path: root/doc/modules/ldap_howto.rst

LDAP Configuration
==================

This document describes how to setup Freeradius on a Freebsd machine
using LDAP as a backend.  This is by no means complete and your
mileage may vary.  If you are having any problems with the setup of
your freeradius installation, please read the documentation that comes
with Freeradius first as that is where all the information for this
project came from.  If you find any bugs, typos, alternative ideas, or
just plain wrong information, please let me know by sending an email
to the address above.

The radius servers in this document are built on Freebsd 4.8, using
Freeradius .81 with OpenLDAP 2.0.27 as the backend. The servers are
designed to support customers for multiple services.  In this document
we will use regular dialup and dialup ISDN as examples of two
different services using the same radius server for authentication.

OVERVIEW
--------

The radius servers are to be provisioned by a some sort of system we
will call Billing.  Billing could simply be a script, a web front-end,
or an actual integration into a billing system. Billing will provision
to the master LDAP server.  The master LDAP server is running slurpd,
which will replicate all changes to the other radius servers.  Each
radius server will run a local instance of LDAP.

The radius servers will be accepting Radius auth packets and Radius
acct packets.  The accounting packets will be stored locally on each
radius server and then forwarded to the Accounting radius server,
using radrelay.  The Accounting radius server will store all the
radius information in some sort of database such as MySQL, Postgres,
or Oracle.  The configuration of the actual Accounting radius server
is outside the scope of this document.  Please refer to the freeradius
documentation for setting up that server.

The Accounting radius server will help to provide a searchable
interface to the accounting data for billing and usage purposes and
could allow a web front-end to be built for helpdesk/customer service
usage.  If that is not needed for your purposes, then disregard all
details about the Accounting radius server.

In order to make sure no data is lost in the event of the Accounting
radius server going down, the replication of data will take place
using radrelay.  Radrelay will do the equivalent of a tail on the
detail file and will continually attempt to duplicate each radius
packet that is stored in the detail file and send it off to the
recipient(s) specified.  Upon receipt of an accounting_response packet
radrelay will consider that packet completed and continue working on
the others.  Each radius server will also be storing its own copy of
all accounting packets that are sent to it.

Each NAS will be setup with a primary radius server and a failover
radius server.  We will spread the load among the group of radius
servers that we have so some are acting as a primary to some NAS's and
acting as a secondary to others.  In the event of a radius failure,
the NAS should failover to the backup radius server.  How to configure
this is dependent on the particular NAS being used.

::

            Will use Radius acct data              Billing will provision
                for real-time billing               out to the Master LDAP
                                                    server over LDAP
                    +------------+
                    | Accounting |                     +---------+
                    |   Radius   |                     | Billing |
                    +------------+                     +----+----+
                        /|\                                |
                        |                                 |
                        |                                 |
                        |                                 |
                        |                             Provisioning
                        |                               Message
                        |                                 |
                    Duplicate                              |
                        Acct                                |
                        |                                 |
                        |                                \|/
                        |                           +------------+
                        |        +------------------| LDAP Master|
                        |        |                  +------------+
                        |        |                        |
                        |      Slurpd             Slurpd Replication
                        |   Replication                   |
                        |        |                        |
                        |        |                       \|/
                        |        |                  +------------+
                        |        |                  |   Radius2  |
    The Radius servers    |        |                  | LDAP Slave |
    will create a local   |       \|/                 +------------+
    copy of all acct  +-------------+
    packets and then  |   Radius1   |
    fwd a copy back   | LDAP Slave  |        All Radius servers run a
    to accounting     +-------------+         local copy of LDAP for
                        /|\    /|\         Authorization and Authentication
                        |      |
                        |      |
                        |      |
                        |      |
                        Auth    Acct
                        |      |
                        |      |
                        |      |
                        |      |
                        |      |
                        \|/    \|/
                        +-----------+
                        |           |
                        |           |
                        |    NAS    |
                        |           |
                        +-----------+
                    The NAS will be setup to
                    use one of the Radius servers
                as primary and the others as failover


LDAP
----

The LDAP directory is designed to start with the top level of
dc=mydomain,dc=com.  The next level of the tree contains the different
services that will be stored within the ldap server.  For the radius
users, it will be specified as ou=radius.  Below ou=radius, will be
the different types of accounts.  For example, ou=users will store the
users and ou=profiles will store the default radius profiles.  The
profiles are entries that will be used to store group-wide radius
profiles.  The group ou=admins will be a place to enter the users for
Billing, Freeradius, and any other administrative accounts that are
needed.

