--- name: "radius.fsm" section: "5" platform: "linux" package: "radiusd-merit" version: "2.4.23-2" release: "Debian 1.3 (Bo)" platforms: ["linux"] url: "https://new.carta.tech/radius.fsm" --- # radius.fsm(5) RADIUS finite state machine configuration file ## NAME radius.fsm - RADIUS finite state machine configuration file ## SYNOPSIS **../raddb/radius.fsm** ## DESCRIPTION The *radius.fsm* file resides in the *../raddb* directory. It contains an entry for each state in the RADIUS finite state machine (FSM) table. This file is optional and is used to modify the built-in (default) sequence of actions performed by RADIUS. Comments are indicated by leading pound sign ('**#**') characters. All such comment lines are ignored (as are blank lines). Each state consists of one or more entries described below. Each state starts with a line containing just the name of the state followed by a colon ('**:**') character. Subsequent lines have three required, and two optional, white-space delimited fields. There is one line of the following form for each expected event this state should handle: - *\ \ \ \[\\] \[\\]* For example: - **Start:**\ \ **\*.\*.AUTHEN AUTHENTICATE Await**\ **Await:**\ \ **Start.AUTHENTICATE.ACK REPLY Hold**\ **Hold:**\ \ **\*.\*.TIMEOUT NULL End** **The** *\* **field describes an event which has occurred and upon which the current state** **may be able to act.** **The event field consists of three sub-fields separated by the period** ('**.**') **character.** **The first sub-field is the name of the state from which the event was generated.** **This field may contain the "\*" character to indicate a wild card state which** **matches** *any* **state.** **The second sub-field is the name of the action which generated the event.** **This field may contain the "\*" character to indicate a wild card action which** **matches** *any* **action.** **This action is the name of an Authentication/Authorization Transfer Vector** **(AATV, see below).** **The third sub-field is the name of an event from the list found in the** **include file,** *radius.h,* **for the RADIUS server.** **The current list of these events is:** ``` ACK acknowledgment of the previous action NAK negative acknowledgment of the previous action WAIT the previous action generated a pending event ERROR the previous action generated an error FATAL the previous action generated a fatal error DUP the incoming request is a duplicate TIMER the timer value has expired TIMEOUT the request has timed out due to inactivity AUTHEN the incoming request is an Access-Request ACCT the incoming request is an Accounting-Request PASSWD the incoming request is a Passwd-Request REACCESS the incoming request is is an Access-Request with State ACC_CHAL the incoming request is and Access-Challenge MGT_POLL the incoming request is is a Status-Server AUTH_ONLY the incoming request is for Authentication-Only RC1 general purpose return code of one RC2 general purpose return code of two RC3 general purpose return code of three RC4 general purpose return code of four RC5 general purpose return code of five RC6 general purpose return code of six RC7 general purpose return code of seven RC8 general purpose return code of eight RC9 general purpose return code of nine RC10 general purpose return code of ten RC11 general purpose return code of eleven RC12 general purpose return code of twelve ``` **The** *\* **field is the name of an AATV action function to invoke when the** **associated** *\* **occurs.** **The current list of these AATVs is:** ``` ACCT the AATV for Accounting requests ACK utility AATV used to always signify success AKERB the AATV for AFS Kerberos Authentication AUTHENTICATE the AATV for Authentication requests CLEANUP utility AATV used to exit the FSM FILE the AATV for FILE Authentication The FILE type is only available with the Merit LAS license. KCHAP the AATV for KCHAP Authentication KILL utility AATV used to unconditionally remove pending events LOG utility AATV used to log some error MKERB the AATV for MIT Kerberos Authentication NULL utility NULL AATV PASSWD the AATV used to handle Passwd-Requests PENDING utility AATV used to test for pending events RAD2RAD the AATV used to send RADIUS proxy requests RADDNS the AATV for resolving DNS names RADIUS the main AATV in the RADIUS engine REALM the AATV for handling realm based Authentication REDO utility AATV used to re-invoke an action REPLY utility AATV used to send a RADIUS reply SRV_STATUS the AATV for Status-Server requests TACACS the AATV for TACACS Authentication TIMEOUT utility AATV used to do timeout logging TIMER utility AATV used to initialize the timeout value UNIX-PW the AATV for for UNIX password file Authentication ``` **The** *\* **field indicates which state the FSM should enter following the** **completion of the** *\*, **even if that** *\* **was deferred in one of several ways allowed for an AATV.** **Each such state must appear in the configuration file alone on a line and** **followed by a colon** ('**:**') **character.** **The optional** *\* **and** *\* **fields are simple keyword/value pairs which allow any AATV to be** **given an arbitrary integer or string value (or both) as configured in the** **FSM table.** **The** *name* **for integer values is** **XVALUE** **and the** *name* **for string values is** **XSTRING**. **NOTE: Only one action may result from entering any state and this** **from the** *first* **entry which matches the given event.** **If the file** *radius.fsm* **does not exist, the server will use the following built-in FSM table:** - **Start:**\ \ **\*.\*.AUTHEN AUTHENTICATE AUTHwait**\ **\*.\*.AUTH\_ONLY AUTHENTICATE AUTHwait**\ **\*.\*.MGT\_POLL SRV\_STATUS MGTwait**\ **AUTHwait:**\ \ **Start.AUTHENTICATE.ACK REPLY Hold**\ **Start.AUTHENTICATE.NAK REPLY Hold**\ **MGTwait:**\ \ **Start.SRV\_STATUS.ACK REPLY Hold**\ **Hold:**\ **\*.\*.TIMEOUT NULL End**\ **End:** **The** *radius.fsm* **file is read by** **radiusd** **upon startup, or when a HUP signal is received by** **radiusd**. **The RADIUS server detects any out-of-date configuration files** **upon receipt of a Status-Server (or Management-Poll) request and re-reads** **all the configuration files.** **This file is maintained by the RADIUS administrator using a text editor.** ## FILES - *../raddb/radius.fsm* **finite state machine configuration file** - *../src/radius.h* **RADIUS main include file** ## SEE ALSO [**signal**(3)](/signal/3.md), [**radiusd**(8)](/radiusd/8.md)