6.2 Proxying and Realms

FreeRADIUS can act as a proxy server that adheres to the RFC specifications. To use realms, a user will likely dial in with a preferred syntax as discussed in Chapter 2: commonly, this is in the format of user@realm or realm/user. To configure the proper syntax for your implementation, consult the realm module configuration section of the radiusd.conf file (in the /etc/raddb directory).

Further realm configuration takes place in the /etc/raddb/proxy.conf file. There is also another file, /etc/raddb/realms, but the developers of FreeRADIUS suggest using the more expandable and functional proxy.conf file for this purpose. The proxy.conf file lists various settings and configuration directives for the proxy functionality, as well as a realm configuration section in which you detail which realms belong to which authentication hosts. For example, for the realm ralint, the following entry would be added to the proxy.conf file:

realm ralint {
    type        = radius
    authhost    = radius.raleighinternet.com:1645
    accthost    = radius.raleighinternet.com:1646
    secret      = triangle
    nostrip
}

You can also configure local realms whose authentication requests are not proxied. In this case, you don't need to list a secret in the configuration. For instance:

realm durhamnet {
    type= radius
    authhost= LOCAL
    accthost= LOCAL
}

A NULL realm can be used for authentication requests without a realm specified. A NULL entry might look something like this:

realm NULL {
    type= radius
    authhost= radius.raleighinternet.com:1645
    accthost= radius.raleighinternet.com:1646
    secret= triangle
}

Finally, much like in the users file, there can be a DEFAULT entry that will apply to all other realms not explicitly matched. Here is an example:

realm DEFAULT {
    type= radius
    authhost= radlocal.corp.raleighinternet.com:1645
    accthost= radlocal.corp.raleighinternet.com:1646
    secret= iamnotamicrosoftmachine
}

There exist several more options with which you can configure proxying and realm functionality in the proxy.conf file. Table 6-1 lists the options.

Table 6-1. Realm and proxy configuration options

Option	Description
nostrip	This instructs FreeRADIUS not to strip the realm prefix or suffix before proxying a request. The default is to strip the realm identifier.
hints	This tells radiusd to send the username to the remote RADIUS server after the local hints file has been processed. The default is to send the original User-Name attribute unaltered.
notrealm	This option overrides the default action to proxy a user who logs on with a User-Name attribute that matches a defined realm.