Adding upstream version 3.2.1+dfsg.upstream/3.2.1+dfsgupstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

4 files changed, 417 insertions, 0 deletions

diff --git a/raddb/mods-config/files/accounting b/raddb/mods-config/files/accounting
new file mode 100644
index 0000000..eaf952a
--- /dev/null
+++ b/raddb/mods-config/files/accounting
@@ -0,0 +1,27 @@
+#
+#	$Id$
+#
+#	This is like the 'users' file, but it is processed only for
+#	accounting packets.
+#
+
+#  Select between different accounting methods based for example on the
+#  Realm, the Huntgroup-Name or any combinaison of the attribute/value
+#  pairs contained in an accounting packet.
+#
+#  You will need to add an "Acct-Type foo {...}" subsection to the
+#  main "accounting" section in order for these sample configurations
+#  to work.
+#
+#DEFAULT Realm == "foo.net", Acct-Type := foo
+#
+#DEFAULT Huntgroup-Name == "wifi", Acct-Type := wifi
+#
+#DEFAULT Client-IP-Address == 10.0.0.1, Acct-Type := other
+#
+#DEFAULT Acct-Status-Type == Start, Acct-Type := start
+
+#  Replace the User-Name with the Stripped-User-Name, if it exists.
+#
+#DEFAULT
+#	User-Name := "%{%{Stripped-User-Name}:-%{User-Name}}"
diff --git a/raddb/mods-config/files/authorize b/raddb/mods-config/files/authorize
new file mode 100644
index 0000000..ddf805f
--- /dev/null
+++ b/raddb/mods-config/files/authorize
@@ -0,0 +1,206 @@
+#
+# 	Configuration file for the rlm_files module.
+# 	Please see rlm_files(5) manpage for more information.
+#
+# 	This file contains authentication security and configuration
+#	information for each user.  Accounting requests are NOT processed
+#	through this file.  Instead, see 'accounting', in this directory.
+#
+#	The first field is the user's name and can be up to
+#	253 characters in length.  This is followed (on the same line) with
+#	the list of authentication requirements for that user.  This can
+#	include password, comm server name, comm server port number, protocol
+#	type (perhaps set by the "hints" file), and huntgroup name (set by
+#	the "huntgroups" file).
+#
+#	If you are not sure why a particular reply is being sent by the
+#	server, then run the server in debugging mode (radiusd -X), and
+#	you will see which entries in this file are matched.
+#
+#	When an authentication request is received from the comm server,
+#	these values are tested. Only the first match is used unless the
+#	"Fall-Through" variable is set to "Yes".
+#
+#	A special user named "DEFAULT" matches on all usernames.
+#	You can have several DEFAULT entries. All entries are processed
+#	in the order they appear in this file. The first entry that
+#	matches the login-request will stop processing unless you use
+#	the Fall-Through variable.
+#
+#	Indented (with the tab character) lines following the first
+#	line indicate the configuration values to be passed back to
+#	the comm server to allow the initiation of a user session.
+#	This can include things like the PPP configuration values
+#	or the host to log the user onto.
+#
+#	You can include another `users' file with `$INCLUDE users.other'
+
+#
+#	For a list of RADIUS attributes, and links to their definitions,
+#	see: http://www.freeradius.org/rfc/attributes.html
+#
+#	Entries below this point are examples included in the server for
+#	educational purposes. They may be deleted from the deployed
+#	configuration without impacting the operation of the server.
+#
+
+#
+# Deny access for a specific user.  Note that this entry MUST
+# be before any other 'Auth-Type' attribute which results in the user
+# being authenticated.
+#
+# Note that there is NO 'Fall-Through' attribute, so the user will not
+# be given any additional resources.
+#
+#lameuser	Auth-Type := Reject
+#		Reply-Message = "Your account has been disabled."
+
+#
+# Deny access for a group of users.
+#
+# Note that there is NO 'Fall-Through' attribute, so the user will not
+# be given any additional resources.
+#
+#DEFAULT	Group == "disabled", Auth-Type := Reject
+#		Reply-Message = "Your account has been disabled."
