initial config files
This commit is contained in:
parent
b3843f123f
commit
65a2d8c1d8
|
|
@ -0,0 +1,18 @@
|
|||
#!/bin/sh
|
||||
# Do initial configuration of freeradius
|
||||
|
||||
set -e
|
||||
|
||||
CONF_DIR = '/etc/freeradius'
|
||||
BASEDIR=`dirname $0`
|
||||
|
||||
service freeradius stop
|
||||
|
||||
cp "$CONF_DIR/sites-available/default" "$CONF_DIR/sites-available/default.backup"
|
||||
cp "$BASEDIR/radius-default.conf" "$CONF_DIR/sites-available/default"
|
||||
|
||||
service freeradius start
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,76 @@
|
|||
dn: cn=config
|
||||
objectClass: olcGlobal
|
||||
cn: config
|
||||
olcArgsFile: /var/run/slapd/slapd.args
|
||||
olcPidFile: /var/run/slapd/slapd.pid
|
||||
olcToolThreads: 1
|
||||
olcLogLevel: none
|
||||
olcServerId: 1
|
||||
|
||||
dn: cn=module{0},cn=config
|
||||
objectClass: olcModuleList
|
||||
cn: module{0}
|
||||
olcModulePath: /usr/lib/ldap
|
||||
olcModuleLoad: {0}back_hdb
|
||||
olcModuleLoad: {1}back_monitor
|
||||
olcModuleLoad: {2}back_mdb
|
||||
olcModuleLoad: {3}accesslog
|
||||
olcModuleLoad: {4}unique
|
||||
olcModuleLoad: {5}refint
|
||||
olcModuleLoad: {6}constraint
|
||||
olcModuleLoad: {7}syncprov
|
||||
|
||||
dn: cn=schema,cn=config
|
||||
objectClass: olcSchemaConfig
|
||||
cn: schema
|
||||
|
||||
dn: olcDatabase={-1}frontend,cn=config
|
||||
objectClass: olcDatabaseConfig
|
||||
objectClass: olcFrontendConfig
|
||||
olcDatabase: {-1}frontend
|
||||
olcAccess: {0}to *
|
||||
by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage
|
||||
by * break
|
||||
olcAccess: {1}to dn.exact="" by * read
|
||||
olcAccess: {2}to dn.base="cn=Subschema" by * read
|
||||
olcSizeLimit: 500
|
||||
|
||||
dn: olcDatabase={0}config,cn=config
|
||||
objectClass: olcDatabaseConfig
|
||||
olcDatabase: {0}config
|
||||
olcAccess: {0}to *
|
||||
by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage
|
||||
by * break
|
||||
olcRootDN: cn=admin,cn=config
|
||||
|
||||
dn: olcDatabase={1}mdb,cn=config
|
||||
objectClass: olcDatabaseConfig
|
||||
objectClass: olcMdbConfig
|
||||
olcSuffix: cn=config-accesslog
|
||||
olcDbDirectory: /var/lib/ldap/config-accesslog/
|
||||
# Allow reading accesslog only by root
|
||||
olcAccess: {0}to *
|
||||
by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
|
||||
by * break
|
||||
|
||||
dn: olcDatabase={1}monitor,cn=config
|
||||
objectClass: olcDatabaseConfig
|
||||
objectClass: olcMonitorConfig
|
||||
olcDatabase: {1}monitor
|
||||
# Allow reading monitoring only by root
|
||||
olcAccess: {0}to *
|
||||
by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
|
||||
by * break
|
||||
|
||||
# Log all writes to the configuration
|
||||
dn: olcOverlay={0}accesslog,olcDatabase={0}config,cn=config
|
||||
objectClass: olcAccesslogConfig
|
||||
objectClass: olcOverlayConfig
|
||||
objectClass: olcConfig
|
||||
objectClass: top
|
||||
olcOverlay: {0}accesslog
|
||||
olcAccessLogDB: cn=config-accesslog
|
||||
olcAccessLogOps: writes
|
||||
# log are conserved one year and purged every day
|
||||
olcAccessLogPurge: 365+00:00 1+00:00
|
||||
olcAccessLogOld: objectClass=olcConfig
|
||||
|
|
@ -0,0 +1,613 @@
|
|||
client local {
|
||||
shortname = "Dynamic client"
