fD-testbed: conf/radpxy.eap.testbed.aaa/freeradius/experimental.conf comparison

comparison conf/radpxy.eap.testbed.aaa/freeradius/experimental.conf @ 11:44f87917c579

Added a RADIUS proxy using freeradius in the eap testbed

author	Sebastien Decugis <sdecugis@nict.go.jp>
date	Thu, 16 Sep 2010 14:23:42 +0900
parents
children

comparison

equal deleted inserted replaced

-:7b569c198c7c
+:44f87917c579
+#
+#  This file contains the configuration for experimental modules.
+#
+#  By default, it is NOT included in the build.
+#
+#  $Id: experimental.conf,v 1.42 2008/01/19 22:26:30 aland Exp $
+#
+	# Configuration for the Python module.
+	#
+	# Where radiusd is a Python module, radiusd.py, and the
+	# function 'authorize' is called.  Here is a dummy piece
+	# of code:
+	#
+	#	def authorize(params):
+	#	    print params
+	#	    return (5, ('Reply-Message', 'banned'))
+	#
+	# The RADIUS value-pairs are passed as a tuple of tuple
+	# pairs as the first argument, e.g. (('attribute1',
+	# 'value1'), ('attribute2', 'value2'))
+	#
+	# The function return is a tuple with the first element
+	# being the return value of the function.
+	# The 5 corresponds to RLM_MODULE_USERLOCK. I plan to
+	# write the return values as Python symbols to avoid
+	# confusion.
+	#
+	# The remaining tuple members are the string form of
+	# value-pairs which are passed on to pairmake().
+	#
+	python {
+		mod_instantiate = radiusd_test
+		func_instantiate = instantiate
+		mod_authorize = radiusd_test
+		func_authorize = authorize
+		mod_accounting = radiusd_test
+		func_accounting = accounting
+		mod_preproxy = radiusd_test
+		func_preproxy = preproxy
+		mod_postproxy = radiusd_test
+		func_postproxy = postproxy
+		mod_postauth = radiusd_test
+		func_postauth = postauth
+		mod_detach = radiusd_test
+		func_detach = detach
+	}
+	# Configuration for the example module.  Uncommenting it will cause it
+	# to get loaded and initialized, but should have no real effect as long
+	# it is not referencened in one of the autz/auth/preacct/acct sections
+	example {
+		#  Boolean variable.
+		# allowed values: {no, yes}
+		boolean = yes
+		#  An integer, of any value.
+		integer = 16
+		#  A string.
+		string = "This is an example configuration string"
+		# An IP address, either in dotted quad (1.2.3.4) or hostname
+		# (example.com)
+		ipaddr = 127.0.0.1
+		# A subsection
+		mysubsection {
+			anotherinteger = 1000
+			# They nest
+			deeply nested {
+				string = "This is a different string"
+			}
+		}
+	}
+	#
+	#  To create a dbm users file, do:
+	#
+	#   cat test.users | rlm_dbm_parser -f /etc/raddb/users_db
+	#
+	#  Then add 'dbm' in 'authorize' section.
+	#
+	#  Note that even if the file has a ".db" or ".dbm" extension,
+	#  you may have to specify it here without that extension.  This
+	#  is because the DBM libraries "helpfully" add a ".db" to the
+	#  filename, but don't check if it's already there.
+	#
+	dbm {
+		usersfile = ${confdir}/users_db
+	}
+	#
+	#  Persistent, embedded Perl interpreter.
+	#
+	perl {
+		#
+		#  The Perl script to execute on authorize, authenticate,
+		#  accounting, xlat, etc.  This is very similar to using
+		#  'rlm_exec' module, but it is persistent, and therefore
+		#  faster.
+		#
+		module = /path/to/your/perl_module.pm
+		#
+		#  The following hashes are given to the module and
+#  filled with value-pairs (Attribute names and values)
+		#
+		#  %RAD_CHECK		Read-only	Check items
+		#  %RAD_REQUEST		Read-only	Attributes from the request
+		#  %RAD_REPLY		Read-write	Attributes for the reply
+		#
+		#  The return codes from functions in the perl_script
+		#  are passed directly back to the server.  These
+		#  codes are defined in doc/configurable_failover,
+		#  src/include/modules.h (RLM_MODULE_REJECT, etc),
+		#  and are pre-defined in the 'example.pl' program
+		#  which is included.
