46 |
@cindex Radiusd configuration |
@cindex Radiusd configuration |
47 |
@cindex @file{raddb/config} file |
@cindex @file{raddb/config} file |
48 |
|
|
49 |
@command{radiusd} uses the configuration values from the following |
At startup @command{radiusd} obtains its configuration values from three |
50 |
sources (in order of increasing precedence): |
places. The basic configuration is kept in the executable module |
51 |
|
itself. These values are overridden by those obtained from |
52 |
@enumerate 1 |
@file{raddb/config} file. Finally, the options obtained from the |
53 |
@item Compiled-in defaults |
command line override the first two sets of options. |
54 |
@item @file{raddb/config} file. |
|
55 |
@item Command line arguments |
When re-reading of the configuration is initiated either by |
56 |
@end enumerate |
@code{SIGHUP} signal or by SNMP channel any changes in the config file |
57 |
|
take precedence over command line arguments, since @file{raddb/config} is |
|
This order of precedence applies only on startup. When re-reading of |
|
|
the configuration is initiated either by @code{SIGHUP} signal or by |
|
|
SNMP channel any changes in the config file take |
|
|
precedence over command line arguments, since @file{raddb/config} is |
|
58 |
the only way to change configuration of the running program. |
the only way to change configuration of the running program. |
59 |
|
|
60 |
This chapter discusses the @file{raddb/config} file in detail. |
This chapter discusses the @file{raddb/config} file in detail. |
187 |
Determines characters that are valid within a username. The alphanumeric |
Determines characters that are valid within a username. The alphanumeric |
188 |
characters are always allowed in a username, it is not necessary to |
characters are always allowed in a username, it is not necessary to |
189 |
specify them in this statement. By default the following characters |
specify them in this statement. By default the following characters |
190 |
are allowed in a username: @samp{.-_!@@#$%^&\/"}. |
are allowed in a username: @samp{.-_!@@#$%^&\/"}. The |
191 |
|
@code{username-chars} statement overrides this default, thus setting: |
192 |
|
|
193 |
|
@smallexample |
194 |
|
username-chars ":" |
195 |
|
@end smallexample |
196 |
|
|
197 |
|
@noindent |
198 |
|
will restrict the set of allowed characters to the alphanumeric |
199 |
|
characters and colon. If you wish to expand the default character |
200 |
|
set, you will have to explicitly specify it in the |
201 |
|
@code{username-chars} argument, as shown in the example below: |
202 |
|
|
203 |
|
@smallexample |
204 |
|
username-chars ".-_!@@#$%^&\\/\":" |
205 |
|
@end smallexample |
206 |
|
|
207 |
|
@noindent |
208 |
|
(Notice the use of escape character @samp{\}). |
209 |
|
|
210 |
@item log-dir |
@item log-dir |
211 |
Specifies the logging directory. |
Specifies the logging directory. |
252 |
The @code{logging} statement describes the course followed by |
The @code{logging} statement describes the course followed by |
253 |
@command{radiusd}'s logging information. |
@command{radiusd}'s logging information. |
254 |
|
|
255 |
|
The parts of this statement are discussed below. |
256 |
|
|
257 |
@menu |
@menu |
258 |
* category:: @code{category} statement. |
* category:: @code{category} statement. |
259 |
* channel:: @code{channel} statement. |
* channel:: @code{channel} statement. |
283 |
order are: @code{debug}, @code{info}, @code{notice}, @code{warn}, |
order are: @code{debug}, @code{info}, @code{notice}, @code{warn}, |
284 |
@code{err}, @code{crit}, @code{alert}, @code{emerg}. |
@code{err}, @code{crit}, @code{alert}, @code{emerg}. |
285 |
|
|
286 |
The full category specification, @dfn{category_spec}, can take any of |
The full category specification, denoted by the @code{category_spec} |
287 |
the following three forms: |
in the above section, can take any of the following three forms: |
