From: Alan T. DeKok Date: Fri, 15 Jan 2021 14:17:15 +0000 (-0500) Subject: just do "adoc -> man" into the local "man" directory X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b221ea0095ae72380159158745469504584d142c;p=thirdparty%2Ffreeradius-server.git just do "adoc -> man" into the local "man" directory where they can be commited to git, like the "conf -> adoc" conversions, and where the "install" process no longer needs asciidoctor or pandoc --- diff --git a/doc/all.mk b/doc/all.mk index de67f2643b4..45106f546c0 100644 --- a/doc/all.mk +++ b/doc/all.mk @@ -7,6 +7,28 @@ # build the documentation. # WITH_DOC := $(strip $(foreach x,install doc html man pdf doxygen,$(findstring $(x),$(MAKECMDGOALS)))) + +# +# Not all of the "man" files have been converted to asciidoc, so we have a "install.doc.man" +# rule here, instead of overloading the "install.man" rule. +# +ADOC2MAN_FILES := $(filter-out %/index.adoc,$(wildcard doc/antora/modules/reference/pages/man/*.adoc)) +$(BUILD_DIR)/make/man.mk: $(ADOC2MAN_FILES) | $(BUILD_DIR)/make + @rm -f $@ + ${Q}for x in $^; do \ + y=$$(grep :manvolnum: $$x | awk '{print $$2}'); \ + z=$$(basename $$x | sed 's/.adoc//'); \ + echo "AUTO_MAN_FILES += $(R)$(mandir)/man$$y/$$z.$$y" >> $@; \ + echo "man/man$$y/$$z.$$y: $$x" >> $@; \ + printf "\t"'@echo AUTO-MAN $$(notdir $$@)'"\n" >> $@; \ + printf "\t"'@mkdir -p $$(dir $$@)'"\n" >> $@; \ + printf "\t"'@asciidoctor -b manpage $$< -o $$@'"\n" >> $@; \ + echo "" >> $@; \ + done + +-include $(BUILD_DIR)/make/man.mk +all: $(AUTO_MAN_FILES) + # # We're installing the documentation, but there's no "docdir". # @@ -58,7 +80,7 @@ endif # all.doc: html docsite -install: install.doc install.doc.man +install: install.doc clean: clean.doc @@ -113,29 +135,6 @@ $(foreach FILE,$(ALL_DOC_FILES),$(eval $(call ADD_INSTALL_RULE.file,doc/${FILE}, # install.doc: $(addprefix $(R)$(docdir)/,$(ALL_DOC_FILES)) -# -# Not all of the "man" files have been converted to asciidoc, so we have a "install.doc.man" -# rule here, instead of overloading the "install.man" rule. -# -ADOC2MAN_FILES := $(filter-out %/index.adoc,$(wildcard doc/antora/modules/reference/pages/man/*.adoc)) -$(BUILD_DIR)/make/man.mk: $(ADOC2MAN_FILES) | $(BUILD_DIR)/make - @rm -f $@ - ${Q}for x in $^; do \ - y=$$(grep :manvolnum: $$x | awk '{print $$2}'); \ - z=$$(basename $$x | sed 's/.adoc//'); \ - echo "INSTALL_MAN_FILES += $(R)$(mandir)/man$$y/$$z.$$y" >> $@; \ - echo "$(R)$(mandir)/man$$y/$$z.$$y: $$x" >> $@; \ - printf "\t"'@echo INSTALL-MAN $$(notdir $$@)'"\n" >> $@; \ - printf "\t"'@echo mkdir -p $$(dir $$@)'"\n" >> $@; \ - printf "\t"'@asciidoctor -b manpage $$< -o $$@'"\n" >> $@; \ - echo "" >> $@; \ - done - --include $(BUILD_DIR)/make/man.mk -ALL_INSTALL += $(INSTALL_MAN_FILES) - -install.doc.man install.man: $(INSTALL_MAN_FILES) - .PHONY: clean.doc clean.doc: ${Q}rm -f doc/*~ doc/rfc/*~ doc/examples/*~ $(AUTO_ADOC_FILES) $(HTML_FILES) $(PDF_FILES) $(MAN_FILES) diff --git a/man/man1/radclient.1 b/man/man1/radclient.1 new file mode 100644 index 00000000000..d0fad70c841 --- /dev/null +++ b/man/man1/radclient.1 @@ -0,0 +1,242 @@ +'\" t +.\" Title: radclient +.\" Author: Alan DeKok +.\" Generator: Asciidoctor 2.0.10 +.\" Date: 2020-12-25 +.\" Manual: FreeRADIUS +.\" Source: FreeRADIUS +.\" Language: English +.\" +.TH "RADCLIENT" "1" "2020-12-25" "FreeRADIUS" "FreeRADIUS" +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.ss \n[.ss] 0 +.nh +.ad l +.de URL +\fI\\$2\fP <\\$1>\\$3 +.. +.als MTO URL +.if \n[.g] \{\ +. mso www.tmac +. am URL +. ad l +. . +. am MTO +. ad l +. . +. LINKSTYLE blue R < > +.