Subversion Repositories configs

######################################################################
#
#       An example virtual server configuration.
#
#       $Id: 89950303b94d5763ebd96744500b7a00da186c08 $
#
######################################################################


#
#       This client will be available to any "listen" section that
#       are defined outside of a virtual server section.  However,
#       when the server receives a packet from this client, the
#       request will be processed through the "example" virtual
#       server, as the "client" section contains a configuration item
#       to that effect.
#
#       Note that this client will be able to send requests to any
#       port defined in a global "listen" section.  It will NOT,
#       however, be able to send requests to a port defined in a
#       "listen" section that is contained in a "server" section.
#
#       With careful matching of configurations, you should be able
#       to:
#
#       - Define one authentication port, but process each client
#         through a separate virtual server.
#
#       - define multiple authentication ports, each with a private
#         list of clients.
#
#       - define multiple authentication ports, each of which may
#         have the same client listed, but with different shared
#         secrets
#
#       FYI: We use an address in the 192.0.2.* space for this example,
#       as RFC 3330 says that that /24 range is used for documenation
#       and examples, and should not appear on the net.  You shouldn't
#       use it for anything, either.
#
client 192.0.2.10 {
        shortname       = example-client
        secret          = testing123
        virtual_server  = example
}

######################################################################
#
#       An example virtual server.  It starts off with "server name {"
#       The "name" is used to reference this server from a "listen"
#       or "client" section.
#
######################################################################
server example {
        #
        #       Listen on 192.0.2.1:1812 for Access-Requests
        #
        #       When the server receives a packet, it is processed
        #       through the "authorize", etc. sections listed here,
        #       NOT the global ones the "default" site.
        #
        listen {
                ipaddr = 192.0.2.1
                port = 1821
                type = auth
        }

        #
        #       This client is listed within the "server" section,
        #       and is therefore known ONLY to the socket defined
        #       in the "listen" section above.  If the client IP
        #       sends a request to a different socket, the server
        #       will treat it as an unknown client, and will not
        #       respond.
        #
        #       In contrast, the client listed at the top of this file
        #       is outside of any "server" section, and is therefore
        #       global in scope.  It can send packets to any port
        #       defined in a global "listen" section.  It CANNOT send
        #       packets to the listen section defined above, though.
        #
        #       Note that you don't have to have a "virtual_server = example"
        #       line here, as the client is encapsulated within
        #       the "server" section.
        #
        client 192.0.2.9 {
                shortname       = example-client
                secret          = testing123
        }

        authorize {
                #
                #  Some example policies.  See "man unlang" for more.
                #
                if ("%{User-Name}" == "bob") {
                        update control {
                                Cleartext-Password := "bob"
                        }
                }

                #
                #  And then reject the user.  The next line requires
                #  that the "always reject {}" section is defined in
                #  the "modules" section of radiusd.conf.
                #
                reject
        }

        authenticate {

        }

        post-auth {

                Post-Auth-Type Reject {
                        update reply {
                                Reply-Message = "This is only an example."
                        }
                }
        }

}