1. INTRO
- All code in this server was written for this project.
+ The FreeRADIUS Server Project is a high performance and highly
+ configurable multi-protocol policy server, supporting RADIUS, DHCPv4
+ and VMPS. It is available under the terms of the GNU GPLv2.
- The server is mostly compatible with Livingston radiusd-2.01
- (no menus or s/key support though) but with more features, such as:
-
- o Can limit the maximum number of simultaneous logins on a per-user basis!
- o Multiple DEFAULT entries, that can optionally fall-through.
- o In fact, every entry can fall-through
- o Deny/permit access based on huntgroup users dials into
- o Set certain parameters (such as static IP address) based on huntgroup
- o Extra "hints" file that can select SLIP/PPP/rlogin based on
- username pattern (Puser or user.ppp is PPP, plain "user" is rlogin etc).
- o Can execute an external program when user has authenticated (for example
- to run a sendmail queue).
- o Can use `$INCLUDE filename' in radiusd.conf, users, and dictionary files
- o Can act as a proxy server, relaying requests to a remote server
- o Supports Vendor-Specific attributes
- o Supports many different plug-in modules for authentication,
- authorization, and accounting.
+ All code in this server was written for this project.
2. INSTALLATION
3. CONFIGURATION FILES
- For every file there is a fully commented example file included, that
- explains what is does, and how to use it. Read those sample files too!
-
- Again, many of the configuration files are ONLY documented in the
- comments included in the files. Reading the configuration files is
- REQUIRED to fully understand how to create complex configurations of
- the server.
+ Much of the server documentation is included only in the comments in the
+ configuration files. Reading the configuration files is REQUIRED to fully
+ understand how to create complex configurations of the server.
-3a. CLIENTS
+3a. 'clients.conf'
- Make sure the clients (portmasters, Linux with portslave etc) are set up to
+ Make sure the clients (NAS, switches, access points etc) are set up to
use the host radiusd is running on as authentication and accounting host.
- Configure these clients to use a "radius secret password". For every client,
- also enter this "secret password" into the file /etc/raddb/clients.
- See also the manual page for clients(5).
-
-3b. NASLIST
-
- Every NAS (Network Access Server, also known as terminal server) should have
- an entry in this file with an abbreviated name and the type of NAS it
- is. Currently FreeRADIUS supports the following NAS types:
-
- Terminal Server Type in naslist
-
- 3Com/USR Hiper Arc Total Control usrhiper
- 3Com/USR NetServer netserver
- 3Com/USR TotalControl tc
- Ascend Max 4000 family max40xx
- Cisco Access Server family cisco
- Cistron PortSlave portslave
- Computone PowerRack computone
- Cyclades PathRAS pathras
- Livingston PortMaster livingston
- Multitech CommPlete Server multitech
- Patton 2800 family patton
-
- Usually this is the same list as in the "clients" file, but not every
- NAS is a client and not every client is a NAS (this will start to make
- sense if you use radius proxy servers).
-
-3c. NASPASSWD
-
- If ``checkrad'' needs to login on your terminal server to check who
- is online on a certain port (i.e. it's not possible to use SNMP or
- finger) you need to define a loginname and password here.
+ Configure these clients with a "radius secret", which should also be
+ entered into the client definition in /etc/raddb/clients.conf.
+ See also the manual page for clients.conf(5).
- This is normally ONLY needed for USR/3Com Total Control, NetServer and
- Cyclades PathRAS terminal servers!
+3b. 'users'
-3d. HINTS
-
- Customize the /etc/raddb/mods-config/preprocess/hints file. This file is
- used to give users different login type based on a prefix/suffix of their
- loginname. For example, logging in as "user" may result in a rlogin session
- to a Unix system, and logging in as "Puser" could start a PPP session.
-
-3e. HUNTGROUPS
-
- This is the /etc/raddb/mods-config/preprocess/huntgroups file. Here you can
- define different huntgroups. These can be used to:
-
- - restrict access to certain huntgroups to certain users/groups of
- users (define this in the huntgroups file itself)
- - match a loginname with a huntgroup in /etc/raddb/users. One use
- for this is to give a user a static IP address based on the
- huntgroup / Point of Presence (s)he dials in to.
-
-3f. USERS
-
- With the original RADIUS server, every user had to be defined in this
- file. There could be one default entry, where you could for example
- define that a user not in the radius file would be checked agains the
- UNIX password file and on successful login would get a PPP connection.
-
- In the new style file, you can define multiple DEFAULT entries. All
- entries are processed in the order as they appear in the users file.
+ Users may be defined in the "users" file (raddb/mods-config/files/authorize).
+ All entries are processed in the order as they appear in the file.
If an entry matches the username, radiusd will stop scanning the users
- file unless the attribute "Fall-Through = Yes" is set.
+ file (unless the attribute "Fall-Through = Yes" is set).
You can uses spaces in usernames by escaping them with \ or by using
quotes. For example, "joe user" or joe\ user.
- The FreeRADIUS server does not trim any spaces from a username received
- from the portmaster (Livingston does, in perl notation, $user =~ s/\s+.*//;)
+ The 'users' file is read by the "rlm_files" module.
-3g. NEW RADIUS ATTRIBUTES (to be used in the USERS file).
+3c. NEW RADIUS ATTRIBUTES (to be used in the USERS file).
Name Type Descr.
---- ---- ------
The files in other directories are:
- debian/ Files to build a "freeradius" Debian Linux package.
+ debian/ Files to build Debian Linux packages.
doc/ Various snippets of documentation
doc/rfc/ Copies of the RFC's. If you have Perl, do a 'make' in
that directory, and look at the HTML output.
- libltdl/ Libtool platform independent library system.
-
man/ Unix Manual pages for the server, configuration files,
and associated utilities.
mibs/ SNMP Mibs for the server.
- raddb/ Sample configuration files for the server.
+ raddb/ Default configuration files for the server.
- redhat/ Additional files for a RedHat Linux system.
+ redhat/ Files to build RedHat RPM packages.
scripts/ Sample scripts for startup and maintenance.
+ share/ Attribute dictionaries.
+
src/ Source code
src/main source code for the daemon and associated utilities
src/lib source code for the RADIUS library
src/include header files
src/modules dynamic plug-in modules
+ src/tests test harness used by "make test"
- suse/ Aditional files for a SuSE (UnitedLinux) system.
-
- todo/ TODO list and assorted files.
+ suse/ Files to build SuSE RPM packages.
If you have ANY problems, concerns, or surprises when running
the server, then run it in debugging mode, as root, from the
command line:
- $ radiusd -X
+ # radiusd -X
It will produce a large number of messages. The answers to many
questions, and the solution to many problems, can usually be found in
For further details, see:
- http://www.freeradius.org/faq/
+ https://freeradius.org/documentation/
and the 'bugs' file, in this directory.
projects / thirdparty / freeradius-server.git / commitdiff