\} +.SH "NAME" +radclient \- send packets to a RADIUS server, show reply +.SH "SYNOPSIS" +.sp +\fBradclient\fP \fI[ OPTIONS ]\fP \fIserver {acct|auth|status|disconnect|auto} secret\fP +.SH "DESCRIPTION" +.sp +`radclient* is a radius client program. It can send arbitrary radius +packets to a radius server, then shows the reply. It can be used to test +changes you made in the configuration of the radius server, or it can be +used to monitor if a radius server is up. +.sp +\fBradclient\fP reads radius attribute/value pairs from it standard input, +or from a file specified on the command line. It then encodes these +attribute/value pairs using the dictionary, and sends them to the remote +server. +.sp +The \f(CRUser\-Password\fP and \f(CRCHAP\-Password\fP attributes are automatically +encrypted before the packet is sent to the server. +.SH "OPTIONS" +.sp +\fB\-4\fP +.RS 4 +Use IPv4 (default) +.RE +.sp +\fB\-6\fP +.RS 4 +Use IPv6 +.RE +.sp +\fB\-c count\fP +.RS 4 +Send each packet \fIcount\fP times. +.RE +.sp +\fB\-d config_dir\fP +.RS 4 +The directory that contains the user dictionary file. Defaults to +\f(CR/etc/raddb\fP. +.RE +.sp +\fB\-D dict_dir\fP +.RS 4 +The directory that contains the main dictionary file. Defaults to +\f(CR/usr/share/freeradius/dictionary\fP. +.RE +.sp +\fB\-f filename[:filename]\fP +.RS 4 +File to read the attribute/value pairs from. If this is not specified, +they are read from stdin. This option can be specified multiple times, +in which case packets are sent in order by file, and within each file, +by first packet to last packet. A blank line separates logical packets +within a file. If a pair of files separated by a colon is specified, the +second file will be used to filter the responses to requests from the +first. The number of requests and filters must be the same. A summary of +filter results will be displayed if \-s is passed. +.RE +.sp +\fB\-F\fP +.RS 4 +Print the file name, packet number and reply code. +.RE +.sp +\fB\-h\fP +.RS 4 +Print usage help information. +.RE +.sp +\fB\-i id\fP +.RS 4 +Use \fIid\fP as the RADIUS request Id. +.RE +.sp +\fB\-n number\fP +.RS 4 + Try to send \fInumber\fP requests per second, evenly spaced. This option +allows you to slow down the rate at which radclient sends requests. When +not using \f(CR\-n\fP, the default is to send packets as quickly as possible, +with no inter\-packet delays. ++ +Due to limitations in radclient, this option does not accurately send +the requested number of packets per second. +.RE +.sp +\fB\-p number\fP +.RS 4 + Send \fInumber\fP requests in parallel, without waiting for a response +for each one. By default, radclient sends the first request it has +read, waits for the response, and once the response is received, +sends the second request in its list. This option allows you to send +many requests at simultaneously. Once \fInumber\fP are sent, radclient +waits for all of the responses to arrive (or for the requests to +time out), before sending any more packets. ++ +This option permits you to discover the maximum load accepted by a +RADIUS server. +.RE +.sp +\fB\-P proto\fP +.RS 4 +Use \fIproto\fP transport protocol ("tcp" or "udp"). Only available if +FreeRADIUS is compiled with TCP transport support. +.RE +.sp +\fB\-q\fP +.RS 4 +Go to quiet mode, and do not print out anything. +.RE +.sp +\fB\-r number\fP +.RS 4 +Try to send each packet \fInumber\fP of times as retries, before giving up on it. +The default is 10. +.RE +.sp +\fB\-s\fP +.RS 4 +Print out some summaries of packets sent and received. +.RE +.sp +\fB\-S filename\fP +.RS 4 + Rather than reading the shared secret from the command\-line (where it +can be seen by others on the local system), read it instead from +\fIfilename\fP. +.RE +.sp +\fB\-t timeout\fP +.RS 4 +Wait \fItimeout\fP seconds before deciding that the NAS has not responded +to a request, and re\-sending the packet. The default timeout is 3. +.RE +.sp +\fB\-v\fP +.RS 4 +Print out version information. +.RE +.sp +\fB\-x\fP +.RS 4 +Print out debugging information. +.RE +.sp +\fBserver[:port]\fP +.RS 4 + The hostname or IP address of the remote server. Optionally a UDP port +can be specified. If no UDP port is specified, it is looked up in +\f(CR/etc/services\fP. The service name looked for is \fBradacct\fP for accounting +packets, and \fBradius\fP for all other requests. If a service is not found +in \f(CR/etc/services\fP, 1813 and 1812 are used respectively. ++ +The RADIUS attributes read by \fIradclient\fP can contain the special +attribute \f(CRPacket\-Dst\-IP\-Address\fP. If this attribute exists, then that +IP address is where the packet is sent, and the \fBserver\fP specified on +the command\-line is ignored. ++ +If the RADIUS attribute list always contains the \f(CRPacket\-Dst\-IP\-Address\fP +attribute, then the \fBserver\fP parameter can be given as \fB\-\fP. ++ +The RADIUS attributes read by \fIradclient\fP can contain the special +attribute \f(CRPacket\-Dst\-Port\fP. If this attribute exists, then that UDP +port is where the packet is sent, and the \fB:port\fP specified on the +command\-line is ignored. +.RE +.sp +\fBauth | acct | status | disconnect | auto\fP +.RS 4 + Use \fBauth\fP to send an authentication packet (Access\-Request), \fBacct\fP +to send an accounting packet (Accounting\-Request), \fBstatus\fP to send an +status packet (Status\-Server), or \fBdisconnect\fP to send a disconnection +request. Instead of these values, you can also use a decimal code here. +For example, code 12 is also \fBStatus\-Server\fP. ++ +The RADIUS attributes read by \fIradclient\fP can contain the special +attribute \f(CRPacket\-Type\fP. If this attribute exists, then that type of +packet is sent, and the \fItype\fP specified on the command\-line is ignored. ++ +If the RADIUS attribute list always contains the \f(CRPacket\-Type\fP +attribute, then the \fBtype\fP parameter can be given as \fBauto\fP. +.RE +.sp +\fBsecret\fP +.RS 4 +The shared secret for this client. It needs to be defined on the +radius server side too, for the IP address you are sending the radius +packets from. +.RE +.SH "EXAMPLE" +.sp +A sample session that queries the remote server for \fIStatus\-Server\fP. +Not all servers support this, but FreeRADIUS has configurable support +for it. +.sp +.if n .RS 4 +.nf +$ echo "Message\-Authenticator = 0x00" | radclient 192.0.2.42 status s3cr3t +Sending request to server 192.0.2.42, port 1812. +Received Packet from host 192.0.2.42 code=2, id=140, length=54 + Reply\-Message = "FreeRADIUS up 21 days, 02:05" +.fi +.if n .RE +.SH "SEE ALSO" +.sp +radiusd(8), +.SH "AUTHOR" +.sp +The FreeRADIUS Server Project (\c +.URL "http://www.freeradius.org" "" ")" +.SH "AUTHOR" +.sp +Alan DeKok \ No newline at end of file diff --git a/man/man8/radiusd.8 b/man/man8/radiusd.8 new file mode 100644 index 00000000000..053ae5bffca --- /dev/null +++ b/man/man8/radiusd.8 @@ -0,0 +1,264 @@ +'\" t +.\" Title: radiusd +.\" Author: Alan DeKok +.\" Generator: Asciidoctor 2.0.10 +.\" Date: 2020-12-21 +.\" Manual: FreeRADIUS +.