Radiusd.conf文件是freeradius的核心配置文件， 其中设置了 服务器的基本信息， 配置文件与日志文件的环境变量，并详细配置freeradius模块所使用的信息， 与认证和计费所使用模块的配置. 配置的变量定义的形式为${foo}，他们就在这个文件上，并且不随请求到请求而改变. 变量的格式参照 variables.txt.

1.1 环境变量

此处定义其他配置文件以及目录的位置，也就是环境变量

prefix = /usr/local

exec_prefix = ${prefix}

sysconfdir = ${prefix}/etc

localstatedir = ${prefix}/var

sbindir = ${exec_prefix}/sbin

logdir = ${localstatedir}/log/radius

raddbdir = ${sysconfdir}/raddb

radacctdir = ${logdir}/radacct

配置文件和日志文件的位置

confdir = ${raddbdir}

run_dir = ${localstatedir}/run/radiusd

日志文件的信息，添加到如下配置文件的底部

log_file = ${logdir}/radius.log

1.2 全局配置

模块的位置由 libdir来配置。

如果不能工作，那么你可以从新配置，从新Build源码，并且使用 共享库。

pidfile: Where to place the PID of the RADIUS server.

pidfile = ${run_dir}/radiusd.pid

user/group

如果有评论，服务器会运行 用户/组 启动它. 修改用户/组，必须具有root权限启动服务器

这里的含义是指定启动radius服务可以限定操作系统上的用户和组，但是不建议启动它.

#user = nobody

#group = nobody

最长请求时间(秒)，这样的问题经常需要存在在应用SQL数据库时候，建议设置为5秒到120秒之间.

max_reqst_time = 30

当请求超过最长请求时间的时候，可以设置服务器删除请求.

当你的服务在threaded(线程下)运行，或者 线程池(thread pool) 模式，建议这里设置为no.

但用threaded 服务设置为yes时，有可能使服务器崩溃.

delete_blocked_reqsts = no

在 reply 发送给NAS后的等待清空时间. 建议 2秒 到 10秒

cleanup_delay = 5

服务器的请求最大数 ，建议值 256 到无穷

max_reqsts = 1024

让服务器监听某个IP，并且从次IP发送 相应 信息. 主要是为了 服务器同时具有多服务器时候使用.

bind_address = *

可以指定raidus的使用端口号，使用0表示使用默认的radius端口， 在配置文件 /etc/services配置.

port = 0

如果需要服务器同时监听其他的IP，可以用listen 块. 下面是例子

#listen {

# IP address on which to listen.

# Allowed vals are:

# dotted q? (1.2.3.4)

# hostname (radius.example.com)

# wildcard (*)

# ipaddr = *

# Port on which to listen.

# Allowed vals are:

# integer port number (1812)

# 0 means "use /etc/services for the proper port"

# port = 0

# Type of packets to listen for.

# Allowed vals are:

# auth listen for authentication packets

# acct listen for accounting packets

#

# type = auth

#}

hostname_lookups大概是表示为NAS查找它的域名信息?可以通过域名配置NAS?

hostname_lookups = no

是否允许 core dumps.

allow_core_dumps = no

expressions支持，规则和扩展.

regular_expressions = yes

extended_expressions = yes

记录User-Name属性的全称.

log_stripped_names = no

是否记录认证请求信息到日志文件

log_auth = no

当请求被拒绝时记录密码， 当请求正确时记录密码

log_auth_badpass = no

log_auth_goodpass = no

是否允许用户名冲突，即重复同用户同时登陆.强烈不建议启用重复用户.

usercollide = no

将用户名 小写化， 将密码小写化.

lower_user = no

lower_pass = no

是否去除用户名和密码中的空格

nospace_user = no

nospace_pass = no

程序执行并发检查(不理解含义)

checkrad = ${sbindir}/checkrad

安全 配置 域

security {

指在Radius包中的最大属性数目.设置为0表示无穷大.

max_attributes = 200

发送 Access-Reject 包时候，可以设置一定的延迟，以缓慢DOS攻击，也可以缓慢穷举破解用户名和密码的攻击

reject_delay = 1

服务器是否对状态服务器的请求信息进行相应.

status_server = no

}

PROXY CONFIGURATION

代理域.