|
||||
ipaddr = 192.168.5.224
|
||||
netmask = 32
|
||||
lifetime = 3600
|
||||
secret = mystrongsecret
|
||||
}
|
||||
|
||||
# Authorization. First preprocess (hints and huntgroups files),
|
||||
# then realms, and finally look in the "users" file.
|
||||
#
|
||||
# Any changes made here should also be made to the "inner-tunnel"
|
||||
# virtual server.
|
||||
#
|
||||
# The order of the realm modules will determine the order that
|
||||
# we try to find a matching realm.
|
||||
#
|
||||
# Make *sure* that 'preprocess' comes before any realm if you
|
||||
# need to setup hints for the remote radius server
|
||||
authorize {
|
||||
|
||||
#
|
||||
# Security settings. Take a User-Name, and do some simple
|
||||
# checks on it, for spaces and other invalid characters. If
|
||||
# it looks like the user is trying to play games, reject it.
|
||||
#
|
||||
# This should probably be enabled by default.
|
||||
#
|
||||
# See policy.conf for the definition of the filter_username policy.
|
||||
#
|
||||
# filter_username
|
||||
|
||||
#
|
||||
# The preprocess module takes care of sanitizing some bizarre
|
||||
# attributes in the request, and turning them into attributes
|
||||
# which are more standard.
|
||||
#
|
||||
# It takes care of processing the 'raddb/hints' and the
|
||||
# 'raddb/huntgroups' files.
|
||||
preprocess
|
||||
|
||||
#
|
||||
# If you want to have a log of authentication requests,
|
||||
# un-comment the following line, and the 'detail auth_log'
|
||||
# section, above.
|
||||
auth_log
|
||||
|
||||
ldap
|
||||
|
||||
#
|
||||
# The chap module will set 'Auth-Type := CHAP' if we are
|
||||
# handling a CHAP request and Auth-Type has not already been set
|
||||
chap
|
||||
|
||||
#
|
||||
# If the users are logging in with an MS-CHAP-Challenge
|
||||
# attribute for authentication, the mschap module will find
|
||||
# the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP'
|
||||
# to the request, which will cause the server to then use
|
||||
# the mschap module for authentication.
|
||||
mschap
|
||||
|
||||
#
|
||||
# If you have a Cisco SIP server authenticating against
|
||||
# FreeRADIUS, uncomment the following line, and the 'digest'
|
||||
# line in the 'authenticate' section.
|
||||
digest
|
||||
|
||||
#
|
||||
# The WiMAX specification says that the Calling-Station-Id
|
||||
# is 6 octets of the MAC. This definition conflicts with
|
||||
# RFC 3580, and all common RADIUS practices. Un-commenting
|
||||
# the "wimax" module here means that it will fix the
|
||||
# Calling-Station-Id attribute to the normal format as
|
||||
# specified in RFC 3580 Section 3.21
|
||||
# wimax
|
||||
|
||||
#
|
||||
# Look for IPASS style 'realm/', and if not found, look for
|
||||
# '@realm', and decide whether or not to proxy, based on
|
||||
# that.
|
||||
# IPASS
|
||||
|
||||
#
|
||||
# If you are using multiple kinds of realms, you probably
|
||||
# want to set "ignore_null = yes" for all of them.
|
||||
# Otherwise, when the first style of realm doesn't match,
|
||||
# the other styles won't be checked.
|
||||
#
|
||||
suffix
|
||||
# ntdomain
|
||||
|
||||
#
|
||||
# This module takes care of EAP-MD5, EAP-TLS, and EAP-LEAP
|
||||
# authentication.
|
||||
#
|
||||
# It also sets the EAP-Type attribute in the request
|
||||
# attribute list to the EAP type from the packet.
|
||||
#
|
||||
# As of 2.0, the EAP module returns "ok" in the authorize stage
|
||||
# for TTLS and PEAP. In 1.x, it never returned "ok" here, so
|
||||
# this change is compatible with older configurations.
|
||||
#
|
||||
# The example below uses module failover to avoid querying all
|
||||
# of the following modules if the EAP module returns "ok".
|
||||
# Therefore, your LDAP and/or SQL servers will not be queried
|
||||
# for the many packets that go back and forth to set up TTLS
|
||||
# or PEAP. The load on those servers will therefore be reduced.
|
||||
#
|
||||
eap {
|
||||
ok = return
|
||||
}
|
||||
|
||||
#
|
||||
# Pull crypt'd passwords from /etc/passwd or /etc/shadow,
|
||||
# using the system API's to get the password. If you want
|
||||
# to read /etc/passwd or /etc/shadow directly, see the
|
||||
# passwd module in radiusd.conf.
|
||||
#
|
||||
# unix
|
||||
|
||||
#
|
||||
# Read the 'users' file
|
||||
# files
|
||||
|
||||
#
|
||||
# Look in an SQL database. The schema of the database
|
||||
# is meant to mirror the "users" file.
|
||||
#
|
||||
# See "Authorization Queries" in sql.conf
|
||||
# sql
|
||||
|
||||
#
|
||||
# If you are using /etc/smbpasswd, and are also doing
|
||||
# mschap authentication, the un-comment this line, and
|
||||
# configure the 'smbpasswd' module.
|
||||
# smbpasswd
|
||||
|
||||
exec
|
||||
#
|
||||
# The ldap module will set Auth-Type to LDAP if it has not
|
||||
# already been set
|
||||
|
||||
#
|
||||
# Enforce daily limits on time spent logged in.
|
||||
# daily
|
||||
|
||||
#
|
||||
# Use the checkval module
|
||||
# checkval
|
||||
|
||||
expiration
|
||||
logintime
|
||||
|
||||
#
|
||||
# If no other module has claimed responsibility for
|
||||
# authentication, then try to use PAP. This allows the
|
||||
# other modules listed above to add a "known good" password
|
||||
# to the request, and to do nothing else. The PAP module
|
||||
# will then see that password, and use it to do PAP
|
||||
# authentication.
|
||||
#
|
||||
# This module should be listed last, so that the other modules
|
||||
