6 |
@unnumbered Introduction to Radius |
@unnumbered Introduction to Radius |
7 |
|
|
8 |
GNU Radius is a software package that provides authentication and |
GNU Radius is a software package that provides authentication and |
9 |
accounting services. The acronym @RADIUS{} stands for @dfn{Remote |
accounting services. The acronym @RADIUS{} stands for @dfn{Remote |
10 |
Authentication Dial In User Service} and usually denotes the |
Authentication Dial In User Service} and (in that form) usually denotes the |
11 |
underlying protocol name. |
underlying protocol name. |
12 |
|
|
13 |
Historically, @RADIUS{} servers were used as a means to authenticate the user |
Historically, @RADIUS{} servers were used as a means to authenticate the user |
14 |
coming from a dial-in connection, but GNU Radius is much more than an |
coming from a dial-in connection, but GNU Radius is much more than an |
15 |
authentication system: it is an advanced, customizable and extensible system |
authentication system: it is an advanced, customizable, and extensible system |
16 |
for controlling access to the network. |
for controlling access to the network. |
17 |
|
|
18 |
GNU Radius has several built-in authentication and accounting methods. |
GNU Radius has several built-in authentication and accounting methods. |
19 |
When these methods are not enough, it allows the administrator to implement |
When these methods are not enough, it allows the administrator to implement |
20 |
any new method he deems convenient. |
any new method she deems convenient. |
21 |
|
|
22 |
The GNU Radius package includes the radius server program, |
The GNU Radius package includes the radius server program, |
23 |
@radiusd{}, which responds to authentication and accounting requests, |
@radiusd{}, which responds to authentication and accounting requests, |
32 |
@node Overview |
@node Overview |
33 |
@section Overview |
@section Overview |
34 |
|
|
35 |
To illustrate what GNU Radius does, let's consider an imaginary Internet |
To illustrate what GNU Radius does, let's consider an imaginary internet |
36 |
Service Provider. Our provider has two @dfn{network access servers} |
service provider. Our provider has two @dfn{network access servers} |
37 |
(@NAS{}es for short) --- i.e., two pieces of equipment which directly accept |
(@NAS{}es for short)---i.e., two pieces of equipment which directly accept |
38 |
users' connections --- and a core router which connects the ISP's internal |
users' connections---and a core router that connects the ISP's internal |
39 |
network with the Internet backbone. |
network with the Internet backbone. |
40 |
|
|
41 |
When a user connects to a @NAS{}, the server must verify if the |
When a user connects to a @NAS{}, the server must verify that the |
42 |
user is actually registered and whether the credentials he has |
user is actually registered and that the credentials she has |
43 |
supplied are correct. This first step is called |
supplied are correct. This first step is called |
44 |
@dfn{authentication}. |
@dfn{authentication}. |
45 |
|
|
46 |
Upon authenticating the user, the @NAS{} must determine which services |
Upon authenticating the user, the @NAS{} must determine which services |
47 |
the user is permitted to use and to what extent the user may use |
the user is permitted to use and to what extent the user may use |
48 |
them. This second step is called @dfn{authorization}. |
them. This second step is called @dfn{authorization}. |
49 |
|
|
50 |
When the first two stages have been successfully completed, the @NAS{} |
When the first two stages have been successfully completed, the @NAS{} |
51 |
takes the third step and establishes the connection between the user |
takes the third step and establishes the connection between the user |
52 |
and the main server. This connection is called a @dfn{user session}. |
and the main server. This connection is called a @dfn{user session}. |
53 |
For the purposes of @dfn{accounting}, the @NAS{} remembers the exact |
For the purposes of @dfn{accounting}, the @NAS{} remembers the exact |
54 |
time of the start of the session. When the session is terminated, the |
time of the start of the session. When the session is terminated, the |