是否开启代理服务，具体配置参照 ${confdir}/proxy.conf

proxy_reqsts = yes

$INCL? ${confdir}/proxy.conf

Clients配置

$INCL? ${confdir}/clients.conf

是否启用snmp配置，具体配置文件在snmp.conf

snmp = no

$INCL? ${confdir}/snmp.conf

线程池 配置 域

thread pool {

启动时服务的个数.(在启动Mysql模块后可以明显看到.)当同时进行的请求数超过5个时，会增加线程服务.

start_servers = 5

最大的服务数

max_servers = 32

当少于最少空闲服务时，它会建立服务，大于最大空闲服务时会停止多余的服务.

最少空闲服务，与最大空闲服务.

min_spare_servers = 3

max_spare_servers = 10

每个server最大的请求数.当有内存漏洞时，可能需要配置.

max_reqsts_per_server = 0

}

1.3 模块配置
1.3.1 PAP 模块

# Supports multiple encryption schemes 支持多种加密方式

# clear: Clear text 明文

# crypt: Unix crypt Unix 加密

# md5: MD5 ecnryption MD5加密

# sha1: SHA1 encryption. SHA1加密

# DEFAULT: crypt 默认是Unix加密

pap {

encryption_scheme = crypt

}

1.3.2 CHAP模块

chap {

authtype = CHAP

}

1.3.3 PAM模块

PAM模块 (PAM) 是行业标准验证框架，

鉴于很多系统的PAM库都有内存漏洞，所以不建议使用。

pam {

pam_auth = radiusd

}

1.3.4 UNIX 系统用户的 认证模块

unix {

cache = no

cache_reload = 600

# passwd = /etc/passwd

# shadow = /etc/shadow

# group = /etc/group

radwtmp = ${logdir}/radwtmp

}

1.3.5 EAP模块

详细见${confdir}/eap.conf

$INCL? ${confdir}/eap.conf

1.3.6 MSCHAP 模块

mschap {

#use_mppe = no

#require_encryption = yes

#require_strong = yes

# 为了纠正window发送chap时有时包括域，有时又不包括域的信息.

#with_ntdomain_hack = no#ntlm_auth = "/path/to/ntlm_auth –reqst-nt-key –username=%{Stripped-User-Name:-%{User-Name:-None}} –challenge=%{mschap:Challenge:-00} –nt-response=%{mschap:NT-Response:-00}"

}

1.3.7 LDAP 配置 模块

LDAP模块只能在Access-Reqst packet 中包含明文密码属性才可以被使用。LDAP认证不能在其他任何认证方法中使用。

具体配置详见下属章节。（参看doc/rlm_ldap）。

1.3.8 passwd 模块

Passwd模块允许通过任何passwd样式的文件进行授权，并可以从这些模块中提取属性信息。

smbpasswd例子

#passwd etc_smbpasswd {

# filename = /etc/smbpasswd

# format = "*User-Name::LM-Password:NT-Password:SMB-Account-CTRL-TEXT::"

# authtype = MS-CHAP

# hashsize = 100

# ignorenislike = no

# allowmultiplekeys = no

#}

#passwd etc_group {

# filename = /etc/group

# format = "=Group-Name:::*，User-Name"

# hashsize = 50

# ignorenislike = yes

# allowmultiplekeys = yes

# delimiter = ":"

#}

1.3.9 Realm 模块

应用在代理上. You can have multiple instances of the realm module to support multiple realm syntaxs at the same time. The search order is defined by the order in the authorize and preacct sections.

realm IPASS {

format = prefix

delimiter = "/"

ignore_default = no

ignore_null = no

}

# ‘username@realm’

#

realm s?ix {

format = s?ix

delimiter = "@"

ignore_default = no

ignore_null = no

}

# ‘username%realm’

#

realm realmpercent {

format = s?ix

delimiter = "%"

ignore_default = no

ignore_null = no

}

# ‘domain\user’

#

realm ntdomain {

format = prefix

delimiter = "\\"

ignore_default = no

ignore_null = no

}

1.3.10 简单值检查模块(checkval)

It can be used to check if an attribute val in the reqst matches a (possibly multi vald) attribute in the check items This can be used for example for caller-id authentication. For the module to run， both the reqst attribute and the check items attribute must exist.

checkval {

# The attribute to look for in the reqst

# Reqst包中查找的属性名称

item-name = Calling-Station-Id

# The attribute to look for in check items. Can be multi vald

# Check 表中查找的属性名称

check-name = Calling-Station-Id

# The data type. Can be

# 数据类型的种类

# string，integer，ipaddr，date，abinary，octets

data-type = string

# If set to yes and we dont find the item-name attribute in the

# reqst then we send back a reject

# 如果设置为yes，我们不在reqst包中查找属性名称直接发送reject.

# DEFAULT is no

#notfound-reject = no

}

1.3.11 从写属性模块(attr_rewrite)

从写任何包，在认证和计费时都很有用.在拿到包后，可以从写包里属性的内容.

