Table of Contents

Introduction to Radius

1.0 Overview

2. Naming Conventions
3. How Radius Operates

3.1 Attributes
3.2 RADIUS Requests

3.2.1 Authentication Requests
3.2.2 Accounting Requests

3.3 Matching Rule
3.4 Processing Requests

3.4.1 Checking for Duplicate Requests
3.4.2 Proxying

3.4.2.1 Proxy Service
3.4.2.2 Realms

3.4.3 Hints
3.4.4 Huntgroups
3.4.5 User Profiles

4. How to Start the Daemon.
5. Radius Configuration Files

5.1 Run-Time Configuration Options -- `raddb/config'

5.1.1 option block
5.1.2 logging block

5.1.2.1 Logging hooks
5.1.2.2 category statement
5.1.2.3 channel statement
5.1.2.4 Example of the logging statement

5.1.3 auth statement
5.1.4 acct statement
5.1.5 usedbm statement
5.1.6 snmp statement
5.1.7 rewrite statement.
5.1.8 guile statement
5.1.9 message statement
5.1.10 filters statement
5.1.11 mlc statement

5.2 Dictionary of Attributes -- `raddb/dictionary'

5.2.1 Comments
5.2.2 $INCLUDE Statement
5.2.3 VENDOR Statement
5.2.4 ATTRIBUTE statement
5.2.5 Blocks of Vendor-Specific Attributes
5.2.6 ALIAS statement
5.2.7 PROPERTY statement
5.2.8 VALUE Statement

5.3 Clients List -- `raddb/clients'

5.3.1 Example of `clients' file

5.4 NAS List -- `raddb/naslist'

5.4.1 Example of `naslist' file

5.5 NAS Types -- `raddb/nastypes'

5.5.1 Syntax of `raddb/nastypes'
5.5.2 Example of nastypes file.
5.5.3 Standard NAS types

5.6 Request Processing Hints -- `raddb/hints'

5.6.1 Example of `hints' file

5.7 Huntgroups -- `raddb/huntgroups'

5.7.1 Example of `huntgroups' file.

5.8 List of Proxy Realms -- `raddb/realms'

5.8.1 Example of `realms' file

5.9 User Profiles -- `raddb/users'

5.9.1 Example of `users' file

5.10 List of Blocked Users -- `raddb/access.deny'
5.11 SQL Configuration -- `raddb/sqlserver'

5.11.1 SQL Client Parameters
5.11.2 Authentication Server Parameters
5.11.3 Authorization Parameters
5.11.4 Accounting Parameters

5.11.4.1 Writing SQL Accounting Query Templates

5.12 Rewrite functions -- `raddb/rewrite'
5.13 Login Menus -- `raddb/menus'

5.13.1 A menu file syntax.
5.13.2 An example of menu files

5.14 Macro Substitution

6. Request Comparison Methods

6.1 Extended Comparison

6.1.1 An example of extended comparison configuration
6.1.2 List of attributes that can be declared comparable.

6.2 Fine-Tuning the Request Queue

7. Authentication

7.1 Accept Authentication Type
7.2 Reject Authentication Type
7.3 Local Password Authentication Type
7.4 Encrypted Password Authentication Type
7.5 System Authentication Type
7.6 SQL Authentication Type
7.7 PAM Authentication Type
7.8 Defining Custom Authentication Types
7.9 Multiple Login Checking

7.9.1 Retrieving Session Data
7.9.2 Verifying Active Sessions

7.10 Controlling Authentication Probes

8. Accounting

8.1 System Accounting
8.2 Detailed Request Accounting
8.3 SQL Accounting
8.4 Defining Custom Accounting Types

9. Logging
10. Problem Tracking

10.1 Rule Tracing
10.2 Debugging
10.3 Test Mode

11. Extensions

11.1 Filters

11.1.1 Getting Acquainted with Filters
11.1.2 Declaring the Filter
11.1.3 Invoking the Filter from a User Profile
11.1.4 Adding Reply Attributes
11.1.5 Accounting Filters
11.1.6 Invoking the Accounting Filter

11.2 Rewrite

11.2.1 Syntax Overview
11.2.2 Quick Start
11.2.3 Interaction with Radius
11.2.4 Rewriting Incoming Requests

11.2.4.1 Examples of Various Rewrite Functions

11.2.5 Login Verification Functions

11.2.5.1 Examples of Login Verification Functions

11.2.6 Attribute Creation Functions
11.2.7 Logging Hook Functions
11.2.8 Full Syntax Description

11.2.8.1 Rewrite Data Types
11.2.8.2 Rewrite Symbols
11.2.8.3 Rewrite Identifiers
11.2.8.4 Rewrite Declarations
11.2.8.5 Rewrite Statements
11.2.8.6 Regular Expressions
11.2.8.7 Rewrite Built-in Functions

11.3 Guile

11.3.1 Data Representation
11.3.2 Authentication with Scheme
11.3.3 Accounting with Scheme
11.3.4 Radius-Specific Functions

