALITY caseIgnoreIA5Match SYNTAX
|
||||||
|
1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {17}( 1.3.6.1.4.1.3317.4.3.1.16 NAME 'radiusFramedIPXNetw
|
||||||
|
ork' DESC 'replyItem: Framed-IPX-Network' EQUALITY caseIgnoreIA5Match SYNTA
|
||||||
|
X 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {18}( 1.3.6.1.4.1.3317.4.3.1.17 NAME 'radiusFramedMTU' DE
|
||||||
|
SC 'replyItem: Framed-MTU' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1
|
||||||
|
466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {19}( 1.3.6.1.4.1.3317.4.3.1.18 NAME 'radiusFramedProtoco
|
||||||
|
l' DESC 'replyItem: Framed-Protocol' EQUALITY caseIgnoreIA5Match SYNTAX 1.3
|
||||||
|
.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {20}( 1.3.6.1.4.1.3317.4.3.1.19 NAME 'radiusFramedRoute'
|
||||||
|
DESC 'replyItem: Framed-Route' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4
|
||||||
|
.1.1466.115.121.1.26 )
|
||||||
|
olcAttributeTypes: {21}( 1.3.6.1.4.1.3317.4.3.1.20 NAME 'radiusFramedRouting
|
||||||
|
' DESC 'replyItem: Framed-Routing' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6
|
||||||
|
.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {22}( 1.3.6.1.4.1.3317.4.3.1.46 NAME 'radiusGroupName' DE
|
||||||
|
SC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||||
|
olcAttributeTypes: {23}( 1.3.6.1.4.1.3317.4.3.1.47 NAME 'radiusHint' DESC ''
|
||||||
|
EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VA
|
||||||
|
LUE )
|
||||||
|
olcAttributeTypes: {24}( 1.3.6.1.4.1.3317.4.3.1.48 NAME 'radiusHuntgroupName
|
||||||
|
' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
|
||||||
|
)
|
||||||
|
olcAttributeTypes: {25}( 1.3.6.1.4.1.3317.4.3.1.21 NAME 'radiusIdleTimeout'
|
||||||
|
DESC 'replyItem: Idle-Timeout' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4
|
||||||
|
.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {26}( 1.3.6.1.4.1.3317.4.3.1.22 NAME 'radiusLoginIPHost'
|
||||||
|
DESC 'replyItem: Login-IP-Host' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.
|
||||||
|
4.1.1466.115.121.1.26 )
|
||||||
|
olcAttributeTypes: {27}( 1.3.6.1.4.1.3317.4.3.1.23 NAME 'radiusLoginLATGroup
|
||||||
|
' DESC 'replyItem: Login-LAT-Group' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.
|
||||||
|
6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {28}( 1.3.6.1.4.1.3317.4.3.1.24 NAME 'radiusLoginLATNode'
|
||||||
|
DESC 'replyItem: Login-LAT-Node' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.
|
||||||
|
1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {29}( 1.3.6.1.4.1.3317.4.3.1.25 NAME 'radiusLoginLATPort'
|
||||||
|
DESC 'replyItem: Login-LAT-Port' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.
|
||||||
|
1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {30}( 1.3.6.1.4.1.3317.4.3.1.26 NAME 'radiusLoginLATServi
|
||||||
|
ce' DESC 'replyItem: Login-LAT-Service' EQUALITY caseIgnoreIA5Match SYNTAX
|
||||||
|
1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {31}( 1.3.6.1.4.1.3317.4.3.1.27 NAME 'radiusLoginService'
|
||||||
|
DESC 'replyItem: Login-Service' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1
|
||||||
|
.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {32}( 1.3.6.1.4.1.3317.4.3.1.28 NAME 'radiusLoginTCPPort'
|
||||||
|
DESC 'replyItem: Login-TCP-Port' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.
