RadiusD(8)

NAME
radiusd - Authentication and accounting server

SYNOPSIS
radiusd [-A] [-a acct_dir] [-b[b]] [-d config_dir] [-f] [-l log_dir] [-N] [-n] [-p port] [-Ssv] [-x debug_level] [-yz]

NOTE
The information in this manpage may be obsolete or incomplete. Please refer to texinfo documentation for full information about GNU Radius tools.

DESCRIPTION
radiusd is the server implementing RADIUS protocol.

RADIUS is a protocol spoken between the network access server (NAS) and the auhtentication server. The network access server is typically a device accepting connections from several modem lines and the authentication server is the server which decides whether some user has the right to log in or he has not. This is called authentication.

Also, when the user logs in or out, the NAS sends login and logout packets. These packets are received by the radius server and recorded appropriately. This is called accounting.

Upon startup, radius server listens the following two ports: authentication (default 1645), accounting (1646). When configured with --enable-snmp option, radiusd also starts listening on the specified SNMP port.

Upon receiving a packet from any of the above ports, the server performs the following:

1. checks the authenticity of the request
    Depending on the type of the request this check is based on the source IP address.

2. looks up the request queue for duplicates
    If a request is found in the queue, it gets dropped and the appropriate diagnostics is output to the Warning channel.

3. registers request in the queue
    This is needed to prevent any eventual duplicates of this packet from being processed.

4. processes and answers the request
    A child process may be forked during this stage to handle the request.

OPTIONS

-A  Write a file named detail.auth in the same directory as detail file. This file contains all the Attribute-Value pairs for each authentication packet. Normally this should be used for debugging purposes.

-a  Specify alternate directory for accounting. Usually this defaults to /radacct.

-b  If the radiusd server was configured with --enable-dbm option, this flag instructs it to use the DBM version of the users database (/users.db or /users.pag, /users.dir pair) instead of the plain text file (/users).

    Note that this makes the processing of each authentication request much more slower when the number of users grows beyong some limit.

    If this option is used twice, i.e. [-bb], it instructs the server to use both databases. In this case it first searches the login name in the internal hash (== in the plain text database), and if not found there, the server looks up the DBM database. This can be used to use the plain text database for keeping the information for those users that require the quickest possible auhtentication, and the DBM files to keep the information about those that can tolerate some delays in processing.

-d  Specifies alternate name for the configuration directory. Radiusd looks there for its configuration files. It defaults to .

-f  Instructs the server to not detach itself from the controlling terminal. This is used for debugging.

-l  Specifies alternate name for logging directory. Radiusd writes there its logfile(s). The default is .

-p  Specifies alternate port for authentication requests. The port number for accounting requests is determined by adding 1 to this number. Port number should be specified in decimal. Defaults are 1645 and 1646.

-S  Strip off the suffix and prefix from the username before writing it to the detail file.

-s  Tells the authentication server to operate in single process mode. When specified this flag, the authentications server will handle each request itself instead of forking child process to do that. This slows down the authentication processing to a crawl and should only be used for debugging purposes. The most convenient use is with the -f option.

-v  When given this option radiusd prints on the standard output its version number, compilation flags and the file names it uses and exits with zero code.

-x  Sets the debug level. The level should be specified as decimal, octal or hex number. The usage of this option is discouraged. Use debug statement in the configuration file instead.

-y  Write in the log file detailed information about each authentication request. The information is logged under auth loglevel.

-z  Log the password along with user name for each login. This is very insecure.

CONFIGURATION
Radiusd uses rather complicated configuration file suite. The files live in directory. The place of their location can be overriden using -d option.

The configuration files are:

config
    This file contains all the configurable parameters of the server itself: logging options, debug levels, notification and SNMP options, etc.

users
    The plaintext users database. Contains the per-user authorization and accounting information.

users.db
    Or users.dir, users.pag pair. The DBM version of the users database. This is used when the server is compiled with --enable-dbm option and either -b flag is specified in the command line, or one of usedbm always, usedbm also options is used in config file.

radius.deny
    The list of users whose access is denied for some reason.

dictionary
    Defines the symbolic representation of the Radius attributes, attribute values, etc. Usually should not be modified.

naslist
    The list of network access servers that are allowed to use this Radius server. This file specifies for each NAS its long and short names, NAS type, and possibly its IP pool.

clients
    The list of IP addresses and secred keys for each NAS that wants to communicate to the server.

hints
    The radius server can alter its politics towards a user depending on its login name. It can, for example, supply a different kind of service, assign it the IP number, etc. To do so the server consults this file. This extends the Prefix/Suffix functionality of the Livingstone 2.0 server.

huntgroups
    Defines the huntgroups. The huntgroup is a class of users that have some common characteristics.

FILES

/   Configuration files directory

/radius.log
    Default logfile.

/radacct
    Accounting directory.

/radius.pid
    Holds the PID number of the master Radius process.

BUGS
Hmm, probalbly there are some. Bug reports are welcome.

This manpage is very scarce. Refer to texinfo documentation for full info.

AUTHORS
Sergey Poznyakoff, gray@farlep.net

SEE ALSO
users(5rad), config(5rad), dictionary(5rad), naslist(5rad), clients(5rad), hints(5rad), huntgroups(5rad), builddbm(8rad), radlast(1rad), raduse(1rad), radwho(1rad), radzap(8rad), radctl(8rad), radgrep(1rad), radping(8rad), radtest(8rad), radsnmp(8rad)