GNU Radius Reference Manual

nas login sid port [ip] · Remote Authentication Dial In User Service

`raddb/config'
`raddb/dictionary'
`raddb/clients'
`raddb/naslist'
`raddb/nastypes'
`raddb/hints'
`raddb/huntgroups'
`raddb/realms'
`raddb/users'
`raddb/access.deny'
`raddb/sqlserver'
`raddb/rewrite'
`raddb/menus'
`raddb'
`radlog'
`radacct'
`datadir'
... this information is contained in file `raddb/sqlserver' 

`/usr/local/etc/raddb/sqlserver'
`raddb/dictionary'
`huntgroups'
`hints'
`users'
`raddb/dictionary'
`hints'
`huntgroups'
`users'
`clients'
`raddb/clients'
`clients'
`raddb/hints'
`raddb/hints'
`raddb/huntgroups'
`raddb/huntgroups'
`raddb/realms'
`raddb/realms'
`raddb/hints'
`raddb/hints'
`raddb/huntgroups'
`raddb/huntgroups'
`raddb/users'
`raddb/users'
`raddb/users'
`raddb/config'
`raddb/config'
`radacct/NASNAME/detail.auth'
`raddb/naslist'
`/usr/local/etc/raddb'
`raddb/config'
MODULE
MODULE = LEVEL

logging {
        category debug {
                level DEBUG_LEVEL;
        };
};

logging {
        category auth {
                print-pass yes;
        };
};

`raddb/config'
`raddb'
`config'
`clients'
`clients'
`naslist'
`nastypes'
`naslist'
`dictionary'
`users'
`hints'
`huntgroups'
`huntgroups'
`hints'
`users'
`realms'
`access.deny'
`sqlserver'
`rewrite'
`menus'
`raddb/config'
`raddb/dictionary'
`raddb/clients'
`raddb/naslist'
`raddb/nastypes'
`raddb/hints'
`raddb/huntgroups'
`raddb/realms'
`raddb/users'
`raddb/access.deny'
`raddb/sqlserver'
`raddb/rewrite'
`raddb/menus'
`raddb/config'
`raddb/config'
`raddb/config'
`raddb/config'
`raddb/config'
# A shell comment
/* A C-style
 * multi-line comment
 */
// A C++-style comment

option {
        source-ip number ; 
        max-requests number ; 
        radiusd-user string ; 
        exec-program-user string ; 
        username-chars string ; 
        log-dir string ; 
        acct-dir string ; 
        resolve bool ; 
        max-processes number ; 
        process-idle-timeout number ; 
        master-read-timeout number ; 
        master-write-timeout number ; 
} ;

`raddb/users'
`/etc/passwd'
username-chars ":"

username-chars ".-_!@#$%^&\\/\":"

logging {
        prefix-hook string ; 
        suffix-hook string ; 
        category category_spec {
                channel channel_name ; 
                print-auth bool ; 
                print-pass bool ; 
                print-failed-pass bool ; 
                level debug_level ; 
        } ; 
        channel channel_name {
                file string ;
                syslog facility . priority ; 
                print-pid bool ; 
                print-category bool ; 
                print-cons bool ; 
                print-level bool ; 
                print-priority bool ; 
                print-tid bool; 
                print-milliseconds bool; 
                prefix-hook string ; 
                suffix-hook string ; 
        }; 
} ;

logging {
        channel default {
                file "radius.log";
                print-category yes;
                print-priority yes;
        };
        channel info {
                file "radius.info";
                print-pid yes;
                print-cons yes;
                print-priority yes;
        };
        channel notice {
                syslog auth.notice;
        };

        category auth {
                print-auth yes;
                print-failed-pass yes;
        };
        category notice {
                channel notice;
        };
        category info {
                channel info;
        };
        category debug {
                channel info;
                level radiusd=1,files;
        };

        category *.!debug {
                channel default;
        };
};

auth {
        listen ( addr-list | no ); 
        forward addr-list; 
        port number ; 
        max-requests number ; 
        time-to-live number ; 
        request-cleanup-delay number ; 
        detail bool ; 
        strip-names bool ; 
        checkrad-assume-logged bool ; 
        password-expire-warning number ; 
        compare-atribute-flag character ; 
        trace-rules bool ; 
        reject-malformed-names bool ; 
} ;

listen 10.10.10.1, 10.10.11.2:1645;

`radacct/nasname/detail.auth'
acct {
        listen ( addr-list | no ); 
        forward addr-list ; 
        port number ; 
        detail bool; 
        system bool;
        max-requests number ; 
        time-to-live number ; 
        request-cleanup-delay number ; 
        compare-atribute-flag character ; 
        trace-rules bool ; 
} ;

listen 10.10.10.1, 10.10.11.2:1646;

usedbm ( yes | no ) ;

`raddb/users'
snmp {
        port portno ; 
        listen ( addr-list | no ); 
        max-requests number ; 
        time-to-live number ; 
        request-cleanup-delay number ; 
        ident string ; 
        community name ( rw | ro ) ; 
        network name network [ network ... ] ; 
        acl {
                allow network_name community_name ; 
                deny network_name ; 
        } ; 
        storage {
                file filename ; 
                perms number ; 
                max-nas-count number ; 
                max-port-count number ; 
        } ; 
};

listen 10.10.10.1, 10.10.11.2:4500;

reached SNMP storage limit for the number of
monitored NASes: increase max-nas-count

reached SNMP storage limit for the number of
monitored ports: increase max-port-count

rewrite {
        stack-size number ; 
        load-path string ; 
        load string ; 
};

`RADDB'
`DATADIR'
guile {
        debug bool ; 
        load-path string ; 
        load string ; 
        load-module string [ string ... ] ; 
        eval expression [ expression ... ] ; 
        gc-interval number ; 
        outfile string ; 
};

message {
        account-closed string ; 
        password-expired string ; 
        password-expire-warning string ; 
        access-denied string ; 
        realm-quota string ; 
        multiple-login string ; 
        second-login string ; 
        timespan-violation string ; 
};

Password Will Expire in %R{Password-Expire-Days} Days\r\n

filters {
        filter ident {
                exec-path path ;
                error-log filename ;
                common bool [max-wait];
                auth {
                        input-format fmt ;
                        wait-reply bool ;
                };
                acct {
                        input-format fmt ;
                        wait-reply bool ;
                };
        };
        ...
};

        input-format "=my_func()";

mlc {
        method (system|sql);  
        checkrad-assume-logged bool;
};

`raddb/dictionary'
`raddb/dictionary'
$INCLUDE `filename'

`filename'
VENDOR  vendor-name vendor-id

VENDOR  Livingston  307

ATTRIBUTE  name  number  type [vendor] [flags]

`raddb/users'
`raddb/hints'
`raddb/huntgroups'
        [L--RLR]

`raddb/users'
`raddb/hints'
`raddb/huntgroups'
ATTRIBUTE  Service-Type  6 integer - [LR-RLR]=P 

`raddb/hints'
BEGIN VENDOR vendor-name [vendor-id]
...
END 

BEGIN-VENDOR vendor-name
...
END-VENDOR vendor-name

VENDOR          Livingston      307

ATTRIBUTE       LE-Terminate-Detail     2       string  Livingston
ATTRIBUTE       LE-Advice-of-Charge     3       string  Livingston

VENDOR Livingston 307
BEGIN VENDOR Livingston
ATTRIBUTE       LE-Terminate-Detail     2       string  
ATTRIBUTE       LE-Advice-of-Charge     3       string
END

BEGIN VENDOR Livingston 307
ATTRIBUTE       LE-Terminate-Detail     2       string  
ATTRIBUTE       LE-Advice-of-Charge     3       string
END

ALIAS name  alt-name

ALIAS User-Password Password

PROPERTY  name  flags
PROPERTY  name  +flags [-flags ...]

`raddb/users'
PROPERTY  User-Password [L-----]E

PROPERTY  My-Attrib     +P -=

VALUE   Attribute-Translation       Value-Translation       number

VALUE  Service-Type  Login-User  1

`raddb/clients'
`raddb/clients'
`raddb/clients'
10.10.10.0/27   seCRet

10.10.10.0/255.255.255.224   seCRet

`clients'
`clients'
# This is a list of clients which are allowed to make authentication 
# requests.
# Each record consists of two fields:
#       i.  Valid hostname.
#       ii. The shared encryption key for this hostname. 
#
#Client Name            Key
#----------------       -------------------
myhost.dom.ain          guessme         
merlin                  emrys           
11.10.10.10             secRet

`raddb/naslist'
`raddb/naslist'
`nastypes'
`raddb/nastypes'
`nastypes'
`naslist'
`naslist'
# raddb/naslist: contains a list of Network Access Servers 
#
# Each record consists of following fields:
#
#       i.      A valid hostname or IP address for the client.
#       ii.     The short name to use in the logfiles for this NAS.
#       iii.    Type of device. Valid values are `true', `false' and
#               those defined in raddb/nastypes file.

# NAS Name              Short Name      Type
#----------------       ----------      ----
myhost.dom.ain          myhost          unix
merlin                  merlin          max 
11.10.10.10             arthur          livingston

`raddb/nastypes'
`raddb/nastypes'
`raddb/nastypes'
`raddb/nastypes'
# Type     Method          Args
# ----     ------          ----
unix       finger       function=check_unix
max-f      finger       function=check_max_finger
max        snmp         oid=.1.3.6.1.4.1.529.12.3.1.4.%d,
                        function=check_snmp_u
as5300-f   finger       function=check_as5300_finger
as5300     snmp         oid=.1.3.6.1.4.1.9.9.150.1.1.3.1.2.%d,
                        function=check_snmp_u
livingston snmp         oid=.1.3.6.1.4.1.307.3.2.1.1.1.5.%P,
                        function=check_snmp_s

`nastypes'
`naslist'
#Hostname       Shortname   Type
#--------       ---------   ----
nas.name        T           unix

`naslist'
#Hostname       Shortname   Type  Flags
#--------       ---------   ----  -----
nas.name        T           max-f broken_pass

`raddb/naslist'
`naslist'
#Hostname       Shortname   Type  Flags
#--------       ---------   ----  -----
nas.name        T           max-f broken_pass,community=comm

`raddb/hints'
`raddb/hints'
`hints'
`hints'
`hints'
`hints'
## If the username starts with `U', append the UUCP hint 
DEFAULT         Prefix = "U", Strip-User-Name = No
                Hint = "UUCP"
## If the username ends with `.slip', append the SLIP service data
## and remove the suffix from the user name.
DEFAULT         Suffix = ".slip",
                   Strip-User-Name = Yes
                Hint = "SLIP",
                   Service-Type = Framed-User,
                   Framed-Protocol = SLIP

`raddb/huntgroups'
`raddb/huntgroups'
`huntgroups'
`huntgroups'
`huntgroups'
## This defines the packet rewriting function for the server 11.10.10.11
DEFAULT NAS-IP-Address = 11.10.10.11, Rewrite-Function = "max_fixup"
        NULL

