/[radius]/radius/doc/texinfo/intro.texi
ViewVC logotype

Diff of /radius/doc/texinfo/intro.texi

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.9 by dbarowy, Tue Feb 4 02:12:04 2003 UTC revision 1.10 by gray, Sat May 17 21:03:26 2003 UTC
# Line 6  Line 6 
6  @unnumbered Introduction to Radius  @unnumbered Introduction to Radius
7    
8  GNU Radius is a software package that provides authentication and  GNU Radius is a software package that provides authentication and
9  accounting services. The acronym @RADIUS{} stands for @dfn{Remote  accounting services.  The acronym @RADIUS{} stands for @dfn{Remote
10  Authentication Dial In User Service} and usually denotes the  Authentication Dial In User Service} and (in that form) usually denotes the
11  underlying protocol name.  underlying protocol name.
12    
13  Historically, @RADIUS{} servers were used as a means to authenticate the user  Historically, @RADIUS{} servers were used as a means to authenticate the user
14  coming from a dial-in connection, but GNU Radius is much more than an  coming from a dial-in connection, but GNU Radius is much more than an
15  authentication system: it is an advanced, customizable and extensible system  authentication system: it is an advanced, customizable, and extensible system
16  for controlling access to the network.  for controlling access to the network.
17    
18  GNU Radius has several built-in authentication and accounting methods.  GNU Radius has several built-in authentication and accounting methods.
19  When these methods are not enough, it allows the administrator to implement  When these methods are not enough, it allows the administrator to implement
20  any new method he deems convenient.  any new method she deems convenient.
21    
22  The GNU Radius package includes the radius server program,  The GNU Radius package includes the radius server program,
23  @radiusd{}, which responds to authentication and accounting requests,  @radiusd{}, which responds to authentication and accounting requests,
# Line 32  the server and analyze the information i Line 32  the server and analyze the information i
32  @node Overview  @node Overview
33  @section Overview  @section Overview
34    
35  To illustrate what GNU Radius does, let's consider an imaginary Internet  To illustrate what GNU Radius does, let's consider an imaginary internet
36  Service Provider. Our provider has two @dfn{network access servers}  service provider.  Our provider has two @dfn{network access servers}
37  (@NAS{}es for short) --- i.e., two pieces of equipment which directly accept  (@NAS{}es for short)---i.e., two pieces of equipment which directly accept
38  users' connections ---  and a core router which connects the ISP's internal  users' connections---and a core router that connects the ISP's internal
39  network with the Internet backbone.  network with the Internet backbone.
40    
41  When a user connects to a @NAS{}, the server must verify if the  When a user connects to a @NAS{}, the server must verify that the
42  user is actually registered and whether the credentials he has  user is actually registered and that the credentials she has
43  supplied are correct. This first step is called  supplied are correct.  This first step is called
44  @dfn{authentication}.  @dfn{authentication}.
45    
46  Upon authenticating the user, the @NAS{} must determine which services  Upon authenticating the user, the @NAS{} must determine which services
47  the user is permitted to use and to what extent the user may use  the user is permitted to use and to what extent the user may use
48  them. This second step is called @dfn{authorization}.  them.  This second step is called @dfn{authorization}.
49    
50  When the first two stages have been successfully completed, the @NAS{}  When the first two stages have been successfully completed, the @NAS{}
51  takes the third step and establishes the connection between the user  takes the third step and establishes the connection between the user
52  and the main server. This connection is called a @dfn{user session}.  and the main server.  This connection is called a @dfn{user session}.
53  For the purposes of @dfn{accounting}, the @NAS{} remembers the exact  For the purposes of @dfn{accounting}, the @NAS{} remembers the exact
54  time of the start of the session.  When the session is terminated, the  time of the start of the session.  When the session is terminated, the
55  duration of the session and the number of bytes transferred are  duration of the session and the number of bytes transferred are
56  recorded as well.  recorded as well.
57    
58  All three tasks can be accomplished by the use of user and accounting  All three tasks can be accomplished by the use of user and accounting
59  databases on each terminal server. However, this is not convenient,  databases on each terminal server.  However, this is not convenient,
60  and it is error prone since the maintenance of separate databases for  and it is error-prone in that the maintenance of separate databases for
61  the same users is not a trivial task. Even worse, as the number of  the same users is not a trivial task.  What is worse, as the number of
62  terminal servers grows, the more difficult this maintenance problem  terminal servers grows, this maintenance problem
63  becomes.  becomes more difficult.
64    
65  @subheading How Does @RADIUS{} Solve These Tasks?  @subheading How Does @RADIUS{} Perform These Tasks?
