# -*- text -*-

prefix = /usr
exec_prefix = /usr
sysconfdir = /etc
localstatedir = /var
sbindir = ${exec_prefix}/sbin
logdir = /var/log/freeradius

raddbdir = /root/conf/freeradius

radacctdir = ${logdir}/radacct
confdir = ${raddbdir}
run_dir = ${localstatedir}/run/freeradius
db_dir = $(raddbdir)
libdir = /usr/lib/freeradius
pidfile = ${run_dir}/freeradius.pid
user = freerad
group = freerad
max_request_time = 30
cleanup_delay = 5
max_requests = 1024
listen {
	type = auth
	ipaddr = *
	port = 0
}
listen {
	ipaddr = *
	port = 0
	type = acct
}
hostname_lookups = no
allow_core_dumps = yes
regular_expressions	= yes
extended_expressions	= yes
log {
	destination = files
	file = ${logdir}/radius.log
	syslog_facility = daemon
	stripped_names = no
	auth = no
	auth_badpass = no
	auth_goodpass = no
}
checkrad = ${sbindir}/checkrad
security {
	max_attributes = 200
	reject_delay = 1
	status_server = yes
}

# PROXY CONFIGURATION
#
#  proxy_requests: Turns proxying of RADIUS requests on or off.
#
#  The server has proxying turned on by default.  If your system is NOT
#  set up to proxy requests to another server, then you can turn proxying
#  off here.  This will save a small amount of resources on the server.
#
#  If you have proxying turned off, and your configuration files say
#  to proxy a request, then an error message will be logged.
#
#  To disable proxying, change the "yes" to "no", and comment the
#  $INCLUDE line.
#
#  allowed values: {no, yes}
#
proxy_requests  = yes
$INCLUDE proxy.conf


# CLIENTS CONFIGURATION
#
#  Client configuration is defined in "clients.conf".  
#

#  The 'clients.conf' file contains all of the information from the old
#  'clients' and 'naslist' configuration files.  We recommend that you
#  do NOT use 'client's or 'naslist', although they are still
#  supported.
#
#  Anything listed in 'clients.conf' will take precedence over the
#  information from the old-style configuration files.
#
$INCLUDE clients.conf


snmp	= no
thread pool {
	start_servers = 5
	max_servers = 32
	min_spare_servers = 3
	max_spare_servers = 10
	max_requests_per_server = 0
}

modules {
	#  'username@realm'
	#
	realm suffix {
		format = suffix
		delimiter = "@"
	}

	preprocess {
		huntgroups = ${confdir}/huntgroups
		hints = ${confdir}/hints
		with_ascend_hack = no
		ascend_channels_per_line = 23
		with_ntdomain_hack = no
		with_specialix_jetstream_hack = no
		with_cisco_vsa_hack = no
	}
	
	files {
		# The default key attribute to use for matches.  The content
		# of this attribute is used to match the "name" of the
		# entry.
		#key = "%{Stripped-User-Name:-%{User-Name}}"

		usersfile = ${confdir}/users
		acctusersfile = ${confdir}/acct_users
		preproxy_usersfile = ${confdir}/preproxy_users

		compat = no
	}

	# Write a detailed log of all accounting records received.
	#
	detail {
		detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d
		detailperm = 0600
		header = "%t"
	}


	detail auth_log {
		detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d

		#
		#  This MUST be 0600, otherwise anyone can read
		#  the users passwords!
		# detailperm = 0600

		# You may also strip out passwords completely
		#suppress {
			# User-Password
		#}
	}
	
	#  This module logs packets proxied to a home server.
	#
	#  You will also need to un-comment the 'pre_proxy_log' line
	#  in the 'pre-proxy' section, below.
	#
	detail pre_proxy_log {
		detailfile = ${radacctdir}/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d

		#
		#  This MUST be 0600, otherwise anyone can read
		#  the users passwords!
		# detailperm = 0600

		# You may also strip out passwords completely
		#suppress {
			# User-Password
		#}
	}

	#
	#  This module logs response packets from a home server.
	#
	#  You will also need to un-comment the 'post_proxy_log' line
	#  in the 'post-proxy' section, below.
	#
	detail post_proxy_log {
		detailfile = ${radacctdir}/%{Client-IP-Address}/post-proxy-detail-%Y%m%d

		# detailperm = 0600
	}

	radutmp {
		filename = ${logdir}/radutmp
		username = %{User-Name}
		case_sensitive = yes
		check_with_nas = yes		
		perm = 0600
		callerid = "yes"
	}
	radutmp sradutmp {
		filename = ${logdir}/sradutmp
		perm = 0644
		callerid = "no"
	}

	attr_filter attr_filter.post-proxy {
		attrsfile = ${confdir}/attrs
	}
	attr_filter attr_filter.pre-proxy {
		attrsfile = ${confdir}/attrs.pre-proxy
	}
	attr_filter attr_filter.access_reject {
		key = %{User-Name}
		attrsfile = ${confdir}/attrs.access_reject
	}
	attr_filter attr_filter.accounting_response {
		key = %{User-Name}
		attrsfile = ${confdir}/attrs.accounting_response
	}
	always fail {
		rcode = fail
	}
	always reject {
		rcode = reject
	}
	always noop {
		rcode = noop
	}
	always handled {
		rcode = handled
	}
	always updated {
		rcode = updated
	}
	always notfound {
		rcode = notfound
	}
	always ok {
		rcode = ok
		simulcount = 0
		mpp = no
	}
}

instantiate {
}





authorize {
	preprocess
	auth_log
	suffix
	files
}
preacct {
	preprocess
	suffix
	files
}
pre-proxy {
	files
	pre_proxy_log
}
post-proxy {
	post_proxy_log
}