[root@alexy ~]# groupadd -g 500 radius[root@alexy ~]# useradd -g 500 -u 500 -d /opt/radius -m -s /bin/bash radius[root@alexy ~]# passwd radiusChanging password for user radius.New UNIX password: BAD PASSWORD: it is based on a dictionary wordRetype new UNIX password: passwd: all authentication tokens updated successfully.[root@alexy ~]# tail -3 /etc/passwdgdm:x:42:42::/var/gdm:/sbin/nologinsabayon:x:86:86:Sabayon user:/home/sabayon:/sbin/nologinradius:x:500:500::/opt/radius:/bin/bash[root@alexy ~]#

[root@alexy radius]# ls -lh total 4.5M-rw-r--r-- 1 root root 4.5M Aug 28 14:52 freeradius-server-3.0.9.tar.gz[root@alexy radius]# ls -lh total 4.5M-rw-r--r-- 1 root root 4.5M Aug 28 14:52 freeradius-server-3.0.9.tar.gz[root@alexy radius]# chmod 775 freeradius-server-3.0.9.tar.gz [root@alexy radius]# chown radius:radius freeradius-server-3.0.9.tar.gz [root@alexy radius]# ls -lh total 4.5M-rwxrwxr-x 1 radius radius 4.5M Aug 28 14:52 freeradius-server-3.0.9.tar.gz[root@alexy radius]#

[radius@alexy ~]$ tar -xvf freeradius-server-3.0.9.tar.gz [radius@alexy ~]$ ls -lh total 4.5Mdrwxrwxr-x 13 radius radius 4.0K Jul  8 23:41 freeradius-server-3.0.9-rwxrwxr-x  1 radius radius 4.5M Aug 28 14:52 freeradius-server-3.0.9.tar.gz

yum install net-snmpyum install gccyum install libtallocyum install libtalloc-devel -yyum install openssl-devel -y

用root用户安装./configuremake && make install

（1）启动radiusradiusd or  ##启动radius:radiusd -X  ##启动radius的debug模式:（2）测试radius[root@alexy ~]# radtest steve testing 127.0.0.1 1812 testing123 Sending Access-Request of id 169 to 127.0.0.1 port 1812        User-Name = "steve"        User-Password = "testing"        NAS-IP-Address = 127.0.0.1        NAS-Port = 1812        Message-Authenticator = 0x00000000000000000000000000000000rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=169, length=20[root@alexy ~]# 有rad_recv代表有回复，说明radius服务器是启动起来并能正常返回消息的。

/usr/local/etc/raddb/radiusd.conf    #radius主要配置文件/usr/local/etc/raddb/clients.conf    #radius客户端配置文件/usr/local/etc/raddb/users　　　　　　#radius用户配置文件

# -*- text -*-#### radiusd.conf -- FreeRADIUS server configuration file.####      http://www.freeradius.org/##      $Id: 81a565ed4e970318914f4c7798215a04d9ca8c15 $##########################################################################       Read "man radiusd" before editing this file.  See the section#       titled DEBUGGING.  It outlines a method where you can quickly#       obtain the configuration you want, without running into#       trouble.##       Run the server in debugging mode, and READ the output.##               $ radiusd -X##       We cannot emphasize this point strongly enough.  The vast#       majority of problems can be solved by carefully reading the#       debugging output, which includes warnings about common issues,#       and suggestions for how they may be fixed.##       There may be a lot of output, but look carefully for words like:#       "warning", "error", "reject", or "failure".  The messages there#       will usually be enough to guide you to a solution.##       If you are going to ask a question on the mailing list, then#       explain what you are trying to do, and include the output from#       debugging mode (radiusd -X).  Failure to do so means that all#       of the responses to your question will be people telling you#       to "post the output of radiusd -X".########################################################################       The location of other config files and logfiles are declared#       in this file.##       Also general configuration for modules can be done in this#       file, it is exported through the API to modules that ask for#       it.##       See "man radiusd.conf" for documentation on the format of this#       file.  Note that the individual configuration items are NOT#       documented in that "man" page.  They are only documented here,#       in the comments.##       As of 2.0.0, FreeRADIUS supports a simple processing language#       in the "authorize", "authenticate", "accounting", etc. sections.#       See "man unlang" for details.#prefix = /usr/localexec_prefix = ${prefix}sysconfdir = ${prefix}/etclocalstatedir = ${prefix}/varsbindir = ${exec_prefix}/sbinlogdir = ${localstatedir}/log/radiusraddbdir = ${sysconfdir}/raddbradacctdir = ${logdir}/radacct##  name of the running server.  See also the "-n" command-line option.name = radiusd#  Location of config and logfiles.confdir = ${raddbdir}run_dir = ${localstatedir}/run/${name}# Should likely be ${localstatedir}/lib/radiusddb_dir = ${raddbdir}## libdir: Where to find the rlm_* modules.##   This should be automatically set at configuration time.##   If the server builds and installs, but fails at execution time#   with an 'undefined symbol' error, then you can use the libdir#   directive to work around the problem.##   The cause is usually that a library has been installed on your#   system in a place where the dynamic linker CANNOT find it.  When#   executing as root (or another user), your personal environment MAY#   be set up to allow the dynamic linker to find the library.  When#   executing as a daemon, FreeRADIUS MAY NOT have the same#   personalized configuration.##   To work around the problem, find out which library contains that symbol,#   and add the directory containing that library to the end of 'libdir',#   with a colon separating the directory names.  NO spaces are allowed.##   e.g. libdir = /usr/local/lib:/opt/package/lib##   You can also try setting the LD_LIBRARY_PATH environment variable#   in a script which starts the server.##   If that does not work, then you can re-configure and re-build the#   server to NOT use shared libraries, via:##       ./configure --disable-shared#       make#       make install#libdir = ${exec_prefix}/lib#  pidfile: Where to place the PID of the RADIUS server.##  The server may be signalled while it's running by using this#  file.##  This file is written when ONLY running in daemon mode.##  e.g.:  kill -HUP `cat /var/run/radiusd/radiusd.pid`#pidfile = ${run_dir}/${name}.pid#  chroot: directory where the server does "chroot".##  The chroot is done very early in the process of starting the server.