55 |
duration of the session and the number of bytes transferred are |
duration of the session and the number of bytes transferred are |
56 |
recorded as well. |
recorded as well. |
57 |
|
|
58 |
All three tasks can be accomplished by the use of user and accounting |
All three tasks can be accomplished by the use of user and accounting |
59 |
databases on each terminal server. However, this is not convenient, |
databases on each terminal server. However, this is not convenient, |
60 |
and it is error prone since the maintenance of separate databases for |
and it is error-prone in that the maintenance of separate databases for |
61 |
the same users is not a trivial task. Even worse, as the number of |
the same users is not a trivial task. What is worse, as the number of |
62 |
terminal servers grows, the more difficult this maintenance problem |
terminal servers grows, this maintenance problem |
63 |
becomes. |
becomes more difficult. |
64 |
|
|
65 |
@subheading How Does @RADIUS{} Solve These Tasks? |
@subheading How Does @RADIUS{} Perform These Tasks? |
66 |
|
|
67 |
@RADIUS{} allows an administrator to keep authentication and |
@RADIUS{} allows an administrator to keep authentication and |
68 |
accounting data in a single place, no matter how many network access |
accounting data in a single place, no matter how many network access |
70 |
communicate with this central server to perform authentication and |
communicate with this central server to perform authentication and |
71 |
accounting, thus easing the burden on the system administrator. |
accounting, thus easing the burden on the system administrator. |
72 |
|
|
73 |
Let's return to our imaginary ISP. Suppose it runs a @RADIUS{} daemon |
Let's return to our imaginary ISP. Suppose it runs a @RADIUS{} daemon |
74 |
on its central server. Each @NAS{} runs @dfn{client software} to |
on its central server. Each @NAS{} runs @dfn{client software} to |
75 |
communicate with the @RADIUS{} server by sending @dfn{radius packets}. |
communicate with the @RADIUS{} server by sending @dfn{radius packets}. |
76 |
|
|
77 |
@c @image{isp} |
@c @image{isp} |
84 |
|
|
85 |
@c @image{authreq} |
@c @image{authreq} |
86 |
|
|
87 |
The @RADIUS{} server verifies user's credentials and finds them |
The @RADIUS{} server verifies the user's credentials and finds them |
88 |
sufficient. It then retrieves the user's authorization information |
sufficient. It then retrieves the user's authorization information |
89 |
from its database, packages it into an @dfn{acknowledgement packet}, |
from its database, packages it into an @dfn{acknowledgement packet}, |
90 |
and then sends it back to the @NAS{} |
and then sends it back to the @NAS{} |
94 |
The @NAS{} receives the acknowledgement packet and starts the user |
The @NAS{} receives the acknowledgement packet and starts the user |
95 |
session. The information brought with the packet tells the @NAS{} to |
session. The information brought with the packet tells the @NAS{} to |
96 |
establish a connection between the core router and the user, and to |
establish a connection between the core router and the user, and to |
97 |
assign the user a certain IP address. Having established the session, |
assign the user a certain IP address. Having established the session, |
98 |
the @NAS{} informs the @RADIUS{} server by sending it an |
the @NAS{} informs the @RADIUS{} server by sending it an |
99 |
@dfn{accounting start packet}. The server acknowledges the receipt of |
@dfn{accounting start packet}. The server acknowledges the receipt of |
100 |
the accounting packet. |
the accounting packet. |
102 |
@c @image{acctstart} |
@c @image{acctstart} |
103 |
|
|
104 |
Now suppose that after some time the user decides to break the |
Now suppose that after some time the user decides to break the |
105 |
connection --- the @NAS{} notices this and terminates the user's |
connection. The @NAS{} notices this and terminates the user's |
106 |
session. The @NAS{} then sends an accounting stop packet to the |
session. The @NAS{} then sends an @dfn{accounting stop packet} to the |
107 |
@RADIUS{} server to mark this event. Again, the server acknowledges |