|
||||||
|
1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {33}( 1.3.6.1.4.1.3317.4.3.1.29 NAME 'radiusPasswordRetry
|
||||||
|
' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
|
||||||
|
SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {34}( 1.3.6.1.4.1.3317.4.3.1.30 NAME 'radiusPortLimit' DE
|
||||||
|
SC 'replyItem: Port-Limit' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1
|
||||||
|
466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {35}( 1.3.6.1.4.1.3317.4.3.1.49 NAME 'radiusProfileDn' DE
|
||||||
|
SC '' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
|
||||||
|
SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {36}( 1.3.6.1.4.1.3317.4.3.1.31 NAME 'radiusPrompt' DESC
|
||||||
|
'' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-
|
||||||
|
VALUE )
|
||||||
|
olcAttributeTypes: {37}( 1.3.6.1.4.1.3317.4.3.1.50 NAME 'radiusProxyToRealm'
|
||||||
|
DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 S
|
||||||
|
INGLE-VALUE )
|
||||||
|
olcAttributeTypes: {38}( 1.3.6.1.4.1.3317.4.3.1.51 NAME 'radiusReplicateToRe
|
||||||
|
alm' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.
|
||||||
|
26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {39}( 1.3.6.1.4.1.3317.4.3.1.52 NAME 'radiusRealm' DESC '
|
||||||
|
' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-V
|
||||||
|
ALUE )
|
||||||
|
olcAttributeTypes: {40}( 1.3.6.1.4.1.3317.4.3.1.32 NAME 'radiusServiceType'
|
||||||
|
DESC 'replyItem: Service-Type' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4
|
||||||
|
.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {41}( 1.3.6.1.4.1.3317.4.3.1.33 NAME 'radiusSessionTimeou
|
||||||
|
t' DESC 'replyItem: Session-Timeout' EQUALITY caseIgnoreIA5Match SYNTAX 1.3
|
||||||
|
.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {42}( 1.3.6.1.4.1.3317.4.3.1.34 NAME 'radiusTerminationAc
|
||||||
|
tion' DESC 'replyItem: Termination-Action' EQUALITY caseIgnoreIA5Match SYNT
|
||||||
|
AX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {43}( 1.3.6.1.4.1.3317.4.3.1.35 NAME 'radiusTunnelAssignm
|
||||||
|
entId' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.
|
||||||
|
1.26 )
|
||||||
|
olcAttributeTypes: {44}( 1.3.6.1.4.1.3317.4.3.1.36 NAME 'radiusTunnelMediumT
|
||||||
|
ype' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.
|
||||||
|
26 )
|
||||||
|
olcAttributeTypes: {45}( 1.3.6.1.4.1.3317.4.3.1.37 NAME 'radiusTunnelPasswor
|
||||||
|
d' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
|
||||||
|
SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {46}( 1.3.6.1.4.1.3317.4.3.1.38 NAME 'radiusTunnelPrefere
|
||||||
|
nce' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.
|
||||||
|
26 )
|
||||||
|
olcAttributeTypes: {47}( 1.3.6.1.4.1.3317.4.3.1.39 NAME 'radiusTunnelPrivate
|
||||||
|
GroupId' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.12
|
||||||
|
1.1.26 )
|
||||||
|
olcAttributeTypes: {48}( 1.3.6.1.4.1.3317.4.3.1.40 NAME 'radiusTunnelServerE
|
||||||
|
ndpoint' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.12
|
||||||
|
1.1.26 )
|
||||||
|
olcAttributeTypes: {49}( 1.3.6.1.4.1.3317.4.3.1.41 NAME 'radiusTunnelType' D
|
||||||
|
ESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||||
|
olcAttributeTypes: {50}( 1.3.6.1.4.1.3317.4.3.1.42 NAME 'radiusVSA' DESC ''
|
||||||
|
EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||||
|
olcAttributeTypes: {51}( 1.3.6.1.4.1.3317.4.3.1.43 NAME 'radiusTunnelClientE
|
||||||
|
ndpoint' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.12
|
||||||
|
1.1.26 )
|
||||||
|
olcAttributeTypes: {52}( 1.3.6.1.4.1.3317.4.3.1.53 NAME 'radiusSimultaneousU
|
||||||
|
se' DESC 'checkItem: Simultaneous-Use' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
|
||||||
|
SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {53}( 1.3.6.1.4.1.3317.4.3.1.54 NAME 'radiusLoginTime' DE
|
||||||
|
SC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SING
|
||||||
|
LE-VALUE )
|
||||||
|
olcAttributeTypes: {54}( 1.3.6.1.4.1.3317.4.3.1.55 NAME 'radiusUserCategory'
|
||||||
|
DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 S
|
||||||
|
INGLE-VALUE )
|
||||||
|
olcAttributeTypes: {55}( 1.3.6.1.4.1.3317.4.3.1.56 NAME 'radiusStripUserName
|
||||||
|
' DESC '' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {56}( 1.3.6.1.4.1.3317.4.3.1.57 NAME 'dialupAccess' DESC
|
||||||
|
'' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-
|
||||||
|
VALUE )
|
||||||
|
olcAttributeTypes: {57}( 1.3.6.1.4.1.3317.4.3.1.58 NAME 'radiusExpiration' D
|
||||||
|
ESC 'checkItem: Expiration' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.