`raddb/realms'
`raddb/realms'
`raddb/realms'
servername[:auth-port[:acct-port]]

# Wrong!
realm.name      localhost

# Use this to declare a locally handled realm
realm.nam       LOCAL

`raddb/realms'
myrealm.net     remote.server.net:1812  ignorecase

`realms'
`realms'
`realms'
# Realm                 Remote server[:port]            flags
#----------------       ---------------------           --------
that.net                radius.that.net                 nostrip
dom.ain                 server.dom.ain:3000             strip,quota=20
remote.net              srv1.remote.net,srv2.remote.net 

# Realm                 Remote server[:port]            flags
#----------------       ---------------------           --------
NOREALM                 radius.server.net               
that.net                radius.that.net                 nostrip
dom.ain                 server.dom.ain:3000             strip,quota=20

`raddb/users'
`raddb/users'
`users'
`users'
`users'
## The following entry is matched when the user appends ``.ppp'' to his
## username when logging in.
## The suffix is removed from the user name, then the password is
## looked up in the SQL database.
## Users may log in at any time. They get PPP service.
DEFAULT Suffix = ".ppp",
                Auth-Type = SQL,
                Login-Time = "Al",
                Simultaneous-Use = 1,
                Strip-User-Name = Yes
        Service-Type = Framed-User,
                Framed-Protocol = PPP

## This is for SLIP users.
## This entry is matched when the auth request matches ``SLIP'' hint
DEFAULT Hint = "SLIP",
                Auth-Type = Mysql
        Service-Type = Framed-User
                Framed-Protocol = SLIP

## The following authenticates users using system passwd files.
## The users are allowed to log in from 7:55 to 23:05 on any weekday,
## except the weekend, and from 07:55 to 12:00 on Sunday.
## Only one login is allowed per user.
## The program telauth is used to further check the authentication
## information and provide the reply pairs
## Note the use of backslashes to split a long line.
DEFAULT Auth-Type = System,
                Login-Time = "Wk0755-2305,Su0755-1200",
                Simultaneous-Use = 1
        Exec-Program-Wait = "/usr/local/sbin/telauth \
                             %C{User-Name} \
                             %C{Calling-Station-Id} \
                             %C{NAS-IP-Address} \
                             %C{NAS-Port-Id}"

## This particular user is authenticated via PAM. He is presented a
## choice from `raddb/menus/menu1' file.
gray    Auth-Type = Pam
        Menu = menu1

`raddb/access.deny'
`raddb/access.deny'
`raddb/sqlserver'
`raddb/sqlserver'
`sqlserver'
CREATE TABLE passwd (
  user_name           varchar(32) binary default '' not null,
  service             char(16) default 'Framed-PPP' not null,
  password            char(64) 
);

CREATE TABLE groups (
  user_name           char(32) binary default '' not null,
  user_group          char(32) 
);

auth_query  SELECT password
            FROM passwd
            WHERE user_name = '%C{User-Name}'
            AND service = '%C{Auth-Data}'

group_query SELECT user_group
            FROM groups
            WHERE user_name = '%C{User-Name}'

attr-name, attr-value, opcode

attr-name, attr-value

CREATE TABLE attrib (
  user_name varchar(32) default '' not null,
  attr      char(32) default '' not null,
  value     char(128),
  op enum("=", "!=", "<", ">", "<=", ">=") default null
);

check_attr_query  SELECT attr,value,op \
                  FROM attrib \
                  WHERE user_name='%u' \
                  AND op IS NOT NULL

reply_attr_query  SELECT attr,value \
                  FROM attrib \
                  WHERE user_name='%u' \
                  AND op IS NULL

`raddb/users'
DEFAULT Auth-Type = SQL
        Service-Type = Framed-User   

`raddb/users'
Auth-Type = SQL,
NAS-IP-Address = 10.10.10.1,
NAS-Port-Id <= 20

Service-Type = Framed-User,
Framed-Protocol = PPP,
Framed-IP-Address = 10.10.10.11

CREATE TABLE calls (
  status              int(3),
  user_name           char(32),
  event_date_time     datetime DEFAULT '0000-00-00 00:00:00' NOT NULL,
  nas_ip_address      char(17),
  nas_port_id         int(6),
  acct_session_id     char(16) DEFAULT '' NOT NULL,
  acct_session_time   int(11),
  acct_input_octets   int(11),
  acct_output_octets  int(11),
  connect_term_reason int(4),
  framed_ip_address   char(17),
  called_station_id   char(32),
  calling_station_id  char(32)
);

# Query to be used on session start
acct_start_query     INSERT INTO calls \
                     VALUES(%C{Acct-Status-Type},\
                            '%u',\
                            '%G',\
                            '%C{NAS-IP-Address}',\
                            %C{NAS-Port-Id},\
                            '%C{Acct-Session-Id}',\
                            0,\
                            0,\
                            0,\
                            0,\
                            '%C{Framed-IP-Address}',\
                            '%C{Called-Station-Id}',\
                            '%C{Calling-Station-Id}')

status = 2
acct_session_time = value of Acct-Session-Time attribute
acct_input_octets = value of Acct-Input-Octets attribute
acct_output_octets = value of Acct-Output-Octets attribute
connect_term_reason = value of Acct-Terminate-Cause attribute

# Query to be used on session end
acct_stop_query      UPDATE calls \
                     SET status=%C{Acct-Status-Type},\
                         acct_session_time=%C{Acct-Session-Time},\
                         acct_input_octets=%C{Acct-Input-Octets},\
                         acct_output_octets=%C{Acct-Output-Octets},\
                         connect_term_reason=%C{Acct-Terminate-Cause} \
                     WHERE user_name='%C{User-Name}' \
                     AND status = 1 \
                     AND acct_session_id='%C{Acct-Session-Id}' 

acct_alive_query  UPDATE calls \
                  SET acct_session_time=%C{Acct-Session-Time},\
                      acct_input_octets=%C{Acct-Input-Octets},\
                      acct_output_octets=%C{Acct-Output-Octets},\
                      framed_ip_address=%C{Framed-IP-Address} \
                  WHERE user_name='%C{User-Name}' \
                  AND status = 1 \
                  AND acct_session_id='%C{Acct-Session-Id}'

# Query to be used when a NAS goes down, i.e. when it sends 
# Accounting-Off packet
acct_nasdown_query UPDATE calls \
                   SET status=2,\
                       acct_session_time=unix_timestamp(now())-\
                               unix_timestamp(event_date_time) \
                   WHERE status=1 \
                   AND nas_ip_address='%C{NAS-IP-Address}'

# Query to be used when a NAS goes up, i.e. when it sends 
# Accounting-On packet
acct_nasup_query   UPDATE calls \
                   SET status=3,\
                       acct_session_time=unix_timestamp(now())-\
                               unix_timestamp(event_date_time) \
                   WHERE status=1 \
                   AND nas_ip_address='%C{NAS-IP-Address}'

user-name, nas-ip-address, nas-port-id, acct-session-id

mlc_user_query SELECT user_name,nas_ip_address,\
                      nas_port_id,acct_session_id \
               FROM calls \
               WHERE user_name='%C{User-Name}' \
               AND status = 1

mlc_realm_query SELECT user_name,nas_ip_address,\
                       nas_port_id,acct_session_id \
                FROM calls \
                WHERE realm_name='%C{Realm-Name}'     

mlc_stop_query UPDATE calls \
               SET status=4,\
                acct_session_time=unix_timestamp(now())-\
                                  unix_timestamp(event_date_time) \
               WHERE user_name='%C{User-Name}' \
                 AND status = 1 \
                 AND acct_session_id='%C{Acct-Session-Id}' 

`raddb/rewrite'
`raddb/rewrite'
`raddb/menus'
Menu = <menu-name>

`raddb/menus'
`raddb/menus/menu1'
menu
        *** Welcome EEE user! ***
Please select an option:

        1. Start CSLIP session
        2. Start PPP session
        3. Quit

        Option:
end
# CSLIP choice
# Framed-IP-Address of 255.255.255.254 indicates that the NAS should
# select an address for the user from its own IP pool.
1
        Service-Type = Framed-User,
        Framed-Protocol = SLIP,
        Framed-IP-Address = 255.255.255.254,
        Termination-Menu = "menu1"
# PPP choice
2
        Service-Type = Framed-User,
        Framed-Protocol = PPP,
        Framed-IP-Address = 255.255.255.254,
        Termination-Menu = "menu1"
# A special menu EXIT means abort the session
3
        Menu = "EXIT"
# Return to this menu if no valid choice have been entered 
DEFAULT
        Menu = "menu1"

`raddb/users'
DEFAULT Auth-Type = System
        Menu = "menu1"

        *** Welcome EEE user! ***
Please select an option:

        1. Start CSLIP session
        2. Start PPP session
        3. Quit

        Option:

        Service-Type = Framed-User,
        Framed-Protocol = PPP,
        Framed-IP-Address = 255.255.255.254,
        Termination-Menu = "menu1"

menu
        *** Welcome here! ***
Please enter an option:
        ppp     ---     Start PPP session
        telnet  ---     Begin guest login session
        other   ---     Select other option

        Enter your choice:
end
ppp
        Service-Type = Framed-User,
        Framed-Protocol = PPP
telnet
        Service-Type = Login-User,
        Login-IP-Host = 10.11.11.7,
        Login-Service = Telnet,
        Login-TCP-Port = 23
other
        Menu = "menu1"
DEFAULT
        menu = "menu2"

`users'
`sqlserver'
nasid=%C{NAS-Identifier} ==> nasid=A "new" host
nasid="%C{NAS-Identifier}" ==> nasid="A \"new\" host"
nasid=%\C{NAS-Identifier} ==> nasid=A \"new\" host

reason=%C{Acct-Terminate-Cause} ==> reason=10
reason='%C{Acct-Terminate-Cause}' ==> reason='NAS-Request'
reason=%\C{Acct-Terminate-Cause} ==> reason=NAS-Request

        %C{Acct-Session-Time:-0}

        %C{Acct-Session-Time:=0}

`raddb/config'
        compare-attribute-flag flag;

`raddb/naslist'
        compare-auth-flag=flag,compare-acct-flag=flag

`raddb/naslist'
`raddb/dictionary'
PROPERTY       User-Name               +12
PROPERTY       Password                +1
PROPERTY       NAS-Port-Id             +12
PROPERTY       State                   +1
PROPERTY       Called-Station-Id       +12
PROPERTY       Calling-Station-Id      +12
PROPERTY       Acct-Status-Type        +2
PROPERTY       Acct-Session-Id         +2
PROPERTY       Acct-Session-Time       +2

`raddb/config'
        auth {
                max-requests 127;
                request-cleanup-delay 2;
                compare-attribute-flag 1;
        };
        acct {
                max-requests 127;
                request-cleanup-delay 2;
                compare-attribute-flag 2;
        };                

     request-cleanup-delay = Nretries * Ntimeout + const

   Nretries = 3
   Ntimeout = 10

auth { 
        request-cleanup-delay 40;
};
acct { 
        request-cleanup-delay 40;
};

