Client Package
**************

Beside the Radius server and accompanying utilities, GNU Radius provides a set of utilities to be used as Radius clients.

The following sections describe in detail the parts of the Radius client package.

Client Configuration
====================

All programs from the client package share the same configuration file: raddb/client.conf. The file uses simple line-oriented syntax. Empty lines are ignored; the command # introduces an end-of-line comment.

The source IP is introduced with the source_ip statement. Its syntax is:

     source_ip IP-ADDR

where IP-ADDR must be the IP in dotted-quad notation.

The Radius server to send the requests to is introduced with server statement:

     server NAME IP-ADDR SECRET AUTH-PORT ACCT-PORT

Its parts are:

name
     The server name. It is reserved for further use.

ip-addr
     The server IP.

secret
     The shared secret to be used when sending requests to this server.

auth-port
     The authentication port number.

acct-port
     The accounting port number.

If several server statement are present, they are tried in turn until one of them replies to the request.

The amount of time a client program waits for the reply from a server is configured using the timeout statement:

     timeout NUMBER

If the program does not receive any response within NUMBER seconds, it assumes the server does not respond and either retries the transmission or tries the next available server. The number of retries is set with the retry statement:

     retry NUMBER

The example raddb/client.conf follows:

     server first 10.11.10.1 secret 1645 1646
     server second 10.11.10.1 secret 1645 1646
     source_ip 127.0.0.1
     timeout 3
     retry 5

radsession
==========

radsession is a Guile script that sends authentication and accounting requests to the Radius server. To invoke the script, run

     radsession OPTIONS ACTION

Possible actions are:

--auth
     Send authentication request.

--start
     Send accounting start request.

--stop
     Send accounting stop request.

Options determine the contents of the request's pairlist. They are:

-l STRING
--login STRING
     Set login name.

-p STRING
--passwd STRING
     Set password.

-n IP
--nas IP
     Set the value of NAS-IP-Address attribute.

-s STRING
--sid STRING
     Set the session ID (Acct-Session-Id attribute).

-P NUMBER
--port NUMBER
     Set the port number (NAS-Port-Id attribute).

-h
--help
     Print a short usage message and exit.

-v
--verbose
     Verbosely list the contents of the received reply.

nas.scm
=======

nas.scm is a Guile program that allows one to convert a GNU/Linux box into a NAS. It requires Guile version 1.4 or better and PPP version 2.3.7 or better.

To use it, you will basically need to do the following:

 1. Create links:

          ln -s LIBEXEC/nas.scm /etc/ppp/ip-up
          ln -s LIBEXEC/nas.scm /etc/ppp/ip-down

     Here, LIBEXEC denotes the location of your libexec directory, where nas.scm is installed. If not overridden at configure time, it defaults to PREFIX/libexec. These links assure that ppp will invoke nas.scm when the user's session starts and ends, thus giving it a possibility to send accounting requests.

 2. Configure the file raddb/client.conf.

 3. Edit the file raddb/nas.rc. The supplied nas.rc template is tailored to work in most environments. The only variables you may need to change are nas-log-facility, specifying the syslog facility to be used for logging, and pppd-args, keeping the arguments to be given to ppp.

 4. Configure your /etc/inittab and getty.

     For example, if you use mgetty, then the inittab entries for dial-up lines will look like:

          d0:345:respawn:/sbin/mgetty ttyS0 vt100
          d1:345:respawn:/sbin/mgetty ttyS1 vt100
          ...

     mgetty's login.config will then contain the following line:

          *       -       -       /usr/local/libexec/nas.scm @

     If you use agetty, then the inittab will contain (with the long lines split for readability)

          d0:345:respawn:/sbin/agetty -mt60 \
             -l /usr/local/libexec/nas.scm 38400,19200,9600 \
             ttyS0 vt100
          d1:345:respawn:/sbin/agetty -mt60 \
             -l /usr/local/libexec/nas.scm 38400,19200,9600 \
             ttyS1 vt100
          ...

pam_radius.so
=============

pam_radius.so is a PAM module for Radius authentication. The module understands the following command line options:

audit
     Enable audit information.

debug[=LEVEL]
     Enable debugging information. The higher LEVEL is, the more debugging info is output. When omitted, LEVEL defaults to 100.

     Debugging levels equal to or greater than 10 compromise users' passwords, so use them sparingly.

use_authtok
     Use the authentication token passed from the previous module in the stack.

confdir=PATH
     Look for configuration files in PATH. The default is $sysconfdir/etc/raddb.

attr:
     This keyword marks the end of command line options. The part of the command line after it is parsed as a whitespace-separated list of AVP s to be sent with the request.

service_type=TYPE
     This option is retained for compatibility with the 0.96 series of GNU Radius. It is equivalent to

                  attr: Service-Type=TYPE

The pam_radius.so module logs its messages under LOG_AUTH syslog facility.