is a program that provides authorization and accounting services for
remote hosts, based on RADIUS protocols.
RADIUS protocols are defined in a pair of RFC documents
and currently used by the majority of network access servers and routers
in order to manage incoming dialup connections.
Open source products of RADIUS clients are also available for general
use on *nix hosts.
YARD RADIUS daemon is largerly based on the original Livingston
Inc. RADIUS 2.1 daemon (currently known as Lucent Inc. Remote
Access RADIUS server 2.1 - Livingston Inc. is now disappeared...).
It enhances the original code with a number of useful features, such as
control of simultaneous logins, support of many non standard vendor clients,
autoconfiguration capabilities, PAM services, MD5 passwords, etc.
All them are very useful in real world area of application (e.g. ISPs).
A complete and up-to-date list of extensions currently present
in YARD RADIUS is available in the Changelog file, which should be enclosed
The daemon listens to a couple of non privileged UDP ports (1645 and 1646)
and possibly to other two ones (1815 and 1816), when proxy is enabled.
Those ports could also be changed at run-time, but you are not encouraged
to do this. If your authorization information are available either as a
separate passwd file or self-contained in
file (i.e. in some form independent from system passwd file, see below)
you could run
as a non privileged users.
All configuration files of YARD RADIUS are contained under
if not spe
Sets the accounting directory instead of the builtin default.
The default is choosen at configuration time and it is
Enable accounting via PAM. See below.
Uses GDBM for the users file (
) instead of the plain text version (
This improve performances of users file checking for authentication.
It's strongly suggested. But it's not completely equivalent to plain
text, because GDBM files are strictly unsorted. This could be
ok or not, it depens on your specific choices of attributes.
You need to run
to convert the plain
file in the GDBM indexed file and this needs
to be done every time you changes users file contents.
Clears user stats database. This should be done to solve troubles
due to unsynchonized status among the servers and one or more of
its clients. Mabye, after a cold-reboot of an access server.
Sets the database directory instead of the builtin default one.
The default is choosen at configuration time and it is
Prints out usage of the command.
Sets an alternate password file name to use instead of the system password
Sets an alternate IP for the server host, instead of the default one.
This is useful if the host on which the daemon is runnig has multiple
interfaces or ip aliases.
Sets a logging text file, to use instead of
Accept all-zero accounting requests authenticator.
A damned thing to use with some old non-RFC compliant clients.
Use this if you see this kind of errors in the logging file, only.
Set an alternate radius port number.
Default ports should be (optionally) defined in
If they are not in that file, the above ones are used.
If you specify the port `n' as the argument of
-p option, then
tries to use the following ports:
Enable authorization via PAM. See below.
Sets the incoming packets queue size. 100 is the default.
Forks another process for accounting.
This is not generally suggested, due to dependencies among
auth and acct modules in YARD
Set time out for requests queue.
Print version. It shows also enabled features. Version number should be
a group of three point-separated numbers, such as
where meaning of the three values should be obvious. It's not easy to define
a `major' advancement in respect of a `minor' one. Anyway,
any minor/major number should correspond to a different branch
in the CVS repository. This is not true for a patching release.
Set time out for proxy requests.
Set debug mode on. It increases verbosity level.
The same of
-b -x -d . -a ra.
This is intended for debugging.
requires a group of configuration files under
in order to properly work.
Examples of those
working files are provided with sources and should be present
under the same directory, with extension
All files are well commented and it should be easy to customize them.
The work files are the following ones:
This file contains the human readable information for users' accounting
and authorization. See
for details about its syntax.
The same of the previous one as compiled in by
in GDBM format. It needs to be compiled again every time you make
changes to the previous one and without restarting
This read-only file contains the codes and formats for
standard and vendor RADIUS protocol attributes and values along with
their human readable representation. It is subject to change, due to
new access server supports. It is a plain text file with a pletora
of comments in it.
It contains names or ip addresses of remote clients authorized
to use the server for authentication and accounting,
along with their passwords in clear text.
So this file should be protected with mode 600.