# get a chance to set Auth-Type for themselves.
|
||||
#
|
||||
pap
|
||||
|
||||
#
|
||||
# If "status_server = yes", then Status-Server messages are passed
|
||||
# through the following section, and ONLY the following section.
|
||||
# This permits you to do DB queries, for example. If the modules
|
||||
# listed here return "fail", then NO response is sent.
|
||||
#
|
||||
# Autz-Type Status-Server {
|
||||
#
|
||||
# }
|
||||
}
|
||||
|
||||
|
||||
# Authentication.
|
||||
#
|
||||
#
|
||||
# This section lists which modules are available for authentication.
|
||||
# Note that it does NOT mean 'try each module in order'. It means
|
||||
# that a module from the 'authorize' section adds a configuration
|
||||
# attribute 'Auth-Type := FOO'. That authentication type is then
|
||||
# used to pick the apropriate module from the list below.
|
||||
#
|
||||
|
||||
# In general, you SHOULD NOT set the Auth-Type attribute. The server
|
||||
# will figure it out on its own, and will do the right thing. The
|
||||
# most common side effect of erroneously setting the Auth-Type
|
||||
# attribute is that one authentication method will work, but the
|
||||
# others will not.
|
||||
#
|
||||
# The common reasons to set the Auth-Type attribute by hand
|
||||
# is to either forcibly reject the user (Auth-Type := Reject),
|
||||
# or to or forcibly accept the user (Auth-Type := Accept).
|
||||
#
|
||||
# Note that Auth-Type := Accept will NOT work with EAP.
|
||||
#
|
||||
# Please do not put "unlang" configurations into the "authenticate"
|
||||
# section. Put them in the "post-auth" section instead. That's what
|
||||
# the post-auth section is for.
|
||||
#
|
||||
authenticate {
|
||||
#
|
||||
# PAP authentication, when a back-end database listed
|
||||
# in the 'authorize' section supplies a password. The
|
||||
# password can be clear-text, or encrypted.
|
||||
Auth-Type PAP {
|
||||
pap
|
||||
}
|
||||
|
||||
#
|
||||
# Most people want CHAP authentication
|
||||
# A back-end database listed in the 'authorize' section
|
||||
# MUST supply a CLEAR TEXT password. Encrypted passwords
|
||||
# won't work.
|
||||
Auth-Type CHAP {
|
||||
chap
|
||||
}
|
||||
|
||||
#
|
||||
# MSCHAP authentication.
|
||||
Auth-Type MS-CHAP {
|
||||
mschap
|
||||
}
|
||||
|
||||
#
|
||||
# If you have a Cisco SIP server authenticating against
|
||||
# FreeRADIUS, uncomment the following line, and the 'digest'
|
||||
# line in the 'authorize' section.
|
||||
digest
|
||||
|
||||
#
|
||||
# Pluggable Authentication Modules.
|
||||
# pam
|
||||
|
||||
#
|
||||
# See 'man getpwent' for information on how the 'unix'
|
||||
# module checks the users password. Note that packets
|
||||
# containing CHAP-Password attributes CANNOT be authenticated
|
||||
# against /etc/passwd! See the FAQ for details.
|
||||
#
|
||||
# For normal "crypt" authentication, the "pap" module should
|
||||
# be used instead of the "unix" module. The "unix" module should
|
||||
# be used for authentication ONLY for compatibility with legacy
|
||||
# FreeRADIUS configurations.
|
||||
#
|
||||
unix
|
||||
|
||||
# Uncomment it if you want to use ldap for authentication
|
||||
#
|
||||
# Note that this means "check plain-text password against
|
||||
# the ldap database", which means that EAP won't work,
|
||||
# as it does not supply a plain-text password.
|
||||
Auth-Type LDAP {
|
||||
ldap
|
||||
}
|
||||
|
||||
#
|
||||
# Allow EAP authentication.
|
||||
eap
|
||||
|
||||
#
|
||||
# The older configurations sent a number of attributes in
|
||||
# Access-Challenge packets, which wasn't strictly correct.
|
||||
# If you want to filter out these attributes, uncomment
|
||||
# the following lines.
|
||||
#
|
||||
# Auth-Type eap {
|
||||
# eap {
|
||||
# handled = 1
|
||||
# }
|
||||
# if (handled && (Response-Packet-Type == Access-Challenge)) {
|
||||
# attr_filter.access_challenge.post-auth
|
||||
# handled # override the "updated" code from attr_filter
|
||||
# }
|
||||
# }
|
||||
}
|
||||
|
||||
|
||||
#
|
||||
# Pre-accounting. Decide which accounting type to use.
|
||||
#
|
||||
preacct {
|
||||
preprocess
|
||||
|
||||
#
|
||||
# Session start times are *implied* in RADIUS.
|
||||
# The NAS never sends a "start time". Instead, it sends
|
||||
# a start packet, *possibly* with an Acct-Delay-Time.
|
||||
# The server is supposed to conclude that the start time
|
||||
# was "Acct-Delay-Time" seconds in the past.
|
||||
#
|
||||
# The code below creates an explicit start time, which can
|
||||
# then be used in other modules.
|
||||
#
|
||||
# The start time is: NOW - delay - session_length
|
||||
#
|
||||
|
||||
# update request {
|
||||
# FreeRADIUS-Acct-Session-Start-Time = "%{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}}"
|
||||
# }
|
||||
|
||||
|
||||
#
|
||||
# Ensure that we have a semi-unique identifier for every
|
||||
# request, and many NAS boxes are broken.
|
||||
acct_unique
|
||||
|
||||
#
|
||||
# Look for IPASS-style 'realm/', and if not found, look for
|
||||
# '@realm', and decide whether or not to proxy, based on
|
||||
# that.
|
||||
#
|
||||
# Accounting requests are generally proxied to the same
|
||||
# home server as authentication requests.
|
||||
# IPASS
|
||||
suffix
|
||||
# ntdomain
|
||||
|
||||
#
|
||||
# Read the 'acct_users' file
|
||||
files
|
||||
}
|
||||
|
||||
#
|
||||
# Accounting. Log the accounting data.
|
||||
#
|
||||
accounting {
|
||||
#
|
||||