66    
67  @RADIUS{} allows an administrator to keep authentication and  @RADIUS{} allows an administrator to keep authentication and
68  accounting data in a single place, no matter how many network access  accounting data in a single place, no matter how many network access
# Line 70  servers are actually present.  Using @RA Line 70  servers are actually present.  Using @RA
70  communicate with this central server to perform authentication and  communicate with this central server to perform authentication and
71  accounting, thus easing the burden on the system administrator.  accounting, thus easing the burden on the system administrator.
72    
73  Let's return to our imaginary ISP. Suppose it runs a @RADIUS{} daemon  Let's return to our imaginary ISP.  Suppose it runs a @RADIUS{} daemon
74  on its central server. Each @NAS{} runs @dfn{client software} to  on its central server.  Each @NAS{} runs @dfn{client software} to
75  communicate with the @RADIUS{} server by sending @dfn{radius packets}.  communicate with the @RADIUS{} server by sending @dfn{radius packets}.
76    
77  @c @image{isp}  @c @image{isp}
# Line 84  the @RADIUS{} server. Line 84  the @RADIUS{} server.
84    
85  @c @image{authreq}  @c @image{authreq}
86    
87  The @RADIUS{} server verifies user's credentials and finds them  The @RADIUS{} server verifies the user's credentials and finds them
88  sufficient.  It then retrieves the user's authorization information  sufficient.  It then retrieves the user's authorization information
89  from its database, packages it into an @dfn{acknowledgement packet},  from its database, packages it into an @dfn{acknowledgement packet},
90  and then sends it back to the @NAS{}  and then sends it back to the @NAS{}
# Line 94  and then sends it back to the @NAS{} Line 94  and then sends it back to the @NAS{}
94  The @NAS{} receives the acknowledgement packet and starts the user  The @NAS{} receives the acknowledgement packet and starts the user
95  session.  The information brought with the packet tells the @NAS{} to  session.  The information brought with the packet tells the @NAS{} to
96  establish a connection between the core router and the user, and to  establish a connection between the core router and the user, and to
97  assign the user a certain IP address. Having established the session,  assign the user a certain IP address.  Having established the session,
98  the @NAS{} informs the @RADIUS{} server by sending it an  the @NAS{} informs the @RADIUS{} server by sending it an
99  @dfn{accounting start packet}.  The server acknowledges the receipt of  @dfn{accounting start packet}.  The server acknowledges the receipt of
100  the accounting packet.  the accounting packet.
# Line 102  the accounting packet. Line 102  the accounting packet.
102  @c @image{acctstart}  @c @image{acctstart}
103    
104  Now suppose that after some time the user decides to break the  Now suppose that after some time the user decides to break the
105  connection --- the @NAS{} notices this and terminates the user's  connection.  The @NAS{} notices this and terminates the user's
106  session. The @NAS{} then sends an accounting stop packet to the  session.  The @NAS{} then sends an @dfn{accounting stop packet} to the
107  @RADIUS{} server to mark this event. Again, the server acknowledges  @RADIUS{} server to mark this event.  Again, the server acknowledges
108  the receipt of the packet.  the receipt of the packet.
109    
110  @c @image{acctstop}  @c @image{acctstop}
# Line 112  the receipt of the packet. Line 112  the receipt of the packet.
112  @subheading @RADIUS{} Attributes  @subheading @RADIUS{} Attributes
113    
114  @dfn{Attributes} are means of passing the information between the  @dfn{Attributes} are means of passing the information between the
115  @NAS{} and the server. Basically, an attribute is an integer number  @NAS{} and the server.  Basically, an attribute is an integer number
116  that identifies some piece of information. A set of @dfn{properties}  that identifies some piece of information.  A set of @dfn{properties}
117  are associated with each attribute, specifying the way to interpret  are associated with each attribute, specifying the way to interpret
118  the attribute. The most important property is the @dfn{data type}. The  the attribute.  The most important property is the @dfn{data type}, which
119  data type property declares the type of data that the attribute  declares the type of data that the attribute
120  identifies (@dfn{character string}, @dfn{integer number}, @dfn{IP  identifies (@dfn{character string}, @dfn{integer number}, @dfn{IP
121  address}, or @dfn{raw binary data}).  address}, or @dfn{raw binary data}).
122    
123  The information to be transmitted with the request is packaged in a  The information to be transmitted with the request is packaged in a
124  set of @dfn{Attribute-value pairs} (or @AVP{}s for short).  Such pairs  set of @dfn{attribute-value pairs} (or @AVP{}s for short).  Such pairs
125  consist of attribute numbers and the associated data.  consist of attribute numbers and the associated data.
