attributes.texi

来自「gnu 的radius服务器很好用的」· TEXI 代码 · 共 1,741 行 · 第 1/4 页

@item Framed-User
A framed protocol, such as PPP or SLIP, should be started for the user.
The @attr{Framed-IP-Address} attribute (@pxref{Framed-IP-Address}) will
supply the IP to be used.

@item Callback-Login-User
The user should be disconnected and called back, then connected to a host.

@item Callback-Framed-User
The user should be disconnected and called back; then a framed
protocol, such as PPP or SLIP,
should be started for the user.

@item Outbound-User
The user should be granted access to outgoing devices.

@item Administrative-User
The user should be granted access to the administrative interface
to the @NAS{}, from which privileged commands can be executed.

@item NAS-Prompt
The user should be provided a command prompt on the @NAS{}, from which
nonprivileged commands can be executed.

@item Authenticate-Only
Only authentication is requested, and no authorization information needs
to be returned in the Access-Accept.

@item Call-Check
@itemx Callback-NAS-Prompt
The user should be disconnected and called back, then provided a command
prompt on the @NAS{}, from which nonprivileged commands can be executed.
@end table

@comment **************************************************************
@node Session-Timeout
@subsection @attr{Session-Timeout}
@atindex Session-Timeout

@defattr{Session-Timeout,27,integer,-R,--,--,Replace,Yes}

This attribute sets the maximum number of seconds of service to be
provided to the user before termination of the session or prompt.
The server may send this attribute to the client in an Access-Accept
or Access-Challenge.

@comment **************************************************************
@node State
@subsection @attr{State}
@atindex State

@defattr{State,24,string,LR,LR,LR,Append,No}

This attribute is available to be sent by the server to the client
in an Access-Challenge and @strong{must} be sent unmodified from the client
to the server in the new Access-Request reply to that challenge,
if any.

This attribute is available to be sent by the server to the client
in an Access-Accept that also includes a @attr{Termination-Action}
attribute with the value @code{RADIUS-Request}.  If the @NAS{} performs
the termination action by sending a new Access-Request upon
termination of the current session, it @strong{must} include the @attr{State}
attribute unchanged in that Access-Request.

In either usage, no interpretation by the client should be made.
A packet may have only one @attr{State} attribute.

@comment **************************************************************
@node Termination-Action
@subsection @attr{Termination-Action}
@atindex Termination-Action

@defattr{Termination-Action,29,integer,LR,-R,-R,Replace,No}

@smallexample
VALUE      Termination-Action  Default              0       
VALUE      Termination-Action  RADIUS-Request       1       
@end smallexample

This attribute indicates what action the @NAS{} should take when the
specified service is completed.  It is only used in Access-Accept
packets.

@comment **************************************************************
@node User-Name
@subsection @attr{User-Name}
@atindex User-Name

@defattr{User-Name,1,string,LR,-R,LR,Replace,Yes}

This attribute indicates the name of the user to be authenticated or
accounted. It is used in Access-Request and Accounting attributes. 
The length of the user name is usually limited by some arbitrary value.
By default, Radius supports user names up to 32 characters long. This
value can be modified by redefining the @code{RUT_USERNAME} macro in the
@file{include/radutmp.h} file in the distribution directory and recompiling the
program.

Some @NAS{}es have peculiarities about sending long user names. For
example, the
Specialix Jetstream 8500 24-port access server inserts a @samp{/}
character after the 10th character if the user name is longer than
10 characters. In such cases, we recommend applying rewrite functions
in order to bring the user name to its normal form (@pxref{rewrite file}).


@comment **************************************************************
@node User-Password
@subsection @attr{User-Password}
@atindex User-Password

@defattr{User-Password,2,string,L-,--,--,@acronym{N/A},No}

This attribute indicates the password of the user to be
authenticated, or the user's input following an Access-Challenge.
It is only used in Access-Request packets.

