/[radius]/radius/doc/texinfo/operation.texi
ViewVC logotype

Diff of /radius/doc/texinfo/operation.texi

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.15 by gray, Thu Dec 26 15:55:51 2002 UTC revision 1.16 by dbarowy, Tue Feb 4 02:10:29 2003 UTC
# Line 1  Line 1 
1  @c This is part of the Radius manual.  @c This is part of the GNU Radius manual.
2  @c Copyright (C) 1999,2000,2001 Sergey Poznyakoff  @c Copyright (C) 2003 Free Software Foundation
3  @c See file radius.texi for copying conditions.  @c See file radius.texi for copying conditions.
4  @comment *******************************************************************  @comment *******************************************************************
5  @node Operation, Invocation, Naming Conventions, Top  @node Operation, Invocation, Naming Conventions, Top
# Line 7  Line 7 
7  @cindex @sc{nas}  @cindex @sc{nas}
8  @cindex Network Access Server  @cindex Network Access Server
9    
10  The main purpose of Radius is to centralize authentication of users coming  The main purpose of GNU Radius is to centralize authentication of
11  from various network stations. Its primary usage is for dial-in users,  users coming from various network stations, pursuant to the @RADIUS{}
12  though it can be used for any kind of network connection.  specification. Its primary usage is for dial-in users, though it can
13    be used for any kind of network connection.  @xref{Intro}
 Radius uses the Client/Server model. The main server keeps the centralized  
 user database. Each user's profile in this database determines which services  
 are allowed for this particular user.  
   
 The Network Access Server (@NAS{} in short) is a machine that actually provides  
 a service for the user. It can do so, e.g. by running a pool of modems the  
 users can connect to. Otherwise, it can be a machine connected to the network  
 and allowing some form of remote access, like telnet or ssh. It can even be  
 a workstation allowing console logins to it. Whichever service it provides  
 the @NAS{} sends the request to the central Radius server in order to determine  
 whether the user trying to access the service is allowed to do so. Such  
 request carries information about user's login name, password, @NAS{}  
 identifier (such as its @IP{}), etc.  
   
 On receiving such request Radius server retrieves from its database  
 a profile corresponding to the user's login name. The profile basically  
 consists of two parts: a checklist used for authentication and a reply  
 list used for authorization. The server checks the authenticity of the  
 user using first part of the retrieved profile. If this check succeeds,  
 it uses second part of the profile to authorize the user, i.e. to  
 determine which service he should be provided. Then, the server responds  
 with the parameters of the service, such as connection speed, framed IP  
 address, etc. If any of the described checks had failed, the server sends  
 the negative response.  
   
 If the server needs some additional information in order to process the  
 request, it asks the @NAS{} to supply such information. Thus, for example, if  
 the user is allowed to use several services, he can be asked which one of  
 them he wishes to use, etc.  
   
 When @NAS{} receives the positive authentication response, it initiates the  
 connection.  
   
 The @NAS{} can be configured to notify Radius server about such events as  
 session start, session stop or changing some parameters during the  
 session. It can also notify the server about other events, such as @NAS{}  
 shutdown or startup. This is called @dfn{accounting} and the radius server  
 responsible for processing this information is called an @dfn{accounting  
 server}. The responses to accounting requests carry no attributes.  
   