#  After the chroot has been performed it switches to the "user" listed#  below (which MUST be specified).  If "group" is specified, it switchs#  to that group, too.  Any other groups listed for the specified "user"#  in "/etc/group" are also added as part of this process.##  The current working directory (chdir / cd) is left *outside* of the#  chroot until all of the modules have been initialized.  This allows#  the "raddb" directory to be left outside of the chroot.  Once the#  modules have been initialized, it does a "chdir" to ${logdir}.  This#  means that it should be impossible to break out of the chroot.##  If you are worried about security issues related to this use of chdir,#  then simply ensure that the "raddb" directory is inside of the chroot,#  end be sure to do "cd raddb" BEFORE starting the server.##  If the server is statically linked, then the only files that have#  to exist in the chroot are ${run_dir} and ${logdir}.  If you do the#  "cd raddb" as discussed above, then the "raddb" directory has to be#  inside of the chroot directory, too.##chroot = /path/to/chroot/directory# user/group: The name (or #number) of the user/group to run radiusd as.##   If these are commented out, the server will run as the user/group#   that started it.  In order to change to a different user/group, you#   MUST be root ( or have root privleges ) to start the server.##   We STRONGLY recommend that you run the server with as few permissions#   as possible.  That is, if you're not using shadow passwords, the#   user and group items below should be set to radius'.##  NOTE that some kernels refuse to setgid(group) when the value of#  (unsigned)group is above 60000; don't use group nobody on these systems!##  On systems with shadow passwords, you might have to set 'group = shadow'#  for the server to be able to read the shadow password file.  If you can#  authenticate users while in debug mode, but not in daemon mode, it may be#  that the debugging mode server is running as a user that can read the#  shadow info, and the user listed below can not.##  The server will also try to use "initgroups" to read /etc/groups.#  It will join all groups where "user" is a member.  This can allow#  for some finer-grained access controls.##user = radius#group = radius#  panic_action: Command to execute if the server dies unexpectedly.##  FOR PRODUCTION SYSTEMS, ACTIONS SHOULD ALWAYS EXIT.#  AN INTERACTIVE ACTION MEANS THE SERVER IS NOT RESPONDING TO REQUESTS.#  AN INTERACTICE ACTION MEANS THE SERVER WILL NOT RESTART.##  The panic action is a command which will be executed if the server#  receives a fatal, non user generated signal, i.e. SIGSEGV, SIGBUS,#  SIGABRT or SIGFPE.##  This can be used to start an interactive debugging session so#  that information regarding the current state of the server can#  be acquired.##  The following string substitutions are available:#  - %e   The currently executing program e.g. /sbin/radiusd#  - %p   The PID of the currently executing program e.g. 12345##  Standard ${} substitutions are also allowed.##  An example panic action for opening an interactive session in GDB would be:##panic_action = "gdb %e %p"##  Again, don't use that on a production system.##  An example panic action for opening an automated session in GDB would be:##panic_action = "gdb -silent -x ${raddbdir}/panic.gdb %e %p > ${logdir}/gdb-%e-%p.log 2>&1"##  That command can be used on a production system.##  max_request_time: The maximum time (in seconds) to handle a request.##  Requests which take more time than this to process may be killed, and#  a REJECT message is returned.##  WARNING: If you notice that requests take a long time to be handled,#  then this MAY INDICATE a bug in the server, in one of the modules#  used to handle a request, OR in your local configuration.##  This problem is most often seen when using an SQL database.  If it takes#  more than a second or two to receive an answer from the SQL database,#  then it probably means that you haven't indexed the database.  See your#  SQL server documentation for more information.##  Useful range of values: 5 to 120#max_request_time = 30#  cleanup_delay: The time to wait (in seconds) before cleaning up#  a reply which was sent to the NAS.##  The RADIUS request is normally cached internally for a short period#  of time, after the reply is sent to the NAS.  The reply packet may be#  lost in the network, and the NAS will not see it.  The NAS will then#  re-send the request, and the server will respond quickly with the#  cached reply.##  If this value is set too low, then duplicate requests from the NAS#  MAY NOT be detected, and will instead be handled as seperate requests.##  If this value is set too high, then the server will cache too many#  requests, and some new requests may get blocked.  (See 'max_requests'.)##  Useful range of values: 2 to 10#cleanup_delay = 5#  max_requests: The maximum number of requests which the server keeps#  track of.  This should be 256 multiplied by the number of clients.#  e.g. With 4 clients, this number should be 1024.##  If this number is too low, then when the server becomes busy,#  it will not respond to any new requests, until the 'cleanup_delay'#  time has passed, and it has removed the old requests.##  If this number is set too high, then the server will use a bit more#  memory for no real benefit.##  If you aren't sure what it should be set to, it's better to set it#  too high than too low.  Setting it to 1000 per client is probably#  the highest it should be.##  Useful range of values: 256 to infinity#max_requests = 1024#  listen: Make the server listen on a particular IP address, and send#  replies out from that address. This directive is most useful for#  hosts with multiple IP addresses on one interface.##  If you want the server to listen on additional addresses, or on#  additionnal ports, you can use multiple "listen" sections.##  Each section make the server listen for only one type of packet,#  therefore authentication and accounting have to be configured in#  different sections.##  The server ignore all "listen" section if you are using '-i' and '-p'#  on the command line.#listen {        #  Type of packets to listen for.        #  Allowed values are:        #       auth    listen for authentication packets        #       acct    listen for accounting packets        #       proxy   IP to use for sending proxied packets        #       detail  Read from the detail file.  For examples, see        #               raddb/sites-available/copy-acct-to-home-server        #       status  listen for Status-Server packets.  For examples,        #               see raddb/sites-available/status        #       coa     listen for CoA-Request and Disconnect-Request        #               packets.  For examples, see the file        #               raddb/sites-available/coa        #        type = auth        #  Note: "type = proxy" lets you control the source IP used for        #        proxying packets, with some limitations:        #        #    * A proxy listener CANNOT be used in a virtual server section.        #    * You should probably set "port = 0".        #    * Any "clients" configuration will be ignored.        #        #  See also proxy.conf, and the "src_ipaddr" configuration entry        #  in the sample "home_server" section.  When you specify the        #  source IP address for packets sent to a home server, the        #  proxy listeners are automatically created.        #  IP address on which to listen.        #  Allowed values are:        #       dotted quad (1.2.3.4)        #       hostname    (radius.example.com)        #       wildcard    (*)        ipaddr = *        #  OR, you can use an IPv6 address, but not both        #  at the same time.#       ipv6addr = ::   # any.  ::1 == localhost        #  Port on which to listen.        #  Allowed values are:        #       integer port number (1812)        #       0 means "use /etc/services for the proper port"        port = 0        #  Some systems support binding to an interface, in addition        #  to the IP address.  This feature isn't strictly necessary,        #  but for sites with many IP addresses on one interface,        #  it's useful to say "listen on all addresses for eth0".        #        #  If your system does not support this feature, you will        #  get an error if you try to use it.        ##       interface = eth0        #  Per-socket lists of clients.  This is a very useful feature.        #        #  The name here is a reference to a section elsewhere in        #  radiusd.conf, or clients.conf.  Having the name as        #  a reference allows multiple sockets to use the same        #  set of clients.        #        #  If this configuration is used, then the global list of clients        #  is IGNORED for this "listen" section.  Take care configuring        #  this feature, to ensure you don't accidentally disable a        #  client you need.        #        #  See clients.conf for the configuration of "per_socket_clients".        ##       clients = per_socket_clients}#  This second "listen" section is for listening on the accounting#  port, too.#listen {        ipaddr = *#       ipv6addr = ::        port = 0        type = acct#       interface = eth0#       clients = per_socket_clients}#  hostname_lookups: Log the names of clients or just their IP addresses#  e.g., www.freeradius.org (on) or 206.47.27.232 (off).##  The default is 'off' because it would be overall better for the net#  if people had to knowingly turn this feature on, since enabling it#  means that each client request will result in AT LEAST one lookup#  request to the nameserver.   Enabling hostname_lookups will also#  mean that your server may stop randomly for 30 seconds from time#  to time, if the DNS requests take too long.##  Turning hostname lookups off also means that the server won't block#  for 30 seconds, if it sees an IP address which has no name associated#  with it.##  allowed values: {no, yes}#hostname_lookups = no#  Core dumps are a bad thing.  This should only be set to 'yes'#  if you're debugging a problem with the server.##  allowed values: {no, yes}#allow_core_dumps = no#  Regular expressions##  These items are set at configure time.  If they're set to "yes",#  then setting them to "no" turns off regular expression support.##  If they're set to "no" at configure time, then setting them to "yes"#  WILL NOT WORK.  It will give you an error.#regular_expressions     = yesextended_expressions    = yes##  Logging section.  The various "log_*" configuration items#  will eventually be moved here.#log {        #        #  Destination for log messages.  This can be one of:        #        #       files - log to "file", as defined below.        #       syslog - to syslog (see also the "syslog_facility", below.        #       stdout - standard output        #       stderr - standard error.        #        #  The command-line option "-X" over-rides this option, and forces        #  logging to go to stdout.        #        destination = files        #        #  The logging messages for the server are appended to the        #  tail of this file if destination == "files"        #        #  If the server is running in debugging mode, this file is        #  NOT used.        #        file = ${logdir}/radius.log        #        #  If this configuration parameter is set, then log messages for        #  a *request* go to this file, rather than to radius.log.        #        #  i.e. This is a log file per request, once the server has accepted        #  the request as being from a valid client.  Messages that are        #  not associated with a request still go to radius.log.        #        #  Not all log messages in the server core have been updated to use        #  this new internal API.  As a result, some messages will still        #  go to radius.log.  Please submit patches to fix this behavior.        #        #  The file name is expanded dynamically.  You should ONLY user        #  server-side attributes for the filename (e.g. things you control).        #  Using this feature MAY also slow down the server substantially,        #  especially if you do thinks like SQL calls as part of the        #  expansion of the filename.        #        #  The name of the log file should use attributes that don't change        #  over the lifetime of a request, such as User-Name,        #  Virtual-Server or Packet-Src-IP-Address.  