- modules/ROOT/nav.adoc
- modules/installation/nav.adoc
- modules/howto/nav.adoc
+- modules/tutorials/nav.adoc
- modules/unlang/nav.adoc
- modules/developers/nav.adoc
- modules/raddb/nav.adoc
** Tuning
*** xref:tuning/performance-testing.adoc[Performance Testing]
*** xref:tuning/tuning_guide.adoc[Tuning Guide]
-** Exercises
-*** xref:exercises/new_user.adoc[New User]
-*** xref:exercises/new_client.adoc[New Client]
-*** xref:exercises/accounting.adoc[Accounting]
-*** xref:exercises/simultaneous_use.adoc[Simultaneous Use]
-*** xref:exercises/matching_users.adoc[Matching Users]
-*** xref:exercises/proxy.adoc[Proxying]
-**** xref:exercises/proxy_receive.adoc[Proxy Receive]
-**** xref:exercises/proxy_failover.adoc[Proxy Fail-Over]
-**** xref:exercises/proxy_load_balance.adoc[Proxy Load-Balance]
-*** xref:exercises/sql.adoc[SQL]
-**** xref:exercises/sql_user.adoc[SQL Users]
-*** xref:exercises/variables.adoc[Variables]
-*** xref:exercises/dynamic-translation.adoc[Dynamic-Translation]
-*** xref:exercises/multiple_modules.adoc[Module instances]
-*** xref:exercises/autz-type.adoc[Autz-Type]
-*** xref:exercises/module_fail_over.adoc[Module-Fail-Over]
-*** xref:exercises/prepaid.adoc[Prepaid]
-*** xref:exercises/dictionary.adoc[Dictionary]
-*** xref:exercises/virtual.adoc[Virtual]
-*** xref:exercises/radmin.adoc[Radmin]
*** Unlang
-**** xref:exercises/unlang_conditions.adoc[Unlang Conditions]
-**** xref:exercises/unlang_policies.adoc[Unlang Policies]
+**** xref:unlang_conditions.adoc[Unlang Conditions]
+**** xref:unlang_policies.adoc[Unlang Policies]
*** EAP
-**** xref:exercises/eap-md5.adoc[EAP-MD5]
-**** xref:exercises/eap-ttls.adoc[EAP-TTLS]
-**** xref:exercises/eap-peap.adoc[EAP-PEAP]
-**** xref:exercises/eap-tls.adoc[EAP-TLS]
+**** xref:eap-md5.adoc[EAP-MD5]
+**** xref:eap-ttls.adoc[EAP-TTLS]
+**** xref:eap-peap.adoc[EAP-PEAP]
+**** xref:eap-tls.adoc[EAP-TLS]
--- /dev/null
+** Tutorials
+*** xref:new_user.adoc[New User]
+*** xref:new_client.adoc[New Client]
+*** xref:accounting.adoc[Accounting]
+*** xref:simultaneous_use.adoc[Simultaneous Use]
+*** xref:matching_users.adoc[Matching Users]
+*** xref:proxy.adoc[Proxying]
+**** xref:proxy_receive.adoc[Proxy Receive]
+**** xref:proxy_failover.adoc[Proxy Fail-Over]
+**** xref:proxy_load_balance.adoc[Proxy Load-Balance]
+*** xref:sql.adoc[SQL]
+**** xref:sql_user.adoc[SQL Users]
+*** xref:variables.adoc[Variables]
+*** xref:dynamic-translation.adoc[Dynamic-Translation]
+*** xref:multiple_modules.adoc[Module instances]
+*** xref:autz-type.adoc[Autz-Type]
+*** xref:module_fail_over.adoc[Module-Fail-Over]
+*** xref:prepaid.adoc[Prepaid]
+*** xref:dictionary.adoc[Dictionary]
+*** xref:virtual.adoc[Virtual]
+*** xref:radmin.adoc[Radmin]
an NAS when a user logs in.
Use the entry in the file from the exercise in
-xref:exercises/new_user.adoc[New User] for user "bob".
+xref:new_user.adoc[New User] for user "bob".
[NOTE]
========================================================================
9. What error message is produced on the second accounting stop, and
why is it produced?
+// Copyright (C) 2019 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
+// Development of this documentation was sponsored by Network RADIUS SAS.
- `etc/raddb/users`
This exercise is a follow-up to the previous one in
-xref:exercises/multiple_modules.adoc[Multiple Modules], and it uses the `byname` and `bydate` modules
+xref:multiple_modules.adoc[Multiple Modules], and it uses the `byname` and `bydate` modules
configured there.
