
prefix = /usr
exec_prefix = /usr
sysconfdir = /etc
localstatedir = /var
sbindir = ${exec_prefix}/sbin
logdir = /var/log/freeradius
raddbdir = /etc/freeradius
radacctdir = ${logdir}/radacct

#  Location of config and logfiles.
confdir = ${raddbdir}
run_dir = ${localstatedir}/run/freeradius

#
#  The logging messages for the server are appended to the
#  tail of this file.
#
log_file = ${logdir}/radius.log

libdir = /usr/lib/freeradius

pidfile = ${run_dir}/freeradius.pid

user = freerad
group = freerad

max_request_time = 30

delete_blocked_requests = no

cleanup_delay = 5

max_requests = 1024

bind_address = *

port = 0

#listen {
	#  IP address on which to listen.
	#  Allowed values are:
	#	dotted quad (1.2.3.4)
	#       hostname    (radius.example.com)
	#       wildcard    (*)
#	ipaddr = *

	#  Port on which to listen.
	#  Allowed values are:
	#	integer port number (1812)
	#	0 means "use /etc/services for the proper port"
#	port = 0

	#  Type of packets to listen for.
	#  Allowed values are:
	#	auth	listen for authentication packets
	#	acct	listen for accounting packets
	#
#	type = auth
#}

hostname_lookups = no

allow_core_dumps = no

regular_expressions	= yes
extended_expressions	= yes

log_stripped_names = no
log_auth = no
log_auth_badpass = no
log_auth_goodpass = no

usercollide = no

lower_user = no
lower_pass = no

nospace_user = no
nospace_pass = no

#  The program to execute to do concurrency checks.
checkrad = ${sbindir}/checkrad

security {
	max_attributes = 200
	reject_delay = 1
	status_server = no
}

proxy_requests  = yes
$INCLUDE  ${confdir}/proxy.conf
$INCLUDE  ${confdir}/clients.conf
snmp	= no
$INCLUDE  ${confdir}/snmp.conf

thread pool {
	start_servers = 5
	max_servers = 32
	min_spare_servers = 3
	max_spare_servers = 10
	max_requests_per_server = 0
}

modules {

perl {
               module = /usr/local/bin/login.pl
               func_authenticate = authenticate
               func_authorize = authorize
               #func_preacct = preacct
               #func_accounting = radutmp
               #func_checksimul = checksimul
               #func_pre_proxy = pre_proxy
               #func_post_proxy = post_proxy
               #func_post_auth = post_auth
               #func_xlat = xlat
               #func_detach = detach

               #
               #  Comment out the following line if you whish
               #  to use seperate functions for Start and Stop
               #  accounting packets. In that case, the
               #  func_accounting function is not called.
               #
               #func_start_accounting = accounting_start
               #func_stop_accounting = accounting_stop

               max_clones = 32
               start_clones = 32
               min_spare_clones = 0
               max_spare_clones = 32
               cleanup_delay = 5
               max_request_per_clone = 0
       }

	pap {
		auto_header = yes
	}

	chap {
		authtype = CHAP
	}

	pam {
		pam_auth = radiusd
	}
	unix {
		cache = no
		# Reload the cache every 600 seconds (10mins). 0 to disable.
		cache_reload = 600
		shadow = /etc/shadow
		radwtmp = ${logdir}/radwtmp
	}
$INCLUDE ${confdir}/eap.conf
	mschap {
		#use_mppe = no
		#require_encryption = yes
		#require_strong = yes
		#with_ntdomain_hack = no
		# Be VERY careful when editing the following line!
		#
		#ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
	}

	# Lightweight Directory Access Protocol (LDAP)
	ldap {
		server = "ldap.your.domain"
		# identity = "cn=admin,o=My Org,c=UA"
		# password = mypass
		basedn = "o=My Org,c=UA"
		filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
		# base_filter = "(objectclass=radiusprofile)"

		# set this to 'yes' to use TLS encrypted connections
		# to the LDAP database by using the StartTLS extended
		# operation.
		# The StartTLS operation is supposed to be used with normal
		# ldap connections instead of using ldaps (port 689) connections
		start_tls = no