`users'
`users'
Auth-Type = Accept

`users'
guest   Auth-Type = Accept,
                Simultaneous-Use = 10
        Service-Type = Framed-User,
                Framed-Protocol = PPP

`raddb/access.deny'
`users'
Auth-Type = Reject

`users'
user-name  Auth-Type = Local,
                     User-Password = plaintext

user-name   Auth-Type = Local,
                      Password-Location = SQL

user-name  Auth-Type = Crypt-Local,
                     User-Password = crypt-pass

user-name  Crypt-Password = crypt-pass

user-name   Auth-Type = Crypt-Local,
                      Password-Location = SQL

Auth-Type = System

`users'
`users'
Auth-Type = Crypt-Local, Password-Location = SQL

`raddb/sqlserver'
Auth-Type = PAM

`users'
Auth-Type = PAM,
    Auth-Data = pam-service

`users'
DEFAULT  Auth-Type = Accept
         Scheme-Procedure = "my-auth"

`users'
Exec-Program-Wait = "progname args"

`raddb/config'
mlc {
    method sql;
};

`raddb/sqlserver'
user-name, nas-ip-address, nas-port-id, acct-session-id

mlc_user_query SELECT user_name,nas_ip_address,\
                      nas_port_id,acct_session_id \
               FROM calls \
               WHERE user_name='%C{User-Name}' \
               AND status = 1

mlc_realm_query SELECT user_name,nas_ip_address,\
                       nas_port_id,acct_session_id \
                FROM calls \
                WHERE realm_name='%C{Realm-Name}'     

mlc_stop_query UPDATE calls \
               SET status=4,\
                acct_session_time=unix_timestamp(now())-\
                                  unix_timestamp(event_date_time) \
               WHERE user_name='%C{User-Name}' \
                 AND status = 1 \
                 AND acct_session_id='%C{Acct-Session-Id}' 

`config'
`naslist'
`raddb/naslist'
`nastypes'
`raddb/nastypes'
`naslist'
`nastypes'
`/sbin/check_failure'
`/sbin/count_failure'
`raddb/users'
BEGIN   NULL
        Exec-Program-Wait = "/sbin/check_failure  %C{User-Name}",
        Auth-Failure-Trigger = "/sbin/count_failure %C{User-Name}",
                Fall-Through = Yes

DEFAULT Auth-Type = PAM
        Service-Type = Framed-User,
                Framed-Protocol = PPP

[... Other profiles ...]                

`/sbin/count_failure'
`/sbin/check_failure'
`/var/log/radius/fails'
#! /bin/bash

test $# -eq 1 || exit 1

MAXFAIL=8
REGDIR=/var/log/radius/fails

if [ -r "$REGDIR/$1" ]; then
  read COUNT < "$REGDIR/$1"
  COUNT=$((COUNT+1))
else
  COUNT=1
fi
echo $COUNT > "$REGDIR/$1"      
# End of /sbin/count_failure

#! /bin/bash

test $# -eq 1 || exit 1

MAXFAIL=8
REGDIR=/var/log/radius/fails

if [ -r "$REGDIR/$1" ]; then
  read COUNT < "$REGDIR/$1"
  if [ $COUNT -ge $MAXFAIL ]; then
    echo "Reply-Message=\"Too many login failures. Your account is locked\""
    exit 1
  else
    rm "$REGDIR/$1"
  fi
fi
exit 0

# End of check_failure

`raddb/sqlserver'
CREATE TABLE authfail (
  # User name this entry refers to
  user_name           varchar(32) binary default '' not null,
  # Number of successive authentication failures for this user
  count               int,
  # Timestamp when this entry was last updated
  time                datetime DEFAULT '1970-01-01 00:00:00' NOT NULL,
  # Create a unique index on user_name
  UNIQUE uname (user_name)
);

auth_failure_query UPDATE authfail \
                   SET count=count+1,time=now() \
                   WHERE user_name='%C{User-Name}'

auth_success_query UPDATE authfail \
                   SET count=0,time=now() \
                   WHERE user_name='%C{User-Name}'

`raddb/users'
DEFAULT Group = "*LOCKED_ACCOUNT*",
                Auth-Type = Reject
        Reply-Message = "Your account is currently locked.\n\
Please, contact your system administrator\n"

group_query       SELECT user_group FROM groups \
                  WHERE user_name='%u' \
                  UNION \
                  SELECT CASE WHEN (SELECT count > 8 FROM authfail \
                                                 WHERE user_name='%u')
                         THEN '*LOCKED_ACCOUNT*' END

INSERT INTO authfail VALUES('new-user',0,now());

`radutmp'
`radwtmp'
`raddb/config'
`radacct/nasname/detail'
`raddb/naslist'
`raddb/naslist'
`radacct'
`config'
Fri Dec 15 18:00:24 2000
        Acct-Session-Id = "2193976896017"
        User-Name = "e2"
        Acct-Status-Type = Start
        Acct-Authentic = RADIUS
        Service-Type = Framed-User
        Framed-Protocol = PPP
        Framed-IP-Address = 11.10.10.125
        Calling-Station-Id = "+15678023561"
        NAS-IP-Address = 11.10.10.11
        NAS-Port-Id = 8
        Acct-Delay-Time = 0
        Timestamp = 976896024
        Request-Authenticator = Unverified

Fri Dec 15 18:32:09 2000
        Acct-Session-Id = "2193976896017"
        User-Name = "e2"
        Acct-Status-Type = Stop
        Acct-Authentic = RADIUS
        Acct-Output-Octets = 5382
        Acct-Input-Octets = 7761
        Service-Type = Framed-User
        Framed-Protocol = PPP
        Framed-IP-Address = 11.10.10.125
        Acct-Session-Time = 1905
        NAS-IP-Address = 11.10.10.11
        NAS-Port-Id = 8
        Acct-Delay-Time = 0
        Timestamp = 976897929
        Request-Authenticator = Unverified

`sqlserver'
`raddb/sqlserver'
`raddb/sqlserver'
`hints'
DEFAULT NULL Scheme-Acct-Procedure = "my-acct"

`hints'
Acct-Ext-Program = "progname args"

level auth;

`config'
`radlog/radius.log'
`raddb/config'
`users'
`hints'
`huntgroups'
`config'
Oct 31 11:37:17 [28322]: Auth.info: (Access-Request foo 170 bar):
rule trace: /etc/raddb/users:157,22,3; huntgroups:72; hints:34

`/etc/raddb/hints'
`/etc/raddb/huntgroups'
`/etc/raddb/users'
`/etc/raddb/users'
`/etc/raddb/users'
`hints'
DEFAULT  Group = "root"
         Scheme-Acct-Procedure = "staff-acct",
                   Hint = "admin"

DEFAULT  Group = "staff"
         Scheme-Acct-Procedure = "staff-acct",
                   Hint = "staff"

`users'
DEFAULT Auth-Type = SQL,
              Simultaneous-Use = 1
        Service-Type = Framed-User,
              Framed-Protocol = PPP

DEFAULT Hint = "admin",
             Auth-Type = System
        Service-Type = Login-User,
             Login-IP-Host = 192.168.0.1,              
             Login-Service = Rlogin

DEFAULT Hint = "staff",
              Auth-Type = System,
              Simultaneous-Use = 1
         Service-Type = Login-User,
              Login-IP-Host = 192.168.0.2,
              Login-Service = Telnet

Nov 06 21:25:24: Auth.notice: (Access-Request local 61 svp):
  Login incorrect [svp]

`config'
trace-rules yes;

Nov 06 21:31:24: Auth.notice: (Access-Request local 13 svp):
  Login incorrect [svp]
Nov 06 21:31:24: Auth.info: (Access-Request local 13 svp):
  rule trace: /etc/raddb/users:1, hints: 5

`hints'
`users'
`users'
`users'
DEFAULT Hint = "admin",
             Auth-Type = System
        Service-Type = Login-User,
             Login-IP-Host = 192.168.0.1,              
             Login-Service = Rlogin

DEFAULT  Hint = "staff",
              Auth-Type = System,
              Simultaneous-Use = 1
         Service-Type = Login-User,
              Login-IP-Host = 192.168.0.2,
              Login-Service = Telnet

DEFAULT Auth-Type = SQL,
              Simultaneous-Use = 1
        Service-Type = Framed-User,
              Framed-Protocol = PPP

Nov 06 21:35:14: Auth.notice: (Access-Request local 42 svp):
  Login OK [svp]
Nov 06 21:35:14: Auth.info: (Access-Request local 42 svp):
  rule trace: /etc/raddb/users:7, hints: 5

Nov 06 21:39:05: Auth.notice: (Access-Request local 122 plog):
  Login OK [svp]
Nov 06 21:39:05: Auth.info: (Access-Request local 122 plog):
  rule trace: /etc/raddb/users:14

        proxy.c=10,files.c,config.y=1

radiusd -mt

** TEST SHELL **
(radiusd) _

(radiusd) help
h       help                           Print this help screen
q       query-nas NAS LOGIN SID PORT [IP]
                                       Query the given NAS
g       guile                          Enter Guile
rs      rewrite-stack [NUMBER]         Print or set the Rewrite
                                       stack size
r       run-rewrite FUNCTION(args..)   Run given Rewrite function
s       source FILE                    Source the given Rewrite file
t       timespan TIMESPAN [DOW [HH [MM]]]
                                       Check the timespan interval
d       debug LEVEL                    Set debugging level
rd      request-define [PAIR [,PAIR]]  Define a request
rp      request-print                  Print the request
quit    quit                           Quit the shell

`raddb/naslist'
(radiusd) timespan Wk0900-1800
ctime: Tue Dec  2 16:08:47 2003
inside Wk0900-1800: 6720 seconds left

(radiusd) timespan Wk0900-1800 0
ctime: Sun Nov 30 16:09:03 2003
OUTSIDE Wk0900-1800: 60660 seconds to wait

(radiusd) timespan Wk0900-1800 0 12 30
ctime: Sun Nov 30 12:30:13 2003
OUTSIDE Wk0900-1800: 73800 seconds to wait

(radiusd) timespan Wk0900-1800 1 05 00
ctime: Mon Dec  1 05:00:33 2003
OUTSIDE Wk0900-1800: 14400 seconds to wait

(radiusd) timespan Wk0900-1800 1 09 10
ctime: Wed Jan  7 22:09:41 2004
OUTSIDE Wk0900-1800: 39060 seconds to wait

(radiusd) timespan Wk0900-1800 1 09 10
ctime: Mon Dec  1 09:10:44 2003
inside Wk0900-1800: 31800 seconds left

(radiusd) 

(radiusd) request-define
Enter the pair list. End with end of file
[radiusd] User-Name = smith, User-Password = guessme
[radiusd] NAS-IP-Address = 10.10.10.1
[radiusd] NAS-Port-Id = 34
[radiusd] 
(radiusd) 

