/[radius]/radius/doc/man/radiusd.8.man
ViewVC logotype

Diff of /radius/doc/man/radiusd.8.man

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.6 by gray, Thu Dec 13 13:42:36 2001 UTC revision 1.7 by gray, Thu Oct 16 15:18:43 2003 UTC
# Line 20  radiusd - Authentication and accounting Line 20  radiusd - Authentication and accounting
20  [\fB-x\fR debug_level]  [\fB-x\fR debug_level]
21  [\fB-yz\fR]  [\fB-yz\fR]
22  .SH DESCRIPTION  .SH DESCRIPTION
23  \fBradiusd\fR is the server implementing \fBRADIUS\fR protocol.  .De radiusd
 .PP  
 \fBRADIUS\fR is a protocol spoken between the network access server  
 (\fBNAS\fR) and the authentication server. The network access server  
 is typically a device accepting connections from several modem lines  
 and the authentication server is the server which decides whether some  
 user has the right to log in or he has not. This is called authentication.  
 .PP  
 Also, when the user logs in or out, the \fBNAS\fR sends login and  
 logout packets. These packets are received by the \fBradius\fR server  
 and recorded appropriately. This is called accounting.  
 .PP  
 Upon startup, \fBradius\fR server listens the following two ports:  
 authentication (default 1645), accounting (1646).  
 When configured with \fB--enable-snmp\fR option, \fBradiusd\fR also starts  
 listening on the specified SNMP port.  
 .PP  
 Upon receiving a packet from any of the above ports, the server performs  
 the following:  
 .IP "1. checks the authenticity of the request"  
 Depending on the type of the request this check is based on the source  
 IP address.  
 .IP "2. looks up the request queue for duplicates"  
 If a request is found in the queue, it gets dropped and the appropriate  
 diagnostics is output to the Warning channel.  
 .IP "3. registers request in the queue"  
 This is needed to prevent any eventual duplicates of this packet from being  
 processed.  
 .IP "4. processes and answers the request"  
 A child process may be forked during this stage to handle the request.  
 .PP  
   
 .SH OPTIONS  
 .IP "-A, --log-auth-detail"  
 Write a file named \fBdetail.auth\fR in the same directory as  
 \fBdetail\fR file. This file contains all the Attribute-Value pairs  
 for each authentication packet. Normally this should be used for  
 debugging purposes.  
 .IP  
 Configuration file equivalent: \fBdetail yes\fR in \fBauth\fR block.  
 .IP "-a, --acct-directory PATH"  
 Specify alternate directory for accounting. Usually this defaults to  
 \fB\*(RL/radacct\fR.  
 .IP  
 Configuration file equivalent: \fBacct-dir PATH\fR in \fBoption\fR block.  
 .IP "-b, --dbm"  
 If the \fBradiusd\fR server was configured with \fB--enable-dbm\fR  
 option, this flag instructs it to use the DBM version of the users  
 database (\fB\*(RD/users.db\fR or \fB\*(RD/users.pag\fR,  
 \fB\*(RD/users.dir\fR pair) instead of the plain text file  
 (\fB\*(RD/users\fR).  
 .IP  
 Configuration file equivalent: \fBusedbm yes\fR.  
 .IP "-d, --config-directory, --directory PATH"  
 Specifies alternate name for the configuration  
 directory. \fBRadiusd\fR looks there for its configuration files. It  
 defaults to \fB\*(RD\fR.  
 .IP "-f, --foreground"  
 Instructs the server to not detach itself from the controlling  
 terminal. This is used for debugging.  
 .IP "-i, --ip-address IP"  
 Specifies the IP address to listen on. If this option is not specified,  
 the program will listen on all IP addresses, assigned to the machine it  
 runs on.  
 .IP  
 Configuration file equivalent: \fBsource-ip IP\fR in \fBoption\fR block.  
 .IP  
 Please note, that \fBlisten\fR statement in \fBraddb/config\fR  
 provides a better control over IP addresses to listen on.  
 .IP "-L, --license"  
 Display GNU General Public License and exit.  
   