288 |
|
|
289 |
@table @asis |
@table @asis |
290 |
@item category_name |
@item category_name |
299 |
@item category_name . priority |
@item category_name . priority |
300 |
Print the messages of given category, abridged by given priority. The |
Print the messages of given category, abridged by given priority. The |
301 |
priority may be prefixed with either @samp{=} or @samp{!} as described |
priority may be prefixed with either @samp{=} or @samp{!} as described |
302 |
above. |
above. The dot (@samp{.}) separates the priority from the category |
303 |
|
name, it may be surrounded by any amount of whitespace. |
304 |
@end table |
@end table |
305 |
|
|
306 |
Additional category options valid for @code{auth} category are: |
Additional category options valid for @code{auth} category are: |
448 |
If the @code{listen} statement is omitted, radiusd will accept incoming |
If the @code{listen} statement is omitted, radiusd will accept incoming |
449 |
requests from any interface on the machine. |
requests from any interface on the machine. |
450 |
|
|
451 |
|
The following example configures radius to listen for the incoming |
452 |
|
requests on the default authentication port on the address 10.10.10.1 |
453 |
|
and on port 1645 on address 10.10.11.2. |
454 |
|
|
455 |
|
@smallexample |
456 |
|
listen 10.10.10.1, 10.10.11.2:1645; |
457 |
|
@end smallexample |
458 |
|
|
459 |
@subheading Numeric statements |
@subheading Numeric statements |
460 |
|
|
461 |
@table @code |
@table @code |
462 |
@item port |
@item port |
463 |
Sets the number of @sc{udp} port to listen on for the authentication requests. |
Sets the number of which @sc{udp} port to listen on for the |
464 |
|
authentication requests. |
465 |
|
|
466 |
@item max-requests |
@item max-requests |
467 |
Sets the maximum number of authentication requests in the queue. Any |
Sets the maximum number of authentication requests in the queue. Any |
561 |
If the @code{listen} statement is omitted, radiusd will accept incoming |
If the @code{listen} statement is omitted, radiusd will accept incoming |
562 |
requests from any interface on the machine. |
requests from any interface on the machine. |
563 |
|
|
564 |
|
The following example configures radius to listen for the incoming |
565 |
|
requests on the default accounting port on the address 10.10.10.1 |
566 |
|
and on port 1646 on address 10.10.11.2. |
567 |
|
|
568 |
|
@smallexample |
569 |
|
listen 10.10.10.1, 10.10.11.2:1646; |
570 |
|
@end smallexample |
571 |
|
|
572 |
@subheading Numeric statements |
@subheading Numeric statements |
573 |
|
|
574 |
@table @code |
@table @code |
575 |
@item port |
@item port |
576 |
Sets the port number to listen for the authentication requests. |
Sets the number of which port to listen for the authentication requests. |
577 |
|
|
578 |
@item max-requests |
@item max-requests |
579 |
Sets the maximum number of accounting requests in the queue. Any |
Sets the maximum number of accounting requests in the queue. Any |
724 |
list of items in the form @var{ip}:@var{port-number}. The @var{ip} can |
list of items in the form @var{ip}:@var{port-number}. The @var{ip} can |
725 |
be either an IP address in familiar ``dotted-quad'' notation or a |
be either an IP address in familiar ``dotted-quad'' notation or a |
726 |
hostname. The :@var{port-number} part may be omitted, in which case the |
hostname. The :@var{port-number} part may be omitted, in which case the |
727 |
default accounting port is assumed. |
default SNMP port (161) is used. |
728 |
|
|
729 |
If the @code{listen} statement is omitted, radiusd will accept incoming |
If the @code{listen} statement is omitted, radiusd will accept incoming |
730 |
requests from any interface on the machine. |
requests from any interface on the machine. |
731 |
|
|
732 |
|
The following example configures radius to listen for the incoming |