(radiusd) request-print
    User-Name = (STRING) smith
    User-Password = (STRING) guessme
    NAS-IP-Address = (IPADDR) 10.10.10.1
    NAS-Port-Id = (INTEGER) 34
(radiusd) 

#! /bin/sh

DB=/var/db/userlist

while read NAME CLID
do
    if grep "$1:$2" $DB; then
        echo "0"
    else
        echo "1"
    fi
done

`raddb/config'
filters {
    filter check_clid {
        exec-path "/usr/libexec/myfilter";
        error-log "myfilter.log";
        auth {
            input-format "%C{User-Name}
            %C{Calling-Station-Id}";
            wait-reply yes;
        };
    };        
};                        

`myfilter.log'
DEFAULT Auth-Type = System,
                Simultaneous-Use = 1
        Exec-Program-Wait = "|check_clid"

#! /bin/sh

DB=/var/db/userlist

while read NAME CLID
do
    if grep "$1:$2" $DB; then
        echo "0 Service-Type = Login, Session-Timeout = 1200"
    else
        echo "1 Reply-Message = 
              \"You are not authorized to log in\""
    fi
done

#! /bin/sh

AUTH_DB=/var/db/userlist
ACCT_DB=/var/db/acct.db

while read CODE NAME CLID DATE
do
    case CODE
    auth)
        if grep "$1:$2" $DB; then
            echo "0 Service-Type = Login, \
                  Session-Timeout = 1200"
        else
            echo "1 Reply-Message = \
                  \"You are not authorized to log in\""
        fi
    acct)
        echo "$CODE $NAME $CLID $DATE" >> $ACCT_DB
done

`raddb/config'
filter check_clid {
    exec-path "/usr/libexec/myfilter";
    error-log "myfilter.log";
    auth {
        input-format "auth %C{User-Name} 
                      %C{Calling-Station-Id}";
        wait-reply yes;
    };
    acct {
        input-format "acct %C{User-Name} 
                      %C{Calling-Station-Id} %D";
        wait-reply no;
    };
};        

`raddb/hints'
DEFAULT NULL
        Acct-Ext-Program = "|check_clid:

string
foo(integer i)
{
    string rc;
    if (i % 2)
        rc = "odd";
    else
        rc = "even";
    return "the number is " + rc;
}

integer
px_add()
{
        %[User-Name] = "pfx-" + %[User-Name];
        return 0;
}

`naslist'
DEFAULT  NAS-IP-Address = 11.10.10.11
         Rewrite-Function = "fixup"

`hints'
`hints'
DEFAULT  Prefix = "P"
         Rewrite-Function = "fixup"

integer fixup()
{
}

`rewrite'
/*
 * decode MAX port number
 * input: P        --  The value of NAS-Port-Id attribute
 *        portcnt  --  number of physical ports on the NAS
 */
integer
max_decode_port(integer P, integer portcnt)
{
    if (P > 9999) {
        integer s, l, c;

        s = P / 10000;
        l = (P - (10000 * s))/100; 
        c = P - ((10000 * s) + (100 * l)); 
        return (c-1) + (l-1) * portcnt;
    }
    return P;
}

/*
 * Interface function for MAX terminal server with 23 ports.
 * Note that it saves the received NAS-Port-Id attribute in
 * the Orig-NAS-Port-Id attribute. The latter must be
 * defined somewhere in the dictionary
 */
integer
max_fixup()
{
    %[Orig-NAS-Port-Id] = %[NAS-Port-Id];
                                  # Preserve original data
    %[NAS-Port-Id] = max_decode_port(%[NAS-Port-Id], 23);
    return 0;
}

/* 
 * The port rewriting function for Cisco AS5300 used for
 * VoIP. This function is used to generate NAS-Port-Id pair
 * on the basis of vendor-specific pair 2. If the latter is
 * in the form "ISDN 9:D:999" (where each 9 represents a
 * decimal digit), then the function returns the number
 * after the last colon. This is used as a port number.
 */
integer
cisco_pid(string A)
{
    if (A =~ 
        ".*\([0-9][0-9]*\):
         [A-Z0-9][A-Z0-9]*:\([0-9][0-9]*\)") {
        return (integer)\2;
    }
    return -1;
}

/*
 * This function parses the packed session id.
 * The actual sid is the number before the first slash
 * character.  Other possibly relevant fields are also
 * parsed out and saved in the Voip-* A/V pairs. The latter
 * should be defined somewhere in the dictionary.
 * Note that the regular expression in this example
 * spans several lines for readability. It should be on one 
 * line in real file.
 */
string
cisco_sid(string S)
{
   if (S =~ "\(.[^/]*\)/[^/]*/[^/]*/\([^/]*\)/\([^/]*\)/
             \([^/]*\)/\([^/]*\)/\([^/]*\)/\([^/]*\)
             /\([^/]*\).*") {
        %[Voip-Connection-ID] = \2;
        %[Voip-Call-Leg-Type] = \3;
        %[Voip-Connection-Type] = \4;
        %[Voip-Connect-Time] = \5;
        %[Voip-Disconnect-Time] = \6;
        %[Voip-Disconnect-Cause] = \7;
        %[Voip-Remote-IP] = \8;
        return \1;
   } 
   return S;
}

/*
 * Normalize cisco AS5300 packets
 */
integer
cisco_fixup()
{
    integer pid;

    if ((pid = cisco_pid(%[Cisco-PRI-Circuit])) != -1) {
        if (*%[NAS-Port-Id])
            %[Orig-NAS-Port-Id] = %[NAS-Port-Id];
        %[NAS-Port-Id] = pid;
    }
    if (*%[Acct-Session-Id]) {
        %[Orig-Acct-Session-Id] = %[Acct-Session-Id];
        %[Acct-Session-Id] = cisco_sid(%[Acct-Session-Id]);
    }
    return 0;
}

integer
login_nt(string uname)
{
    integer i;

    if ((i = index(uname, '\\')) != -1)
        return substr(uname, i+1, -1);
    return uname;
}

integer
nt_rewrite()
{
    %[Orig-User-Name] = %[User-Name];
    %[User-Name] = login_nt(%[User-Name]);
    return 0;
}

`raddb/nastypes'
`raddb/naslist'
`raddb/nastypes'
integer
check_unix(string str, string name, integer pid, string sid)
{
    return field(str, 1) == name
           && field(str, 3) == pid
           && field(str, 7) == sid;
}

integer
check_username(string str, string name, integer pid, string sid)
{
    return str == name;
}

`raddb/users'
DEFAULT Auth-Type = SQL
        Service-Type = Framed-User,
            Framed-IP-Address = "=get_ip_addr(10.10.10.1)"

integer
get_ip_address(integer base)
{
    return base + %[NAS-Port-Id] - %[NAS-Port-Id]/16;
}

`raddb/naslist'
string
compat_log_prefix(integer reqtype, string nas, integer id)
{
        string result;

        return "(" + request_code_string(reqtype) + " "
                   + nas + " " + (string)id + " " + %[User-Name] + ")";
}

Auth.notice: Login OK [jsmith]
...
Auth.notice: (AUTHREQ nas-2 251 jsmith): Login OK [jsmith]

`%[' attribute-name `]'
`%[' attribute-name `]' `(' n `)'

`raddb/dictionary'
        %[attribute-name](0)

        %[attribute-name]

`\number'

string
basename(string arg)
{
    if (arg =~ ".*/\(.*\)\..*")
        return \1;
    else
        return arg;
}

type function-name (parameter-list)

type parm-name

type ident_list ;

`(' type `)' ident

ident = expression ;

ident ( arg-list )

delete attribute-name;
delete attribute-name(n);

#pragma regex option-list

#pragma regex +extended +icase

#pragma regex -extended 

#pragma regex -extended -icase -newline

length("string") => 6

index("/raddb/users", 47) => 0

index("/raddb/users", 45) => -1

rindex("/raddb/users", 47) => 6

substr("foo-bar-baz", 3, 5) => "-bar-"

field("GNU's not UNIX", 1) => "GNU's"
field("GNU's not UNIX", 2) => "not"
field("GNU's not UNIX", 3) => "UNIX"
field("GNU's not UNIX", 4) => ""

inet_aton("127.0.0.1") => 2130706433

inet_ntoa(2130706433) => "127.0.0.1"

gsub("s","S","strings")
    => "StringS"
gsub("[0-9][0-9]*","N","28 or 29 days")
    => "N or N days"
gsub("[()'\"]","/","\"a\" (quoted) 'string'")
    => "/a/ /quoted/ /string/"

qprn("a string/value") => "a%20string%2Fvalue"

quote_string("François contains non-!-printable chars")
  => "Fran\347ois contains non\tprintable chars"

unquote_string("Fran\347ois") => "François"

toupper("a-string") => "A-STRING"

tolower("A-STRING") => "a-string"

request_code_string(4) => "Accounting-Request"

integer
restore_nas_ip()
{
        if (!*%[NAS-IP-Address])
                %[NAS-IP-Address] = request_source_ip();
        return 0;
}

        Session-Timeout = 10

        (cons "Session-Timeout" 10)

        (cons 27 10)

        User-Name = "jsmith",
                User-Password = "guessme",
                NAS-IP-Address = 10.10.10.1,
                NAS-Port-Id = 10

        (list
          (cons "User-Name" "jsmith")
          (cons "User-Password" "guessme")
          (cons "NAS-IP-Address" "10.10.10.1")
          (cons "NAS-Port-Id" 10))

    (cons return-code list)

(define (decline-auth request-list check-list reply-list)
  (cons #f
        (list
         (cons "Reply-Message"
               "\r\nSorry, you are not
                allowed to log in\r\n"))))

(define staff-data
  (list
   (list "scheme"
         (cons
          (list (cons "NAS-IP-Address" "127.0.0.1"))
          (list (cons "Framed-MTU" "8096")))
         (cons
          '()
          (list (cons "Framed-MTU" "256"))))))

(define (auth req check reply)
  (let* ((username (assoc "User-Name" req))
         (reqlist (assoc username req))
         (reply-list '()))
    (if username
        (let ((user-data (assoc (cdr username) staff-data)))
          (rad-log L_INFO (format #f "~A" user-data))
          (if user-data
              (call-with-current-continuation
               (lambda (xx)
                 (for-each
                  (lambda (pair)
                    (cond
                     ((avl-match? req (car pair))
                      (set! reply-list (avl-merge
                                        reply-list
                                        (cdr pair)))
                      (xx #t))))
                  (cdr user-data))
                 #f)))))
    (cons
     #t
     reply-list)))

`raddb/users'
DEFAULT Auth-Type = SQL
        Scheme-Procedure = "auth"

(define radius-acct-file "/var/log/acct/radius")

(define (acct req)
  (call-with-output-file radius-acct-file
    (lambda (port)
      (for-each (lambda (pair)
                  (display (car pair) port)
                  (display "=" port)
                  (display (cdr pair) port)
                  (newline port))
                req)
      (newline port)))
  #t)

`raddb/users'
`/etc/inetd.conf'
finger stream tcp nowait nobody /usr/sbin/radwho
radwho -fL

