Initial ldap and radius configs
This commit is contained in:
@@ -3,6 +3,7 @@
|
||||
log_file
|
||||
pptp
|
||||
sstp
|
||||
radius
|
||||
auth_pap
|
||||
auth_chap_md5
|
||||
auth_mschap_v1
|
||||
@@ -56,6 +57,11 @@ ip-pool=v4pool
|
||||
ipv6-pool=v6pool
|
||||
pv6-pool-delegate=v6pool-delegate
|
||||
|
||||
[radius]
|
||||
verbose=1
|
||||
interim-verbose=1
|
||||
server=radius,secret,auth-port=1812,acct-port=1813,req-limit=0,fail-time=0
|
||||
|
||||
[dns]
|
||||
dns1=8.8.8.8
|
||||
|
||||
|
||||
@@ -22,6 +22,14 @@ services:
|
||||
networks:
|
||||
proxy-tier:
|
||||
ipv6_address: "fc00:b10c:3::ffff"
|
||||
radius:
|
||||
build: ./radius
|
||||
|
||||
|
||||
ldap:
|
||||
build: ./ldap
|
||||
volumes:
|
||||
- ldap:/var/lib/ldap
|
||||
|
||||
stream:
|
||||
build: ./nginx-stream
|
||||
@@ -59,3 +67,4 @@ volumes:
|
||||
certs:
|
||||
vhost.d:
|
||||
html:
|
||||
ldap:
|
||||
|
||||
@@ -0,0 +1,16 @@
|
||||
FROM osixia/openldap:1.5.0
|
||||
# USE THIS VARIABLES IN .ldif files
|
||||
# {{ LDAP_BASE_DN }}
|
||||
# {{ LDAP_BACKEND }}
|
||||
# {{ LDAP_DOMAIN }}
|
||||
# {{ LDAP_READONLY_USER_USERNAME }}
|
||||
# {{ LDAP_READONLY_USER_PASSWORD_ENCRYPTED }}
|
||||
ADD ./*.ldif /container/service/slapd/assets/config/bootstrap/ldif/custom
|
||||
ADD ./*.schema /container/service/slapd/assets/config/bootstrap/ldif/custom
|
||||
ENV LDAP_ORGANISATION="ATerekhin test domain"
|
||||
ENV LDAP_DOMAIN="bearns.me"
|
||||
ENV LDAP_ADMIN_PASSWORD="WlnTd9_mtw5-4"
|
||||
ENV LDAP_TLS=false
|
||||
ENV LDAP_READONLY_USER=true
|
||||
ENV LDAP_OPENLDAP_GID=911
|
||||
ENV LDAP_OPENLDAP_UID=911
|
||||
@@ -0,0 +1,80 @@
|
||||
dn: cn=freeradius-radius,cn=schema,cn=config
|
||||
objectClass: olcSchemaConfig
|
||||
cn: freeradius-radius
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.1 NAME 'radiusArapFeatures' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.2 NAME 'radiusArapSecurity' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.3 NAME 'radiusArapZoneAccess' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.44 NAME 'radiusAuthType' DESC 'controlItem: Auth-Type' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.4 NAME 'radiusCallbackId' DESC 'replyItem: Callback-Id' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.5 NAME 'radiusCallbackNumber' DESC 'replyItem: Callback-Number' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.6 NAME 'radiusCalledStationId' DESC 'controlItem: Called-Station-Id' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.7 NAME 'radiusCallingStationId' DESC 'controlItem: Calling-Station-Id' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.8 NAME 'radiusClass' DESC 'replyItem: Class' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.45 NAME 'radiusClientIPAddress' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.9 NAME 'radiusFilterId' DESC 'replyItem: Filter-Id' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.10 NAME 'radiusFramedAppleTalkLink' DESC 'replyItem: Framed-AppleTalk-Link' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.11 NAME 'radiusFramedAppleTalkNetwork' DESC 'replyItem: Framed-AppleTalk-Network' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.12 NAME 'radiusFramedAppleTalkZone' DESC 'replyItem: Framed-AppleTalk-Zone' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.13 NAME 'radiusFramedCompression' DESC 'replyItem: Framed-Compression' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.14 NAME 'radiusFramedIPAddress' DESC 'replyItem: Framed-IP-Address' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.15 NAME 'radiusFramedIPNetmask' DESC 'replyItem: Framed-IP-Netmask' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.16 NAME 'radiusFramedIPXNetwork' DESC 'replyItem: Framed-IPX-Network' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.17 NAME 'radiusFramedMTU' DESC 'replyItem: Framed-MTU' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.18 NAME 'radiusFramedProtocol' DESC 'replyItem: Framed-Protocol' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.19 NAME 'radiusFramedRoute' DESC 'replyItem: Framed-Route' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.20 NAME 'radiusFramedRouting' DESC 'replyItem: Framed-Routing' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.46 NAME 'radiusGroupName' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.47 NAME 'radiusHint' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.48 NAME 'radiusHuntgroupName' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.21 NAME 'radiusIdleTimeout' DESC 'replyItem: Idle-Timeout' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.22 NAME 'radiusLoginIPHost' DESC 'replyItem: Login-IP-Host' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.23 NAME 'radiusLoginLATGroup' DESC 'replyItem: Login-LAT-Group' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.24 NAME 'radiusLoginLATNode' DESC 'replyItem: Login-LAT-Node' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.25 NAME 'radiusLoginLATPort' DESC 'replyItem: Login-LAT-Port' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.26 NAME 'radiusLoginLATService' DESC 'replyItem: Login-LAT-Service' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.27 NAME 'radiusLoginService' DESC 'replyItem: Login-Service' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.28 NAME 'radiusLoginTCPPort' DESC 'replyItem: Login-TCP-Port' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.29 NAME 'radiusPasswordRetry' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.30 NAME 'radiusPortLimit' DESC 'replyItem: Port-Limit' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.31 NAME 'radiusPrompt' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.49 NAME 'radiusProfileDN' EQUALITY distinguishedNameMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.50 NAME 'radiusProfileSuspendedDN' EQUALITY distinguishedNameMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.51 NAME 'radiusProxyToRealm' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.52 NAME 'radiusRealm' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.32 NAME 'radiusServiceType' DESC 'replyItem: Service-Type' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.33 NAME 'radiusSessionTimeout' DESC 'replyItem: Session-Timeout' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.34 NAME 'radiusTerminationAction' DESC 'replyItem: Termination-Action' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.35 NAME 'radiusTunnelAssignmentId' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.36 NAME 'radiusTunnelMediumType' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.37 NAME 'radiusTunnelPassword' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.38 NAME 'radiusTunnelPreference' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.39 NAME 'radiusTunnelPrivateGroupId' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.40 NAME 'radiusTunnelServerEndpoint' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.41 NAME 'radiusTunnelType' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.42 NAME 'radiusVSA' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.43 NAME 'radiusTunnelClientEndpoint' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.53 NAME 'radiusSimultaneousUse' DESC 'controlItem: Simultaneous-Use' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.54 NAME 'radiusLoginTime' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.55 NAME 'radiusUserCategory' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.56 NAME 'radiusStripUserName' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.57 NAME 'dialupAccess' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.58 NAME 'radiusExpiration' DESC 'controlItem: Expiration' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.59 NAME 'radiusAttribute' DESC 'controlItem: $GENERIC$' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.61 NAME 'radiusNASIpAddress' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.62 NAME 'radiusReplyMessage' DESC 'replyItem: Reply-Message' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.97 NAME 'radiusFramedIPv6Prefix' DESC 'replyItem: Framed-IPv6-Prefix' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.168 NAME 'radiusFramedIPv6Address' DESC 'replyItem: Framed-IPv6-Address' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.169 