733 |
|
SNMP requests on the default SNMP port on the address 10.10.10.1 |
734 |
|
and on port 4500 on address 10.10.11.2. |
735 |
|
|
736 |
|
@smallexample |
737 |
|
listen 10.10.10.1, 10.10.11.2:4500; |
738 |
|
@end smallexample |
739 |
|
|
740 |
|
|
741 |
@subheading Numeric statements |
@subheading Numeric statements |
742 |
|
|
743 |
@table @code |
@table @code |
744 |
@item port |
@item port |
745 |
Sets the port number to listen for the SNMP requests. |
Sets the number of which port to listen for the SNMP requests. |
746 |
|
|
747 |
@item max-requests |
@item max-requests |
748 |
Sets the maximum number of SNMP requests in the queue. Any |
Sets the maximum number of SNMP requests in the queue. Any |
818 |
|
|
819 |
@cartouche |
@cartouche |
820 |
@example |
@example |
821 |
reached SNMP storage limit for the number of monitored NASes: |
reached SNMP storage limit for the number of |
822 |
increase max-nas-count |
monitored NASes: increase max-nas-count |
823 |
@end example |
@end example |
824 |
@end cartouche |
@end cartouche |
825 |
|
|
830 |
|
|
831 |
@cartouche |
@cartouche |
832 |
@example |
@example |
833 |
reached SNMP storage limit for the number of monitored ports: |
reached SNMP storage limit for the number of |
834 |
increase max-port-count |
monitored ports: increase max-port-count |
835 |
@end example |
@end example |
836 |
@end cartouche |
@end cartouche |
837 |
|
|
899 |
|
|
900 |
@table @code |
@table @code |
901 |
@item gc-interval |
@item gc-interval |
902 |
Sets the interval in seconds between the two successive forced |
Configures the forced garbage collections. By default the invocation |
903 |
garbage collections. Setting this value to @code{0} disables forced |
of the garbage collector is run by the internal Guile mechanism. |
904 |
garbage collections. This is the default. |
However, you may force Radius to trigger the garbage collection |
905 |
|
at fixed time intervals. The @code{gc-interval} statement sets |
906 |
|
such interval in seconds. |
907 |
|
|
908 |
|
For more information about Guile memory management system in general |
909 |
|
and garbage collections in particular, see @ref{Memory Management,,Memory Management and Garbage Collection,guile,The Guile Reference Manual}. |
910 |
|
|
911 |
@end table |
@end table |
912 |
|
|
922 |
it is taken relative to the current logging directory. |
it is taken relative to the current logging directory. |
923 |
@end table |
@end table |
924 |
|
|
925 |
For a detailed description of Guile extensions interface, @xref{Guile}. |
@xref{Guile}, for a detailed description of Guile extensions interface. |
926 |
|
|
927 |
@comment **L3*************************************************************** |
@comment **L3*************************************************************** |
928 |
@node message |
@node message |
987 |
@item realm-quota |
@item realm-quota |
988 |
This message is returned when the user is trying to log in using a |
This message is returned when the user is trying to log in using a |
989 |
realm, and number of users that are currently logged in from this realm |
realm, and number of users that are currently logged in from this realm |
990 |
reaches maximum value. For a description of realms, @xref{Realms}. |
reaches maximum value. For a description of realms, see @ref{Realms}. |
991 |
@item multiple-login |
@item multiple-login |
992 |
This message is returned to the user, who has logged in more than |
This message is returned to the user, who has logged in more than |
993 |
allowed number of times. For description of how to set the maximum |
allowed number of times. For description of how to set the maximum |
1042 |
used in @attr{Exec-Program-Wait} or @attr{Acct-Ext-Program} attributes |
used in @attr{Exec-Program-Wait} or @attr{Acct-Ext-Program} attributes |
1043 |
to trigger invocation of this filter (@pxref{Exec-Program-Wait}). |