`utmp'
`radutmp'
`radutmp'
`radutmp'
`/etc/passwd'
`raddb/realms'
(login 10 Login) (gecos 17 Name) \
(protocol 5 Proto) (nas-port 5 TTY) \
(time 9 When) (nas-address 9 From) \
(framed-address 16 Location)

`radutmp'
(login 32 Login) (session-id 32 SID) \
(protocol 5 Proto) (nas-port 5 Port) \
(time 27 Date) (nas-address 32 NAS) \
(clid 17 CLID) (duration 7 Duration) \
(framed-address 16 Location) (realm 16 Realm)

`radutmp'
User: (login)(newline)\
In real life: (gecos)(newline)\
Logged in: (time)(newline)\
NAS: (nas-address)(newline)\
Port: (nas-port)(newline)\
CLID: (clid)(newline)\
Protocol: (protocol)(newline)\
Session ID: (session-id)(newline)\
Uptime: (duration)(newline)\
Assigned IP: (framed-address)(newline)\
Realm: (realm)(newline)"

`/var/log/radwtmp'
`radwtmp'
radzap [options] [username]

`/usr/local/etc/raddb'
`RADLOG/radutmp'
`radutmp'
radping username
radping -c calling-station-id

radauth [options] [command] user-name [password]

radctl command [args]

`radlog/radius.parse'
19692 ?        01:53:11 radiusd

`raddb/users'
`raddb/users.db'
`raddb/users.pag'
`raddb/users.dir'
`/usr/local/etc/raddb'
(list id-str host-str secret-str auth-num acct-num
      cntl-num)

        (cons attr-name-str value)

        (cons attr-number value)

        (list return-code-number pair-list)

        '()

(list id-str host-str secret-str auth-num acct-num
      cntl-num)

(list id-str host-str secret-str auth-num acct-num
      cntl-num)

                (cons name-str value)

                (cons attr-number value)

                (cons name-str value)

                (cons attr-number value)

`raddb/client.conf'
source_ip ip-addr

server name ip-addr secret auth-port acct-port

timeout number

retry number

`raddb/client.conf'
server first 10.11.10.1 secret 1645 1646
server second 10.11.10.1 secret 1645 1646
source_ip 127.0.0.1
timeout 3
retry 5

`/usr/local/etc/raddb'
A-string
"String, containing white space"

"Always quote \" character"

"This string contains a \
newline character."

<<[-]delimiter
  text
delimiter

print <<EOT
usage: foo [OPTIONS] [NAME...]
OPTIONS are:
  -h            Print this help list.
EOT

name op value

( User-Name = "test" NAS-IP-Address = 10.10.10.1 )

acct, and, auth, begin, break, case, continue, 
do, else, end, exit, expect, getopt, if,       
in, input, not, or, print, return, send,     
set, shift, while    

'case' = 1

${case} + 2

variable = expression

foo = 1
print $foo => 1
foo = "bar"
print $foo => bar
foo = ( User-Name = "antonius" NAS-IP-Address = 127.0.0.1 )
print $foo => ( User-Name = "antonius" NAS-IP-Address = 127.0.0.1 )

x = y = 1

'case' = 1

foo = 1
print foo => foo
print $foo => 1

print $x error--> variable `x' used before definition

long-name = 2
$long-name => 2
$long-name-1 error--> variable `long-name-1' used before definition
${long-name}-1 => 1
$long-name - 1 => 1

$x error--> variable `x' used before definition
${x:-1} => 1
x = 2
${x:-1} => 2

$x error--> variable `x' used before definition
${x:=1} => 1
$x => 1

$x error--> variable `x' used before definition
${x:?} error--> x: variable unset
${x:?foobar} error--> foobar

${x::} -| (<teletype>:1)x?
${x::Enter value of x: } -| Enter value of x: 

$variable [ attribute-name ]

$variable [ attribute-name * ]

x = (NAS-Port-Id = 127.0.0.1 \
     Reply-Message = "a long"
     Reply-Message = " string"

$x[NAS-Port-Id] => 127.0.0.1
$x[Reply-Message] => "a long"
$x[Reply-Message*] => "a long string"

--assign variable=text
-a variable=text

radtest -a foobar=5

variable=text

radtest -f myprog.rad foo=5 addr=127.0.0.1

#! /usr/local/bin/radtest -f
print $addr

myprog.rad addr=127.0.0.1

`client.conf'
radtest -f script.rad name foo=bar 5

`script.rad'
$0 => script.rad
$1 => name
$2 => 5

"string" + "ent" => "stringent"

( User-Name = "foo" ) + ( Password = "bar" )
=> ( User-Name = "foo" Password = "bar" )

( User-Name = "foo" Service-Type = Login-User ) + \
 ( Service-Type = Framed-User Password = "bar" )
=> ( User-Name = "foo" \
          Service-Type = Framed-User \
          Password = "bar" )

( User-Name = "foo" Service-Type = Login-User ) - \
( Service-Type = Framed-User )
=> ( User-Name = "foo" )

( User-Name = "foo" Service-Type = Login-User ) - \
( Service-Type = Framed-User )
=> ( Service-Type = Login-User )

# Wrong!
1 < $x < 2

-(1 + 1)  => -2
-(127.0.0.1 + 2) => -2130706435
- ("1" + "1") => -11
- "text" error--> cannot convert string to integer

not 0 => 1
not 10 => 0
not "23" => 0
not "0" => 1
not "text" => 0
not "" => 1
not 127.0.0.1 => 0
not 0.0.0.0 => 1

foo()             no arguments
bar(1)            one argument
bar(1, "string")  two arguments

name
begin
  ...
end

hypo
begin
        return $1*$1 + $2*$2
end

`raddb/client.conf'
send [flags] port-type code [expr-or-pair-list]

# Send a Status-Server request without attributes.
send auth Status-Server

# Send an Access-Request with two attributes
send auth Access-Request User-Name = "foo" User-Password = "bar"

# Send an Accounting-Request, taking attributes from the variable
# attr
send acct Accounting-Request $attr

send auth Access-Request User-Name = "foo" User-Password = "bar"
expect Access-Accept Reply-Message = "Access allowed"

if cond stmt

if $REPLY[NAS-IP-Address] = 127.0.0.1
   print "Request from localhost"

if cond stmt-1 else stmt-2 

if $REPLY_CODE != Accounting-Response
begin
  print "Accounting failed.\n"
  exit 1        
end else
  print "Accounting succeeded.\n"

case expr in
expr-1 ) stmt-1
expr-2 ) stmt-2
...
expr-n ) stmt-n
end

case $COMMAND in
"auth.*")       authenticate($LIST, no)
"acct")         authenticate($LIST, yes)
".*")           begin
                  print "Unknown command."
                  exit 1
                end
end

while cond
  stmt

do
  stmt
while cond

while $x < 10
begin
  if $x < $y
     break
  ...
  x = $x + 1
end
print "OK\n"

while $y < 10
begin
  while $x < 10
  begin
    if $x < $y
       break 2
    ...
    x = $x + 1 
  end
  ...
  y = $y + 1 
end  
print "OK\n"

while getopt "hf:"
case $OPTVAR in
"-h")  print "Got -h option\n"
"-f")  print "Got -f option. Argument is " $OPTARG "\n"
".*")  begin
          print "Unknown option: " $OPTVAR "\n"
          exit 1
       end
  end
end

  1 #! /usr/bin/radtest -f
  2 
  3 while getopt "n:s:P:hv"
  4 begin
  5   case $OPTVAR in
  6   "-n") NASIP = $OPTARG 
  7   "-s") SID = $OPTARG 
  8   "-P") PID = $OPTARG 
  9   "-v") set -v

 10   "-h") begin
 11           print <<-EOT
 12            usage: radauth [OPTIONS] [COMMAND] login [password]
 13            Options are:
 14            -v         Print verbose descriptions of what is being done
 15            -n IP      Set NAS IP address
 16            -s SID     Set session ID
 17            -P PORT    Set NAS port number
 18            COMMAND is one of:
 19            auth       Send only Access-Request (default)
 20            acct       Send Access-Request. If successfull, send
 21                       accounting start request
 22            start      Send accounting start request
 23            stop       Send accounting stop request
 24            EOT
 25           exit 0
 26         end
 27   ".*") begin
 28           print "Unknown option: " $OPTVAR "\n"
 29           exit 1
 30         end
 31   end
 32 end

 33 
 34 shift ${OPTIND}-1
 35 
 36 if $# > 3
 37 begin
 38         print "Wrong number of arguments."
 39         print "Try radauth -h for more info"
 40         exit 1
 41 end

 42
 43 case $1 in
 44 "auth|acct|start|stop") begin
 45                           COMMAND=$1
 46                           shift 1
 47                         end
 48 ".*")   COMMAND="auth"
 49 end
 50 
 51 LOGIN=${1:?User name is not specified. Try radauth -h for more info.}
 52 
 53 if ${NASIP:-} = ""
 54         NASIP=$SOURCEIP
 55 
 56 LIST = ( User-Name = $LOGIN NAS-IP-Address = $NASIP )

 57 
 58 'acct'
 59 begin
 60   if ${SID:-} = ""
 61     input "Enter session ID: " SID
 62   if ${PID:-} = ""
 63     input "Enter NAS port ID: " PID
 64   send auth Accounting-Request $1 + \
            (Acct-Session-Id = $SID NAS-Port-Id = $PID)

 65   if $REPLY_CODE != Accounting-Response
 66   begin
 67     print "Accounting failed.\n"
 68     exit 1  
 69   end
 70   print "Accounting OK.\n"
 71   exit 0
 72 end
 73

 74 'auth'
 75 begin
 76   send auth Access-Request $1 + (User-Password = $2)

 77   while 1
 78   begin
 79     if $REPLY_CODE = Access-Accept
 80     begin
 81       print "Authentication passed. " + $REPLY[Reply-Message*] + "\n"
 82       if ${3:-no} = no
 83         exit 0
 84       'acct'($1 + ( Acct-Status-Type = Start ))
 85     end else if $REPLY_CODE = Access-Reject
 86     begin
 87       print "Authentication failed. " + $REPLY[Reply-Message*] + "\n"
 88       break

`raddb/menus'
 89     end else if $REPLY_CODE = Access-Challenge
 90     begin
 91       print $REPLY[Reply-Message*]
 92       input 
 93       send auth Access-Request \
 94         (User-Name = $LOGIN User-Password = $INPUT \
             State = $REPLY[State])

 95     end else begin
 96       print "Authentication failed. Reply code " + $REPLY_CODE + "\n"
 97       break
 98     end
 99   end
100   exit 1
101 end
102

103 case ${COMMAND} in
104 "auth")   'auth'($LIST, ${2:&Password: }, no)
105 "acct")   'auth'($LIST, ${2:&Password: }, yes)
106 "start")  'acct'($LIST+(Acct-Status-Type = Start))
107 "stop")   'acct'($LIST+(Acct-Status-Type = Stop))
108 ".*")       begin
109               print "Unknown command. Try radauth -h for more info"
110               exit 1
111             end
112 end
113 
114 # End of radauth

radsession options action

ln -s libexec/nas.scm /etc/ppp/ip-up
ln -s libexec/nas.scm /etc/ppp/ip-down

`raddb/client.conf'
`raddb/nas.rc'
`nas.rc'
`/etc/inittab'
`inittab'
d0:345:respawn:/sbin/mgetty ttyS0 vt100
d1:345:respawn:/sbin/mgetty ttyS1 vt100
...