::

                    +---------------------+
                    |                     |
                    |  Dc=mydomain,dc=com |Objectclass:organizationalUnit
                    |                     |Objectclass:dcObject
                    +---------------------+
                                |
                                |
                                \|/
                        +---------------+
                        |               |
                        |   Ou=radius   | Objectclass:organizationalUnit
                        |               |
                        +---------------+
                                |
        +-----------------------+-------------------------|
        |                       |                         |
        \|/                     \|/                       \|/
    +---------+           +---------------+         +-------------+
    |         |           |               |         |             |
    |Ou=users |           |  Ou=profiles  |         |  Ou=admins  |
    |         |           |               |         |             |
    +---------+           +---------------+         +------|------+
        |                       |                         |
        |                       |                         |
        \|/                      |                        \|/
    ----- Objectclass:        |                       ----- Objectclass:
    //     \\   radiusprofile   |                     //     \\     person
    |         |                  |                    |         |
    \\     //                   |                     \\     //
    -----                    \|/                      ----- Dn:cn=freeradius
    Dn: uid=example,ou=users,  -----  ObjectClass:         ou=admins,ou=radius
    dc=mydomain,dc=com       //     \\   radiusprofile      dc=mydomain,dc=com
                            |         |
                            |         |
                            \\     //
                            -----
                Dn: uid=dial,ou=profiles,ou=radius,dc=mydomain,dc=com


An example LDIF file is below.
NOTE:  There are unique radius attribute types and objectclasses, these will be
explained in the configuration section.

::

    dn: dc=mydomain,dc=com
    objectClass: dcObject
    objectClass: organizationUnit
    ou: Mydomain.com Radius
    dc: mydomain

    dn: ou=radius,dc=mydomain,dc=com
    objectclass: organizationalunit
    ou: radius

    dn: ou=profiles,ou=radius,dc=mydomain,dc=com
    objectclass: organizationalunit
    ou: profiles

    dn: ou=users,ou=radius,dc=mydomain,dc=com
    objectclass: organizationalunit
    ou: users

    dn: ou=admins,ou=radius,dc=mydomain,dc=com
    objectclass: organizationalunit
    ou: admins

    dn: uid=dial,ou=profiles,ou=radius,dc=mydomain,dc=com
    objectclass: radiusprofile
    uid: dial
    radiusServiceType: Framed-User
    radiusFramedProtocol: PPP
    radiusFramedIPNetmask: 255.255.255.0
    radiusFramedRouting: None

    dn: uid=isdn,ou=profiles,ou=radius,dc=mydomain,dc=com
    objectclass: radiusprofile
    uid: isdn
    radiusServiceType: Framed-User
    radiusFramedProtocol: PPP
    radiusFramedIPNetmask: 255.255.255.0
    radiusFramedRouting: None

    dn: uid=example,ou=users,ou=radius,dc=mydomain,dc=com
    objectclass: radiusProfile
    uid: example
    userPassword: test
    radiusGroupName: dial
    radiusGroupName: isdn

    dn: cn=freeradius,ou=admins,ou=radius,dc=mydomain,dc=com
    objectclass: person
    sn: freeradius
    cn: freeradius
    userPassword: freeradius

    dn: cn=billing,ou=admins,ou=radius,dc=mydomain,dc=com
    objectclass: person
    sn: freeradius
    cn: freeradius
    userPassword: billing

    dn: cn=replica,ou=admins,ou=radius,dc=mydomain,dc=com
    objectclass: person
    sn: replica
    cn: replica
    userPassword: replica

In order to configure the ldap server to understand the radius schema that we
are using, the attribute types and objectclasses must be defined in slapd.conf.
The file is included with the following line in slapd.conf::

    include         /usr/local/etc/openldap/schema/RADIUS-LDAPv3.schema

Below is the complete Schema::

    ----Begin RADIUS-LDAPv3.schema----

    #################################################
    ##### custom radius attributes ##################

    objectIdentifier myOID 1.1
    objectIdentifier mySNMP myOID:1
    objectIdentifier myLDAP myOID:2
    objectIdentifier myRadiusFlag myLDAP:1
    objectIdentifier myObjectClass myLDAP:2

    attributetype
        ( myRadiusFlag:1
        NAME 'radiusAscendRouteIP'
        DESC 'Ascend VSA Route IP'
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
        )

    attributetype
        (myRadiusFlag:2
        NAME 'radiusAscendIdleLimit'
        DESC 'Ascend VSA Idle Limit'
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
        )

    attributetype
        (myRadiusFlag:3
        NAME 'radiusAscendLinkCompression'
        DESC 'Ascend VSA Link Compression'
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
        )

    attributetype
        (myRadiusFlag:4
        NAME 'radiusAscendAssignIPPool'
        DESC 'Ascend VSA AssignIPPool'
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
        )


    attributetype
        (myRadiusFlag:5
        NAME 'radiusAscendMetric'
        DESC 'Ascend VSA Metric'
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
        )

