embedaddon/mpd/doc/mpd29.html - view

File: [ELWIX - Embedded LightWeight unIX -] / embedaddon / mpd / doc / mpd29.html
Revision 1.1.1.4 (vendor branch): download - view: text, annotated - select for diffs - revision graph
Wed Mar 17 00:39:23 2021 UTC (3 years, 3 months ago) by misho
Branches: mpd, MAIN
CVS tags: v5_9p16, v5_9, HEAD

mpd 5.9

1: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"> 2: <HTML> 3: <HEAD> 4: <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> 5: <TITLE>Authentication, Authorization and Accounting (AAA)</TITLE> 6: </HEAD> 7: <BODY text="#000000" bgcolor="#ffffff"> 8: 9: <A HREF="mpd.html">Mpd 5.9 User Manual</A> 10: : <A HREF="mpd17.html">Configuring Mpd</A> 11: : Authentication, Authorization and Accounting (AAA)  12: Previous: <A HREF="mpd28.html">Interface layer</A>  13: Next: <A HREF="mpd30.html">RADIUS</A> 14: 15: 16: <HR NOSHADE> 17: <H2><A NAME="29"></A>4.10. Authentication, Authorization and Accounting (AAA)<A NAME="auth"></A></H2> 18: 19: Mpd currently supports authentication against (tried 20: in this order) 21: <A HREF="mpd31.html#extauth">external script</A>, 22: <A HREF="mpd30.html#radius">RADIUS</A>, PAM, systems password database 23: (<code>master.passwd</code>), OPIE and internal <code>mpd.secret</code> file. 24: This chapter describes commands that configure the Authentication 25: subsystem of LCP layer. All of these commands apply to the currently 26: active link.  27:  28: <dl> 29: 30: <dt><code>set auth authname login</code><dd>This command sets the authentication login name associated with 31: the link (in multi-link PPP, though each link is authenticated 32: individually, they all must use the same login name). The 33: <code>login</code> may have a corresponding entry in 34: <code>mpd.secret</code>. The <code>login</code> and password 35: are used when the peer requires us to authenticate ourselves. 36: 37: <dt><code>set auth password password</code><dd>This command is normally not necessary. It causes mpd to not 38: lookup the password corresponding to <code>login</code> 39: in <code>mpd.secret</code>, but rather to use 40: <code>password</code> instead. If you're too lazy to set up 41: <code>mpd.secret</code> and are only dialing out, you can use this 42: command instead. 43: 44: <dt><code>set auth max-logins num [CI]</code><dd>Limit the max. amount of concurrent logins with the same username. 45: If set to zero, then this feature is disabled. If CI argument is present 46: login comparasion will be case insensitive. 47: 48: <dt><code>set auth acct-update seconds</code><dd>Enables periodic accounting updates, if set to a value greater then 49: zero. 50: 51: <dt><code>set auth timeout seconds</code><dd>Sets the timeout for the whole authentication process. 52: It defaults to 40 seconds. 53: Under some circumstances the value should be changed; it usually 54: depends on the authentication backend and protocol. 55: E.g. when using EAP with a slow RADIUS server this value should be increased. 56: 57: <dt><code> set auth extauth-script script  58: set auth extacct-script script</code><dd>Sets scripts names for external authentication and accounting. 59: 60: <dt><code> set auth enable option ...  61: set auth disable option ...</code><dd> 62: </dl> 63:  64: 65: 66: The options available are: 67:  68: <dl> 69: 70: <dt><code>internal</code><dd>Enables authentication against the <code>mpd.secret</code> file. 71: Default <code>enable</code>. 72: 73: <dt><code>radius-auth</code><dd>Enable authentication via RADIUS. For details see 74: <A HREF="mpd30.html#radius">the RADIUS chapter</A>. 75: Default <code>disable</code>. 76: 77: <dt><code>radius-acct</code><dd>Enable per link accounting via RADIUS. For details see 78: <A HREF="mpd30.html#radius">the RADIUS chapter</A>. 79: Default <code>disable</code>. 80: 81: <dt><code>ext-auth</code><dd>Enable authentication by calling external script. 82: This method pretended to be a fullfeatured alternative to the 83: <code>radius-auth</code>. For details see 84: <A HREF="mpd31.html#extauth">the External authentication chapter</A>. 85: Default <code>disable</code>. 86: 87: <dt><code>ext-acct</code><dd>Enable accounting by calling external script. 88: This method pretended to be a fullfeatured alternative to the 89: <code>radius-acct</code>. For details see 90: <A HREF="mpd31.html#extauth">the External authentication chapter</A>. 91: Default <code>disable</code>. 92: 93: <dt><code>pam-auth</code><dd>Enables authentication using PAM service "mpd". 94: This options can only be used with PAP. 95: Default <code>disable</code>. 96: 97: <dt><code>pam-acct</code><dd>Enable accounting using PAM service "mpd". 98: Default <code>disable</code>. 99: 100: <dt><code>system-auth</code><dd>Enables authentication against the systems password database. 101: This options can only be used with PAP and MS-CHAP, but not 102: with CHAP-MD5. If you intend to use this with MS-CHAP, then 103: the passwords in the <code>master.passwd</code> must be NT-Hashes. 104: You can enable this by putting <code>:passwd_format=nth:</code> into 105: your <code>/etc/login.conf</code>, but you need at least FreeBSD 5.2. 106: Default <code>disable</code>. 107: 108: <dt><code>system-acct</code><dd>Enable accounting via utmp/wtmp. 109: Default <code>disable</code>. 110: 111: <dt><code>opie</code><dd>Enables authentication using OPIE. 112: When using PAP there is nothing more todo. For all other 113: authentication protocols you have to put the username into 114: the <code>mpd.secret</code> file, but the specified password is 115: then interpreted as secret pass phrase. This is needed, because 116: Mpd must be aware of the plaintext password when using CHAP. 117: The (windows) endusers could generate their actual responses 118: themselfs using Winkey. 119: IMPORTANT: Disable the internal authentication when using 120: OPIE and CHAP, because otherwise users are also able to authenticate 121: with their secret pass phrase. 122: Default <code>disable</code>. 123: 124: <dt><code>acct-mandatory</code><dd>Makes accounting start mandatory. If enabled, on accounting start failure 125: connection will be dropped. 126: Default <code>enable</code>. 127: 128: </dl> 129:  130: <H3>4.10.1. <A HREF="mpd30.html#30">RADIUS</A></H3> 131: <H3>4.10.2. <A HREF="mpd31.html#31">External authentication</A></H3> 132: <HR NOSHADE> 133: <A HREF="mpd.html">Mpd 5.9 User Manual</A> 134: : <A HREF="mpd17.html">Configuring Mpd</A> 135: : Authentication, Authorization and Accounting (AAA)  136: Previous: <A HREF="mpd28.html">Interface layer</A>  137: Next: <A HREF="mpd30.html">RADIUS</A> 138: 139: 140: 141: </BODY> 142: </HTML>