`login.config'
*       -       -       /usr/local/libexec/nas.scm @

`inittab'
d0:345:respawn:/sbin/agetty -mt60 \
   -l /usr/local/libexec/nas.scm 38400,19200,9600 \
   ttyS0 vt100
d1:345:respawn:/sbin/agetty -mt60 \
   -l /usr/local/libexec/nas.scm 38400,19200,9600 \
   ttyS1 vt100
...

`$sysconfdir/etc/raddb'
        attr: Service-Type=type

ATTRIBUTE name value type

`raddb/users'
`raddb/hints'
`raddb/huntgroups'
ATTRIBUTE CHAP-Password 3 string

ATTRIBUTE Callback-Id 20 string

ATTRIBUTE Callback-Number 19 string

ATTRIBUTE Called-Station-Id 30 string

ATTRIBUTE Calling-Station-Id 31 string

ATTRIBUTE Class 25 string

ATTRIBUTE Framed-Compression 13 integer

VALUE      Framed-Compression  None                 0       
VALUE      Framed-Compression  Van-Jacobson-TCP-IP  1       

ATTRIBUTE Framed-IP-Address 8 ipaddr

        Framed-IP-Address = 10.10.0.1+

ATTRIBUTE Framed-IP-Netmask 9 ipaddr

ATTRIBUTE Framed-MTU 12 integer

ATTRIBUTE Framed-Protocol 7 integer

VALUE      Framed-Protocol   PPP                  1       
VALUE      Framed-Protocol   SLIP                 2       

ATTRIBUTE Framed-Route 22 string

ATTRIBUTE Framed-Routing 10 integer

VALUE      Framed-Routing    None                 0       
VALUE      Framed-Routing    Broadcast            1       
VALUE      Framed-Routing    Listen               2       
VALUE      Framed-Routing    Broadcast-Listen     3       

ATTRIBUTE Idle-Timeout 28 integer

ATTRIBUTE NAS-IP-Address 4 ipaddr

ATTRIBUTE NAS-Identifier 32 string

ATTRIBUTE NAS-Port-Id 5 integer

`raddb/rewrite'
ATTRIBUTE NAS-Port-Type 61 integer

VALUE      NAS-Port-Type     Async                0       
VALUE      NAS-Port-Type     Sync                 1       
VALUE      NAS-Port-Type     ISDN                 2       
VALUE      NAS-Port-Type     ISDN-V120            3       
VALUE      NAS-Port-Type     ISDN-V110            4       

ATTRIBUTE Reply-Message 18 string

ATTRIBUTE Service-Type 6 integer

VALUE      Service-Type      Login-User           1       
VALUE      Service-Type      Framed-User          2       
VALUE      Service-Type      Callback-Login-User  3       
VALUE      Service-Type      Callback-Framed-User 4       
VALUE      Service-Type      Outbound-User        5       
VALUE      Service-Type      Administrative-User  6       
VALUE      Service-Type      NAS-Prompt-User      7       
VALUE      Service-Type      Authenticate-Only    8       
VALUE      Service-Type      Call-Check           10      

ATTRIBUTE Session-Timeout 27 integer

ATTRIBUTE State 24 string

ATTRIBUTE Termination-Action 29 integer

VALUE      Termination-Action  Default              0       
VALUE      Termination-Action  RADIUS-Request       1       

ATTRIBUTE User-Name 1 string

`include/radutmp.h'
`raddb/rewrite'
ATTRIBUTE User-Password 2 string

ATTRIBUTE Vendor-Specific 26 string

ATTRIBUTE Acct-Authentic 45 integer

VALUE           Acct-Authentic          RADIUS          1
VALUE           Acct-Authentic          Local           2
VALUE           Acct-Authentic          Remote          3

ATTRIBUTE Acct-Delay-Time 41 integer

ATTRIBUTE Acct-Input-Octets 42 integer

ATTRIBUTE Acct-Input-Packets 47 integer

ATTRIBUTE Acct-Output-Octets 43 integer

ATTRIBUTE Acct-Output-Packets 48 integer

ATTRIBUTE Acct-Session-Id 44 string

ATTRIBUTE Acct-Session-Time 46 integer

ATTRIBUTE Acct-Status-Type 40 integer

VALUE    Acct-Status-Type    Start              1
VALUE    Acct-Status-Type    Stop               2 
VALUE    Acct-Status-Type    Alive              3
VALUE    Acct-Status-Type    Accounting-On      7
VALUE    Acct-Status-Type    Accounting-Off     8

ATTRIBUTE Acct-Terminate-Cause 49 integer

VALUE    Acct-Terminate-Cause    User-Request            1
VALUE    Acct-Terminate-Cause    Lost-Carrier            2
VALUE    Acct-Terminate-Cause    Lost-Service            3
VALUE    Acct-Terminate-Cause    Idle-Timeout            4
VALUE    Acct-Terminate-Cause    Session-Timeout         5
VALUE    Acct-Terminate-Cause    Admin-Reset             6
VALUE    Acct-Terminate-Cause    Admin-Reboot            7
VALUE    Acct-Terminate-Cause    Port-Error              8
VALUE    Acct-Terminate-Cause    NAS-Error               9
VALUE    Acct-Terminate-Cause    NAS-Request             10
VALUE    Acct-Terminate-Cause    NAS-Reboot              11
VALUE    Acct-Terminate-Cause    Port-Unneeded           12
VALUE    Acct-Terminate-Cause    Port-Preempted          13
VALUE    Acct-Terminate-Cause    Port-Suspended          14
VALUE    Acct-Terminate-Cause    Service-Unavailable     15
VALUE    Acct-Terminate-Cause    Callback                16
VALUE    Acct-Terminate-Cause    User-Error              17
VALUE    Acct-Terminate-Cause    Host-Request            18

ATTRIBUTE Acct-Ext-Program 2008 string

`raddb/hints'
ATTRIBUTE Acct-Type 2003 integer

VALUE           Acct-Type               None    0
VALUE           Acct-Type               System  1
VALUE           Acct-Type               Detail  2
VALUE           Acct-Type               SQL     3

`radlog/radius.stderr'
ATTRIBUTE Auth-Data 2006 string

`raddb/sqlserver'
ATTRIBUTE Auth-Type 1000 integer

VALUE      Auth-Type         Local                0       
VALUE      Auth-Type         System               1       
VALUE      Auth-Type         Crypt-Local          3       
VALUE      Auth-Type         Reject               4       
VALUE      Auth-Type         SQL                  252     
VALUE      Auth-Type         Pam                  253     
VALUE      Auth-Type         Accept               254     

ATTRIBUTE Crypt-Password 1006 string

ATTRIBUTE Exec-Program-Wait 1039 string

`users'
DEFAULT Auth-Type = System,
                Simultaneous-Use = 1
        Exec-Program-Wait = "/usr/local/sbin/telauth \
                             %C{User-Name} \
                             %C{Calling-Station-Id}"

`/usr/local/sbin/telauth'
`/usr/local/sbin/telauth'
#! /bin/sh

DB=/var/db/userlist

if grep "$1:$2" $DB; then
    echo "Service-Type = Login,"
    echo "Session-Timeout = 1200"
    exit 0
else
    echo "Reply-Message = \
          \"You are not authorized to log in\""
    exit 1
fi

`/var/db/userlist'
`raddb/config'
`users'
DEFAULT Auth-Type = System,
                Simultaneous-Use = 1
        Exec-Program-Wait = "|myfilter"

`raddb/config'
filters {
    filter myfilter {
        exec-path "/usr/libexec/myfilter";
        error-log "myfilter.log";
        auth {
            input-format "%C{User-Name}
                          %C{Calling-Station-Id}";
            wait-reply yes;
        };
    };        
};                        

`myfilter.log'
#! /bin/sh

DB=/var/db/userlist

while read NAME CLID
do
    if grep "$1:$2" $DB; then
        echo "0 Service-Type = Login, Session-Timeout = 1200"
    else
        echo "1 Reply-Message = \
              \"You are not authorized to log in\""
    fi
done

ATTRIBUTE Exec-Program 1038 string

`users'
DEFAULT Auth-Type = System,
                Simultaneous-Use = 1
        Exec-Program = "/usr/local/sbin/logauth \
                        %C{User-Name} \
                        %C{Calling-Station-Id}"

`/usr/local/sbin/logauth'
ATTRIBUTE Fall-Through 1036 integer

VALUE      Fall-Through      No                   0       
VALUE      Fall-Through      Yes                  1       

`users'
johns   Auth-Type = SQL
                Framed-IP-Address = 11.10.10.251,
                Fall-Through = Yes

smith   Auth-Type = SQL
                Framed-IP-Address = 11.10.10.252,
                Fall-Through = Yes

DEFAULT NAS-IP-Address = 11.10.10.1
        Service-Type = Framed-User,
                Framed-Protocol = PPP

        Service-Type = Framed-User,
        Framed-Protocol = PPP,  
        Framed-IP-Address = 11.10.10.251

        Service-Type = Framed-User,
        Framed-Protocol = PPP,  
        Framed-IP-Address = 11.10.10.252

ATTRIBUTE Group 1005 string

ATTRIBUTE Hint 1040 string

`raddb/hints'
`hints'
DEFAULT         Prefix = "S", Strip-User-Name = No
                Hint = "SLIP"

`users'
DEFAULT Hint = "SLIP",
                NAS-IP-Address = 11.10.10.12,
                Auth-Type = System
        Service-Type = Framed-User,
                Framed-Protocol = SLIP

ATTRIBUTE Huntgroup-Name 221 string

`users'
`huntgroups'
`users'
`huntgroups'
User-Name = "john",
User-Password = "guess",
NAS-IP-Address = 10.11.11.1,
NAS-Port-Id = 24

`users'
john    Huntgroup-Name = "users_group",
                Auth-Type = System
        Service-Type = Login

`huntgroups'
users_group     NAS-IP-Address = 10.11.11.1
                NAS-Port-Id < 32

`raddb/huntgroups'
ATTRIBUTE Log-Mode-Mask 2007 integer

VALUE           Log-Mode-Mask           Log-Auth                1
VALUE           Log-Mode-Mask           Log-Auth-Pass           2
VALUE           Log-Mode-Mask           Log-Failed-Pass         4
VALUE           Log-Mode-Mask           Log-Pass                6
VALUE           Log-Mode-Mask           Log-All                 7