NAME 'radiusDNSServerIPv6Address' DESC 'replyItem: DNS-Server-IPv6-Address' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.170 NAME 'radiusRouteIPv6Information' DESC 'replyItem: Route-IPv6-Information' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.171 NAME 'radiusDelegatedIPv6PrefixPool' DESC 'replyItem: Delegated-IPv6-Prefix-Pool' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.172 NAME 'radiusStatefulIPv6AddressPool' DESC 'replyItem: Stateful-IPv6-Address-Pool' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.256 NAME 'radiusControlAttribute' DESC 'controlItem: $GENERIC$' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.257 NAME 'radiusReplyAttribute' DESC 'replyItem: $GENERIC$' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.258 NAME 'radiusRequestAttribute' DESC 'requestItem: $GENERIC$' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.259 NAME 'radiusProfilePriority' DESC 'Priority to apply profiles' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 EQUALITY integerMatch ORDERING integerOrderingMatch SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.260 NAME 'radiusProfileCondition' DESC 'Condition to apply profiles' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.2.1.261 NAME 'radiusProfileFallthrough' DESC 'Condition to apply additional profiles after this one' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.1.1.1 NAME 'radiusClientSecret' DESC 'Client Secret' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
|
||||
olcAttributeTypes: ( 1.3.6.1.4.1.11344.4.2.1.1.2 NAME 'radiusClientRequireMa' DESC 'Require Message Authenticator' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
|
||||
olcObjectClasses: ( 1.3.6.1.4.1.11344.4.2.2.2.1 NAME 'radiusProfile' SUP top AUXILIARY MAY ( radiusArapFeatures $ radiusArapSecurity $ radiusArapZoneAccess $ radiusAuthType $ radiusCallbackId $ radiusCallbackNumber $ radiusCalledStationId $ radiusCallingStationId $ radiusClass $ radiusClientIPAddress $ radiusFilterId $ radiusFramedAppleTalkLink $ radiusFramedAppleTalkNetwork $ radiusFramedAppleTalkZone $ radiusFramedCompression $ radiusFramedIPAddress $ radiusFramedIPNetmask $ radiusFramedIPXNetwork $ radiusFramedMTU $ radiusFramedProtocol $ radiusAttribute $ radiusFramedRoute $ radiusFramedRouting $ radiusIdleTimeout $ radiusGroupName $ radiusHint $ radiusHuntgroupName $ radiusLoginIPHost $ radiusLoginLATGroup $ radiusLoginLATNode $ radiusLoginLATPort $ radiusLoginLATService $ radiusLoginService $ radiusLoginTCPPort $ radiusLoginTime $ radiusPasswordRetry $ radiusPortLimit $ radiusPrompt $ radiusProxyToRealm $ radiusRealm $ radiusServiceType $ radiusSessionTimeout $ radiusStripUserName $ radiusTerminationAction $ radiusTunnelClientEndpoint $ radiusProfileDN $ radiusProfileSuspendedDN $ radiusSimultaneousUse $ radiusTunnelAssignmentId $ radiusTunnelMediumType $ radiusTunnelPassword $ radiusTunnelPreference $ radiusTunnelPrivateGroupId $ radiusTunnelServerEndpoint $ radiusTunnelType $ radiusUserCategory $ radiusVSA $ radiusExpiration $ dialupAccess $ radiusNASIpAddress $ radiusReplyMessage $ radiusFramedIPv6Prefix $ radiusFramedIPv6Address $ radiusDNSServerIPv6Address $ radiusRouteIPv6Information $ radiusDelegatedIPv6PrefixPool $ radiusStatefulIPv6AddressPool $ radiusControlAttribute $ radiusReplyAttribute $ radiusRequestAttribute $ radiusProfilePriority $ radiusProfileCondition $ radiusProfileFallthrough ) )
|
||||
olcObjectClasses: ( 1.3.6.1.4.1.11344.4.2.1.2.1 NAME 'radiusClient' SUP top AUXILIARY MUST radiusClientSecret MAY radiusClientRequireMa )
|
||||
@@ -0,0 +1,602 @@
|
||||
#
|
||||
# radiusProfile should be added to a freeradiusPolicy, user/subscriber objects, groups,
|
||||
# or any other object which has RADIUS attributes associated with it.
|
||||
#
|
||||
# 11344.4.2.2.[1|2]
|
||||
# | | | | |_ .1 Profile attributes, .2 profile objects
|
||||
# | | | |_ Profile
|
||||
# | | |_ RADIUS
|
||||
# | |_ LDAP Attributes
|
||||
# |_ Vendor
|
||||
#
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.1
|
||||
NAME 'radiusArapFeatures'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.2
|
||||
NAME 'radiusArapSecurity'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.3
|
||||
NAME 'radiusArapZoneAccess'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.44
|
||||
NAME 'radiusAuthType'
|
||||
DESC 'controlItem: Auth-Type'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.4
|
||||
NAME 'radiusCallbackId'
|
||||
DESC 'replyItem: Callback-Id'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.5
|
||||
NAME 'radiusCallbackNumber'
|
||||
DESC 'replyItem: Callback-Number'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.6
|
||||
NAME 'radiusCalledStationId'
|
||||
DESC 'controlItem: Called-Station-Id'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.7
|
||||
NAME 'radiusCallingStationId'
|
||||
DESC 'controlItem: Calling-Station-Id'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.8
|
||||
NAME 'radiusClass'
|
||||
DESC 'replyItem: Class'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.45
|
||||
NAME 'radiusClientIPAddress'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.9
|
||||
NAME 'radiusFilterId'
|
||||
DESC 'replyItem: Filter-Id'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.10
|
||||
NAME 'radiusFramedAppleTalkLink'
|
||||
DESC 'replyItem: Framed-AppleTalk-Link'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.11
|
||||
NAME 'radiusFramedAppleTalkNetwork'
|
||||
DESC 'replyItem: Framed-AppleTalk-Network'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.12
|
||||
NAME 'radiusFramedAppleTalkZone'
|
||||
DESC 'replyItem: Framed-AppleTalk-Zone'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.13
|
||||
NAME 'radiusFramedCompression'
|
||||
DESC 'replyItem: Framed-Compression'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.14
|
||||
NAME 'radiusFramedIPAddress'
|
||||
DESC 'replyItem: Framed-IP-Address'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.15
|
||||
NAME 'radiusFramedIPNetmask'
|
||||
DESC 'replyItem: Framed-IP-Netmask'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.16
|
||||
NAME 'radiusFramedIPXNetwork'
|
||||
DESC 'replyItem: Framed-IPX-Network'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.17
|
||||
NAME 'radiusFramedMTU'
|
||||
DESC 'replyItem: Framed-MTU'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.18
|
||||
NAME 'radiusFramedProtocol'
|
||||
DESC 'replyItem: Framed-Protocol'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.19
|
||||
NAME 'radiusFramedRoute'
|
||||
DESC 'replyItem: Framed-Route'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.20
|
||||
NAME 'radiusFramedRouting'
|
||||
DESC 'replyItem: Framed-Routing'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.46
|
||||
NAME 'radiusGroupName'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.47
|
||||
NAME 'radiusHint'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.48
|
||||
NAME 'radiusHuntgroupName'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.21
|
||||
NAME 'radiusIdleTimeout'
|
||||
DESC 'replyItem: Idle-Timeout'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.22
|
||||
NAME 'radiusLoginIPHost'
|
||||
DESC 'replyItem: Login-IP-Host'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.23
|
||||
NAME 'radiusLoginLATGroup'
|
||||
DESC 'replyItem: Login-LAT-Group'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.24
|
||||
NAME 'radiusLoginLATNode'
|
||||
DESC 'replyItem: Login-LAT-Node'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.25
|
||||
NAME 'radiusLoginLATPort'
|
||||
DESC 'replyItem: Login-LAT-Port'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.26
|
||||
NAME 'radiusLoginLATService'
|
||||
DESC 'replyItem: Login-LAT-Service'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.27
|
||||
NAME 'radiusLoginService'
|
||||
DESC 'replyItem: Login-Service'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.28
|
||||
NAME 'radiusLoginTCPPort'
|
||||
DESC 'replyItem: Login-TCP-Port'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.29
|
||||
NAME 'radiusPasswordRetry'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.30
|
||||
NAME 'radiusPortLimit'
|
||||
DESC 'replyItem: Port-Limit'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.31
|
||||