\" Source: FreeRADIUS +.\" Language: English +.\" +.TH "RADIUSD" "8" "2020-12-21" "FreeRADIUS" "FreeRADIUS" +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.ss \n[.ss] 0 +.nh +.ad l +.de URL +\fI\\$2\fP <\\$1>\\$3 +.. +.als MTO URL +.if \n[.g] \{\ +. mso www.tmac +. am URL +. ad l +. . +. am MTO +. ad l +. . +. LINKSTYLE blue R < > +.\} +.SH "NAME" +radiusd \- Authentication, Authorization and Accounting server +.SH "SYNOPSIS" +.sp +\fBradiusd\fP [\fB\-C\fP] [\fB\-d\fP \fIconfig_directory\fP] [\fB\-f\fP] [\fB\-h\fP] [\fB\-l\fP +\fIlog_file\fP] [\fB\-m\fP] [\fB\-n\fP \fIname\fP] [\fB\-s\fP] [\fB\-t\fP] [\fB\-T\fP] [\fB\-v\fP] [\fB\-x\fP] +[\fB\-X\fP] +.SH "DESCRIPTION" +.sp +FreeRADIUS is a high\-performance and highly configurable RADIUS server. +It supports many database back\-ends such as flat\-text files, SQL, LDAP, +Perl, Python, etc. It also supports many authentication protocols such +as PAP, CHAP, MS\-CHAP(v2), HTTP Digest, and EAP (EAP\-MD5, EAP\-TLS, PEAP, +EAP\-TTLS, EAP\-SIM, etc.). +.sp +It also has full support for Cisco\(cqs VLAN Query Protocol (VMPS) and DHCP. +.sp +Please read the DEBUGGING section below. It contains instructions for +quickly configuring the server for your local system. +.SH "OPTIONS" +.sp +The following command\-line options are accepted by the server. +.sp +\fB\-C\fP +.RS 4 +Check the configuration and exit immediately. If there is a problem +reading the configuration, then the server will exit with a non\-zero +status code. If the configuration appears to be acceptable, then the +server will exit with a zero status code. +.sp +Note that there are limitations to this check. Due to the complexities +involved in \fIalmost\fP starting a RADIUS server, these checks are +necessarily incomplete. The server can return a zero status code when +run with \f(CR\-C\fP, but may still exit with an error when run normally. +.sp +See the output of \f(CRradiusd \-XC\fP for a list of which modules are +checked for correct configuration, and which modules are skipped, +and therefore not checked. +.RE +.sp +\fB\-d config_directory\fP +.RS 4 +Defaults to \f(CR/etc/raddb\fP. \f(CRRadiusd\fP looks here for its configuration +files such as the \f(CRdictionary\fP and the \f(CRusers\fP files. +.RE +.sp +\fB\-f\fP +.RS 4 +Do not fork, stay running as a foreground process. +.RE +.sp +\fB\-h\fP +.RS 4 +Print usage help information. +.RE +.sp +\fB\-l log_file\fP +.RS 4 +Defaults to \f(CR${logdir}/radius.log\fP. \f(CRRadiusd\fP writes its logging +information to this file. If \f(CRlog_file\fP is the string \f(CRstdout\fP, then +logging messages will be written to stdout. +.RE +.sp +\fB\-m\fP +.RS 4 +On SIGINT or SIGQUIT exit cleanly instead of immediately. This is most +useful for when running the server with "valgrind". +.RE +.sp +\fB\-n name\fP +.RS 4 +Read \f(CRraddb/name.conf\fP instead of \f(CRraddb/radiusd.conf\fP. +.sp +Note that by default, the server looks for a configuration file +which matches its own name. Creating a soft link from file \f(CRfoo\fP +to \f(CRradiusd\fP, and then running the program \f(CRfoo\fP, will cause the +binary to look for \f(CRraddb/foo.conf\fP. +.RE +.sp +\fB\-s\fP +.RS 4 +Run in "single server" mode. The server normally runs with multiple +threads and/or processes, which can lower its response time to +requests. In single server mode, the server will not "daemonize" +(auto\-background) itself. +.RE +.sp +\fB\-t\fP +.RS 4 +Do not spawn threads. +.RE +.sp +\fB\-T\fP +.RS 4 +Always add timestamps to log messages. +.RE +.sp +\fB\-v\fP +.RS 4 +Print server version information and exit. +.RE +.sp +\fB\-X\fP +.RS 4 +Debugging mode. This argument is equivalent to using \f(CR\-sfxx \-l +stdout\fP. When trying to understand how the server works, ALWAYS run +it with \f(CRradiusd \-X\fP. For production servers, use the \f(CRraddebug\fP +program. +.RE +.sp +\fB\-x\fP +.RS 4 +Finer\-grained debug mode. In this mode the server will print details +of every request to the default logging destination. Using multiple +\f(CR\-x\fP options will increase the debug output. +.RE +.SH "DEBUGGING" +.sp +The default configuration is set to work in the widest possible +circumstances. It requires minimal changes for your system. +.sp +However, your needs may be complex, and may require significant changes +to the server configuration. Making random changes is a guaranteed +method of failure. Instead, we STRONGLY RECOMMEND proceeding via the +following steps: +.sp +1) Always run the server in debugging mode ( \f(CRradiusd \-X\fP ) after +making a configuration change. We cannot emphasize this enough. If you +are not running the server in debugging mode, you \fIwill not\fP be able to +see what is doing, and you \fIwill not\fP be able to correct any problems. +.sp +If you ask questions on the mailing list, the first response will be to +tell you "run the server in debugging mode". Please, follow these +instructions. +.sp +2) Change as little as possible in the default configuration +files. The server contains a decade of experience with protocols, +databases, and different systems. Its default configuration is designed +to work almost everywhere, and to do almost everything you need. +.sp +3) When you make a small change, testing it before changing +anything else. If the change works, save a copy of the configuration, +and make another change. If the change doesn\(cqt work, debug it, and try +to understand why it doesn\(cqt work. +.sp +If you begin by making large changes to the server configuration, it +will never work, and you will never be able to debug the problem. +.sp +4) If you need to add a connection to a database FOO (e.g. LDAP +or SQL), then: + +.br +a) Edit \f(CRraddb/modules/foo\fP + +.br +This file contains the default configuration for the module. It contains +comments describing what can be configured, and what those configuration +entries mean. + +.br +b) Edit \f(CRraddb/sites\-available/default\fP + +.br +This file contains the default policy for the server. e.g. "enable CHAP, +MS\-CHAP, and EAP authentication". Look in this file for all references +to your module "foo". Read the comments, and remove the leading hash \(aq#\(aq +from the lines referencing the module. This enables the module. + +.br +c) Edit \f(CRraddb/sites\-available/inner\-tunnel\fP + +.br +This file contains the default policy for the "tunneled" portion of +certain EAP methods. Perform the same kind of edits as above, for the +"default" file.. If you are not using EAP (802.1X), then this step can +be skipped. + +.br +d) Start the server in debugging mode ( \f(CRradiusd \-X\fP ), and start +testing. +.sp +5) Ask questions on the mailing list + +.br +(\c +.MTO "freeradius\-users\(atlists.freeradius.org" "" ")." +When asking questions, include +the output from debugging mode ( \f(CRradiusd \-X\fP ). This information will +allow people to help you. If you do not include it, the first response +to your message will be "post the output of debug mode". +.sp +Ask questions earlier, rather than later. If you cannot solve a problem +in a day, ask a