Radiusclient - Installation and Operation Guide

#
Radiusclient - Installation and Operation Guide

## Table of contents

- Introduction
- Principles of operation
- Installation
- Availabiliy
- Credits
- Copyright
- Contacting the author
- Appendix A: Command line flags

## Introduction

Radiusclient is a /bin/login replacement which gets called by a getty to log in a user and to setup the user's login environment.
Normal login programs just check the login name and password which the user entered against the local password file (/etc/passwd, /etc/shadow). In contrast to that Radiusclient also uses the RADIUS protocol to authenticate the user.

RADIUS stands for Remote Authentication Dial In User Service and is a protocol for carrying authentication, authorization, and configuration information between a Network Access Server (NAS) which desires to authenticate its links and a shared Authentication Server.
The protocol originally was designed by the well known terminal server manufacturer Livingston for use with their Portmaster series of terminal servers. Since then it has been implemented by a lot of other vendors and it is also on it's way to become a Internet Standard.

## Principles of operation

If the main program of Radiusclient which is called radlogin gets invoked by your systems's getty, it behaves like the normal login program to the user.

First it asks the user for his loginname (if not supplied by getty) and his password.

Then it tries to find the login name either through a RADIUS server query or in the local passwd file or through both methods.

If the user is authenticated locally radlogin calls the local login program to spawn a login enviroment.

If the user is authenticated via RADIUS radlogin calls a special other login program which gets the information that was passed from the RADIUS server in enviroment variables.

In this special login program you can now either start a telnet/rlogin session or start up SLIP/CSLIP or even PPP based on the information from the RADIUS server. Furthermore you can send accounting information to a RADIUS accouting server via a program called radacct which is also part of Radiusclient.

## Installation

Get the Radiusclient package from the places mentioned below.

Then unpack it in a directory which you normally use for keeping your source code. For example do:

    	cd /usr/src
    	gzip -dc radiusclient-x.x.tar.gz | tar xvvf -

You now should have a directory called radiusclient-x.x in which all the source code of Radiusclient is stored.

First run configure --help to see if you need to enable any options. Then configure the sources by calling configure with the appropriate options.

Have a look at include/messages.h if you'd like to change some of the messages there. But normally you shouldn't.

Executing "make" builds the executables.

Executing "make install" will install the executables and example versions of all the needed config and data files. Be careful the installation process will overwrite existing files without asking you. Try "make -n install" to see which file gets were if you're unsure.

The installation procedure will only install a dummy login.radius script which just outputs all RADIUS_* environment variables and then exits.

You need to write your own login.radius if you want that the script does something useful. See the login.radius directory for example scripts.

You will have to look into radiusclient.conf and edit it.

Add the following two line to /etc/services if you don't already have them:

    	radius          1645/udp	# RADIUS access requests
    	radacct         1646/udp	# RADIUS accounting requests

Get your getty to execute radlogin instead of the normal login process. The method of how to do this varies from getty to getty.

- If you're using getty_ps you can set the LOGIN directive in the respective config file.

- agetty has a command line option (-l) which allows you to specify an alternate login program, i.e. radlogin.

- With mgetty you add the following line to your login.cfg file:

      	*       -       -       /radlogin @

I suggest you use mgetty or getty_ps, mgetty even has a nice automatic PPP detection feature, which can be useful.

## Availability

This program is avaiable from ftp.cityline.net in the directory /pub/radiusclient.
Download the version with the largest version number, older version are only kept for reference.

## Credits

My thanks go to all the people who have helped me in one or another way with the development of radiusclient but especially to:

Miguel A.L. Paraz <map@iphil.net>
Matjaz Godec <gody@master.slon.net>
Michael Lausch <mla@gams.co.at>

## Copyright

Read the file COPYRIGHT in the top directory of Radiusclient for the respective copyrights.

If you like the Radiusclient software very much and/or are using it on a production machine please send my a postcard. My postal address is:

Lars Fenneberg Boettgerstrasse 29 22851 Norderstedt Germany

## Contacting the author

Send your comments, suggestions, bug reports and patches to Lars Fenneberg <lf@elemental.net>.

## Appendix A: Command line flags

radlogin
-f | Path to an alternative configuration file
-i | File name of the terminal used to determine what to send in the NAS-Port attribute. Normally the tty of stdin is used.
-n | Disable display if the radlogin issue file. This option is set by default if radlogin is called with an argument.
-V | Display version information
-h | Display usage information
radacct
-i | File name of the terminal used to determine what to send in the NAS-Port attribute. Normally the tty of stdout is used.
-V | Display version information
-h | Display usage information
radstatus
-V | Display version information
-h | Display usage information

Last changed: 7/19/98
Copyright © 1996,1997,1998, Lars Fenneberg, lf@elemental.net