rlm_passwd(5)

NAME 💖

rlm_passwd — FreeRADIUS Module

okay bestie, welcome to the rlm_passwd(5) page from the FreeRADIUS Module set. This one is all about authorization via files that are formatted like /etc/passwd. It is iconic, it is fast, and it is lowkey a little old-school in the best way. 🎀

DESCRIPTION 🌸

The rlm_passwd module gives you authorization via files similar in format to /etc/passwd. No cap.

This module lets you retrieve any account information from any files with passwd-like format (/etc/passwd, /etc/group, smbpasswd, .htpasswd, etc.). Every field of the file may be mapped to a RADIUS attribute, with one of the fields used as a key. 🦋

The module reads the file when it initializes, and caches the data in memory. That makes it very fast, even for files with thousands of lines. To re-read the file, the module will need to be reloaded with radmin(8), or the server will need to be sent a SIGHUP, as dynamic updates are not supported. Important, bestie: no dynamic updates, so don't just edit the file and expect the vibe to refresh instantly. 💅

CONFIGURATION ✨

The configuration item(s), aka the knobs you can turn:

• allow_multiple_keys — If set to 'yes', and more than one record in the file matches the request, then the attributes from all records will be used. If set to 'no' (the default), the module will warn about duplicated records.
• delimiter = ":" — The character to use as a delimiter between fields. The default is ":".
• filename — The path to the file.
• format — The format of the fields in the file, given as an example line from the file, with the content of the fields as the RADIUS attributes which the fields map to. The fields are separated by the ':' character in the configuration (no matter what is configured for the 'delimiter' option).
• hash_size — The size of the hash table. A larger value means less probability of a collision, so records will be found faster, at the expense of greater memory usage. Having a hash_size in the range of 30-100% of the number of passwd file records is reasonable.
• ignore_empty — When set to "yes", the default, empty fields in the input will be skipped and the RADIUS attribute will not be added. By setting this value to "no", all attributes in the format list will always be added, even if they have no value.
• ignore_nislike — If set to 'yes', then all records from the file beginning with the '+' sign will be ignored. The default is 'no'.

FORMAT 🦋

The format option controls how lines are read from the file, and which fields are mapped to which RADIUS attributes. This is the main character of the config, fr fr.

The key field is the field being searched for within the file. It is normally signified by being preceded with a '*' character, which indicates that the field has only one key, like the /etc/passwd file. The key field may instead be preceded with '*,', which indicates that the field has multiple possible comma-separated keys, such as when searching the /etc/group file.

The other fields signify RADIUS attributes. By default they will be added as a control attribute list.

To add an attribute to the RADIUS request (as though it had been sent by the NAS), prefix the attribute name in the "format" string with the '~' character.

To add an attribute to the RADIUS reply (to be sent back to the NAS), prefix the attribute name in the "format" string with the '=' character.

EXAMPLES 🎀

Example one, the classic:

format = "*User-Name:Crypt-Password:"

For a file that looks similar to /etc/passwd: the first field, User-Name, is the key to look up in the file. When the record is found, a control attribute, Crypt-Password, will be added with the contents of the second field. (Note: this will not work with shadow passwords.) 😭

Example two, the group-chat era:

format = "My-Group:::*,User-Name"

Parse a file similar to the /etc/group file. An entry matches a request when the name in a User-Name attribute exists in the comma-separated list of a line in the file. When an entry matches, a "My-Group" attribute will be created and added to the control items for the request. The value of that attribute will be taken from the first field of the matching line in the file.

The ":::" in the format string means that there are extra two fields in the line, in between the group name and list of user names. Those fields do not map to any RADIUS attribute, and are therefore ignored.

For this example to work in practice, you will have to add the My-Group attribute to the dictionary file. See dictionary(5) for details on how this may be done. 📚

Example three, same energy but the request version:

format = "~My-Group:::*,User-Name"

Similar to the previous entry, except the My-Group attribute is added to the request, as though it was sent by the NAS. 🫶

SECTIONS 💅

• authorize

FILES 🌈

• /etc/raddb/mods-available/passwd

SEE ALSO 👑

• radiusd(8)
• radiusd.conf(5)
• radmin(8)
• dictionary(5)
• rlm_unix(5)

AUTHOR 💜

Alan DeKok <aland@freeradius.org>, Matthew Newton <matthew@newtoncomputing.co.uk>.

---

that's the whole page, bestie — FreeRADIUS Module energy, dated 20 January 2015, and yes, this is rlm_passwd(5). periodt 💅✨