# Create a 'detail'ed log of the packets.
|
||||
# Note that accounting requests which are proxied
|
||||
# are also logged in the detail file.
|
||||
detail
|
||||
# daily
|
||||
|
||||
# Update the wtmp file
|
||||
#
|
||||
# If you don't use "radlast", you can delete this line.
|
||||
# unix
|
||||
|
||||
#
|
||||
# For Simultaneous-Use tracking.
|
||||
#
|
||||
# Due to packet losses in the network, the data here
|
||||
# may be incorrect. There is little we can do about it.
|
||||
# radutmp
|
||||
# sradutmp
|
||||
|
||||
# Return an address to the IP Pool when we see a stop record.
|
||||
# main_pool
|
||||
|
||||
#
|
||||
# Log traffic to an SQL database.
|
||||
#
|
||||
# See "Accounting queries" in sql.conf
|
||||
# sql
|
||||
|
||||
#
|
||||
# If you receive stop packets with zero session length,
|
||||
# they will NOT be logged in the database. The SQL module
|
||||
# will print a message (only in debugging mode), and will
|
||||
# return "noop".
|
||||
#
|
||||
# You can ignore these packets by uncommenting the following
|
||||
# three lines. Otherwise, the server will not respond to the
|
||||
# accounting request, and the NAS will retransmit.
|
||||
#
|
||||
# if (noop) {
|
||||
# ok
|
||||
# }
|
||||
|
||||
#
|
||||
# Instead of sending the query to the SQL server,
|
||||
# write it into a log file.
|
||||
#
|
||||
# sql_log
|
||||
|
||||
# Cisco VoIP specific bulk accounting
|
||||
# pgsql-voip
|
||||
|
||||
# For Exec-Program and Exec-Program-Wait
|
||||
exec
|
||||
|
||||
# Filter attributes from the accounting response.
|
||||
attr_filter.accounting_response
|
||||
|
||||
#
|
||||
# See "Autz-Type Status-Server" for how this works.
|
||||
#
|
||||
# Acct-Type Status-Server {
|
||||
#
|
||||
# }
|
||||
}
|
||||
|
||||
|
||||
# Session database, used for checking Simultaneous-Use. Either the radutmp
|
||||
# or rlm_sql module can handle this.
|
||||
# The rlm_sql module is *much* faster
|
||||
session {
|
||||
radutmp
|
||||
|
||||
#
|
||||
# See "Simultaneous Use Checking Queries" in sql.conf
|
||||
# sql
|
||||
}
|
||||
|
||||
|
||||
# Post-Authentication
|
||||
# Once we KNOW that the user has been authenticated, there are
|
||||
# additional steps we can take.
|
||||
post-auth {
|
||||
# Get an address from the IP Pool.
|
||||
# main_pool
|
||||
|
||||
#
|
||||
# If you want to have a log of authentication replies,
|
||||
# un-comment the following line, and the 'detail reply_log'
|
||||
# section, above.
|
||||
# reply_log
|
||||
|
||||
#
|
||||
# After authenticating the user, do another SQL query.
|
||||
#
|
||||
# See "Authentication Logging Queries" in sql.conf
|
||||
# sql
|
||||
|
||||
#
|
||||
# Instead of sending the query to the SQL server,
|
||||
# write it into a log file.
|
||||
#
|
||||
# sql_log
|
||||
|
||||
#
|
||||
# Un-comment the following if you have set
|
||||
# 'edir_account_policy_check = yes' in the ldap module sub-section of
|
||||
# the 'modules' section.
|
||||
#
|
||||
# ldap
|
||||
|
||||
# For Exec-Program and Exec-Program-Wait
|
||||
exec
|
||||
|
||||
#
|
||||
# Calculate the various WiMAX keys. In order for this to work,
|
||||
# you will need to define the WiMAX NAI, usually via
|
||||
#
|
||||
# update request {
|
||||
# WiMAX-MN-NAI = "%{User-Name}"
|
||||
# }
|
||||
#
|
||||
# If you want various keys to be calculated, you will need to
|
||||
# update the reply with "template" values. The module will see
|
||||
# this, and replace the template values with the correct ones
|
||||
# taken from the cryptographic calculations. e.g.
|
||||
#
|
||||
# update reply {
|
||||
# WiMAX-FA-RK-Key = 0x00
|
||||
# WiMAX-MSK = "%{EAP-MSK}"
|
||||
# }
|
||||
#
|
||||
# You may want to delete the MS-MPPE-*-Keys from the reply,
|
||||
# as some WiMAX clients behave badly when those attributes
|
||||
# are included. See "raddb/modules/wimax", configuration
|
||||
# entry "delete_mppe_keys" for more information.
|
||||
#
|
||||
# wimax
|
||||
|
||||
# If there is a client certificate (EAP-TLS, sometimes PEAP
|
||||
# and TTLS), then some attributes are filled out after the
|
||||
# certificate verification has been performed. These fields
|
||||
# MAY be available during the authentication, or they may be
|
||||
# available only in the "post-auth" section.
|
||||
#
|
||||
# The first set of attributes contains information about the
|
||||
# issuing certificate which is being used. The second
|
||||
# contains information about the client certificate (if
|
||||
# available).
|
||||
#
|
||||
# update reply {
|
||||
# Reply-Message += "%{TLS-Cert-Serial}"
|
||||
# Reply-Message += "%{TLS-Cert-Expiration}"
|
||||
# Reply-Message += "%{TLS-Cert-Subject}"
|
||||
# Reply-Message += "%{TLS-Cert-Issuer}"
|
||||
# Reply-Message += "%{TLS-Cert-Common-Name}"
|
||||
# Reply-Message += "%{TLS-Cert-Subject-Alt-Name-Email}"
|
||||
#
|
||||
# Reply-Message += "%{TLS-Client-Cert-Serial}"
|
||||
# Reply-Message += "%{TLS-Client-Cert-Expiration}"
|
||||
# Reply-Message += "%{TLS-Client-Cert-Subject}"
|
||||
# Reply-Message += "%{TLS-Client-Cert-Issuer}"
|
||||
# Reply-Message += "%{TLS-Client-Cert-Common-Name}"
|
||||
# Reply-Message += "%{TLS-Client-Cert-Subject-Alt-Name-Email}"
|
||||
# }
|
||||
|
||||
# MacSEC requires the use of EAP-Key-Name. However, we don't
|
||||
# want to send it for all EAP sessions. Therefore, the EAP
|
||||
# modules put required data into the EAP-Session-Id attribute.
|
||||