Start off by deleting the old log files:
Questions
~~~~~~~~~
+// Copyright (C) 2019 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
+// Development of this documentation was sponsored by Network RADIUS SAS.
1. Why is it useful to _not_ call certain modules for a request?
2. Why is it useful to control which modules get called for a request?
-
prefixed with the vendor name?
3. Why are vendor specific attributes useful?
+// Copyright (C) 2019 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
+// Development of this documentation was sponsored by Network RADIUS SAS.
That text was then sent back to the RADIUS client in the `Callback-Id`
attribute, which was not quoted above.
+// Copyright (C) 2019 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
+// Development of this documentation was sponsored by Network RADIUS SAS.
Another dynamic translation string function is the `expr` module. It performs
some simple mathematical operations. The following sample file entry
demonstrates how to use the `expr` module.
*Programs*: radtest
For this exercise, your are assumed to have previously worked
-through and be familiar with the exercise in xref:exercises/new_user.aodc[New User] for
+through and be familiar with the exercise in xref:new_user.aodc[New User] for
user "bob".
While RADIUS is an authentication protocol in its own right, other
7. What security issues exist with EAP-MD5?
8. Why is EAP-MD5 disabled in newer operating systems?
+// Copyright (C) 2019 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
+// Development of this documentation was sponsored by Network RADIUS SAS.
3. Would you use EAP-PEAP in a large deployment? If so, why? If not,
why not?
+// Copyright (C) 2019 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
+// Development of this documentation was sponsored by Network RADIUS SAS.
4. What is the purpose of the `MS-MPPE-Recv-Key` and `MS-MPPE-Send-Key`
attributes in the final `Access-Accept` packet?
+// Copyright (C) 2019 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
+// Development of this documentation was sponsored by Network RADIUS SAS.
3. Would you use EAP-TTLS in a large deployment? If so, why? If not,
why not?
+// Copyright (C) 2019 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
+// Development of this documentation was sponsored by Network RADIUS SAS.
network?
4. How does this kind of simple configuration scale to many users?
+// Copyright (C) 2019 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
+// Development of this documentation was sponsored by Network RADIUS SAS.
When the server uses an external database to find user authentication
information or to log accounting requests, that database may sometimes
fail temporarily. This situation is similar to the situation seen in the exercise
-in xref:exercises/proxy_failover.adoc[Proxy Failover], where proxied
+in xref:proxy_failover.adoc[Proxy Failover], where proxied
requests "fail-over" to a backup RADIUS server when the primary
RADIUS server does not respond.
1. Could the configuration for the "group" section containing the
"detail1" and "detail2" modules be simplified? If so, how?
+// Copyright (C) 2019 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
+// Development of this documentation was sponsored by Network RADIUS SAS.
1. Why is it useful to have multiple versions of a module?
+// Copyright (C) 2019 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
+// Development of this documentation was sponsored by Network RADIUS SAS.
4. What are the other fields in a client entry, and what are they used
for?
+// Copyright (C) 2019 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
+// Development of this documentation was sponsored by Network RADIUS SAS.
3. Why does the server need access to a clear-text password to perform
CHAP authentication?
+// Copyright (C) 2019 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
+// Development of this documentation was sponsored by Network RADIUS SAS.
2. Why is it useful to enforce time-based restrictions on users, in
addition to enforcing `Simultaneous-Use`?
+// Copyright (C) 2019 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
+// Development of this documentation was sponsored by Network RADIUS SAS.
from the incoming request.
The entry from the exercise in
-xref:exercises/new_user.adoc[New User] for user "bob", in the
+xref:new_user.adoc[New User] for user "bob", in the
"users" file will be used in this exercise.
The example packets `bob.sh` and `bob@realm1.sh` may be used in this
3. Since the User-Password is encrypted with the RADIUS shared secret,
what happens to it when a request is proxied?
+// Copyright (C) 2019 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
+// Development of this documentation was sponsored by Network RADIUS SAS.
The two group for "realm2" should also configure their
`clients.conf` file to permit user 1’s RADIUS server to act as a client,
-as given in the exercise in xref:exercises/new_client.adoc[New Clients].
+as given in the exercise in xref:new_client.adoc[New Clients].
Each user operating "realm2" should pick a different shared
secret to use with user 1.
The group should verify that the expected authentication requests
sent to the server for "realm1" are handled locally, as in the
-exercise in xref:exercises/proxy.adoc[Proxy].
+exercise in xref:proxy.adoc[Proxy].
The group should then verify that the expected requests sent to
the server for "realm1" are proxied to a server for "realm2". The
why not?
