NAME

       radiusd_attributes - extended users attributes

DESCRIPTION

       This  page  describes  the  differences  between  YARD RADIUS syntax of users file and the
       `standard' one of Livingston RADIUS Daemon 2.1. A complete description of  the  syntax  of
       that file is not the scope of this document.

       The  users  text  file  contains security and configuration information for each user. The
       first field is the user's name and can be up to 8 characters in length.  This is  followed
       (on  the  same line) with the list of authentication requirements for that user.  This can
       include password, comm server name, comm server port number, and an expiration date of the
       user's  password.   When an authentication request is received from the comm server, these
       values are tested.  Special users named "DEFAULT", "DEFAULT2", "DEFAULT3" can  be  created
       (and  should  be  placed at the end of the user file) to specify what to do with users not
       contained in the user file.

       Indented  (with  the  tab  character)  lines  following  the  first  line   indicate   the
       configuration  values  to  be  passed back to the comm server to allow the initiation of a
       user session.  This can include things like the PPP configuration values or  the  host  to
       log the user onto.

       Again,  a  description of all attributes and values is not the topic of this document. See
       NOTES section below for a complete reference about.

YARD RADIUS ATTRIBUTES

       YARD RADIUS uses some private non-protocol attributes to support  its  specific  features.
       They  are  integer  or  string  attributes  that you could set to manage in some ways user
       accesses:

       Yard-Simultaneous-Use:
              The maximum number of simultaneous logins for a user.  It's a positive value.

       Yard-Time:
              It's a list of the access times (week day(s) and hours) during which  the  user  is
              authorized   to   login.    It   is   a  comma-separated  list  of  items  such  as
              "Wk0800-1800,Sa0800-2400,Su0800-2400". Each item follows  a  syntax  like  "DDHHMM-
              HHMM",  where  DD=Mo,Tu,We,Th,Fr,Sa,Su,Al,Wk  and HHMM are the times of access in 4
              characters form. 'Wk' means all 5 weekdays ('Mo'-'Fr') and 'Al' is the whole week.

       Yard-Max-Monthly-Time:
              The maximum number of on-line hours the user can be on-line  per  month.  It  is  a
              positive value.

       Yard-Max-Monthly-Traffic:
              The  maximum  number  of Kbytes of traffic the user can totalize per month. It is a
              positive value.

       Yard-Max-Daily-Time:

       Yard-Max-Daily-Traffic:

       Yard-Max-Yearly-Time:

       Yard-Max-Yearly-Traffic:
              At this point, all these attributes are obvious.

       Yard-Pam-Auth:
              This string is the name of the PAM authentication service to  use  instead  of  the
              default  one,  which  is  "yard".  This is used to parse the pam.conf, or the pam.d
              directory to get the PAM module to use for auth/acct. You  could  prefer  something
              like "radius", for instance.

       YARD  RADIUS  extends also the predefined values of the standard Auth-Type attribute, with
       the following ones:

       PAM    Use PAM authentication module. The service name could be specified with a Yard-Pam-
              Auth attribute or it implies the default one "yard".

       System Use  system passwd file with or without shadowing. Shadow support should be enabled
              when calling the `configure' script  only  if  your  system  requires  the  use  of
              getspnam()  in  order  to  get the encrypted password. Not all systems that support
              shadow password have that function. If your  system  has  a  transparent  shadowing
              support, you do not need any specific enabling. Notably this is true for FreeBSD.

              If  you  like  so,  you can also enable 'shadow expirations'. Systems which support
              this feature must have a compatible getspnam() with an expiration field in the spwd
              structure.  So, enabling this feature implies enabling shadow support.  When shadow
              expiration  is  enabled  you  can  require  system-based  expirations  by  using  a
              conventional attribute value like Expiration="SHADOW".

       Safeword
              Not yet supported.

       Defender
              Not yet supported.

       But  for  the  above attributes and values, many vendor specific attributes and values are
       parsed and legal for YARD RADIUS server. You can  refer  to  the  dictionary  file  for  a
       complete  list.  Vendor  attributes  are  useful  only  when  the  communication server is
       configured to send VSA mode requests. Some old communication servers could be unable to do
       this, and in that case you should modify manually the dictionary.

FILES

       /usr/conf/users
              This  file  contains  the  human  readable  information  for  users' accounting and
              authorization.

       /usr/conf/users.db
              The same of the previous one as compiled in by builddbm in GDBM format.

       /usr/conf/dictionary
              This read-only file contains the codes and formats for standard and  vendor  RADIUS
              protocol  attributes  and values along with their human readable representation. It
              is subject to change, due to new access server supports. It is a  plain  text  file
              with a pletora of comments in it.

       /usr/docs/rfc/rfc2138.txt
              Request For Comments about Remote Authentication Dial In User Service (RADIUS).

       /usr/docs/rfc/rfc2139.txt
              Request For Comments about RADIUS Accounting.

SEE ALSO

       radiusd(8), RFC2138, RFC2139

AUTHOR

       Francesco Paolo Lovergine <francesco@yardradius.org>.

       A  complete  list  of contributors is contained in CREDITS file.  You should get that file
       among other ones within your distribution and possibly installed under /usr/docs directory

COPYRIGHT

       Copyright (C) 1992-1999 Lucent Inc. All rights reserved.

       Copyright (C) 1999-2004 Francesco Paolo Lovergine. All rights reserved.

       See the LICENSE file enclosed within this software for conditions of use and distribution.
       This is a pure ISO BSD Open Source License .

NOTES

       See  the  RADIUS  for  UNIX  Administrator's  Guide  as a complete reference for all other
       attributes      and       values.        It       is       freely       available       at
       http://www.livingston.com/tech/docs/manuals.html  at  the time of this document. Note that
       many vendor attributes are described only within vendor's documentation.

       Currently YARD RADIUS dictionary is updated with vendor's  dictionary  by  Cisco,  Lucent,
       3COM, Redback, Springtide, Nortel and possibly others, whenever available.