126    
127  @subheading @RADIUS{} Packets  @subheading @RADIUS{} Packets
128    
129  There exist two basic kinds of @RADIUS{} packets: authentication and  There exist two basic kinds of @RADIUS{} packets: authentication and
130  accounting packets. Each of them is subdivided into @dfn{requests} and  accounting packets.  Each of them is subdivided into @dfn{requests} and
131  @dfn{replies}.  @dfn{replies}.
132    
133  @dfn{Authentication requests} are sent from the @NAS{} to the  @dfn{Authentication requests} are sent from the @NAS{} to the
134  @RADIUS{} server and contain the information necessary to check the  @RADIUS{} server and contain the information necessary to check the
135  identity of the user. The minimum set of data in such packets are:  identity of the user.  The minimum set of data in such packets
136  user login name, user password, and @NAS{} @IP{} or identifier.  consists of the
137    user login name, user password, and @NAS{} IP or identifier.
138    
139  @dfn{Authentication replies} are sent by the @RADIUS{} server and  @dfn{Authentication replies} are sent by the @RADIUS{} server and
140  contain the reply code and a set of additional attributes. By their  contain the reply code and a set of additional attributes.  According
141    to their
142  reply code the authentication replies are subdivided into  reply code the authentication replies are subdivided into
143  @dfn{authentication acknowlegements}, @dfn{authentication rejections},  @dfn{authentication acknowledgements}, @dfn{authentication rejections},
144  and @dfn{authentication challenges}.  and @dfn{authentication challenges}.
145    
146  An authentication acknowledgement packet is sent to the @NAS{} if the  An authentication acknowledgement packet is sent to the @NAS{} if the
147  credentials supplied with the authentication request were  credentials supplied with the authentication request were
148  correct. This kind of packet tells the @NAS{} to establish the normal  correct.  This kind of packet tells the @NAS{} to establish a normal
149  user session. The additional attributes in such packets are carrying  user session.  The additional attributes in such packets carry
150  the @dfn{authorization data}, i.e.  they determine which kind of  the @dfn{authorization data}, i.e., they determine which kind of
151  service the user is to be provided.  service the user is to be provided.
152    
153  An authentication rejection is sent to the @NAS{} if the authentication  An authentication rejection is sent to the @NAS{} if the
154  failed. This packet forbids the @NAS{} from providing any service to  authentication has
155    failed.  This packet forbids the @NAS{} to provide any service to
156  the user.  The additional attributes may carry descriptive text to be  the user.  The additional attributes may carry descriptive text to be
157  displayed as an explanation to the user for the failed request for  displayed as an explanation to the user for the failure of his request.
 services.  
158    
159  Finally, an authentication challenge packet is sent to the @NAS{} if  Finally, an authentication challenge packet is sent to the @NAS{} if
160  the supplied credentials did not suffice to establish the authenticity  the supplied credentials did not suffice to establish the authenticity
161  of the user. This means that the dialog between the @NAS{} and the  of the user.  This means that the dialog between the @NAS{} and the
162  @RADIUS{} server continues.  As the @RADIUS{} server asks for  @RADIUS{} server continues.  As the @RADIUS{} server asks for
163  additional authentication credentials, the @NAS{} acts as a  additional authentication credentials, the @NAS{} acts as a
164  liaison, passing server requests to the user and sending user  liaison, passing server requests to the user and sending user
165  replies back to the server. Such a dialog ends when the @RADIUS{} server sends  replies back to the server.  Such a dialog ends when the @RADIUS{}
166    server sends
167  either an acknowledgement packet or a rejection packet.  either an acknowledgement packet or a rejection packet.
168    
169  An @dfn{accounting request} is sent to the server when the @NAS{}  An @dfn{accounting request} is sent to the server when the @NAS{}
170  wishes to report some event in the user session, e.g. start of the  wishes to report some event in the user session: the start of the
171  session, session termination, etc. The attributes carry the actual  session, session termination, etc.  The attributes carry the actual
172  information about the event.  information about the event.
173    
174  For each accounting request that has been received and successfully  For each accounting request that has been received and successfully
175  processed, the @RADIUS{} server sends back an @dfn{accounting  processed, the @RADIUS{} server sends back an @dfn{accounting
176  acknowlegement}. This packet carries no attributes, but simply informs  acknowledgement}.  This packet carries no attributes, but simply informs
177  the @NAS{} that the information it had sent was received.  the @NAS{} that the information it had sent was received.