 .IP "-l, --logging-directory PATH"  
 Specifies alternate name for logging directory. \fBRadiusd\fR writes  
 there its logfile(s). The default is \fB\*(RL\fR.  
 .IP  
 Configuration file equivalent: \fBlog-dir PATH\fR in \fBoption\fR block.  
 .IP "-m, --mode c"  
 Check mode. In this mode \fBradiusd\fR starts as usual, checks its  
 configuration files and exits. All log channels are duplicated to  
 stdout.  
 .IP "-m, --mode b"  
 Build DBM users database out of plaintext file. If no argument is  
 specified, the file \*(RD/users is taken as input.  Otherwise the  
 argument specifies the filename to be used as input. This option  
 takes effect only if the program was configured with \fB--enable-dbm\fR  
 option.  
 .IP "-m, --mode t"  
 Start in test mode. In this mode \fBradiusd\fR starts interactive  
 interpreter which allows to test various aspects of its configuration.  
 .IP "-p, --port PORT"  
 Specifies alternate port for authentication requests. The port number  
 for accounting requests is determined by adding 1 to this number. Port  
 number should be specified in decimal. Defaults are 1645 and 1646.  
 .IP "-S, --log-stripped-names"  
 Strip off the suffix and prefix from the username before writing it to  
 the \fBdetail\fR file.  
 .IP  
 Configuration file equivalent: \fBstrip-names yes\fR in \fBauth\fR block.  
 .IP "-s, --single-process"  
 Tells the authentication server to operate in single process  
 mode. When specified this flag, the authentications server will handle  
 each request itself instead of forking child process to do that. This  
 slows down the authentication processing to a crawl and should only be  
 used for debugging purposes. The most convenient use is with the  
 \fB-f\fR option.  
 .IP "-v, --version"  
 When given this option \fBradiusd\fR prints on the standard output its  
 version number, compilation flags and the file names it uses and exits  
 with zero code.  
 .IP "-x, --debug MOD-LIST"  
 Sets the debug level. \fBMOD-LIST\fR is a comma-separated list of  
 \fBmodule-level\fR specifications. Each module-level specification  
 is either \fBMOD-NAME\fR or \fBMOD-NAME\fR=\fBLEVEL\fR, where  
 \fBMOD-NAME\fR is the name of the source module, \fBLEVEL\fR is  
 the debugging level to be set for that module (0 <= \fBLEVEL\fR <= 100)  
 If \fBLEVEL\fR is omitted, it defaults to 100.  
 .IP  
 Configuration file equivalent: \fBdebug MOD-LIST\fR in \fBlogging\fR block.  
 .IP "-y, --log-auth"  
 Write to the log file detailed information about each authentication  
 request. The information is logged under \fBauth\fR loglevel.  
 .IP  
 Configuration file equivalent: \fBprint-auth yes\fR in \fBlogging\fR block.  
 .IP "-z, --log-auth-pass"  
 Log the password along with the user name for each login. This is very  
 insecure. This option is provided only for debugging purposes.  
 .IP  
 Configuration file equivalent: \fBprint-pass yes\fR in \fBlogging\fR block.  
 .SH CONFIGURATION  
 \fBRadiusd\fR uses rather complicated configuration file suite. The  
 files live in \fB\*(RD\fR directory. The place of their location  
 can be overridden using \fB-d\fr option.  
 .PP  
 The configuration files are:  
 .IP config  
 This file contains all the configurable parameters of the server  
 itself: logging options, debug levels, notification and SNMP options,  
 etc.  
 .IP users  
 The plaintext users database. Contains the per-user authorization and  
 accounting information.  
 .IP users.db  
 Or users.dir, users.pag pair. The DBM version of the users  
 database. This is used when the server is compiled with  
 \fB--enable-dbm\fR option and either \fB-b\fR flag is specified in the  
 command line, or \fBusedbm yes\fR option is  
 used in \fBconfig\fR file.  
 .IP access.deny  
 The list of users whose access is denied for some reason.  
 .IP dictionary  
 Defines the symbolic representation of the \fBRadius\fR attributes,  
 attribute values, etc. Usually should not be modified.  
 .IP naslist  
 The list of network access servers that are allowed to use this  
 \fBRadius\fR server. This file specifies for each \fBNAS\fR its long  
 and short names, NAS type, and possibly its IP pool.  
 .IP clients  
 The list of IP addresses and secret keys for each \fBNAS\fR that wants  
 to communicate to the server.  
 .IP hints  
 The \fBradius\fR server can alter its politics towards a user  
 depending on its login name. It can, for example, supply a different  
 kind of service, assign it the IP number, etc. This file specifies  
 the rules to be applied to an incoming request depending on the  
 username it contains.  
 .IP huntgroups  
 Defines the huntgroups. A huntgroup is a class of users that have  
 some common attributes in the incoming packet, for example all users  
 coming from a given NAS.  
   
 .SH FILES  
 These are default values. They can be overridden either from command  
 line or from configuration file.  
   
 .IP \*(RD/  
 Configuration files directory  
 .PP  
 .IP \*(RL/radius.log  
 Default logfile.  
 .IP \*(RL/radacct  
 Accounting directory.  
 .IP \*(RP/radius.pid  
 Holds the PID number of the master \fBRadius\fR process.  
 .PP  
   
 .SH BUGS  
 The information in this manpage may be obsolete or incomplete. Please  
 refer to texinfo documentation for full information about GNU Radius  
 tools.  
24  .SH AUTHORS  .SH AUTHORS
25  \*(AU  \*(AU
   
 .SH SEE ALSO  
 users(5rad), config(5rad), dictionary(5rad), naslist(5rad), clients(5rad),  
 hints(5rad), huntgroups(5rad), builddbm(8rad), radlast(1rad), raduse(1rad),  
 radwho(1rad), radzap(8rad), radctl(8rad), radgrep(1rad),  
 radping(8rad), radtest(8rad), radsnmp(8rad)  
 .PP  

Legend:
Removed from v.1.6  
changed lines
  Added in v.1.7

savannah-hackers-public@gnu.org
ViewVC Help
Powered by ViewVC 1.1.26