 The radius server may fail to receive some incoming requests or may  
 fail to process them due to high server load. In order to prevent  
 such requests from being lost, the @NAS{} retransmits the request  
 if no response from the server is received within a  
 predefined interval of time (a @dfn{timeout} interval). Usually the  
 @NAS{} is configured in such a way that it continues retransmitting  
 failed requests until either it receives a reply from the server  
 or a predefined number of @dfn{retries} expires, whichever occurs first.  
 Furthermore, the @NAS{} may be configured to communicate with a set  
 of @dfn{backup} radius servers. In this case it applies the described  
 process to each server from the set, until some of them responds or  
 the set is exhausted.  
14    
15  @menu  @menu
16  * Attributes::                  Attributes.  * Attributes::                  Attributes.
# Line 81  the set is exhausted. Line 29  the set is exhausted.
29  @cindex Propagation of an attribute  @cindex Propagation of an attribute
30  @cindex Properties of an attribute  @cindex Properties of an attribute
31    
32  The information the Radius requests carry is stored as a list of  Information carried by @RADIUS{} requests is stored as a list of
33  @dfn{Attribute-Value pairs}. Each pair consists of @dfn{Attribute  @dfn{Attribute-Value pairs}. Each pair consists of @dfn{Attribute
34  number} and @dfn{Attribute value}. The @dfn{Attribute number} identifies  number} and @dfn{Attribute value}. The @dfn{Attribute number} identifies
35  the type of information the pair carries and the @dfn{Attribute Value}  the type of information the pair carries and the @dfn{Attribute Value}
# Line 103  For convenience, the attributes and the Line 51  For convenience, the attributes and the
51  integer attributes are given symbolic names. These names are assigned to  integer attributes are given symbolic names. These names are assigned to
52  attributes and values in the dictionary file @ref{dictionary file}.  attributes and values in the dictionary file @ref{dictionary file}.
53    
54  The attribute numbers range from 1 to 255. The attributes with the numbers  Attribute numbers range from 1 to 255. Attributes with numbers
55  greater than 255 are used internally by the sever and cannot be sent to  greater than 255 are used internally by the sever and cannot be sent to
56  the @NAS{}.  the @NAS{}.
57    
# Line 119  properties are: Line 67  properties are:
67  These flags determine usage of the attribute in configuration  These flags determine usage of the attribute in configuration
68  files @file{huntgroups}, @file{hints} and @file{users}.  files @file{huntgroups}, @file{hints} and @file{users}.
69  @item propagation  @item propagation
70  When a radius server functions in proxy mode, it uses the @dfn{propagation}  When a @RADIUS{} server functions in proxy mode, it uses the @dfn{propagation
71  bit to determine which attributes from the reply packet should be passed  bit} to determine which attributes from the reply packet should be passed
72  back to the requesting @NAS{} (@pxref{Proxy Service}).  back to the requesting @NAS{} (@pxref{Proxy Service}).
73  @item additivity  @item additivity
74  Some configuration rules may cause addition of new @AVP{}s to the  Some configuration rules may cause the addition of new @AVP{}s to the
75  incoming request. Before addition of a new pair, @command{radiusd}  incoming request. Before the addition of a new pair, @radiusd{}
76  scans the request to see if it already contains a pair with the same  scans the request to see if it already contains a pair with the same
77  attribute. If it does, the value of @dfn{additivity} determines the  attribute. If it does, the value of @dfn{additivity} determines the
78  further actions:  further actions:
# Line 140  The new pair is appended to the end of t Line 88  The new pair is appended to the end of t
88  @end table  @end table
89  @end table  @end table
90    
91  The attributes are declared in @file{raddb/dictionary} file. For a  The attributes are declared in the @file{raddb/dictionary} file. For a
92  detailed description of it, @xref{ATTRIBUTE}.  detailed description, @xref{ATTRIBUTE}.
93  For information about particular attributes, @xref{Attribute List}.  For information about particular attributes, @xref{Attribute List}.
94    
95  @comment *L2****************************************************************  @comment *L2****************************************************************
96  @node Requests  @node Requests
97  @section Radius Requests  @section @RADIUS{} Requests
98  @cindex Request  @cindex Request
99    
100  The term @dfn{request} means both the authentication/accounting request  The term @dfn{request} refers to both the authentication/accounting
101  from @NAS{} to a Radius server and the response that the server sends back  request packet  from a @NAS{} to a Radius server and the response
102  to the @NAS{}.  packet that the server sends back to the @NAS{}.
103    
104  Each request contains the following fields  Each request contains the following fields
105    

Legend:
Removed from v.1.15  
changed lines
  Added in v.1.16

savannah-hackers-public@gnu.org
ViewVC Help
Powered by ViewVC 1.1.26