# This attribute is never put into a request or reply packet.
|
||||
#
|
||||
# Uncomment the next few lines to copy the required data into
|
||||
# the EAP-Key-Name attribute
|
||||
# if (reply:EAP-Session-Id) {
|
||||
# update reply {
|
||||
# EAP-Key-Name := "%{reply:EAP-Session-Id}"
|
||||
# }
|
||||
# }
|
||||
|
||||
# If the WiMAX module did it's work, you may want to do more
|
||||
# things here, like delete the MS-MPPE-*-Key attributes.
|
||||
#
|
||||
# if (updated) {
|
||||
# update reply {
|
||||
# MS-MPPE-Recv-Key !* 0x00
|
||||
# MS-MPPE-Send-Key !* 0x00
|
||||
# }
|
||||
# }
|
||||
|
||||
#
|
||||
# Access-Reject packets are sent through the REJECT sub-section of the
|
||||
# post-auth section.
|
||||
#
|
||||
# Add the ldap module name (or instance) if you have set
|
||||
# 'edir_account_policy_check = yes' in the ldap module configuration
|
||||
#
|
||||
Post-Auth-Type REJECT {
|
||||
# log failed authentications in SQL, too.
|
||||
# sql
|
||||
attr_filter.access_reject
|
||||
}
|
||||
}
|
||||
|
||||
#
|
||||
# When the server decides to proxy a request to a home server,
|
||||
# the proxied request is first passed through the pre-proxy
|
||||
# stage. This stage can re-write the request, or decide to
|
||||
# cancel the proxy.
|
||||
#
|
||||
# Only a few modules currently have this method.
|
||||
#
|
||||
pre-proxy {
|
||||
# attr_rewrite
|
||||
|
||||
# Uncomment the following line if you want to change attributes
|
||||
# as defined in the preproxy_users file.
|
||||
# files
|
||||
|
||||
# Uncomment the following line if you want to filter requests
|
||||
# sent to remote servers based on the rules defined in the
|
||||
# 'attrs.pre-proxy' file.
|
||||
# attr_filter.pre-proxy
|
||||
|
||||
# If you want to have a log of packets proxied to a home
|
||||
# server, un-comment the following line, and the
|
||||
# 'detail pre_proxy_log' section, above.
|
||||
# pre_proxy_log
|
||||
}
|
||||
|
||||
#
|
||||
# When the server receives a reply to a request it proxied
|
||||
# to a home server, the request may be massaged here, in the
|
||||
# post-proxy stage.
|
||||
#
|
||||
post-proxy {
|
||||
|
||||
# If you want to have a log of replies from a home server,
|
||||
# un-comment the following line, and the 'detail post_proxy_log'
|
||||
# section, above.
|
||||
# post_proxy_log
|
||||
|
||||
# attr_rewrite
|
||||
|
||||
# Uncomment the following line if you want to filter replies from
|
||||
# remote proxies based on the rules defined in the 'attrs' file.
|
||||
# attr_filter.post-proxy
|
||||
|
||||
#
|
||||
# If you are proxying LEAP, you MUST configure the EAP
|
||||
# module, and you MUST list it here, in the post-proxy
|
||||
# stage.
|
||||
#
|
||||
# You MUST also use the 'nostrip' option in the 'realm'
|
||||
# configuration. Otherwise, the User-Name attribute
|
||||
# in the proxied request will not match the user name
|
||||
# hidden inside of the EAP packet, and the end server will
|
||||
# reject the EAP request.
|
||||
#
|
||||
eap
|
||||
|
||||
#
|
||||
# If the server tries to proxy a request and fails, then the
|
||||
# request is processed through the modules in this section.
|
||||
#
|
||||
# The main use of this section is to permit robust proxying
|
||||
# of accounting packets. The server can be configured to
|
||||
# proxy accounting packets as part of normal processing.
|
||||
# Then, if the home server goes down, accounting packets can
|
||||
# be logged to a local "detail" file, for processing with
|
||||
# radrelay. When the home server comes back up, radrelay
|
||||
# will read the detail file, and send the packets to the
|
||||
# home server.
|
||||
#
|
||||
# With this configuration, the server always responds to
|
||||
# Accounting-Requests from the NAS, but only writes
|
||||
# accounting packets to disk if the home server is down.
|
||||
#
|
||||
# Post-Proxy-Type Fail {
|
||||
# detail
|
||||
# }
|
||||
}
|
||||
|
|
@ -0,0 +1,210 @@
|
|||
# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
|
||||
# CRC32 f395ae99
|
||||
dn: cn=radius,cn=schema,cn=config
|
||||
objectClass: olcSchemaConfig
|
||||
cn: radius
|
||||
olcAttributeTypes: {0}( 1.3.6.1.4.1.3317.4.3.1.1 NAME 'radiusArapFeatures' D
|
||||
ESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SIN
|
||||
GLE-VALUE )
|
||||
olcAttributeTypes: {1}( 1.3.6.1.4.1.3317.4.3.1.2 NAME 'radiusArapSecurity' D
|
||||
ESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SIN
|
||||
GLE-VALUE )
|
||||
olcAttributeTypes: {2}( 1.3.6.1.4.1.3317.4.3.1.3 NAME 'radiusArapZoneAccess'
|
||||
DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 S
|
||||
INGLE-VALUE )
|
||||
olcAttributeTypes: {3}( 1.3.6.1.4.1.3317.4.3.1.44 NAME 'radiusAuthType' DESC
|
||||
'checkItem: Auth-Type' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466
|
||||
.115.121.1.26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {4}( 1.3.6.1.4.1.3317.4.3.1.4 NAME 'radiusCallbackId' DES
|
||||
C 'replyItem: Callback-Id' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1
|
||||
466.115.121.1.26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {5}( 1.3.6.1.4.1.3317.4.3.1.5 NAME 'radiusCallbackNumber'
|
||||
DESC 'replyItem: Callback-Number' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6
|
||||
.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {6}( 1.3.6.1.4.1.3317.4.3.1.6 NAME 'radiusCalledStationId
|
||||
' DESC 'checkItem: Called-Station-Id' EQUALITY caseIgnoreIA5Match SYNTAX 1.