+		#
+		#
+		#  List of functions in the module to call.
+		#  Uncomment and change if you want to use function
+		#  names other than the defaults.
+		#
+		#func_authenticate = authenticate
+		#func_authorize = authorize
+		#func_preacct = preacct
+		#func_accounting = accounting
+		#func_checksimul = checksimul
+		#func_pre_proxy = pre_proxy
+		#func_post_proxy = post_proxy
+		#func_post_auth = post_auth
+		#func_xlat = xlat
+		#func_detach = detach
+		#
+		#  Uncomment the following lines if you wish
+		#  to use separate functions for Start and Stop
+		#  accounting packets. In that case, the
+		#  func_accounting function is not called.
+		#
+		#func_start_accounting = accounting_start
+		#func_stop_accounting = accounting_stop
+		#  Uncomment the following lines if your perl is
+		#  compiled with threads support.
+		#  The settings below are the defaults.
+		#
+		#max_clones = 32
+		#start_clones = 32
+		#min_spare_clones = 0
+		#max_spare_clones = 32
+		#cleanup_delay = 5
+		#max_request_per_clone = 0
+	}
+	#
+	#  Perform NT-Domain authentication.  This only works
+	#  with PAP authentication.  That is, Authentication-Request
+	#  packets containing a User-Password attribute.
+	#
+	#  To use it, add 'smb' into the 'authenticate' section,
+	#  and then in another module (usually the 'users' file),
+	#  set 'Auth-Type := SMB'
+	#
+	#  WARNING: this module is not only experimental, it's also
+	#  a security threat. It's not recommended to use it until
+	#  it gets fixed.
+	#
+	smb {
+		server = ntdomain.server.example.com
+		backup = backup.server.example.com
+		domain = NTDOMAIN
+	}
+	# See doc/rlm_fastusers before using this
+	# module or changing these values.
+	#
+	fastusers {
+		usersfile = ${confdir}/users_fast
+		hashsize = 1000
+		compat = no
+		# Reload the hash every 600 seconds (10mins)
+		hash_reload = 600
+	}
+	# Caching module
+	#
+	# Should be added in the post-auth section (after all other modules)
+	# and in the authorize section (before any other modules)
+	#
+	# authorize {
+	#	caching {
+	#		ok = return
+	#	}
+	#	[... other modules ...]
+	# }
+	# post-auth {
+	#	[... other modules ...]
+	#	caching
+	# }
+	#
+	# The caching module will cache the Auth-Type and reply items
+	# and send them back on any subsequent requests for the same key
+	#
+	# Configuration:
+	#
+	# filename: The gdbm file to use for the cache database
+	#		(can be memory mapped for more speed)
+	#
+	# key: A string to xlat and use as a key. For instance,
+	#	"%{Acct-Unique-Session-Id}"
+	#
+	# post-auth: If we find a cached entry, set the post-auth to that value
+	#
+	# cache-ttl: The time to cache the entry. The same time format
+	#		as the counter module apply here.
+	#	  num[hdwm] where:
+	#  	h: hours, d: days, w: weeks, m: months
+	#  	If the letter is ommited days will be assumed.
+	#	e.g. 1d == one day
+	#
+	# cache-size: The gdbm cache size to request (default 1000)
+	#
+	# hit-ratio: If set to non-zero we print out statistical
+	#	information after so many cache requests
+	#
+	# cache-rejects: Do we also cache rejects, or not? (default 'yes')
+	#
+	caching {
+		filename = ${db_dir}/db.cache
+		cache-ttl = 1d
+		hit-ratio = 1000
+		key = "%{Acct-Unique-Session-Id}"
+		#post-auth = ""
+		# cache-size = 2000
+		# cache-rejects = yes
+	}
+	# Simple module for logging of Account packets to radiusd.log
+	# You need to declare it in the accounting section for it to work
+	acctlog {
+		acctlog_update = ""
+		acctlog_start = "Connect: [%{User-Name}] (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} ip %{Framed-IP-Address})"
+		acctlog_stop = "Disconnect: [%{User-Name}] (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} ip %{Framed-IP-Address}) %{Acct-Session-Time} seconds"
+		acctlog_on = "NAS %C (%{NAS-IP-Address}) just came online"