    #################################################

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.1
        NAME 'radiusArapFeatures'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.2
        NAME 'radiusArapSecurity'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.3
        NAME 'radiusArapZoneAccess'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.44
        NAME 'radiusAuthType'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.4
        NAME 'radiusCallbackId'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.5
        NAME 'radiusCallbackNumber'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.6
        NAME 'radiusCalledStationId'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.7
        NAME 'radiusCallingStationId'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.8
        NAME 'radiusClass'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.45
        NAME 'radiusClientIPAddress'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.9
        NAME 'radiusFilterId'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.10
        NAME 'radiusFramedAppleTalkLink'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.11
        NAME 'radiusFramedAppleTalkNetwork'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.12
        NAME 'radiusFramedAppleTalkZone'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.13
        NAME 'radiusFramedCompression'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.14
        NAME 'radiusFramedIPAddress'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.15
        NAME 'radiusFramedIPNetmask'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.16
        NAME 'radiusFramedIPXNetwork'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.17
        NAME 'radiusFramedMTU'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.18
        NAME 'radiusFramedProtocol'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.19
        NAME 'radiusFramedRoute'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.20
        NAME 'radiusFramedRouting'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.46
        NAME 'radiusGroupName'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.47
        NAME 'radiusHint'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.48
        NAME 'radiusHuntgroupName'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.21
        NAME 'radiusIdleTimeout'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.22
        NAME 'radiusLoginIPHost'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.23
        NAME 'radiusLoginLATGroup'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.24
        NAME 'radiusLoginLATNode'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.25
        NAME 'radiusLoginLATPort'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.26
        NAME 'radiusLoginLATService'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.27
        NAME 'radiusLoginService'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.28
        NAME 'radiusLoginTCPPort'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.29
        NAME 'radiusPasswordRetry'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.30
        NAME 'radiusPortLimit'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.49
        NAME 'radiusProfileDn'
        DESC ''
        EQUALITY distinguishedNameMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.31
        NAME 'radiusPrompt'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.50
        NAME 'radiusProxyToRealm'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.51
        NAME 'radiusReplicateToRealm'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.52
        NAME 'radiusRealm'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.32
        NAME 'radiusServiceType'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.33
        NAME 'radiusSessionTimeout'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.34
        NAME 'radiusTerminationAction'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.35
        NAME 'radiusTunnelAssignmentId'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.36
        NAME 'radiusTunnelMediumType'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.37
        NAME 'radiusTunnelPassword'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.38
        NAME 'radiusTunnelPreference'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.39
        NAME 'radiusTunnelPrivateGroupId'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.40
        NAME 'radiusTunnelServerEndpoint'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.41
        NAME 'radiusTunnelType'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.42
        NAME 'radiusVSA'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.43
        NAME 'radiusTunnelClientEndpoint'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
    )


    #need to change asn1.id
    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.53
        NAME 'radiusSimultaneousUse'
        DESC ''
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.54
        NAME 'radiusLoginTime'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.55
        NAME 'radiusUserCategory'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.56
        NAME 'radiusStripUserName'
        DESC ''
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.57
        NAME 'dialupAccess'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.58
        NAME 'radiusExpiration'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.59
        NAME 'radiusCheckItem'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
    )

    attributetype
    ( 1.3.6.1.4.1.3317.4.3.1.60
        NAME 'radiusReplyItem'
        DESC ''
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
    )


    objectclass
    ( 1.3.6.1.4.1.3317.4.3.2.1
        NAME 'radiusprofile'
        SUP top STRUCTURAL
        DESC ''
        MUST ( uid )
        MAY ( userPassword $
                radiusArapFeatures $ radiusArapSecurity $ radiusArapZoneAccess $
                radiusAuthType $ radiusCallbackId $ radiusCallbackNumber $
                radiusCalledStationId $ radiusCallingStationId $ radiusClass $
                radiusClientIPAddress $ radiusFilterId $ radiusFramedAppleTalkLink $
                radiusFramedAppleTalkNetwork $ radiusFramedAppleTalkZone $
                radiusFramedCompression $ radiusFramedIPAddress $
                radiusFramedIPNetmask $ radiusFramedIPXNetwork $
                radiusFramedMTU $ radiusFramedProtocol $
                radiusCheckItem $ radiusReplyItem $
                radiusFramedRoute $ radiusFramedRouting $ radiusIdleTimeout $
                radiusGroupName $ radiusHint $ radiusHuntgroupName $
                radiusLoginIPHost $ radiusLoginLATGroup $ radiusLoginLATNode $
                radiusLoginLATPort $ radiusLoginLATService $ radiusLoginService $
                radiusLoginTCPPort $ radiusLoginTime $ radiusPasswordRetry $
                radiusPortLimit $ radiusPrompt $ radiusProxyToRealm $
                radiusRealm $ radiusReplicateToRealm $ radiusServiceType $
                radiusSessionTimeout $ radiusStripUserName $
                radiusTerminationAction $ radiusTunnelAssignmentId $
                radiusTunnelClientEndpoint $ radiusIdleTimeout $
                radiusLoginIPHost $ radiusLoginLATGroup $ radiusLoginLATNode $
                radiusLoginLATPort $ radiusLoginLATService $ radiusLoginService $
                radiusLoginTCPPort $ radiusPasswordRetry $ radiusPortLimit $
                radiusPrompt $ radiusProfileDn $ radiusServiceType $
                radiusSessionTimeout $ radiusSimultaneousUse $
                radiusTerminationAction $ radiusTunnelAssignmentId $
                radiusTunnelClientEndpoint $ radiusTunnelMediumType $
                radiusTunnelPassword $ radiusTunnelPreference $
                radiusTunnelPrivateGroupId $ radiusTunnelServerEndpoint $
                radiusTunnelType $ radiusUserCategory $ radiusVSA $
                radiusExpiration $ dialupAccess $
                radiusAscendRouteIP $ radiusAscendIdleLimit $
                radiusAscendLinkCompression $
                radiusAscendAssignIPPool $ radiusAscendMetric )
    )
    ----End RADIUS-LDAPv3.schema----


Now we need to setup the permissions on the ldap server.  Notice above we
created three users in the admin ou.  These users will be specific for billing,
freeradius, and replication.

