diff --git a/ansible/ansible-bootstrap.cfg b/ansible/ansible-bootstrap.cfg index de65b59..c85722c 100644 --- a/ansible/ansible-bootstrap.cfg +++ b/ansible/ansible-bootstrap.cfg @@ -2,6 +2,7 @@ host_key_checking = False inventory = hosts interpreter_python = auto_silent +vault_password_file = ~/.ansible-vault-pass [ssh_connection] pipelining = true \ No newline at end of file diff --git a/ansible/host_vars/radius.vntx.net.yml b/ansible/host_vars/radius.vntx.net.yml deleted file mode 100644 index 2e0dad4..0000000 --- a/ansible/host_vars/radius.vntx.net.yml +++ /dev/null @@ -1,21 +0,0 @@ ---- -ansible_host: 204.110.191.248 -ansible_python_interpreter: /usr/bin/python3 -ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new' - -firewall_allow_rules: - - port: 1812 - proto: udp - comment: RADIUS Auth - - port: 1812 - proto: tcp - comment: RADIUS Auth - - port: 1813 - proto: udp - comment: RADIUS Accounting - - port: 1813 - proto: tcp - comment: RADIUS Accounting - - port: 3306 - proto: tcp - comment: MySQL diff --git a/ansible/host_vars/radius.vntx.net/vars.yml b/ansible/host_vars/radius.vntx.net/vars.yml new file mode 100644 index 0000000..795005f --- /dev/null +++ b/ansible/host_vars/radius.vntx.net/vars.yml @@ -0,0 +1,104 @@ +--- +ansible_python_interpreter: /usr/bin/python3 +ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new' + +firewall_trusted_subnets: + - subnet: 100.64.0.0/10 + comment: Tailscale + - subnet: 204.110.188.0/22 + comment: VNTX + - subnet: 10.0.0.0/8 + comment: Internal + - subnet: 192.168.0.0/16 + comment: Internal + - subnet: 172.0.0.0/15 + comment: VNTX + - subnet: 216.180.128.0/20 + comment: VNTX + - subnet: 3.228.90.246 + comment: Gaiia AWS + +firewall_allow_rules: + - port: 1812 + proto: udp + comment: RADIUS Auth + - port: 1812 + proto: tcp + comment: RADIUS Auth + - port: 1813 + proto: udp + comment: RADIUS Accounting + - port: 1813 + proto: tcp + comment: RADIUS Accounting + - port: 3306 + proto: tcp + from_ip: 10.0.0.0/8 + comment: MySQL (internal) + - port: 3306 + proto: tcp + from_ip: 204.110.188.0/22 + comment: MySQL (VNTX/Gaiia) + - port: 3306 + proto: tcp + from_ip: 3.228.90.246 + comment: MySQL (Gaiia AWS) + - port: 3799 + proto: udp + from_ip: 3.228.90.246 + comment: RADIUS CoA/Disconnect (Gaiia AWS) + +# FreeRADIUS role — user will manually import seed data after deploy +freeradius_load_user_data: false + +# RADIUS clients (CoA/management systems) +freeradius_clients: + - name: localhost + ipaddr: "127.0.0.1" + secret: "{{ vault_freeradius_localhost_secret | default('testing123') }}" + shortname: localhost + nas_type: other + - name: gaiia + ipaddr: "3.228.90.246" + secret: "{{ vault_freeradius_gaiia_secret }}" + shortname: gaiia + nas_type: other + +# NAS clients (secrets from vault.yml in this directory) +freeradius_nas_clients: + - nasname: "204.110.188.31" + shortname: "380" + secret: "{{ vault_nas_380_secret }}" + - nasname: "204.110.188.254" + shortname: "Verona" + secret: "{{ vault_nas_verona_secret }}" + - nasname: "204.110.188.62" + shortname: "Climax" + secret: "{{ vault_nas_climax_secret }}" + - nasname: "204.110.188.158" + shortname: "Culleoka" + secret: "{{ vault_nas_culleoka_secret }}" + - nasname: "204.110.188.190" + shortname: "NewHope" + secret: "{{ vault_nas_newhope_secret }}" + - nasname: "204.110.188.222" + shortname: "LowryCrossing" + secret: "{{ vault_nas_lowrycrossing_secret }}" + - nasname: "204.110.188.126" + shortname: "982" + secret: "{{ vault_nas_982_secret }}" + - nasname: "204.110.191.190" + shortname: "yorkshire" + secret: "{{ vault_nas_yorkshire_secret }}" + - nasname: "204.110.188.94" + shortname: "494" + secret: "{{ vault_nas_494_secret }}" + - nasname: "204.110.191.185" + shortname: "Core" + secret: "{{ vault_nas_core_secret }}" + - nasname: "204.110.191.252" + shortname: "Concatenator" + secret: "{{ vault_nas_concatenator_secret }}" + - nasname: "10.254.254.103" + shortname: "Yorkshire-mgmt" + secret: "{{ vault_nas_yorkshire_secret }}" diff --git a/ansible/host_vars/radius.vntx.net/vault.yml b/ansible/host_vars/radius.vntx.net/vault.yml new file mode 100644 index 0000000..fb424cc --- /dev/null +++ b/ansible/host_vars/radius.vntx.net/vault.yml @@ -0,0 +1,39 @@ +$ANSIBLE_VAULT;1.1;AES256 +65323864356364393135623533323261663562363831646562366138373331383030346535633461 +6363633761363631393136663630613334303034623230300a386661383931313138333165396535 +61626130353839323335646366383435323365663232356338383236316632343331323139363962 +6630663737393337660a396361313439313663636634353465393333373233363961663136393561 +64663130383362613330316439346536646235343831366138373864646433653131613734613131 +30613266666661653030383937323639666435323163666338353835626265313862643066623334 +35646236343062376635313339626366356265313032363763623066636466346363363838613938 +37653238346635343637656535373436356135356335653030323639386530386234326332333534 +63313365346265653130636635386465643966613666316532383563653534386366363762343939 +61393365663763323437303637343635326232643833336432393836363733633330663634333362 +63356338653864653363663533383430663236643335303862353133646637653232363736626532 +66316138633133663837396436633439313264613436656135383934393861363630396138616635 +32643663373232326433363834346161343832336135393830303134396539633437366466663139 +64393339623436646666326236633662636364663730376230636334663733616334633064316364 +62626166626138303165363038653930643966303334383265326331383766396332336561633636 +63643038373635326539643061313063393839356439303339386661343964303034363937363263 +37373463326530336664643134626630643839366634346432393964316366316363373461653863 +34303865303563373563386339353433613766333233626131626265623935613239373730333661 +31313836626535393934373636363863616139613866383232323931623866626336323131373136 +64373534396535666433636566613834643466353764386431303362663433333731333731613038 +65383435323738643837343538383366633766636463353963373336333033393062343734616664 +65336632613662373636336464653930346533643839623833393437316239353062386238333661 +39646433376437366234376164356337353433613938613636353235383230323738616434376439 +66393662316330663966353236383438616662656437393064353465633666326433356536366139 +37386137353464363163636664323266353064383666396537363331373334616433316433333362 +62353761613462383239653034656466383365373065376632623637366235356265313831303766 +39623236396663303333323430613233396239636638393839636462633438353334366631316432 +34396135663062383065323534643235316461336534333666636665343463323266666131356334 +63623535656433613237353432393433313362663061643237306138656663313734653962356638 +36656536356131336338336162653062663466643161346661326334363132346533653064346163 +35366536643938366265313065353230643331363034303462336534643065373634323861306236 +66646637303239393561646662383836633735623066353634643732633337626231623731663664 +61313738376337626337336334656562393664316138383235353630343233373264636631386439 +66653065396534316565666262623331653461633862396430313938616233636361633166656533 +32393735646565613835303466633639303139393461613634333835326439323664633333333030 +38656437363036303434656436343364323730363765646234366363353561343030326264333462 +62313665373162343437386133616362346539646666633736303337313366616562393562646439 +3865376334636231363639343833663863303765396131633839 diff --git a/ansible/hosts b/ansible/hosts index 12dbd5b..d1d68d6 100755 --- a/ansible/hosts +++ b/ansible/hosts @@ -1,6 +1,6 @@ [vntx_servers] logs.vntx.net -radius.vntx.net +#radius.vntx.net vpn.vntx.net netbox.vntx.net #ntp.vntx.net @@ -60,7 +60,9 @@ db.w5isp.com [irc_limited] ca.manero.org +#[radius_servers] +#radius.vntx.net + [irc_servers] us.manero.org ansible_host=manero-us ca.manero.org ansible_host=manero-ca - diff --git a/ansible/playbook.yml b/ansible/playbook.yml index 0d6120f..7c2bf6c 100644 --- a/ansible/playbook.yml +++ b/ansible/playbook.yml @@ -381,6 +381,16 @@ - role: grafana tags: grafana +- name: Configure FreeRADIUS servers + hosts: radius_servers + become: true + gather_facts: true + tags: + - radius + - freeradius + roles: + - freeradius + - name: Configure IRC servers hosts: irc_servers become: true diff --git a/ansible/roles/base/tasks/users.yml b/ansible/roles/base/tasks/users.yml index a0eafb4..7e4fe62 100644 --- a/ansible/roles/base/tasks/users.yml +++ b/ansible/roles/base/tasks/users.yml @@ -60,11 +60,42 @@ label: "{{ item.name }}" when: item.state | default('present') == 'absent' +- name: Collect unique GitHub usernames for key fetch + ansible.builtin.set_fact: + _gh_usernames: >- + {{ managed_users | default([]) + | map(attribute='authorized_keys', default=[]) + | flatten + | selectattr('type', 'defined') + | selectattr('type', 'equalto', 'github') + | map(attribute='value') + | unique + | list }} + when: managed_users | default([]) | length > 0 + +- name: Fetch GitHub SSH keys + ansible.builtin.uri: + url: "https://github.com/{{ item }}.keys" + return_content: true + loop: "{{ _gh_usernames | default([]) }}" + register: _gh_fetched + delegate_to: localhost + run_once: true + become: false + when: _gh_usernames | default([]) | length > 0 + +- name: Build GitHub keys lookup dict + ansible.builtin.set_fact: + _gh_keys: "{{ _gh_keys | default({}) | combine({item.item: item.content}) }}" + loop: "{{ _gh_fetched.results | default([]) }}" + when: _gh_fetched.results | default([]) | length > 0 + no_log: true + - name: Install authorized keys from GitHub ansible.posix.authorized_key: user: "{{ item.0.name }}" state: "{{ item.1.state | default('present') }}" - key: "https://github.com/{{ item.1.value }}.keys" + key: "{{ _gh_keys[item.1.value] }}" manage_dir: "{{ item.1.manage_dir | default(true) }}" exclusive: "{{ item.1.exclusive | default(false) }}" loop: "{{ managed_users | default([]) | subelements('authorized_keys', skip_missing=True) }}" diff --git a/ansible/roles/debian/tasks/main.yml b/ansible/roles/debian/tasks/main.yml index 3eaaa97..c5d12b5 100644 --- a/ansible/roles/debian/tasks/main.yml +++ b/ansible/roles/debian/tasks/main.yml @@ -44,3 +44,11 @@ state: present regexp: '^tmpfs\s+/run/shm\s+' line: "tmpfs /run/shm tmpfs defaults,noexec,nosuid 0 0" + +- name: "Ensure SSH listens on both IPv4 and IPv6" + ansible.builtin.lineinfile: + path: /etc/ssh/sshd_config + regexp: '^#?AddressFamily' + line: "AddressFamily any" + state: present + notify: restart ssh diff --git