Otherwise, the log        #  messages will be distributed over multiple files.        #        #  Logging can be enabled for an individual request by a special        #  dynamic expansion macro:  %{debug: 1}, where the debug level        #  for this request is set to '1' (or 2, 3, etc.).  e.g.        #        #       ...        #       update control {        #              Tmp-String-0 = "%{debug:1}"        #       }        #       ...        #        #  The attribute that the value is assigned to is unimportant,        #  and should be a "throw-away" attribute with no side effects.        #        #requests = ${logdir}/radiusd-%{%{Virtual-Server}:-DEFAULT}-%Y%m%d.log        #        #  Which syslog facility to use, if ${destination} == "syslog"        #        #  The exact values permitted here are OS-dependent.  You probably        #  don't want to change this.        #        syslog_facility = daemon        #  Log the full User-Name attribute, as it was found in the request.        #        # allowed values: {no, yes}        #        stripped_names = no        #  Log authentication requests to the log file.        #        #  allowed values: {no, yes}        #        auth = no        #  Log passwords with the authentication requests.        #  auth_badpass  - logs password if it's rejected        #  auth_goodpass - logs password if it's correct        #        #  allowed values: {no, yes}        #        auth_badpass = no        auth_goodpass = no        #  Log additional text at the end of the "Login OK" messages.        #  for these to work, the "auth" and "auth_goopass" or "auth_badpass"        #  configurations above have to be set to "yes".        #        #  The strings below are dynamically expanded, which means that        #  you can put anything you want in them.  However, note that        #  this expansion can be slow, and can negatively impact server        #  performance.        ##       msg_goodpass = ""#       msg_badpass = ""}#  The program to execute to do concurrency checks.checkrad = ${sbindir}/checkrad# SECURITY CONFIGURATION##  There may be multiple methods of attacking on the server.  This#  section holds the configuration items which minimize the impact#  of those attacks#security {        #        #  max_attributes: The maximum number of attributes        #  permitted in a RADIUS packet.  Packets which have MORE        #  than this number of attributes in them will be dropped.        #        #  If this number is set too low, then no RADIUS packets        #  will be accepted.        #        #  If this number is set too high, then an attacker may be        #  able to send a small number of packets which will cause        #  the server to use all available memory on the machine.        #        #  Setting this number to 0 means "allow any number of attributes"        max_attributes = 200        #        #  reject_delay: When sending an Access-Reject, it can be        #  delayed for a few seconds.  This may help slow down a DoS        #  attack.  It also helps to slow down people trying to brute-force        #  crack a users password.        #        #  Setting this number to 0 means "send rejects immediately"        #        #  If this number is set higher than 'cleanup_delay', then the        #  rejects will be sent at 'cleanup_delay' time, when the request        #  is deleted from the internal cache of requests.        #        #  Useful ranges: 1 to 5        reject_delay = 1        #        #  status_server: Whether or not the server will respond        #  to Status-Server requests.        #        #  When sent a Status-Server message, the server responds with        #  an Access-Accept or Accounting-Response packet.        #        #  This is mainly useful for administrators who want to "ping"        #  the server, without adding test users, or creating fake        #  accounting packets.        #        #  It's also useful when a NAS marks a RADIUS server "dead".        #  The NAS can periodically "ping" the server with a Status-Server        #  packet.  If the server responds, it must be alive, and the        #  NAS can start using it for real requests.        #        #  See also raddb/sites-available/status        #        status_server = yes        #        #  allow_vulnerable_openssl: Allow the server to start with        #  versions of OpenSSL known to have critical vulnerabilities.        #        #  This check is based on the version number reported by libssl        #  and may not reflect patches applied to libssl by        #  distribution maintainers.        #        allow_vulnerable_openssl = no}# PROXY CONFIGURATION##  proxy_requests: Turns proxying of RADIUS requests on or off.##  The server has proxying turned on by default.  If your system is NOT#  set up to proxy requests to another server, then you can turn proxying#  off here.  This will save a small amount of resources on the server.##  If you have proxying turned off, and your configuration files say#  to proxy a request, then an error message will be logged.##  To disable proxying, change the "yes" to "no", and comment the#  $INCLUDE line.##  allowed values: {no, yes}#proxy_requests  = yes$INCLUDE proxy.conf# CLIENTS CONFIGURATION##  Client configuration is defined in "clients.conf".##  The 'clients.conf' file contains all of the information from the old#  'clients' and 'naslist' configuration files.  We recommend that you#  do NOT use 'client's or 'naslist', although they are still#  supported.##  Anything listed in 'clients.conf' will take precedence over the#  information from the old-style configuration files.#$INCLUDE clients.conf# THREAD POOL CONFIGURATION##  The thread pool is a long-lived group of threads which#  take turns (round-robin) handling any incoming requests.##  You probably want to have a few spare threads around,#  so that high-load situations can be handled immediately.  If you#  don't have any spare threads, then the request handling will#  be delayed while a new thread is created, and added to the pool.##  You probably don't want too many spare threads around,#  otherwise they'll be sitting there taking up resources, and#  not doing anything productive.