WebSVN – configs – /homeserver/etc/raddb/sites-available/dynamic-clients

# -*- text -*-
######################################################################
#
#       Sample configuration file for dynamically updating the list
#       of RADIUS clients at run time.
#
#       Everything is keyed off of a client "network".  (e.g. 192.168/16)
#       This configuration lets the server know that clients within
#       that network are defined dynamically.
#
#       When the server receives a packet from an unknown IP address
#       within that network, it tries to find a dynamic definition
#       for that client.  If the definition is found, the IP address
#       (and other configuration) is added to the server's internal
#       cache of "known clients", with a configurable lifetime.
#
#       Further packets from that IP address result in the client
#       definition being found in the cache.  Once the lifetime is
#       reached, the client definition is deleted, and any new requests
#       from that client are looked up as above.
#
#       If the dynamic definition is not found, then the request is
#       treated as if it came from an unknown client.  i.e. It is
#       silently discarded.
#
#       As part of protection from Denial of Service (DoS) attacks,
#       the server will add only one new client per second.  This CANNOT
#       be changed, and is NOT configurable.
#
#       $Id: f8c3cc4ddd4a8e6434911fbcc444715f4ac95912 $
#
######################################################################

#
#  Define a network where clients may be dynamically defined.
client dynamic {
        ipaddr = 192.168.0.0

        #
        #  You MUST specify a netmask!
        #  IPv4 /32 or IPv6 /128 are NOT allowed!
        netmask = 16

        #
        #  Any other configuration normally found in a "client"
        #  entry can be used here.

        #
        #  A shared secret does NOT have to be defined.  It can
        #  be left out.

        #
        #  Define the virtual server used to discover dynamic clients.
        dynamic_clients = dynamic_client_server

        #
        #  The directory where client definitions are stored.  This
        #  needs to be used ONLY if the client definitions are stored
        #  in flat-text files.  Each file in that directory should be
        #  ONE and only one client definition.  The name of the file
        #  should be the IP address of the client.
        #
        #  If you are storing clients in SQL, this entry should not
        #  be used.
#       directory = ${confdir}/dynamic-clients/

        #
        #  Define the lifetime (in seconds) for dynamic clients.
        #  They will be cached for this lifetime, and deleted afterwards.
        #
        #  If the lifetime is "0", then the dynamic client is never
        #  deleted.  The only way to delete the client is to re-start
        #  the server.
        lifetime = 3600
}

#
#  This is the virtual server referenced above by "dynamic_clients".
server dynamic_client_server {

        #
        #  The only contents of the virtual server is the "authorize" section.
        authorize {

                #
                #  Put any modules you want here.  SQL, LDAP, "exec",
                #  Perl, etc.  The only requirements is that the
                #  attributes MUST go into the control item list.
                #
                #  The request that is processed through this section
                #  is EMPTY.  There are NO attributes.  The request is fake,
                #  and is NOT the packet that triggered the lookup of
                #  the dynamic client.
                #
                #  The ONLY piece of useful information is either
                #
                #       Packet-Src-IP-Address (IPv4 clients)
                #       Packet-Src-IPv6-Address (IPv6 clients)
                #
                #  The attributes used to define a dynamic client mirror
                #  the configuration items in the "client" structure.
                #

                #
                #  Example 1: Hard-code a client IP.  This example is
                #             useless, but it documents the attributes
                #             you need.
                #
                update control {

                        #
                        #  Echo the IP address of the client.
                        FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}"

                        # require_message_authenticator
                        FreeRADIUS-Client-Require-MA = no

                        # secret
                        FreeRADIUS-Client-Secret = "testing123"

                        # shortname
                        FreeRADIUS-Client-Shortname = "%{Packet-Src-IP-Address}"

                        # nastype
                        FreeRADIUS-Client-NAS-Type = "other"

                        # virtual_server
                        #
                        #  This can ONLY be used if the network client
                        #  definition (e.g. "client dynamic" above) has
                        #  NO virtual_server defined.
                        #
                        #  If the network client definition does have a
                        #  virtual_server defined, then that is used,
                        #  and there is no need to define this attribute.
                        #  
                        FreeRADIUS-Client-Virtual-Server = "something"

                }

                #
                #  Example 2: Read the clients from "clients" files
                #             in a directory.
                #

                #             This requires you to uncomment the
                #             "directory" configuration in the
                #             "client dynamic" configuration above,
                #             and then put one file per IP address in
                #             that directory.
                #
                dynamic_clients

                #
                #  Example 3: Look the clients up in SQL.
                #
                #  This requires the SQL module to be configured, of course.
                if ("%{sql: SELECT nasname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}") {
                        update control {
                                #
                                #  Echo the IP.
                                FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}"

                                #
                                #  Do multiple SELECT statements to grab
                                #  the various definitions.
                                FreeRADIUS-Client-Shortname = "%{sql: SELECT shortname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}"

                                FreeRADIUS-Client-Secret = "%{sql: SELECT secret FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}"

                                FreeRADIUS-Client-NAS-Type = "%{sql: SELECT type FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}"

                                FreeRADIUS-Client-Virtual-Server = "%{sql: SELECT server FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}"
                        }

                }

                # Do an LDAP lookup in the elements OU, check to see if
                # the Packet-Src-IP-Address object has a "ou"
                # attribute, if it does continue.  Change "ACME.COM" to
                # the real OU of your organization.
                #
                # Assuming the following schema:
                #
                # OU=Elements,OU=Radius,DC=ACME,DC=COM
                #
                # Elements will hold a record of every NAS in your
                # Network.  Create Group objects based on the IP
                # Address of the NAS and set the "Location" or "l"
                # attribute to the NAS Huntgroup the NAS belongs to
                # allow them to be centrally managed in LDAP.
                #
                # e.g.  CN=10.1.2.3,OU=Elements,OU=Radius,DC=ACME,DC=COM
                #
                # With a "l" value of "CiscoRTR" for a Cisco Router
                # that has a NAS-IP-Address or Source-IP-Address of
                # 10.1.2.3.
                #
                # And with a "ou" value of the shared secret password
                # for the NAS element. ie "password"
                if ("%{ldap:ldap:///OU=Elements,OU=Radius,DC=ACME,DC=COM?ou?sub?cn=%{Packet-Src-IP-Address}}") {
                        update control {
                               FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}"

                                # Set the Client-Shortname to be the Location
                                # "l" just like in the Huntgroups, but this
                                # time to the shortname.

                                FreeRADIUS-Client-Shortname = "%{ldap:ldap:///OU=Elements,OU=Radius,DC=ACME,DC=COM?l?sub?cn=%{Packet-Src-IP-Address}}"

                                # Lookup and set the Shared Secret based on
                                # the "ou" attribute.
                                FreeRADIUS-Client-Secret = "%{ldap:ldap:///OU=Elements,OU=Radius,DC=ACME,DC=COM?ou?sub?cn=%{Packet-Src-IP-Address}}"
                        }
                }

                #
                #  Tell the caller that the client was defined properly.
                #
                #  If the authorize section does NOT return "ok", then
                #  the new client is ignored.
                ok
        }
}
Subversion Repositories configs

(root)/homeserver/etc/raddb/sites-available/dynamic-clients – Rev 34