#attr_rewrite sanecallerid {

# attribute = Called-Station-Id

# may be "packet"， "reply"， "proxy"， "proxy_reply" or "config"

# searchin = packet

# searchfor = "[+ ]"

# replacewith = ""

# ignore_case = no

# new_attribute = no

# max_matches = 10

# ## If set to yes then the replace string will be appended to the original string

# append = no

#}

1.3.12 预处理radius请求模块(preprocess)

预处理Radius请求，在交付其他模块处理前. 包含这两个配置文件. 可以从写那些由一些NAS添加的很奇怪的属性.然后把这些属性转换到一个形态。参见第二章。

配置实例:

preprocess {

huntgroups = ${confdir}/huntgroups

hints = ${confdir}/hints

with_ascend_hack = no

ascend_channels_per_line = 23

with_ntdomain_hack = no

with_specialix_jetstream_hack = no

with_cisco_vsa_hack = no

}

1.3.13 用户文件模块(files)

files {

usersfile = ${confdir}/users

acctusersfile = ${confdir}/acct_users

preproxy_usersfile = ${confdir}/preproxy_users

compat = no

}

1.3.14 日志信息记录模块(detail)

将计费信息详细记录到文件上，按照设定时间，每隔一个时段生成一个新文件记录.

detail {

detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d

detailperm = 0600

#suppress {

# User-Password

#}

}

将认证信息详细记录到文件上，按照设定时间，每隔一个时段生成一个新文件记录.

detail auth_log {

detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d

This MUST be 0600， otherwise anyone can read

the users passwords!

detailperm = 0600

}

将相应(Reply)信息详细记录到文件上，按照设定时间，每隔一个时段生成一个新文件记录

detail reply_log {

detailfile = ${radacctdir}/%{Client-IP-Address}/reply-detail-%Y%m%d

This MUST be 0600， otherwise anyone can read

the users passwords!

detailperm = 0600

}

This module logs packets proxied to a home server.

detail pre_proxy_log {

detailfile = ${radacctdir}/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d

This MUST be 0600， otherwise anyone can read

the users passwords!

detailperm = 0600

}

This module logs response packets from a home server.

detail post_proxy_log {

detailfile = ${radacctdir}/%{Client-IP-Address}/post-proxy-detail-%Y%m%d

This MUST be 0600， otherwise anyone can read

the users passwords!

detailperm = 0600

}

1.3.15 SQL日志记录模块(sql_log)

The rlm_sql_log module appends the SQL qries in a log file which is read later by the radsqlrelay program.

它只是将sql语句写到文件里，而后由radsqlrelay程序读取.

参看

1.3.16 计费唯一sessionid模块

针对NAS不停重复Acct-Session-Id vals造成混淆的问题，建立唯一的计费sessionid

acct_uniq {

key = "User-Name， Acct-Session-Id， NAS-IP-Address， Client-IP-Address， NAS-Port"

}

1.3.17 SQL模块

通过$INCL?来把数据库的模块的配置文件链接进来.

# The following configuration file is for use with MySQL.

#

# For Postgresql， use: ${confdir}/postgresql.conf

# For MS-SQL， use: ${confdir}/mssql.conf

# For Oracle， use: ${confdir}/oraclesql.conf

$INCL? ${confdir}/sql.conf

1.3.18 Radutmp模块

记录了那些在线用户的用户名，以及他们从哪里登陆的信息.

实例1 radutmp

radutmp {

filename = ${logdir}/radutmp

username = %{User-Name}

case_sensitive = yes

check_with_nas = yes

perm = 0600

callerid = "yes"

}

实例2 "Safe" radutmp

radutmp sradutmp {

filename = ${logdir}/sradutmp

perm = 0644

callerid = "no"

}

1.3.19 属性过滤模块

属性过滤模块，过滤从代理raidus服务器那里收到响应信息里的属性，来确保我们可以发送回给我们的Radius客户端，详细见attrs配置文件.

attr_filter {

attrsfile = ${confdir}/attrs

}

1.3.20 计数模块

从计费包信息中拿去一个属性及它的值，统计这个属性不同值的总数.