+#
+
+#
+# This is a complete entry for "steve". Note that there is no Fall-Through
+# entry so that no DEFAULT entry will be used, and the user will NOT
+# get any attributes in addition to the ones listed here.
+#
+#steve	Cleartext-Password := "testing"
+#	Service-Type = Framed-User,
+#	Framed-Protocol = PPP,
+#	Framed-IP-Address = 172.16.3.33,
+#	Framed-IP-Netmask = 255.255.255.0,
+#	Framed-Routing = Broadcast-Listen,
+#	Framed-Filter-Id = "std.ppp",
+#	Framed-MTU = 1500,
+#	Framed-Compression = Van-Jacobsen-TCP-IP
+
+#
+# The canonical testing user which is in most of the
+# examples.
+#
+#bob	Cleartext-Password := "hello"
+#	Reply-Message := "Hello, %{User-Name}"
+#
+
+#
+# This is an entry for a user with a space in their name.
+# Note the double quotes surrounding the name.  If you have
+# users with spaces in their names, you must also change
+# the "filter_username" policy to allow spaces.
+#
+# See raddb/policy.d/filter, filter_username {} section.
+#
+#"John Doe"	Cleartext-Password := "hello"
+#		Reply-Message = "Hello, %{User-Name}"
+
+#
+# Dial user back and telnet to the default host for that port
+#
+#Deg	Cleartext-Password := "ge55ged"
+#	Service-Type = Callback-Login-User,
+#	Login-IP-Host = 0.0.0.0,
+#	Callback-Number = "9,5551212",
+#	Login-Service = Telnet,
+#	Login-TCP-Port = Telnet
+
+#
+# Another complete entry. After the user "dialbk" has logged in, the
+# connection will be broken and the user will be dialed back after which
+# he will get a connection to the host "timeshare1".
+#
+#dialbk	Cleartext-Password := "callme"
+#	Service-Type = Callback-Login-User,
+#	Login-IP-Host = timeshare1,
+#	Login-Service = PortMaster,
+#	Callback-Number = "9,1-800-555-1212"
+
+#
+# user "swilson" will only get a static IP number if he logs in with
+# a framed protocol on a terminal server in Alphen (see the huntgroups file).
+#
+# Note that by setting "Fall-Through", other attributes will be added from
+# the following DEFAULT entries
+#
+#swilson	Service-Type == Framed-User, Huntgroup-Name == "alphen"
+#		Framed-IP-Address = 192.0.2.65,
+#		Fall-Through = Yes
+
+#
+# If the user logs in as 'username.shell', then authenticate them
+# using the default method, give them shell access, and stop processing
+# the rest of the file.
+#
+#DEFAULT	Suffix == ".shell"
+#		Service-Type = Login-User,
+#		Login-Service = Telnet,
+#		Login-IP-Host = your.shell.machine
+
+
+#
+# The rest of this file contains the several DEFAULT entries.
+# DEFAULT entries match with all login names.
+# Note that DEFAULT entries can also Fall-Through (see first entry).
+# A name-value pair from a DEFAULT entry will _NEVER_ override
+# an already existing name-value pair.
+#
+
+# Sample defaults for all framed connections.
+#
+#DEFAULT	Service-Type == Framed-User
+#	Framed-IP-Address = 255.255.255.254,
+#	Framed-MTU = 576,
+#	Service-Type = Framed-User,
+#	Fall-Through = Yes
+
+#
+# Default for PPP: dynamic IP address, PPP mode, VJ-compression.
+# NOTE: we do not use Hint = "PPP", since PPP might also be auto-detected
+#	by the terminal server in which case there may not be a "P" suffix.
+#	The terminal server sends "Framed-Protocol = PPP" for auto PPP.
+#
+DEFAULT	Framed-Protocol == PPP
+	Framed-Protocol = PPP,
+	Framed-Compression = Van-Jacobson-TCP-IP
+
+#
+# Default for CSLIP: dynamic IP address, SLIP mode, VJ-compression.
+#
+DEFAULT	Hint == "CSLIP"
+	Framed-Protocol = SLIP,
+	Framed-Compression = Van-Jacobson-TCP-IP
+
+#
+# Default for SLIP: dynamic IP address, SLIP mode.
