radsecproxy(8)

✨ NAME ✨

okay so bestie, meet radsecproxy — a generic RADIUS proxy that gives you both the usual RADIUS UDP transport and TCP/TLS (aka RadSec) transport. she does it all. 💅

---

🌸 SYNOPSIS 🌸

radsecproxy [-c configfile] [-d debuglevel] [-f] [-i pidfile] [-p] [-v]

---

🦋 DESCRIPTION 🦋

radsecproxy is a generic RADIUS proxy that, on top of the usual RADIUS UDP transport, also supports TLS (RadSec). the whole goal here is for the proxy to have sufficient features to be flexible while simultaneously staying small, efficient and easy to configure. yes, you can have both. icon behavior.

so the origin story: the proxy was initially made to be able to deploy RadSec (RADIUS over TLS) so that all RADIUS communication across network links could be done using TLS, without modifying existing RADIUS software. how? you run this proxy on the same host as an existing RADIUS server or client, then configure that existing client/server to talk to localhost (the proxy) instead of talking to other clients and servers directly. sneaky? no. genius? yes. 😌

but like, there are other situations where a RADIUS proxy is useful too, and we're not gatekeeping:

• some people deploy RADIUS topologies where they want to route RADIUS messages to the right server, and the nodes doing purely routing could be using a proxy.
• some people may also wish to deploy a proxy on a site boundary.
• and since the proxy supports both IPv4 and IPv6, it could also be used to allow communication in cases where some RADIUS nodes use only IPv4 and some only IPv6. bridging the divide fr fr 🌈

---

👑 OPTIONS 👑

• -f — Run in foreground. by specifying this option, the proxy will run in foreground mode. that is, it won't detach. also, all logging will be done to stderr. cozy, she stays right there with you. 🫶
• -d debuglevel — this specifies the debug level. it must be set to 1, 2, 3, 4 or 5, where 1 logs only serious errors, and 5 logs everything. the default is 2, which logs errors, warnings and a few informational messages. so like, the middle child. balanced. 💅
• -p — Pretend. the proxy reads configuration files and performs initialisation as usual, but exits prior to creating any sockets. it will return different exit codes depending on whether the configuration files are okay. this may be used to verify configuration files, and can be done while another instance is running. it's giving dress rehearsal, no cap. 🎭
• -v — Print version and exit. that's it, that's the whole thing. ✨
• -c configfile — this option allows you to specify which config file to use. this is useful if you want to use a config file that is not in any of the default locations. main character energy: she goes wherever you tell her. 👑
• -i pidfile — this option tells the proxy to create a PID file with the specified path. 🍓

---

💀 SIGNALS 💀

the proxy generally exits on all signals. the exceptions are listed below, because of course there are exceptions, it's a Unix program. 🙈

SIGHUP

• when logging to a file, this signal forces a reopen of the log file.
• when using TLS or DTLS, it reloads certificate CRLs. glow up, certs. ✨

SIGPIPE

• this signal is ignored. she simply does not hear it. 💅

---

🎀 FILES 🎀

• /etc/radsecproxy.conf — the default configuration file. the one, the only, the OG. 🌟

---

🌈 SEE ALSO 🌈

• radsecproxy.conf(5)
• radsecproxy-hash(8)

go read your sisters, bestie, they're iconic too. 🦋

---

and that's the whole vibe check, bestie — this was radsecproxy 1.11.4, dated 2026-08-10. periodt. 💖🎀🫶