@RADIUS{} server to mark this event. Again, the server acknowledges |
108 |
the receipt of the packet. |
the receipt of the packet. |
109 |
|
|
110 |
@c @image{acctstop} |
@c @image{acctstop} |
112 |
@subheading @RADIUS{} Attributes |
@subheading @RADIUS{} Attributes |
113 |
|
|
114 |
@dfn{Attributes} are means of passing the information between the |
@dfn{Attributes} are means of passing the information between the |
115 |
@NAS{} and the server. Basically, an attribute is an integer number |
@NAS{} and the server. Basically, an attribute is an integer number |
116 |
that identifies some piece of information. A set of @dfn{properties} |
that identifies some piece of information. A set of @dfn{properties} |
117 |
are associated with each attribute, specifying the way to interpret |
are associated with each attribute, specifying the way to interpret |
118 |
the attribute. The most important property is the @dfn{data type}. The |
the attribute. The most important property is the @dfn{data type}, which |
119 |
data type property declares the type of data that the attribute |
declares the type of data that the attribute |
120 |
identifies (@dfn{character string}, @dfn{integer number}, @dfn{IP |
identifies (@dfn{character string}, @dfn{integer number}, @dfn{IP |
121 |
address}, or @dfn{raw binary data}). |
address}, or @dfn{raw binary data}). |
122 |
|
|
123 |
The information to be transmitted with the request is packaged in a |
The information to be transmitted with the request is packaged in a |
124 |
set of @dfn{Attribute-value pairs} (or @AVP{}s for short). Such pairs |
set of @dfn{attribute-value pairs} (or @AVP{}s for short). Such pairs |
125 |
consist of attribute numbers and the associated data. |
consist of attribute numbers and the associated data. |
126 |
|
|
127 |
@subheading @RADIUS{} Packets |
@subheading @RADIUS{} Packets |
128 |
|
|
129 |
There exist two basic kinds of @RADIUS{} packets: authentication and |
There exist two basic kinds of @RADIUS{} packets: authentication and |
130 |
accounting packets. Each of them is subdivided into @dfn{requests} and |
accounting packets. Each of them is subdivided into @dfn{requests} and |
131 |
@dfn{replies}. |
@dfn{replies}. |
132 |
|
|
133 |
@dfn{Authentication requests} are sent from the @NAS{} to the |
@dfn{Authentication requests} are sent from the @NAS{} to the |
134 |
@RADIUS{} server and contain the information necessary to check the |
@RADIUS{} server and contain the information necessary to check the |
135 |
identity of the user. The minimum set of data in such packets are: |
identity of the user. The minimum set of data in such packets |
136 |
user login name, user password, and @NAS{} @IP{} or identifier. |
consists of the |
137 |
|
user login name, user password, and @NAS{} IP or identifier. |
138 |
|
|
139 |
@dfn{Authentication replies} are sent by the @RADIUS{} server and |
@dfn{Authentication replies} are sent by the @RADIUS{} server and |
140 |
contain the reply code and a set of additional attributes. By their |
contain the reply code and a set of additional attributes. According |
141 |
|
to their |
142 |
reply code the authentication replies are subdivided into |
reply code the authentication replies are subdivided into |
143 |
@dfn{authentication acknowlegements}, @dfn{authentication rejections}, |
@dfn{authentication acknowledgements}, @dfn{authentication rejections}, |
144 |
and @dfn{authentication challenges}. |
and @dfn{authentication challenges}. |
145 |
|
|
146 |
An authentication acknowledgement packet is sent to the @NAS{} if the |
An authentication acknowledgement packet is sent to the @NAS{} if the |
147 |
credentials supplied with the authentication request were |
credentials supplied with the authentication request were |
148 |
correct. This kind of packet tells the @NAS{} to establish the normal |
correct. This kind of packet tells the @NAS{} to establish a normal |
149 |
user session. The additional attributes in such packets are carrying |
user session. The additional attributes in such packets carry |
150 |
the @dfn{authorization data}, i.e. they determine which kind of |
the @dfn{authorization data}, i.e., they determine which kind of |