+#
+DEFAULT	Hint == "SLIP"
+	Framed-Protocol = SLIP
+
+#
+# Last default: rlogin to our main server.
+#
+#DEFAULT
+#	Service-Type = Login-User,
+#	Login-Service = Rlogin,
+#	Login-IP-Host = shellbox.ispdomain.com
+
+# #
+# # Last default: shell on the local terminal server.
+# #
+# DEFAULT
+# 	Service-Type = Administrative-User
+
+
+# On no match, the user is denied access.
+
+
+#########################################################
+# You should add test accounts to the TOP of this file! #
+# See the example user "bob" above.                     #
+#########################################################
+
diff --git a/raddb/mods-config/files/dhcp b/raddb/mods-config/files/dhcp
new file mode 100644
index 0000000..04f37b5
--- /dev/null
+++ b/raddb/mods-config/files/dhcp
@@ -0,0 +1,153 @@
+#
+#  This configuration file that may be used by multiple instances of rlm_files
+#  to set reply and control options for defining DHCP replies.
+#
+#  The content of this file is all made up and needs to be set appropriate to
+#  the network being served.
+#
+
+############################################
+#  Global and network-specific parameters  #
+############################################
+
+#
+#  Note: This section is matched by calling the dhcp_network instance of the
+#  files module.
+#
+
+
+#
+#  Default options that can be overridden by subsequent matches.
+#
+network
+	DHCP-Domain-Name-Server := 192.0.1.100,
+	DHCP-Domain-Name-Server += 192.0.1.101,
+	DHCP-Time-Server := 192.0.1.200,
+	DHCP-Domain-Name := "example.org",
+	DHCP-IP-Address-Lease-Time := 7200,
+	Fall-Through := yes
+
+
+#
+#  The following examples set options specific to the Layer 2 network, matched
+#  on whether the internal attribute DHCP-Network-Subnet (that acts as a
+#  network identifier) is within the indicated range. This is equivalent to a
+#  "shared-network" or "multinet" configuration (i.e. one that is possibly
+#  composed of multiple subnets) as defined by some other DHCP servers.
+#
+
+#
+#  Here is an example for a network containing a single IP subnet. We can set
+#  the network-specific options *and* we directly set the DHCP-Subnet-Mask,
+#  DHCP-Router-Address and DHCP-Broadcast-Address since it is a common reply
+#  parameter for all DHCP requests originating from this network.
+#
+#  The use of the ^= "prepend" operator for setting DHCP-Domain-Name-Server
+#  results in this new value being inserted at the start of the list, meaning
+#  this will become the first DNS server presented in the reply.
+#
+#  Note: If the architecture has only a single subnet for each Layer 2 network
+#  then by placing all subnet-related options here we can avoid calling the
+#  dhcp_subnet policy after IP allocation.
+#
+network	DHCP-Network-Subnet < 10.20.0.0/16, Pool-Name := "smalldept"
+	DHCP-IP-Address-Lease-Time := 3600,
+	DHCP-Domain-Name := "smalldept.example.org",
+	DHCP-Subnet-Mask := 255.255.0.0,
+	DHCP-Router-Address := 10.20.0.1,
+	DHCP-Domain-Name-Server ^= 10.20.0.2,
+	DHCP-Broadcast-Address := 10.20.255.255
+
+#
+#  Here is an example for a network that consists of multiple IP subnets, each
+#  of which is valid for a DHCP request originating from the network. We set
+#  the Pool-Name parameter to identify a single pool that contains the IP
+#  address within each subnet, any of which is suitable.
+#
+#  We set the options that are common to the network but we defer the setting
+#  of DHCP-Subnet-Mask, DHCP-Router-Address and DHCP-Broadcast-Address until an
+#  address has been allocated. Only then do we know which subnet parameters are
+#  required. See the next section.
+#
+network	DHCP-Network-Subnet < 10.30.0.0/16, Pool-Name := "bigdept"
+	DHCP-Domain-Name := "bigdept.example.org"
+
+
+#
+#  Here is an example for a network that has a dedicated pool for admin staff
+#  and a seperate pool for everything else.