		# tls_cacertfile	= /path/to/cacert.pem
		# tls_cacertdir		= /path/to/ca/dir/
		# tls_certfile		= /path/to/radius.crt
		# tls_keyfile		= /path/to/radius.key
		# tls_randfile		= /path/to/rnd
		# tls_require_cert	= "demand"

		# default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA"
		# profile_attribute = "radiusProfileDn"
		access_attr = "dialupAccess"

		# Mapping of RADIUS dictionary attributes to LDAP
		# directory attributes.
		dictionary_mapping = ${raddbdir}/ldap.attrmap

		ldap_connections_number = 5
		edir_account_policy_check=no
		#
		# groupname_attribute = cn
		# groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"
		# groupmembership_attribute = radiusGroupName
		timeout = 4
		timelimit = 3
		net_timeout = 1
		# compare_check_items = yes
		# do_xlat = yes
		# access_attr_used_for_allow = yes

		# set_auth_type = yes
	}

	#passwd etc_smbpasswd {
	#	filename = /etc/smbpasswd
	#	format = "*User-Name::LM-Password:NT-Password:SMB-Account-CTRL-TEXT::"
	#	authtype = MS-CHAP
	#	hashsize = 100
	#	ignorenislike = no
	#	allowmultiplekeys = no
	#}

	#passwd etc_group {
	#	filename = /etc/group
	#	format = "=Group-Name:::*,User-Name"
	#	hashsize = 50
	#	ignorenislike = yes
	#	allowmultiplekeys = yes
	#	delimiter = ":"
	#}

	#  'realm/username'
	#
	#  Using this entry, IPASS users have their realm set to "IPASS".
	realm IPASS {
		format = prefix
		delimiter = "/"
		ignore_default = no
		ignore_null = no
	}

	#  'username@realm'
	#
	realm suffix {
		format = suffix
		delimiter = "@"
		ignore_default = no
		ignore_null = no
	}

	#  'username%realm'
	#
	realm realmpercent {
		format = suffix
		delimiter = "%"
		ignore_default = no
		ignore_null = no
	}

	#
	#  'domain\user'
	#
	realm ntdomain {
		format = prefix
		delimiter = "\\"
		ignore_default = no
		ignore_null = no
	}	

	checkval {
		# The attribute to look for in the request
		item-name = Calling-Station-Id

		# The attribute to look for in check items. Can be multi valued
		check-name = Calling-Station-Id

		# The data type. Can be
		# string,integer,ipaddr,date,abinary,octets
		data-type = string

		# If set to yes and we dont find the item-name attribute in the
		# request then we send back a reject
		# DEFAULT is no
		#notfound-reject = no
	}
	
	#attr_rewrite sanecallerid {
	#	attribute = Called-Station-Id
		# may be "packet", "reply", "proxy", "proxy_reply" or "config"
	#	searchin = packet
	#	searchfor = "[+ ]"
	#	replacewith = ""
	#	ignore_case = no
	#	new_attribute = no
	#	max_matches = 10
	#	## If set to yes then the replace string will be appended to the original string
	#	append = no
	#}

	preprocess {
		huntgroups = ${confdir}/huntgroups
		hints = ${confdir}/hints

		# This hack changes Ascend's wierd port numberings
		# to standard 0-??? port numbers so that the "+" works
		# for IP address assignments.
		with_ascend_hack = no
		ascend_channels_per_line = 23

		with_ntdomain_hack = no

		with_specialix_jetstream_hack = no

		with_cisco_vsa_hack = no
	}

	# Livingston-style 'users' file
	#
	files {
		usersfile = ${confdir}/users
		acctusersfile = ${confdir}/acct_users
		preproxy_usersfile = ${confdir}/preproxy_users

		compat = no
	}

	# Write a detailed log of all accounting records received.
	#
	detail {
		detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d

		detailperm = 0600

		#suppress {
			# User-Password
		#}
	}

	# detail auth_log {
		# detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d

		#
		#  This MUST be 0600, otherwise anyone can read
		#  the users passwords!
		# detailperm = 0600
	# }

	# detail reply_log {
		# detailfile = ${radacctdir}/%{Client-IP-Address}/reply-detail-%Y%m%d

		#
		#  This MUST be 0600, otherwise anyone can read
		#  the users passwords!
		# detailperm = 0600
	# }
	# detail pre_proxy_log {
		# detailfile = ${radacctdir}/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d