to trigger invocation of this filter (@pxref{Exec-Program-Wait}). |
1044 |
|
|
1045 |
|
@subheading Usage |
1046 |
|
|
1047 |
@table @asis |
@table @asis |
1048 |
@item exec-path @var{path} |
@item exec-path @var{path} |
1049 |
Absolute path to the filter program. |
Absolute path to the filter program. |
1084 |
|
|
1085 |
@end table |
@end table |
1086 |
|
|
1087 |
|
|
1088 |
@comment *L2**************************************************************** |
@comment *L2**************************************************************** |
1089 |
@node dictionary file |
@node dictionary file |
1090 |
@section Dictionary of Attributes --- @file{raddb/dictionary} |
@section Dictionary of Attributes --- @file{raddb/dictionary} |
1093 |
|
|
1094 |
The dictionary file @file{raddb/dictionary} defines the symbolic names |
The dictionary file @file{raddb/dictionary} defines the symbolic names |
1095 |
for radius attributes and their values (@pxref{Attributes}). The file consists |
for radius attributes and their values (@pxref{Attributes}). The file consists |
1096 |
of a series of statements. Each statement occupies one line. |
of a series of statements, each statement occupies one line. |
1097 |
|
|
1098 |
In the detailed discussion below we use the following meta-syntactic |
In the detailed discussion below we use the following meta-syntactic |
1099 |
characters: |
characters: |
1121 |
@end table |
@end table |
1122 |
@end table |
@end table |
1123 |
|
|
|
There are following kinds of statements: |
|
|
|
|
1124 |
@menu |
@menu |
1125 |
* Comment:: Introducing a comment line. |
* Comment:: Introducing a comment line. |
1126 |
* $INCLUDE:: Include a file. |
* $INCLUDE:: Include a file. |
1157 |
|
|
1158 |
@subheading Syntax |
@subheading Syntax |
1159 |
@smallexample |
@smallexample |
1160 |
VENDOR Vendor-Name @var{number} |
VENDOR Vendor-Name @var{number} |
1161 |
@end smallexample |
@end smallexample |
1162 |
|
|
1163 |
@subheading Usage |
@subheading Usage |
1167 |
|
|
1168 |
@subheading Example |
@subheading Example |
1169 |
@smallexample |
@smallexample |
1170 |
VENDOR Livingston 307 |
VENDOR Livingston 307 |
1171 |
@end smallexample |
@end smallexample |
1172 |
|
|
1173 |
@comment **L3*************************************************************** |
@comment **L3*************************************************************** |
1180 |
@end smallexample |
@end smallexample |
1181 |
|
|
1182 |
@subheading Usage |
@subheading Usage |
1183 |
The @code{ATTRIBUTE} statement defines the translation for an attribute. |
The @code{ATTRIBUTE} statement defines the internal representation of |
1184 |
|
an attribute: its symbolic name, data type and syntactical usage. |
1185 |
Its parts have the following meaning: |
Its parts have the following meaning: |
1186 |
|
|
1187 |
@table @var |
@table @var |
1248 |
ATTRIBUTE Service-Type 6 integer - [LR-RLR]=P |
ATTRIBUTE Service-Type 6 integer - [LR-RLR]=P |
1249 |
@end smallexample |
@end smallexample |
1250 |
|
|
1251 |
This statement assigns the translation string @samp{Service-Type} to the |
This statement declares that the attribute number 6 will be referred |
1252 |
attribute number 6. It allows the use of this attribute in any part |
to by the symbolic name @samp{Service-Type}. The attribute is of |
1253 |
of matching rules, except in @LHS{} of a @file{raddb/hints} rule. The |
integer data type and it may be used in any part of matching rules, |
1254 |
|
except in @LHS{} of a @file{raddb/hints} rule. The |
1255 |
additivity of @attr{Service-Type} is set to @samp{Replace}. The |
additivity of @attr{Service-Type} is set to @samp{Replace}. The |
1256 |
attribute will be propagated through the proxy chain. |
attribute will be propagated through the proxy chain. |
1257 |
|
|
1277 |
the value 1 of the attribute @samp{Service-Type}. |
the value 1 of the attribute @samp{Service-Type}. |
1278 |
|
|
1279 |
@smallexample |