+		acctlog_off = "NAS %C (%{NAS-IP-Address}) just went offline"
+	}
+	# Another implementation of the EAP module.
+	#
+	#  This module requires the libeap.so file from the hostap
+	#  software (http://hostap.epitest.fi/hostapd/).  It has been
+	#  tested on the development version of hostapd (0.6.1) ONLY.
+	#
+	#  In order to use it, you MUST build a "libeap.so" in hostapd,
+	#  which is not done by default.
+	#
+	#  You MUST also edit the file: src/modules/rlm_eap2/Makefile
+	#  to point to the location of the hostap include files.
+	#
+	#  This module CANNOT be used in the same way as the current
+	#  FreeRADIUS "eap" module.  There is NO way to look inside of
+	#  a tunneled request.  There is NO way to proxy a tunneled
+	#  request.  There is NO way to even look at the user name inside
+	#  of the tunneled request.  There is NO way to control the
+	#  choice of EAP types inside of the tunnel.  You MUST force
+	#  the server to choose "eap2" for authentication, because this
+	#  module has no "authorize" section.
+	#
+	#  If you want to use this module for experimentation, please
+	#  post your comments to the freeradius-devel list:
+	#
+	#    http://lists.freeradius.org/mailman/listinfo/freeradius-devel
+	#
+	#  If you want to use this module in a production (i.e. real-world)
+	#  environment:
+	#
+	#	!!! DO NOT USE IT IN A PRODUCTION ENVIRONMENT !!!
+	#
+	#  The module needs additional work to make it ready for
+	#  production use..  Please supply patches, or sponsor the
+	#  work by hiring a developer.  Do NOT ask when the work will
+	#  be done, because there is no plan to finish this module
+	#  unless there is demand for it.
+	#
+	eap2 {
+		#  EAP types are chosen in the order that they are
+		#  listed in this section.  There is no "default_eap_type"
+		#  as with rlm_eap.  Instead, the *first* EAP type is
+		#  used as the default type.
+		#
+		peap {
+		}
+		ttls {
+		}
+		#  This is the ONLY EAP type that has any configuration.
+		#  All other EAP types have no configuration.
+		#
+		tls {
+			ca_cert = ${confdir}/certs/ca.pem
+			server_cert = ${confdir}/certs/server.pem
+			private_key_file = ${confdir}/certs/server.pem
+			private_key_password = whatever
+		}
+		#
+		#  These next two methods do not supply keying material.
+		#
+		md5 {
+		}
+		mschapv2 {
+		}
+		#  LEAP is NOT supported by this module.
+		#  Use the "eap" module instead.
+		#  For other methods that MIGHT work, see the
+		#  configuration of hostap.  The methods are statically
+		#  linked in at compile time, and cannot be controlled
+		#  here.
+	}
+	#  Configuration for experimental EAP types.  The sub-sections
+	#  can be copied into eap.conf.
+	eap {
+		ikev2 {
+		# Server auth type
+		# Allowed values are:
+		#  cert   - for certificate based server authentication,
+		#           other required settings for this type are
+		#	    'private_key_file' and 'certificate_file'
+		#  secret - for shared secret based server authentication,
+		#           other required settings for this type is 'id'
+		# Default value of this option is 'secret'
+	#     server_authtype=cert
+		# Allowed default client auth types
+		# Allowed values are:
+		#   secret - for shared secret based client	authentication
+		#   cert   - for certificate based client authentication
+		#   both   - shared secret and certificate is allowed
+		#   none   - authentication will always fail
+		# Default value for this option is 'both'. This option could
+		#  be overwritten within 'usersfile' file by EAP-IKEv2-Auth
+		#  option.
+	#   default_authtype = both
+		# path to trusted CA certificate file
+		CA_file="/path/to/CA/cacert.pem"
+		# path to CRL file, if not set, then there will be no
+		#  checks against CRL
+	#   crl_file="/path/to/crl.pem"
+		# path to file with user settings
+		#
+		#  Note that this file is read ONLY on module initialization!