On the master ldap server, we will set the following permissions::

    access to attr=userPassword
            by self write
            by dn="cn=billing,ou=admins,ou=radius,dc=mydomain,dc=com" write
            by anonymous auth
            by * none

    access to *
            by self write
            by dn="cn=billing,ou=admins,ou=radius,dc=mydomain,dc=com" write
            by anonymous auth
            by * none

This will give the billing user write access to add/delete users.  For security
we will not give read access to any other users.  You can easily add another
read-only user to this setup if you want to build some sort of web interface to
do only reads.

Now on the slave ldap servers (aka the radius servers) we will setup the
following permissions::

    access to attr=userPassword
            by self write
            by dn="cn=replica,ou=admins,ou=radius,dc=mydomain,dc=com" write
            by anonymous auth
            by * none

    access to dn="ou=users,ou=radius,dc=mydomain,dc=com"
            by dn="cn=replica,ou=admins,ou=radius,dc=mydomain,dc=com" write
            by dn="cn=freeradius,ou=admins,ou=radius,dc=mydomain,dc=com" read
            by anonymous auth
            by * none

    access to *
            by self write
            by dn="cn=replica,ou=admins,ou=radius,dc=mydomain,dc=com" write
            by anonymous auth
            by * none


This will give the replica user write access.  This user will be discussed
below and it is involved in the process of replicating the master server to the
slaves.  The freeradius user only needs read access to do the lookups for
authorization.

Now we will want to setup indexes to speed up searches.  At the minimum, below
will work.  Since all radius lookups are currently using the uid, we will want
to index that.  It is also a good idea to index the objectclass attribute.

# Indices to maintain
index   objectClass     eq
index   uid             eq

Now we need to setup the replication from the master to the slave servers.  To
do this, we will add the following to the slapd.conf file on the master:

On the master LDAP server::
    replica host=radius1.mydomain.com
    binddn=cn=replica,ou=admins,ou=radius,dc=mydomain,dc=com
    bindmethod=simple credentials=replica

    replica host=radius2.mydomain.com
    binddn=cn=replica,ou=admins,ou=radius,dc=mydomain,dc=com
    bindmethod=simple credentials=replica

We will need to add a replica for each slave LDAP server.  The binddn is the
name that is used to bind to the slave server, and the credentials is the
secret for that user.

On the slave LDAP servers::

    updatedn       cn=replica,ou=admins,ou=radius,dc=mydomain,dc=com
    updateref       ldap://ldapmaster.mydomain.com

Those will determine what name is allowed to update the LDAP server and if an
update is attempted directly, what server to refer the update to.

RADIUS
------

The radius server is setup to use LDAP for both Authorization and
Authentication.  This section will describe what events will take place during
an AAA session with a NAS.  When the NAS sends a access_request to the radius
server, the radius server will perform authorization and authentication based
on a series of modules that are defined in radiusd.conf.  For example, the
module defined as ldap, will be used to make connections to the LDAP directory.

An example is seen in raddb/mods-config/ldap::

The first thing that is done is authorization of the user.  The radius server
will process the modules in the order specified in the authorization section of
radiusd.conf.  Currently, they are in the following order.

1) preprocess
2) suffix
3) files
4) ldap

The first module will be preprocess.  This will first check the huntgroups of
the user coming in.  The huntgroups are defined in the file huntgroups and they
are a group listing of the NAS-IP-Addresses that make the access_request.  This
is useful in creating specific actions based on the NAS-IP that the request is
made from.  An example, is below::

    isdncombo       NAS-IP-Address == 10.10.10.1
    dialup          NAS-IP-Address == 10.10.10.2
    dialup          NAS-IP-Address == 10.10.10.3

We will have one NAS that is used for both ISDN and regular dialup customers,
the other NAS's will be only used for dialup.

The preprocess module may also use the hints file, to load hints to the radius
server, and add additional hacks that are based on the type of request that
comes in.  This is to help with certain NAS's that don't conform to radius
RFC's.  Check the comments in radiusd.conf for an explanation on those.

The second module is suffix.  This event will determine which realm the user is
in, based on the User-Name attribute.  It is currently setup to split the
username at the occurence of the @symbol.  For example, the username of
example@mydomain.com, will be split into example and mydomain.com.  The realm
is then checked against the file proxy.conf, which will determine what actions
should be taken for that realm.  Certain realms can be setup to be proxied to a
different radius server or set to authenticate locally.  Also, the username can
be setup to be stripped from the realm or left intact.  An example of
proxy.conf, is listed below.  If the realm is to be proxied, then a secret is
needed, which is the secret of the radius server it is to be proxied to.
By default the User-Name will be stripped, unless the nostrip option is set.

