163 |
@kwindex process-idle-timeout |
@kwindex process-idle-timeout |
164 |
@kwindex master-read-timeout |
@kwindex master-read-timeout |
165 |
@kwindex master-write-timeout |
@kwindex master-write-timeout |
166 |
|
@kwindex radiusd-user |
167 |
@kwindex exec-program-user |
@kwindex exec-program-user |
168 |
@kwindex username-chars |
@kwindex username-chars |
169 |
@kwindex log-dir |
@kwindex log-dir |
176 |
option @{ |
option @{ |
177 |
[ source-ip @var{number} ; ] |
[ source-ip @var{number} ; ] |
178 |
[ max-requests @var{number} ; ] |
[ max-requests @var{number} ; ] |
179 |
|
[ radiusd-user @var{string} ; ] |
180 |
[ exec-program-user @var{string} ; ] |
[ exec-program-user @var{string} ; ] |
181 |
[ username-chars @var{string} ; ] |
[ username-chars @var{string} ; ] |
182 |
[ log-dir @var{string} ; ] |
[ log-dir @var{string} ; ] |
242 |
|
|
243 |
@subheading String statements |
@subheading String statements |
244 |
@table @code |
@table @code |
245 |
@item exec-program-user |
@item radiusd-user |
246 |
Sets effective user id for the programs executed as a result of |
Instructs @command{radiusd} to drop root privileges and to switch to |
247 |
@attr{Exec-Program} and @attr{Exec-Program-Wait}. The effective |
the real user and group IDs of the given user after becoming |
248 |
group id will be retrieved from the @file{/etc/passwd} entry |
daemon. Notice the following implications of this statement: |
249 |
|
|
250 |
|
@enumerate 1 |
251 |
|
@item All configuration files must be readable for this user. |
252 |
|
@item Authentication type @code{System} (@pxref{System Auth}) requires |
253 |
|
root privileges, so it cannot be used with @code{radiusd-user}. Any |
254 |
|
@file{raddb/users} profiles using this authentication type will be |
255 |
|
discarded. |
256 |
|
@item Authentication type @code{PAM} (@pxref{PAM Auth}) may require root |
257 |
|
provileges. It is reported to always require root privileges on some |
258 |
|
systems (notably on Solaris). |
259 |
|
@item @code{exec-program-user} statement (see below) is ignored when |
260 |
|
used with @code{radiusd-user}. |
261 |
|
@end enumerate |
262 |
|
|
263 |
|
@item exec-program-user |
264 |
|
Sets the privileges for the programs executed as a result of |
265 |
|
@attr{Exec-Program} and @attr{Exec-Program-Wait}. The real user |
266 |
|
and group ids will be retrieved from the @file{/etc/passwd} entry |
267 |
for the given user. |
for the given user. |
268 |
|
|
269 |
@item username-chars |
@item username-chars |