On transmission, the password is hidden.  The password is first
padded at the end with nulls to a multiple of 16 octets.  A one-way
 MD5 hash is calculated over a stream of octets consisting of
the shared secret followed by the request authenticator.  This
value is @sc{xor}ed with the first 16 octet segment of the password and
placed in the first 16 octets of the String field of the User-Password
attribute.

If the password is longer than 16 characters, a second one-way MD5
hash is calculated over a stream of octets consisting of the
shared secret followed by the result of the first xor.  That hash
is @sc{xor}ed with the second 16 octet segment of the password and
placed in the second 16 octets of the string field of the 
User-Password attribute.

If necessary, this operation is repeated, with each @sc{xor} result
being used along with the shared secret to generate the next hash
to @sc{xor} the next segment of the password, up  to no more than 128
characters.

@comment **************************************************************
@node Vendor-Specific
@subsection @attr{Vendor-Specific}
@atindex Vendor-Specific
@UNREVISED{}

@defattr{Vendor-Specific,26,string,LR,-R,-R,Append,No}

This attribute is available to allow vendors to support their own
extended attributes not suitable for general usage. @FIXME{some more detail over the VSAs? How does GNU Radius handle unknown VSAs?}

@comment **************************************************************
@node Accounting Attributes
@section Accounting Attributes

These are attributes the @NAS{} sends along with accounting requests.
These attributes can not be used in matching rules.

@menu
* Acct-Authentic::
* Acct-Delay-Time::
* Acct-Input-Octets::
* Acct-Input-Packets::
* Acct-Output-Octets::
* Acct-Output-Packets::
* Acct-Session-Id::
* Acct-Session-Time::
* Acct-Status-Type:: 
* Acct-Terminate-Cause::
@end menu

@comment **************************************************************
@node Acct-Authentic
@subsection @attr{Acct-Authentic}
@atindex Acct-Authentic

@defattr{Acct-Authentic,45,integer,--,--,--,@acronym{N/A},@acronym{N/A}}

@smallexample
VALUE           Acct-Authentic          RADIUS          1
VALUE           Acct-Authentic          Local           2
VALUE           Acct-Authentic          Remote          3
@end smallexample

This attribute may be included in an Accounting-Request to
indicate how the user was authenticated, whether by Radius, the
@NAS{} itself, or another remote authentication protocol.  Users who
are delivered service without being authenticated should not
generate accounting records.

@comment **************************************************************
@node Acct-Delay-Time
@subsection @attr{Acct-Delay-Time}
@atindex Acct-Delay-Time

@defattr{Acct-Delay-Time,41,integer,--,--,--,@acronym{N/A},@acronym{N/A}}

This attribute indicates how many seconds the client has been
trying to send this record for, and can be subtracted from the
time of arrival on the server to find the approximate time of the
event generating this Accounting-Request.  (Network transit time
is ignored.)

@comment **************************************************************
@node Acct-Input-Octets
@subsection @attr{Acct-Input-Octets}
@atindex Acct-Input-Octets

@defattr{Acct-Input-Octets,42,integer,--,--,--,@acronym{N/A},@acronym{N/A}}

This attribute indicates how many octets have been received from
the port over the course of this service being provided, and can
only be present in Accounting-Request records where
@code{Acct-Status-Type} is set to @code{Stop}.

@comment **************************************************************
@node Acct-Input-Packets
@subsection @attr{Acct-Input-Packets}
@atindex Acct-Input-Packets

@defattr{Acct-Input-Packets,47,integer,--,--,--,@acronym{N/A},@acronym{N/A}}

This attribute indicates how many packets have been received from
the port over the course of this service being provided to a
framed user, and can only be present in Accounting-Request records
where @code{Acct-Status-Type} is set to @code{Stop}.

