# General settings

# Specify which authentication comes first respectively which
# authentication is used. Possible values are "radius" and "local".
# If you specify "radius,local" then the RADIUS server is asked
# first then the local one. If only one keyword is specified,
# only this server is asked.
auth_order radius,local

# Maximum login tries a user has.
login_tries 4

# Timeout for all login tries if this
# time is exceeded the user is kicked out
login_timeout 60

# Name of the nologin file which when it exists disables logins.
# It may be extended by the ttyname which will result in
# a terminal specific lock (e.g. /etc/nologin.ttyS2 will disable
# logins on /dev/ttyS2)
nologin /etc/nologin

# Name of the issue file. It's only displayed when no
# username is passed on the radlogin command line.
issue /usr/local/etc/freeradius-client/issue

# Transport Protocol Support
# Available options - 'tcp', 'udp', 'tls' and 'dtls'. 
# If commented out, udp will be used. TLS and DTLS
# authentication can be used with PSK keys or X.509
# certificate  authentication (see below).
serv-type tls

tls-ca-file dtls/ca.pem
tls-cert-file dtls/clicert.pem
tls-key-file dtls/clikey.pem
tls-verify-hostname false

# RADIUS settings

# RADIUS server to use for authentication requests. This config
# item can appear more than one time. If multiple servers are
# defined they are tried in a round robin fashion if one server
# is not answering.
# Optionally, you can specify the port number on which thes remote
# RADIUS server listens separated by a colon from the hostname.
# If no port is specified, /etc/services is consulted for the radius
# service. If this fails also a compiled in default is used.
authserver localhost:2083

# RADIUS server to use for accouting requests.
# All settings for authserver apply, too.
#
acctserver localhost:2083

# File holding shared secrets used for the communication
# between the RADIUS client and server.
servers servers-tls-temp

# Dictionary of allowed attributes and values.
# Just like in the normal RADIUS distributions.
dictionary ../etc/dictionary

# Program to call for a RADIUS authenticated login.
login_radius /usr/local/sbin/login.radius

# File which specifies mapping between the ttyname
# and the NAS-Port attribute.
mapfile ../etc/port-id-map

# Default authentication realm to append to all usernames.
# The radiusd program directly from Livingston doesn't
# use any realms, so leave it blank then.
default_realm

# Time to wait for a reply from the RADIUS server.
radius_timeout 10

# Resend request this many times before trying the next server.
radius_retries 3

# The length of time in seconds after we skip a nonresponsive RADIUS
# server for transaction requests. Server(s) being in the "dead" state
# are tried only after all other non-dead servers have been tried and
# failed or timed out. The deadtime interval starts when the server
# does not respond to an authentication/accounting request transmissions. 
# When the interval expires, the "dead" server would be re-tried again,
# and if it's still down then it will be considered "dead" for another
# such interval and so on. This option is no-op if there is only one
# server in the list. Set to 0 in order to disable the feature.
radius_deadtime 0

# Local address from which radius packets have to be sent.
bindaddr *

# LOCAL settings

# Program to execute for local login. It must support
# the -f flag for preauthenticated login
login_local /bin/login