151 |
service the user is to be provided. |
service the user is to be provided. |
152 |
|
|
153 |
An authentication rejection is sent to the @NAS{} if the authentication |
An authentication rejection is sent to the @NAS{} if the |
154 |
failed. This packet forbids the @NAS{} from providing any service to |
authentication has |
155 |
|
failed. This packet forbids the @NAS{} to provide any service to |
156 |
the user. The additional attributes may carry descriptive text to be |
the user. The additional attributes may carry descriptive text to be |
157 |
displayed as an explanation to the user for the failed request for |
displayed as an explanation to the user for the failure of his request. |
|
services. |
|
158 |
|
|
159 |
Finally, an authentication challenge packet is sent to the @NAS{} if |
Finally, an authentication challenge packet is sent to the @NAS{} if |
160 |
the supplied credentials did not suffice to establish the authenticity |
the supplied credentials did not suffice to establish the authenticity |
161 |
of the user. This means that the dialog between the @NAS{} and the |
of the user. This means that the dialog between the @NAS{} and the |
162 |
@RADIUS{} server continues. As the @RADIUS{} server asks for |
@RADIUS{} server continues. As the @RADIUS{} server asks for |
163 |
additional authentication credentials, the @NAS{} acts as a |
additional authentication credentials, the @NAS{} acts as a |
164 |
liaison, passing server requests to the user and sending user |
liaison, passing server requests to the user and sending user |
165 |
replies back to the server. Such a dialog ends when the @RADIUS{} server sends |
replies back to the server. Such a dialog ends when the @RADIUS{} |
166 |
|
server sends |
167 |
either an acknowledgement packet or a rejection packet. |
either an acknowledgement packet or a rejection packet. |
168 |
|
|
169 |
An @dfn{accounting request} is sent to the server when the @NAS{} |
An @dfn{accounting request} is sent to the server when the @NAS{} |
170 |
wishes to report some event in the user session, e.g. start of the |
wishes to report some event in the user session: the start of the |
171 |
session, session termination, etc. The attributes carry the actual |
session, session termination, etc. The attributes carry the actual |
172 |
information about the event. |
information about the event. |
173 |
|
|
174 |
For each accounting request that has been received and successfully |
For each accounting request that has been received and successfully |
175 |
processed, the @RADIUS{} server sends back an @dfn{accounting |
processed, the @RADIUS{} server sends back an @dfn{accounting |
176 |
acknowlegement}. This packet carries no attributes, but simply informs |
acknowledgement}. This packet carries no attributes, but simply informs |
177 |
the @NAS{} that the information it had sent was received. |
the @NAS{} that the information it had sent was received. |
178 |
|
|
179 |
Occasionally, a @RADIUS{} server may fail to receive incoming requests or may |
Occasionally, a @RADIUS{} server may fail to receive incoming requests or may |
180 |
fail to process them due to high server load. In order to prevent |
fail to process them due to high server load. In order to prevent |
181 |
such requests from being lost, the @NAS{} retransmits the request |
such requests from being lost, the @NAS{} retransmits the request |
182 |
if no response from the server is received within a |
if no response from the server is received within a |
183 |
predefined interval of time (a @dfn{timeout} interval). Usually the |
predefined interval of time (a @dfn{timeout} interval). Usually the |
184 |
@NAS{} is configured in such a way that it continues retransmitting |
@NAS{} is configured in such a way that it continues retransmitting |
185 |
failed requests until either it receives a reply from the server |
failed requests until either it receives a reply from the server |
186 |
or until a predefined number of @dfn{retries} are exhausted, whichever occurs first. Furthermore, a @NAS{} may be configured to communicate with a set |
or a predefined number of @dfn{retries} are exhausted, whichever |
187 |
