NAME

       dictionary - RADIUS dictionary file

DESCRIPTION

       The master RADIUS dictionary file resides in /etc/raddb/dictionary.  It references other dictionary files
       located  in  /usr/local/share/freeradius/.  Each dictionary file contains a list of RADIUS attributes and
       values, which the server uses to map between descriptive names and on-the-wire data.  The names  have  no
       meaning outside of the RADIUS server itself, and are never exchanged between server and clients.

       That  is,  editing the dictionaries will have NO EFFECT on anything other than the server that is reading
       those files.  Adding new attributes to the dictionaries will have NO EFFECT on RADIUS clients,  and  will
       not  make  RADIUS  clients  magically understand those attributes.  The dictionaries are solely for local
       administrator convenience, and are specific to each version of FreeRADIUS.

       The dictionaries in /usr/local/share SHOULD NOT be edited unless you know exactly  what  you  are  doing.
       Changing them will most likely break your RADIUS deployment.

       If  you  need to add new attributes, please edit the /etc/raddb/dictionary file.  It's sole purpose is to
       contain site-local defintions that are added by the local administrator.

FORMAT

       Every line starting with a hash sign ('#') is treated as comment and ignored.

       Each line of the file can contain one of the following strings

       ATTRIBUTE name number type [vendor|options]
            Define a RADIUS attribute name to number mapping.  The name field can be any non-space text, but  is
            usually  taken  from  RFC2865, and other related documents.  The number field is also taken from the
            relevant documents, for that name.  The type field can be one of string,  octets,  ipaddr,  integer,
            date,  ifid, ipv6addr, ipv6prefix, or ether abinary.  See the RFC's, or the main dictionary file for
            a description of the various types.

            The last (optional) field of an attribute definition can have either a vendor name, or  options  for
            that  attribute.   When  a  vendor  name  is given, the attribute is defined to be a vendor specific
            attribute.  Alternately, the options may be the a comma-separated list of the following options:

            encrypt=[1-3]
            Mark the attribute as being encrypted with one of three methods.  "1" means that  the  attribute  is
            encrypted with the method as defined in RFC2865 for the User-Password attribute.  "2" means that the
            password  is encrypted with the method as defined in RFC2868 for the Tunnel-Password attribute.  "3"
            means that the attribute is  encrypted  as  per  Ascend's  definitions  for  the  Ascend-Send-Secret
            attribute.

            has_tag
            Mark  the attribute as being permitted to have a tag, as defined in RFC2868.  The purpose of the tag
            is to allow grouping of attributes for tunnelled users.  See RFC2868 for more details.

       When the server receives an encoded attribute in a RADIUS packet, it looks up that attribute by number in
       the dictionary, and uses the name found there for printing diagnostic and log messages.

       VALUE attribute-name value-name number
            Define an attribute value name to number mapping, for an attribute of type integer.  The  attribute-
            name  field  MUST be previously defined by an ATTRIBUTE entry.  The value-name field can be any non-
            space text, but is usually taken from RFC2865, or other documents..  The number field is also  taken
            from the relevant documents, for that name.

            When  the  server  receives  an  encoded  value  in  a  RADIUS packet, it looks up the value of that
            attribute by number in the dictionary, and uses the name found there for printing diagnostic and log
            messages.

       VENDOR vendor-name number [format=t,l]
            Define a Vendor Specific Attribute encapsulation for vendor-name to number.  For a  list  of  vendor
            names and numbers, see http://www.iana.org/enterprise-numbers.txt.

       The "format=t,l" statement tells the server how many octets to use to encode/decode the vendor "type" and
       "length"  fields  in  the  attributes.  The default is "format=1,1", which does not have to be specified.
       For USR VSA's, the format is "format=4,0", for Lucent VSA's it's "format=2,1", and for Starent VSA's it's
       "format=2,2".

       The supported values for the number of type octets (i.e. the first digit) are 1, 2, and 4.   The  support
       values for the number of length octets (i.e. the second digit) are 0, 1, and 2.  Any combination of those
       values will work.

       $INCLUDE filename
            Include  dictionary  entries  from  the  file  filename.   The  filename is taken as relative to the
            location of the file which is asking for the inclusion.

FILES

       /etc/raddb/dictionary, /usr/share/freeradius/dictionary.*

SEE ALSO

       radiusd(8), naslist(5), RFC2865, RFC2866, RFC2868

                                                   31 Oct 2005                                     dictionary(5)