@smallexample |
1280 |
VALUE Service-Type Login-User 1 |
VALUE Service-Type Login-User 1 |
1281 |
@end smallexample |
@end smallexample |
1282 |
|
|
1283 |
@comment *L2**************************************************************** |
@comment *L2**************************************************************** |
1330 |
|
|
1331 |
The @file{raddb/naslist} file contains a list of @NAS{}es known to the Radius |
The @file{raddb/naslist} file contains a list of @NAS{}es known to the Radius |
1332 |
server. Each record in the file consist of the following four fields, |
server. Each record in the file consist of the following four fields, |
1333 |
the first two being mandatory, the rest being optional: |
the first two being mandatory, the last two being optional: |
1334 |
|
|
1335 |
@table @asis |
@table @asis |
1336 |
@item NAS name |
@item NAS name |
1373 |
@file{nastypes} and can thus be used to override the default |
@file{nastypes} and can thus be used to override the default |
1374 |
values. |
values. |
1375 |
|
|
1376 |
The @dfn{nas-specific} arguments currently implemented are: |
The @dfn{nas-specific} arguments currently implemented are: |
1377 |
|
|
1378 |
@table @asis |
@table @asis |
1379 |
@item broken_pass |
@item broken_pass |
1462 |
Arguments to pass to this method. Each argument is a pair |
Arguments to pass to this method. Each argument is a pair |
1463 |
@var{arg}=@var{value}, where @var{arg} is its name and @var{value} is |
@var{arg}=@var{value}, where @var{arg} is its name and @var{value} is |
1464 |
a value assigned to it. The list of predefined argument names follows. |
a value assigned to it. The list of predefined argument names follows. |
1465 |
@emph{Note}, that no intervening whitespace is allowed in this |
Note, that no intervening whitespace is allowed in this |
1466 |
field. |
field. |
1467 |
@end table |
@end table |
1468 |
|
|
1538 |
@subsection Example of nastypes file. |
@subsection Example of nastypes file. |
1539 |
@exindex @file{nastypes} file |
@exindex @file{nastypes} file |
1540 |
|
|
1541 |
@emph{Note}, that in the following example the long lines are |
Note, that in the following example the long lines are |
1542 |
broken into several lines for readability. |
broken into several lines for readability. |
1543 |
|
|
1544 |
@smallexample |
@smallexample |
1588 |
@end group |
@end group |
1589 |
@end smallexample |
@end smallexample |
1590 |
|
|
1591 |
@emph{Note} the use of @code{broken_pass} flag. It is needed |
Note the use of @code{broken_pass} flag. It is needed |
1592 |
for most MAX Ascend servers (@pxref{naslist file}). |
for most MAX Ascend servers (@pxref{naslist file}). |
1593 |
|
|
1594 |
@item max --- MAX Ascend, answering SNMP |
@item max --- MAX Ascend, answering SNMP |
1791 |
@cindex @file{raddb/users} file |
@cindex @file{raddb/users} file |
1792 |
|
|
1793 |
File @file{raddb/users} contains the list of @dfn{User Profiles}. |
File @file{raddb/users} contains the list of @dfn{User Profiles}. |
1794 |
For a description of its purpose, @xref{User Profiles}. |
@xref{User Profiles}, for a description of its purpose. |
1795 |
|
|
1796 |
@menu |
@menu |
1797 |
* Example: users example. An example of @file{users} file. |
* Example: users example. An example of @file{users} file. |
2118 |
@item |
@item |
2119 |
Radius compares the incoming request with the @LHS{} pairs thus |
Radius compares the incoming request with the @LHS{} pairs thus |
2120 |
obtained. If the comparison fails, it rejects the authentication. |
obtained. If the comparison fails, it rejects the authentication. |
2121 |
@emph{Note} that the @attr{Auth-Type} attributes itself |
Note that the @attr{Auth-Type} attributes itself |
2122 |
triggers execution of @code{auth_query}, described in the previous |
triggers execution of @code{auth_query}, described in the previous |
2123 |
section. |
section. |
2124 |
@item |
@item |