NAME 'radiusPrompt'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.49
|
||||
NAME 'radiusProfileDN'
|
||||
EQUALITY distinguishedNameMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.50
|
||||
NAME 'radiusProfileSuspendedDN'
|
||||
EQUALITY distinguishedNameMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.51
|
||||
NAME 'radiusProxyToRealm'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.52
|
||||
NAME 'radiusRealm'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.32
|
||||
NAME 'radiusServiceType'
|
||||
DESC 'replyItem: Service-Type'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.33
|
||||
NAME 'radiusSessionTimeout'
|
||||
DESC 'replyItem: Session-Timeout'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.34
|
||||
NAME 'radiusTerminationAction'
|
||||
DESC 'replyItem: Termination-Action'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.35
|
||||
NAME 'radiusTunnelAssignmentId'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.36
|
||||
NAME 'radiusTunnelMediumType'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.37
|
||||
NAME 'radiusTunnelPassword'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.38
|
||||
NAME 'radiusTunnelPreference'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.39
|
||||
NAME 'radiusTunnelPrivateGroupId'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.40
|
||||
NAME 'radiusTunnelServerEndpoint'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.41
|
||||
NAME 'radiusTunnelType'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.42
|
||||
NAME 'radiusVSA'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.43
|
||||
NAME 'radiusTunnelClientEndpoint'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.53
|
||||
NAME 'radiusSimultaneousUse'
|
||||
DESC 'controlItem: Simultaneous-Use'
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.54
|
||||
NAME 'radiusLoginTime'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.55
|
||||
NAME 'radiusUserCategory'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.56
|
||||
NAME 'radiusStripUserName'
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.57
|
||||
NAME 'dialupAccess'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.58
|
||||
NAME 'radiusExpiration'
|
||||
DESC 'controlItem: Expiration'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.59
|
||||
NAME 'radiusAttribute'
|
||||
DESC 'controlItem: $GENERIC$'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.61
|
||||
NAME 'radiusNASIpAddress'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.62
|
||||
NAME 'radiusReplyMessage'
|
||||
DESC 'replyItem: Reply-Message'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.97
|
||||
NAME 'radiusFramedIPv6Prefix'
|
||||
DESC 'replyItem: Framed-IPv6-Prefix'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.168
|
||||
NAME 'radiusFramedIPv6Address'
|
||||
DESC 'replyItem: Framed-IPv6-Address'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.169
|
||||
NAME 'radiusDNSServerIPv6Address'
|
||||
DESC 'replyItem: DNS-Server-IPv6-Address'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.170
|
||||
NAME 'radiusRouteIPv6Information'
|
||||
DESC 'replyItem: Route-IPv6-Information'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.171
|
||||
NAME 'radiusDelegatedIPv6PrefixPool'
|
||||
DESC 'replyItem: Delegated-IPv6-Prefix-Pool'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.172
|
||||
NAME 'radiusStatefulIPv6AddressPool'
|
||||
DESC 'replyItem: Stateful-IPv6-Address-Pool'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.256
|
||||
NAME 'radiusControlAttribute'
|
||||
DESC 'controlItem: $GENERIC$'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.257
|
||||
NAME 'radiusReplyAttribute'
|
||||
DESC 'replyItem: $GENERIC$'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.258
|
||||
NAME 'radiusRequestAttribute'
|
||||
DESC 'requestItem: $GENERIC$'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.259
|
||||
NAME 'radiusProfilePriority'
|
||||
DESC 'Priority to apply profiles'
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
|
||||
EQUALITY integerMatch
|
||||
ORDERING integerOrderingMatch
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.260
|
||||
NAME 'radiusProfileCondition'
|
||||
DESC 'Condition to apply profiles'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.2.1.261
|
||||
NAME 'radiusProfileFallthrough'
|
||||
DESC 'Condition to apply additional profiles after this one'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
)
|
||||
|
||||
objectclass ( 1.3.6.1.4.1.11344.4.2.2.2.1
|
||||
NAME 'radiusProfile'
|
||||
SUP top
|
||||
AUXILIARY
|
||||
MAY ( radiusArapFeatures $ radiusArapSecurity $ radiusArapZoneAccess $ radiusAuthType $ radiusCallbackId $ radiusCallbackNumber $ radiusCalledStationId $ radiusCallingStationId $ radiusClass $ radiusClientIPAddress $ radiusFilterId $ radiusFramedAppleTalkLink $ radiusFramedAppleTalkNetwork $ radiusFramedAppleTalkZone $ radiusFramedCompression $ radiusFramedIPAddress $ radiusFramedIPNetmask $ radiusFramedIPXNetwork $ radiusFramedMTU $ radiusFramedProtocol $ radiusAttribute $ radiusFramedRoute $ radiusFramedRouting $ radiusIdleTimeout $ radiusGroupName $ radiusHint $ radiusHuntgroupName $ radiusLoginIPHost $ radiusLoginLATGroup $ radiusLoginLATNode $ radiusLoginLATPort $ radiusLoginLATService $ radiusLoginService $ radiusLoginTCPPort $ radiusLoginTime $ radiusPasswordRetry $ radiusPortLimit $ radiusPrompt $ radiusProxyToRealm $ radiusRealm $ radiusServiceType $ radiusSessionTimeout $ radiusStripUserName $ radiusTerminationAction $ radiusTunnelClientEndpoint $ radiusProfileDN $ radiusProfileSuspendedDN $ radiusSimultaneousUse $ radiusTunnelAssignmentId $ radiusTunnelMediumType $ radiusTunnelPassword $ radiusTunnelPreference $ radiusTunnelPrivateGroupId $ radiusTunnelServerEndpoint $ radiusTunnelType $ radiusUserCategory $ radiusVSA $ radiusExpiration $ dialupAccess $ radiusNASIpAddress $ radiusReplyMessage $ radiusFramedIPv6Prefix $ radiusFramedIPv6Address $ radiusDNSServerIPv6Address $ radiusRouteIPv6Information $ radiusDelegatedIPv6PrefixPool $ radiusStatefulIPv6AddressPool $ radiusControlAttribute $ radiusReplyAttribute $ radiusRequestAttribute $ radiusProfilePriority $ radiusProfileCondition $ radiusProfileFallthrough )
|
||||
)
|
||||
|
||||
#
|
||||
# 11344.4.2.1.[1|2]
|
||||
# | | | | |_ .1 Profile attributes, .2 profile objects
|
||||
# | | | |_ Client
|
||||
# | | |_ RADIUS
|
||||
# | |_ LDAP Attributes
|
||||
# |_ Vendor
|
||||
#
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.1.1.1
|
||||
NAME 'radiusClientSecret'
|
||||
DESC 'Client Secret'
|
||||
EQUALITY caseIgnoreMatch
|
||||
SUBSTR caseIgnoreSubstringsMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
attributetype ( 1.3.6.1.4.1.11344.4.2.1.1.2
|
||||
NAME 'radiusClientRequireMa'
|
||||
DESC 'Require Message Authenticator'
|
||||
EQUALITY booleanMatch
|
||||
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
|
||||
SINGLE-VALUE
|
||||
)
|
||||
|
||||
objectclass ( 1.3.6.1.4.1.11344.4.2.1.2.1
|
||||
NAME 'radiusClient'
|
||||
SUP top
|
||||
AUXILIARY
|
||||
MUST ( radiusClientSecret )
|
||||
MAY ( radiusClientRequireMa )
|
||||
)
|
||||
@@ -0,0 +1,32 @@
|
||||
ARG from=debian:bookworm
|
||||
FROM ${from}
|
||||
ARG DEBIAN_FRONTEND=noninteractive
|
||||
|
||||
#
|
||||
# We need also curl to get the signing key
|
||||
#
|
||||
RUN apt-get update \
|
||||
&& apt-get install -y curl
|
||||
|
||||
#
|
||||
# Set up NetworkRADIUS extras repository
|
||||
#
|
||||
RUN install -d -o root -g root -m 0755 /etc/apt/keyrings \
|
||||
&& curl -o /etc/apt/keyrings/packages.networkradius.com.asc "https://packages.inkbridgenetworks.com/pgp/packages%40networkradius.com" \
|
||||
&& echo "deb [signed-by=/etc/apt/keyrings/packages.networkradius.com.asc] http://packages.networkradius.com/extras/debian/bookworm bookworm main" > /etc/apt/sources.list.d/networkradius-extras.list
|
||||
|
||||
#
|
||||
# Install from reposittory
|
||||
#
|
||||
RUN apt-get install -y freeradius \
|
||||
&& apt-get clean \
|
||||
&& rm -r /var/lib/apt/lists/* \
|
||||
&& ln -s /etc/freeradius /etc/raddb
|
||||
|
||||
ADD ./raddb/* /etc/raddb/3.0/
|
||||
|
||||
WORKDIR /
|
||||
|
||||
EXPOSE 1812/udp 1813/udp
|
||||
ENTRYPOINT ["freeradius"]
|
||||
CMD ["-X"]
