6.2 Proxying and Realms

FreeRADIUS can act as a proxy server that adheres to the RFC specifications. To use realms, a user will likely dial in with a preferred syntax as discussed in Chapter 2: commonly, this is in the format of user@realm or realm/user . To configure the proper syntax for your implementation, consult the realm module configuration section of the radiusd.conf file (in the /etc/raddb directory).

Further realm configuration takes place in the /etc/raddb/proxy.conf file. There is also another file, /etc/raddb/realms , but the developers of FreeRADIUS suggest using the more expandable and functional proxy.conf file for this purpose. The proxy.conf file lists various settings and configuration directives for the proxy functionality, as well as a realm configuration section in which you detail which realms belong to which authentication hosts . For example, for the realm ralint , the following entry would be added to the proxy.conf file:

 realm ralint {     type        = radius     authhost    = radius.raleighinternet.com:1645     accthost    = radius.raleighinternet.com:1646     secret      = triangle     nostrip } 

You can also configure local realms whose authentication requests are not proxied . In this case, you don't need to list a secret in the configuration. For instance:

 realm durhamnet {     type= radius     authhost= LOCAL     accthost= LOCAL } 

A NULL realm can be used for authentication requests without a realm specified. A NULL entry might look something like this:

 realm NULL {     type= radius     authhost= radius.raleighinternet.com:1645     accthost= radius.raleighinternet.com:1646     secret= triangle } 

Finally, much like in the users file, there can be a DEFAULT entry that will apply to all other realms not explicitly matched. Here is an example:

 realm DEFAULT {     type= radius     authhost= radlocal.corp.raleighinternet.com:1645     accthost= radlocal.corp.raleighinternet.com:1646     secret= iamnotamicrosoftmachine } 

There exist several more options with which you can configure proxying and realm functionality in the proxy.conf file. Table 6-1 lists the options.

Table 6-1. Realm and proxy configuration options

Option

Description

 nostrip 

This instructs FreeRADIUS not to strip the realm prefix or suffix before proxying a request. The default is to strip the realm identifier.

 hints 

This tells radiusd to send the username to the remote RADIUS server after the local hints file has been processed . The default is to send the original User- Name attribute unaltered.

 notrealm 

This option overrides the default action to proxy a user who logs on with a User-Name attribute that matches a defined realm.



Radius
Radius
ISBN: 0596003226
EAN: 2147483647
Year: 2005
Pages: 89

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net