12. Utility Programs

12.1 radwho

12.1.1 radwho Command Line Options
12.1.2 radwho Format Strings
12.1.3 radwho Predefined Formats

12.2 radlast

12.2.1 radlast Command Line Options

12.3 radzap
12.4 radgrep
12.5 radping
12.6 radauth
12.7 radctl
12.8 builddbm
12.9 radscm: A Guile Interface to Radius Functions

13. Client Package

13.1 Client Configuration
13.2 radtest

13.2.1 Invoking radtest
13.2.2 Literal Values

13.2.2.1 Numeric Values
13.2.2.2 Character Strings
13.2.2.3 Lists of A/V pairs

13.2.3 Reserved Keywords
13.2.4 Variables

13.2.4.1 Using Variables
13.2.4.2 Variable Assignments
13.2.4.3 Dereferencing Variables
13.2.4.4 Accessing Elements of A/V Pair Lists
13.2.4.5 Assignment Options
13.2.4.6 Built-in Variables

13.2.5 Positional Parameters
13.2.6 Expressions

13.2.6.1 Arithmetic Operations
13.2.6.2 String Operations
13.2.6.3 Operations on A/V Lists
13.2.6.4 Comparison Operations
13.2.6.5 Boolean Operations
13.2.6.6 Conversion Between Data Types
13.2.6.7 Function Calls
13.2.6.8 Operator Precedence (How Operators Nest)

13.2.7 Function Definitions
13.2.8 Interacting with Radius Servers
13.2.9 Conditional Statements
13.2.10 Loops
13.2.11 Built-in Primitives
13.2.12 Sample Radtest Program

13.3 radsession
13.4 nas.scm
13.5 pam_radius.so

14. Attribute List

14.1 Authentication Attributes

14.1.1 CHAP-Password
14.1.2 Callback-Id
14.1.3 Callback-Number
14.1.4 Called-Station-Id
14.1.5 Calling-Station-Id
14.1.6 Class
14.1.7 Framed-Compression
14.1.8 Framed-IP-Address
14.1.9 Framed-IP-Netmask
14.1.10 Framed-MTU
14.1.11 Framed-Protocol
14.1.12 Framed-Route
14.1.13 Framed-Routing
14.1.14 Idle-Timeout
14.1.15 NAS-IP-Address
14.1.16 NAS-Identifier
14.1.17 NAS-Port-Id
14.1.18 NAS-Port-Type
14.1.19 Reply-Message
14.1.20 Service-Type
14.1.21 Session-Timeout
14.1.22 State
14.1.23 Termination-Action
14.1.24 User-Name
14.1.25 User-Password
14.1.26 Vendor-Specific

14.2 Accounting Attributes

14.2.1 Acct-Authentic
14.2.2 Acct-Delay-Time
14.2.3 Acct-Input-Octets
14.2.4 Acct-Input-Packets
14.2.5 Acct-Output-Octets
14.2.6 Acct-Output-Packets
14.2.7 Acct-Session-Id
14.2.8 Acct-Session-Time
14.2.9 Acct-Status-Type
14.2.10 Acct-Terminate-Cause

14.3 Radius Internal Attributes

14.3.1 Acct-Ext-Program
14.3.2 Acct-Type
14.3.3 Auth-Failure-Trigger
14.3.4 Auth-Data
14.3.5 Auth-Type
14.3.6 Crypt-Password
14.3.7 Exec-Program-Wait

14.3.7.1 Running an External Program
14.3.7.2 Using an External Filter

14.3.8 Exec-Program
14.3.9 Fall-Through
14.3.10 Group
14.3.11 Hint
14.3.12 Huntgroup-Name
14.3.13 Log-Mode-Mask
14.3.14 Login-Time
14.3.15 Match-Profile
14.3.16 Menu
14.3.17 Pam-Auth
14.3.18 Prefix
14.3.19 Proxy-Replied
14.3.20 Realm-Name
14.3.21 Replace-User-Name
14.3.22 Rewrite-Function
14.3.23 Scheme-Acct-Procedure
14.3.24 Scheme-Procedure
14.3.25 Simultaneous-Use
14.3.26 Strip-User-Name
14.3.27 Suffix
14.3.28 Termination-Menu

15. Reporting Bugs
16. Where to Get Information about GNU Radius
How to Obtain Radius
Radius Glossary
Acknowledgements
17. New Configuration Approach (draft)

17.1 A brief description of Currently Used Approach
17.2 Deficiencies of Current Operation Model and Configuration Suite
17.3 Proposed Solution

17.3.1 Request-processing Instruction
17.3.2 grad_instr_conditional
17.3.3 grad_instr_call
17.3.4 grad_instr_return
17.3.5 grad_instr_action
17.3.6 grad_instr_reply
17.3.7 grad_instr_proxy
17.3.8 grad_instr_forward
17.3.9 RPL representation

17.4 Changes to Rewrite Language
17.5 Support for Traditional Configuration Files.
17.6 New Configuration Files

A. GNU Free Documentation License

A.0.1 ADDENDUM: How to use this License for your documents

Index