of @dfn{backup} @RADIUS{} servers. In this case it applies the described |
occurs first. Furthermore, a @NAS{} may be configured to communicate |
188 |
|
with a set |
189 |
|
of @dfn{backup} @RADIUS{} servers. In this case it applies the described |
190 |
process to each server from the set, until one of them responds or |
process to each server from the set, until one of them responds or |
191 |
the set is exhausted. |
the set is exhausted. |
192 |
|
|
198 |
|
|
199 |
@table @asis |
@table @asis |
200 |
|
|
201 |
@item @RADIUS{} |
@item @RADIUS{} (small capitals) |
202 |
(All capitals) The Remote Authentication Dial In User Service |
The Remote Authentication Dial In User Service |
203 |
protocol as described in RFC 2138, 2865 and 2866. |
protocol as described in RFC 2138, 2865, and 2866. |
204 |
|
|
205 |
@cindex @sc{nas} |
@cindex @sc{nas} |
206 |
@cindex Network Access Server |
@cindex Network Access Server |
207 |
@item @NAS{} |
@item @NAS{} |
208 |
@NAS{} stands for Network Access Server. It is a computer or a special device |
A network access server, that is, a computer or a special device |
209 |
designed to provide access to the network. For example, it can be a |
designed to provide access to the network. For example, it can be a |
210 |
computer connected to the network and equipped with several modems. Such |
computer connected to the network and equipped with several modems. |
211 |
@NAS{} would allow the user connecting to one of its modems to access the |
Such a |
212 |
|
@NAS{} will allow a user connecting to one of its modems to access the |
213 |
network. |
network. |
214 |
|
|
215 |
@cindex Service |
@cindex Service |
216 |
@item Service |
@item Service |
217 |
A service, such as PPP, SLIP, telnet, etc., provided to a user by the @NAS{}. |
A service, such as PPP, SLIP, or telnet, provided to a user by the @NAS{}. |
218 |
|
|
219 |
@cindex Session |
@cindex Session |
220 |
@item Session |
@item Session |
221 |
Each instance of a service. Sessions start when the service is |
Each instance of a service. Sessions start when the service is |
222 |
first provided and close when the service is ended. A user may have multiple |
first provided and close when the service is ended. A user may be |
223 |
sessions active simultaneously if he is allowed to. |
allowed to have multiple |
224 |
|
sessions active simultaneously. |
225 |
|
|
226 |
@cindex Session ID |
@cindex Session ID |
227 |
@item Session @sc{id} |
@item Session @sc{id} |
228 |
Session Identifier. A string of characters uniquely identifying the session. |
The session identifier: a string of characters uniquely identifying the session. |
229 |
|
|
230 |
@cindex A/V pair |
@cindex @AVP{} |
231 |
@cindex Attribute |
@cindex Attribute |
232 |
@cindex Attribute-Value pair |
@cindex Attribute-Value pair |
233 |
@item A/V pair |
@item @AVP{} |
234 |
Stands for Attribute-Value pair @ref{Attributes}. |
Attribute-value pair: see @ref{Attributes}. |
235 |
|
|
236 |
@cindex Dial-In user |
@cindex Dial-in user |
237 |
@cindex Dial-Up user |
@cindex Dial-up user |
238 |
@item Dial-In or Dial-Up user |
@item Dial-in or dial-up user |
239 |
A user connecting to a service through the modem line. |
A user connecting to a service through the modem line. |
240 |
|
|
241 |
@item User Database |
@item User database |
242 |
A database where a @RADIUS{} server keeps information about users, their |
A database where a @RADIUS{} server keeps information about users, their |
243 |
authentication information, etc. |
authentication information, etc. |
244 |
|
|
245 |
@item User's Profile |
@item User's profile |
246 |
A record in the User Database describing a particular user. The User's |
A record in the user database describing a particular user for |
247 |
Profile keeps the authentication and authorization information for |
purposes of authentication and authorization, i.e., how the user should |
|
that user, i.e. it contains data describing how this user should |
|
248 |
be authenticated as well as which services he is allowed to be |
be authenticated as well as which services he is allowed to be |
249 |
provided and parameters of these services. |
provided and parameters of these services. |
250 |
|
|