|
||||
3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {7}( 1.3.6.1.4.1.3317.4.3.1.7 NAME 'radiusCallingStationI
|
||||
d' DESC 'checkItem: Calling-Station-Id' EQUALITY caseIgnoreIA5Match SYNTAX
|
||||
1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {8}( 1.3.6.1.4.1.3317.4.3.1.8 NAME 'radiusClass' DESC 're
|
||||
plyItem: Class' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121
|
||||
.1.26 )
|
||||
olcAttributeTypes: {9}( 1.3.6.1.4.1.3317.4.3.1.45 NAME 'radiusClientIPAddres
|
||||
s' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
|
||||
SINGLE-VALUE )
|
||||
olcAttributeTypes: {10}( 1.3.6.1.4.1.3317.4.3.1.9 NAME 'radiusFilterId' DESC
|
||||
'replyItem: Filter-Id' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466
|
||||
.115.121.1.26 )
|
||||
olcAttributeTypes: {11}( 1.3.6.1.4.1.3317.4.3.1.10 NAME 'radiusFramedAppleTa
|
||||
lkLink' DESC 'replyItem: Framed-AppleTalk-Link' EQUALITY caseIgnoreIA5Match
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {12}( 1.3.6.1.4.1.3317.4.3.1.11 NAME 'radiusFramedAppleTa
|
||||
lkNetwork' DESC 'replyItem: Framed-AppleTalk-Network' EQUALITY caseIgnoreIA
|
||||
5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
olcAttributeTypes: {13}( 1.3.6.1.4.1.3317.4.3.1.12 NAME 'radiusFramedAppleTa
|
||||
lkZone' DESC 'replyItem: Framed-AppleTalk-Zone' EQUALITY caseIgnoreIA5Match
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {14}( 1.3.6.1.4.1.3317.4.3.1.13 NAME 'radiusFramedCompres
|
||||
sion' DESC 'replyItem: Framed-Compression' EQUALITY caseIgnoreIA5Match SYNT
|
||||
AX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
olcAttributeTypes: {15}( 1.3.6.1.4.1.3317.4.3.1.14 NAME 'radiusFramedIPAddre
|
||||
ss' DESC 'replyItem: Framed-IP-Address' EQUALITY caseIgnoreIA5Match SYNTAX
|
||||
1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {16}( 1.3.6.1.4.1.3317.4.3.1.15 NAME 'radiusFramedIPNetma
|
||||
sk' DESC 'replyItem: Framed-IP-Netmask' EQUALITY caseIgnoreIA5Match SYNTAX
|
||||
1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {17}( 1.3.6.1.4.1.3317.4.3.1.16 NAME 'radiusFramedIPXNetw
|
||||
ork' DESC 'replyItem: Framed-IPX-Network' EQUALITY caseIgnoreIA5Match SYNTA
|
||||
X 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {18}( 1.3.6.1.4.1.3317.4.3.1.17 NAME 'radiusFramedMTU' DE
|
||||
SC 'replyItem: Framed-MTU' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1
|
||||
466.115.121.1.26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {19}( 1.3.6.1.4.1.3317.4.3.1.18 NAME 'radiusFramedProtoco
|
||||
l' DESC 'replyItem: Framed-Protocol' EQUALITY caseIgnoreIA5Match SYNTAX 1.3
|
||||
.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {20}( 1.3.6.1.4.1.3317.4.3.1.19 NAME 'radiusFramedRoute'
|
||||
DESC 'replyItem: Framed-Route' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4
|
||||
.1.1466.115.121.1.26 )
|
||||
olcAttributeTypes: {21}( 1.3.6.1.4.1.3317.4.3.1.20 NAME 'radiusFramedRouting
|
||||
' DESC 'replyItem: Framed-Routing' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6
|
||||
.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {22}( 1.3.6.1.4.1.3317.4.3.1.46 NAME 'radiusGroupName' DE
|
||||
SC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
olcAttributeTypes: {23}( 1.3.6.1.4.1.3317.4.3.1.47 NAME 'radiusHint' DESC ''
|
||||
EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VA
|
||||
LUE )
|
||||
olcAttributeTypes: {24}( 1.3.6.1.4.1.3317.4.3.1.48 NAME 'radiusHuntgroupName
|
||||
' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
|
||||
)
|
||||
olcAttributeTypes: {25}( 1.3.6.1.4.1.3317.4.3.1.21 NAME 'radiusIdleTimeout'
|
||||
DESC 'replyItem: Idle-Timeout' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4
|
||||
.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {26}( 1.3.6.1.4.1.3317.4.3.1.22 NAME 'radiusLoginIPHost'
|
||||
DESC 'replyItem: Login-IP-Host' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.
|
||||
4.1.1466.115.121.1.26 )
|
||||
olcAttributeTypes: {27}( 1.3.6.1.4.1.3317.4.3.1.23 NAME 'radiusLoginLATGroup
|
||||
' DESC 'replyItem: Login-LAT-Group' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.
|
||||
6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {28}( 1.3.6.1.4.1.3317.4.3.1.24 NAME 'radiusLoginLATNode'
|
||||
DESC 'replyItem: Login-LAT-Node' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.
|
||||
1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {29}( 1.3.6.1.4.1.3317.4.3.1.25 NAME 'radiusLoginLATPort'
|
||||
DESC 'replyItem: Login-LAT-Port' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.
|
||||
1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {30}( 1.3.6.1.4.1.3317.4.3.1.26 NAME 'radiusLoginLATServi
|
||||
ce' DESC 'replyItem: Login-LAT-Service' EQUALITY caseIgnoreIA5Match SYNTAX
|
||||
1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {31}( 1.3.6.1.4.1.3317.4.3.1.27 NAME 'radiusLoginService'
|
||||
DESC 'replyItem: Login-Service' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1
|
||||
.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {32}( 1.3.6.1.4.1.3317.4.3.1.28 NAME 'radiusLoginTCPPort'
|
||||
DESC 'replyItem: Login-TCP-Port' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.
