::ffff
, see Section 3.7.10. BindV6Only.<Client oscar.open.com.au> Secret XG1gFty566 </Client> <Client 203.63.154.7> # An IPv4 client Secret kj1fgkj77878& </Client> <Client 203.10.1.0/24> # An IPv4 class C address group Secret ljdfhjlsd </Client> <Client ::ffff:203.10.1.0/120> # See the note above Secret ljdfhjlsd </Client> <Client 2001:db8:100:f101:0:0:0:1> # An IPv6 client Secret pqr </Client> <Client 2001:db8:100::/64> # An IPv6 /64 sized network Secret pqr </Client> #<Client MAC:2a-1f-09-5a-25-2a> # # Client identified by its MAC address # Secret gshgs #</Client> ## Handle all other clients with this secret #<Client DEFAULT> # Secret xyzzy #</Client>
User-Password
and some other less frequently
used attributes. Shared secret is also used for RADIUS message integrity
checking with the exception of Access-Request messages. You must define a
shared secret for each Client, and it must match the secret configured
into the client RADIUS software. There is no default. The secret can be
any number of ASCII characters. Any ASCII character except newline is
permitted, but it might be easier if you restrict yourself to the
printable characters. For a reasonable level of security, the secret
should be at least 16 characters, and a mixture of upper and lower case,
digits and punctuation. You should not use just a single recognisable
word.# This better agree with the client at # 10.20.30.40 or we won't understand them! <Client 10.20.30.40> Secret 66+6obaFGkmRNs-R </Client>
EncryptedSecret
is in encrypted format and
is preferred over Secret
. See Section 3.14.1. Secret for more about RADIUS shared
secrets. # This better agree with the client at # 10.20.30.41 or we won't understand them! <Client 10.20.30.41> EncryptedSecret {rcrypt}1F67Kx6WXHKHpOuRZHSaIJdI </Client>
Secret
.# 10.20.30.40 has separate secret for dynauth requests <Client 10.20.30.40> Secret 66+6obaFGkmRNs-R DynAuthSecret 7e4+674.4a614A1b </Client>
EncryptedDynAuthSecret
is in encrypted format and is
preferred over
DynAuthSecret
.# 10.20.30.41 has separate secret for dynauth requests <Client 10.20.30.41> EncryptedSecret {rcrypt}1F67Kx6WXHKHpOuRZHSaIJdI EncryptedDynAuthSecret {rcrypt}oVYMAWI/UUYPj4zbo3l95lKk </Client>
# Realmless logins to this NAS will be treated # as if they are for realm open.com.au <Client acc1.open.com.au> Secret .... DefaultRealm open.com.au </Client> <Realm open.com.au> ..... </Realm>
# brian.open.com.au is being tested <Client brian.open.com.au> Secret 666obaFGkmRNs666 DupInterval 0 </Client>
IdenticalClients 10.1.1.1 10.1.1.2 nas.mydomain.com IdenticalClients 10.1.1.7 10.1.1.8 10.1.1.9 IdenticalClients 203.63.154.1 localhost IdenticalClients MAC:11-22-33-44-55-66 IdenticalClients 203.10.1.0/24 220.10.0.0/16 IdenticalClients 2001:db8:22:1::/64 2001:db8:22:2::/64
PreHandlerHook
is called for
each request after per-Client user name rewriting and duplicate
rejection, and before the request is passed to a Realm or Handler
clause.PreHandlerHook
specifies a Perl hook to be called before the inner request is
re-dispatched to a matching Realm or Handler.EAP_LEAP_MSCHAP_Convert
flag is
set, PreHandlerHook
specifies a Perl hook to
be called before the converted request is re-dispatched to a
matching Realm or Handler.EAP_PEAP_MSCHAP_Convert
flag is set, PreHandlerHook
specifies a Perl
hook to be called before the converted request is re-dispatched to
a matching Realm or Handler.EAP_GTC_PAP_Convert
flag is
set, PreHandlerHook
specifies a Perl hook to
be called before the converted request is re-dispatched to a
matching Realm or Handler.PreHandlerHook
is
called for each request created by the clause before the request is
passed to a Realm or Handler clause.PreHandlerHook
is
called for each request after global and per-ServerRADSEC user name
rewriting and before the request is passed to a Realm or Handler
clause.PreHandlerHook
is
called for each request received by ServerDIAMETER before the request
is passed to a Realm or Handler clause.PreHandlerHook
is
called for each request before it is passed to a Realm or Handler
clause. If a Client is found for the request, Client's
PrehandlerHook
is run before ServerTACASPLUS's
PreHandlerHook
. Global and per-Client user name
rewriting and other processing is done before the hooks are
run.PreHandlerHook
can be an arbitrarily complicated Perl function, that might run external
processes, consult databases, change the contents of the current request
or many other things. Here is an example of using
PreHandlerHook
:# Fake a new attribute into the request PreHandlerHook sub { ${$_[0]}->add_attr('test-attr', \ 'test-value');}
StatusServer
to one of the
following values:off
minimal
default
<Client xxxxxx> # Show stats about this client in Server-Status replies StatusServerShowClientDetails Secret xxxxxx .... </Client>
<Client 10.1.2.3> Identifier www-proxy Secret mysecret </Client> # www-proxy <Handler Client-Identifier=www-proxy> <AuthBy FILE> Filename %D/www-proxy-users </AuthBy> </Handler>
PacketTrace