##  The numbers given below should be adequate for most situations.#thread pool {        #  Number of servers to start initially --- should be a reasonable        #  ballpark figure.        start_servers = 5        #  Limit on the total number of servers running.        #        #  If this limit is ever reached, clients will be LOCKED OUT, so it        #  should NOT BE SET TOO LOW.  It is intended mainly as a brake to        #  keep a runaway server from taking the system with it as it spirals        #  down...        #        #  You may find that the server is regularly reaching the        #  'max_servers' number of threads, and that increasing        #  'max_servers' doesn't seem to make much difference.        #        #  If this is the case, then the problem is MOST LIKELY that        #  your back-end databases are taking too long to respond, and        #  are preventing the server from responding in a timely manner.        #        #  The solution is NOT do keep increasing the 'max_servers'        #  value, but instead to fix the underlying cause of the        #  problem: slow database, or 'hostname_lookups=yes'.        #        #  For more information, see 'max_request_time', above.        #        max_servers = 32        #  Server-pool size regulation.  Rather than making you guess        #  how many servers you need, FreeRADIUS dynamically adapts to        #  the load it sees, that is, it tries to maintain enough        #  servers to handle the current load, plus a few spare        #  servers to handle transient load spikes.        #        #  It does this by periodically checking how many servers are        #  waiting for a request.  If there are fewer than        #  min_spare_servers, it creates a new spare.  If there are        #  more than max_spare_servers, some of the spares die off.        #  The default values are probably OK for most sites.        #        min_spare_servers = 3        max_spare_servers = 10        #  When the server receives a packet, it places it onto an        #  internal queue, where the worker threads (configured above)        #  pick it up for processing.  The maximum size of that queue        #  is given here.        #        #  When the queue is full, any new packets will be silently        #  discarded.        #        #  The most common cause of the queue being full is that the        #  server is dependent on a slow database, and it has received        #  a large "spike" of traffic.  When that happens, there is        #  very little you can do other than make sure the server        #  receives less traffic, or make sure that the database can        #  handle the load.        ##       max_queue_size = 65536        #  There may be memory leaks or resource allocation problems with        #  the server.  If so, set this value to 300 or so, so that the        #  resources will be cleaned up periodically.        #        #  This should only be necessary if there are serious bugs in the        #  server which have not yet been fixed.        #        #  '0' is a special value meaning 'infinity', or 'the servers never        #  exit'        max_requests_per_server = 0}# MODULE CONFIGURATION##  The names and configuration of each module is located in this section.##  After the modules are defined here, they may be referred to by name,#  in other sections of this configuration file.#modules {        #        #  Each module has a configuration as follows:        #        #       name [ instance ] {        #               config_item = value        #               ...        #       }        #        #  The 'name' is used to load the 'rlm_name' library        #  which implements the functionality of the module.        #        #  The 'instance' is optional.  To have two different instances        #  of a module, it first must be referred to by 'name'.        #  The different copies of the module are then created by        #  inventing two 'instance' names, e.g. 'instance1' and 'instance2'        #        #  The instance names can then be used in later configuration        #  INSTEAD of the original 'name'.  See the 'radutmp' configuration        #  for an example.        #        #        #  As of 2.0.5, most of the module configurations are in a        #  sub-directory.  Files matching the regex /[a-zA-Z0-9_.]+/        #  are loaded.  The modules are initialized ONLY if they are        #  referenced in a processing section, such as authorize,        #  authenticate, accounting, pre/post-proxy, etc.        #        $INCLUDE ${confdir}/modules/        #  Extensible Authentication Protocol        #        #  For all EAP related authentications.        #  Now in another file, because it is very large.        #        $INCLUDE eap.conf        #  Include another file that has the SQL-related configuration.        #  This is another file only because it tends to be big.        ##       $INCLUDE sql.conf        #        #  This module is an SQL enabled version of the counter module.        #        #  Rather than maintaining seperate (GDBM) databases of        #  accounting info for each counter, this module uses the data        #  stored in the raddacct table by the sql modules. This        #  module NEVER does any database INSERTs or UPDATEs.  It is        #  totally dependent on the SQL module to process Accounting        #  packets.        ##       $INCLUDE sql/mysql/counter.conf        #        #  IP addresses managed in an SQL table.        ##       $INCLUDE sqlippool.conf}# Instantiation##  This section orders the loading of the modules.  Modules#  listed here will get loaded BEFORE the later sections like#  authorize, authenticate, etc. get examined.##  This section is not strictly needed.  When a section like#  authorize refers to a module, it's automatically loaded and#  initialized.  However, some modules may not be listed in any#  of the following sections, so they can be listed here.##  Also, listing modules here ensures that you have control over#  the order in which they are initalized.  If one module needs#  something defined by another module, you can list them in order#  here, and ensure that the configuration will be OK.