178    
179  Occasionally, a @RADIUS{} server may fail to receive incoming requests or may  Occasionally, a @RADIUS{} server may fail to receive incoming requests or may
180  fail to process them due to high server load. In order to prevent  fail to process them due to high server load.  In order to prevent
181  such requests from being lost, the @NAS{} retransmits the request  such requests from being lost, the @NAS{} retransmits the request
182  if no response from the server is received within a  if no response from the server is received within a
183  predefined interval of time (a @dfn{timeout} interval). Usually the  predefined interval of time (a @dfn{timeout} interval).  Usually the
184  @NAS{} is configured in such a way that it continues retransmitting  @NAS{} is configured in such a way that it continues retransmitting
185  failed requests until either it receives a reply from the server  failed requests until either it receives a reply from the server
186  or until a predefined number of @dfn{retries} are exhausted, whichever occurs first.  Furthermore, a @NAS{} may be configured to communicate with a set  or a predefined number of @dfn{retries} are exhausted, whichever
187  of @dfn{backup} @RADIUS{} servers. In this case it applies the described  occurs first.  Furthermore, a @NAS{} may be configured to communicate
188    with a set
189    of @dfn{backup} @RADIUS{} servers.  In this case it applies the described
190  process to each server from the set, until one of them responds or  process to each server from the set, until one of them responds or
191  the set is exhausted.  the set is exhausted.
192    
# Line 193  Throughout this document the following t Line 198  Throughout this document the following t
198    
199  @table @asis  @table @asis
200    
201  @item @RADIUS{}  @item @RADIUS{} (small capitals)
202  (All capitals) The Remote Authentication Dial In User Service  The Remote Authentication Dial In User Service
203  protocol as described in RFC 2138, 2865 and 2866.  protocol as described in RFC 2138, 2865, and 2866.
204    
205  @cindex @sc{nas}  @cindex @sc{nas}
206  @cindex Network Access Server  @cindex Network Access Server
207  @item @NAS{}  @item @NAS{}
208  @NAS{} stands for Network Access Server. It is a computer or a special device  A network access server, that is, a computer or a special device
209  designed to provide access to the network. For example, it can be a  designed to provide access to the network.  For example, it can be a
210  computer connected to the network and equipped with several modems. Such  computer connected to the network and equipped with several modems.
211  @NAS{} would allow the user connecting to one of its modems to access the  Such a
212    @NAS{} will allow a user connecting to one of its modems to access the
213  network.  network.
214    
215  @cindex Service  @cindex Service
216  @item Service  @item Service
217  A service, such as PPP, SLIP, telnet, etc., provided to a user by the @NAS{}.  A service, such as PPP, SLIP, or telnet, provided to a user by the @NAS{}.
218    
219  @cindex Session  @cindex Session
220  @item Session  @item Session
221  Each instance of a service. Sessions start when the service is  Each instance of a service.  Sessions start when the service is
222  first provided and close when the service is ended. A user may have multiple  first provided and close when the service is ended.  A user may be
223  sessions active simultaneously if he is allowed to.  allowed to have multiple
224    sessions active simultaneously.
225    
226  @cindex Session ID  @cindex Session ID
227  @item Session @sc{id}  @item Session @sc{id}
228  Session Identifier. A string of characters uniquely identifying the session.  The session identifier: a string of characters uniquely identifying the session.
229    
230  @cindex A/V pair  @cindex @AVP{}
231  @cindex Attribute  @cindex Attribute
232  @cindex Attribute-Value pair  @cindex Attribute-Value pair
233  @item A/V pair  @item @AVP{}
234  Stands for Attribute-Value pair @ref{Attributes}.  Attribute-value pair: see @ref{Attributes}.
235    
236  @cindex Dial-In user  @cindex Dial-in user
237  @cindex Dial-Up user  @cindex Dial-up user
238  @item Dial-In or Dial-Up user  @item Dial-in or dial-up user
239  A user connecting to a service through the modem line.  A user connecting to a service through the modem line.
240    
241  @item User Database  @item User database
242  A database where a @RADIUS{} server keeps information about users, their  A database where a @RADIUS{} server keeps information about users, their
243  authentication information, etc.  authentication information, etc.
244    
245  @item User's Profile  @item User's profile
246  A record in the User Database describing a particular user. The User's  A record in the user database describing a particular user for
247  Profile keeps the authentication and authorization information for  purposes of authentication and authorization, i.e., how the user should
 that user, i.e. it contains data describing how this user should  
248  be authenticated as well as which services he is allowed to be  be authenticated as well as which services he is allowed to be
249  provided and parameters of these services.  provided and parameters of these services.
250    

Legend:
Removed from v.1.9  
changed lines
  Added in v.1.10

savannah-hackers-public@gnu.org
ViewVC Help
Powered by ViewVC 1.1.26