set off or
0
.PacketTrace
is available
for the following clauses:Client
Handler
Realm
AuthBy
ServerDIAMETER
ServerRADSEC
ServerTACACSPLUS
PacketTrace
:# Debug any packets that pass through here PacketTrace
StripFromReply
does never remove any attributes added
by DefaultReply
. Value is a list of comma separated
attribute value pairs all on one line, exactly as for any reply item. You
can use any of the special % formats in the attribute values. There is no
default.<AuthBy UNIX>
and <AuthBy SYSTEM>
, which do not have a way of
specifying per-user reply items. In other AuthBy methods you can also very
easily set up a standard set of reply items for all users, yet you can
still override reply items on a per-user basis.# If the user had no reply items set some DefaultReply Service-Type=Framed,Framed-Protocol=PPP
# Remove dangerous attributes from the reply StripFromReply Framed-IP-Netmask,Framed-Compression
StripFromReply
: It specifies the only attributes that
are permitted in an Access-Accept. It is useful, for example, to limit the
attributes that are passed back to the NAS from a proxy server. This way
you can prevent downstream customer RADIUS servers from sending back
illegal or troublesome attributes to your NAS.# Only permit a limited set of reply attributes. AllowInReply Session-Timeout, Framed-IP-Address
# Only permit a limited set of attributes in a reject. AllowInReject Message-Authenticator, EAP-Message
# Append some necessary attributes for our pops AddToReply cisco-avpair="ip:addr_pool=mypool"
# Always handle dups of Accounting-Request packets NoIgnoreDuplicates Accounting-Request
# Remove any NAS-IP-Address,NAS-Port attributes StripFromRequest NAS-IP-Address,NAS-Port
# Append a Filter-ID and host name AddToRequest Calling-Station-Id=1,Login-IP-Host=%h
# Append a Filter-ID and host name if they are not there already AddToRequestIfNotExist Calling-Station-Id=1,Login-IP-Host=%h
Client
clause checks the value of any
Message-Authenticator
attribute in incoming EAP or
other requests. An incorrect authenticator causes the request to be
ignored. RequireMessageAuthenticator
flag causes the clause to
require a correct Message-Authenticator
attribute to
be present in all incoming requests that support
Message-Authenticator
attribute. Most of the request
types support Message-Authenticator
. Accounting
requests and responses do not support
Message-Authenticator
.LimitProxyState
flag
parameter causes the Client
to require a
Message-Authenticator
attribute to be present when
one or more Proxy-State
attributes are received.
Radius clients that are not proxies should never send
Proxy-State
attributes. Proxies should always include
a Message-Authenticator
with the messages they
forward. Limiting Proxy-State
to requests which also
include Message-Authenticator
allows the server to
discard unexpected requests from non-proxy clients.Message-Authenticator
. Consider RequireMessageAuthenticator
for proxies and other clients that support
Message-Authenticator
.AuthBy DYNAUTH
, to provide a per request
value that is not overwritten by this parameter. When set, a common value
is 3799
.# Certain vendor may default to non-standard port <Client 172.3.2.2> Secret 666obaFGkmRNs666 DynAuthPort 1700 </Client>
# This NAS requires Message-Authenticator for dynauth requests <Client 172.3.2.3> Secret 666obaFGkmRNs666 DynAuthPort 1700 UseMessageAuthenticator </Client>
/Radius/Nas/
directory. For more
information about VSA translation, see Section 3.14.33. VsaTranslateIn.Client
or
<AuthBy RADIUS>
vendor type. The general format
for VsaTranslateIn
and
VsaTranslateOut
is:VsaTranslateIn
source_attr, dest_attr[, translation, strip|nostrip,
extras]
source_attr
is the translation source
attribute.dest_attr
defines the name for the newly
translated attribute.translation
defaults to copy which does no
modification. The available translation depend on the
VsaVendor
and VsaType
configuration parameters.strip
or nostrip
defaults to
nostrip
for VsaTranslateIn
and
strip
for VsaTranslateOut
.extras
depends on the translation,
VsaVendor
and VsaType
.VsaVenedor
,
VsaType
, VsaTranslateIn
,
VsaTranslateOut
, and the related configuration
parameters is in
goodies/vsa-translate.cfg
.# Translate incoming MAC address to common internal format # and copy the DNS address in a VSA <Client 192.168.3.49> Identifier juniper Secret mysecret # These control how the translation is done VsaVendor Juniper VsaType junos # macaddr transforms MAC addresses to and from internal presentation VsaTranslateIn Unisphere-Pppoe-Description, OSC-Mac-Address, macaddr # Convert internal presentation to what this client expects VsaTranslateOut OSC-DNS-Address1, Unisphere-Primary-Dns </Client>
MaxSessions
parameter in <Realm> or
<Handler> clauses. In either case, during authentication, Radiator
first checks its Session Database to see if the user's session count is
exceeded. For more information, see Section 3.18. <SessionDatabase SQL>
and Section 3.20. <SessionDatabase DBM>.