@comment **************************************************************
@node Acct-Output-Octets
@subsection @attr{Acct-Output-Octets}
@atindex Acct-Output-Octets

@defattr{Acct-Output-Octets,43,integer,--,--,--,@acronym{N/A},@acronym{N/A}}

This attribute indicates how many octets have been sent to the
port in the course of delivering this service, and can only be
present in Accounting-Request records where @code{Acct-Status-Type}
is set to @code{Stop}.

@comment **************************************************************
@node Acct-Output-Packets
@subsection @attr{Acct-Output-Packets}
@atindex Acct-Output-Packets

@defattr{Acct-Output-Packets,48,integer,--,--,--,@acronym{N/A},@acronym{N/A}}

This attribute indicates how many packets have been sent to the
port in the course of delivering this service to a framed user,
and can only be present in Accounting-Request records where
@code{Acct-Status-Type} is set to @code{Stop}.

@comment **************************************************************
@node Acct-Session-Id
@subsection @attr{Acct-Session-Id}
@atindex Acct-Session-Id

@defattr{Acct-Session-Id,44,string,--,--,--,@acronym{N/A},@acronym{N/A}}

This attribute is a unique accounting @sc{id} to make it easy to match
start and stop records in a log file.  The start and stop records
for a given session must have the same @code{Acct-Session-Id}.  An
Accounting-Request packet must have an @code{Acct-Session-Id}.  An
Access-Request packet may have an @code{Acct-Session-Id}; if it does,
then the @NAS{} must use the same @code{Acct-Session-Id} in the
Accounting-Request
packets for that session.

@comment **************************************************************
@node Acct-Session-Time
@subsection @attr{Acct-Session-Time}
@atindex Acct-Session-Time

@defattr{Acct-Session-Time,46,integer,--,--,--,@acronym{N/A},@acronym{N/A}}

This attribute indicates how many seconds the user has received
service for, and can only be present in Accounting-Request records
where @code{Acct-Status-Type} is set to @code{Stop}.

@comment **************************************************************
@node Acct-Status-Type
@subsection @attr{Acct-Status-Type}
@atindex Acct-Status-Type

@defattr{Acct-Status-Type,40,integer,--,--,--,@acronym{N/A},@acronym{N/A}}

@smallexample
VALUE    Acct-Status-Type    Start              1
VALUE    Acct-Status-Type    Stop               2 
VALUE    Acct-Status-Type    Alive              3
VALUE    Acct-Status-Type    Accounting-On      7
VALUE    Acct-Status-Type    Accounting-Off     8
@end smallexample

This attribute indicates whether this Accounting-Request marks the
beginning of the user service (@code{Start}) or the end (@code{Stop}).

It may also be used to mark the start of accounting (for example,
upon booting) by specifying @code{Accounting-On} and to mark the end of
accounting (for example, just before a scheduled reboot) by specifying
@code{Accounting-Off}.

A special value @code{Alive} or @code{Interim-Update} indicates the packet that
contains some additional data to the initial @code{Start} record or to the
last @code{Alive} record.

@comment **************************************************************
@node Acct-Terminate-Cause
@subsection @attr{Acct-Terminate-Cause}
@atindex Acct-Terminate-Cause

@defattr{Acct-Terminate-Cause,49,integer,--,--,--,@acronym{N/A},@acronym{N/A}}

@smallexample
VALUE    Acct-Terminate-Cause    User-Request            1
VALUE    Acct-Terminate-Cause    Lost-Carrier            2
VALUE    Acct-Terminate-Cause    Lost-Service            3
VALUE    Acct-Terminate-Cause    Idle-Timeout            4
VALUE    Acct-Terminate-Cause    Session-Timeout         5
VALUE    Acct-Terminate-Cause    Admin-Reset             6
VALUE    Acct-Terminate-Cause    Admin-Reboot            7
VALUE    Acct-Terminate-Cause    Port-Error              8
VALUE    Acct-Terminate-Cause    NAS-Error               9
VALUE    Acct-Terminate-Cause    NAS-Request             10
VALUE    Acct-Terminate-Cause    NAS-Reboot              11
VALUE    Acct-Terminate-Cause    Port-Unneeded           12
VALUE    Acct-Terminate-Cause    Port-Preempted          13
VALUE    Acct-Terminate-Cause    Port-Suspended          14
VALUE    Acct-Terminate-Cause    Service-Unavailable     15
VALUE    Acct-Terminate-Cause    Callback                16
VALUE    Acct-Terminate-Cause    User-Error              17
VALUE    Acct-Terminate-Cause    Host-Request            18
@end smallexample