|
||||
@@ -0,0 +1,694 @@
|
||||
# -*- text -*-
|
||||
#
|
||||
# $Id: bc879ccc20354d5d32afa1f8b4d10422d5184eab $
|
||||
|
||||
#
|
||||
# Lightweight Directory Access Protocol (LDAP)
|
||||
#
|
||||
ldap {
|
||||
# Note that this needs to match the name(s) in the LDAP server
|
||||
# certificate, if you're using ldaps. See OpenLDAP documentation
|
||||
# for the behavioral semantics of specifying more than one host.
|
||||
#
|
||||
# Depending on the libldap in use, server may be an LDAP URI.
|
||||
# In the case of OpenLDAP this allows additional the following
|
||||
# additional schemes:
|
||||
# - ldaps:// (LDAP over SSL)
|
||||
# - ldapi:// (LDAP over Unix socket)
|
||||
# - ldapc:// (Connectionless LDAP)
|
||||
server = 'ldap'
|
||||
# server = 'ldap.rrdns.example.org'
|
||||
# server = 'ldap.rrdns.example.org'
|
||||
|
||||
# Port to connect on, defaults to 389, will be ignored for LDAP URIs.
|
||||
# port = 389
|
||||
|
||||
# Administrator account for searching and possibly modifying.
|
||||
# If using SASL + KRB5 these should be commented out.
|
||||
# identity = 'cn=admin,dc=example,dc=org'
|
||||
password = readonly
|
||||
|
||||
# Unless overridden in another section, the dn from which all
|
||||
# searches will start from.
|
||||
base_dn = 'dc=bearns,dc=me'
|
||||
|
||||
#
|
||||
# You can run the 'ldapsearch' command line tool using the
|
||||
# parameters from this module's configuration.
|
||||
#
|
||||
# ldapsearch -D ${identity} -w ${password} -h ${server} -b 'CN=user,${base_dn}'
|
||||
#
|
||||
# That will give you the LDAP information for 'user'.
|
||||
#
|
||||
# Group membership can be queried by using the above "ldapsearch" string,
|
||||
# and adding "memberof" qualifiers. For ActiveDirectory, use:
|
||||
#
|
||||
# ldapsearch ... '(&(objectClass=user)(sAMAccountName=user)(memberof=CN=group,${base_dn}))'
|
||||
#
|
||||
# Where 'user' is the user as above, and 'group' is the group you are querying for.
|
||||
#
|
||||
|
||||
#
|
||||
# SASL parameters to use for admin binds
|
||||
#
|
||||
# When we're prompted by the SASL library, these control
|
||||
# the responses given, as well as the identity and password
|
||||
# directives above.
|
||||
#
|
||||
# If any directive is commented out, a NULL response will be
|
||||
# provided to cyrus-sasl.
|
||||
#
|
||||
# Unfortunately the only way to control Keberos here is through
|
||||
# environmental variables, as cyrus-sasl provides no API to
|
||||
# set the krb5 config directly.
|
||||
#
|
||||
# Full documentation for MIT krb5 can be found here:
|
||||
#
|
||||
# http://web.mit.edu/kerberos/krb5-devel/doc/admin/env_variables.html
|
||||
#
|
||||
# At a minimum you probably want to set KRB5_CLIENT_KTNAME.
|
||||
#
|
||||
sasl {
|
||||
# SASL mechanism
|
||||
# mech = 'PLAIN'
|
||||
|
||||
# SASL authorisation identity to proxy.
|
||||
# proxy = 'autz_id'
|
||||
|
||||
# SASL realm. Used for kerberos.
|
||||
# realm = 'example.org'
|
||||
}
|
||||
|
||||
#
|
||||
# Generic valuepair attribute
|
||||
#
|
||||
|
||||
# If set, this will attribute will be retrieved in addition to any
|
||||
# mapped attributes.
|
||||
#
|
||||
# Values should be in the format:
|
||||
# <radius attr> <op> <value>
|
||||
#
|
||||
# Where:
|
||||
# <radius attr>: Is the attribute you wish to create
|
||||
# with any valid list and request qualifiers.
|
||||
# <op>: Is any assignment operator (=, :=, +=, -=).
|
||||
# <value>: Is the value to parse into the new valuepair.
|
||||
# If the value is wrapped in double quotes it
|
||||
# will be xlat expanded.
|
||||
# valuepair_attribute = 'radiusAttribute'
|
||||
|
||||
#
|
||||
# Mapping of LDAP directory attributes to RADIUS dictionary attributes.
|
||||
#
|
||||
|
||||
# WARNING: Although this format is almost identical to the unlang
|
||||
# update section format, it does *NOT* mean that you can use other
|
||||
# unlang constructs in module configuration files.
|
||||
#
|
||||
# Configuration items are in the format:
|
||||
# <radius attr> <op> <ldap attr>
|
||||
#
|
||||
# Where:
|
||||
# <radius attr>: Is the destination RADIUS attribute
|
||||
# with any valid list and request qualifiers.
|
||||
# <op>: Is any assignment attribute (=, :=, +=, -=).
|
||||
# <ldap attr>: Is the attribute associated with user or
|
||||
# profile objects in the LDAP directory.
|
||||
# If the attribute name is wrapped in double
|
||||
# quotes it will be xlat expanded.
|
||||
#
|
||||
# Request and list qualifiers may also be placed after the 'update'
|
||||
# section name to set defaults destination requests/lists
|
||||
# for unqualified RADIUS attributes.
|
||||
#
|
||||
# Note: LDAP attribute names should be single quoted unless you want
|
||||
# the name value to be derived from an xlat expansion, or an
|
||||
# attribute ref.
|
||||
update {
|
||||
control:Password-With-Header += 'userPassword'