Since this count can be inaccurate in the face of NAS reboots, lost
packets etc. Radiator can also double check the count by interrogating the
NAS directly (you enable this by specifying NasType
in the Client clause).unknown
or do
not specify any value at all, Radiator will never try to contact the NAS
to check the user's sessions, and it will always assume that the sessions
it thinks are present are correct. If you specify ignore
,
Radiator will never try to contact the NAS to check the users sessions,
and it will always assume that there are no multiple sessions.NasType
as a check item,
to confirm that a request came from a client with a specific
NasType
.NasType
are:NasType | Method used to connect to NAS |
Livingston | SNMP |
Portslave | Finger |
PortslaveLinux | Finger. For use with Portslave running on a Linux host, understands Linux finger format. |
PortslaveMoxa | Finger, requires ctlportslave to be installed as fingerd on the target Linux host. Supports Linux running Portslave and a Moxa multiport. |
Cisco | SNMP |
CiscoVPDN | SNMP, detects users terminated on a l2tp, pptp or l2f tunnel. |
Colubris | SNMP |
Ascend | Finger |
AscendSNMP | SNMP |
Computone | Finger |
Cyclades | SNMP |
Hiper | SNMP |
NomadixSNMP | SNMP |
Redback | SNMP |
Shiva | Finger |
TotalControl | pmwho |
TotalControlSNMP | SNMP |
Bay, Bay5399SNMP, Bay8000SNMP | SNMP |
Bay4000SNMP | SNMP |
BayFinger | Finger |
Tigris, TigrisNew | SNMP for new version of the Tigris MIB (i.e. firmware revision 10.1.4.14 or greater) |
TigrisOld | SNMP for old versions of the Tigris MIB |
NortelCVX1800 | SNMP |
Xyplex | Finger |
Patton | SNMP |
Portmaster3 | SNMP |
Portmaster4 | pmwho For use with Portmaster 4’s running ComOS 4.1 or later |
Ping | Verifies a login by ICMP pinging the Framed-IP-Address of the dialup user. This is not foolproof if the IP address has been reallocated. Requires that Radiator be run with root permissions (on Unix). |
ignore | Does not contact NAS under any circumstances. Always assumes that there are no multiple logins. |
unknown | The default value. Does not connect to the NAS under any circumstances. Always assumes the Session Database is correct. |
CiscoSessionMIB | SNMP, using the Session MIB available in Cisco IOS 12.2.15T and later. |
NasType
s by adding a suitably named module to the
Radius/Nas directory. Your new module should implement the isOnline
function. See the existing Radius/Nas/*pm
modules for
examples. If you do implement your own module, send us a copy so we may
include it in future releases.
# Make Radiator ask the NAS to confirm multiple logins. # its a Total Control box NasType TotalControl
SNMPCommunity private
# Work out the users IP address from the first # FramedGroupBaseAddress specified in out client FramedGroup 0
<Client ..> # This is the base address for Framed-Group = 0 FramedGroupBaseAddress 10.0.0.1 # This is the base address for Framed-Group = 1 FramedGroupBaseAddress 10.0.1.1 # This is the base address for Framed-Group = 2 FramedGroupBaseAddress 10.0.2.1 .... </Client>
mikem User-Password = "fred" Framed-Group = 1, Framed-Protocol = PPP, etc.
<AuthBy whatever...> # This will cause all users authorised by this clause to get # an address allocated from the block starting 10.0.1.1, # unless overridden by a user-specific Framed-Group FramedGroup 1 ..... </AuthBy>
<AuthBy whatever> ...... UseAddressHint DynamicReply USR-IP-Input-Filter </AuthBy>
DEFAULT User-Password = "UNIX" Framed-IP-Address = 255.255.255.254, Framed-Routing = None, Framed-IP-Netmask = 255.255.255.255, USR-IP-Input-Filter = "1 REJECT src-addr != %a;", Service-Type = Framed-User
Dynamic
. That name is still recognised as a
synonym for DynamicReply
.IgnoreAcctSignature
, it
prevents the server from checking the authenticator Authenticator field in
requests received from this client. Contrary to its name, it applies to
all message types and also prevents checking the
Message-Authenticator
attribute. This parameter is
useful because some clients do not send Authenticators that conform to
RADIUS RFCs. Message-Authenticator
attribute. Regardless
of the setting of this parameter, the server always sends a correctly
computed Authenticator and Message-Authenticator
attribute. IgnoreAccSignature
. The bad
authenticator log message looks this:Bad authenticator in request from <client name> (<nas identifier>)
IgnoreAccSignature
. The bad EAP
Message-Authenticator log message looks this:Bad EAP Message-Authenticator
# brian.open.com.au has a broken legacy NAS <Client 10.20.30.40> Identifier brian.open.com.au Secret 666obaFGkmRNs666 IgnoreAcctSignature </Client>