radmin - FreeRADIUS Administration tool
radmin [-d config_directory] [-e
command] [-E] [-f socket_file] [-h]
[-i input_file] [-n name] [-q]
FreeRADIUS Server administration tool that connects to the control
socket of a running server, and gives a command-line interface to it.
At this time, only a few commands are supported. Please type
"help" at the command prompt for detailed information about the
supported commands.
The security protections offered by this command are limited to
the permissions on the Unix domain socket, and the server configuration. If
someone can connect to the Unix domain socket, they have a substantial
amount of control over the server.
The following command-line options are accepted by the
program.
- -d config directory
- Defaults to /etc/freeradius/3.0. radmin looks here for the
server configuration files to find the "listen" section that
defines the control socket filename.
- -e command
- Run command and exit.
- -E
- Echo commands as they are being executed.
- -f socket_file
- Specify the socket filename directly. The radiusd.conf file is not
read.
- -h
- Print usage help information.
- -i input_file
- Reads input from the specified file. If not specified, stdin is used. This
also sets "-q".
- -n mname
- Read raddb/name.conf instead of raddb/radiusd.conf.
- -q
- Quiet mode.
The commands implemented by the command-line interface are almost
completely controlled by the server. There are a few commands interpreted
locally by radmin:
- reconnect
- Reconnect to the server.
- quit
- Exit from radmin.
- exit
- Exit from radmin.
The other commands are implemented by the server. Type
"help" at the prompt for more information.
- debug file /var/log/radius/bob.log
- Set debug logs to /var/log/radius/bob.log. There is very little checking
of this filename. Rogue administrators may be able use this command to
over-write almost any file on the system. If those administrators have
write access to "radius.conf", they can do the same thing
without radmin, too.
- debug condition '(User-Name == "bob")'
- Enable debugging output for all requests that match the condition. Any
"unlang" condition is valid here. The condition is parsed as a
string, so it must be enclosed in single or double quotes. Strings
enclosed in double-quotes must have back-slashes and the quotation marks
escaped inside of the string.
Only one debug condition can be active at a time.
- debug condition
'((User-Name == "bob") || (Packet-Src-IP-Address ==
192.0.2.22))'
- A more complex condition that enables debugging output for requests
containing User-Name "bob", or requests that originate from
source IP address 192.0.2.22.
- debug condition
- Disable debug conditionals.
Alan DeKok <aland@freeradius.org>