a/ansible/roles/firewall/tasks/main.yml b/ansible/roles/firewall/tasks/main.yml index 39bee62..f994308 100644 --- a/ansible/roles/firewall/tasks/main.yml +++ b/ansible/roles/firewall/tasks/main.yml @@ -196,7 +196,7 @@ - ansible_facts['os_family'] == "Debian" - firewall_enabled | default(true) - firewall_allow_rules | length > 0 - - _fw_ufw_rules.skipped | default(true) or (item.port | string + '/' + item.proto) not in _fw_ufw_rules.stdout + - _fw_ufw_rules.skipped | default(true) or (item.from_ip | default('any') + ' ' + item.port | string + '/' + item.proto) not in _fw_ufw_rules.stdout - name: Enable IP forwarding ansible.posix.sysctl: diff --git a/ansible/roles/freeradius/defaults/main.yml b/ansible/roles/freeradius/defaults/main.yml new file mode 100644 index 0000000..f4ba7d4 --- /dev/null +++ b/ansible/roles/freeradius/defaults/main.yml @@ -0,0 +1,50 @@ +--- +# FreeRADIUS v3 role for Debian + +freeradius_config_dir: /etc/freeradius/3.0 +freeradius_service_name: freeradius + +# Packages to install (Debian) +freeradius_packages: + - freeradius + - freeradius-mysql + - freeradius-utils + - mariadb-server + - python3-pymysql + +# MySQL connection +freeradius_db_host: localhost +freeradius_db_port: 3306 +freeradius_db_name: radius +freeradius_db_user: radius + +# SQL dialect +freeradius_sql_dialect: mysql +freeradius_sql_driver: "rlm_sql_{{ freeradius_sql_dialect }}" + +# Whether to read clients from nas table +freeradius_read_clients: true +freeradius_client_table: nas + +# NAS clients — define in host_vars +# Each entry: { nasname, shortname, type, ports, secret, server, community, description } +freeradius_nas_clients: [] + +# RADIUS clients.conf entries — define in host_vars +# Each entry: { name, ipaddr, secret, shortname, nas_type } +freeradius_clients: + - name: localhost + ipaddr: "127.0.0.1" + secret: "{{ vault_freeradius_localhost_secret | default('testing123') }}" + shortname: localhost + nas_type: other + +# Whether to seed the DB schema +freeradius_seed_db: true + +# Whether to seed NAS table from freeradius_nas_clients +freeradius_seed_nas: true + +# Whether to load user data from a SQL dump file +freeradius_load_user_data: false +freeradius_user_data_file: "" diff --git a/ansible/roles/freeradius/files/queries.conf b/ansible/roles/freeradius/files/queries.conf new file mode 100644 index 0000000..86b03b2 --- /dev/null +++ b/ansible/roles/freeradius/files/queries.conf @@ -0,0 +1,393 @@ +{# Managed by Ansible — do not edit manually. #} +# -*- text -*- +# +# main/mysql/queries.conf -- MySQL configuration for default schema (schema.sql) +# +# $Id: b31ae9c3a1bf41f030a2112d31bf3a678e76f23c $ + +safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" + +sql_user_name = "%{User-Name}" + +event_timestamp_epoch = "%{%{integer:Event-Timestamp}:-%l}" +event_timestamp = "FROM_UNIXTIME(${event_timestamp_epoch})" + +class { + column_name = # ", class" + packet_xlat = # ", '%{Class}'" + reply_xlat = # ", '%{reply:Class}'" +} + +client_query = "\ + SELECT id, nasname, shortname, type, secret, server \ + FROM ${client_table}" + +authorize_check_query = "\ + SELECT id, username, attribute, value, op \ + FROM ${authcheck_table} \ + WHERE username = '%{SQL-User-Name}' \ + ORDER BY id" + +authorize_reply_query = "\ + SELECT id, username, attribute, value, op \ + FROM ${authreply_table} \ + WHERE username = '%{SQL-User-Name}' \ + ORDER BY id" + +group_membership_query = "\ + SELECT groupname \ + FROM ${usergroup_table} \ + WHERE username = '%{SQL-User-Name}' \ + ORDER BY priority" + +authorize_group_check_query = "\ + SELECT id, groupname, attribute, \ + Value, op \ + FROM ${groupcheck_table} \ + WHERE groupname = '%{${group_attribute}}' \ + ORDER BY id" + +authorize_group_reply_query = "\ + SELECT id, groupname, attribute, \ + value, op \ + FROM ${groupreply_table} \ + WHERE groupname = '%{${group_attribute}}' \ + ORDER BY id" + +simul_count_query = "\ + SELECT COUNT(*) \ + FROM ${acct_table1} a \ + LEFT OUTER JOIN nasreload n USING (nasipaddress) \ + WHERE username = '%{SQL-User-Name}' \ + AND acctstoptime IS NULL \ + AND (a.acctstarttime > n.reloadtime OR n.reloadtime IS NULL)" + +simul_verify_query = "\ + SELECT \ + radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, \ + callingstationid, framedprotocol \ + FROM ${acct_table1} a \ + LEFT OUTER JOIN nasreload n USING (nasipaddress) \ + WHERE username = '%{SQL-User-Name}' \ + AND acctstoptime IS NULL \ + AND (a.acctstarttime > n.reloadtime OR n.reloadtime IS NULL)" + +accounting { + reference = "%{tolower:type.%{%{Acct-Status-Type}:-%{Request-Processing-Stage}}.query}" + + column_list = "\ + acctsessionid, acctuniqueid, username, \ + realm, nasipaddress, nasportid, \ + nasporttype, acctstarttime, acctupdatetime, \ + acctstoptime, acctsessiontime, acctauthentic, \ + connectinfo_start, connectinfo_stop, acctinputoctets, \ + acctoutputoctets, calledstationid, callingstationid, \ + acctterminatecause, servicetype, framedprotocol, \ + framedipaddress, framedipv6address, framedipv6prefix, \ + framedinterfaceid, delegatedipv6prefix ${..class.column_name}" + + type { + accounting-on { + query = "\ + UPDATE ${....acct_table1} \ + SET \ + acctstoptime = ${....event_timestamp}, \ + acctsessiontime = '${....event_timestamp_epoch}' \ + - UNIX_TIMESTAMP(acctstarttime), \ + acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' \ + WHERE acctstoptime IS NULL \ + AND nasipaddress = '%{NAS-IP-Address}' \ + AND acctstarttime <= ${....event_timestamp}" + + -query = "\ + INSERT INTO nasreload \ + SET \ + nasipaddress = '%{NAS-IP-Address}', \ + reloadtime = ${....event_timestamp} \ + ON DUPLICATE KEY UPDATE reloadtime = ${....event_timestamp}" + } + + accounting-off { + query = "${..accounting-on.query}" + } + + post-auth { + query = "\ + INSERT INTO ${....acct_table1} \ + (${...column_list}) \ + VALUES(\ + '%{Acct-Session-Id}', \ + '%{Acct-Unique-Session-Id}', \ + '%{SQL-User-Name}', \ + '%{Realm}', \ + '%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}}', \ + NULLIF('%{%{NAS-Port-ID}:-%{NAS-Port}}', ''), \ + '%{NAS-Port-Type}', \ + ${....event_timestamp}, \ + ${....event_timestamp}, \ + NULL, \ + 0, \ + '', \ + '%{Connect-Info}', \ + NULL, \ + 0, \ + 0, \ + '%{Called-Station-Id}', \ + '%{Calling-Station-Id}', \ + '', \ + '%{Service-Type}', \ + NULL, \ + '', \ + '', \ + '', \ + '', \ + '' \ + ${....class.packet_xlat})" + + query = "\ + UPDATE ${....acct_table1} SET \ + AcctStartTime = ${....event_timestamp}, \ + AcctUpdateTime = ${....event_timestamp}, \ + ConnectInfo_start = '%{Connect-Info}', \ + AcctSessionId = '%{Acct-Session-Id}' \ + WHERE UserName = '%{SQL-User-Name}' \ + AND NASIPAddress = '%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}}' \ + AND NASPortId = '%{%{NAS-Port-ID}:-%{NAS-Port}}' \ + AND NASPortType = '%{NAS-Port-Type}' \ + AND AcctStopTime IS NULL" + } + + start { + query = "\ + INSERT INTO ${....acct_table1} \ + (${...column_list}) \ + VALUES \ + ('%{Acct-Session-Id}', \ + '%{Acct-Unique-Session-Id}', \ + '%{SQL-User-Name}', \ + '%{Realm}', \ + '%{NAS-IP-Address}', \ + '%{%{NAS-Port-ID}:-%{NAS-Port}}', \ + '%{NAS-Port-Type}', \ + ${....event_timestamp}, \ + ${....event_timestamp}, \ + NULL, \ + '0', \ + '%{Acct-Authentic}', \ + '%{Connect-Info}', \ + '', \ + '0', \ + '0', \ + '%{Called-Station-Id}', \ + '%{Calling-Station-Id}', \ + '', \ + '%{Service-Type}', \ + '%{Framed-Protocol}', \ + '%{Framed-IP-Address}', \ + '%{Framed-IPv6-Address}', \ + '%{Framed-IPv6-Prefix}', \ + '%{Framed-Interface-Id}', \ + '%{Delegated-IPv6-Prefix}' \ + ${....class.packet_xlat})" + + -query = "\ + UPDATE ${....acct_table1} \ + SET \ + AcctSessionId = '%{Acct-Session-Id}', \ + AcctUniqueId = '%{Acct-Unique-Session-Id}', \ + AcctAuthentic = '%{Acct-Authentic}', \ + ConnectInfo_start = '%{Connect-Info}', \ + ServiceType = '%{Service-Type}', \ + FramedProtocol = '%{Framed-Protocol}', \ + framedipaddress = '%{Framed-IP-Address}', \ + framedipv6address = '%{Framed-IPv6-Address}', \ + framedipv6prefix = '%{Framed-IPv6-Prefix}', \ + framedinterfaceid = '%{Framed-Interface-Id}', \ + delegatedipv6prefix = '%{Delegated-IPv6-Prefix}', \ + AcctStartTime = ${....event_timestamp}, \ + AcctUpdateTime = ${....event_timestamp} \ + WHERE UserName = '%{SQL-User-Name}' \ + AND NASIPAddress = '%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}}' \ + AND NASPortId = '%{%{NAS-Port-ID}:-%{NAS-Port}}' \ + AND NASPortType = '%{NAS-Port-Type}' \ + AND AcctStopTime IS NULL" + + query = "\ + UPDATE ${....acct_table1} SET \ + acctstarttime = ${....event_timestamp}, \ + acctupdatetime = ${....event_timestamp}, \ + connectinfo_start = '%{Connect-Info}' \ + WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" + } + + interim-update { + query = "\ + UPDATE ${....acct_table1} \ + SET \ + acctupdatetime = (@acctupdatetime_old:=acctupdatetime), \ + acctupdatetime = ${....event_timestamp}, \ + acctinterval = ${....event_timestamp_epoch} - \ + UNIX_TIMESTAMP(@acctupdatetime_old), \ + framedipaddress = '%{Framed-IP-Address}', \ + framedipv6address = '%{Framed-IPv6-Address}', \ + framedipv6prefix = '%{Framed-IPv6-Prefix}', \ + framedinterfaceid = '%{Framed-Interface-Id}', \ + delegatedipv6prefix = '%{Delegated-IPv6-Prefix}', \ + acctsessiontime = %{%{Acct-Session-Time}:-NULL}, \ + acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' \ + << 32 | '%{%{Acct-Input-Octets}:-0}', \ + acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' \ + << 32 | '%{%{Acct-Output-Octets}:-0}' \ + WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" + + query = "\ + INSERT INTO ${....acct_table1} \ + (${...column_list}) \ + VALUES \ + ('%{Acct-Session-Id}', \ + '%{Acct-Unique-Session-Id}', \ + '%{SQL-User-Name}', \ + '%{Realm}', \ + '%{NAS-IP-Address}', \ + '%{%{NAS-Port-ID}:-%{NAS-Port}}', \ + '%{NAS-Port-Type}', \ + FROM_UNIXTIME(${....event_timestamp_epoch} - %{%{Acct-Session-Time}:-0}), \ + ${....event_timestamp}, \ + NULL, \ + %{%{Acct-Session-Time}:-NULL}, \ + '%{Acct-Authentic}', \ + '%{Connect-Info}', \ + '', \ + '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', \ + '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', \ + '%{Called-Station-Id}', \ + '%{Calling-Station-Id}', \ + '', \ + '%{Service-Type}', \ + '%{Framed-Protocol}', \ + '%{Framed-IP-Address}', \ + '%{Framed-IPv6-Address}', \ + '%{Framed-IPv6-Prefix}', \ + '%{Framed-Interface-Id}', \ + '%{Delegated-IPv6-Prefix}' \ + ${....class.packet_xlat})" + + -query = "\ + UPDATE ${....acct_table1} \ + SET \ + AcctSessionId = '%{Acct-Session-Id}', \ + AcctUniqueId = '%{Acct-Unique-Session-Id}', \ + AcctAuthentic = '%{Acct-Authentic}', \ + ConnectInfo_start = '%{Connect-Info}', \ + ServiceType = '%{Service-Type}', \ + FramedProtocol = '%{Framed-Protocol}', \ + framedipaddress = '%{Framed-IP-Address}', \ + framedipv6address = '%{Framed-IPv6-Address}', \ + framedipv6prefix = '%{Framed-IPv6-Prefix}', \ + framedinterfaceid = '%{Framed-Interface-Id}', \ + delegatedipv6prefix = '%{Delegated-IPv6-Prefix}', \ + AcctUpdateTime = ${....event_timestamp}, \ + AcctSessionTime = %{%{Acct-Session-Time}:-NULL}, \ + AcctInputOctets = '%{%{Acct-Input-Gigawords}:-0}' \ + << 32 | '%{%{Acct-Input-Octets}:-0}', \ + AcctOutputOctets = '%{%{Acct-Output-Gigawords}:-0}' \ + << 32 | '%{%{Acct-Output-Octets}:-0}' \ + WHERE UserName = '%{SQL-User-Name}' \ + AND NASIPAddress = '%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}}' \ + AND NASPortId = '%{%{NAS-Port-ID}:-%{NAS-Port}}' \ + AND NASPortType = '%{NAS-Port-Type}' \ + AND AcctStopTime IS NULL" + } + + stop { + query = "\ + UPDATE ${....acct_table2} SET \ + acctstoptime = ${....event_timestamp}, \ + acctsessiontime = %{%{Acct-Session-Time}:-NULL}, \ + acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' \ + << 32 | '%{%{Acct-Input-Octets}:-0}', \ + acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' \ + << 32 | '%{%{Acct-Output-Octets}:-0}', \ + acctterminatecause = '%{Acct-Terminate-Cause}', \ + connectinfo_stop = '%{Connect-Info}' \ + WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" + + query = "\ + INSERT INTO ${....acct_table2} \ + (${...column_list}) \ + VALUES \ + ('%{Acct-Session-Id}', \ + '%{Acct-Unique-Session-Id}', \ + '%{SQL-User-Name}', \ + '%{Realm}', \ + '%{NAS-IP-Address}', \ + '%{%{NAS-Port-ID}:-%{NAS-Port}}', \ + '%{NAS-Port-Type}', \ + FROM_UNIXTIME(${....event_timestamp_epoch} - %{%{Acct-Session-Time}:-0}), \ + ${....event_timestamp}, \ + ${....event_timestamp}, \ + %{%{Acct-Session-Time}:-NULL}, \ + '%{Acct-Authentic}', \ + '', \ + '%{Connect-Info}', \ + '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', \ + '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', \ + '%{Called-Station-Id}', \ + '%{Calling-Station-Id}', \ + '%{Acct-Terminate-Cause}', \ + '%{Service-Type}', \ + '%{Framed-Protocol}', \ + '%{Framed-IP-Address}', \ + '%{Framed-IPv6-Address}', \ + '%{Framed-IPv6-Prefix}', \ + '%{Framed-Interface-Id}', \ + '%{Delegated-IPv6-Prefix}' \ + ${....class.packet_xlat})" + + -query = "\ + UPDATE ${....acct_table1} \ + SET \ + AcctSessionId = '%{Acct-Session-Id}', \ + AcctUniqueId = '%{Acct-Unique-Session-Id}', \ + AcctAuthentic = '%{Acct-Authentic}', \ + ConnectInfo_start = '%{Connect-Info}', \ + ServiceType = '%{Service-Type}', \ + FramedProtocol = '%{Framed-Protocol}', \ + framedipaddress = '%{Framed-IP-Address}', \ + framedipv6address = '%{Framed-IPv6-Address}', \ + framedipv6prefix = '%{Framed-IPv6-Prefix}', \ + framedinterfaceid = '%{Framed-Interface-Id}', \ + delegatedipv6prefix = '%{Delegated-IPv6-Prefix}', \ + AcctStopTime = ${....event_timestamp}, \ + AcctUpdateTime = ${....event_timestamp}, \ + AcctSessionTime = %{Acct-Session-Time}, \ + AcctInputOctets = '%{%{Acct-Input-Gigawords}:-0}' \ + << 32 | '%{%{Acct-Input-Octets}:-0}', \ + AcctOutputOctets = '%{%{Acct-Output-Gigawords}:-0}' \ + << 32 | '%{%{Acct-Output-Octets}:-0}', \ + AcctTerminateCause = '%{Acct-Terminate-Cause}', \ + ConnectInfo_stop = '%{Connect-Info}' \ + WHERE UserName = '%{SQL-User-Name}' \ + AND NASIPAddress = '%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}}' \ + AND NASPortId = '%{%{NAS-Port-ID}:-%{NAS-Port}}' \ + AND NASPortType = '%{NAS-Port-Type}' \ + AND AcctStopTime IS NULL" + } + + accounting { + query = "SELECT true" + } + } +} + +post-auth { + query = "\ + INSERT INTO ${..postauth_table} \ + (username, pass, reply, authdate ${..class.column_name}) \ + VALUES ( \ + '%{SQL-User-Name}', \ + '%{%{User-Password}:-%{Chap-Password}}', \ + '%{reply:Packet-Type}', \ + '%S.%M' \ + ${..class.reply_xlat})" +} diff --git a/ansible/roles/freeradius/files/schema.sql b/ansible/roles/freeradius/files/schema.sql new file mode 100644 index 0000000..350e024 --- /dev/null +++ b/ansible/roles/freeradius/files/schema.sql @@ -0,0 +1,130 @@ +-- FreeRADIUS v3 MySQL schema +-- Managed by Ansible + +CREATE TABLE IF NOT EXISTS radacct ( + radacctid bigint(21) NOT NULL auto_increment, + acctsessionid varchar(64) NOT NULL default '', + acctuniqueid varchar(32) NOT NULL default '', + username varchar(64) NOT NULL default '', + realm varchar(64) default '', + nasipaddress varchar(15) NOT NULL default '', + nasportid varchar(32) default NULL, + nasporttype varchar(32) default NULL, + acctstarttime datetime NULL default NULL, + acctupdatetime datetime NULL default NULL, + acctstoptime datetime NULL default NULL, + acctinterval int(12) default NULL, + acctsessiontime int(12) unsigned default NULL, + acctauthentic varchar(32) default NULL, + connectinfo_start varchar(128) default NULL, + connectinfo_stop varchar(128) default NULL, + acctinputoctets bigint(20) default NULL, + acctoutputoctets bigint(20) default NULL, + calledstationid varchar(50) NOT NULL default '', + callingstationid varchar(50) NOT NULL default '', + acctterminatecause varchar(32) NOT NULL default '', + servicetype varchar(32) default NULL, + framedprotocol varchar(32) default NULL, + framedipaddress varchar(15) NOT NULL default '', + framedipv6address varchar(45) NOT NULL default '', + framedipv6prefix varchar(45) NOT NULL default '', + framedinterfaceid varchar(44) NOT NULL default '', + delegatedipv6prefix varchar(45) NOT NULL default '', + class varchar(64) default NULL, + PRIMARY KEY (radacctid), + UNIQUE KEY acctuniqueid (acctuniqueid), + KEY username (username), + KEY framedipaddress (framedipaddress), + KEY framedipv6address (framedipv6address), + KEY framedipv6prefix (framedipv6prefix), + KEY framedinterfaceid (framedinterfaceid), + KEY delegatedipv6prefix (delegatedipv6prefix), + KEY acctsessionid (acctsessionid), + KEY acctsessiontime (acctsessiontime), + KEY acctstarttime (acctstarttime), + KEY acctinterval (acctinterval), + KEY acctstoptime (acctstoptime), + KEY nasipaddress (nasipaddress), + KEY class (class) +) ENGINE = INNODB; + +CREATE TABLE IF NOT EXISTS radcheck ( + id int(11) unsigned NOT NULL auto_increment, + username varchar(64) NOT NULL default '', + attribute varchar(64) NOT NULL default '', + op char(2) NOT NULL DEFAULT '==', + value varchar(253) NOT NULL default '', + PRIMARY KEY (id), + KEY username (username(32)) +); + +CREATE TABLE IF NOT EXISTS radgroupcheck ( + id int(11) unsigned NOT NULL auto_increment, + groupname varchar(64) NOT NULL default '', + attribute varchar(64) NOT NULL default '', + op char(2) NOT NULL DEFAULT '==', + value varchar(253) NOT NULL default '', + PRIMARY KEY (id), + KEY groupname (groupname(32)) +); + +CREATE TABLE IF NOT EXISTS radgroupreply ( + id int(11) unsigned NOT NULL auto_increment, + groupname varchar(64) NOT NULL default '', + attribute varchar(64) NOT NULL default '', + op char(2) NOT NULL DEFAULT '=', + value varchar(253) NOT NULL default '', + PRIMARY KEY (id), + KEY groupname (groupname(32)) +); + +CREATE TABLE IF NOT EXISTS radreply ( + id int(11) unsigned NOT NULL auto_increment, + username varchar(64) NOT NULL default '', + attribute varchar(64) NOT NULL default '', + op char(2) NOT NULL DEFAULT '=', + value varchar(253) NOT NULL default '', + PRIMARY KEY (id), + KEY username (username(32)) +); + +CREATE TABLE IF NOT EXISTS radusergroup ( + id int(11) unsigned NOT NULL auto_increment, + username varchar(64) NOT NULL default '', + groupname varchar(64) NOT NULL default '', + priority int(11) NOT NULL default '1', + PRIMARY KEY (id), + KEY username (username(32)) +); + +CREATE TABLE IF NOT EXISTS radpostauth ( + id int(11) NOT NULL auto_increment, + username varchar(64) NOT NULL default '', + pass varchar(64) NOT NULL default '', + reply varchar(32) NOT NULL default '', + authdate timestamp(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6), + class varchar(64) default NULL, + PRIMARY KEY (id), + KEY username (username), + KEY class (class) +) ENGINE = INNODB; + +CREATE TABLE IF NOT EXISTS nas ( + id int(10) NOT NULL auto_increment, + nasname varchar(128) NOT NULL, + shortname varchar(32), + type varchar(30) DEFAULT 'other', + ports int(5), + secret varchar(60) DEFAULT 'secret' NOT NULL, + server varchar(64), + community varchar(50), + description varchar(200) DEFAULT 'RADIUS Client', + PRIMARY KEY (id), + KEY nasname (nasname) +) ENGINE = INNODB; + +CREATE TABLE IF NOT EXISTS nasreload ( + nasipaddress varchar(15) NOT NULL, + reloadtime datetime NOT NULL, + PRIMARY KEY (nasipaddress) +) ENGINE = INNODB; diff --git a/ansible/roles/freeradius/files/seed-data.sql b/ansible/roles/freeradius/files/seed-data.sql new file mode 100644 index 0000000..02e8cf4 --- /dev/null +++ b/ansible/roles/freeradius/files/seed-data.sql @@ -0,0 +1,521 @@ + +/*M!999999\- enable the sandbox mode */ +-- MariaDB dump 10.19 Distrib 10.11.18-MariaDB, for Linux (x86_64) +-- +-- Host: localhost Database: radius +-- ------------------------------------------------------ +-- Server version 10.11.18-MariaDB-log + +/*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */; +/*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */; +/*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */; +/*!40101 SET NAMES utf8mb4 */; +/*!40103 SET @OLD_TIME_ZONE=@@TIME_ZONE */; +/*!40103 SET TIME_ZONE='+00:00' */; +/*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */; +/*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */; +/*!