Currently we will not be using realms with our users, but adding this ability
in the future will be much easier with already incorporating proxy.conf into the
setup::

    proxy server {
            synchronous = no
            retry_delay = 5
            retry_count = 3
            dead_time = 120
            servers_per_realm = 15
            default_fallback = yes
    }

    realm NULL {
            type            = radius
            authhost        = LOCAL
            accthost        = LOCAL
            #secret         = testing123
    }

    realm DEFAULT {
            type            = radius
            authhost        = LOCAL
            accthost        = LOCAL
            #secret         = testing123
    }

The next module is files, which is commonly know as the users file.  The users
file will start with either a username to determine how to authorize a specific
user, or a DEFAULT setting.  In each line it will define what items must be
present for there to be a match in the form of attribute == value.  If all the
required attributes are matched, then attributes specified with attribute :=
value will be set for that user.  If no match is found the users file will
continue to be processed until there is a match.  The last DEFAULT setting will
be set as a catch-all, in case there is no previous match.  If a match is made,
the statement of Fall-Through determines if the users file should continue to
be processed or if it should stop right there.

The Ldap-Group corresponds to the LDAP attribute of radiusGroupName (see ldap
configuration above).  The user may be assigned multiple radiusGroupNames, one
for each of the services that the user is authorized for.  If the user does
belong to the correct group, then the user will be authorized for that type of
access.  If the user does not belong to that group, then there will not be a
match and the users file will continue to be processed.  If a match is made and
there is a User-Profile set, then the radius server will lookup the attributes
that exist in that User-Profile in the LDAP directory.  These are radius
attributes that will be sent to the NAS as a reply-item.

An example users file is below::

    DEFAULT Ldap-Group == disabled, Auth-Type := Reject
            Reply-Message = "Account disabled.  Please call the helpdesk."

    DEFAULT Huntgroup-Name == isdncombo, NAS-Port-Type == Async, Ldap-Group == dial,
    User-Profile := "uid=dial,ou=profiles,ou=radius,dc=mydomain,dc=com"
            Fall-Through = no

    DEFAULT Huntgroup-Name == isdncombo, NAS-Port-Type == ISDN, Ldap-Group == isdn,
    User-Profile := "uid=isdn,ou=profiles,ou=radius,dc=mydomain,dc=com"
            Fall-Through = no

    DEFAULT Huntgroup-Name == dial, Ldap-Group == dial,
    User-Profile := "uid=dial,ou=profiles,ou=radius,dc=mydomain,dc=com"
            Fall-Through = no

    DEFAULT Auth-Type := Reject
            Reply-Message = "Please call the helpdesk."

Notice that the catchall DEFAULT is set to Reject the user.  This will stop the
authorization and immediately send back an access_reject message.  Because
business rules are applied above to each scenario where the user will be
authorized for access, if no match is found, then we will want to stop the
process immediately to save resources.

By using the Ldap-Group feature we can limit user logins to only the services
they are subscribed to.  Some examples of possible user setups are below::

    #user with access to dial-up
    dn: uid=user1,ou=users,ou=radius,dc=mydomain,dc=com
    objectclass: radiusprofile
    uid: user1
    userPassword: whatever
    radiusgroupname: dial

    #user with access to ISDN and dial
    dn: uid=user2,ou=users,ou=radius,dc=mydomain,dc=com
    objectclass: radiusprofile
    uid: user2
    userPassword: whatever
    radiusgroupname: dial
    radiusgroupname: isdn

    #same user as above that was suspended for not paying
    dn: uid=user2,ou=users,ou=radius,dc=mydomain,dc=com
    objectclass: radiusprofile
    uid: user2
    userPassword: whatever
    radiusgroupname: dial
    radiusgroupname: isdn
    radiusgroupname: disabled

Now that we have authorized the user, the final piece is to authenticate the
user. Authentication is currently done by checking if the password sent in the
access_request packet is correct.  This action will be done with an attempted
bind to the LDAP server using the User-Name and User-Password attributes
passed to it from the access_request.  If the user is successfully authorized,
then an access_accept message will be sent back to the NAS, with any reply
items that were defined in the authorization section.  If the user did not
supply the correct password, then an access_reject message will be sent to the
user.