The same of the previous file as cached in GDBM format for fast access
at daemon startup. With the same recommendations for file access modes.
This file is used to collect proxy hosts and their associated realms
and passwords. It contains a list of remote servers to forward to
authentication and accounting requests.
Every line refers to a different proxy server: the first field is a
valid hostname or ip address; the second field (seperated by blanks or
tabs) is the shared secret); the third field is the named or numeric
authentication realm; the fourth field can contain the optional RADIUS
UDP Port number of the remote server, the RADIUS and RADIUS Accounting
Port numbers, and any of following optional keywords:
Strip realm and do not attach Proxy-State when forwarding
Allow remote server to authorize admin logins for your client
Use the ipass protocol
The realm string must follow an `@' sign after the username to identify
the correct proxy server.
You can list here (one per line) usernames/groupnames who
are granted for having access (if their password are correct).
Each entry must respect one of the following syntaxes:
so you can match users by usernames, groupnames, gcos
substrings (i.e. case-sensitive sub-strings in the fifth field
of the system /etc/passwd file or the alternate password file),
or shell paths. You can use the special string `ANY' as a matching
argument too (e.g. `USER: ANY'). An empty or missing file grants
access to anyone which is not listed in the next file.
The same syntax of allowuser can be used to deny access to
specific classes of users, with the same previous matching
criteria. An empty or missing file grants access to anyone
which is listed in the previous file or not.
Note that all users have always to match their password with the
authorization module selected in their `users' file entry, after the
above files allowed to login. You cannot use these files
to grant access without any other additional authentication.
This text file is created by
to deny access to users,
when certain conditions are reached (as selected in the radwatch
configuration file). The authentication daemon
that file along with `denyuser' in order to grant access or not.
It has an entry per line, which should be a valid system or `users'
This is the configuration file for
It is a text files each line of which is of the form:
where `user_list' is a comma-separated list of usernames for which
this line apply. You can use @group syntax to denote the standard
UNIX user groups. The field `restriction' is the value in seconds of the
maximum permitted online time within the `time_list'. This one is the
third colon separated field
and is a list of days of the week and times during which this
restriction apply to this user. The valid days are 'Su', 'Mo', 'Tu', 'We', 'Th', 'Fr', and 'Sa'.
In addition, the value 'Al'
represents all 7 days, and 'Wk' represents the 5 weekdays.
Times are given as HHMM-HHMM. The ending time may be before
the starting time. Days are presumed to wrap at 0000.
This text file contains the configuration information necessary for
to connect to the ActivEngine, which is the
ActivCard Authentication Server.
See comments contained in the
example file provided for details.
All logging and accounting files of YARD RADIUS are stored under
`/usr/logs'. Accounting files are organized on a per-month
and per-year basis. All files written by Livingston's server are
also written by YARD, but it also creates some specific binary files to store
the on-line status of users, and collect users statistics.
It's important to ensure that those files are synchronized with the real
status of the clients, to avoid annoying denial-of-service troubles
to your users (e.g. in conjunction with a Yard-Simultaneuous-Use attribute).
This could happen when one or more clients reboots without
sending suitable stop accouting records before. In those cases, YARD
has to be killed too and restarted with a `clean up' argument `-c', in order
to reset its internal status.
The logging file structure is as follows:
GDBM yearly file
Binary compact monthly file
Livingston-like logging text file
This allows very fast computing of statistics and maintaining on-line
A complete list of contributors is contained in CREDITS file.
You should get that file among other ones within your distribution
and possibly installed under
Copyright (C) 1992-1999 Lucent Inc. All rights reserved.
Copyright (C) 1999-2004 Francesco Paolo Lovergine. All rights reserved.
See the LICENSE file enclosed within this software for conditions of
use and distribution. This is a pure
ISO BSD Open Source License .
The configuration of a RADIUS server is an argument too long to
deal with it here. Please, refer to the official Livingston documentation,
which includes the
RADIUS for UNIX Administrator's Guide.
It is freely available at
at the time of this document.