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 */; + +-- +-- Dumping data for table `radcheck` +-- + +LOCK TABLES `radcheck` WRITE; +/*!40000 ALTER TABLE `radcheck` DISABLE KEYS */; +INSERT INTO `radcheck` (`id`, `username`, `attribute`, `op`, `value`) VALUES (29581,'joseortiz','Cleartext-Password',':=','J2WEYT7782UJ'), +(29578,'perlachavez2','Cleartext-Password',':=','U4BBTBMCJZST'), +(29575,'thomashernandez','Cleartext-Password',':=','X6BZLA7SC3XM'), +(29572,'williamarmstead','Cleartext-Password',':=','SAQ4XEKXDC58'), +(29570,'julierose','Cleartext-Password',':=','MLM8R2WAGY52'), +(29571,'derrickmccausland','Cleartext-Password',':=','ETNLKZHACGF7'), +(29567,'sherrifredrick','Cleartext-Password',':=','7P52BVMTSNN6'), +(29565,'shelbyburris','Cleartext-Password',':=','3YAL9DWFZUPT'), +(29564,'priscillacrenshaw','Cleartext-Password',':=','AXBDLXSGXMLR'), +(29561,'korybiggs','Cleartext-Password',':=','4FJC7DXAW5RV'), +(29563,'kristinjimenez','Cleartext-Password',':=','9FAYXMRDU69T'), +(29558,'jessicaweddle','Cleartext-Password',':=','VV96G36AEEDA'), +(29557,'yolandamedrano','Cleartext-Password',':=','R948UL4KZRA4'), +(29555,'williambowland','Cleartext-Password',':=','K7HYNWGE25XX'), +(29554,'marcuspatton','Cleartext-Password',':=','GEUXX27VLZXK'), +(29553,'shacaciabillings','Cleartext-Password',':=','8AZLJCDFYFYV'), +(29552,'guadalupelugo','Cleartext-Password',':=','DQG8XCMFMVH5'), +(29551,'brandonhardesty','Cleartext-Password',':=','KMRHVPEXBEZ8'), +(29550,'nancyavellaneda','Cleartext-Password',':=','CXATYV7NGZN2'), +(29549,'matthewgoodwin','Cleartext-Password',':=','VSPM7N9UNU6Y'), +(29545,'donmckinney','Cleartext-Password',':=','C6AQ6UVD6R7R'), +(29544,'natashaelmore','Cleartext-Password',':=','8G5QJ8R7MK8Q'), +(29543,'shamsbashir','Cleartext-Password',':=','WLBGY4JMN4VA'), +(29541,'douglasglover','Cleartext-Password',':=','9Y6H9X3HCG3D'), +(29538,'carolstrickland','Cleartext-Password',':=','547P6AQ8RCD4'), +(29537,'carmenlopez','Cleartext-Password',':=','TPLND3H2FWTQ'), +(29534,'johnlooper','Cleartext-Password',':=','ZPL8LRY2TGRH'), +(29535,'davidroesch','Cleartext-Password',':=','ZHB2BS968DTU'), +(29531,'daycor','Cleartext-Password',':=','U45YBPSARH7N'), +(29530,'derekrodriguez','Cleartext-Password',':=','AP7Z594DMR7E'), +(29522,'joshuasoliz','Cleartext-Password',':=','PE7MHRZWUEQM'), +(29521,'tiffanyyarley-olenak','Cleartext-Password',':=','98HTZ9Q8FARG'), +(29514,'ericbarrett','Cleartext-Password',':=','5S2CV9FEFMKG'), +(29513,'marysmelser','Cleartext-Password',':=','ZS74NS5BBPX3'), +(29506,'nicolemaenn','Cleartext-Password',':=','B7KS27WL5WSN'), +(29503,'yolandajudge','Cleartext-Password',':=','6V8RLNK75LM8'), +(29501,'craighovde','Cleartext-Password',':=','AVZXWBX8GQTC'), +(29498,'joselucas','Cleartext-Password',':=','ZHMW9TE8QHRX'), +(29488,'douggarber','Cleartext-Password',':=','WXP9J5SRJWEJ'), +(29482,'carmencleghorn','Cleartext-Password',':=','VH3CBTJZAJ2Y'), +(29472,'rubenreyez','Cleartext-Password',':=','66384Y7B4WR4'), +(29464,'tiffanystewart','Cleartext-Password',':=','3EGVCS6RMF3Z'), +(29449,'dejadodson','Cleartext-Password',':=','FLR4DJHPX6TG'), +(29447,'coreyball','Cleartext-Password',':=','3JAUWZNAR9MB'), +(29442,'toniyoung','Cleartext-Password',':=','RJ24VTRM7JA9'), +(29434,'melanieweddle','Cleartext-Password',':=','XQ5L7PUM9RP6'), +(29431,'zackknuckey','Cleartext-Password',':=','VP5CCX8LTE47'), +(29425,'christinehamparyan','Cleartext-Password',':=','WEYX9R5P7J5L'), +(29422,'joespeciale','Cleartext-Password',':=','UH6ZCM9WLGRQ'), +(29420,'rogerbatt','Cleartext-Password',':=','KGDJZ7V66QQK'), +(29419,'kalebjames','Cleartext-Password',':=','KMQDGPD5XB6Z'), +(29416,'stevemolina','Cleartext-Password',':=','BLLHWPY9RCTC'), +(29414,'mariatrejo','Cleartext-Password',':=','EYPWCQKKWYZH'), +(29410,'kenhall','Cleartext-Password',':=','LX897BGJNMK5'), +(29407,'deewilliams','Cleartext-Password',':=','R8AGX3E8WAHN'), +(29406,'johnvayo','Cleartext-Password',':=','DJJNUEEHGAW5'), +(29398,'anthonythompson','Cleartext-Password',':=','WB4E4MPJVHTB'), +(29608,'stevecombest','ClearText-Password',':=','STVN23552Wt'), +(29606,'mariacastanon','ClearText-Password',':=','iu297gkid9'), +(29395,'vanessagomez1','Cleartext-Password',':=','J5JEW3HEBVAF'), +(29607,'luisvelira','ClearText-Password',':=','uygo875491!'), +(29609,'keithtucker','ClearText-Password',':=','14FYJSNUU48'), +(29610,'angelatrevino','ClearText-Password',':=','KJGU39565'), +(29611,'brittannieredden1','ClearText-Password',':=','TYFTUEZ7429'), +(29612,'amymontelongo','ClearText-Password',':=','ig76f7fuvu'), +(29613,'michaelasmith','ClearText-Password',':=','MS21353GHY'), +(29614,'samanthatheis','ClearText-Password',':=','kf6u8djigk'), +(29615,'janisstewart','ClearText-Password',':=','JD834HCUW1C'), +(29616,'irenegaribay','ClearText-Password',':=','uky75dkc'), +(29383,'leonardocoronel','Cleartext-Password',':=','TXPC494'), +(29374,'alejandrolimon','Cleartext-Password',':=','MM4BSQS7FRTD'), +(29368,'crystalharney','Cleartext-Password',':=','A7W26H834WLJ'), +(29647,'radiantlifeministries','Cleartext-Password',':=','12FDIUNF5L7vM'), +(29648,'krisdougherty','Cleartext-Password',':=','rweh75uj38'), +(29355,'olgagutierrez','Cleartext-Password',':=','WERWRMUDBZ85'), +(29353,'greghummel','Cleartext-Password',':=','JV84HSVAK6XR'), +(29349,'bettymitchell','Cleartext-Password',':=','8CHHCNBWQLRV'), +(29341,'wandadavis','Cleartext-Password',':=','JXQXXZ9MKFX6'), +(29338,'scottanderson','Cleartext-Password',':=','RJ49A43SG3RA'), +(29335,'jenniferboon','Cleartext-Password',':=','28ESU8ELVELP'), +(29331,'marialopez','Cleartext-Password',':=','P3FNSPT7MEYM'), +(29329,'cynthiasandlin','Cleartext-Password',':=','MCDTLMVFQXAV'), +(29328,'bethanybell','Cleartext-Password',':=','3UUC5X27PETS'), +(29323,'garrettojeda','Cleartext-Password',':=','U5PRQYZE2MM3'), +(29325,'rayschaak','Cleartext-Password',':=','XSNLP62EK6VZ'), +(29327,'carlaswearingen','Cleartext-Password',':=','E6DQ4B2T9JZD'), +(29320,'lesliebewley','Cleartext-Password',':=','55KFSJMEDYLK'), +(29317,'delainawaite','Cleartext-Password',':=','EM7TWHUS4SYU'), +(29307,'esparanzagarza','Cleartext-Password',':=','VLL9ZNPRSTG5'), +(29653,'midvalleyconcrete','Cleartext-Password',':=','BD58JYT2PJ6A'), +(29273,'glendabeauchamp','Cleartext-Password',':=','RKA3J8WSPYJP'), +(29256,'glindarichter','Cleartext-Password',':=','VXMLMDAFLNJ3'), +(29251,'nhumorrison','Cleartext-Password',':=','EC32VDFKB9CB'), +(29245,'brittanyworley','Cleartext-Password',':=','NBKYERRBSBH4'), +(29661,'janiscable','Cleartext-Password',':=','JHC7U554JBTR'), +(29243,'dustynfisher','Cleartext-Password',':=','XASFU3DBPZ5M'), +(29237,'stephenbeegle','Cleartext-Password',':=','RU5GZVTVACRC'), +(29229,'roseanndellavalle','Cleartext-Password',':=','5GAF6JHUWWYP'), +(29231,'duanewright','Cleartext-Password',':=','VXK4FBLVFE7F'), +(29222,'pablohernandez','Cleartext-Password',':=','P3YB6A4JGEDF'), +(29217,'pavelavanesov','Cleartext-Password',':=','KP8ZSGC2DG2U'), +(29216,'wanxiaxong','Cleartext-Password',':=','BER4NEK9M7NA'), +(29215,'bryangoulart','Cleartext-Password',':=','DTNQFE4CXSFX'), +(29204,'sandrahoughton','Cleartext-Password',':=','5XR4QMPBXVWY'), +(29203,'adamstaeben','Cleartext-Password',':=','GP7RANJ8UCYP'), +(29190,'russmott','Cleartext-Password',':=','J8ZN888UQSLR'), +(29189,'karenstewart','Cleartext-Password',':=','JSKTFAJ2JYDX'), +(29185,'heatherwomack','Cleartext-Password',':=','89W7S5Q7UAHP'), +(29183,'wyndijames','Cleartext-Password',':=','CPSDNRQU95HJ'), +(29182,'angelicacuayahuitl','Cleartext-Password',':=','VK8PZW3LK5F3'), +(29181,'chasewilliams','Cleartext-Password',':=','W6AMPQEPY3BC'), +(29176,'kevinarana','Cleartext-Password',':=','JAJYSEG75UZS'), +(29166,'chrisclayton','Cleartext-Password',':=','BFJ462PLHJFV'), +(29162,'billyhorton','Cleartext-Password',':=','MPTX573ZUYYG'), +(29151,'chisediquezada','Cleartext-Password',':=','RJBYQ2NUB829'), +(29649,'donwilhelmus','Cleartext-Password',':=','2V4NEL87RM39'), +(29147,'angelmerlo','Cleartext-Password',':=','EWWAPXN9Z2YS'), +(29656,'kavalleriefarm','Cleartext-Password',':=','8DFNNTPBPZGY'), +(29113,'kerryblack','Cleartext-Password',':=','9D5S9ZD2FCBV'), +(29110,'cliffordjennings','Cleartext-Password',':=','5GC7M65H9VGT'), +(29098,'carlakimberling','Cleartext-Password',':=','SS4KRJYKTV7B'), +(29088,'richardconklin','Cleartext-Password',':=','WEUNG5H3K8BB'), +(29089,'leandrabeshea','Cleartext-Password',':=','7V8BZU4G83VF'), +(29640,'kellygarza','Cleartext-Password',':=','4696591662'), +(29660,'1stchoiceliving','Cleartext-Password',':=','YVWJWRPEVYNH'), +(29067,'robertfinch','Cleartext-Password',':=','D7FMTT455GBB'), +(29058,'ericcoffman','Cleartext-Password',':=','MMEBXQYLZWNU'), +(29050,'nathanaelfinch','Cleartext-Password',':=','JVNC68FV7N6B'), +(29047,'gabrielasereno','Cleartext-Password',':=','KCH82WCRA2YR'), +(29045,'georginacovarrubias','Cleartext-Password',':=','8QT57NUV8C7R'), +(29035,'thomascline','Cleartext-Password',':=','E523BKVU5MJP'), +(29034,'susanlewis','Cleartext-Password',':=','R7TZFZEGLNRW'), +(29025,'tammywelborn','Cleartext-Password',':=','RMC482WNBS7'), +(29023,'haleymuela','Cleartext-Password',':=','BS7X3DTKW8TH'), +(29018,'christelles','Cleartext-Password',':=','WL2TKLFG8G2H'), +(29017,'mauricioantonio','Cleartext-Password',':=','6QJW7RAPDBWB'), +(29013,'vincentlimon','Cleartext-Password',':=','YDDXKFABUZY7'), +(29655,'tech','Cleartext-Password',':=','brussels-crucial-smashing'), +(29634,'jeffreyharder','ClearText-Password',':=','YUV565D67RT'), +(29635,'pablomartinez','ClearText-Password',':=','2766581BER'), +(29636,'krystalmendez','ClearText-Password',':=','6FTCKU6S56'), +(29637,'davidvandagriff','Cleartext-Password',':=','UTRC53865F9'), +(29638,'carolynwalker','Cleartext-Password',':=','trjxtyx75!'), +(28979,'claygilbert','Cleartext-Password',':=','3E6XFDHXCAG7'), +(28978,'jmichaelculverhouse','Cleartext-Password',':=','2147099521'), +(28971,'diegosereno','Cleartext-Password',':=','2CE9F5YSPQHX'), +(28970,'ashleysmith','Cleartext-Password',':=','F8D3FVCZB7PD'), +(28954,'dougstowe','Cleartext-Password',':=','5D35LFD6GEAZ'), +(28936,'timbronschidle','ClearText-Password',':=','3ZVLCWSAE3EW1'), +(28935,'chrislewis1','Cleartext-Password',':=','V9DS4E4Y7UTT'), +(28928,'cynthiajones','Cleartext-Password',':=','KC7ESYHEZGNR'), +(28917,'crankkeith','Cleartext-Password',':=','kcrank10615'), +(29646,'kimberlyrichards','Cleartext-Password',':=','7PQA6J8RPZ9Z'), +(28867,'bobbymack','Cleartext-Password',':=','UDUBTCXXF8VV'), +(28848,'americatrejo','Cleartext-Password',':=','3B63TLTT9WE4'), +(28832,'tjbanschbach','Cleartext-Password',':=','8WTWTXACGG5N'), +(28811,'luiscabrera','Cleartext-Password',':=','RWUQ94XT9A9Z'), +(28810,'rosahernandez','Cleartext-Password',':=','JSGUXKWEMSVN'), +(28807,'carlosgomez','Cleartext-Password',':=','J22RS7F3LGG2'), +(28800,'kennethcampbell','Cleartext-Password',':=','!9727342446!'), +(28763,'jeridrutledge','Cleartext-Password',':=','GJ3CZTRJJW2M'), +(28748,'timthomas','Cleartext-Password',':=','NY223RQJD7PN'), +(28715,'carolbates','Cleartext-Password',':=','J3UBUCMYDX64'), +(28710,'shirleyelmore','Cleartext-Password',':=','D8Y64N9L4R9W'), +(28703,'grahammcintire2','Cleartext-Password',':=','U5Y3hA3g*14L'), +(28702,'chrissyeagle2','Cleartext-Password',':=','NJPCGPBNFB'), +(28698,'swedlund','Cleartext-Password',':=','swedlund494'), +(28695,'wendysanders','Cleartext-Password',':=','RYG9L43NWDZV'), +(28693,'robbymccollom','Cleartext-Password',':=','RMC482WNBS7'), +(28671,'melodymccarty','Cleartext-Password',':=','U3WLEGEB'), +(28664,'heatherbrister2','Cleartext-Password',':=','KK37V8W9ZD9Z'), +(28663,'ryanlloyd','Cleartext-Password',':=','HWEMKNWX55RF'), +(28661,'amyrodriguez','Cleartext-Password',':=','WX3QRT2U6L4X'), +(28660,'thecountrycutter','Cleartext-Password',':=','YXpScFIneePm'), +(28659,'bradwilson','Cleartext-Password',':=','ZFAXA9AK63AH'), +(28654,'edrater','Cleartext-Password',':=','FRY4823N'), +(28642,'barbihardin','Cleartext-Password',':=','ZENETJ75TEVQ'), +(28637,'vikyacosta','Cleartext-Password',':=','Z4SMV49SAH72'), +(28633,'terrimack','Cleartext-Password',':=','B9HNTSN7ASQ4'), +(28628,'jackworthy','Cleartext-Password',':=','2VUR7AAFWZZQ'), +(28617,'luisarellano','Cleartext-Password',':=','GVNWBQMM3S7U'), +(28609,'dorisavalos','Cleartext-Password',':=','DLKMJS88AF2W'), +(29654,'ryanrodriguez','Cleartext-Password',':=','9DFYWJ47YWUP'), +(28597,'jackierollier','Cleartext-Password',':=','TSFNN8DVDSPR'), +(28588,'charlesmccreary','Cleartext-Password',':=','88J6XS6TXRMA'), +(28548,'jamessmith','Cleartext-Password',':=','LRVU6RVG5SP8'), +(28546,'davidwhitefoot','Cleartext-Password',':=','PYHTZMHJU8R8-'), +(28542,'michaelray2','Cleartext-Password',':=','jjPgDcotL6rtY'), +(28536,'patriciavasquez','Cleartext-Password',':=','P88256487V'), +(28535,'adrianmcdaniel','Cleartext-Password',':=','U4TGDH2PSAB4'), +(28526,'justinvoga','Cleartext-Password',':=','URHVCX7SFSFU'), +(28518,'jenniferlittle','Cleartext-Password',':=','8EAUUDQPXSQX'), +(28510,'bradslate','Cleartext-Password',':=','AF4KVQ2P44M7'), +(28494,'irisdelira','Cleartext-Password',':=','L6XGQA583DG6'), +(28491,'richardbarragan','Cleartext-Password',':=','WJBS86MMJBFH'), +(28476,'jensenhall','Cleartext-Password',':=','F8XM9U8SC6LL'), +(28466,'paulcomella','Cleartext-Password',':=','YTZDMBZCMPX4'), +(29639,'saidaacosta','Cleartext-Password',':=','V29897X4'), +(28458,'kennethcampbell2','Cleartext-Password',':=','V5TKW8L6RXFF'), +(28449,'amberkrings','Cleartext-Password',':=','5NWBR3JLV6N8'), +(28438,'mauriciosoto','Cleartext-Password',':=','DJ7YP7W7AA8M'), +(28435,'jimcrank','Cleartext-Password',':=','PLA7XNX2F4Y3'), +(28425,'summerbeazley','Cleartext-Password',':=','D4S4YRB8Y3KA'), +(28426,'davidarmstrong','Cleartext-Password',':=','MPEZGG53KQSZ'), +(29651,'jackiehendricks','Cleartext-Password',':=','UQR5HGFCJ4XX'), +(28395,'stevenspurgers','Cleartext-Password',':=','YS5Q785J2HGZ'), +(28388,'connercoleman','Cleartext-Password',':=','6108RANDOMREDDOG'), +(28367,'judithfierro','Cleartext-Password',':=','FUZ33LB6SFFC'), +(28359,'tonyasipes','Cleartext-Password',':=','N5VEZR8Q5M86'), +(28358,'stephenday','Cleartext-Password',':=','MSVGQ8X38YLN'), +(28347,'kathysmith','Cleartext-Password',':=','SJ53PSYCZLPR'), +(28344,'cherieeshelman','Cleartext-Password',':=','BRUV99PN6Y7L'), +(29644,'buddyswan','Cleartext-Password',':=','N7XUYUD7J9SD'), +(28296,'cinthiapereira1','Cleartext-Password',':=','9WSGXM9LBXGZ'), +(28289,'ronberger','Cleartext-Password',':=','Ronb499H7ALW'), +(28267,'sandracrouch','Cleartext-Password',':=','V4N3764R5J'), +(28263,'abbieandrews','Cleartext-Password',':=','YQSJ499H7ALW'), +(28253,'perlachavez','Cleartext-Password',':=','ZWR9PXVFFYBS'), +(28246,'susanking','Cleartext-Password',':=','N2KUYLPDNXJP'), +(28241,'terrybachran','Cleartext-Password',':=','NG9VMH25LCTC'), +(28240,'lanaygaunce','Cleartext-Password',':=','MJCNZAJHK9H3'), +(28190,'heatherbrister','Cleartext-Password',':=','6XPLC545G6HW'), +(28184,'jenniferdunaway','Cleartext-Password',':=','343V5CT2R7HZ'), +(28159,'elviraquezada','Cleartext-Password',':=','HXAS29VRX33V'), +(28154,'jordainpatton','Cleartext-Password',':=','J8P4TPF7QS2A'), +(28140,'mattkosarek','Cleartext-Password',':=','RJ4BQUZJY'), +(28117,'shannonclark','Cleartext-Password',':=','F5XESMCJ'), +(28107,'jacquelinewilder','Cleartext-Password',':=','HEY36LUGYCUQ'), +(28098,'kevincostanzo','Cleartext-Password',':=','244VGMVMH66D'), +(28093,'kenpatrick','Cleartext-Password',':=','V7U3XBAPTSV3'), +(28083,'briangallimore','Cleartext-Password',':=','39V285NX'), +(28072,'amberprater','Cleartext-Password',':=','RP42B7AYDLAP'), +(28068,'marilynfowler','Cleartext-Password',':=','MarilynVG72P8H'), +(28065,'douglaswilson','Cleartext-Password',':=','HP97HG9XPYC3'), +(28034,'terrygortney','Cleartext-Password',':=','GQUGR3VJUXBR'), +(28031,'gizellebutler','Cleartext-Password',':=','HMZTX66RTPVX'), +(28029,'bradgurney','Cleartext-Password',':=','7A6LRZWT82DX'), +(28024,'darrylchavis','Cleartext-Password',':=','TDGUUNXGMYRC'), +(28025,'kathymazzola','Cleartext-Password',':=','5MVS8VUF9QL2'), +(27994,'austinwatkins','Cleartext-Password',':=','S7M4UD8QUTDP'), +(27988,'oscarrodriguez','Cleartext-Password',':=','TGPCF3Y2ABXS'), +(27986,'erinthompson','Cleartext-Password',':=','69TQZ797'), +(27983,'brianhardesty','Cleartext-Password',':=','8D4P34N8'), +(27976,'cathyday','Cleartext-Password',':=','FAXMKENV8FCT'), +(27956,'fredheckel','Cleartext-Password',':=','HUVZSE8RGD65'), +(27949,'charlesboone','Cleartext-Password',':=','Ccbn78wdfksB'), +(27948,'rachelguzzardi','Cleartext-Password',':=','R87wgerf8bsG'), +(27939,'reynamoore','Cleartext-Password',':=','R92nbskba7iM'), +(27936,'juanalonzo','Cleartext-Password',':=','745GF0JK5!W'), +(27930,'kristinamurphy','Cleartext-Password',':=','oPXFrylqKf'), +(27926,'johnnygoble','Cleartext-Password',':=','J829fhf7G'), +(27923,'keithbarber','Cleartext-Password',':=','K73bvd54tB'), +(27917,'doreengrubb','Cleartext-Password',':=','DOR32SVT1234'), +(27916,'steveraia','Cleartext-Password',':=','DRR648DFTMSE4'), +(27912,'blancadiaz','Cleartext-Password',':=','B548gdu55D'), +(27896,'twcowley','Cleartext-Password',':=','TW486TW'), +(27888,'joepatton','Cleartext-Password',':=','L7luYzSKSu'), +(27873,'timfisher','Cleartext-Password',':=','Thd73gdf5eF'), +(27847,'kileigheven','Cleartext-Password',':=','K9872gdf8E'), +(27838,'consueloluna1830','Cleartext-Password',':=','C8736gfd0'), +(27833,'deannecook','Cleartext-Password',':=','Dc872cobnC'), +(27830,'kacyharrison','Cleartext-Password',':=','7Ozr7el6K1'), +(27822,'milliganwater','Cleartext-Password',':=','8NjGMNsTXd'), +(27813,'michaelnewby','Cleartext-Password',':=','TM5M3HU877'), +(27808,'ladonnaclark','Cleartext-Password',':=','YQReVH9men'), +(27800,'jamesmooney','Cleartext-Password',':=','QNUqD2tSzq'), +(29657,'branchrvpark','Cleartext-Password',':=','XfKxVZIKmm'), +(27783,'tamythomas','Cleartext-Password',':=','TT4699520858tt'), +(27781,'pambanschbach','Cleartext-Password',':=','Q2p68#*9vwF2'), +(27780,'josephcruz','Cleartext-Password',':=','Z06oxJXrNd'), +(27761,'franceskirby','Cleartext-Password',':=','FK8179391152fk'), +(27759,'chadwhitsell','Cleartext-Password',':=','79374B75phGy'), +(29641,'gordonhamilton','Cleartext-Password',':=','c3495Rpuq5Sh'), +(27754,'ruthfengler','Cleartext-Password',':=','8q8MX6NQP3b6'), +(27751,'bobbyfisher','Cleartext-Password',':=','salvagejuggle'), +(27748,'eddieyarbrough','Cleartext-Password',':=','89298ChZWzMy'), +(27744,'chrissyeagle','Cleartext-Password',':=','9vkX97426Sgt'), +(27739,'victoriaobier','Cleartext-Password',':=','M57B288P9'), +(27736,'bernardheer','Cleartext-Password',':=','BH33682019BER'), +(27734,'garycable','Cleartext-Password',':=','M2w6z5Y73'), +(27735,'coyungemach','Cleartext-Password',':=','MhS569N84e7a'), +(27733,'michaelmccauley','Cleartext-Password',':=','CPORADIO98'), +(27731,'lessruble','Cleartext-Password',':=','9U35SXxM2H8y'), +(27730,'marknunnelee','Cleartext-Password',':=','833j2Ymm4yfV'), +(27729,'elizabethchristian','Cleartext-Password',':=','Webg22nj'), +(27724,'mikebell','Cleartext-Password',':=','BHF538HSEBDLY4'), +(27713,'krystabates','Cleartext-Password',':=','KB2145445824kb'), +(29658,'sensibleheatsystems','Cleartext-Password',':=','SHQWERY23'), +(27708,'chrisfrancis','Cleartext-Password',':=','DR45QC74M'), +(29659,'lambandlion','Cleartext-Password',':=','LL9727363567ll'), +(27701,'markfisher','Cleartext-Password',':=','32fd8P&rw8s7'), +(27696,'kirkvanmeter','Cleartext-Password',':=','J2sR9g^83M33'), +(27694,'dananance','Cleartext-Password',':=','23SP$e!ug232'), +(27690,'keithcrank','Cleartext-Password',':=','2zt3T5w72T3A'), +(27687,'scottarmstrong','Cleartext-Password',':=','2SV58M55'), +(27683,'floydday','Cleartext-Password',':=','Tfdd3254tfD'), +(27680,'mariacortes','Cleartext-Password',':=','MC2145858276mc'), +(27668,'christianlummus','ClearText-Password',':=','K6dbr631ddL'), +(27666,'marklindsey','Cleartext-Password',':=','ML9727346434ml'), +(27658,'joeywhitfield','Cleartext-Password',':=','BV758qXne446'), +(27654,'taekim','Cleartext-Password',':=','SAN11837TCK'), +(27652,'teresarobinson','Cleartext-Password',':=','T645trdf87fR'), +(27651,'nathanmctee','Cleartext-Password',':=','N32462uu8rM'), +(27646,'rebekahmoore','Cleartext-Password',':=','R756346tfg4M'), +(27643,'monicatrevino','Cleartext-Password',':=','MT2145877143mt'), +(27640,'rachelfuller','Cleartext-Password',':=','R8364hbst'), +(27639,'choonpang','Cleartext-Password',':=','CP2143855677cp'), +(27638,'shannonbrown','Cleartext-Password',':=','S9725298223b'), +(27637,'allentaylor','Cleartext-Password',':=','A6346gge8T1'), +(27632,'kristenaustin','Cleartext-Password',':=','KA8017916972ka'), +(27630,'colinhopper','Cleartext-Password',':=','TYVU65445IUB'), +(29642,'mattbud','Cleartext-Password',':=','kjklfda79sd'), +(27621,'richardhill','Cleartext-Password',':=','RH9729788124rh'), +(27619,'srireddy','Cleartext-Password',':=','ycHAvetmF0'), +(27618,'tammieventris','Cleartext-Password',':=','DR45QC74M'), +(27615,'almaacosta','Cleartext-Password',':=','ENKC5DGV'), +(27614,'chrispassonno','Cleartext-Password',':=','C8766thf96P'), +(27613,'seanbaxter','Cleartext-Password',':=','SB4696679337sb'), +(27612,'collinhartman','Cleartext-Password',':=','B886tg98jt9L'), +(27608,'michaeltalbot','Cleartext-Password',':=','Mjj1276rt99T'), +(27606,'anagonzalez','Cleartext-Password',':=','WNAHDMwWoE'), +(27604,'leonardlewis','Cleartext-Password',':=','L1877ef32L'), +(27598,'jerryjohnson','Cleartext-Password',':=','J177895aa98J'