This attribute indicates how the session was terminated, and can
only be present in Accounting-Request records where
@code{Acct-Status-Type} is set to @code{Stop}.

@comment **************************************************************
@node Radius Internal Attributes
@section Radius Internal Attributes

These are attributes used by GNU Radius during the processing
of a request. They are never returned to the @NAS{}. Mostly, they are
used in matching rules.

@menu
* Acct-Ext-Program::
* Acct-Type::
* Auth-Data::
* Auth-Failure-Trigger::
* Auth-Type::
* Crypt-Password::
* Exec-Program-Wait::
* Exec-Program::
* Fall-Through::
* Group::
* Hint::
* Huntgroup-Name::
* Log-Mode-Mask::
* Login-Time::
* Match-Profile::
* Menu::
* Pam-Auth::
* Prefix::
* Proxy-Replied::
* Realm-Name::
* Replace-User-Name::
* Rewrite-Function::
* Scheme-Acct-Procedure::
* Scheme-Procedure::
* Simultaneous-Use::
* Strip-User-Name::
* Suffix::
* Termination-Menu::
@end menu

@comment **************************************************************
@node Acct-Ext-Program
@subsection @attr{Acct-Ext-Program}
@atindex Acct-Ext-Program

@defattr{Acct-Ext-Program,2008,string,--,-R,--,Replace,@acronym{N/A}}

The @attr{Acct-Ext-Program} attribute can be used in @RHS{} of an
@file{raddb/hints} to require the execution of an external accounting
program or filter. If the attribute value starts with a vertical bar
(@samp{|}), then the attribute specifies the filter program to be used.
If it starts with a slash (@samp{/}), then it is understood as
the full pathname and arguments for the external program to be executed.
Using any other character as the start of this string results in error.

The command line can reference any attributes from both check and reply
pairlists using attribute macros (@pxref{Macro Substitution}).

Before the execution of the program, @command{radiusd} switches to the
uid and gid of the user @code{daemon} and the group @code{daemon}. You can
override these defaults by setting variables @code{exec-program-user}
and @code{exec-program-group} in configuration file to proper values
(@pxref{option,, The option statement}).

The accounting program must exit with status 0 to indicate a successful
accounting.

@node Acct-Type
@subsection @attr{Acct-Type}
@atindex Acct-Type

@defattr{Acct-Type,2003,integer,L-,-R,-R,Append,@acronym{N/A}}

@smallexample
VALUE           Acct-Type               None    0
VALUE           Acct-Type               System  1
VALUE           Acct-Type               Detail  2
VALUE           Acct-Type               SQL     3
@end smallexample

The @attr{Acct-Type} allows one to control which accounting methods
must be used for a given user or group of users. In the absence
of this attribute, all currently enabled accounting types are used.
@xref{Accounting}, for more information about accounting types.

@comment **************************************************************
@node Auth-Failure-Trigger
@subsection @attr{Auth-Failure-Trigger}
@atindex Auth-Failure-Trigger

This attribute specifies an external program or a Scheme expression to
be run upon an authentication failure. The handling of this attribute
depends upon its value:

If the value of @attr{Auth-Failure-Trigger} begins with @samp{/}, it
is taken to contain a command line for invoking an external
program. In this case @command{radiusd} invokes the program much the
same way it does when handling @attr{Exec-Program} attribute, i.e. the
program is invoked with standard input closed, its standard output and
standard error are captured and redirected to
@file{@var{radlog}/radius.stderr} file, the return value of the