|
||||||
|
1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {58}( 1.3.6.1.4.1.3317.4.3.1.59 NAME 'radiusCheckItem' DE
|
||||||
|
SC 'checkItem: $GENERIC$' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.14
|
||||||
|
66.115.121.1.26 )
|
||||||
|
olcAttributeTypes: {59}( 1.3.6.1.4.1.3317.4.3.1.60 NAME 'radiusReplyItem' DE
|
||||||
|
SC 'replyItem: $GENERIC$' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.14
|
||||||
|
66.115.121.1.26 )
|
||||||
|
olcAttributeTypes: {60}( 1.3.6.1.4.1.3317.4.3.1.61 NAME 'radiusNASIpAddress'
|
||||||
|
DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 S
|
||||||
|
INGLE-VALUE )
|
||||||
|
olcAttributeTypes: {61}( 1.3.6.1.4.1.3317.4.3.1.62 NAME 'radiusReplyMessage'
|
||||||
|
DESC 'replyItem: Reply-Message' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1
|
||||||
|
.4.1.1466.115.121.1.26 )
|
||||||
|
olcObjectClasses: {0}( 1.3.6.1.4.1.3317.4.3.2.1 NAME 'radiusprofile' DESC ''
|
||||||
|
SUP top AUXILIARY MUST cn MAY ( radiusArapFeatures $ radiusArapSecurity $
|
||||||
|
radiusArapZoneAccess $ radiusAuthType $ radiusCallbackId $ radiusCallbackNu
|
||||||
|
mber $ radiusCalledStationId $ radiusCallingStationId $ radiusClass $ radiu
|
||||||
|
sClientIPAddress $ radiusFilterId $ radiusFramedAppleTalkLink $ radiusFrame
|
||||||
|
dAppleTalkNetwork $ radiusFramedAppleTalkZone $ radiusFramedCompression $ r
|
||||||
|
adiusFramedIPAddress $ radiusFramedIPNetmask $ radiusFramedIPXNetwork $ rad
|
||||||
|
iusFramedMTU $ radiusFramedProtocol $ radiusCheckItem $ radiusReplyItem $ r
|
||||||
|
adiusFramedRoute $ radiusFramedRouting $ radiusIdleTimeout $ radiusGroupNam
|
||||||
|
e $ radiusHint $ radiusHuntgroupName $ radiusLoginIPHost $ radiusLoginLATGr
|
||||||
|
oup $ radiusLoginLATNode $ radiusLoginLATPort $ radiusLoginLATService $ rad
|
||||||
|
iusLoginService $ radiusLoginTCPPort $ radiusLoginTime $ radiusPasswordRetr
|
||||||
|
y $ radiusPortLimit $ radiusPrompt $ radiusProxyToRealm $ radiusRealm $ rad
|
||||||
|
iusReplicateToRealm $ radiusServiceType $ radiusSessionTimeout $ radiusStri
|
||||||
|
pUserName $ radiusTerminationAction $ radiusTunnelClientEndpoint $ radiusPr
|
||||||
|
ofileDn $ radiusSimultaneousUse $ radiusTunnelAssignmentId $ radiusTunnelMe
|
||||||
|
diumType $ radiusTunnelPassword $ radiusTunnelPreference $ radiusTunnelPriv
|
||||||
|
ateGroupId $ radiusTunnelServerEndpoint $ radiusTunnelType $ radiusUserCate
|
||||||
|
gory $ radiusVSA $ radiusExpiration $ dialupAccess $ radiusNASIpAddress $ r
|
||||||
|
adiusReplyMessage ) )
|
||||||
|
olcObjectClasses: {1}( 1.3.6.1.4.1.3317.4.3.2.2 NAME 'radiusObjectProfile' D
|
||||||
|