|
||||
1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {33}( 1.3.6.1.4.1.3317.4.3.1.29 NAME 'radiusPasswordRetry
|
||||
' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
|
||||
SINGLE-VALUE )
|
||||
olcAttributeTypes: {34}( 1.3.6.1.4.1.3317.4.3.1.30 NAME 'radiusPortLimit' DE
|
||||
SC 'replyItem: Port-Limit' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1
|
||||
466.115.121.1.26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {35}( 1.3.6.1.4.1.3317.4.3.1.49 NAME 'radiusProfileDn' DE
|
||||
SC '' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
|
||||
SINGLE-VALUE )
|
||||
olcAttributeTypes: {36}( 1.3.6.1.4.1.3317.4.3.1.31 NAME 'radiusPrompt' DESC
|
||||
'' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-
|
||||
VALUE )
|
||||
olcAttributeTypes: {37}( 1.3.6.1.4.1.3317.4.3.1.50 NAME 'radiusProxyToRealm'
|
||||
DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 S
|
||||
INGLE-VALUE )
|
||||
olcAttributeTypes: {38}( 1.3.6.1.4.1.3317.4.3.1.51 NAME 'radiusReplicateToRe
|
||||
alm' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.
|
||||
26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {39}( 1.3.6.1.4.1.3317.4.3.1.52 NAME 'radiusRealm' DESC '
|
||||
' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-V
|
||||
ALUE )
|
||||
olcAttributeTypes: {40}( 1.3.6.1.4.1.3317.4.3.1.32 NAME 'radiusServiceType'
|
||||
DESC 'replyItem: Service-Type' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4
|
||||
.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {41}( 1.3.6.1.4.1.3317.4.3.1.33 NAME 'radiusSessionTimeou
|
||||
t' DESC 'replyItem: Session-Timeout' EQUALITY caseIgnoreIA5Match SYNTAX 1.3
|
||||
.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {42}( 1.3.6.1.4.1.3317.4.3.1.34 NAME 'radiusTerminationAc
|
||||
tion' DESC 'replyItem: Termination-Action' EQUALITY caseIgnoreIA5Match SYNT
|
||||
AX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {43}( 1.3.6.1.4.1.3317.4.3.1.35 NAME 'radiusTunnelAssignm
|
||||
entId' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.
|
||||
1.26 )
|
||||
olcAttributeTypes: {44}( 1.3.6.1.4.1.3317.4.3.1.36 NAME 'radiusTunnelMediumT
|
||||
ype' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.
|
||||
26 )
|
||||
olcAttributeTypes: {45}( 1.3.6.1.4.1.3317.4.3.1.37 NAME 'radiusTunnelPasswor
|
||||
d' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
|
||||
SINGLE-VALUE )
|
||||
olcAttributeTypes: {46}( 1.3.6.1.4.1.3317.4.3.1.38 NAME 'radiusTunnelPrefere
|
||||
nce' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.
|
||||
26 )
|
||||
olcAttributeTypes: {47}( 1.3.6.1.4.1.3317.4.3.1.39 NAME 'radiusTunnelPrivate
|
||||
GroupId' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.12
|
||||
1.1.26 )
|
||||
olcAttributeTypes: {48}( 1.3.6.1.4.1.3317.4.3.1.40 NAME 'radiusTunnelServerE
|
||||
ndpoint' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.12
|
||||
1.1.26 )
|
||||
olcAttributeTypes: {49}( 1.3.6.1.4.1.3317.4.3.1.41 NAME 'radiusTunnelType' D
|
||||
ESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
olcAttributeTypes: {50}( 1.3.6.1.4.1.3317.4.3.1.42 NAME 'radiusVSA' DESC ''
|
||||
EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||
olcAttributeTypes: {51}( 1.3.6.1.4.1.3317.4.3.1.43 NAME 'radiusTunnelClientE
|
||||
ndpoint' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.12
|
||||
1.1.26 )
|
||||
olcAttributeTypes: {52}( 1.3.6.1.4.1.3317.4.3.1.53 NAME 'radiusSimultaneousU
|
||||
se' DESC 'checkItem: Simultaneous-Use' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
|
||||
SINGLE-VALUE )
|
||||
olcAttributeTypes: {53}( 1.3.6.1.4.1.3317.4.3.1.54 NAME 'radiusLoginTime' DE
|
||||
SC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SING
|
||||
LE-VALUE )
|
||||
olcAttributeTypes: {54}( 1.3.6.1.4.1.3317.4.3.1.55 NAME 'radiusUserCategory'
|
||||
DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 S
|
||||
INGLE-VALUE )
|
||||
olcAttributeTypes: {55}( 1.3.6.1.4.1.3317.4.3.1.56 NAME 'radiusStripUserName
|
||||
' DESC '' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
|
||||
olcAttributeTypes: {56}( 1.3.6.1.4.1.3317.4.3.1.57 NAME 'dialupAccess' DESC
|
||||
'' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-
|
||||
VALUE )
|
||||
olcAttributeTypes: {57}( 1.3.6.1.4.1.3317.4.3.1.58 NAME 'radiusExpiration' D
|
||||
ESC 'checkItem: Expiration' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.