#instantiate {        #        #  Allows the execution of external scripts.        #  The entire command line (and output) must fit into 253 bytes.        #        #  e.g. Framed-Pool = `%{exec:/bin/echo foo}`        exec        #        #  The expression module doesn't do authorization,        #  authentication, or accounting.  It only does dynamic        #  translation, of the form:        #        #       Session-Timeout = `%{expr:2 + 3}`        #        #  This module needs to be instantiated, but CANNOT be        #  listed in any other section.  See 'doc/rlm_expr' for        #  more information.        #        #  rlm_expr is also responsible for registering many        #  other xlat functions such as md5, sha1 and lc.        #        #  We do not recommend removing it's listing here.        expr        #        # We add the counter module here so that it registers        # the check-name attribute before any module which sets        # it#       daily        expiration        logintime        # subsections here can be thought of as "virtual" modules.        #        # e.g. If you have two redundant SQL servers, and you want to        # use them in the authorize and accounting sections, you could        # place a "redundant" block in each section, containing the        # exact same text.  Or, you could uncomment the following        # lines, and list "redundant_sql" in the authorize and        # accounting sections.        #        #redundant redundant_sql {        #       sql1        #       sql2        #}}########################################################################       Policies that can be applied in multiple places are listed#       globally.  That way, they can be defined once, and referred#       to multiple times.#######################################################################$INCLUDE policy.conf########################################################################       Load virtual servers.##       This next $INCLUDE line loads files in the directory that#       match the regular expression: /[a-zA-Z0-9_.]+/##       It allows you to define new virtual servers simply by placing#       a file into the raddb/sites-enabled/ directory.#$INCLUDE sites-enabled/########################################################################       All of the other configuration sections like "authorize {}",#       "authenticate {}", "accounting {}", have been moved to the#       the file:##               raddb/sites-available/default##       This is the "default" virtual server that has the same#       configuration as in version 1.0.x and 1.1.x.  The default#       installation enables this virtual server.  You should#       edit it to create policies for your local site.##       For more documentation on virtual servers, see:##               raddb/sites-available/README#######################################################################

# -*- text -*-#### clients.conf -- client configuration directives####      $Id: 729c15d3e84c6cdb54a5f3652d93a2d7f8725fd4 $#########################################################################  Define RADIUS clients (usually a NAS, Access Point, etc.).##  Defines a RADIUS client.##  '127.0.0.1' is another name for 'localhost'.  It is enabled by default,#  to allow testing of the server after an initial installation.  If you#  are not going to be permitting RADIUS queries from localhost, we suggest#  that you delete, or comment out, this entry.####  Each client has a "short name" that is used to distinguish it from#  other clients.##  In version 1.x, the string after the word "client" was the IP#  address of the client.  In 2.0, the IP address is configured via#  the "ipaddr" or "ipv6addr" fields.  For compatibility, the 1.x#  format is still accepted.#client localhost {        #  Allowed values are:        #       dotted quad (1.2.3.4)        #       hostname    (radius.example.com)        ipaddr = 127.0.0.1        #  OR, you can use an IPv6 address, but not both        #  at the same time.#       ipv6addr = ::   # any.  ::1 == localhost        #        #  A note on DNS:  We STRONGLY recommend using IP addresses        #  rather than host names.  Using host names means that the        #  server will do DNS lookups when it starts, making it        #  dependent on DNS.  i.e. If anything goes wrong with DNS,        #  the server won't start!        #        #  The server also looks up the IP address from DNS once, and        #  only once, when it starts.  If the DNS record is later        #  updated, the server WILL NOT see that update.        #        #  One client definition can be applied to an entire network.        #  e.g. 127/8 should be defined with "ipaddr = 127.0.0.0" and        #  "netmask = 8"        #        #  If not specified, the default netmask is 32 (i.e. /32)        #        #  We do NOT recommend using anything other than 32.  There        #  are usually other, better ways to achieve the same goal.        #  Using netmasks of other than 32 can cause security issues.        #        #  You can specify overlapping networks (127/8 and 127.0/16)        #  In that case, the smallest possible network will be used        #  as the "best match" for the client.        #        #  Clients can also be defined dynamically at run time, based        #  on any criteria.  e.g. SQL lookups, keying off of NAS-Identifier,        #  etc.        #  See raddb/sites-available/dynamic-clients for details.        ##       netmask = 32        #        #  The shared secret use to "encrypt" and "sign" packets between        #  the NAS and FreeRADIUS.  You MUST change this secret from the        #  default, otherwise it's not a secret any more!        #        #  The secret can be any string, up to 8k characters in length.        #        #  Control codes can be entered vi octal encoding,        #       e.g. "\101\102" == "AB"        #  Quotation marks can be entered by escaping them,        #       e.g. "foo\"bar"        #        #  A note on security:  The security of the RADIUS protocol        #  depends COMPLETELY on this secret!  