FreeRADIUS Server administration tool that connects to the control
socket of a running server, and gives a command-line interface to it.
At this time, only a few commands are supported. Please type "help"
at the command prompt for detailed information about the supported
commands.
WARNING
The security protections offered by this command are limited to the
permissions on the Unix domain socket, and the server
configuration. If someone can connect to the Unix domain socket, they
have a substantial amount of control over the server.
OPTIONS
The following command-line options are accepted by the program.
-d config directory
Defaults to /etc/raddb. radmin looks here for the server
configuration files to find the "listen" section that defines the
control socket filename.
-e command
Run command and exit.
-f socket_file
Specify the socket filename directly. The radiusd.conf file is not read.
-i input_file
Reads input from the specified file. If not specified, stdin is used.
This also sets "-q".
-n mname
Read raddb/name.conf instead of raddb/radiusd.conf.
-o output_file
Write output to the specified file. If not specified, stdout is used.
This also sets "-q".
-q
Quiet mode.
COMMANDS
The commands implemented by the command-line interface are almost
completely controlled by the server. There are a few commands
interpreted locally by radmin:
reconnect
Reconnect to the server.
quit
Exit from radmin.
exit
Exit from radmin.
The other commands are implemented by the server. Type "help" at the
prompt for more information.
EXAMPLES
debug file /var/log/radius/bob.log
Set debug logs to /var/log/radius/bob.log. There is very little
checking of this filename. Rogue administrators may be able use this
command to over-write almost any file on the system. If those
administrators have write access to "radius.conf", they can do the
same thing without radmin, too.
debug condition '(User-Name == bob)'
Enable debugging output for all requests that match the condition.
Any "unlang" condition is valid here. The condition is parsed as a
string, so it must be enclosed in single or double quotes. Strings
enclosed in double-quotes must have back-slashes and the quotation
marks escaped inside of the string.
A more complex condition that enables debugging output for requests
containing User-Name "bob", or requests that originate from source IP
address 192.0.2.22.
debug condition
Disable debug conditionals.
FULL LIST OF COMMANDS
add <command>
do sub-command of add
add client <command>
Add client configuration commands
add client file <filename>
Add new client definition from <filename>
debug <command>
debugging commands
debug condition [condition]
Enable debugging for requests matching [condition]
debug level <number>
Set debug level to <number>. Higher is more debugging.
debug file [filename]
Send all debugging output to [filename]
hup [module]
sends a HUP signal to the server, or optionally to one module
reconnect
reconnect to a running server
terminate
terminates the server, and cause it to exit
set <command>
do sub-command of set
set module <command>
set module commands
set module config <module> variable value
set configuration for <module>
set home_server <command>
set home server commands
set home_server state <ipaddr> <port> [alive|dead]