|
||||
1466.115.121.1.26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {58}( 1.3.6.1.4.1.3317.4.3.1.59 NAME 'radiusCheckItem' DE
|
||||
SC 'checkItem: $GENERIC$' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.14
|
||||
66.115.121.1.26 )
|
||||
olcAttributeTypes: {59}( 1.3.6.1.4.1.3317.4.3.1.60 NAME 'radiusReplyItem' DE
|
||||
SC 'replyItem: $GENERIC$' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.14
|
||||
66.115.121.1.26 )
|
||||
olcAttributeTypes: {60}( 1.3.6.1.4.1.3317.4.3.1.61 NAME 'radiusNASIpAddress'
|
||||
DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 S
|
||||
INGLE-VALUE )
|
||||
olcAttributeTypes: {61}( 1.3.6.1.4.1.3317.4.3.1.62 NAME 'radiusReplyMessage'
|
||||
DESC 'replyItem: Reply-Message' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1
|
||||
.4.1.1466.115.121.1.26 )
|
||||
olcObjectClasses: {0}( 1.3.6.1.4.1.3317.4.3.2.1 NAME 'radiusprofile' DESC ''
|
||||
SUP top AUXILIARY MUST cn MAY ( radiusArapFeatures $ radiusArapSecurity $
|
||||
radiusArapZoneAccess $ radiusAuthType $ radiusCallbackId $ radiusCallbackNu
|
||||
mber $ radiusCalledStationId $ radiusCallingStationId $ radiusClass $ radiu
|
||||
sClientIPAddress $ radiusFilterId $ radiusFramedAppleTalkLink $ radiusFrame
|
||||
dAppleTalkNetwork $ radiusFramedAppleTalkZone $ radiusFramedCompression $ r
|
||||
adiusFramedIPAddress $ radiusFramedIPNetmask $ radiusFramedIPXNetwork $ rad
|
||||
iusFramedMTU $ radiusFramedProtocol $ radiusCheckItem $ radiusReplyItem $ r
|
||||
adiusFramedRoute $ radiusFramedRouting $ radiusIdleTimeout $ radiusGroupNam
|
||||
e $ radiusHint $ radiusHuntgroupName $ radiusLoginIPHost $ radiusLoginLATGr
|
||||
oup $ radiusLoginLATNode $ radiusLoginLATPort $ radiusLoginLATService $ rad
|
||||
iusLoginService $ radiusLoginTCPPort $ radiusLoginTime $ radiusPasswordRetr
|
||||
y $ radiusPortLimit $ radiusPrompt $ radiusProxyToRealm $ radiusRealm $ rad
|
||||
iusReplicateToRealm $ radiusServiceType $ radiusSessionTimeout $ radiusStri
|
||||
pUserName $ radiusTerminationAction $ radiusTunnelClientEndpoint $ radiusPr
|
||||
ofileDn $ radiusSimultaneousUse $ radiusTunnelAssignmentId $ radiusTunnelMe
|
||||
diumType $ radiusTunnelPassword $ radiusTunnelPreference $ radiusTunnelPriv
|
||||
ateGroupId $ radiusTunnelServerEndpoint $ radiusTunnelType $ radiusUserCate
|
||||
gory $ radiusVSA $ radiusExpiration $ dialupAccess $ radiusNASIpAddress $ r
|
||||
adiusReplyMessage ) )
|
||||
olcObjectClasses: {1}( 1.3.6.1.4.1.3317.4.3.2.2 NAME 'radiusObjectProfile' D
|
||||
ESC 'A Container Objectclass to be used for creating radius profile object'
|
||||
SUP top STRUCTURAL MUST cn MAY ( uid $ userPassword $ description ) )
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
#!/bin/sh
|
||||
# Do initial configuration of slapd
|
||||
|
||||
set -e
|
||||
|
||||
BASEDIR=`dirname $0`
|
||||
|
||||
service slapd stop || true
|
||||
BACKUPDIR="/var/backup/reset-ldap-`date +%Y%m%dT%H:%M:%S`"
|
||||
mkdir -p "$BACKUPDIR"
|
||||
echo Old configuration saved in $BACKUPDIR
|
||||
cp -R /var/lib/ldap /etc/ldap/slapd.d/ "$BACKUPDIR"
|
||||
rm -rf /var/lib/ldap/* /etc/ldap/slapd.d/*
|
||||
mkdir /var/lib/ldap/config-accesslog/
|
||||
|
||||
echo Load overlay modules, configure auditlog for cn=config, create cn=monitor db
|
||||
slapadd -n0 -F/etc/ldap/slapd.d -l"$BASEDIR/config.ldif"
|
||||
slapadd -n0 -F/etc/ldap/slapd.d -l"/etc/ldap/schema/core.ldif"
|
||||
slapadd -n0 -F/etc/ldap/slapd.d -l"/etc/ldap/schema/cosine.ldif"
|
||||
slapadd -n0 -F/etc/ldap/slapd.d -l"/etc/ldap/schema/inetorgperson.ldif"
|
||||
slapadd -n0 -F/etc/ldap/slapd.d -l"$BASEDIR/radius.ldif"
|
||||
|
||||
chown -R openldap.openldap /etc/ldap/slapd.d /var/lib/ldap
|
||||
|
||||
service slapd start
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
#!/bin/sh
|
||||
|
||||
ME=`basename $0`
|
||||
COMMANDDIR=`dirname $0`/lib
|
||||
test -d ${COMMANDDIR} || COMMANDDIR=/usr/lib/`basename $0`
|
||||
|
||||
help() {
|
||||
msg="$1"
|
||||
test -n "$msg" && echo $msg
|
||||
echo "syntaxe: $ME commande ..."
|
||||
echo ""
|
||||
echo "commandes disponibles:"
|
||||
echo " help cette aide"
|
||||
for fcom in $COMMANDDIR/*.help
|
||||
do
|
||||
com=`basename $fcom .help`
|
||||
descr=`head -1 $fcom`
|
||||
echo " "$com" "$descr
|
||||
done
|
||||
test -n "$msg" && exit 1
|
||||
exit 0
|
||||
}
|
||||
|
||||
helpcmd() {
|
||||
command=$1
|
||||
xcommand=$COMMANDDIR/$command
|
||||
test -x $xcommand || help "ERR: commande inconnue ($command)"
|
||||
echo "$ME $command"
|
||||
cat $xcommand.help
|
||||
}
|
||||
|
||||
command=$1
|
||||
test -z $command && help "ERR: commande manquante"
|
||||
shift
|
||||
|
||||
case $command in
|
||||
help)
|
||||
test -z "$1" && help
|
||||
helpcmd $1
|
||||
;;
|
||||
*)
|
||||
xcommand=$COMMANDDIR/$command
|
||||
test -x $xcommand || help "ERR: commande inconnue ($command)"
|
||||
$xcommand "$@"
|
||||
;;
|
||||
esac
|
||||
Reference in New Issue