We recommend using a        #  shared secret that is composed of:        #        #       upper case letters        #       lower case letters        #       numbers        #        #  And is at LEAST 8 characters long, preferably 16 characters in        #  length.  The secret MUST be random, and should not be words,        #  phrase, or anything else that is recognizable.        #        #  The default secret below is only for testing, and should        #  not be used in any real environment.        #        secret          = testing123        #        #  Old-style clients do not send a Message-Authenticator        #  in an Access-Request.  RFC 5080 suggests that all clients        #  SHOULD include it in an Access-Request.  The configuration        #  item below allows the server to require it.  If a client        #  is required to include a Message-Authenticator and it does        #  not, then the packet will be silently discarded.        #        #  allowed values: yes, no        require_message_authenticator = no        #        #  The short name is used as an alias for the fully qualified        #  domain name, or the IP address.        #        #  It is accepted for compatibility with 1.x, but it is no        #  longer necessary in 2.0        ##       shortname       = localhost        #        # the following three fields are optional, but may be used by        # checkrad.pl for simultaneous use checks        #        #        # The nastype tells 'checkrad.pl' which NAS-specific method to        #  use to query the NAS for simultaneous use.        #        #  Permitted NAS types are:        #        #       cisco        #       computone        #       livingston        #       juniper        #       max40xx        #       multitech        #       netserver        #       pathras        #       patton        #       portslave        #       tc        #       usrhiper        #       other           # for all other types        #        nastype     = other     # localhost isn't usually a NAS...        #        #  The following two configurations are for future use.        #  The 'naspasswd' file is currently used to store the NAS        #  login name and password, which is used by checkrad.pl        #  when querying the NAS for simultaneous use.        ##       login       = !root#       password    = someadminpas        #        #  As of 2.0, clients can also be tied to a virtual server.        #  This is done by setting the "virtual_server" configuration        #  item, as in the example below.        ##       virtual_server = home1        #        #  A pointer to the "home_server_pool" OR a "home_server"        #  section that contains the CoA configuration for this        #  client.  For an example of a coa home server or pool,        #  see raddb/sites-available/originate-coa#       coa_server = coa}# IPv6 Client#client ::1 {#       secret          = testing123#       shortname       = localhost#}## All IPv6 Site-local clients#client fe80::/16 {#       secret          = testing123#       shortname       = localhost#}#client some.host.org {#       secret          = testing123#       shortname       = localhost#}##  You can now specify one secret for a network of clients.#  When a client request comes in, the BEST match is chosen.#  i.e. The entry from the smallest possible network.##client 192.168.0.0/24 {#       secret          = testing123-1#       shortname       = private-network-1#}##client 192.168.0.0/16 {#       secret          = testing123-2#       shortname       = private-network-2#}#client 10.10.10.10 {#       # secret and password are mapped through the "secrets" file.#       secret      = testing123#       shortname   = liv1#       # the following three fields are optional, but may be used by#       # checkrad.pl for simultaneous usage checks#       nastype     = livingston#       login       = !root#       password    = someadminpas#}#########################################################################  Per-socket client lists.  The configuration entries are exactly#  the same as above, but they are nested inside of a section.##  You can have as many per-socket client lists as you have "listen"#  sections, or you can re-use a list among multiple "listen" sections.##  Un-comment this section, and edit a "listen" section to add:#  "clients = per_socket_clients".  That IP address/port combination#  will then accept ONLY the clients listed in this section.##clients per_socket_clients {#       client 192.168.3.4 {#               secret = testing123#        }#}[root@alexy raddb]#

##       Please read the documentation file ../doc/processing_users_file,#       or 'man 5 users' (after installing the server) for more information.##       This file contains authentication security and configuration#       information for each user.  Accounting requests are NOT processed#       through this file.  Instead, see 'acct_users', in this directory.##       The first field is the user's name and can be up to#       253 characters in length.  This is followed (on the same line) with#       the list of authentication requirements for that user.  This can#       include password, comm server name, comm server port number, protocol#       type (perhaps set by the "hints" file), and huntgroup name (set by#       the "huntgroups" file).##       If you are not sure why a particular reply is being sent by the#       server, then run the server in debugging mode (radiusd -X), and#       you will see which entries in this file are matched.##       When an authentication request is received from the comm server,#       these values are tested. Only the first match is used unless the#       "Fall-Through" variable is set to "Yes".##       A special user named "DEFAULT" matches on all usernames.#       You can have several DEFAULT entries. All entries are processed#       in the order they appear in this file. The first entry that#       matches the login-request will stop processing unless you use#       the Fall-Through variable.##       If you use the database support to turn this file into a .db or .dbm#       file, the DEFAULT entries _have_ to be at the end of this file and#       you can't have multiple entries for one username.