+#
+network	DHCP-Network-Subnet < 192.0.2.0/24, DHCP-Group-Name == "admin", Pool-Name := "admin-only"
+network	DHCP-Network-Subnet < 192.0.2.0/24, Pool-Name := "general"
+
+
+################################
+#  Subnet-specific parameters  #
+################################
+
+#
+#  Note: This section is matched by calling the dhcp_subnet policy which sets
+#  DHCP-Network-Subnet to the allocated IP address of the device and then
+#  calls the dhcp_subnet instance of the files module.
+#
+#  Layer 2 networks many contain multiple subnets, each with their own gateway.
+#  We call this section *after* the allocation of an IP address (e.g. from a
+#  single pool containing addresses within multiple equally-valid subnets for
+#  the network) so that we then know which subnet-specific parameters to
+#  return.
+#
+
+#
+#  Subnet-specific options, matched on whether the allocated IP address is
+#  within the indicated range.
+#
+subnet	DHCP-Network-Subnet < 10.30.10.0/24
+	DHCP-Subnet-Mask := 255.255.255.0,
+	DHCP-Router-Address := 10.30.10.1,
+	DHCP-Broadcast-Address := 10.30.10.255
+
+subnet	DHCP-Network-Subnet < 10.30.20.0/24
+	DHCP-Subnet-Mask := 255.255.255.0,
+	DHCP-Router-Address := 10.30.20.1,
+	DHCP-Broadcast-Address := 10.30.20.255
+
+
+###############################
+#  Group-specific parameters  #
+###############################
+
+#
+#  Note: This section is matched by calling the dhcp_group_options policy.
+#
+#  It should be called *after* defining the device's group memberships in
+#  DHCP-Group-Name request attributes. In the default dhcp virtual server this
+#  is demonstrated with the help of the dhcp_group_membership instance of the
+#  passwd module.
+#
+
+#
+#  Group-specific options, keyed by DHCP-Group-Name
+#
+group1
+	DHCP-Server-Host-Name := "terminal-booter.example.org",
+	DHCP-Boot-Filename := "bootfile.pxe"
+
+
+##############################
+#  Host-specific parameters  #
+##############################
+
+#
+#  Note: This section is matched by calling the dhcp_hosts instance of the
+#  files module.
+#
+
+#
+#  Host-specific options, keyed by DHCP-Client-Hardware-Address
+#
+host-00:10:20:30:40:50
+	DHCP-Boot-Filename := "customboot.pxe"
+
+host-10:90:80:70:aa:bb
+	DHCP-X-Window-Font-Server := 10.20.1.10,
+	DHCP-Impress-Server := 10.20.1.20
diff --git a/raddb/mods-config/files/pre-proxy b/raddb/mods-config/files/pre-proxy
new file mode 100644
index 0000000..7292e23
--- /dev/null
+++ b/raddb/mods-config/files/pre-proxy
@@ -0,0 +1,31 @@
+#
+#  Configuration file for the rlm_files module.
+#  Please see rlm_files(5) manpage for more information.
+#
+#  $Id$
+#
+#  This file is similar to the "users" file.  The check items
+#  are compared against the request, but the "reply" items are
+#  used to update the proxied packet, not the reply to the NAS.
+#
+#  You can use this file to re-write requests which are about to
+#  be sent to a home server.
+#
+
+#
+#  Requests destinated to realm "extisp" are sent to a RADIUS
+#  home server hosted by an other company which doesn't know about
+#  the IP addresses of our NASes. Therefore we replace the value of
+#  the NAS-IP-Address attribute by a unique value we communicated
+#  to them.
+#
+#DEFAULT Realm == "extisp"
+#	NAS-IP-Address := 10.1.2.3
+
+#
+#  For all proxied packets, set the User-Name in the proxied packet
+#  to the Stripped-User-Name, if it exists.  If not, set it to the
+#  User-Name from the original request.
+#
+#DEFAULT
+#	User-Name := `%{%{Stripped-User-Name}:-%{User-Name}}`