		#
		#  This MUST be 0600, otherwise anyone can read
		#  the users passwords!
		# detailperm = 0600
	# }

	# detail post_proxy_log {
		# detailfile = ${radacctdir}/%{Client-IP-Address}/post-proxy-detail-%Y%m%d

		#
		#  This MUST be 0600, otherwise anyone can read
		#  the users passwords!
		# detailperm = 0600
	# }

	sql_log {
		path = ${radacctdir}/sql-relay
		acct_table = "radacct"
		postauth_table = "radpostauth"

		Start = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \
		 NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \
		 AcctSessionTime, AcctTerminateCause) VALUES                 \
		 ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \
		 '%{Framed-IP-Address}', '%S', '0', '0', '');"
		Stop = "INSERT INTO ${acct_table} (AcctSessionId, UserName,  \
		 NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \
		 AcctSessionTime, AcctTerminateCause) VALUES                 \
		 ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \
		 '%{Framed-IP-Address}', '0', '%S', '%{Acct-Session-Time}',  \
		 '%{Acct-Terminate-Cause}');"
		Alive = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \
		 NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \
		 AcctSessionTime, AcctTerminateCause) VALUES                 \
		 ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \
		 '%{Framed-IP-Address}', '0', '0', '%{Acct-Session-Time}','');"

		Post-Auth = "INSERT INTO ${postauth_table}                   \
		 (user, pass, reply, date) VALUES                            \
		 ('%{User-Name}', '%{User-Password:-Chap-Password}',         \
		 '%{reply:Packet-Type}', '%S');"
	}

	acct_unique {
		key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
	}
	$INCLUDE  ${confdir}/sql.conf


	radutmp {
		#  Where the file is stored.  It's not a log file,
		#  so it doesn't need rotating.
		#
		filename = ${logdir}/radutmp

		#  You may want instead: %{Stripped-User-Name:-%{User-Name}}
		username = %{User-Name}
		case_sensitive = yes
		check_with_nas = yes		
		perm = 0600
		callerid = "yes"
	}
	radutmp sradutmp {
		filename = ${logdir}/sradutmp
		perm = 0644
		callerid = "no"
	}

	attr_filter {
		attrsfile = ${confdir}/attrs
	}

	#
	#  DEFAULT Max-Daily-Session := 36000
	#          Fall-Through = 1
	counter daily {
		filename = ${raddbdir}/db.daily
		key = User-Name
		count-attribute = Acct-Session-Time
		reset = daily
		counter-name = Daily-Session-Time
		check-name = Max-Daily-Session
		allowed-servicetype = Framed-User
		cache-size = 5000
	}

	sqlcounter dailycounter {
		counter-name = Daily-Session-Time
		check-name = Max-Daily-Session
		reply-name = Session-Timeout
		sqlmod-inst = sql
		key = User-Name
		reset = daily

		query = "SELECT SUM(AcctSessionTime - \
                 GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \
                 FROM radacct WHERE UserName='%{%k}' AND \
                 UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'"

		# For mysql:
#		query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE \
#                UserName='%{%k}' AND AcctStartTime > FROM_UNIXTIME('%b')"


		# For mysql:
#		query = "SELECT SUM(AcctSessionTime) FROM radacct \
#                WHERE UserName='%{%k}' AND AcctStartTime BETWEEN \
#                FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')"

	}

	sqlcounter monthlycounter {
		counter-name = Monthly-Session-Time
		check-name = Max-Monthly-Session
		reply-name = Session-Timeout
		sqlmod-inst = sql
		key = User-Name
		reset = monthly

		query = "SELECT SUM(AcctSessionTime - \
                 GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \
                 FROM radacct WHERE UserName='%{%k}' AND \
                 UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'"

