1 |
@c This is part of the Radius manual. |
@c This is part of the GNU Radius manual. |
2 |
@c Copyright (C) 1999,2000,2001 Sergey Poznyakoff |
@c Copyright (C) 2003 Free Software Foundation |
3 |
@c See file radius.texi for copying conditions. |
@c See file radius.texi for copying conditions. |
4 |
@comment ******************************************************************* |
@comment ******************************************************************* |
5 |
@node Operation, Invocation, Naming Conventions, Top |
@node Operation, Invocation, Naming Conventions, Top |
7 |
@cindex @sc{nas} |
@cindex @sc{nas} |
8 |
@cindex Network Access Server |
@cindex Network Access Server |
9 |
|
|
10 |
The main purpose of Radius is to centralize authentication of users coming |
The main purpose of GNU Radius is to centralize authentication of |
11 |
from various network stations. Its primary usage is for dial-in users, |
users coming from various network stations, pursuant to the @RADIUS{} |
12 |
though it can be used for any kind of network connection. |
specification. Its primary usage is for dial-in users, though it can |
13 |
|
be used for any kind of network connection. @xref{Intro} |
|
Radius uses the Client/Server model. The main server keeps the centralized |
|
|
user database. Each user's profile in this database determines which services |
|
|
are allowed for this particular user. |
|
|
|
|
|
The Network Access Server (@NAS{} in short) is a machine that actually provides |
|
|
a service for the user. It can do so, e.g. by running a pool of modems the |
|
|
users can connect to. Otherwise, it can be a machine connected to the network |
|
|
and allowing some form of remote access, like telnet or ssh. It can even be |
|
|
a workstation allowing console logins to it. Whichever service it provides |
|
|
the @NAS{} sends the request to the central Radius server in order to determine |
|
|
whether the user trying to access the service is allowed to do so. Such |
|
|
request carries information about user's login name, password, @NAS{} |
|
|
identifier (such as its @IP{}), etc. |
|
|
|
|
|
On receiving such request Radius server retrieves from its database |
|
|
a profile corresponding to the user's login name. The profile basically |
|
|
consists of two parts: a checklist used for authentication and a reply |
|
|
list used for authorization. The server checks the authenticity of the |
|
|
user using first part of the retrieved profile. If this check succeeds, |
|
|
it uses second part of the profile to authorize the user, i.e. to |
|
|
determine which service he should be provided. Then, the server responds |
|
|
with the parameters of the service, such as connection speed, framed IP |
|
|
address, etc. If any of the described checks had failed, the server sends |
|
|
the negative response. |
|
|
|
|
|
If the server needs some additional information in order to process the |
|
|
request, it asks the @NAS{} to supply such information. Thus, for example, if |
|
|
the user is allowed to use several services, he can be asked which one of |
|
|
them he wishes to use, etc. |
|
|
|
|
|
When @NAS{} receives the positive authentication response, it initiates the |
|
|
connection. |
|
|
|
|
|
The @NAS{} can be configured to notify Radius server about such events as |
|
|
session start, session stop or changing some parameters during the |
|
|
session. It can also notify the server about other events, such as @NAS{} |
|
|
shutdown or startup. This is called @dfn{accounting} and the radius server |
|
|
responsible for processing this information is called an @dfn{accounting |
|
|
server}. The responses to accounting requests carry no attributes. |
|
|
|
|
|
The radius server may fail to receive some incoming requests or may |
|
|
fail to process them due to high server load. In order to prevent |
|
|
such requests from being lost, the @NAS{} retransmits the request |
|
|
if no response from the server is received within a |
|
|
predefined interval of time (a @dfn{timeout} interval). Usually the |
|
|
@NAS{} is configured in such a way that it continues retransmitting |
|
|
failed requests until either it receives a reply from the server |
|
|
or a predefined number of @dfn{retries} expires, whichever occurs first. |
|
|
Furthermore, the @NAS{} may be configured to communicate with a set |
|