), +(27594,'pamtoler','Cleartext-Password',':=','NfxcgYQUbj'), +(27589,'jodymccluskey','Cleartext-Password',':=','JM4696883349jm'), +(27579,'donnance','Cleartext-Password',':=','9727346814'), +(27577,'chrisvannatta','Cleartext-Password',':=','!4694502484!'), +(27575,'mariomerlo','Cleartext-Password',':=','!2149579585!'), +(27572,'williamarmstrong','Cleartext-Password',':=','!2145510334!'), +(27571,'trecedaschmid','Cleartext-Password',':=','!4692075942!'), +(27570,'ronlewis','Cleartext-Password',':=','JDkf1AL942'), +(27567,'sherryerichardson','Cleartext-Password',':=','DR6528BCD3S2'), +(27566,'joannarodriguez','Cleartext-Password',':=','394X3YR9'), +(27561,'dannycampbell','Cleartext-Password',':=','!9726589541!'), +(27560,'howardcomstock','Cleartext-Password',':=','!3365494230!'), +(27555,'terrymiesen','Cleartext-Password',':=','!4697420828!'), +(27550,'michaelray','Cleartext-Password',':=','primitivedefinitionstoredinner'), +(27545,'terrybates','Cleartext-Password',':=','!2145786644!'), +(27538,'gregmcintire','Cleartext-Password',':=','v9368$E9mx9m'), +(27543,'beverlyerwin','Cleartext-Password',':=','MOOLAH'), +(27518,'helenlumpkin','Cleartext-Password',':=','Heehhejd0N'), +(27508,'stevechristiaens','Cleartext-Password',':=','zY272m258*vJ'), +(27505,'judydevine','Cleartext-Password',':=','OD4697669725od'), +(27501,'jonnytaylor','Cleartext-Password',':=','Zb6677&4!yky'), +(27500,'rhondabolton','Cleartext-Password',':=','RB2145786030rb'), +(27492,'rickbeckham','Cleartext-Password',':=','tVj7ZI5QA0'), +(29652,'jenniferreed','Cleartext-Password',':=','683P7V7R'), +(27490,'vancepeltonen','Cleartext-Password',':=','V66rdf43aaP'), +(27486,'jacobwilliams','Cleartext-Password',':=','jnlka9994jkfldsa'), +(29650,'irvinbarojas','Cleartext-Password',':=','yDeEJzYY08'), +(27478,'classicshear','Cleartext-Password',':=','KARENALDERSON'), +(27477,'davekiowski','Cleartext-Password',':=','FNW63KXSAPT7'), +(27458,'paulsammataro','Cleartext-Password',':=','P2n74V7P8g4S'), +(27460,'janetkern','Cleartext-Password',':=','j42252^Bhf44'), +(27457,'carlossalaises','Cleartext-Password',':=','28E358y$JFB9'), +(27453,'obedsandoval','Cleartext-Password',':=','*H78z9xy84C&'), +(27455,'dianewiley','Cleartext-Password',':=','Diane03t4&adTL'), +(27444,'tammylove','Cleartext-Password',':=','f65NS4Ct6$29'), +(27438,'floydallen','Cleartext-Password',':=','V3864VB2'), +(27436,'clayrobertson2','Cleartext-Password',':=','C2147288546R'), +(27432,'hortenciaalvarez','Cleartext-Password',':=','WHTABORG3593JKS'), +(27424,'timbagert','Cleartext-Password',':=','CF18n42cY7'), +(27425,'davidbaker','Cleartext-Password',':=','DB764g1d87rtB'), +(27421,'janicealexander','Cleartext-Password',':=','AG57TSH89L9'), +(27423,'timgilbert','Cleartext-Password',':=','73xi0r600Sz%'), +(27417,'donniecampbell','Cleartext-Password',':=','6a2671bc0c1'), +(27418,'alanwyatt','Cleartext-Password',':=','i1412r53MYr'), +(27413,'jesusrios','Cleartext-Password',':=','8Di6QMs7%7m1'), +(27409,'veronabaptist','Cleartext-Password',':=','DAY753LIGHT253'), +(27406,'whiteywhite','Cleartext-Password',':=','45z6r*H4418n'), +(27404,'grahammcintire','Cleartext-Password',':=','U5Y3hA3g*14L'), +(27402,'louislafon','Cleartext-Password',':=','RFTRE4825CVKL'), +(27397,'ausencioluna','Cleartext-Password',':=','ABN765MNL'), +(27374,'davidvillanueva','Cleartext-Password',':=','DV5489CRPMWBQ'), +(29620,'sayedahaque','ClearText-Password',':=','YR4Sytbu'), +(29621,'coryrees','ClearText-Password',':=','yt5c6ujhvu'), +(29622,'brianamartinez','ClearText-Password',':=','ktydr6428'), +(29623,'khushbooagarwal','ClearText-Password',':=','UUTFVUCTC446'), +(29624,'elisasanders','ClearText-Password',':=','OYTCu3276'), +(29625,'josemedrano','ClearText-Password',':=','UYVITRUR24'), +(29645,'karengreen','Cleartext-Password',':=','UTKCYI674'), +(29627,'nicholasterry','ClearText-Password',':=','VUTYVL746'), +(29628,'leslieperalta','ClearText-Password',':=','RYC66747'), +(29629,'khushbooagarwal2','ClearText-Password',':=','iytf65gkj'), +(29630,'sriahobilamuth','ClearText-Password',':=','RTCESW24'), +(29631,'royrogers','ClearText-Password',':=','TYDGVBNC'), +(29632,'arturoprieto','ClearText-Password',':=','1653APVN877'), +(29633,'ericamorris','ClearText-Password',':=','E16488VN387'), +(29617,'belindamillener','ClearText-Password',':=','Uiyu7280'), +(29618,'kailynnbarnfield','ClearText-Password',':=','HAkuguuvoy1'), +(29619,'thomasgraham','ClearText-Password',':=','YUiygiiu4'), +(27315,'debravega','Cleartext-Password',':=','RCG8618BDUMSR'), +(29582,'davidlanman','Cleartext-Password',':=','2BMMRYQ2PHEA'), +(29583,'anthonylongo','Cleartext-Password',':=','9MLG8HVME4J3'), +(29584,'konradwoelffer','Cleartext-Password',':=','BCQ8NRFVNA3R'), +(29585,'marthaflores','Cleartext-Password',':=','KG2QEG36348V'), +(29586,'connorspicer','Cleartext-Password',':=','6U2BWJKGCX8G'), +(29588,'korybiggsshop','Cleartext-Password',':=','JA4SXBGKHFUL'), +(29589,'ednagriffin','Cleartext-Password',':=','AXA8EZEAN7DJ'), +(29590,'richardrosson','Cleartext-Password',':=','9J5L6MEH4Y7Y'), +(29603,'allentaylor2','ClearText-Password',':=','NCJW87FW8723'), +(29604,'alextovias','ClearText-Password',':=','7VSgrVO1WX'), +(29605,'mikecurrence','ClearText-Password',':=','MKH23FG79C'), +(29594,'terryrector','Cleartext-Password',':=','QUPP83ZUUSGL'), +(29595,'donnacampbell','Cleartext-Password',':=','KYCNTWS3929N'), +(29600,'billmctee','ClearText-Password',':=','Bdge6388M'), +(29643,'kimberlyrichards2','Cleartext-Password',':=','K84f7r10GT108'); +/*!40000 ALTER TABLE `radcheck` ENABLE KEYS */; +UNLOCK TABLES; + +-- +-- Dumping data for table `radreply` +-- + +LOCK TABLES `radreply` WRITE; +/*!40000 ALTER TABLE `radreply` DISABLE KEYS */; +INSERT INTO `radreply` (`id`, `username`, `attribute`, `op`, `value`) VALUES (632,'grahammcintire','Framed-IP-Address','=','204.110.188.225'), +(639,'vancepeltonen','Framed-IP-Address','=','204.110.188.229'), +(648,'michaelray','Framed-IP-Address','=','204.110.188.38'), +(650,'ronlewis','Framed-IP-Address','=','204.110.188.237'), +(655,'leonardlewis','Framed-IP-Address','=','204.110.188.199'), +(657,'taekim','Framed-IP-Address','=','204.110.188.42'), +(658,'joeywhitfield','Framed-IP-Address','=','204.110.188.233'), +(660,'kirkvanmeter','Framed-IP-Address','=','204.110.188.230'), +(661,'lambandlion','Framed-IP-Address','=','204.110.188.168'), +(662,'sensibleheatsystems','Framed-IP-Address','=','204.110.188.161'), +(664,'elizabethchristian','Framed-IP-Address','=','204.110.188.197'), +(665,'coyungemach','Framed-IP-Address','=','204.110.188.202'), +(668,'branchrvpark','Framed-IP-Address','=','204.110.188.142'), +(671,'austinwatkins','Framed-IP-Address','=','204.110.188.235'), +(672,'marilynfowler','Framed-IP-Address','=','204.110.188.131'), +(673,'ronberger','Framed-IP-Address','=','204.110.188.200'), +(675,'mauriciosoto','Framed-IP-Address','=','100.64.4.1'), +(677,'jamessmith','Framed-IP-Address','=','204.110.188.164'), +(680,'jackierollier','Framed-IP-Address','=','204.110.188.135'), +(681,'barbihardin','Framed-IP-Address','=','204.110.188.231'), +(682,'gabrielasereno','Framed-IP-Address','=','204.110.188.143'), +(684,'billyhorton','Framed-IP-Address','=','204.110.188.141'), +(685,'janiscable','Framed-IP-Address','=','204.110.188.196'), +(687,'radiantlifeministries','Framed-IP-Address','=','204.110.188.134'), +(688,'rogerbatt','Framed-IP-Address','=','204.110.188.40'), +(689,'dejadodson','Framed-IP-Address','=','204.110.188.236'), +(690,'johnlooper','Framed-IP-Address','=','204.110.188.144'), +(691,'marcuspatton','Framed-IP-Address','=','204.110.188.170'), +(692,'scottanderson','Framed-IP-Address','=','100.64.48.1'), +(693,'terrymiesen','Framed-IP-Address','=','100.64.144.1'); +/*!40000 ALTER TABLE `radreply` ENABLE KEYS */; +UNLOCK TABLES; + +-- +-- Dumping data for table `radusergroup` +-- + +LOCK TABLES `radusergroup` WRITE; +/*!40000 ALTER TABLE `radusergroup` DISABLE KEYS */; +INSERT INTO `radusergroup` (`username`, `groupname`, `priority`) VALUES ('shannellrichards','delinquent',1), +('joaniestanley','delinquent',1), +('marlenvillanueva','delinquent',1), +('brucejordan','delinquent',1), +('dominiquegreen','delinquent',1); +/*!40000 ALTER TABLE `radusergroup` ENABLE KEYS */; +UNLOCK TABLES; + +-- +-- Dumping data for table `radgroupcheck` +-- + +LOCK TABLES `radgroupcheck` WRITE; +/*!40000 ALTER TABLE `radgroupcheck` DISABLE KEYS */; +INSERT INTO `radgroupcheck` (`id`, `groupname`, `attribute`, `op`, `value`) VALUES (1,'daloRADIUS-Disabled-Users','Auth-Type',':=','Reject'), +(2,'daloRADIUS-Disabled-Users','Auth-Type',':=','Reject'); +/*!40000 ALTER TABLE `radgroupcheck` ENABLE KEYS */; +UNLOCK TABLES; + +-- +-- Dumping data for table `radgroupreply` +-- + +LOCK TABLES `radgroupreply` WRITE; +/*!40000 ALTER TABLE `radgroupreply` DISABLE KEYS */; +INSERT INTO `radgroupreply` (`id`, `groupname`, `attribute`, `op`, `value`) VALUES (128,'delinquent','Mikrotik-Rate-Limit',':=','1M 1M 1M 1 9 1'), +(129,'delinquent','Fall-Through','=','No'), +(138,'inactive','Mikrotik-Rate-Limit',':=','1M 1M 1M 1 9 1'), +(137,'inactive','Fall-Through','=','No'), +(136,'delinquent-temp','Mikrotik-Rate-Limit',':=','100M 100M 100M 1 9 1'); +/*!40000 ALTER TABLE `radgroupreply` ENABLE KEYS */; +UNLOCK TABLES; +/*!40103 SET TIME_ZONE=@OLD_TIME_ZONE */; + +/*!40101 SET SQL_MODE=@OLD_SQL_MODE */; +/*!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS */; +/*!40101 SET CHARACTER_SET_CLIENT=@OLD_CHARACTER_SET_CLIENT */; +/*!40101 SET CHARACTER_SET_RESULTS=@OLD_CHARACTER_SET_RESULTS */; +/*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */; +/*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */; + +-- Dump completed on 2026-07-11 14:24:49 diff --git a/ansible/roles/freeradius/handlers/main.yml b/ansible/roles/freeradius/handlers/main.yml new file mode 100644 index 0000000..fd3a75c --- /dev/null +++ b/ansible/roles/freeradius/handlers/main.yml @@ -0,0 +1,15 @@ +--- +- name: restart freeradius + ansible.builtin.service: + name: "{{ freeradius_service_name }}" + state: restarted + +- name: reload freeradius + ansible.builtin.service: + name: "{{ freeradius_service_name }}" + state: reloaded + +- name: restart mariadb + ansible.builtin.service: + name: mariadb + state: restarted diff --git a/ansible/roles/freeradius/tasks/main.yml b/ansible/roles/freeradius/tasks/main.yml new file mode 100644 index 0000000..6b16692 --- /dev/null +++ b/ansible/roles/freeradius/tasks/main.yml @@ -0,0 +1,270 @@ +--- +- name: Install FreeRADIUS and MySQL packages + ansible.builtin.apt: + name: "{{ freeradius_packages }}" + state: present + notify: restart freeradius + +- name: Set MariaDB to listen on all interfaces + ansible.builtin.lineinfile: + path: /etc/mysql/mariadb.conf.d/50-server.cnf + regexp: '^bind-address' + line: 'bind-address = 0.0.0.0' + notify: restart mariadb + +- name: Deploy MariaDB tuning config + ansible.builtin.template: + src: mariadb-tuning.cnf.j2 + dest: /etc/mysql/mariadb.conf.d/99-freeradius-tuning.cnf + owner: root + group: root + mode: '0644' + notify: restart mariadb + +- name: Create radius database + ansible.mysql.mysql_db: + name: "{{ freeradius_db_name }}" + state: present + login_unix_socket: /run/mysqld/mysqld.sock + when: freeradius_seed_db | bool + +- name: Create radius database user + ansible.mysql.mysql_user: + name: "{{ freeradius_db_user }}" + password: "{{ vault_freeradius_db_password }}" + priv: "{{ freeradius_db_name }}.