If the NAS is sent an access_accept packet then the user will be given access
to the service and the NAS will then send an acct_request packet.  This will be
a request packet to start a radius accounting session.  The way the server will
log the accounting packets is determined in the detail module in the
radiusd.conf file.  Since we will be storing a local copy and forwarding on all
accounting to the Accounting radius server, we will store two local copies on
the machine.  The first one is done in a regular detail file as defined in the
following::

    detail detail1 {
        filename = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d
        permissions = 0600
        dir_permissions = 0755
    }

The second detail file will be used by the program radrelay to relay a copy of
all accounting packets to the Accounting radius server.  This file is stored as
a catchall for all accounting packets.  The radrelay program will basically do
a tail on that file and will then attempt to send a copy of each addition to it
to the Accounting server.  If the copy is successfully sent, then it will be
deleted from this file.  If the Accounting server were to go down, then this
file will continue to build up entries.  As soon as the Accounting server is
back online, an attempt to re-send the packets to the Accounting server will
made.  This file is defined in the following section of radiusd.conf::

    detail detail2 {
    	filename = ${radacctdir}/detail-combined
        permissions = 0600
        dir_permissions = 0755
        locking = yes
    }

INSTALLATION
------------

The new radius servers are currently built on Freebsd 4.8. As the version may
eventually change, these instructions may no longer apply. The steps for
building the server are the following:

* Install FreeBSD
* Install other FreeBSD items
* Install OpenLDAP *NOTE: this must be done before installing Freeradius*
* Install FreeRadius

Under the assumption that FreeBSD is already installed and the kernel rebuilt
to the specifications needed for the machine, there are several other things
that may be needed at this time and the purpose of this is just as a reminder.

install cvsup-without-gui from the ports collection

run cvsup on all to update the ports to the most recent versions

might be a good idea to upgrade the src

edit and run cvsup on /usr/share/examples/cvsup/standard-supfile

cd /usr/src - vi Makefile and follow instructions

install sendmail from ports to keep up to date with the most recent versions.
In the ports collection /ports/mail/sendmail run make; make install; make
mailer.conf.  Then edit rc.conf and change to sendmail_enable=NO
radius servers only need the local interface to send daily reports

edit rc.conf to make sure inetd_enable=NO

no reason to have extra services running

if you rebuilt the kernel to add support for IPFIREWALL, then remember to add a
firewall rule to rc.conf

firewall_enable=YES
firewall_type=OPEN (or actually create a real firewall rule)

add crontab to keep date accurate for accounting::

    15 03 * * * /usr/sbin/ntpdate -s thetimeserver.mydomain.com

install openldap from ports

download the freeradius source as the ports collection is often outdated
the default settings are /usr/local/etc/raddb, /var/log/radius.log, /var/log/radacct

since openldap was installed first, you should not need any special flags to
add ldap support

Now its time to configure openlap and freeradius.  First we will be looking at
configuring OpenLDAP


copy RADIUS-LDAPv3.schema to /usr/local/etc/openldap/schema

edit /usr/local/etc/openldap/slapd.conf

::

    ----Begin slapd.conf----
    # $OpenLDAP: pkg/ldap/servers/slapd/slapd.conf,v 1.23.2.7 2003/03/24 03:54:12
    #kurt Exp $
    #
    # See slapd.conf(5) for details on configuration options.
    # This file should NOT be world readable.
    #
    include		/usr/local/etc/openldap/schema/core.schema
    include		/usr/local/etc/openldap/schema/RADIUS-LDAPv3.schema

    # Define global ACLs to disable default read access.

    # Do not enable referrals until AFTER you have a working directory
    # service AND an understanding of referrals.
    #referral	ldap://root.openldap.org

    loglevel	296

    pidfile		/var/run/slapd.pid
    argsfile	/var/run/slapd.args

    # Load dynamic backend modules:
    # modulepath	/usr/local/libexec/openldap
    # moduleload	back_bdb.la
    # moduleload	back_ldap.la
    # moduleload	back_ldbm.la
    # moduleload	back_passwd.la
    # moduleload	back_shell.la

    password-hash		{SSHA}

    access to attr=userPassword
            by self write
            by dn="cn=replica,ou=admins,ou=radius,dc=mydomain,dc=com" write
            by anonymous auth
            by * none

    access to dn="ou=users,ou=radius,dc=mydomain,dc=com"
            by dn="cn=replica,ou=admins,ou=radius,dc=mydomain,dc=com" write
            by dn="cn=freeradius,ou=admins,ou=radius,dc=mydomain,dc=com" read
            by anonymous auth
            by * none

    access to *
            by self write
            by dn="cn=replica,ou=admins,ou=radius,dc=mydomain,dc=com" write
            by anonymous auth
            by * none


    #######################################################################
    # ldbm database definitions
    #######################################################################

    database	bdb
    suffix		"dc=mydomain,dc=com"
    rootdn		"cn=root,dc=mydomain,dc=com"
    # Cleartext passwords, especially for the rootdn, should
    # be avoid.  See slappasswd(8) and slapd.conf(5) for details.
    # Use of strong authentication encouraged.
    rootpw		{SSHA}Eu5EwPxTrwhEGrXQ9SaQZyfpu4iHt3NP
    # The database directory MUST exist prior to running slapd AND
    # should only be accessible by the slapd and slap tools.
    # Mode 700 recommended.
    directory	/var/db/openldap-data
    # Indices to maintain
    index	objectClass	eq
    index	uid		eq
    mode			0600
    cachesize		2000

