--- /dev/null
+#
+# proxy.conf - proxy radius and realm configuration directives
+#
+# This file is included by default. To disable it, you will need
+# to modify the PROXY CONFIGURATION section of "radiusd.conf".
+#
+#######################################################################
+#
+# Proxy server configuration
+#
+# This entry controls the servers behaviour towards ALL other servers
+# to which it sends proxy requests.
+#
+proxy server {
+
+#
+# If the NAS re-sends the request to us, we can immediately re-send
+# the proxy request to the end server. To do so, use 'yes' here.
+#
+# If this is set to 'no', then we send the retries on our own schedule,
+# and ignore any duplicate NAS requests.
+#
+# If you want to have the server send proxy retries ONLY when the NAS
+# sends it's retries to the server, then set this to 'yes', and
+# set the other proxy configuration parameters to 0 (zero).
+#
+# Additionally, if you want 'failover' to work, the server must manage
+# retries and timeouts. Therefore, if this is set to yes, then no
+# failover functionality is possible.
+#
+ synchronous = no
+
+#
+# The time (in seconds) to wait for a response from the proxy, before
+# re-sending the proxied request.
+#
+# If this time is set too high, then the NAS may re-send the request,
+# or it may give up entirely, and reject the user.
+#
+# If it is set too low, then the RADIUS server which receives the proxy
+# request will get kicked unnecessarily.
+#
+ retry_delay = 5
+
+#
+# The number of retries to send before giving up, and sending a reject
+# message to the NAS.
+#
+ retry_count = 3
+
+#
+# If the home server does not respond to any of the multiple retries,
+# then FreeRADIUS will stop sending it proxy requests, and mark it 'dead'.
+#
+# If there are multiple entries configured for this realm, then the
+# server will fail-over to the next one listed. If no more are listed,
+# then no requests will be proxied to that realm.
+#
+#
+# After a configurable 'dead_time', in seconds, FreeRADIUS will
+# speculatively mark the home server active, and start sending requests
+# to it again.
+#
+# If this dead time is set too low, then you will lose requests,
+# as FreeRADIUS will quickly switch back to the home server, even if
+# it isn't up again.
+#
+# If this dead time is set too high, then FreeRADIUS may take too long
+# to switch back to the primary home server.
+#
+# Realistic values for this number are in the range of minutes to hours.
+# (60 to 3600)
+#
+ dead_time = 120
+
+# An ldflag attribute for all realms to be included in a round-robin
+# setup must be specified, and that ldflag must be the same for all
+# realms of the same name.
+# Currently (0 or fail_over) and (1 or round_robin) are the
+# supported values for ldflag. Fail over is the default setup.
+#
+# DO NOT INCLUDE LOCAL AUTH/ACCT HOST REALMS IN A ROUND-ROBIN QUEUE.
+
+
+#
+# If all exact matching realms did not respond, we can try the
+# DEFAULT realm, too. This is what the server normally does.
+#
+# This behaviour may be undesired for some cases. e.g. You are proxying
+# for two different ISP's, and then act as a general dial-up for Gric.
+# If one of the first two ISP's has their RADIUS server go down, you do
+# NOT want to proxy those requests to GRIC. Instead, you probably want
+# to just drop the requests on the floor. In that case, set this value
+# to 'no'.
+#
+# allowed values: {yes, no}
+#
+ default_fallback = yes
+
+#
+# Older versions of the server would pass proxy requests through the
+# 'authorize' sections twice; once when the packet was received
+# from the NAS, and again after the reply was received from the home
+# server. Now that we have a 'post_proxy' section, the replies from
+# the home server should be sent through that, instead of through
+# the 'authorize' section again.
+#
+# However, for backwards compatibility, this behaviour is configurable.
+# The default configuration is 'no', because this option is deprecated
+# and will be removed in the future.
+#
+# allowed values: {yes, no}
+#
+ post_proxy_authorize = no
+
+}
+
+#######################################################################
+#
+# Configuration for the proxy realms.
+#
+# The information given here is used in conjunction with the 'realms'
+# file. This format is preferred, as it is more flexible. The realms
+# listed here take priority over those listed in the 'realms' file.
+
+# A standard realm entry. A request from "user@company.com" will be
+# sent to radius.company.com as "user", unless the 'nostrip'
+# configuration item is specified. If the 'nostrip' configuration
+# item is specified, then the request will be proxied as
+# "user@company.com"
+#
+#realm company.com {
+# type = radius
+# authhost = radius.company.com:1600
+# accthost = radius.company.com:1601
+# secret = testing123
+#}
+
+# A realm entry with an optional fail-over realm. A request from
+# "user@isp2.com" will be sent to radius.isp2.com as "user@isp2.com",
+# because the 'nostrip' directive is specified for this realm.
