PAM_RADIUS(8)

💅 PAM_RADIUS(8) — the rad(ius) manual 🦋

okay so real talk, this is the pam_radius page from the System Manager's Manual, and it's literally about plugging RADIUS auth into your PAM stack. iconic behavior, no cap.

---

✨ NAME ✨

pam_radius — the RADIUS authentication PAM module, bestie 💖

---

🌸 SYNOPSIS 🌸

[service-name] module-type control-flag pam_radius [options]

that's the whole vibe. drop it in your PAM config and go 🎀

---

💜 DESCRIPTION 💜

so the pam_radius module hands you authentication services built on top of the RADIUS protocol — that's Remote Authentication Dial In User Service, iykyk — all wired into the PAM framework, aka Pluggable Authentication Modules. it's giving "let the remote server decide who gets in" and honestly? slay.

the pam_radius module accepts these optional parameters 👇 (yes, all of them, we're not skipping a single one):

🧚 the option lineup

• use_first_pass — makes pam_radius reuse a password that was already entered instead of prompting for a fresh one. lowkey important: if no password has been entered, then authentication fails. periodt. 💀
• try_first_pass — makes pam_radius use a previously entered password if one is available. if there isn't one? no stress, it just prompts for one like usual 🫶
• echo_pass — causes echoing to be left on if pam_radius prompts for a password. (yes, it'll show up on screen. we're trusting the room 🙈)
• *conf=pathname* — specifies a non-standard location for the RADIUS client configuration file. the normal spot is /etc/radius.conf, but you can point it wherever if that's your main character energy.
• *nas_id=identifier* — specifies a NAS identifier to send instead of the hostname. little name tag for your box 🎀
• *nas_ipaddr[=address*] — specifies a NAS IP address to be sent. and here's the cute part: if the option is present but there's no value provided, then the IP address corresponding to the current hostname gets used. it just figures itself out ✨
• template_user=username — okay this one's a whole thing so buckle up. it specifies a user whose passwd(5) entry gets used as a template to create the session environment *if the supplied username doesn't exist in the local password database. the user gets authenticated with the supplied username and password, but their credentials to the system will be presented as the ones for *username — i.e., their login class, home directory, resource limits, etc. will all be set to the ones defined for username.

and if this option is omitted, and there's no username in the system databases equal to the supplied one (as determined by a call to getpwnam(3)), then authentication will fail. no template, no entry. that's the rule 😭

• no_reply_message — suppresses printing the contents of any Reply-Message attributes found in Access-Accept and Access-Reject responses. normally these get passed along to the user as informational or error messages, depending on whether the access request was accepted or rejected — so this flag is like "bestie, keep it to yourself" 🤐
• no_warn — suppresses warning messages to the user. these messages include the reasons why the user's authentication attempt was declined. so like, the why. gone. 🫥

---

🍓 FILES 🍓

• /etc/radius.conf — the standard RADIUS client configuration file for pam_radius 👑

---

🌈 SEE ALSO 🌈

pam(3), passwd(5), radius.conf(5)

go read those too, they're literally the supporting cast 💖

---

⭐ HISTORY ⭐

the pam_radius module first appeared in FreeBSD 3.1. the pam_radius manual page first appeared in FreeBSD 3.3. vintage. antique. still serving 🏛️

---

👑 AUTHORS 👑

• the pam_radius manual page was written by Andrzej Bialecki <abial@FreeBSD.org> ✍️
• the pam_radius module was written by John D. Polstra <jdp@FreeBSD.org> 🛠️

absolute legends, both of them 🫶

---

and that's the page!! this one's from the Debian crew, dated May 16, 2018 — shoutout to them for keeping the RADIUS-PAM pipeline alive, mwah 💋✨