question on the mailing list. Most questions have been +seen before, and can be answered quickly. +.SH "BACKGROUND" +.sp +\fBRADIUS\fP is a protocol spoken between an access server, typically a +device connected to several modems or ISDN lines, and a \fBradius\fP server. +When a user connects to the access server, (s)he is asked for a +loginname and a password. This information is then sent to the \fBradius\fP +server. The server replies with "access denied", or "access OK". In the +latter case login information is sent along, such as the IP address in +the case of a PPP connection. +.SH "CONFIGURATION" +.sp +\f(CRradiusd\fP uses a number of configuration files. Each file has its own +manpage describing the format of the file. These files are: +.sp +\fBradiusd.conf\fP +.RS 4 +The main configuration file, which sets the administrator\-controlled +items. +.RE +.sp +\fBdictionary\fP +.RS 4 +This file is usually static. It defines all the possible RADIUS +attributes used in the other configuration files. You don\(cqt have to +modify it. It includes other dictionary files in the same directory. +.RE +.sp +\fBunlang\fP +.RS 4 +The processing and policy language used in the server. +.RE +.SH "SEE ALSO" +.sp +radiusd.conf(5), dictionary(5), unlang(5), raddebug(8) +.SH "AUTHOR" +.sp +The FreeRADIUS Server Project (\c +.URL "http://www.freeradius.org" "" ")" +.SH "AUTHOR" +.sp +Alan DeKok \ No newline at end of file diff --git a/man/man8/radmin.8 b/man/man8/radmin.8 new file mode 100644 index 00000000000..26269424b90 --- /dev/null +++ b/man/man8/radmin.8 @@ -0,0 +1,185 @@ +'\" t +.\" Title: radmin +.\" Author: Alan DeKok +.\" Generator: Asciidoctor 2.0.10 +.\" Date: 2020-12-25 +.\" Manual: FreeRADIUS +.\" Source: FreeRADIUS +.\" Language: English +.\" +.TH "RADMIN" "8" "2020-12-25" "FreeRADIUS" "FreeRADIUS" +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.ss \n[.ss] 0 +.nh +.ad l +.de URL +\fI\\$2\fP <\\$1>\\$3 +.. +.als MTO URL +.if \n[.g] \{\ +. mso www.tmac +. am URL +. ad l +. . +. am MTO +. ad l +. . +. LINKSTYLE blue R < > +.\} +.SH "NAME" +radmin \- FreeRADIUS Administration tool +.SH "SYNOPSIS" +.sp +\fBradmin\fP [\fB\-d\fP \fIconfig_directory\fP] [\fB\-e\fP \fIcommand\fP] [\fB\-E\fP] [\fB\-f\fP +\fIsocket_file\fP] [\fB\-h\fP] [\fB\-i\fP \fIinput_file\fP] [\fB\-l\fP \fIlog_file\fP] [\fB\-n\fP +\fIname\fP] [\fB\-q\fP] +.SH "DESCRIPTION" +.sp +FreeRADIUS Server administration tool that connects to the control +socket of a running server, and gives a command\-line interface to it. +.sp +At this time, only a few commands are supported. Please type \f(CRhelp\fP at +the command prompt for detailed information about the supported +commands. +.sp +The \f(CRradmin\fP command supports full tab completion, inline help via \f(CR?\fP +and \f(CRhelp\fP, and command history. +.SH "WARNING" +.sp +The security protections offered by this command are limited to the +permissions on the Unix domain socket, and the server configuration. If +someone can connect to the Unix domain socket, they have a substantial +amount of control over the server. +.SH "OPTIONS" +.sp +The following command\-line options are accepted by the program. +.sp +\fB\-d config_directory\fP +.RS 4 +Defaults to \fI/etc/raddb\fP. \fBradmin\fP looks here for the server +configuration files to find the "listen" section that defines the +control socket filename. +.RE +.sp +\fB\-e command\fP +.RS 4 +Run \fIcommand\fP and exit. +.RE +.sp +\fB\-E\fP +.RS 4 +Echo commands as they are being executed. +.RE +.sp +\fB\-f socket_file\fP +.RS 4 +Specify the socket filename directly. The radiusd.conf file is not +read. +.RE +.sp +\fB\-h\fP +.RS 4 +Print usage help information. +.RE +.sp +\fB\-i input_file\fP +.RS 4 +Reads input from the specified file. If this option is not +specified, \f(CRstdin\fP is used. This also sets \f(CR\-q\fP. +.RE +.sp +\fB\-l log_file\fP +.RS 4 +Writes the commands which are executed to this log file. This +functionality is off by default. +.RE +.sp +\fB\-n name\fP +.RS 4 +Read \f(CRraddb/name.conf\fP instead of \f(CRraddb/radiusd.conf\fP. +.RE +.sp +\fB\-q\fP +.RS 4 +Quiet mode. +.RE +.SH "COMMANDS" +.sp +The commands implemented by the command\-line interface are almost +completely controlled by the server. There are a few commands +interpreted locally by radmin: +.sp +\fBexit\fP +.RS 4 +Exit from radmin. +.RE +.sp +\fBquit\fP +.RS 4 +Exit from radmin. +.RE +.sp +\fBreconnect\fP +.RS 4 +Reconnect to the server. +.RE +.sp +The other commands are implemented by the server. Type \f(CRhelp\fP at the +prompt for more information. +.SH "EXAMPLES" +.sp +\fBdebug file /var/log/radius/bob.log\fP +.RS 4 +Set debug logs to \f(CR/var/log/radius/bob.log\fP. There is very little +checking of this filename. Rogue administrators may be able use this +command to over\-write almost any file on the system. However, if +the rogue administrators have write access to the main \f(CRradius.conf\fP +file, then they can do the same thing without \f(CRradmin\fP, too. +.RE +.sp +\fBdebug condition \(aq(User\-Name == "bob")\(aq\fP +.RS 4 +Enable debugging output for all requests that match the condition. Any +\f(CRunlang\fP condition is valid here. The condition is parsed as a string, +so it must be enclosed in single or double quotes. Strings enclosed in +double\-quotes must have back\-slashes and the quotation marks escaped +inside of the string. +.sp +Only one debug condition can be active at a time. +.RE +.sp +\fBdebug condition \(aqUser\-Name == ""bob"") || (Packet\-Src\-IP\-Address == 192.0.2.22\(aq\fP +.RS 4 +A more complex condition that enables debugging output for requests +containing User\-Name "bob", or requests that originate from source IP +address 192.0.2.22. +.RE +.sp +\fBdebug condition\fP +.RS 4 +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +. sp -1 +. IP \(bu 2.3 +.\} +Disable debug conditionals. +.RE +.RE +.SH "FULL LIST OF COMMANDS" +.sp +Connect to the server and type \f(CRhelp\fP for a full list of commands. +.SH "SEE ALSO" +.sp +unlang(5), radiusd.conf(5), raddb/sites\-available/control\-socket +.SH "AUTHOR" +.sp +Alan DeKok <\c +.MTO "aland\(atfreeradius.org" "" ">" +.SH "AUTHOR" +.sp +Alan DeKok \ No newline at end of file diff --git a/man/man8/radsniff.8 b/man/man8/radsniff.8 new file mode 100644 index 00000000000..cae33af4a4b --- /dev/null +++ b/man/man8/radsniff.8 @@ -0,0 +1,262 @@ +'\" t +.\" Title: radsniff +.\" Author: Alan DeKok +.\" Generator: Asciidoctor 2.0.10 +.\" Date: 2020-12-21 +.\" Manual: FreeRADIUS +.\" Source: FreeRADIUS +.\" Language: English +.\" +.TH "RADSNIFF" "8" "2020-12-21" "FreeRADIUS" "FreeRADIUS" +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.ss \n[.ss] 0 +.nh +.ad l +.de URL +\fI\\$2\fP <\\$1>\\$3 +.. +.als MTO URL +.if \n[.g] \{\ +. mso www.tmac +. am URL +. ad l +. . +. am MTO +. ad l +. . +. LINKSTYLE blue R < > +.