##
## radiusd.conf	-- FreeRADIUS server configuration file.
##
##	http://www.freeradius.org/
##	$Id$
##

prefix = /usr
exec_prefix = /usr
sysconfdir = /etc
localstatedir = /var
sbindir = ${exec_prefix}/sbin
logdir = /var/log/freeradius
log_file = /var/log/freeradius/radius.log
raddbdir = /etc/freeradius
radacctdir = ${logdir}/radacct

#  Location of config and logfiles.
confdir = ${raddbdir}
run_dir = /var/run/freeradius

# Should likely be ${localstatedir}/lib/radiusd
db_dir = ${raddbdir}

# reasd the acctusers file
acctusersfile = ${confdir}/acct_users

log sectiong {
logdir = /var/log/freeradius
log_file = /var/log/freeradius/radius.log
}




libdir = /usr/lib/freeradius

pidfile = /var/run/freeradius/freeradius.pid


max_request_time = 30

delete_blocked_requests = no

cleanup_delay = 5

max_requests = 1024

listen {
	ipaddr = *
	port = 1812
	type = auth
}
listen {
	type = acct
    ipaddr = *
    port = 1813
}
hostname_lookups = no
allow_core_dumps = no
regular_expressions	= yes
extended_expressions	= yes
log_stripped_names = no
log_auth = no
log_auth_badpass = no
log_auth_goodpass = no
usercollide = no
lower_user = no
lower_pass = no
nospace_user = no
nospace_pass = no
checkrad = ${sbindir}/checkrad

security {
	max_attributes = 200
	reject_delay = 1
	status_server = yes
}

proxy_requests  = yes

	realm murray{
		format = prefix
		delimiter = "/"
		ignore_default = no
		ignore_null = no
        authhost    = 10.0.0.101:1812
        accthost    = 10.0.0.101:1813
        secret = secret
	}
    realm NULL{
    }
    realm default{
    }
    realm default {
    }

client 0.0.0.0/0 {
	secret = secret
	shortname = swak
}

snmp	= no

thread pool {
	start_servers = 5
	max_servers = 32
	min_spare_servers = 3
	max_spare_servers = 10
	max_requests_per_server = 0
}

modules {

    realm prefix {
        format=prefix
        delimiter = "/"
    }
    realm realm_prefix {
        format=prefix
        delimiter = "/"
    }
        
    realm default {
    }

 perl {
               module = /etc/freeradius/perl_module.pm
       }

	pap {
		encryption_scheme = crypt
	}
	chap {
		authtype = CHAP
	}



	checkval {
		item-name = Calling-Station-Id
		check-name = Calling-Station-Id
		data-type = string
	}
	
	preprocess {
        # allow rewriting packets based on prefex/suffex
		hints = ${confdir}/hints

		# This hack changes Ascend's wierd port numberings
		# to standard 0-??? port numbers so that the "+" works
		# for IP address assignments.
		with_ascend_hack = no
		ascend_channels_per_line = 23
	}

	# Write a detailed log of all accounting records received.
	#
	detail {
		detailfile = ${radacctdir}/%{NAS-Identifier}/%Y-%m-%d
		detailperm = 0600
	}

	acct_unique {
		key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
	}

	radutmp {
		filename = ${logdir}/radutmp
		username = %{User-Name}
		case_sensitive = yes
		check_with_nas = yes		
		perm = 0600
		callerid = "yes"
	}

	radutmp sradutmp {
		filename = ${logdir}/sradutmp
		perm = 0644
		callerid = "no"
	}

	attr_filter {
		attrsfile = ${confdir}/attrs
	}

	counter daily {
		filename = ${raddbdir}/db.daily
		key = User-Name
		count-attribute = Acct-Session-Time
		reset = daily
		counter-name = Daily-Session-Time
		check-name = Max-Daily-Session
		allowed-servicetype = Framed-User
		#ache-size = 5000
	}

	always fail {
		rcode = fail
	}
	always reject {
		rcode = reject
	}
	always ok {
		rcode = ok
		simulcount = 0
		mpp = no
	}

	expr {
	}

	digest {
	}

	exec {
		wait = yes
		input_pairs = request
	}


	ippool main_pool {

		range-start = 192.168.1.1
		range-stop = 192.168.3.254
		netmask = 255.255.255.0

		cache-size = 800
		# session-db: The main db file used to allocate ip's to clients
		session-db = ${raddbdir}/db.ippool
		# ip-index: Helper db index file used in multilink
		ip-index = ${raddbdir}/db.ipindex
		# override: Will this ippool override a Framed-IP-Address already set
		override = no
		# maximum-timeout: If not zero specifies the maximum time in seconds an
		# entry may be active. Default: 0
		maximum-timeout = 0
	}
}

instantiate {
	exec
	expr
}

authorize {
	preprocess
	update control {
		Auth-Type := perl
	}
	    realm_prefix
	perl 
	chap
	detail
}

authenticate {
	Auth-Type Perl {
		perl
	}
	Auth-Type PAP {
		pap
	}
	Auth-Type CHAP {
		chap
	}
}


preacct {
	preprocess
	realm_prefix
	#
	#  Ensure that we have a semi-unique identifier for every
	#  request, and many NAS boxes are broken.
	acct_unique
}

#
#  Accounting.  Log the accounting data.
#
accounting {
	perl
# prevent proxying of Interim-Update packets
	 if (Acct-Status-Type == Interim-Update) {
	       update control {
		    Proxy-To-Realm := LOCAL
		   }
	    }

}

#  Session database, used for checking Simultaneous-Use. Either the radutmp 
#  or rlm_sql module can handle this.
#  The rlm_sql module is *much* faster
session {
}

#  Post-Authentication
#  Once we KNOW that the user has been authenticated, there are
#  additional steps we can take.
post-auth {
	perl
}

#
#  When the server decides to proxy a request to a home server,
#  the proxied request is first passed through the pre-proxy
#  stage.  This stage can re-write the request, or decide to
#  cancel the proxy.
#
#  Only a few modules currently have this method.
#
pre-proxy {
}

#
#  When the server receives a reply to a request it proxied
#  to a home server, the request may be massaged here, in the
#  post-proxy stage.
#
post-proxy {
}