counter daily {

filename = ${raddbdir}/db.daily

key = User-Name

count-attribute = Acct-Session-Time

reset = daily

counter-name = Daily-Session-Time

check-name = Max-Daily-Session

allowed-servicetype = Framed-User

cache-size = 5000

}

1.3.21 SQL计数模块

该模块所需要的信息都储存raddacct表中。它并不进行在数据库中插入数据项和更新数据项，它完全依赖SQL模块来处理计费信息包。（具体请参照SQL模块配置分析第七章）

例1

sqlcounter dailycounter {

counter-name = Daily-Session-Time

check-name = Max-Daily-Session

sqlmod-inst = sql

key = User-Name

reset = daily

qry = "SELECT SUM(AcctSessionTime - \

GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime))， 0)) \

FROM radacct WHERE UserName=’%{%k}’ AND \

UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > ‘%b’"

}

例2

sqlcounter monthlycounter {

counter-name = Monthly-Session-Time

check-name = Max-Monthly-Session

sqlmod-inst = sql

key = User-Name

reset = monthly

qry = "SELECT SUM(AcctSessionTime - \

GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime))， 0)) \

FROM radacct WHERE UserName=’%{%k}’ AND \

UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > ‘%b’"

}

1.3.22 Always模块

为了测试用的Always模块，不做任何事情.

always fail {

rcode = fail

}

always reject {

rcode = reject

}

always ok {

rcode = ok

simulcount = 0

mpp = no

}

1.3.23 Expression模块(expr)

This module is useful only for ‘xlat’.

expr {

}

1.3.24 Digest模块

目前没有配置

"Digest" authentication against a Cisco SIP server.

1.3.25 外部程序执行模块(exec)

This module is useful only for ‘xlat’

可以将外界程序运行的结果赋予给属性值.

如:Attribute-Name = `%{exec:/path/to/program args}`

exec {

wait = yes

input_pairs = reqst

}

例This is a more general example of the execute module.

exec echo {

wait = yes

program = "/bin/echo %{User-Name}"

input_pairs = reqst

output_pairs = reply

}

IP地址池模块

服务器端IP地址池管理，应该在post-auth和accounting域应该被添加.

例:

ippool main_pool {

range-start = 192.168.1.1

range-stop = 192.168.3.254

netmask = 255.255.255.0

cache-size = 800

session-db = ${raddbdir}/db.ippool

ip-index = ${raddbdir}/db.ipindex

override = no

maximum-timeout = 0

}

1.4 关键域
1.4.1 实例化域(Instantiation)

这部分的目的是装载模块，那些被列在该域的模块讲在authorize，authenticate，等域之前装载. 本部分并不是必须步骤.

instantiate {

exec

expr

}

1.4.2 authorize域

The preprocess module takes care of sanitizing some bizarre attributes in the reqst， and turning them into attributes which are more standard. It takes care of processing the ‘raddb/hints’ and the ‘raddb/huntgroups’ files. It also adds the %{Client-IP-Address} attribute to the reqst.

这个预处理模块解决对reqst包中的那些奇怪的属性的处理， 并把这些奇怪的属性放到标准的属性中. 它同样处理 hints 与 huntgroups文件. 并在reqst包中添加%{Client-IP-Address} 属性.

authorize {

preprocess

# auth_log

# attr_filter

Chap

Mschap

# digest

# IPASS

s?ix

# ntdomain

Eap

Files

Sql

# etc_smbpasswd

# ldap

# daily

# checkval

}

1.4.3 Authentication域

这部分列出验证所需要的模块.. 但各个模块并不是按照顺序进行尝试的. 它的含义是在authorize域添加一份配置属性’Auth-Type := FOO’. 这个验证类型用来拿去域模块列表中合适的模块. 一般来说， 不应该设置Auth-Type 属性. Radius服务器会自己来判断， 然后做正确的事. Auth-Type 一般来说，不正确设置的最普通效果就是只有一种认证方法运行，其他的全部失败.

手动设置Auth-Type attribute的原因一般为要强制拒绝用户，或者强制通过认证用户.

