radiusd_ipcp(8)

NAME

radiusd_ipcp – provides IP configuration and manages IP address pool

SYNOPSIS

radiusd_ipcp

DESCRIPTION

The radiusd_ipcp module is executed by radiusd(8) as a module to provide IP configuration through RADIUS Access-Accept messages and manages the IP address pool through RADIUS accounting messages. The internal sessions can be shown or monitored by radiusctl(8). radiusd_ipcp also provides session timeouts and disconnects requested by radiusctl(8) through the Dynamic Authorization Extension (DAE, RFC 5176).

CONFIGURATIONS

To use the radiusd_ipcp module, it should be configured as a decoration module of the authentication and as an accounting module.

authenticate * by (any auth module) decorate-by ipcp
account      * to ipcp

The radiusd_ipcp module supports the following configuration keys and values:

address pool address-space ...: Specify the IP address spaces that is pooled. The address-space can be specified by an address range (e.g. 192.168.1.1-192.168.1.199) or an address mask (e.g. 192.168.1.0/24). The pooled addresses are used for dynamic assignment.
address static address-space ...: Specify the IP address spaces that is pooled for static assignment. The address-space is the same syntax as address pool, above.
name-server primary-address [secondary-address]: Specify the DNS servers' IP addresses.
netbios-server primary-address [secondary-address]: Specify the NetBIOS name servers' IP addresses.
session-timeout seconds | “radius”: Specify the session-timeout in seconds, or “radius”. radiusd_ipcp disconnects the session through DAE at the specified time after starting. When “radius” is specified, the value of the Session-Timeout attribute in Access-Accept is used for the timeout. When the value is specified in seconds and the Session-Timeout attribute is specified for a session, the Session-Timeout attribute value is used to disconnect the session in preference. Configure dae server to use this option.
dae server address[:port] secret [nas-id]: Configure a DAE server which radiusd_ipcp requests disconnection for sessions. Specify the address, optionally the port number, and the secret. If the optional nas-id is specified, the server is selected only for the session which NAS-Identifier is matched the specified value. The default port number is 3799.
max-sessions number: Specify the maximum number of sessions. ‘0’ means no limit. The default value is 0.
user-max-sessions number: Specify the maximum number of sessions per a user. ‘0’ means no limit. The default value is 0.
start-wait seconds: Specify the seconds waiting for the RADIUS Accounting Start for the session after Access-Accept. radiusd_ipcp preserves the assigned IP address for that period. The default value is 60 seconds.

FILES

/usr/libexec/radiusd/radiusd_ipcp: “ipcp” module executable.

EXAMPLES

An example with radiusd_ipcp working with npppd(8):

/etc/radiusd.conf:

listen on 127.0.0.1
listen on 127.0.0.1 accounting
client 127.0.0.1/32 {
	secret "SECRET"
}
module radius {
    set secret "SECRET2"
    set server 192.168.0.4:1812
}
module ipcp {
    set address pool      192.168.1.0/24
    set name-server       192.168.0.4
    set max-sessions      128
    set user-max-sessions 2
    set dae server        127.0.0.1 "SECRET3"
    set session-timeout   radius
}
authenticate * by radius decorate-by ipcp
account      * to ipcp

/etc/npppd/npppd.conf:

tunnel L2TP protocol l2tp {
    listen on 192.0.2.51
}
ipcp IPCP {
    pool-address 192.168.1.2-192.168.1.255 for dynamic
}
interface pppac0 address 192.168.1.1 ipcp IPCP
authentication RADIUS type radius {
    authentication-server {
	address 127.0.0.1 secret "SECRET"
    }
    accounting-server {
	address 127.0.0.1 secret "SECRET"
    }
}
bind tunnel from L2TP authenticated by RADIUS to pppac0
radius dae listen on 127.0.0.1
radius dae client 127.0.0.1 secret "SECRET3"

HISTORY

The radiusd_ipcp module first appeared in OpenBSD 7.6.