##       Indented (with the tab character) lines following the first#       line indicate the configuration values to be passed back to#       the comm server to allow the initiation of a user session.#       This can include things like the PPP configuration values#       or the host to log the user onto.##       You can include another `users' file with `$INCLUDE users.other'###       For a list of RADIUS attributes, and links to their definitions,#       see:##       http://www.freeradius.org/rfc/attributes.html### Deny access for a specific user.  Note that this entry MUST# be before any other 'Auth-Type' attribute which results in the user# being authenticated.## Note that there is NO 'Fall-Through' attribute, so the user will not# be given any additional resources.##lameuser       Auth-Type := Reject#               Reply-Message = "Your account has been disabled."## Deny access for a group of users.## Note that there is NO 'Fall-Through' attribute, so the user will not# be given any additional resources.##DEFAULT        Group == "disabled", Auth-Type := Reject#               Reply-Message = "Your account has been disabled."### This is a complete entry for "steve". Note that there is no Fall-Through# entry so that no DEFAULT entry will be used, and the user will NOT# get any attributes in addition to the ones listed here.##steve  Cleartext-Password := "testing"#       Service-Type = Framed-User,#       Framed-Protocol = PPP,#       Framed-IP-Address = 172.16.3.33,#       Framed-IP-Netmask = 255.255.255.0,#       Framed-Routing = Broadcast-Listen,#       Framed-Filter-Id = "std.ppp",#       Framed-MTU = 1500,#       Framed-Compression = Van-Jacobsen-TCP-IP## This is an entry for a user with a space in their name.# Note the double quotes surrounding the name.##"John Doe"     Cleartext-Password := "hello"#               Reply-Message = "Hello, %{User-Name}"## Dial user back and telnet to the default host for that port##Deg    Cleartext-Password := "ge55ged"#       Service-Type = Callback-Login-User,#       Login-IP-Host = 0.0.0.0,#       Callback-Number = "9,5551212",#       Login-Service = Telnet,#       Login-TCP-Port = Telnet## Another complete entry. After the user "dialbk" has logged in, the# connection will be broken and the user will be dialed back after which# he will get a connection to the host "timeshare1".##dialbk Cleartext-Password := "callme"#       Service-Type = Callback-Login-User,#       Login-IP-Host = timeshare1,#       Login-Service = PortMaster,#       Callback-Number = "9,1-800-555-1212"## user "swilson" will only get a static IP number if he logs in with# a framed protocol on a terminal server in Alphen (see the huntgroups file).## Note that by setting "Fall-Through", other attributes will be added from# the following DEFAULT entries##swilson        Service-Type == Framed-User, Huntgroup-Name == "alphen"#               Framed-IP-Address = 192.168.1.65,#               Fall-Through = Yes## If the user logs in as 'username.shell', then authenticate them# using the default method, give them shell access, and stop processing# the rest of the file.##DEFAULT        Suffix == ".shell"#               Service-Type = Login-User,#               Login-Service = Telnet,#               Login-IP-Host = your.shell.machine## The rest of this file contains the several DEFAULT entries.# DEFAULT entries match with all login names.# Note that DEFAULT entries can also Fall-Through (see first entry).# A name-value pair from a DEFAULT entry will _NEVER_ override# an already existing name-value pair.### Set up different IP address pools for the terminal servers.# Note that the "+" behind the IP address means that this is the "base"# IP address. The Port-Id (S0, S1 etc) will be added to it.##DEFAULT        Service-Type == Framed-User, Huntgroup-Name == "alphen"#               Framed-IP-Address = 192.168.1.32+,#               Fall-Through = Yes#DEFAULT        Service-Type == Framed-User, Huntgroup-Name == "delft"#               Framed-IP-Address = 192.168.2.32+,#               Fall-Through = Yes## Sample defaults for all framed connections.##DEFAULT        Service-Type == Framed-User#       Framed-IP-Address = 255.255.255.254,#       Framed-MTU = 576,#       Service-Type = Framed-User,#       Fall-Through = Yes## Default for PPP: dynamic IP address, PPP mode, VJ-compression.# NOTE: we do not use Hint = "PPP", since PPP might also be auto-detected#       by the terminal server in which case there may not be a "P" suffix.#       The terminal server sends "Framed-Protocol = PPP" for auto PPP.#DEFAULT Framed-Protocol == PPP        Framed-Protocol = PPP,        Framed-Compression = Van-Jacobson-TCP-IP## Default for CSLIP: dynamic IP address, SLIP mode, VJ-compression.#DEFAULT Hint == "CSLIP"        Framed-Protocol = SLIP,        Framed-Compression = Van-Jacobson-TCP-IP## Default for SLIP: dynamic IP address, SLIP mode.#DEFAULT Hint == "SLIP"        Framed-Protocol = SLIP## Last default: rlogin to our main server.##DEFAULT#       Service-Type = Login-User,#       Login-Service = Rlogin,#       Login-IP-Host = shellbox.ispdomain.com# ## # Last default: shell on the local terminal server.# ## DEFAULT#       Service-Type = Administrative-User# On no match, the user is denied access.

[root@alexy raddb]# radiusd --hradiusd: invalid option -- -Usage: radiusd [-d db_dir] [-l log_dir] [-i address] [-n name] [-fsvXx]Options:  -C              Check configuration and exit.  -d raddb_dir    Configuration files are in "raddbdir/*".  -f              Run as a foreground process, not a daemon.  -h              Print this help message.  -i ipaddr       Listen on ipaddr ONLY.  -l log_file     Logging output will be written to this file.  -m              On SIGINT or SIGQUIT exit cleanly instead of immediately.  -n name         Read raddb/name.conf instead of raddb/radiusd.conf  -p port         Listen on port ONLY.  -s              Do not spawn child processes to handle requests.  -t              Disable threads.  -v              Print server version information.  -X              Turn on full debugging.  -x              Turn on additional debugging. (-xx gives more debugging).[root@alexy raddb]#