+		#
+		# default ${confdir}/eap_ikev2_users
+	#   usersfile=${confdir}/eap_ikev2_users
+#
+#  Sample "eap_ikev2_users" file entry:
+#
+#username  EAP-IKEv2-IDType := KEY_ID,  EAP-IKEv2-Secret := "tajne"
+## where:
+## username           - client user name from IKE-AUTH (IDr)  or CommonName
+##                      from x509 certificate
+## EAP-IKEv2-IDType   - ID Type - same as in expected IDType payload
+##	                allowable attributes for EAP-IKEv2-IDType:
+##	                IPV4_ADDR FQDN RFC822_ADDR IPV6_ADDR DER_ASN1_DN
+##			DER_ASN1_GN KEY_ID
+## EAP-IKEv2-Secret   - shared secret
+## EAP-IKEv2-AuthType - optional parameter which defines expected client auth
+##                      type. Allowed values are: secret,cert,both,none.
+##			For the meaning of this values, please see the
+##                      description of 'default_authtype'.
+##                      This attribute can overwrite 'default_authtype' value.
+		# path to  file with server private key
+		private_key_file="/path/to/srv-private-key.pem"
+		# password to private key file
+		private_key_password="passwd"
+		# path to file with server certificate
+		certificate_file="/path/to/srv-cert.pem"
+		# server identity string
+		id="deMaio"
+		# Server identity type. Allowed values are:
+		# IPV4_ADDR, FQDN, RFC822_ADDR, IPV6_ADDR, ASN1_DN, ASN1_GN,
+		#  KEY_ID
+		# Default value is:	KEY_ID
+	#   id_type = KEY_ID
+		# MTU (default: 1398)
+	#   fragment_size = 1398
+		# maximal allowed number of resends SA_INIT after receiving
+		# 'invalid KEY' notification (default 3)
+	#   DH_counter_max = 3
+		# option which is used to control whenever send CERT REQ
+		#  payload or not.
+		# Allowed values for this option are "yes" or "no".
+		#Default value is "no".
+	#   certreq = "yes"
+		# option which cotrols fast reconnect capability.
+		# Allowed valuse for this option are "yes" or "no".
+		# Default value is "yes".
+	#   enable_fast_reauth = "no"
+		# option which is used to control performing of DH exchange
+		#  during fast rekeying protocol run.
+		# Allowed values for this option are "yes" or "no".
+		# Default value is "no"
+	#   fast_DH_exchange = "yes"
+		# Option which is used to set up expiration time of inactive
+		#  IKEv2 session.
+		# After selected period of time (in seconds), inactive
+		# session data will be deleted.
+		# Default value of this option is set to 900 seconds
+	#   fast_timer_expire = 900
+		# list of server proposals of available cryptographic
+		# suites
+		proposals {
+			# proposal number #1
+			proposal {
+				# Supported transforms types: encryption,
+				# prf, integrity, dhgroup. For multiple
+				# transforms just simple repeat key (i.e.
+				# integity).
+				# encryption algorithm
+				# supported algorithms:
+				# null,3des,aes_128_cbc,aes_192_cbc,
+				# aes_256_cbc,idea
+	            		# blowfish:n, where n range from 8 to 448 bits,
+				#  step 8 bits
+				# cast:n, where n range from 40 to 128 bits,
+				#  step 8 bits
+				encryption = 3des
+				# pseudo random function. Supported prf's:
+				# hmac_md5, hmac_sha1, hmac_tiger
+				prf = hmac_sha1
+				# integrity algorithm. Supported algorithms:
+				# hmac_md5_96, hmac_sha1_96,des_mac
+				integrity = hmac_sha1_96
+				integrity = hmac_md5_96
+				# Diffie-Hellman groups:
+				# modp768, modp1024, modp1536, modp2048,
+				# modp3072, modp4096, modp6144, modp8192
+				dhgroup = modp2048
+			}
+			# proposal number #2
+			proposal {
+				encryption = 3des
+				prf = hmac_md5
+				integrity = hmac_md5_96
+				dhgroup = modp1024
+			}
+			# proposal number #3
+			proposal {
+				encryption=3des
+				prf=hmac_md5
+				integrity=hmac_md5_96
+				dhgroup=modp2048
+			}
+		}
+		}
+	}

Mercurial > hg > fD-testbed

comparison conf/radpxy.eap.testbed.aaa/freeradius/experimental.conf @ 11:44f87917c579