3. What would happen if both servers for "realm2" failed?
+// Copyright (C) 2019 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
+// Development of this documentation was sponsored by Network RADIUS SAS.
image::proxy_load_balance.svg[Fig. Proxy Loadbalance]
For this exercise, the users will be divided into the same groups as
-the previous exercise in xref:exercises/proxy_failover.adoc[Proxy Failover].
+the previous exercise in xref:proxy_failover.adoc[Proxy Failover].
User 1 will edit his `proxy.conf` file, so that the entries for
"realm2" are marked as load balancing. The users will send multiple
5. If the load balancing home server which has "failed" is started
again, will the proxying server ever send requests to it again? If so,
when? If not, why not?
+
+// Copyright (C) 2019 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
+// Development of this documentation was sponsored by Network RADIUS SAS.
realm2 is local
The users should also configure each other's server as a RADIUS
-client, as given in the exercise in xref:exercises/new_client.adoc[New Clients].
+client, as given in the exercise in xref:new_client.adoc[New Clients].
-The entry from the exercise in xref:exercises/new_user.adoc[New User] for user "bob" in
+The entry from the exercise in xref:new_user.adoc[New User] for user "bob" in
the file, will be used in this exercise.
The example packets `bob.sh`, `bob@realm1.sh`, and `bob@realm2.sh` may
3. What would happen if each user did not configure the realms to
"strip" the realm from the proxied requests?
+// Copyright (C) 2019 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
+// Development of this documentation was sponsored by Network RADIUS SAS.
4. Can you start the server in non-debugging mode (`radiusd -f`), and
still see the debugging output? How?
+// Copyright (C) 2019 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
+// Development of this documentation was sponsored by Network RADIUS SAS.
For this exercise, you are assumed to have previously worked
through, and be familiar with, the accounting exercise from
-xref:exercises/accounting.adoc[Accounting], and to have an entry in the file, as given the
-exercise in xref:exercises/new_user.adoc[New User], for user "bob".
+xref:accounting.adoc[Accounting], and to have an entry in the file, as given the
+exercise in xref:new_user.adoc[New User], for user "bob".
In this exercise, youwill work through an example of a user
logging into the server, and then attempting a simultaneous login for a
5. What would happen if the user tried to log in a second time, before
the accounting start packet was received?
+// Copyright (C) 2019 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
+// Development of this documentation was sponsored by Network RADIUS SAS.
configure the server to communicate with an SQL database. you
will configure the schema for the SQL server, and will populate that
schema with a sample entry similar to that for the exercise in
-xref:exercises/new_user.adoc[New User].
+xref:new_user.adoc[New User].
There are a number of reasons why user information may be stored in an
SQL database, rather than the file. While the file is adequate for a
3. What additional benefits, not mentioned here, do SQL databases have
over the files module?
+// Copyright (C) 2019 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
+// Development of this documentation was sponsored by Network RADIUS SAS.
- `etc/raddb/mods-config/sql/main/*`
Now that we have verified in the previous exercise,
-xref:exercises/sql.adoc[SQL] that the server can communicate with
+xref:sql.adoc[SQL] that the server can communicate with
an SQL server, we proceed to adding user configuration entries into the
SQL database.
file for the user "bob". Use the SQL client to verify that the entries
are now in the database.
-As the previous exercise in xref:exercises/sql.adoc[SQL]
+As the previous exercise in xref:sql.adoc[SQL]
did not tell the server to query the database, but only to connect to it,
we must now configure FreeRADIUS to query the database. This may be done
by editing `etc/raddb/sites-available/default`, and listing the `sql`
5. What other configuration entries in `etc/raddb/sites-available/default`
exist for the `sql` module, and why?
+// Copyright (C) 2019 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
+// Development of this documentation was sponsored by Network RADIUS SAS.
2. Why might you want to re-implement functionality offered by modules
in unlang?
3. What is the advantage of using `return` to exit the section early?
+
+// Copyright (C) 2019 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
+// Development of this documentation was sponsored by Network RADIUS SAS.
languages?
3. What is the advantage of using `return` to exit the section early?
+// Copyright (C) 2019 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
+// Development of this documentation was sponsored by Network RADIUS SAS.
3. How would you create an entry in the users file that matched users when
their `Class` was the same as their `NAS-Port`?
+// Copyright (C) 2019 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
+// Development of this documentation was sponsored by Network RADIUS SAS.
4. How can you make the above configuration authenticate different
users via different passwords?
+// Copyright (C) 2019 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
+// Development of this documentation was sponsored by Network RADIUS SAS.
projects / thirdparty / freeradius-server.git / commitdiff
