rlm_files(5)

💅 rlm_files — the FreeRADIUS Module (yes bestie, the files one)

okay so real talk: this is rlm_files(5), a FreeRADIUS Module manpage, and it's genuinely one of the most useful little gremlins in the whole config dir. let's get into it ✨

---

🎀 NAME 🎀

rlm_files — the FreeRADIUS Module. that's it. that's the name. iconic of it honestly 💅

---

🌸 DESCRIPTION 🌸

so the rlm_files module is the one that goes and reads the users file to grab authorization info for users. that's its whole main character job 🫶

but wait — it also lets you apply that same users file syntax to the accounting and pre-proxy sections too. versatile queen 💖

here are the main config items you actually need to know about:

• usersfile — the filename of the users file, which gets parsed during the authorization stage of this module.
• acctusersfile — the filename of the users file, which gets parsed during the accounting stage of this module.
• preproxy_usersfile — the filename of the users file, which gets parsed during the pre_proxy stage of this module.
• compat — this option lets FreeRADIUS parse an old style Cistron syntax. the default is no. if you need to parse an old style Cistron file, set this option to cistron.
• key — this option lets you set the attribute to use as a key to find entries. the default is "%{%{Stripped-User-Name}:-%{User-Name}}". and ngl this next bit is important: the key MUST supply real data, no cap 😭. dynamic attributes like "Group" will not work, because the "Group" attribute can only be used as a comparison — like, to check whether a user is in a Unix group. it will not return the name of the Unix group that a user is in. it's giving "comparison only, no receipts" 💀

if you want to use groups as a key, go look at rlm_passwd, which will create a real attribute that contains the group name. that's the move 🧚

okay and why do you care about this config entry? because it enables you to have configurations that do per-group checks, and return per-group attributes, where the group membership is dynamically defined by a previous module. chef's kiss 🤌

it also lets you do things like key off of attributes in the reply, and express policies like "when I send replies containing attribute FOO with value BAR, do more checks, and maybe send additional attributes". that's so main character honestly 👑

---

✨ CONFIGURATION ✨

here's the shape of it, verbatim, don't @ me:

modules {
  ... stuff here ...
  files {
    usersfile = %{confdir}/users
    acctusersfile = %{confdir}/acct_users
    preproxy_usersfile = %{confdir}/preproxy_users
    compat = no
    key = %{%{Stripped-User-Name}:-%{User-Name}}
  }
  ... stuff here ...
}

(yes the ... stuff here ... is literally in there, it's a vibe 🦋)

---

🌈 SECTIONS 🌈

authorization, accounting, pre_proxy

those three. that's the list. periodt 💅

---

🍓 FILES 🍓

• /etc/raddb/radiusd.conf
• /etc/raddb/users
• /etc/raddb/acct_users
• /etc/raddb/preproxy_users

---

🔥 SEE ALSO 🔥

radiusd(8), radiusd.conf(5), users(5)

go read them, iykyk 📚

---

👑 AUTHORS 👑

Chris Parker, cparker@segv.org — shoutout to Chris, absolute legend 🫶

---

ngl that's the whole page bestie. short, sweet, and every single flag accounted for 💖

— k bye, this was rlm_files(5) from FreeRADIUS Module, dated 5 February 2004, and yes we're still out here reading manpages in 2024+ like the scholars we are 💀✨🎀