# radius.cfg
#

#Foreground
#LogStdout
LogDir		/var/log/radiator
DbDir		/etc/radiator
# User a lower trace level in production systems:
Trace 		4
AuthPort 1645,1812
AcctPort 1646,1813

# You will probably want to add other Clients to suit your site,
# one for each NAS you want to work with
<Client DEFAULT>
	Secret	nacnac08
	DupInterval 0
</Client>

<AuthLog SYSLOG>
        Identifier myauthlogger2
	Facility local0
        LogSuccess 1
        LogFailure 1
	FailureFormat FAIL|%l|%U|%{Request:NAS-IP-Address}|%{Request:Calling-Station-Id}
	SuccessFormat OK|%l|%U|%{Request:NAS-IP-Address}|%{Request:Calling-Station-Id}|%{Reply:Tunnel-Private-Group-ID}|%{Reply:Callback-Number}
# Uncomment these to syslog to a remote host:
# LogHost 1.2.3.4
# LogSock udp
</AuthLog>

<Handler TunnelledByPEAP=1>
        # Windows XP when configured for a workgroup might send tunnelled user n ames
        # in the format COMPUTERNAME\username (eg BAKER\mikem). This
        # will strip the computer name leaving just the user name
        RewriteUsername s/(.*)\\(.*)/$2/

        <AuthBy FILE>

                # anonymous-PEAP must be in here:
                Filename %D/users

                # This tells the PEAP client what types of inner EAP requests
                # we will honour
                EAPType MSCHAP-V2,TTLS,TLS,MD5-Challenge,Generic-Token
                # Need these for TTLS:
                EAPTLS_CAFile %D/certificates/joelsca/certnew.pem
                EAPTLS_CertificateFile %D/certificates/joelsca/proxy.pem
                EAPTLS_CertificateType PEM
                EAPTLS_PrivateKeyFile %D/certificates/joelsca/proxy.key
        </AuthBy>
</Handler>


# This is where we authenticate a TTLS inner request,
# The username of the inner request will be anonymous, although
# the identity of the EAP request will be the real username we are
# trying to authenticate.
<Handler TunnelledByTTLS=1>
        <AuthBy FILE>
                # anonymous-PEAP must be in here:
                Filename %D/users

                # This tells the PEAP client what types of inner EAP requests
                # we will honour
                EAPType MSCHAP-V2,MD5,TLS
                # Need these for TLS
                EAPTLS_CAFile %D/certificates/joelsca/certnew.pem
                EAPTLS_CertificateFile %D/certificates/joelsca/proxy.pem
                EAPTLS_CertificateType PEM
                EAPTLS_PrivateKeyFile %D/certificates/joelsca/proxy.key
        </AuthBy>
</Handler>

# Proxy based on the tail of the username
<Handler User-Name=/cisco$/>
	<AuthBy RADIUS>
		Host 45.200.1.71
		AuthPort 1812
		AcctPort 1813
		Secret nacnac08
		Retries 0
		FailureBackoffTime 0

		# If the reply contains Callback-Id (ie from Cisco ACS)
		# turn it into Callback-Number
		ReplyHook sub {\
		 my $p = ${$_[0]};my $rp = ${$_[1]}; \
		 my $cbid = $rp->get_attr('Callback-Id');\
		 if (defined $cbid)\
		 { \
		   $rp->delete_attr('Callback-Id');\
		   $rp->add_attr('Callback-Number', $cbid);\
		 }\
		}
	</AuthBy>
        AuthLog myauthlogger2
</Handler>

<Handler User-Name=/avenda$/>
        <AuthBy RADIUS>
                Host 45.200.1.81
                AuthPort 1812
                AcctPort 1813
                Secret nacnac08
		Retries 0
		FailureBackoffTime 0
        </AuthBy>
        AuthLog myauthlogger2
</Handler>

<Handler User-Name=/nps$/>
        <AuthBy RADIUS>
                Host 45.200.1.85
                AuthPort 1812
                AcctPort 1813
                Secret nacnac08
		Retries 0
		FailureBackoffTime 0
        </AuthBy>
        AuthLog myauthlogger2
</Handler>

<Handler User-Name=/nps2$/>
        <AuthBy RADIUS>
                Host 45.200.1.77
                AuthPort 1812
                AcctPort 1813
                Secret nacnac08
                Retries 0
                FailureBackoffTime 0
        </AuthBy>
        AuthLog myauthlogger2
</Handler>

<Handler User-Name=/uac$/>
        <AuthBy RADIUS>
                Host 45.200.1.78
                AuthPort 1812
                AcctPort 1813
                Secret nacnac08
		Retries 0
		FailureBackoffTime 0
        </AuthBy>
        AuthLog myauthlogger2
</Handler>

<Handler User-Name=/radiator$/>
        <AuthBy RADIUS>
                Host 45.200.1.72
                AuthPort 1812
                AcctPort 1813
                Secret nacnac08
		Retries 0
		FailureBackoffTime 0
        </AuthBy>
        AuthLog myauthlogger2
</Handler>

<Handler User-Name=/freeradius$/>
        <AuthBy RADIUS>
                Host 45.200.1.76
                AuthPort 1812
                AcctPort 1813
                Secret nacnac08
		Retries 0
		FailureBackoffTime 0
        </AuthBy>
        AuthLog myauthlogger2
</Handler>

# USername that look like MAC addresses go to cisco
<Handler User-Name=/^[0-9a-fA-F][0-9a-fA-F][:-]?[0-9a-fA-F][0-9a-fA-F][:-]?[0-9a-fA-F][0-9a-fA-F][:-]?[0-9a-fA-F][0-9a-fA-F][:-]?[0-9a-fA-F][0-9a-fA-F][:-]?[0-9a-fA-F][0-9a-fA-F]$/>
        <AuthBy RADIUS>
                Host 45.200.1.71
                AuthPort 1812
                AcctPort 1813
                Secret nacnac08
                Retries 0
                FailureBackoffTime 0
        </AuthBy>
        AuthLog myauthlogger2
</Handler>


# Handle everyone else locally, suport almost any EAP type
<Handler>
        <AuthBy FILE>
                Filename %D/users
                EAPType PEAP,TTLS,TLS,MD5,Generic-Token,LEAP,MSCHAP-V2,FAST
                EAPTLS_CAFile %D/certificates/joelsca/certnew.pem
                EAPTLS_CertificateFile %D/certificates/joelsca/proxy.pem
                EAPTLS_CertificateType PEM
                EAPTLS_PrivateKeyFile %D/certificates/joelsca/proxy.key
                EAPTLS_MaxFragmentSize 1000
                AutoMPPEKeys
                EAPTLS_PEAPVersion 0
                EAPTLS_PEAPBrokenV1Label
                EAPTLS_DHFile %D/certificates/dh2048.pem
		EAPTLSRewriteCertificateCommonName s/.nac.ilabs.interop.net//
        </AuthBy>
	AuthLog myauthlogger2

</Handler>

<ServerHTTP>
	Port 9048
	Trace 4
	Username admin
	Password 44beers4all
	DefaultPrivilegeLevel 15
       UseSSL 1
        TLS_CAFile %D/certificates/demoCA/cacert.pem
        TLS_CertificateFile %D/certificates/cert-srv.pem
        TLS_CertificateType PEM
        TLS_PrivateKeyFile %D/certificates/cert-srv.pem
        TLS_PrivateKeyPassword whatever

</ServerHTTP>

