RADIUS.CONF(5)

💖 radius.conf(5) — like, the RADIUS client config file, bestie 💖

okay so this is the radius.conf manual page from the File Formats Manual section, and honestly? it's giving "small file, big responsibilities." let's get into it 🫶

---

✨ NAME ✨

radius.conf — the RADIUS client configuration file, no cap 💅

---

🌸 SYNOPSIS 🌸

/etc/radius.conf

---

🦋 DESCRIPTION 🦋

radius.conf holds literally everything you need to configure the RADIUS client library. the way that it gets parsed by rad_config(3)… iconic. 📖

the file is one or more lines of text, and each line describes a single RADIUS server that the library is gonna use. leading white space gets ignored (rude but ok), and so do empty lines and lines that are nothing but comments. 💀

a RADIUS server is described by three to seven fields on a line, in this exact order:

• Service type
• Server host
• Shared secret
• Timeout
• Retries
• Dead time
• Bind address

the fields are separated by white space. the # character at the beginning of a field starts a comment, which runs to the end of the line. 🎀

a field can be wrapped in double quotes — and if it is, it may contain white space and/or start with the # character. inside a quoted string, the double quote character is represented by \", and the backslash is represented by \\. that's it though — no other escape sequences are supported, periodt. 🚫

🧚 the fields, one by one 🧚

field one — the service type. this is either auth for RADIUS authentication or acct for RADIUS accounting. if a single server provides both services, you need two lines in the file — yes, two. earlier versions of this file didn't include a service type at all. for backward compatibility, if the first field is not auth or acct, the library behaves as if auth were specified, and interprets the fields in the line as if they were fields two through five. time is a flat circle, iykyk. ⏳

field two — the server host. this is either a fully qualified domain name or a dotted-quad IP address. the host may optionally be followed by a : and a numeric port number, with no intervening white space. if you skip the port, it defaults to the radius or radacct service in the /etc/services file for service types auth and acct respectively. and if no such entry is present? the standard ports 1812 and 1813 are used. slay 💫

field three — the shared secret. this should be known only to the client and server hosts, bestie — like, don't be posting it in the group chat. it's an arbitrary string of characters, though it must be enclosed in double quotes if it contains white space. the shared secret may be any length, but the RADIUS protocol uses only the first 128 characters. and N.B. 🚨 — some popular RADIUS servers have bugs which prevent them from working properly with secrets longer than 16 characters. so… yeah, be normal about it.

field four — the timeout. a decimal integer specifying the timeout in seconds for receiving a valid reply from the server. if this field is omitted, it defaults to 3 seconds. ⏱️

field five — the retries. a decimal integer specifying the maximum number of attempts that will be made to authenticate with the server before giving up. if omitted, it defaults to 3 attempts. note — this is the total number of attempts, not the number of retries. they're different things and the distinction is lowkey important, don't @ me. 🙈

field six — the dead time. a decimal integer specifying a time interval in seconds when the server will not be requested if it was inaccessible on the last try. 0 means ask always. 💀

field seven — the bind address. an IP address on a multihomed host. all requests will be binded to this IP. that's what it says, we're keeping it, it's canon. 🔥

👑 the fine print 👑

up to 10 RADIUS servers may be specified for each service type. the servers are tried in round-robin fashion, until a valid response is received or the maximum number of tries has been reached for all servers. queen behavior, honestly. 🌈

the standard location for this file is /etc/radius.conf. but an alternate pathname may be specified in the call to rad_config(3). and because the file contains sensitive information in the form of the shared secrets, it should not be readable except by root. like seriously — <red>root only, no exceptions</red>. 🔐

---

🎀 FILES 🎀

• /etc/radius.conf

---

⭐ EXAMPLES ⭐

bestie, here are the examples verbatim, go off:

# A simple entry using all the defaults:
acct  radius1.domain.com  OurLittleSecret

# A server still using the obsolete RADIUS port, with increased
# timeout and maximum tries:
auth  auth.domain.com:1645  "I can't see you"  5  4

# As above but set dead time and bind address
auth  auth.domain.com:1645  "I can't see you"  5  4  60  192.168.1.8

# A server specified by its IP address:
auth  192.168.27.81  $X*#..38947ax-+=

the last one is giving main character energy and I respect it 💅

---

🔥 SEE ALSO 🔥

• libradius(3)
• C. Rigney, et al, Remote Authentication Dial In User Service (RADIUS), RFC 2138.
• C. Rigney, RADIUS Accounting, RFC 2139.

---

💜 AUTHORS 💜

this documentation was written by John Polstra, and donated to the FreeBSD project by Juniper Networks, Inc. absolute legends, we stan. 🫶

---

aaaand that's the whole page! written for the Debian distro, dated October 30, 1999 — yes, a literal 1999 baby, and it's still out here running things. vintage icon behavior. 🍓✨