		# This query ignores calls that started in a previous
		# reset period and continue into into this one. But it
		# is a little easier on the SQL server
#		query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE \
#                UserName='%{%k}' AND AcctStartTime > FROM_UNIXTIME('%b')"

		# This query is the same as above, but demonstrates an
		# additional counter parameter '%e' which is the
		# timestamp for the end of the period
#		query = "SELECT SUM(AcctSessionTime) FROM radacct \
#                WHERE UserName='%{%k}' AND AcctStartTime BETWEEN \
#                FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')"
	}

	#
	# The "always" module is here for debugging purposes. Each
	# instance simply returns the same result, always, without
	# doing anything.
	always fail {
		rcode = fail
	}
	always reject {
		rcode = reject
	}
	always ok {
		rcode = ok
		simulcount = 0
		mpp = no
	}

	expr {
	}

	digest {
	}

	exec {
		wait = yes
		input_pairs = request
	}

	exec echo {
		wait = yes
		program = "/bin/echo %{User-Name}"
		input_pairs = request
		output_pairs = reply
		#packet_type = Access-Accept
	}

	ippool main_pool {

		#  range-start,range-stop: The start and end ip
		#  addresses for the ip pool
		range-start = 192.168.1.1
		range-stop = 192.168.3.254

		#  netmask: The network mask used for the ip's
		netmask = 255.255.255.0

		#  cache-size: The gdbm cache size for the db
		#  files. Should be equal to the number of ip's
		#  available in the ip pool
		cache-size = 800

		# session-db: The main db file used to allocate ip's to clients
		session-db = ${raddbdir}/db.ippool

		# ip-index: Helper db index file used in multilink
		ip-index = ${raddbdir}/db.ipindex

		# override: Will this ippool override a Framed-IP-Address already set
		override = no

		# maximum-timeout: If not zero specifies the maximum time in seconds an
		# entry may be active. Default: 0
		maximum-timeout = 0
	}

	# $INCLUDE  ${confdir}/sqlippool.conf

	# OTP token support.  Not included by default.
	# $INCLUDE  ${confdir}/otp.conf

}

instantiate {
	exec
	expr
#	daily
}
authorize {
	preprocess
#	auth_log
	
#	attr_filter

	#
	#  The chap module will set 'Auth-Type := CHAP' if we are
	#  handling a CHAP request and Auth-Type has not already been set
	chap

	mschap

#	digest
#	IPASS

	suffix
#	ntdomain

	eap
	files
	perl
	sql
#	etc_smbpasswd
#	ldap
#	daily
#	checkval
	pap
}


#  Authentication.
authenticate {
	Auth-Type PAP {
		pap
	}
	Auth-Type CHAP {
		chap
	}

	Auth-Type MS-CHAP {
		mschap
	}

     Auth-Type Perl {

        perl 

    } 

#	digest
#	pam
	unix
#	Auth-Type LDAP {
#		ldap
#	}

	eap
}




preacct {
	preprocess

	acct_unique

#	IPASS
	suffix
#	ntdomain

	#
	#  Read the 'acct_users' file
	files
}

#
#  Accounting.  Log the accounting data.
#
accounting {
	detail
#	daily
	unix
	radutmp
#	sradutmp

	#  Return an address to the IP Pool when we see a stop record.
#	main_pool

	sql
#	sql_log

	#  Cisco VoIP specific bulk accounting
#	pgsql-voip
	
	perl
}

session {
	radutmp
	sql
}


#  Post-Authentication
post-auth {
	#  Get an address from the IP Pool.
#	main_pool

#	reply_log
	sql

#	sql_log

#	ldap
	#
	#
#	Post-Auth-Type REJECT {
#		insert-module-name-here
#	}

}

pre-proxy {
#	attr_rewrite

	#  Uncomment the following line if you want to change attributes
	#  as defined in the preproxy_users file.
#	files

	#  If you want to have a log of packets proxied to a home
	#  server, un-comment the following line, and the
	#  'detail pre_proxy_log' section, above.
#	pre_proxy_log
}

post-proxy {

#	post_proxy_log

#	attr_rewrite

#	attr_filter

	eap
}