+#
+#realm isp2.com {
+# type = radius
+# authhost = radius.isp2.com:1645
+# accthost = radius.isp2.com:1646
+# secret = TheirKey
+# nostrip
+#}
+#
+# The fail-over realm for isp2.com
+#
+#realm isp2.com {
+# type = radius
+# authhost = radius2.isp2.com:1645
+# accthost = radius2.isp2.com:1646
+# secret = TheirKey2
+# nostrip
+#}
+
+#
+# 1st node serv.com...set up for round-robin.
+#
+# The load balancing 'ldflag' attribute can be used to perform
+# load balancing. Allowed values are 'fail_over' and 'round_robin'.
+#
+# If there is no ldflag attribute, or it is set to 'fail_over', then
+# the realms are treated as "fail-over". That is, the first matching
+# realm is used, unless it is down, in which case the realm "fails
+# over" to the second matching realm. The process continues until an
+# active matching realm is found, OR the DEFAULT realm is returned.
+#
+# If the ldflag attribute is set to 'round_robin', then all active
+# realms of the same name are put into a pool internally in the
+# server, and the proxied requests are evenly divided among the
+# realms in the pool. For this to work, all realms of the same name
+# MUST have the same value of their 'ldflag' attributes. Mixing up
+# different types of load balancing schemes for the same realm will
+# cause problems.
+#
+# The round_robin load balancing method is a probabilistic method
+# which evenly scatters the requests among the home servers.
+#
+# Note that you CANNOT include local auth/acct host realms in a
+# round-robin queue. Having a server load balance requests to itself
+# doesn't make any sense, as it only doubles the amount of work
+# which is needed to be done.
+#
+#realm serv.com {
+# type = radius
+# authhost = radius.serv.com:1645
+# accthost = radius.serv.com:1646
+# secret = TheirKey
+# ldflag = round_robin
+# nostrip
+#}
+
+#
+# Another node for serv.com
+#
+#realm serv.com {
+# type = radius
+# authhost = radius2.serv.com:1645
+# accthost = radius2.serv.com:1646
+# secret = TheirKey2
+# ldflag = round_robin
+# nostrip
+#}
+
+#
+# A third round-robin node realm for serv.com
+#
+#realm serv.com {
+# type = radius
+# authhost = radius3.serv.com:1645
+# accthost = radius3.serv.com:1646
+# secret = TheirKey2
+# ldflag = round_robin
+# nostrip
+#}
+#
+#
+
+#
+# This is a local realm. The requests are NOT proxied,
+# but instead are authenticated by the RADIUS server itself.
+#
+# You don't need a secret if BOTH 'authhost' and 'accthost' are
+# set to LOCAL.
+#
+#realm bla.com {
+# type = radius
+# authhost = LOCAL
+# accthost = LOCAL
+#}
+
+#
+# This is a sample entry for iPass.
+#
+#realm IPASS {
+# type = radius
+# authhost = ipass.server.hostname:11812
+# accthost = ipass.server.hostname:11813
+#
+ # The shared secret here must be the same
+ # value as the secret of the NetServer found in the
+ # /usr/ipass/raddb/clients file of your NetServer software.
+# secret = mysecret
+# nostrip
+#}
+
+#
+# This realm is used mainly to cancel proxying. You can have
+# the "realm suffix" module configured to proxy all requests for
+# a realm, and then later cancel the proxying, based on other
+# configuration.
+#
+# For example, you want to terminate PEAP or EAP-TTLS locally,
+# you can add the following to the "users" file:
+#
+# DEFAULT EAP-Type == PEAP, Proxy-To-Realm := LOCAL
+#
+realm LOCAL {
+ type = radius
+ authhost = LOCAL
+ accthost = LOCAL
+}
+
+#
+# This realm is for requests which don't have an explicit realm
+# prefix or suffix. User names like "bob" will match this one.
+#
+#realm NULL {
+# type = radius
+# authhost = radius.company.com:1600
+# accthost = radius.company.com:1601
+# secret = testing123
+#}
+
+#
+# This realm is for ALL OTHER requests.
+#
+#realm DEFAULT {
+# type = radius
+# authhost = radius.company.com:1600
+# accthost = radius.company.com:1601
+# secret = testing123
+#}
projects / carnet-upgrade.git / blobdiff