\} +.SH "NAME" +radsniff \- dump radius protocol +.SH "SYNOPSIS" +.sp +*radsniff \fI[ OPTIONS ]\fP +.SH "DESCRIPTION" +.sp +*radsniff is a simple wrapper around libpcap. It can also print out the +contents of RADIUS packets using the FreeRADIUS dictionaries. +.SH "OPTIONS" +.sp +\fB\-a\fP +.RS 4 +List all interfaces which can be used to capture packets. +.RE +.sp +\fB\-c count\fP +.RS 4 +Number of packets to capture. Exit after capturing \fBcount\fP packets +.RE +.sp +\fB\-C checksum_type\fP +.RS 4 +Enable checksum validation. Specify \f(CRudp\fP or \f(CRradius\fP. +.RE +.sp +\fB\-d config_dir\fP +.RS 4 +The directory that contains the user dictionary file. Defaults to +\f(CR/etc/raddb\fP. +.RE +.sp +\fB\-D dict_dir\fP +.RS 4 +The directory that contains the main dictionary file. Defaults to +\f(CR/usr/share/freeradius/dictionary\fP. +.RE +.sp +\fB\-e event[,event]\fP +.RS 4 + Only log requests with specific \fIevent\fP flags. ++ +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +. sp -1 +. IP \(bu 2.3 +.\} +\fBreceived\fP \- a request or response +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +. sp -1 +. IP \(bu 2.3 +.\} +\fBnorsp\fP \- no response was received to a request +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +. sp -1 +. IP \(bu 2.3 +.\} +\fBrtx\fP \- retransmission of a request which was already seen +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +. sp -1 +. IP \(bu 2.3 +.\} +\fBnoreq\fP \- a response was seen with no matching request +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +. sp -1 +. IP \(bu 2.3 +.\} +\fBreused\fP \- RADIUS ID field was reused too soon +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +. sp -1 +. IP \(bu 2.3 +.\} +\fBerror\fP \- error decoding the packet +.RE +.RE +.sp +\fB\-F\fP +.RS 4 +Filter PCAP file from stdin to stdout. Output file will contain RADIUS +packets. +.RE +.sp +\fB\-f filter\fP +.RS 4 +PCAP filter. (default is \f(CRudp port 1812 or 1813\fP) +.RE +.sp +\fB\-h\fP +.RS 4 +Print usage help information. +.RE +.sp +\fB\-i interface\fP +.RS 4 +Capture from the named \fIinterface\fP. +.RE +.sp +\fB\-I filename\fP +.RS 4 +Read packets from \fIfilename\fP. +.RE +.sp +\fB\-l attr[,attr]\fP +.RS 4 +Output packet signature and a list of named xattributes. +.RE +.sp +\fB\-L attr[,attr]\fP +.RS 4 +Use the named attributes tfor detecting retransmissions +.RE +.sp +\fB\-m\fP +.RS 4 +Print packet headers only, not contents. +.RE +.sp +\fB\-p port\fP +.RS 4 +Listen for packets on port. +.RE +.sp +\fB\-P filename\fP +.RS 4 +Daemonize, and write PID to _filename_x +.RE +.sp +\fB\-q\fP +.RS 4 +Print less debugging information. +.RE +.sp +\fB\-r attribute\-filter\fP +.RS 4 +RADIUS attribute request filter. +.RE +.sp +\fB\-R attribute\-filter\fP +.RS 4 +RADIUS attribute response filter. +.RE +.sp +\fB\-s secret\fP +.RS 4 +RADIUS secret. +.RE +.sp +\fB\-S\fP +.RS 4 +Sort attributes in the packet. Used to compare server results. +.RE +.sp +\fB\-w filename\fP +.RS 4 +Write output packets to \fIfilename\fP. +.RE +.sp +\fB\-x\fP +.RS 4 +Print out debugging information. +.RE +.sp +The following options are for statistics gathering. +.sp +\fB\-E\fP +.RS 4 +Print statistics in CSV format. +.RE +.sp +\fB\-N prefix\fP +.RS 4 +The instance name passed to the collectd plugin. +.RE +.sp +\fB\-O server\fP +.RS 4 +Write output statics to the named collectd server. +.RE +.sp +\fB\-T timeout\fP +.RS 4 +The timeout in milliseconds before the request is considered +to be lost. +.RE +.sp +\fB\-W interval\fP +.RS 4 +Write statistics every \fIinterval\fP seconds. +.RE +.SH "SEE ALSO" +.sp +radiusd(8),pcap(3) +.SH "AUTHOR" +.sp +The FreeRADIUS Server Project (\c +.URL "http://www.freeradius.org" "" ")" +.SH "AUTHOR" +.sp +Alan DeKok \ No newline at end of file