|
||||
# control:NT-Password := 'ntPassword'
|
||||
# reply:Reply-Message := 'radiusReplyMessage'
|
||||
# reply:Tunnel-Type := 'radiusTunnelType'
|
||||
# reply:Tunnel-Medium-Type := 'radiusTunnelMediumType'
|
||||
# reply:Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId'
|
||||
|
||||
# Where only a list is specified as the RADIUS attribute,
|
||||
# the value of the LDAP attribute is parsed as a valuepair
|
||||
# in the same format as the 'valuepair_attribute' (above).
|
||||
control: += 'radiusControlAttribute'
|
||||
request: += 'radiusRequestAttribute'
|
||||
reply: += 'radiusReplyAttribute'
|
||||
}
|
||||
|
||||
# Set to yes if you have eDirectory and want to use the universal
|
||||
# password mechanism.
|
||||
# edir = no
|
||||
|
||||
# Set to yes if you want to bind as the user after retrieving the
|
||||
# Cleartext-Password. This will consume the login grace, and
|
||||
# verify user authorization.
|
||||
# edir_autz = no
|
||||
|
||||
# LDAP "bind as user" configuration to check PAP passwords.
|
||||
#
|
||||
# Active Directory needs "bind as user", which can be done by
|
||||
# adding the following "if" statement to the authorize {} section
|
||||
# of the virtual server, after the "ldap" module. For
|
||||
# example:
|
||||
#
|
||||
# ...
|
||||
# ldap
|
||||
# if ((ok || updated) && User-Password && !control:Auth-Type) {
|
||||
# update {
|
||||
# control:Auth-Type := ldap
|
||||
# }
|
||||
# }
|
||||
# ...
|
||||
#
|
||||
# You will also need to uncomment the "Auth-Type LDAP" block in the
|
||||
# "authenticate" section.
|
||||
#
|
||||
# This configuration is required because AD will not return the users
|
||||
# "known good" password to FreeRADIUS. Instead, FreeRADIUS has to run
|
||||
# "Auth-Type LDAP" in order to do an LDAP "bind as user", which will hand
|
||||
# the user name / password to AD for verification.
|
||||
#
|
||||
|
||||
#
|
||||
# Name of the attribute that contains the user DN.
|
||||
# The default name is LDAP-UserDn.
|
||||
#
|
||||
# If you have multiple LDAP instances, you should
|
||||
# change this configuration item to:
|
||||
#
|
||||
# ${.:instance}-LDAP-UserDn
|
||||
#
|
||||
# That change allows the modules to set their own
|
||||
# User DN, and to not conflict with each other.
|
||||
#
|
||||
user_dn = "LDAP-UserDn"
|
||||
|
||||
#
|
||||
# User object identification.
|
||||
#
|
||||
user {
|
||||
# Where to start searching in the tree for users
|
||||
base_dn = "${..base_dn}"
|
||||
|
||||
# Filter for user objects, should be specific enough
|
||||
# to identify a single user object.
|
||||
#
|
||||
# For Active Directory, you should use
|
||||
# "samaccountname=" instead of "uid="
|
||||
#
|
||||
filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
|
||||
|
||||
# For Active Directory nested group, you should comment out the previous 'filter = ...'
|
||||
# and use the below. Where 'group' is the group you are querying for.
|
||||
#
|
||||
# NOTE: The string '1.2.840.113556.1.4.1941' specifies LDAP_MATCHING_RULE_IN_CHAIN.
|
||||
# This applies only to DN attributes. This is an extended match operator that walks
|
||||
# the chain of ancestry in objects all the way to the root until it finds a match.
|
||||
# This reveals group nesting. It is available only on domain controllers with
|
||||
# Windows Server 2003 SP2 or Windows Server 2008 (or above).
|
||||
#
|
||||
# See: https://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx
|
||||
#
|
||||
# filter = "(&(objectClass=user)(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf:1.2.840.113556.1.4.1941:=cn=group,${..base_dn}))"
|
||||
|
||||
# SASL parameters to use for user binds
|
||||
#
|
||||
# When we're prompted by the SASL library, these control
|
||||
# the responses given.
|
||||
#
|
||||
# Any of the config items below may be an attribute ref
|
||||
# or and expansion, so different SASL mechs, proxy IDs
|
||||
# and realms may be used for different users.
|
||||
sasl {
|
||||
# SASL mechanism
|
||||
# mech = 'PLAIN'
|
||||
|
||||
# SASL authorisation identity to proxy.
|
||||
# proxy = &User-Name
|
||||
|
||||
# SASL realm. Used for kerberos.
|
||||
# realm = 'example.org'
|
||||
}
|
||||
|
||||
# Search scope, may be 'base', 'one', sub' or 'children'
|
||||
# scope = 'sub'
|
||||
|
||||
# Server side result sorting
|
||||
#
|
||||
# A list of space delimited attributes to order the result
|
||||
# set by, if the filter matches multiple objects.
|
||||
# Only the first result in the set will be processed.
|
||||
#
|
||||
# If the attribute name is prefixed with a hyphen '-' the
|
||||
# sorting order will be reversed for that attribute.
|
||||
#
|
||||
# If sort_by is set, and the server does not support sorting
|
||||
# the search will fail.
|
||||
# sort_by = '-uid'
|
||||
|
||||
# If this is undefined, anyone is authorised.
|
||||
# If it is defined, the contents of this attribute
|
||||
# determine whether or not the user is authorised
|
||||
# access_attribute = 'dialupAccess'
|
||||
|
||||
# Control whether the presence of 'access_attribute'
|
||||
# allows access, or denys access.
|
||||
#
|
||||
# If 'yes', and the access_attribute is present, or
|
||||
# 'no' and the access_attribute is absent then access
|
||||
# will be allowed.
|
||||
#
|
||||
# If 'yes', and the access_attribute is absent, or
|
||||
# 'no' and the access_attribute is present, then
|
||||
# access will not be allowed.
|
||||
#
|
||||
# If the value of the access_attribute is 'false', it
|
||||
# will negate the result.
|
||||
#
|
||||
# e.g.
|
||||
# access_positive = yes
|
||||
# access_attribute = userAccessAllowed
|
||||
#
|
||||
# With an LDAP object containing:
|
||||
# userAccessAllowed: false
|
||||
#
|
||||
# Will result in the user being locked out.
|
||||
# access_positive = yes
|
||||
}
|
||||
|
||||
#
|
||||
# User membership checking.
|
||||
#
|
||||
group {
|
||||
# Where to start searching in the tree for groups
|
||||
base_dn = "${..base_dn}"
|
||||
|
||||
# Filter for group objects, should match all available
|
||||
# group objects a user might be a member of.
|
||||
#
|
||||
# If using Active Directory you are likely to need "group"
|
||||
# instead of "posixGroup".
|
||||
filter = '(objectClass=posixGroup)'