ATTRIBUTE Login-Time 1042 string

ATTRIBUTE Match-Profile 2004 string

IPPOOL  NAS-IP-Address = 10.10.10.1
                Framed-Protocol = PPP,
                Framed-IP-Address = "10.10.10.2"

IPPOOL  NAS-IP-Address = 10.10.11.1
                Framed-Protocol = PPP,
                Framed-IP-Address = "10.10.11.2"

guest   Auth-Type = SQL
                Service-Type = Framed-User,
        Match-Profile = IPPOOL

ATTRIBUTE Menu 1001 string

`RADIUS_DIR/menus/'
`raddb/menus'
ATTRIBUTE Pam-Auth 1041 string

Auth-Type = Pam

ATTRIBUTE Prefix 1003 string

`users'
`hints'
`users'
DEFAULT Prefix = "U", Auth-Type = System
                Service-Type = Login-User

ATTRIBUTE Proxy-Replied 2012 integer

VALUE      Proxy-Replied     No                   0       
VALUE      Proxy-Replied     Yes                  1       

ATTRIBUTE Realm-Name 2013 string

ATTRIBUTE Replace-User-Name 2001 string

VALUE      Replace-User-Name  No                   0       
VALUE      Replace-User-Name  Yes                  1       

`users'
guest   NAS-IP-Address = 11.10.10.11,
                Calling-Station-Id != ""
                Auth-Type = Accept
        Replace-User-Name = "guest#%C{Calling-Station-Id}",
                Service-Type = Framed-User,
                Framed-Protocol = PPP

ATTRIBUTE Rewrite-Function 2004 string

`hints'
`huntgroups'
`rewrite'
integer name()

`raddb/hints'
`raddb/huntgroups'
ATTRIBUTE Scheme-Acct-Procedure 2010 string

ATTRIBUTE Scheme-Procedure 2009 string

ATTRIBUTE Simultaneous-Use 1034 integer

ATTRIBUTE Strip-User-Name 1035 integer

VALUE      Strip-User-Name   No                   0       
VALUE      Strip-User-Name   Yes                  1       

`users'
DEFAULT Suffix = ".ppp",
                Strip-User-Name = Yes,
                Auth-Type = SQL
        Service-Type = Framed-User,
                Framed-Protocol = PPP

DEFAULT Suffix = ".slip",
                Strip-User-Name = Yes,
                Auth-Type = SQL
        Service-Type = Framed-User,
                Framed-Protocol = SLIP

ATTRIBUTE Suffix 1004 string

`users'
`hints'
`users'
DEFAULT Suffix = ".ppp", Auth-Type = System,
                Strip-User-Name = Yes
        Service-Type = Framed-User,
                Framed-Protocol = PPP        

ATTRIBUTE Termination-Menu 1002 string

`RADIUS_DIR/menus/'
`raddb/menus'
`/usr/local/etc/raddb'
`/etc/raddb'
`dictionary'
`hints'
`huntgroups'
`users'
`users'
enum grad_instr_type
{
  grad_instr_conditional,
  grad_instr_call,
  grad_instr_return,
  grad_instr_action,
  grad_instr_reply,
  grad_instr_proxy,
  grad_instr_forward
};

typedef struct grad_instr grad_instr_t;

struct grad_instr
{
  enum grad_instr_type type;
  grad_instr_t *next;
  union
    {
      grad_instr_conditional_t cond;
      grad_instr_call_t call;
      grad_instr_action_t action;
      grad_instr_reply_t reply;
      grad_instr_proxy_t proxy;
      grad_instr_forward_t forward;
    } v;                                                             
};

struct grad_instr_conditional
{
  grad_entry_point_t cond;  /* Entry point to the compiled
                               Rewrite condition */
  grad_instr_t *iftrue;     /* Points to the ``true'' branch  */
  grad_instr_t *iffalse;    /* Points to the ``false'' branch  */
};
typedef struct grad_instr_conditional grad_instr_conditional_t;

(COND "%[User-Name] ~= \"test-.*\""
      (REPLY Access-Reject ("Reply-Message" . "Test accounts disabled")))

(COND "%[Hint] == "PPP" && authorize(PAM)"
      (REPLY Access-Accept
             ("Service-Type" . "Framed-User")
             ("Framed-Protocol" . "PPP"))
      (REPLY Access-Reject
             ("Reply-Message" . "Access Denied")))

struct grad_instr_call {
       grad_instr_t *entry;    
};
typedef struct grad_instr_call grad_instr_call_t;

(CALL (ACTION "myfun(%[User-Name])")
      (REPLY Access-Reject
             ("Reply-Message" . "Access Denied")))

(CALL process_users)

(RETURN)

struct grad_instr_action {
       grad_entry_point_t expr;    /* Entry point to the compiled
                                      Rewrite expression */
};
typedef struct grad_instr_action grad_instr_reply_t;

(ACTION "%[NAS-IP-Address] = request_source_ip()")

struct grad_instr_reply {
       u_char reply_code;         /* Radius request code */
};
typedef struct grad_instr_reply grad_instr_reply_t;

(REPLY Access-Accept
       ("Service-Type" . "Framed-User")
       ("Framed-Protocol" . "PPP"))

struct grad_instr_proxy
{
  grad_realm_t realm;
};
typedef struct grad_instr_proxy grad_instr_proxy_t;

`raddb/realms'
`raddb/*'
struct grad_instr_forward
{
  grad_list_t server_list; 
};
typedef struct grad_instr_forward grad_instr_forward_t;

`forward.c'
`raddb/config'
`hints-huntgroups-users'
(defprog main
 (CALL hints)
 (CALL huntgroups)
 (COND "request_code() == Access-Request"
       (CALL users))
 (REPLY Access-Reject
        (Reply-Message . "\nAccess denied\n")))

# raddb/hints:
DEFAULT Prefix = "PPP" Hint = PPP

(defprog hints
 (COND "%[Prefix] == \"PPP\"")
       (ACTION "%[Hint] = \"PPP\""))

#raddb/huntgroups
DEFAULT NAS-IP-Address = 10.10.4.1      Suffix = "staff"
DEFAULT NAS-IP-Address = 10.10.4.2      Huntgroup-Name = "second"

(defprog huntgroups
 (COND "%[NAS-IP-Address] == 10.10.4.1 && !(%[Suffix] == \"staff\")"
       (REPLY Access-Reject
              ("Reply-Message" . "Access Denied by Huntgroup")))
 (COND "%[NAS-IP-Address] == 10.10.4.2"
       (ACTION "%[Huntgroup-Name] = \"second\"")))

`users'
#raddb/users
DEFAULT Hint = "PPP",
               Auth-Type = PAM
        Service-Type = Framed-User,
               Framed-Protocol = PPP

DEFAULT Huntgroup-Name = "second",
               Auth-Type = PAM
        Service-Type = "Authenticate-Only",
               Reply-Message = "Authentity Confirmed"

(defprog users
 (COND "%[Hint] == "PPP" && authorize(PAM)"
       (REPLY Access-Accept
             (Service-Type . Framed-User)
             (Framed-Protocol . PPP))
       (REPLY Access-Reject
             (Reply-Message . "Access Denied")))
 (COND "%[Huntgroup-Name] == \"second\" && authorize(PAM)"
       (REPLY Access-Accept
              (Service-Type . "Authenticate-Only")
              (Reply-Message . "Authentity Confirmed"))))

Copyright (C) 2000,2001,2002 Free Software Foundation, Inc.
59 Temple Place, Suite 330, Boston, MA  02111-1307, USA

Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.

  Copyright (C)  year  your name.
  Permission is granted to copy, distribute and/or modify this document
  under the terms of the GNU Free Documentation License, Version 1.2
  or any later version published by the Free Software Foundation;
  with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.
  A copy of the license is included in the section entitled ``GNU
  Free Documentation License''.

    with the Invariant Sections being list their titles, with
    the Front-Cover Texts being list, and with the Back-Cover Texts
    being list.

`access.deny'
`raddb/access.deny'
`client.conf'
`clients'
`clients'
`datadir'
`dictionary'
`raddb/dictionary'
`raddb/hints'
`hints'
`hints'
`raddb/huntgroups'
`huntgroups'
`huntgroups'
`config'
`raddb/naslist'
`menus'
`menus'
`raddb/menus'
`naslist'
`naslist'
`nastypes'
`nastypes'
`raddb/nastypes'
`raddb/realms'
`radacct'
`raddb'
`raddb/access.deny'
`raddb/access.deny'
`raddb/client.conf'
`raddb/clients'
`raddb/clients'
`raddb/config'
`raddb/config'
`raddb/hints'
`raddb/hints'
`raddb/huntgroups'
`raddb/huntgroups'
`raddb/menus'
`raddb/menus'
`raddb/naslist'
`raddb/naslist'
`raddb/realms'
`raddb/realms'
`raddb/rewrite'
`raddb/rewrite'
`raddb/sqlserver'
`raddb/sqlserver'
`raddb/users'
`raddb/users'
`raddb/dictionary'
`raddb/config'
`radlog'
`realms'
`realms'
`rewrite'
`raddb/rewrite'
`sqlserver'
`raddb/sqlserver'
`nastypes'
`raddb/nastypes'
`users'
`users'
`Hints'
`hints'
`huntgroups'
`users'
`hints'
`huntgroups'
`Huntgroups'
`raddb/config'
`raddb/dictionary'
`raddb/clients'
`clients'
`raddb/naslist'
`naslist'
`raddb/nastypes'
`raddb/nastypes'
`raddb/hints'
`hints'
`raddb/huntgroups'
`huntgroups'
`raddb/realms'
`realms'
`raddb/users'
`users'
`raddb/access.deny'
`raddb/sqlserver'
`raddb/rewrite'
`raddb/menus'

2. Naming Conventions		Conventions about naming files and directories
3. How Radius Operates		How `radiusd` operates
4. How to Start the Daemon.		How to start the daemon
5. Radius Configuration Files		`radiusd` configuration files
6. Request Comparison Methods		How duplicate requests are dealt with
7. Authentication		How users are authenticated
8. Accounting		Accounting methods
9. Logging		What gets logged and where
10. Problem Tracking		Fixing configuration errors
11. Extensions		Extending GNU Radius

15. Reporting Bugs		How to report a bug
16. Where to Get Information about GNU Radius		Where to get info about GNU Radius

How to Obtain Radius		How to Obtain the GNU Radius
Radius Glossary		The glossary
Acknowledgements

5.1 Run-Time Configuration Options -- `raddb/config'		Run-time configuration options.
5.2 Dictionary of Attributes -- `raddb/dictionary'		Radius dictionary.
5.3 Clients List -- `raddb/clients'		Clients lists the NASes that are allowed to communicate with radius.
5.4 NAS List -- `raddb/naslist'		The naslist file keeps general information about the NASes.
5.5 NAS Types -- `raddb/nastypes'		Information about how to query the NASes about active user sessions.
5.6 Request Processing Hints -- `raddb/hints'		Important user information that is common for the users whose names match some pattern.
5.7 Huntgroups -- `raddb/huntgroups'		Group users by the NAS (and, possibly, a port number) they come from.
5.8 List of Proxy Realms -- `raddb/realms'		Communication with remote radius servers
5.9 User Profiles -- `raddb/users'		User profile.
5.10 List of Blocked Users -- `raddb/access.deny'		List of users which are denied access.
5.11 SQL Configuration -- `raddb/sqlserver'		SQL server configuration.
5.12 Rewrite functions -- `raddb/rewrite'		Rewrite functions allow to change the input packets.
5.13 Login Menus -- `raddb/menus'		Menus allow user to select the type of service.