|
of @dfn{backup} radius servers. In this case it applies the described |
|
|
process to each server from the set, until some of them responds or |
|
|
the set is exhausted. |
|
14 |
|
|
15 |
@menu |
@menu |
16 |
* Attributes:: Attributes. |
* Attributes:: Attributes. |
29 |
@cindex Propagation of an attribute |
@cindex Propagation of an attribute |
30 |
@cindex Properties of an attribute |
@cindex Properties of an attribute |
31 |
|
|
32 |
The information the Radius requests carry is stored as a list of |
Information carried by @RADIUS{} requests is stored as a list of |
33 |
@dfn{Attribute-Value pairs}. Each pair consists of @dfn{Attribute |
@dfn{Attribute-Value pairs}. Each pair consists of @dfn{Attribute |
34 |
number} and @dfn{Attribute value}. The @dfn{Attribute number} identifies |
number} and @dfn{Attribute value}. The @dfn{Attribute number} identifies |
35 |
the type of information the pair carries and the @dfn{Attribute Value} |
the type of information the pair carries and the @dfn{Attribute Value} |
51 |
integer attributes are given symbolic names. These names are assigned to |
integer attributes are given symbolic names. These names are assigned to |
52 |
attributes and values in the dictionary file @ref{dictionary file}. |
attributes and values in the dictionary file @ref{dictionary file}. |
53 |
|
|
54 |
The attribute numbers range from 1 to 255. The attributes with the numbers |
Attribute numbers range from 1 to 255. Attributes with numbers |
55 |
greater than 255 are used internally by the sever and cannot be sent to |
greater than 255 are used internally by the sever and cannot be sent to |
56 |
the @NAS{}. |
the @NAS{}. |
57 |
|
|
67 |
These flags determine usage of the attribute in configuration |
These flags determine usage of the attribute in configuration |
68 |
files @file{huntgroups}, @file{hints} and @file{users}. |
files @file{huntgroups}, @file{hints} and @file{users}. |
69 |
@item propagation |
@item propagation |
70 |
When a radius server functions in proxy mode, it uses the @dfn{propagation} |
When a @RADIUS{} server functions in proxy mode, it uses the @dfn{propagation |
71 |
bit to determine which attributes from the reply packet should be passed |
bit} to determine which attributes from the reply packet should be passed |
72 |
back to the requesting @NAS{} (@pxref{Proxy Service}). |
back to the requesting @NAS{} (@pxref{Proxy Service}). |
73 |
@item additivity |
@item additivity |
74 |
Some configuration rules may cause addition of new @AVP{}s to the |
Some configuration rules may cause the addition of new @AVP{}s to the |
75 |
incoming request. Before addition of a new pair, @command{radiusd} |
incoming request. Before the addition of a new pair, @radiusd{} |
76 |
scans the request to see if it already contains a pair with the same |
scans the request to see if it already contains a pair with the same |
77 |
attribute. If it does, the value of @dfn{additivity} determines the |
attribute. If it does, the value of @dfn{additivity} determines the |
78 |
further actions: |
further actions: |
88 |
@end table |
@end table |
89 |
@end table |
@end table |
90 |
|
|
91 |
The attributes are declared in @file{raddb/dictionary} file. For a |
The attributes are declared in the @file{raddb/dictionary} file. For a |
92 |
detailed description of it, @xref{ATTRIBUTE}. |
detailed description, @xref{ATTRIBUTE}. |
93 |
For information about particular attributes, @xref{Attribute List}. |
For information about particular attributes, @xref{Attribute List}. |
94 |
|
|
95 |
@comment *L2**************************************************************** |
@comment *L2**************************************************************** |
96 |
@node Requests |
@node Requests |
97 |
@section Radius Requests |
@section @RADIUS{} Requests |
98 |
@cindex Request |
@cindex Request |
99 |
|
|
100 |
The term @dfn{request} means both the authentication/accounting request |
The term @dfn{request} refers to both the authentication/accounting |
101 |
from @NAS{} to a Radius server and the response that the server sends back |
request packet from a @NAS{} to a Radius server and the response |
102 |
to the @NAS{}. |
packet that the server sends back to the @NAS{}. |
103 |
|
|
104 |
Each request contains the following fields |
Each request contains the following fields |
105 |
|
|