|
||||
|
||||
# Search scope, may be 'base', 'one', sub' or 'children'
|
||||
# scope = 'sub'
|
||||
|
||||
# Attribute that uniquely identifies a group.
|
||||
# Is used when converting group DNs to group
|
||||
# names.
|
||||
# name_attribute = cn
|
||||
|
||||
# Filter to find all group objects a user is a member of.
|
||||
# That is, group objects with attributes that
|
||||
# identify members (the inverse of membership_attribute).
|
||||
#
|
||||
# Note that this configuration references the "user_dn"
|
||||
# configuration defined above.
|
||||
#
|
||||
# membership_filter = "(|(member=%{control:${..user_dn}})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))"
|
||||
|
||||
# The attribute, in user objects, which contain the names
|
||||
# or DNs of groups a user is a member of.
|
||||
#
|
||||
# Unless a conversion between group name and group DN is
|
||||
# needed, there's no requirement for the group objects
|
||||
# referenced to actually exist.
|
||||
#
|
||||
# If the LDAP server does not support the "memberOf"
|
||||
# attribute (or equivalent), then you will need to use the
|
||||
# membership_filter option above instead. If you can't see
|
||||
# the memberOf attribute then it is also possible that the
|
||||
# LDAP bind user does not have the correct permissions to
|
||||
# view it.
|
||||
membership_attribute = 'memberOf'
|
||||
|
||||
# If cacheable_name or cacheable_dn are enabled,
|
||||
# all group information for the user will be
|
||||
# retrieved from the directory and written to LDAP-Group
|
||||
# attributes appropriate for the instance of rlm_ldap.
|
||||
#
|
||||
# For group comparisons these attributes will be checked
|
||||
# instead of querying the LDAP directory directly.
|
||||
#
|
||||
# This feature is intended to be used with rlm_cache.
|
||||
#
|
||||
# If you wish to use this feature, you should enable
|
||||
# the type that matches the format of your check items
|
||||
# i.e. if your groups are specified as DNs then enable
|
||||
# cacheable_dn else enable cacheable_name.
|
||||
# cacheable_name = 'no'
|
||||
# cacheable_dn = 'no'
|
||||
|
||||
# Override the normal cache attribute (<inst>-LDAP-Group or
|
||||
# LDAP-Group if using the default instance) and create a
|
||||
# custom attribute. This can help if multiple module instances
|
||||
# are used in fail-over.
|
||||
# cache_attribute = 'LDAP-Cached-Membership'
|
||||
|
||||
# If the group being checked is specified as a name, but
|
||||
# the user's groups are referenced by DN, and one of those
|
||||
# group DNs is invalid, the whole group check is treated as
|
||||
# invalid, and a negative result will be returned.
|
||||
# When set to 'yes', this option ignores invalid DN
|
||||
# references.
|
||||
# allow_dangling_group_ref = 'no'
|
||||
}
|
||||
|
||||
#
|
||||
# User profiles. RADIUS profile objects contain sets of attributes
|
||||
# to insert into the request. These attributes are mapped using
|
||||
# the same mapping scheme applied to user objects (the update section above).
|
||||
#
|
||||
profile {
|
||||
# Filter for RADIUS profile objects
|
||||
# filter = '(objectclass=radiusprofile)'
|
||||
|
||||
# The default profile. This may be a DN or an attribute
|
||||
# reference.
|
||||
# To get old v2.2.x style behaviour, or to use the
|
||||
# &User-Profile attribute to specify the default profile,
|
||||
# set this to &control:User-Profile.
|
||||
# default = 'cn=radprofile,dc=example,dc=org'
|
||||
|
||||
# The LDAP attribute containing profile DNs to apply
|
||||
# in addition to the default profile above. These are
|
||||
# retrieved from the user object, at the same time as the
|
||||
# attributes from the update section, are are applied
|
||||
# if authorization is successful.
|
||||
# attribute = 'radiusProfileDn'
|
||||
}
|
||||
|
||||
#
|
||||
# Bulk load clients from the directory
|
||||
#
|
||||
client {
|
||||
# Where to start searching in the tree for clients
|
||||
base_dn = "${..base_dn}"
|
||||
|
||||
#
|
||||
# Filter to match client objects
|
||||
#
|
||||
filter = '(objectClass=radiusClient)'
|
||||
|
||||
# Search scope, may be 'base', 'one', 'sub' or 'children'
|
||||
# scope = 'sub'
|
||||
|
||||
#
|
||||
# Sets default values (not obtained from LDAP) for new client entries
|
||||
#
|
||||
template {
|
||||
# login = 'test'
|
||||
# password = 'test'
|
||||
# proto = tcp
|
||||
# require_message_authenticator = yes
|
||||
|
||||
# Uncomment to add a home_server with the same
|
||||
# attributes as the client.
|
||||
# coa_server {
|
||||
# response_window = 2.0
|
||||
# }
|
||||
}
|
||||
|
||||
#
|
||||
# Client attribute mappings are in the format:
|
||||
# <client attribute> = <ldap attribute>
|
||||
#
|
||||
# The following attributes are required:
|
||||
# * ipaddr | ipv4addr | ipv6addr - Client IP Address.
|
||||
# * secret - RADIUS shared secret.
|
||||
#
|
||||
# All other attributes usually supported in a client
|
||||
# definition are also supported here.
|
||||
#
|
||||
# Schemas are available in doc/schemas/ldap for openldap and eDirectory
|
||||
#
|
||||
attribute {
|
||||
ipaddr = 'radiusClientIdentifier'
|
||||
secret = 'radiusClientSecret'
|
||||
# shortname = 'radiusClientShortname'
|
||||
# nas_type = 'radiusClientType'
|
||||
# virtual_server = 'radiusClientVirtualServer'
|
||||
# require_message_authenticator = 'radiusClientRequireMa'
|
||||
}
|
||||
}
|
||||
|
||||
# Load clients on startup
|
||||
# read_clients = no
|
||||
|
||||
#
|
||||
# Modify user object on receiving Accounting-Request
|
||||
#
|
||||
|
||||
# Useful for recording things like the last time the user logged
|
||||
# in, or the Acct-Session-ID for CoA/DM.
|
||||
#
|
||||
# LDAP modification items are in the format:
|
||||
# <ldap attr> <op> <value>
|
||||
#
|
||||
# Where:
|
||||
# <ldap attr>: The LDAP attribute to add modify or delete.
|
||||
# <op>: One of the assignment operators:
|
||||
# (:=, +=, -=, ++).
|
||||
# Note: '=' is *not* supported.
|
||||
# <value>: The value to add modify or delete.
|
||||
#
|
||||
# WARNING: If using the ':=' operator with a multi-valued LDAP
|
||||
# attribute, all instances of the attribute will be removed and
|
||||
# replaced with a single attribute.
|
||||
accounting {
|
||||
reference = "%{tolower:type.%{Acct-Status-Type}}"
|
||||
|
||||
type {
|
||||
start {
|
||||
update {
|
||||
description := "Online at %S"
|
||||
}
|
||||
}
|
||||
|
||||
interim-update {
|
||||
update {
|
||||
description := "Last seen at %S"
|
||||
}
|
||||
}
|
||||
|
||||
stop {
|
||||
update {
|
||||
description := "Offline at %S"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#
|
||||
# Post-Auth can modify LDAP objects too
|
||||
#
|
||||
post-auth {
|
||||
update {
|
||||
description := "Authenticated at %S"
|
||||
}
|
||||
}
|
||||
|
||||
#
|
||||
# LDAP connection-specific options.
|
||||
#
|
||||
# These options set timeouts, keep-alives, etc. for the connections.
|
||||
#
|
||||
options {
|
||||
# Control under which situations aliases are followed.
|
||||
# May be one of 'never', 'searching', 'finding' or 'always'
|
||||
# default: libldap's default which is usually 'never'.
|
||||
#
|
||||
# LDAP_OPT_DEREF is set to this value.
|
||||
# dereference = 'always'
|
||||
|
||||
#
|
||||
# The following two configuration items control whether the
|
||||
# server follows references returned by LDAP directory.
|
||||
# They are mostly for Active Directory compatibility.
|
||||
# If you set these to 'no', then searches will likely return
|
||||
# 'operations error', instead of a useful result.
|
||||
#
|
||||
# 'rebind' causes any connections being established to follow
|
||||
# referrals to be bound using the admin credentials defined
|
||||
# for this module. If it is set to 'no' libldap will bind
|
||||
# to those connections anonymously.
|
||||
#
|
||||
chase_referrals = yes
|
||||
rebind = yes
|
||||
|
||||
# SASL Security Properties (see SASL_SECPROPS in ldap.conf man page).
|
||||
# Note - uncomment when using GSS-API sasl mechanism along with TLS
|
||||
# encryption against Active-Directory LDAP servers (this disables
|
||||
# sealing and signing at the GSS level as required by AD).
|
||||
#sasl_secprops = 'noanonymous,noplain,maxssf=0'