    # replica one for each
    #replica host=radius1.mydomain.com
    #	binddn="cn=replica,ou=admins,ou=radius,dc=mydomain,dc=com"
    #	bindmethod=simple credentials=secret

    replogfile	/var/db/openldap-slurp/replog

    ## REMEMBER TO ADD THIS TO THE SLAVES
    updatedn	"cn=freeradius,ou=admins,ou=radius,dc=mydomain,dc=com"
    updateref	ldap://ldapmaster.mydomain.com
    ----End slapd.conf----


To create a rootdn that is not stored in plain text, enter the following command::

    $ slappasswd

it will ask for password and verification::

    New password:
    Re-enter new password::

while in the shell create the directory for the ldap database, this must be created before slapd can start::

    $ mkdir /var/db/openldap-data

move the slapd.sh.sample file to slapd.sh in /usr/local/etc/rc.d::

    $ mv /usr/local/etc/rc.d/slapd.sh.sample slapd.sh

enable logging in /etc/syslog.conf by adding the following::

    local4.*            /var/log/ldap.log
    restart syslogd

start it up on both the master and slave ldap servers::

    $ /usr/local/etc/rc.d/slapd start

create the structural ldif, schema.ldif::

    ----Begin schema.ldif----
    dn: dc=mydomain,dc=com
    objectClass: dcObject
    objectClass: organizationUnit
    ou: Mydomain.com Radius
    dc: mydomain

    dn: ou=radius,dc=mydomain,dc=com
    objectclass: organizationalunit
    ou: radius

    dn: ou=profiles,ou=radius,dc=mydomain,dc=com
    objectclass: organizationalunit
    ou: profiles

    dn: ou=users,ou=radius,dc=mydomain,dc=com
    objectclass: organizationalunit
    ou: users

    dn: ou=admins,ou=radius,dc=mydomain,dc=com
    objectclass: organizationalunit
    ou: admins

    dn: uid=dial,ou=profiles,ou=radius,dc=mydomain,dc=com
    objectclass: radiusprofile
    uid: dial
    radiusServiceType: Framed-User
    radiusFramedProtocol: PPP
    radiusFramedIPNetmask: 255.255.255.0
    radiusFramedRouting: None

    dn: uid=isdn,ou=profiles,ou=radius,dc=mydomain,dc=com
    objectclass: radiusprofile
    uid: isdn
    radiusServiceType: Framed-User
    radiusFramedProtocol: PPP
    radiusFramedIPNetmask: 255.255.255.0
    radiusFramedRouting: None

    dn: uid=example,ou=users,ou=radius,dc=mydomain,dc=com
    objectclass: radiusProfile
    uid: example
    userPassword: test
    radiusGroupName: dial
    radiusGroupName: isdn

    dn: cn=freeradius,ou=admins,ou=radius,dc=mydomain,dc=com
    objectclass: person
    sn: freeradius
    cn: freeradius
    userPassword: freeradius

    dn: cn=billing,ou=admins,ou=radius,dc=mydomain,dc=com
    objectclass: person
    sn: freeradius
    cn: freeradius
    userPassword: billing

    dn: cn=replica,ou=admins,ou=radius,dc=mydomain,dc=com
    objectclass: person
    sn: replica
    cn: replica
    userPassword: replica
    ----End schema.ldif----

add the organizational structure to the master ldap database::

    $ ldapadd -D uid=billing,ou=admins,ou=radius,dc=mydomain,dc=com -w billing -f
    schema.ldif -h ldapmaster.mydomain.com

run slapcat to see what the directory looks like::

    $ slapcat

If all went well the LDAP directory should be up and running and propagated to
the slaves.  Now you can add your users to the master.

Now its time to setup FreeRadius.  First cd into /usr/local/etc/raddb and take
a look at all the configuration files, they are heavily documented so you may
wish to read through them all before making and changes.


edit huntgroups to specify a NAS to a huntgroup::

    ----Begin huntgroups----
    # dialup and isdn
    isdncombo	NAS-IP-Address == 10.10.10.1

    # just dialup
    dialup		NAS-IP-Address == 10.10.10.2
    dialup		NAS-IP-Address == 10.10.10.3
    ----End huntgroups----

* edit proxy.conf to setup the different realms::

    ----Begin proxy.conf----
    proxy server {
            synchronous = no
            retry_delay = 5
            retry_count = 3
            dead_time = 120
            servers_per_realm = 15
            default_fallback = yes
    }

    realm NULL {
            type		= radius
            authhost        = LOCAL
            accthost        = LOCAL
            #secret		= testing123
    }

    realm DEFAULT {
            type		= radius
            authhost        = LOCAL
            accthost        = LOCAL
            #secret		= testing123
    }
    ----End proxy.conf----

    -edit clients.conf to setup the NAS's that can talk to it


    ----Begin clients.conf----
    client 127.0.0.1 {
            secret		= example
            shortname	= localhost
            nas_type     	= other
    }


    # isdn and dialup nas
    client 10.10.10.1 {
            secret		= example
            shortname	= isdn
            nas_type		= cisco
    }

    #dialup only
    client 10.10.10.2 {
            secret		= example
            shortname	= dialup1
            nas_type		= cisco
    }

    client 10.10.10.3 {
            secret		= example
            shortname	= dialup2
            nas_type		= cisco
    }
    ----End clients.conf----