Directory	Short name	Default location
Configuration directory	`raddb'	/usr/local/etc/raddb
Log directory	`radlog'	/var/log
Accounting directory	`radacct'	/var/log/radacct
Data directory	`datadir'	/usr/local/share/radius/1.3

3.1 Attributes
3.2 RADIUS Requests		RADIUS requests.
3.3 Matching Rule		Rules for request processing.
3.4 Processing Requests		How GNU Radius processes incoming requests.

3.4.1 Checking for Duplicate Requests
3.4.2 Proxying
3.4.3 Hints
3.4.4 Huntgroups
3.4.5 User Profiles

5.1.1 `option` block		`Option` block: set the global program options.
5.1.2 `logging` block		Fine-tune the logging.
5.1.3 `auth` statement		Configure authentication service.
5.1.4 `acct` statement		Configure accounting service.
5.1.5 `usedbm` statement		Enable the DBM feature.
5.1.6 `snmp` statement		Configure SNMP service.
5.1.7 `rewrite` statement.		Configure Rewrite interface.
5.1.8 `guile` statement		Configure Guile interface.
5.1.9 `message` statement		Configure server reply messages.
5.1.10 `filters` statement		Configure authentication and accounting filters.
5.1.11 `mlc` statement		Configure multiple login checking.

5.1.2.1 Logging hooks
5.1.2.2 `category` statement
5.1.2.3 `channel` statement
5.1.2.4 Example of the `logging` statement

5.2.1 Comments		Introducing a comment line.
5.2.2 $INCLUDE Statement		Include a file.
5.2.3 VENDOR Statement		Define a vendor-id.
5.2.4 ATTRIBUTE statement		Define an attribute translation.
5.2.5 Blocks of Vendor-Specific Attributes		Blocks of vendor-specific attributes
5.2.6 ALIAS statement		Define alternative name for an attribute.
5.2.7 PROPERTY statement		Define attribute properties.
5.2.8 VALUE Statement		Define a value translation.

5.5.1 Syntax of `raddb/nastypes'		Syntax described.
5.5.2 Example of nastypes file.
5.5.3 Standard NAS types		NAS types defined in standard nastypes file.

5.11.1 SQL Client Parameters
5.11.2 Authentication Server Parameters
5.11.3 Authorization Parameters
5.11.4 Accounting Parameters

user_name	attr	value	op
`jsmith`	`NAS-IP-Address`	`10.10.10.1`
`jsmith`	`NAS-Port-Id`	`20`	`<=`
`jsmith`	`Framed-Protocol`	`PPP`	`NULL`
`jsmith`	`Framed-IP-Address`	`10.10.10.11`	`NULL`

6.1.1 An example of extended comparison configuration
6.1.2 List of attributes that can be declared comparable.

7.1 Accept Authentication Type		Accept unconditionally.
7.2 Reject Authentication Type		Reject unconditionally.
7.3 Local Password Authentication Type		Authenticate using plaintext password.
7.4 Encrypted Password Authentication Type		Authenticate using MD5 encrypted password.
7.5 System Authentication Type		Authenticate using system account.
7.6 SQL Authentication Type		Authenticate using SQL.
7.7 PAM Authentication Type		Authenticate using PAM.
7.8 Defining Custom Authentication Types
7.9 Multiple Login Checking		Checking for Simultaneous Logins.
7.10 Controlling Authentication Probes

7.9.1 Retrieving Session Data
7.9.2 Verifying Active Sessions

8.1 System Accounting		UNIX style utmp/wtmp accounting.
8.2 Detailed Request Accounting		Detailed requests.
8.3 SQL Accounting		Accounting to SQL server.
8.4 Defining Custom Accounting Types

10.1 Rule Tracing		Tracing rules.
10.2 Debugging		Enabling full debugging information.
10.3 Test Mode		Running radius in test mode.

File name	Line number
`/etc/raddb/hints'	34
`/etc/raddb/huntgroups'	72
`/etc/raddb/users'	3
`/etc/raddb/users'	22
`/etc/raddb/users'	157

11.1 Filters		Using external filter programs.
11.2 Rewrite		The built-in extension language.
11.3 Guile		Using Scheme.

11.1.1 Getting Acquainted with Filters
11.1.2 Declaring the Filter
11.1.3 Invoking the Filter from a User Profile
11.1.4 Adding Reply Attributes
11.1.5 Accounting Filters
11.1.6 Invoking the Accounting Filter

11.2.1 Syntax Overview
11.2.2 Quick Start
11.2.3 Interaction with Radius
11.2.4 Rewriting Incoming Requests
11.2.5 Login Verification Functions
11.2.6 Attribute Creation Functions
11.2.7 Logging Hook Functions
11.2.8 Full Syntax Description

11.2.8.1 Rewrite Data Types
11.2.8.2 Rewrite Symbols
11.2.8.3 Rewrite Identifiers
11.2.8.4 Rewrite Declarations
11.2.8.5 Rewrite Statements
11.2.8.6 Regular Expressions
11.2.8.7 Rewrite Built-in Functions

type	Variable type	Resulting conversion
integer	integer	No conversion. This results in the same integer value.
integer	string	If the string value of the variable is a valid ASCII representation of the integer number (either decimal, octal, or hex), it is converted to the integer; otherwise the result of the conversion is undefined.
string	integer	The ASCII representation (in decimal) of the integer number.
string	string	No conversion. This results in the same string value.

11.3.1 Data Representation
11.3.2 Authentication with Scheme
11.3.3 Accounting with Scheme
11.3.4 Radius-Specific Functions

GNU Radius Reference Manual

Introduction to Radius

1.0 Overview

How Does RADIUS Perform These Tasks?

RADIUS Attributes

RADIUS Packets

2. Naming Conventions

3. How Radius Operates

3.1 Attributes

3.2 RADIUS Requests

3.2.1 Authentication Requests

3.2.2 Accounting Requests

3.3 Matching Rule

3.4 Processing Requests

3.4.1 Checking for Duplicate Requests

3.4.2 Proxying

3.4.2.1 Proxy Service

3.4.2.2 Realms

3.4.3 Hints

3.4.4 Huntgroups

3.4.5 User Profiles

4. How to Start the Daemon.

5. Radius Configuration Files

5.1 Run-Time Configuration Options -- `raddb/config'

5.1.1 option block

Syntax:

Usage

Boolean statements

Numeric statements

String statements

5.1.2 logging block

Syntax:

Usage

5.1.2.1 Logging hooks

5.1.2.2 category statement

5.1.2.3 channel statement

5.1.2.4 Example of the logging statement

5.1.3 auth statement

Syntax:

Usage:

listen statement

forward statement

Numeric statements

Boolean statements

Character statement

5.1.4 acct statement

Syntax:

Usage:

listen statement

forward statement

Numeric statements

Boolean statements

Character statement

5.1.5 usedbm statement

Syntax:

Usage

5.1.6 snmp statement

Syntax:

Usage

listen statement

Numeric statements

String statements

Community and network definitions

Access-Control List definitions

Storage control

5.1.7 rewrite statement.

Syntax:

Numeric statements

String statements

Loading

5.1.8 guile statement

Syntax

Usage

Boolean statements

Numeric statements

String statements

5.1.9 message statement

Syntax

String statements

5.1.10 filters statement

5.1.1 `option` block

5.1.2 `logging` block

5.1.2.2 `category` statement

5.1.2.3 `channel` statement

5.1.2.4 Example of the `logging` statement

5.1.3 `auth` statement

`listen` statement

`forward` statement

5.1.4 `acct` statement

`listen` statement

`forward` statement

5.1.5 `usedbm` statement

5.1.6 `snmp` statement

`listen` statement

5.1.7 `rewrite` statement.

5.1.8 `guile` statement

5.1.9 `message` statement

5.1.10 `filters` statement

5.1.11 `mlc` statement

12.1 `radwho`		Show who is logged in by radius now.
12.2 `radlast`		Show the history of logins by radius.

12.3 `radzap`		Modify the login records.
12.4 `radgrep`		Quickly find the login record.
12.5 `radping`		Ping the remote machine by the username.
12.6 `radauth`		Check if a user can be authenticated.
12.7 `radctl`		Radctl monitor.
12.8 `builddbm`		Create DBM version of the `raddb/users' file.

12.1.1 `radwho` Command Line Options		Command line options.
12.1.2 `radwho` Format Strings
12.1.3 `radwho` Predefined Formats

id-str	Server ID
host-str	Server hostname or IP
secret-str	Shared secret key to use
auth-num	Authentication port number
acct-num	Accounting port number
cntl-num	Control channel port number

13.1 Client Configuration		Configuration file is common for all client utilities.
13.2 radtest		Radius client shell.
13.3 radsession		Send arbitrary requests to Radius server.
13.4 `nas.scm`		A NAS implementation for GNU/Linux machines.
13.5 `pam_radius.so`		A PAM module for authentication via Radius.

13.2.1 Invoking radtest
13.2.2 Literal Values
13.2.3 Reserved Keywords
13.2.4 Variables
13.2.5 Positional Parameters
13.2.6 Expressions
13.2.7 Function Definitions
13.2.8 Interacting with Radius Servers
13.2.9 Conditional Statements
13.2.10 Loops
13.2.11 Built-in Primitives
13.2.12 Sample Radtest Program

13.2.2.1 Numeric Values		Integers and IP addresses.
13.2.2.2 Character Strings
13.2.2.3 Lists of A/V pairs

Access-Request	1
Access-Accept	2
Access-Reject	3
Accounting-Request	4
Accounting-Response	5
Accounting-Status	6
Password-Request	7
Password-Ack	8
Password-Reject	9
Accounting-Message	10
Access-Challenge	11
Status-Server	12
Status-Client	13
Ascend-Terminate-Session	31
Ascend-Event-Request	33
Ascend-Event-Response	34
Ascend-Allocate-IP	51
Ascend-Release-IP	52

13.2.4.1 Using Variables
13.2.4.2 Variable Assignments
13.2.4.3 Dereferencing Variables
13.2.4.4 Accessing Elements of A/V Pair Lists
13.2.4.5 Assignment Options
13.2.4.6 Built-in Variables

13.2.6.1 Arithmetic Operations
13.2.6.2 String Operations
13.2.6.3 Operations on A/V Lists
13.2.6.4 Comparison Operations
13.2.6.5 Boolean Operations
13.2.6.6 Conversion Between Data Types
13.2.6.7 Function Calls
13.2.6.8 Operator Precedence (How Operators Nest)