.

authenticate {

Auth-Type PAP {

pap

}

Auth-Type CHAP {

chap

}

Auth-Type MS-CHAP {

mschap

}

# digest

# pam

Unix

# Auth-Type LDAP {

# ldap

# }

eap

}

1.4.4 Pre-accounting域

决定用何种计费方式

preacct {

preprocess

acct_uniq

# IPASS

s?ix

# ntdomain

files

}

1.4.5 Accounting域

accounting {

建立packets的详细日志

记录那些代理的计费reqsts ，并在detail文件中记录

detail

# daily

# Update the wtmp file

#

如果你不使用radlast，你就不能删掉下面这行

unix

#

# For Simultaneous-Use tracking.

#

# D to packet losses in the network， the data here

# may be incorrect. There is little we can do about it.

# 由于网络上数据包的丢失，这里的数据有可能会不正确，对此我们无能为力

radutmp

# sradutmp

# Return an address to the IP Pool when we see a stop record.

# 当我们看到停止记录时向IP Pool中返回地址信息

# main_pool

#

# Log traffic to an SQL database.

# 向SQL数据库中记录日志

#

# See "Accounting qries" in sql.conf

# 在 sql.conf中查看”计费 qries”

sql

#

# Instead of sending the qry to the SQL server，

# write it into a log file.

# 除了向SQL数据库中写入qry信息，还可以将信息写入log file来代替.

# sql_log

# Cisco VoIP specific bulk accounting

# pgsql-voip

}

1.4.6 Session域

# Session database， used for checking Simultaneous-Use. Either the radutmp

# or rlm_sql module can handle this.

# The rlm_sql module is *m h* faster

Session 数据库用来检查用户的并发使用. 不论是Radutmp还是rlm_sql模块都在这里被处理， rlm_sql模块相比来说速度更快.

session {

radutmp

#

# See "Simultaneous Use Checking Qrie" in sql.conf

# sql

}

1.4.7 post-auth域

# Post-Authentication

# Once we KNOW that the user has been authenticated， there are

# additional steps we can take.

当用户已经通过前面的认证过程，我们还可以额外添加一些步骤.

post-auth {

# Get an address from the IP Pool.

# 从IP Pool中拿到地址

# main_pool

#

# If you want to have a log of authentication replies，

# un-comment the following line， and the ‘detail reply_log’

# 如果你想获得一个认证replies信息的日志记录， 解除掉这行与’detail reply_log’ 的注释.

# section， above.

# reply_log

#

# After authenticating the user， do another SQL qry.

# 在认证用户后， 进行另外的SQL qry

#

# See "Authentication Logging Qries" in sql.conf

# 详细请看sql.conf 文件中"Authentication Logging Qries" 部分.

# sql

#

# Instead of sending the qry to the SQL server，

# write it into a log file.

# 除了向数据库中写入qry信息，还可以写在文件中作为代替.

#

# sql_log

#

# Un-comment the following if you have set

# ‘edir_account_policy_check = yes’ in the ldap module s -section of

# the ‘modules’ section.

# 如果你设置了’edir_account_policy_check = yes’在ldap模块的域中(见上).

#

# ldap

#

# Access-Reject packets are sent through the REJECT s -section of the

# post-auth section.

# Uncomment the following and set the module name to the ldap instance

# name if you have set ‘edir_account_policy_check = yes’ in the ldap

# module s -section of the ‘modules’ section.

# 如果你设置了’edir_account_policy_check = yes’ 在ldap模块的域中，请解除下面的注释信息

# Post-Auth-Type REJECT {

# insert-module-name-here

# }

}

1.4.8 pre-proxy域

# When the server decides to proxy a reqst to a home server，

# the proxied reqst is first passed through the pre-proxy

# stage. This stage can re-write the reqst， or decide to

# cancel the proxy.

#

# Only a few modules currently have this method.

pre-proxy {

# attr_rewrite

# Uncomment the following line if you want to change attributes

# as defined in the preproxy_users file.

# files

# If you want to have a log of packets proxied to a home

# server， un-comment the following line， and the

# ‘detail pre_proxy_log’ section， above.

# pre_proxy_log

}

1.4.9 post-proxy域

#

# When the server receives a reply to a reqst it proxied

# to a home server， the reqst may be massaged here， in the

# post-proxy stage.

#

post-proxy {

# If you want to have a log of replies from a home server，

# un-comment the following line， and the ‘detail post_proxy_log’

# section， above.

# post_proxy_log

# attr_rewrite

# Uncomment the following line if you want to filter replies from

# remote proxies based on the rules defined in the ‘attrs’ file.

# attr_filter

#

# If you are proxying LEAP， you MUST configure the EAP

# module， and you MUST list it here， in the post-proxy

# stage.

#

# You MUST also use the ‘nostrip’ option in the ‘realm’

# configuration. Otherwise， the User-Name attribute

# in the proxied reqst will not match the user name

# hidden inside of the EAP packet， and the end server will

# reject the EAP reqst.

#

eap

}