You may wish to look at the other files, but they should all be OK by default.

create startup files in /usr/local/etc/rc.d

radiusd.sh - the radiusd startup file::

    ----Begin radiusd.sh----
    #!/bin/sh
    case "$1" in
    start)
            /usr/local/sbin/radiusd
            echo -n ' radiusd'
            ;;
    stop)
            if [ -f /usr/local/var/run/radiusd/radiusd.pid ]; then
                    kill -TERM `cat /usr/local/var/run/radiusd/radiusd.pid`
                    rm -f /usr/local/var/run/radiusd/radiusd.pid
                    echo -n ' radiusd'
            fi
            ;;
    restart)
            if [ -f /usr/local/var/run/radiusd/radiusd.pid ]; then
                    kill -HUP `cat /usr/local/var/run/radiusd/radiusd.pid`
                    echo 'radiusd restarted'
            fi
            ;;
    *)
            echo "Usage: ${0##*/}: { start | stop | restart }" 2>&1
            exit 65
            ;;
    esac
    ----End radiusd.sh----

radrelay.sh - the radrelay startup file::


    ----Begin radrelay.sh----
    #!/bin/sh
    case "$1" in

    start)
        /usr/local/bin/radrelay -a /var/log/radacct -d /usr/local/etc/raddb \
        -S /usr/local/etc/raddb/radrelay_secret -f -r accounting.mydomain.com:1813 \
    detail-combined
    echo -n ' radrelay started'
    ;;


    stop)
    /usr/bin/killall radrelay
    echo ' radrelay stopped'
    ;;

    *)
    echo "Usage: $[0##*/}: { start | stop }" 2>&1
    exit 65
    ;;

    esac
    ----End radrelay.sh----

create radrelay_secret in /usr/local/etc/radddb
This file will contain the secret to connect to the Accounting radius server::

    ----Begin radrelay_secret----
    example
    ----End radrelay_secret----

Now fire them up::
    $ /usr/local/etc/rc.d/radiusd.sh start
    $ /usr/local/etc/rc.d/radrelay.sh start

You should be all set to start testing now.

OTHER RANDOM NOTES AND THOUGHTS
-------------------------------

The client programs used to connect to the ldap directory are:

ldapadd:
    to add a record
ldapmodify:
    to modify a record
ldapdelete:
    to delete a record
ldapsearch:
    to search for a record
slapcat:
    to show the entire directory
slappaswd:
    to generate a crypted password

Read the man pages on those commands, they tell you everything you
need to know.

They all follow this basic syntax::

    $ ldapwhatever -D "uid=someone,ou=admins,ou=radius,dc=mydomain,dc=com" -w thesecret -andthenotherstuff

Finally, if you are having trouble with LDAP, run it in debug mode by
changing the following in slapd.sh::

    slapd_args=

to::

    slapd_args= '-d 3'

There is a program included with freeradius to test the radius server,
its called radclient.  Typing it alone will tell you all the options.
You will need to create a file that contains radius attributes, such
as::

    User-Name = example
    User-Password = test
    Service-Type = Framed-User
    NAS-IP-Address = 10.10.10.1
    NAS-Port-Type = Async

Then you fire that radius packet at the server by issuing::

    $ radclient -f testradiusfile localhost auth thesecret

-f = filename
localhost is the server you are hitting
auth or acct depending on the type of packet
thesecret to connect to that server

Finally, if you are having trouble you can run radius in debug mode
and it will output everything that happens to the screen.  To do that,
kill the current process and run::

    $ radiusd -X


LINKS
-----

FREERADIUS
++++++++++

* _`FreeRADIUS`: http://www.freeradius.org
* _`FreeRADIUS Documentation`: http://freeradius.org/documentation/
* _`FreeRADIUS Wiki`: http://wiki.freeradius.org/

OPENLDAP
++++++++

* _`OpenLDAP`: http://www.openldap.org
* _`OpenLDAP Administrator's Guide`: http://www.openldap.org/doc/admin21

RFCs
++++

* _`RFC2865: RADIUS Authentication`: http://freeradius.org/rfc/rfc2865.txt
* _`RFC2866: RADIUS Accounting`: http://freeradius.org/rfc/rfc2866.txt
* _`RFC2869: RADIUS Extentions`: http://freeradius.org/rfc/rfc2869.txt
* _`RFC2251: LDAP v3`: http://www.ietf.org/rfc/rfc2251.txt
* _`RFC2252: LDAP v3 Attribute Syntax Definitions`: http://www.ietf.org/rfc/rfc2252.txt
* _`RFC2253: LDAP UTF-8 String Representation of Distinguishe d Names (DNs)`: http://www.ietf.org/rfc/rfc2252.txt
* _`RFC2849: LDAP Data Interchange Fromat (LDIFs)`: http://www.ietf.org/rfc/rfc2849.txt
* _`RFC3377: LDAP v3 Technical Specs`: http://www.ietf.org/rfc/rfc3377.txt