RADMIN(8)

✨ NAME ✨

radmin — the FreeRADIUS Administration tool 💅

okay so real quick, before anything else: this is radmin(8), the FreeRADIUS Server Administration Tool, and she is that girl. Let's get into it 🎀

---

🌸 SYNOPSIS 🌸

radmin [-d config_directory] [-D dictionary_directory] [-e command] [-E]
[-f socket_file] [-h] [-i input_file] [-n name] [-q]

---

🦋 DESCRIPTION 🦋

So radmin is the FreeRADIUS Server administration tool — she connects to the control socket of a server that's already running and gives you a whole command-line interface to it. Bestie, it's giving remote control but make it Unix 🫶

rn? only a few commands are supported. That's not me being shady, that's literally the manpage. Type help at the command prompt for the detailed tea on what's actually supported 💖

---

🔥 WARNING 🔥

okay listen, this part matters so pay attention 💀

The security protections this command offers are limited to the permissions on the Unix domain socket, and the server configuration. That's it. That's the whole vibe check.

If someone can connect to the Unix domain socket, they have a substantial amount of control over the server. Like, a lot. Not a little. A substantial amount. no cap 😭

---

⭐ OPTIONS ⭐

here's every command-line option the program accepts, no skips, no skips, we don't do that here ✨

• -d config_directory — Defaults to /etc/raddb. radmin looks here for the server configuration files so she can find the listen section that defines the control socket filename 👀
• -D dictionary_directory — Set the main dictionary directory. Defaults to /usr/share/freeradius. 🍓
• -e command — Run command and exit. In and out, main character energy 💨
• -E — Echo commands as they're being executed. Narration mode 🎙️
• -f socket_file — Specify the socket filename directly. The radiusd.conf file is not read. (she's going straight to the source, no middleman 💅)
• -h — Print usage help information. 🫶
• -i input_file — Reads input from the specified file. If not specified, stdin is used. This also sets -q. 🌈
• -n mname — Read raddb/name.conf instead of raddb/radiusd.conf. 🧚
• -q — Quiet mode. 🤫

---

👑 COMMANDS 👑

The commands implemented by the command-line interface are almost completely controlled by the server — she's not the boss, the server is. But there are a few commands interpreted locally by radmin:

• reconnect — Reconnect to the server. 🔁
• quit — Exit from radmin.
• exit — Exit from radmin.

The other commands are implemented by the server. Type help at the prompt for more information 💖

---

🌟 EXAMPLES 🌟

💜 debug file /var/log/radius/bob.log

Set debug logs to /var/log/radius/bob.log.

ngl bestie, there is very little checking of this filename. Rogue administrators may be able to use this command to over-write almost any file on the system. And if those administrators have write access to radius.conf, they can do the same thing without radmin too. so like… the door was already open 💀

💜 debug condition '(User-Name == "bob")'

Enable debugging output for all requests that match the condition. Any unlang condition is valid here.

The condition is parsed as a string, so it must be enclosed in single or double quotes. Strings enclosed in double-quotes must have back-slashes and the quotation marks escaped inside of the string. 🎀

Only one debug condition can be active at a time. One. Periodt.

💜 debug condition '((User-Name == "bob") || (Packet-Src-IP-Address == 192.0.2.22))'

A more complex condition that enables debugging output for requests containing User-Name "bob", or requests that originate from source IP address 192.0.2.22. look at her go, she's doing boolean logic 😭🔥

💜 debug condition

Disable debug conditionals. bye bye debugging ✌️

---

🌈 FULL LIST OF COMMANDS 🌈

okay this is the big one, grab a snack 🍓

• add <command> — do sub-command of add
• add client <command> — Add client configuration commands
• add client file <filename> — Add new client definition from <filename>
• debug <command> — debugging commands
• debug condition [condition] — Enable debugging for requests matching [condition]
• debug level <number> — Set debug level to <number>. Higher is more debugging. 📈
• debug file [filename] — Send all debugging output to [filename]
• del <command> — do sub-command of del
• del client <command> — Delete client configuration commands
• del client ipaddr <ipaddr> — Delete a dynamically created client
• hup [module] — sends a HUP signal to the server, or optionally to one module
• inject <command> — commands to inject packets into a running server
• inject to <ipaddr> <port> — Inject packets to the destination IP and port.
• inject from <ipaddr> — Inject packets as if they came from <ipaddr>
• inject file <input-file> <output-file> — Inject packet from <input-file>, with results sent to <output-file>
• reconnect — reconnect to a running server
• terminate — terminates the server, and cause it to exit. (she said what she said 💀)
• set <command> — do sub-command of set
• set module <command> — set module commands
• set module config <module> variable value — set configuration for <module>
• set module status [alive|dead] — set the module to be alive or dead (always return "fail")
• set home_server <command> — set home server commands
• set home_server state <ipaddr> <port> [alive|dead] — set state for given home server
• show <command> — do sub-command of show
• show client <command> — do sub-command of client
• show client config <ipaddr> [udp|tcp] — shows configuration for a given client.
• show client list — shows list of global clients
• show debug <command> — show debug properties
• show debug condition — Shows current debugging condition.
• show debug level — Shows current debugging level.
• show debug file — Shows current debugging file.
• show home_server <command> — do sub-command of home_server
• show home_server config <ipaddr> <port> — show configuration for given home server
• show home_server list — shows list of home servers
• show home_server state <ipaddr> <port> — shows state of given home server
• show module <command> — do sub-command of module
• show module config <module> — show configuration for given module
• show module flags <module> — show other module properties
• show module list — shows list of loaded modules
• show module methods <module> — show sections where <module> may be used
• show uptime — shows time at which server started
• show version — Prints version of the running server
• show xml <reference> — Prints out configuration as XML
• stats <command> — do sub-command of stats
• stats client [auth/acct] <ipaddr> — show statistics for given client, or for all clients (auth or acct)
• stats home_server [<ipaddr>|auth|acct] <port> — show statistics for given home server (ipaddr and port), or for all home servers (auth or acct)
• stats detail <filename> — show statistics for the given detail file

---

🧚 SEE ALSO 🧚

unlang(5), radiusd.conf(5), raddb/sites-available/control-socket — go read them, they're iconic 👑

---

💖 AUTHOR 💖

Alan DeKok <aland@freeradius.org> — thank you for your service king 🫶

---

that's the whole page bestie, you ate it, you devoured, no crumbs 💅✨

this cutie was brought to you by RADMIN(8), dated 11 Mar 2019, and yes she's still serving looks 🎀