--- name: "authfile" section: "5" platform: "linux" package: "radiusd-merit" version: "2.4.23-2" release: "Debian 1.3 (Bo)" platforms: ["linux"] url: "https://new.carta.tech/authfile" --- # authfile(5) RADIUS realm to authentication-type mapping file ## NAME authfile - RADIUS realm to authentication-type mapping file ## SYNOPSIS **../raddb/authfile** ## DESCRIPTION The *authfile* file resides in the *../raddb* directory. It contains a list of realms which RADIUS can use to authenticate Network Access Server (NAS) users who enter *user@realm* as their user name. Comments are indicated by leading pound sign ('**#**') characters. All such comment lines are ignored (as are blank lines). The file contains a line of information for each such realm. Each line has several, white-space delimited fields. There are a number of lines of the form: - *\* \[( *\* \[, *\*\])\] \[ *-\*\] *\* \[ *\*\] \[ *\*\] For example: - **umich.edu AFS-KRB UMICH.EDU umich** **flatland.org FILE flatland** where the latter is only available with the Merit LAS license. The *\* is any appropriate symbol or name for the realm to which the user "belongs." Note that this does not have to be a Domain Name System (DNS) name. A **DEFAULT** entry may be included in the file which indicates how to handle authentication requests specifying authenticator realms not found in this file. Usually, a remote RADIUS server will handle these relayed requests. A user is not allowed to use the name **DEFAULT** as the authenticator name. The **NULL** entry may be used to indicate how to handle user namess without an attached realm name. There is a "wild card" syntax, *\*.realm*, which may be included as the primary (non-alias) realm name on an entry in the authfile. The purpose of this is to provide a shorthand way of indicating several related realms which are to be handled by one entry (one authentication type) in the authfile. For example, a company may have several branches, eastern.foobah.com, western.foobah.com and central.foobah.com, so that an entry \*.foobah.com would "match" all three of these realms. It is recommended that any such wild card entry be listed toward the end of the authfile. This allows for specific entries to override the wild card entry. Aliases are allowed on the wild card entry and are interpreted as meaning *\*.alias* rather than *alias.realm* or just *alias.* The *\* field is an optional, comma separated list of realm names enclosed within parenthesis. Each realm alias is equivalent to the "main" realm name and may be provided for user convenience or other purposes. The *\* field is one of **-PW**, **-CHAP**, or **-DFLT**. These may be used to force the processing order of *authfile* entries which would otherwise be identical. Valid *\*s include **PASSWD**, **UNIX-PW**, **RADIUS**, **MIT-KRB**, **AFS-KRB**, **FILE**, **TACACS**, and **KCHAP**. These authentication types are case insensitive. The FILE type is only available with the Merit LAS license. The **PASSWD** *\* is the same as the **UNIX-PW** *\*. Either refers to authentication using the UNIX password file (usually found in the */etc/passwd* file). The **RADIUS** *\* indicates the authentication is to be performed by a remote RADIUS server. The authorization Attribute/Value Pairs returned by the remote RADIUS server are propagated back to the NAS. See the [**dictionary**(5)](/dictionary/5.md) man page. RADIUS servers check to see if the *\* field contains their DNS host identifier or is blank, in either case the request is handled as a local UNIX request. For the remaining *\*s, the entries in the *\* field depend on how the RADIUS server was configured. For RADIUS servers built to use the Kerberos model for authentication, these entries correspond to the Kerberos realm name to be used by Kerberos. Note that the */etc/krb.conf* file must have valid entries for the Kerberos realm. For RADIUS servers built to use the FILE model, this field contains the "prefix" of a compound file name: *prefix* *\* *users* (for example, *flatland.users*). The FILE type is only available with the Merit LAS license. The *\ are names of filters pre-configured on the NAS. The names should match the configured values on the NAS. This filter name, if present, overrides any filter name a remote RADIUS server may have set. The *authfile* file is read by **radiusd** at startup and whenever a HUP signal is received by **radiusd**. The RADIUS server detects any out-of-date configuration files upon receipt of a Status-Server (or Management-Poll) request and re-reads all the configuration files. This file is maintained by the RADIUS administrator using a text editor. ## FILES - *../raddb/authfile* - *../raddb/dictionary* - *../raddb/users* - */etc/krb.conf* - */etc/minostab* ## SEE ALSO [**signal**(3)](/signal/3.md), [**dictionary**(5)](/dictionary/5.md), [**users**(5)](/users/5.md), [**radiusd**(8)](/radiusd/8.md), [**radcheck**(8)](/radcheck/8.md), [**radpwtst**(8)](/radpwtst/8.md)