*:SELECT,INSERT,UPDATE,DELETE" + host: localhost + state: present + login_unix_socket: /run/mysqld/mysqld.sock + when: freeradius_seed_db | bool + +- name: Copy schema SQL to server + ansible.builtin.copy: + src: schema.sql + dest: /tmp/radius-schema.sql + owner: root + group: root + mode: '0640' + when: freeradius_seed_db | bool + +- name: Seed radius database schema + ansible.mysql.mysql_db: + name: "{{ freeradius_db_name }}" + state: import + target: /tmp/radius-schema.sql + login_unix_socket: /run/mysqld/mysqld.sock + when: freeradius_seed_db | bool + +- name: Clean up schema SQL + ansible.builtin.file: + path: /tmp/radius-schema.sql + state: absent + when: freeradius_seed_db | bool + +- name: Ensure freeradius config directory exists + ansible.builtin.file: + path: "{{ freeradius_config_dir }}" + state: directory + owner: root + group: freerad + mode: '0750' + +- name: Ensure mods-enabled directory exists + ansible.builtin.file: + path: "{{ freeradius_config_dir }}/mods-enabled" + state: directory + owner: root + group: freerad + mode: '0750' + +- name: Ensure sites-enabled directory exists + ansible.builtin.file: + path: "{{ freeradius_config_dir }}/sites-enabled" + state: directory + owner: root + group: freerad + mode: '0750' + +- name: Ensure sql config directories exist + ansible.builtin.file: + path: "{{ freeradius_config_dir }}/mods-config/sql/main/{{ freeradius_sql_dialect }}" + state: directory + owner: root + group: freerad + mode: '0750' + +- name: Deploy radiusd.conf + ansible.builtin.template: + src: radiusd.conf.j2 + dest: "{{ freeradius_config_dir }}/radiusd.conf" + owner: root + group: freerad + mode: '0640' + notify: restart freeradius + +- name: Deploy clients.conf + ansible.builtin.template: + src: clients.conf.j2 + dest: "{{ freeradius_config_dir }}/clients.conf" + owner: root + group: freerad + mode: '0640' + notify: restart freeradius + +- name: Deploy SQL module config + ansible.builtin.template: + src: sql.j2 + dest: "{{ freeradius_config_dir }}/mods-available/sql" + owner: root + group: freerad + mode: '0640' + notify: restart freeradius + +- name: Deploy SQL queries.conf + ansible.builtin.copy: + src: queries.conf + dest: "{{ freeradius_config_dir }}/mods-config/sql/main/{{ freeradius_sql_dialect }}/queries.conf" + owner: root + group: freerad + mode: '0640' + notify: restart freeradius + +- name: Deploy cache module config + ansible.builtin.template: + src: cache.j2 + dest: "{{ freeradius_config_dir }}/mods-available/cache" + owner: root + group: freerad + mode: '0640' + notify: restart freeradius + +- name: Deploy default virtual server + ansible.builtin.template: + src: default.j2 + dest: "{{ freeradius_config_dir }}/sites-available/default" + owner: root + group: freerad + mode: '0640' + notify: restart freeradius + +- name: Deploy inner-tunnel virtual server + ansible.builtin.template: + src: inner-tunnel.j2 + dest: "{{ freeradius_config_dir }}/sites-available/inner-tunnel" + owner: root + group: freerad + mode: '0640' + notify: restart freeradius + +- name: Deploy CoA virtual server + ansible.builtin.template: + src: coa.j2 + dest: "{{ freeradius_config_dir }}/sites-available/coa" + owner: root + group: freerad + mode: '0640' + notify: restart freeradius + +- name: Deploy proxy.conf + ansible.builtin.template: + src: proxy.conf.j2 + dest: "{{ freeradius_config_dir }}/proxy.conf" + owner: root + group: freerad + mode: '0640' + notify: restart freeradius + +- name: Enable SQL module + ansible.builtin.file: + src: "{{ freeradius_config_dir }}/mods-available/sql" + dest: "{{ freeradius_config_dir }}/mods-enabled/sql" + state: link + force: true + owner: root + group: freerad + notify: restart freeradius + +- name: Enable cache module + ansible.builtin.file: + src: "{{ freeradius_config_dir }}/mods-available/cache" + dest: "{{ freeradius_config_dir }}/mods-enabled/cache" + state: link + force: true + owner: root + group: freerad + notify: restart freeradius + +- name: Enable default site + ansible.builtin.file: + src: "{{ freeradius_config_dir }}/sites-available/default" + dest: "{{ freeradius_config_dir }}/sites-enabled/default" + state: link + force: true + owner: root + group: freerad + notify: restart freeradius + +- name: Enable CoA site + ansible.builtin.file: + src: "{{ freeradius_config_dir }}/sites-available/coa" + dest: "{{ freeradius_config_dir }}/sites-enabled/coa" + state: link + force: true + owner: root + group: freerad + notify: restart freeradius + +- name: Seed NAS clients from ansible vars + ansible.mysql.mysql_query: + login_db: "{{ freeradius_db_name }}" + login_unix_socket: /run/mysqld/mysqld.sock + query: >- + INSERT INTO nas (nasname, shortname, type, ports, secret, server, community, description) + VALUES ('{{ item.nasname }}', '{{ item.shortname }}', '{{ item.type | default('other') }}', + {{ item.ports | default(0) }}, '{{ item.secret }}', + {{ ("'" + item.server + "'") if item.server is defined and item.server else 'NULL' }}, + {{ ("'" + item.community + "'") if item.community is defined and item.community else 'NULL' }}, + {{ ("'" + item.description + "'") if item.description is defined and item.description else 'NULL' }}) + ON DUPLICATE KEY UPDATE + shortname = VALUES(shortname), type = VALUES(type), + secret = VALUES(secret), server = VALUES(server), + community = VALUES(community), description = VALUES(description) + loop: "{{ freeradius_nas_clients }}" + when: freeradius_seed_nas | bool and freeradius_nas_clients | length > 0 + +- name: Copy user data SQL to server + ansible.builtin.copy: + src: seed-data.sql + dest: /tmp/radius-seed-data.sql + owner: root + group: root + mode: '0640' + when: freeradius_load_user_data | bool + +- name: Load user data from SQL dump + ansible.mysql.mysql_db: + name: "{{ freeradius_db_name }}" + state: import + target: /tmp/radius-seed-data.sql + login_unix_socket: /run/mysqld/mysqld.sock + when: freeradius_load_user_data | bool + +- name: Clean up user data SQL + ansible.builtin.file: + path: /tmp/radius-seed-data.sql + state: absent + when: freeradius_load_user_data | bool + +- name: Remove default symlinks that conflict with our config + ansible.builtin.file: + path: "{{ freeradius_config_dir }}/mods-enabled/{{ item }}" + state: absent + loop: + - sql + when: false # only enable when needed + +- name: Start and enable freeradius + ansible.builtin.service: + name: "{{ freeradius_service_name }}" + state: started + enabled: true diff --git a/ansible/roles/freeradius/templates/cache.j2 b/ansible/roles/freeradius/templates/cache.j2 new file mode 100644 index 0000000..a10dce1 --- /dev/null +++ b/ansible/roles/freeradius/templates/cache.j2 @@ -0,0 +1,28 @@ +# -*- text -*- +## +## mods-available/cache -- Attribute cache (reduces SQL load) +## +## Managed by Ansible — do not edit manually. +## + +cache { + driver = "rlm_cache_rbtree" + + key = "%{User-Name}" + + # Cache entries for 24 hours + ttl = 86400 + + add_stats = no + + update { + # Cache the Cleartext-Password so PAP/CHAP/MS-CHAP work without SQL + &control:Cleartext-Password += &control:Cleartext-Password + + # Cache group membership + &control:SQL-Group += &control:SQL-Group + + # Cache all reply attributes (Framed-IP-Address, rate limits, etc.) + &reply: += &reply:[*] + } +} diff --git a/ansible/roles/freeradius/templates/clients.conf.j2 b/ansible/roles/freeradius/templates/clients.conf.j2 new file mode 100644 index 0000000..9cdf5c2 --- /dev/null +++ b/ansible/roles/freeradius/templates/clients.conf.j2 @@ -0,0 +1,38 @@ +# -*- text -*- +## +## clients.conf -- FreeRADIUS client definitions +## +## Managed by Ansible — do not edit manually. +## +{% for client in freeradius_clients %} +client {{ client.name }} { + ipaddr = {{ client.ipaddr }} + proto = * + secret = {{ client.secret }} +{% if client.shortname is defined %} + shortname = {{ client.shortname }} +{% endif %} + require_message_authenticator = no +{% if client.nas_type is defined %} + nas_type = {{ client.nas_type }} +{% else %} + nas_type = other +{% endif %} +{% if client.virtual_server is defined %} + virtual_server = {{ client.virtual_server }} +{% endif %} +{% if client.limit is defined %} + limit { +{% for k, v in client.limit.items() %} + {{ k }} = {{ v }} +{% endfor %} + } +{% else %} + limit { + max_connections = 16 + lifetime = 0 + idle_timeout = 30 + } +{% endif %} +} +{% endfor %} diff --git a/ansible/roles/freeradius/templates/coa.j2 b/ansible/roles/freeradius/templates/coa.j2 new file mode 100644 index 0000000..c2e552f --- /dev/null +++ b/ansible/roles/freeradius/templates/coa.j2 @@ -0,0 +1,53 @@ +# -*- text -*- +## +## sites-available/coa -- Receive CoA/Disconnect and proxy to NAS +## +## Managed by Ansible — do not edit manually. +## +## gaiia sends CoA-Request or Disconnect-Request with User-Name +## and/or Acct-Session-Id. This server looks up the active session +## in radacct, finds the NAS, and proxies the request to it. +## + +listen { + type = coa + ipaddr = * + port = 3799 + virtual_server = coa +} + +server coa { + recv-coa { + # + # Try to find the NAS shortname from the active session. + # Lookup by Acct-Session-Id first (most specific), then User-Name. + # + {% if freeradius_sql_dialect == 'mysql' -%} + update control { + &Tmp-String-0 := "%{sql:SELECT nas.shortname FROM radacct INNER JOIN nas ON radacct.nasipaddress = nas.nasname WHERE radacct.acctsessionid = '%{Acct-Session-Id}' AND radacct.AcctStopTime IS NULL LIMIT 1}" + } + if (control:Tmp-String-0 == "") { + update control { + &Tmp-String-0 := "%{sql:SELECT nas.shortname FROM radacct INNER JOIN nas ON radacct.nasipaddress = nas.nasname WHERE radacct.username = '%{User-Name}' AND radacct.AcctStopTime IS NULL LIMIT 1}" + } + } + {% endif -%} + + # + # If we found a NAS, set the home_server_pool and proxy to it. + # + if (control:Tmp-String-0 != "") { + update request { + &Home-Server-Pool := "coa-pool-%{control:Tmp-String-0}" + } + } + else { + # No active session found — reject + reject + } + } + + send-coa { + ok + } +} diff --git a/ansible/roles/freeradius/templates/default.j2 b/ansible/roles/freeradius/templates/default.j2 new file mode 100644 index 0000000..9e267db --- /dev/null +++ b/ansible/roles/freeradius/templates/default.j2 @@ -0,0 +1,127 @@ +# -*- text -*- +## +## sites-available/default -- default virtual server +## +## Managed by Ansible — do not edit manually. +## + +server default { + +listen { + type = auth + ipaddr = * + port = 0 + limit { + max_connections = 16 + lifetime = 0 + idle_timeout = 30 + } +} + +listen { + ipaddr = * + port = 0 + type = acct + limit { + } +} + +listen { + type = auth + ipv6addr = :: + port = 0 + limit { + max_connections = 16 + lifetime = 0 + idle_timeout = 30 + } +} + +listen { + ipv6addr = :: + port = 0 + type = acct + limit { + } +} + +authorize { + filter_username + preprocess + chap + mschap + digest + suffix + cache { + ok = return + } + files + sql + expiration + logintime + pap +} + +authenticate { + Auth-Type PAP { + pap + } + Auth-Type CHAP { + chap + } + Auth-Type MS-CHAP { + mschap + } + mschap + digest +} + +preacct { + preprocess + acct_unique + suffix + files +} + +accounting { + detail + unix + -sql + exec + attr_filter.accounting_response +} + +session { + sql +} + +post-auth { + if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { + update reply { + &User-Name !* ANY + } + } + update { + &reply: += &session-state: + } + -sql + cache + exec + + Post-Auth-Type REJECT { + -sql + attr_filter.access_reject + remove_reply_message_if_eap + } + + Post-Auth-Type Challenge { + } +} + +pre-proxy { +} + +post-proxy { +} + +} diff --git a/ansible/roles/freeradius/templates/inner-tunnel.j2 b/ansible/roles/freeradius/templates/inner-tunnel.j2 new file mode 100644 index 0000000..0539711 --- /dev/null +++ b/ansible/roles/freeradius/templates/inner-tunnel.j2 @@ -0,0 +1,74 @@ +# -*- text -*- +## +## sites-available/inner-tunnel -- EAP inner tunnel virtual server +## +## Managed by Ansible — do not edit manually. +## + +server inner-tunnel { + +listen { + ipaddr = 127.0.0.1 + port = 18120 + type = auth +} + +authorize { + filter_username + suffix + update control { + &Proxy-To-Realm := LOCAL + } + sql + chap + mschap + pap + eap { + ok = return + } + cache { + ok = return + } + files + expiration + logintime +} + +authenticate { + Auth-Type PAP { + pap + } + Auth-Type CHAP { + chap + } + Auth-Type MS-CHAP { + mschap + } + mschap + eap +} + +session { +} + +post-auth { + -sql + cache + + Post-Auth-Type REJECT { + -sql + attr_filter.access_reject + update outer.session-state { + &Module-Failure-Message := &request:Module-Failure-Message + } + } +} + +pre-proxy { +} + +post-proxy { + eap +} + +} diff --git a/ansible/roles/freeradius/templates/mariadb-tuning.cnf.j2 b/ansible/roles/freeradius/templates/mariadb-tuning.cnf.j2 new file mode 100644 index 0000000..e26d5e5 --- /dev/null +++ b/ansible/roles/freeradius/templates/mariadb-tuning.cnf.j2 @@ -0,0 +1,33 @@ +# +# MariaDB performance tuning for FreeRADIUS +# Managed by Ansible — do not edit manually. +# +[mariadbd] + +# --- Connections --- +max_connections = 100 +thread_cache_size = 16 +skip-name-resolve + +# --- InnoDB --- +# 512M is plenty — the radius DB is small but InnoDB benefits from headroom +innodb_buffer_pool_size = 512M +innodb_buffer_pool_instances = 1 +innodb_flush_log_at_trx_commit = 2 +innodb_log_file_size = 128M +innodb_file_per_table = 1 +innodb_flush_method = fsync + +# --- Tables --- +table_open_cache = 256 +table_definition_cache = 400 + +# --- Query Cache --- +# Disabled by default in MariaDB 10.6+ — leave off for FreeRADIUS +# (most queries are single-row lookups, query cache adds overhead) +query_cache_type = 0 + +# --- Binary Logging --- +# Disable unless replication is needed — saves disk I/O +# skip-log-bin is default in Debian, explicit for safety +disable_log_bin diff --git a/ansible/roles/freeradius/templates/proxy.conf.j2 b/ansible/roles/freeradius/templates/proxy.conf.j2 new file mode 100644 index 0000000..9fafb59 --- /dev/null +++ b/ansible/roles/freeradius/templates/proxy.conf.j2 @@ -0,0 +1,56 @@ +# -*- text -*- +## +## proxy.conf -- Proxy and home_server configuration +## +## Managed by Ansible — do not edit manually. +## + +# CoA/Disconnect home_server for each NAS +{% for nas in freeradius_nas_clients %} +home_server coa-{{ nas.shortname }} { + type = coa + ipaddr = {{ nas.nasname }} + port = 3799 + secret = {{ nas.secret }} + coa { + irt = 2 + mrt = 16 + mrc = 5 + mrd = 30 + } +} +home_server_pool coa-pool-{{ nas.shortname }} { + type = fail-over + home_server = coa-{{ nas.shortname }} + virtual_server = originate-coa-relay +} +{% endfor %} + +# Originate CoA response handler virtual server +server originate-coa-relay { + post-proxy { + switch &proxy-reply:Packet-Type { + case CoA-ACK { + ok + } + case CoA-NAK { + ok + } + case Disconnect-ACK { + ok + } + case Disconnect-NAK { + ok + } + case { + fail + } + } + Post-Proxy-Type Fail-CoA { + ok + } + Post-Proxy-Type Fail-Disconnect { + ok + } + } +} diff --git a/ansible/roles/freeradius/templates/radiusd.conf.j2 b/ansible/roles/freeradius/templates/radiusd.conf.j2 new file mode 100644 index 0000000..b49ac7a --- /dev/null +++ b/ansible/roles/freeradius/templates/radiusd.conf.j2 @@ -0,0 +1,91 @@ +# -*- text -*- +## +## radiusd.conf -- FreeRADIUS server configuration +## +## Managed by Ansible — do not edit manually. +## + +prefix = /usr +exec_prefix = /usr +sysconfdir = /etc +localstatedir = /var +sbindir = /usr/sbin +logdir = ${localstatedir}/log/freeradius +raddbdir = ${sysconfdir}/freeradius/3.0 +radacctdir = ${logdir}/radacct + +name = radiusd + +confdir = ${raddbdir} +modconfdir = ${confdir}/mods-config +certdir = ${confdir}/certs +cadir = ${confdir}/certs +run_dir = ${localstatedir}/run/${name} + +db_dir = ${localstatedir}/lib/radiusd + +libdir = /usr/lib/freeradius + +pidfile = ${run_dir}/${name}.pid + +max_request_time = 30 +cleanup_delay = 5 +max_requests = 16384 + +hostname_lookups = no + +unlang { +} + +log { + destination = files + colourise = yes + msg_denied = "You are already logged in - access denied" + file = ${logdir}/radius.log + syslog_facility = daemon + stripped_names = no + auth = yes + auth_badpass = no + auth_goodpass = no + msg_goodpass = "" + msg_badpass = "" +} + +checkrad = ${sbindir}/checkrad + +ENV { +} + +security { + max_attributes = 200 + reject_delay = 1 + status_server = yes + allow_vulnerable_openssl = "CVE-2016-6304" +} + +proxy_requests = yes + +$INCLUDE clients.conf +$INCLUDE proxy.conf + +thread pool { + start_servers = 5 + max_servers = 32 + min_spare_servers = 3 + max_spare_servers = 10 + max_requests_per_server = 0 + auto_limit_acct = no +} + +modules { + $INCLUDE mods-enabled/ +} + +instantiate { +} + +policy { + $INCLUDE policy.d/ +} + +$INCLUDE sites-enabled/ diff --git a/ansible/roles/freeradius/templates/sql.j2 b/ansible/roles/freeradius/templates/sql.j2 new file mode 100644 index 0000000..07afb1b --- /dev/null +++ b/ansible/roles/freeradius/templates/sql.j2 @@ -0,0 +1,74 @@ +# -*- text -*- +## +## mods-available/sql -- SQL module configuration +## +## Managed by Ansible — do not edit manually. +## + +sql { + dialect = "{{ freeradius_sql_dialect }}" + driver = "{{ freeradius_sql_driver }}" + + sqlite { + filename = "/tmp/freeradius.db" + busy_timeout = 200 + bootstrap = "${modconfdir}/${..:name}/main/sqlite/schema.sql" + } + + mysql { + warnings = auto + } + + postgresql { + send_application_name = yes + } + + mongo { + appname = "freeradius" + tls { + certificate_file = /path/to/file + certificate_password = "password" + ca_file = /path/to/file + ca_dir = /path/to/directory + crl_file = /path/to/file + weak_cert_validation = false + allow_invalid_hostname = false + } + } + + server = "{{ freeradius_db_host }}" + port = {{ freeradius_db_port }} + login = "{{ freeradius_db_user }}" + password = "{{ vault_freeradius_db_password }}" + + radius_db = "{{ freeradius_db_name }}" + + acct_table1 = "radacct" + acct_table2 = "radacct" + postauth_table = "radpostauth" + authcheck_table = "radcheck" + groupcheck_table = "radgroupcheck" + authreply_table = "radreply" + groupreply_table = "radgroupreply" + usergroup_table = "radusergroup" + + delete_stale_sessions = yes + + pool { + start = ${thread[pool].start_servers} + min = ${thread[pool].min_spare_servers} + max = ${thread[pool].max_servers} + spare = ${thread[pool].max_spare_servers} + uses = 0 + retry_delay = 30 + lifetime = 0 + idle_timeout = 60 + } + + read_clients = {{ 'yes' if freeradius_read_clients else 'no' }} + client_table = "{{ freeradius_client_table }}" + + group_attribute = "SQL-Group" + + $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf +} diff --git a/tofu/flatcar-resolver.bu b/tofu/flatcar-resolver.bu index ce3355b..f3e77d3 100644 --- a/tofu/flatcar-resolver.bu +++ b/tofu/flatcar-resolver.bu @@ -128,10 +128,7 @@ systemd: ExecStartPre=/usr/bin/docker pull mvance/unbound:latest ExecStart=/usr/bin/docker run \ --name unbound \ - -p 204.110.191.240:53:53/udp \ - -p 204.110.191.240:53:53/tcp \ - -p 127.0.0.1:8953:8953/tcp \ - -p 127.0.0.1:8080:8080/tcp \ + --network host \ -v /etc/unbound:/opt/unbound/etc/unbound:ro \ mvance/unbound:latest ExecStop=/usr/bin/docker stop unbound diff --git a/tofu/flatcar-resolver2.bu b/tofu/flatcar-resolver2.bu index 9517c19..2cfd25e 100644 --- a/tofu/flatcar-resolver2.bu +++ b/tofu/flatcar-resolver2.bu @@ -128,10 +128,7 @@ systemd: ExecStartPre=/usr/bin/docker pull mvance/unbound:latest ExecStart=/usr/bin/docker run \ --name unbound \ - -p 204.110.191.250:53:53/udp \ - -p 204.110.191.250:53:53/tcp \ - -p 127.0.0.1:8953:8953/tcp \ - -p 127.0.0.1:8080:8080/tcp \ + --network host \ -v /etc/unbound:/opt/unbound/etc/unbound:ro \ mvance/unbound:latest ExecStop=/usr/bin/docker stop unbound