|
||||
|
||||
# Seconds to wait for LDAP query to finish. default: 20
|
||||
res_timeout = 10
|
||||
|
||||
# Seconds LDAP server has to process the query (server-side
|
||||
# time limit). default: 20
|
||||
#
|
||||
# LDAP_OPT_TIMELIMIT is set to this value.
|
||||
srv_timelimit = 3
|
||||
|
||||
# Seconds to wait for response of the server. (network
|
||||
# failures) default: 10
|
||||
#
|
||||
# LDAP_OPT_NETWORK_TIMEOUT is set to this value.
|
||||
net_timeout = 1
|
||||
|
||||
# LDAP_OPT_X_KEEPALIVE_IDLE
|
||||
idle = 60
|
||||
|
||||
# LDAP_OPT_X_KEEPALIVE_PROBES
|
||||
probes = 3
|
||||
|
||||
# LDAP_OPT_X_KEEPALIVE_INTERVAL
|
||||
interval = 3
|
||||
|
||||
# ldap_debug: debug flag for LDAP SDK
|
||||
# (see OpenLDAP documentation). Set this to enable
|
||||
# huge amounts of LDAP debugging on the screen.
|
||||
# You should only use this if you are an LDAP expert.
|
||||
#
|
||||
# default: 0x0000 (no debugging messages)
|
||||
# Example:(LDAP_DEBUG_FILTER+LDAP_DEBUG_CONNS)
|
||||
ldap_debug = 0x0028
|
||||
}
|
||||
|
||||
#
|
||||
# This subsection configures the tls related items
|
||||
# that control how FreeRADIUS connects to an LDAP
|
||||
# server. It contains all of the 'tls_*' configuration
|
||||
# entries used in older versions of FreeRADIUS. Those
|
||||
# configuration entries can still be used, but we recommend
|
||||
# using these.
|
||||
#
|
||||
# Note that some distributions use NSS for libldap instead
|
||||
# of OpenSSL.
|
||||
#
|
||||
# If you see something like this in the debug output:
|
||||
#
|
||||
# TLSMC: MozNSS compatibility interception begins.
|
||||
#
|
||||
# Then there is a problem.
|
||||
#
|
||||
# THIS LDAP INSTALLATION WILL NOT WORK WITH FREERADIUS.
|
||||
#
|
||||
# You MUST install fixed LDAP libraries which use OpenSSL.
|
||||
#
|
||||
# For more details, see:
|
||||
#
|
||||
# http://packages.networkradius.com
|
||||
#
|
||||
tls {
|
||||
# Set this to 'yes' to use TLS encrypted connections
|
||||
# to the LDAP database by using the StartTLS extended
|
||||
# operation.
|
||||
#
|
||||
# The StartTLS operation is supposed to be
|
||||
# used with normal ldap connections instead of
|
||||
# using ldaps (port 636) connections
|
||||
# start_tls = yes
|
||||
|
||||
# ca_file = ${certdir}/cacert.pem
|
||||
|
||||
# ca_path = ${certdir}
|
||||
# certificate_file = /path/to/radius.crt
|
||||
# private_key_file = /path/to/radius.key
|
||||
# random_file = /dev/urandom
|
||||
|
||||
# Certificate Verification requirements. Can be:
|
||||
# 'never' (do not even bother trying)
|
||||
# 'allow' (try, but don't fail if the certificate
|
||||
# cannot be verified)
|
||||
# 'demand' (fail if the certificate does not verify)
|
||||
# 'hard' (similar to 'demand' but fails if TLS
|
||||
# cannot negotiate)
|
||||
#
|
||||
# The default is libldap's default, which varies based
|
||||
# on the contents of ldap.conf.
|
||||
|
||||
# require_cert = 'demand'
|
||||
|
||||
#
|
||||
# Minimum TLS version to accept. We STRONGLY recommend
|
||||
# setting this to "1.2"
|
||||
#
|
||||
# tls_min_version = "1.2"
|
||||
}
|
||||
|
||||
# As of v3, the 'pool' section has replaced the
|
||||
# following v2 configuration items:
|
||||
#
|
||||
# ldap_connections_number
|
||||
|
||||
#
|
||||
# The connection pool is used to pool outgoing connections.
|
||||
#
|
||||
# When the server is not threaded, the connection pool
|
||||
# limits are ignored, and only one connection is used.
|
||||
pool {
|
||||
# Connections to create during module instantiation.
|
||||
# If the server cannot create specified number of
|
||||
# connections during instantiation it will exit.
|
||||
# Set to 0 to allow the server to start without the
|
||||
# directory being available.
|
||||
start = ${thread[pool].start_servers}
|
||||
|
||||
# Minimum number of connections to keep open
|
||||
min = ${thread[pool].min_spare_servers}
|
||||
|
||||
# Maximum number of connections
|
||||
#
|
||||
# If these connections are all in use and a new one
|
||||
# is requested, the request will NOT get a connection.
|
||||
#
|
||||
# Setting 'max' to LESS than the number of threads means
|
||||
# that some threads may starve, and you will see errors
|
||||
# like 'No connections available and at max connection limit'
|
||||
#
|
||||
# Setting 'max' to MORE than the number of threads means
|
||||
# that there are more connections than necessary.
|
||||
max = ${thread[pool].max_servers}
|
||||
|
||||
# Spare connections to be left idle
|
||||
#
|
||||
# NOTE: Idle connections WILL be closed if "idle_timeout"
|
||||
# is set. This should be less than or equal to "max" above.
|
||||
spare = ${thread[pool].max_spare_servers}
|
||||
|
||||
# Number of uses before the connection is closed
|
||||
#
|
||||
# 0 means "infinite"
|
||||
uses = 0
|
||||
|
||||
# The number of seconds to wait after the server tries
|
||||
# to open a connection, and fails. During this time,
|
||||
# no new connections will be opened.
|
||||
retry_delay = 30
|
||||
|
||||
# The lifetime (in seconds) of the connection
|
||||
lifetime = 0
|
||||
|
||||
# Idle timeout (in seconds). A connection which is
|
||||
# unused for this length of time will be closed.
|
||||
idle_timeout = 60
|
||||
|
||||
# NOTE: All configuration settings are enforced. If a
|
||||
# connection is closed because of 'idle_timeout',
|
||||
# 'uses', or 'lifetime', then the total number of
|
||||
# connections MAY fall below 'min'. When that
|
||||
# happens, it will open a new connection. It will
|
||||
# also log a WARNING message.
|
||||
#
|
||||
# The solution is to either lower the 'min' connections,
|
||||
# or increase lifetime/idle_timeout.
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,209 @@
|
||||
#
|
||||
# Configuration file for the rlm_files module.
|
||||
# Please see rlm_files(5) manpage for more information.
|
||||
#
|
||||
# This file contains authentication security and configuration
|
||||
# information for each user. Accounting requests are NOT processed
|
||||
# through this file. Instead, see 'accounting', in this directory.
|
||||
#
|
||||
# The first field is the user's name and can be up to
|
||||
# 253 characters in length. This is followed (on the same line) with
|
||||
# the list of authentication requirements for that user. This can
|
||||
# include password, comm server name, comm server port number, protocol
|
||||
# type (perhaps set by the "hints" file), and huntgroup name (set by
|
||||
# the "huntgroups" file).
|
||||
#
|
||||
# If you are not sure why a particular reply is being sent by the
|
||||
# server, then run the server in debugging mode (radiusd -X), and
|
||||
# you will see which entries in this file are matched.
|
||||
#
|
||||
# When an authentication request is received from the comm server,
|
||||
# these values are tested. Only the first match is used unless the
|
||||
# "Fall-Through" variable is set to "Yes".
|
||||
#
|
||||
