RADIUS

Proxying and Realms

FreeRADIUS can act as a proxy server that adheres to the RFC specifications. To use realms, a user will likely dial in with a preferred syntax as discussed in Chapter 2: commonly, this is in the format of user@realm or realm/user. To configure the proper syntax for your implementation, consult the realm module configuration section of the radiusd.conf file (in the /etc/raddb directory).

Further realm configuration takes place in the /etc/raddb/proxy.conf file. There is also another file, /etc/raddb/realms, but the developers of FreeRADIUS suggest using the more expandable and functional proxy.conf file for this purpose. The proxy.conf file lists various settings and configuration directives for the proxy functionality, as well as a realm configuration section in which you detail which realms belong to which authentication hosts. For example, for the realm ralint, the following entry would be added to the proxy.conf file:

realm ralint {
    type        = radius
    authhost    = radius.raleighinternet.com:1645
    accthost    = radius.raleighinternet.com:1646
    secret      = triangle
    nostrip
}

You can also configure local realms whose authentication requests are not proxied. In this case, you don’t need to list a secret in the configuration. For instance:

realm durhamnet {
    type= radius
    authhost= LOCAL
    accthost= LOCAL
}

A NULL realm can be used for authentication requests without a realm specified. A NULL entry might look something like this:

realm NULL { type= radius authhost= radius.raleighinternet.com:1645 ...