ESC 'A Container Objectclass to be used for creating radius profile object'
|
||||||
|
SUP top STRUCTURAL MUST cn MAY ( uid $ userPassword $ description ) )
|
|
@ -0,0 +1,25 @@
|
||||||
|
#!/bin/sh
|
||||||
|
# Do initial configuration of slapd
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
BASEDIR=`dirname $0`
|
||||||
|
|
||||||
|
service slapd stop || true
|
||||||
|
BACKUPDIR="/var/backup/reset-ldap-`date +%Y%m%dT%H:%M:%S`"
|
||||||
|
mkdir -p "$BACKUPDIR"
|
||||||
|
echo Old configuration saved in $BACKUPDIR
|
||||||
|
cp -R /var/lib/ldap /etc/ldap/slapd.d/ "$BACKUPDIR"
|
||||||
|
rm -rf /var/lib/ldap/* /etc/ldap/slapd.d/*
|
||||||
|
mkdir /var/lib/ldap/config-accesslog/
|
||||||
|
|
||||||
|
echo Load overlay modules, configure auditlog for cn=config, create cn=monitor db
|
||||||
|
slapadd -n0 -F/etc/ldap/slapd.d -l"$BASEDIR/config.ldif"
|
||||||
|
slapadd -n0 -F/etc/ldap/slapd.d -l"/etc/ldap/schema/core.ldif"
|
||||||
|
slapadd -n0 -F/etc/ldap/slapd.d -l"/etc/ldap/schema/cosine.ldif"
|
||||||
|
slapadd -n0 -F/etc/ldap/slapd.d -l"/etc/ldap/schema/inetorgperson.ldif"
|
||||||
|
slapadd -n0 -F/etc/ldap/slapd.d -l"$BASEDIR/radius.ldif"
|
||||||
|
|
||||||
|
chown -R openldap.openldap /etc/ldap/slapd.d /var/lib/ldap
|
||||||
|
|
||||||
|
service slapd start
|
|
@ -0,0 +1,46 @@
|
||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
ME=`basename $0`
|
||||||
|
COMMANDDIR=`dirname $0`/lib
|
||||||
|
test -d ${COMMANDDIR} || COMMANDDIR=/usr/lib/`basename $0`
|
||||||
|
|
||||||
|
help() {
|
||||||
|
msg="$1"
|
||||||
|
test -n "$msg" && echo $msg
|
||||||
|
echo "syntaxe: $ME commande ..."
|
||||||
|
echo ""
|
||||||
|
echo "commandes disponibles:"
|
||||||
|
echo " help cette aide"
|
||||||
|
for fcom in $COMMANDDIR/*.help
|
||||||
|
do
|
||||||
|
com=`basename $fcom .help`
|
||||||
|
descr=`head -1 $fcom`
|
||||||
|
echo " "$com" "$descr
|
||||||
|
done
|
||||||
|
test -n "$msg" && exit 1
|
||||||
|
exit 0
|
||||||
|
}
|
||||||
|
|
||||||
|
helpcmd() {
|
||||||
|
command=$1
|
||||||
|
xcommand=$COMMANDDIR/$command
|
||||||
|
test -x $xcommand || help "ERR: commande inconnue ($command)"
|
||||||
|
echo "$ME $command"
|
||||||
|
cat $xcommand.help
|
||||||
|
}
|
||||||
|
|
||||||
|
command=$1
|
||||||
|
test -z $command && help "ERR: commande manquante"
|
||||||
|
shift
|
||||||
|
|
||||||
|
case $command in
|
||||||
|
help)
|
||||||
|
test -z "$1" && help
|
||||||
|
helpcmd $1
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
xcommand=$COMMANDDIR/$command
|
||||||
|
test -x $xcommand || help "ERR: commande inconnue ($command)"
|
||||||
|
$xcommand "$@"
|
||||||
|
;;
|
||||||
|
esac
|
Reference in New Issue