# A special user named "DEFAULT" matches on all usernames.
|
||||
# You can have several DEFAULT entries. All entries are processed
|
||||
# in the order they appear in this file. The first entry that
|
||||
# matches the login-request will stop processing unless you use
|
||||
# the Fall-Through variable.
|
||||
#
|
||||
# Indented (with the tab character) lines following the first
|
||||
# line indicate the configuration values to be passed back to
|
||||
# the comm server to allow the initiation of a user session.
|
||||
# This can include things like the PPP configuration values
|
||||
# or the host to log the user onto.
|
||||
#
|
||||
# You can include another `users' file with `$INCLUDE users.other'
|
||||
|
||||
#
|
||||
# For a list of RADIUS attributes, and links to their definitions,
|
||||
# see: http://www.freeradius.org/rfc/attributes.html
|
||||
#
|
||||
# Entries below this point are examples included in the server for
|
||||
# educational purposes. They may be deleted from the deployed
|
||||
# configuration without impacting the operation of the server.
|
||||
#
|
||||
|
||||
# Ldap auth
|
||||
DEFAULT Auth-Type = ldap
|
||||
|
||||
#
|
||||
# Deny access for a specific user. Note that this entry MUST
|
||||
# be before any other 'Auth-Type' attribute which results in the user
|
||||
# being authenticated.
|
||||
#
|
||||
# Note that there is NO 'Fall-Through' attribute, so the user will not
|
||||
# be given any additional resources.
|
||||
#
|
||||
#lameuser Auth-Type := Reject
|
||||
# Reply-Message = "Your account has been disabled."
|
||||
|
||||
#
|
||||
# Deny access for a group of users.
|
||||
#
|
||||
# Note that there is NO 'Fall-Through' attribute, so the user will not
|
||||
# be given any additional resources.
|
||||
#
|
||||
#DEFAULT Group == "disabled", Auth-Type := Reject
|
||||
# Reply-Message = "Your account has been disabled."
|
||||
#
|
||||
|
||||
#
|
||||
# This is a complete entry for "steve". Note that there is no Fall-Through
|
||||
# entry so that no DEFAULT entry will be used, and the user will NOT
|
||||
# get any attributes in addition to the ones listed here.
|
||||
#
|
||||
#steve Cleartext-Password := "testing"
|
||||
# Service-Type = Framed-User,
|
||||
# Framed-Protocol = PPP,
|
||||
# Framed-IP-Address = 172.16.3.33,
|
||||
# Framed-IP-Netmask = 255.255.255.0,
|
||||
# Framed-Routing = Broadcast-Listen,
|
||||
# Framed-Filter-Id = "std.ppp",
|
||||
# Framed-MTU = 1500,
|
||||
# Framed-Compression = Van-Jacobsen-TCP-IP
|
||||
|
||||
#
|
||||
# The canonical testing user which is in most of the
|
||||
# examples.
|
||||
#
|
||||
#bob Cleartext-Password := "hello"
|
||||
# Reply-Message := "Hello, %{User-Name}"
|
||||
#
|
||||
|
||||
#
|
||||
# This is an entry for a user with a space in their name.
|
||||
# Note the double quotes surrounding the name. If you have
|
||||
# users with spaces in their names, you must also change
|
||||
# the "filter_username" policy to allow spaces.
|
||||
#
|
||||
# See raddb/policy.d/filter, filter_username {} section.
|
||||
#
|
||||
#"John Doe" Cleartext-Password := "hello"
|
||||
# Reply-Message = "Hello, %{User-Name}"
|
||||
|
||||
#
|
||||
# Dial user back and telnet to the default host for that port
|
||||
#
|
||||
#Deg Cleartext-Password := "ge55ged"
|
||||
# Service-Type = Callback-Login-User,
|
||||
# Login-IP-Host = 0.0.0.0,
|
||||
# Callback-Number = "9,5551212",
|
||||
# Login-Service = Telnet,
|
||||
# Login-TCP-Port = Telnet
|
||||
|
||||
#
|
||||
# Another complete entry. After the user "dialbk" has logged in, the
|
||||
# connection will be broken and the user will be dialed back after which
|
||||
# he will get a connection to the host "timeshare1".
|
||||
#
|
||||
#dialbk Cleartext-Password := "callme"
|
||||
# Service-Type = Callback-Login-User,
|
||||
# Login-IP-Host = timeshare1,
|
||||
# Login-Service = PortMaster,
|
||||
# Callback-Number = "9,1-800-555-1212"
|
||||
|
||||
#
|
||||
# user "swilson" will only get a static IP number if he logs in with
|
||||
# a framed protocol on a terminal server in Alphen (see the huntgroups file).
|
||||
#
|
||||
# Note that by setting "Fall-Through", other attributes will be added from
|
||||
# the following DEFAULT entries
|
||||
#
|
||||
#swilson Service-Type == Framed-User, Huntgroup-Name == "alphen"
|
||||
# Framed-IP-Address = 192.0.2.65,
|
||||
# Fall-Through = Yes
|
||||
|
||||
#
|
||||
# If the user logs in as 'username.shell', then authenticate them
|
||||
# using the default method, give them shell access, and stop processing
|
||||
# the rest of the file.
|
||||
#
|
||||
#DEFAULT Suffix == ".shell"
|
||||
# Service-Type = Login-User,
|
||||
# Login-Service = Telnet,
|
||||
# Login-IP-Host = your.shell.machine
|
||||
|
||||
|
||||
#
|
||||
# The rest of this file contains the several DEFAULT entries.
|
||||
# DEFAULT entries match with all login names.
|
||||
# Note that DEFAULT entries can also Fall-Through (see first entry).
|
||||
# A name-value pair from a DEFAULT entry will _NEVER_ override
|
||||
# an already existing name-value pair.
|
||||
#
|
||||
|
||||
# Sample defaults for all framed connections.
|
||||
#
|
||||
#DEFAULT Service-Type == Framed-User
|
||||
# Framed-IP-Address = 255.255.255.254,
|
||||
# Framed-MTU = 576,
|
||||
# Service-Type = Framed-User,
|
||||
# Fall-Through = Yes
|
||||
|
||||
#
|
||||
# Default for PPP: dynamic IP address, PPP mode, VJ-compression.
|
||||
# NOTE: we do not use Hint = "PPP", since PPP might also be auto-detected
|
||||
# by the terminal server in which case there may not be a "P" suffix.
|
||||
# The terminal server sends "Framed-Protocol = PPP" for auto PPP.
|
||||
#
|
||||
DEFAULT Framed-Protocol == PPP
|
||||
Framed-Protocol = PPP,
|
||||
Framed-Compression = Van-Jacobson-TCP-IP
|
||||
|
||||
#
|
||||
# Default for CSLIP: dynamic IP address, SLIP mode, VJ-compression.
|
||||
#
|
||||
DEFAULT Hint == "CSLIP"
|
||||
Framed-Protocol = SLIP,
|
||||
Framed-Compression = Van-Jacobson-TCP-IP
|
||||
|
||||
#
|
||||
# Default for SLIP: dynamic IP address, SLIP mode.
|
||||
#
|
||||
DEFAULT Hint == "SLIP"
|
||||
Framed-Protocol = SLIP
|
||||
|
||||
#
|
||||
# Last default: rlogin to our main server.
|
||||
#
|
||||
#DEFAULT
|
||||
# Service-Type = Login-User,
|
||||
# Login-Service = Rlogin,
|
||||
# Login-IP-Host = shellbox.ispdomain.com
|
||||
|
||||
# #
|
||||
# # Last default: shell on the local terminal server.
|
||||
# #
|
||||
# DEFAULT
|
||||
# Service-Type = Administrative-User
|
||||
|
||||
|
||||
# On no match, the user is denied access.
|
||||
|
||||
|
||||
#########################################################
|
||||
# You should add test accounts to the TOP of this file! #
|
||||
# See the example user "bob" above. #
|
||||
#########################################################
|
||||
|
||||
Symlink
+1
@@ -0,0 +1 @@
|
||||
../mods-available/ldap
|
||||
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user