understanding FreeRADIUS

[Alan DeKok]

Tom D. Davidson wrote:
> Hello, I have some usage questions about FreeRADIUS that I am not
> finding answers for on the wiki.
> 
> Can FR:

  FreeRADIUS can put anything into any RADIUS packet.  The rest of your
questions are best answered by pointing to general RADIUS concepts:

	http://deployingradius.com/book/concepts/

  In short, if your NAS has those features, FreeRADIUS can tell the NAS
when and where to use those features.

> FR architecture:
> * Does being a WPA user make a difference to any of these questions?
> What about being a device rather than a user?

  If you are using WPA-PSK, then the NAS does not contact the RADIUS
server.  So dynamic policies are not possible.

  If you are using EAP, then FreeRADIUS supports whatever the NAS
implements.

> * Authorization policies are not "in" radius, but in the db or
> directory correct? So to change policy for a user or device, the
> change would be done through the data store and not through radius?

  See the "concepts" page for some discussion.  A database is... a
database, and not a policy engine.  FreeRADIUS implements a policy
language that can query databases, scripts, flat-text files...

> But the policy logic would need to exists in FR (ie modules?)? OR does
> the policy logic come form the data store as well?

  It comes from anywhere you need.

> * Is there an OS API or does all the direction come through the data store?

  ? OS API for... what?  The server comes with a policy language that
lets you pull information from custom SQL schemas.

> * Is there any reason why FR couldnt be used as an all encompassing
> NAC (for WAN)?

  No.

> * Do my questions clearly demostrat that I do not understand FR? :)

  It's more "how RADIUS works".  RADIUS is the glue between dumb NASes
and dumb databases.

> FR 2.0:
> Is 2.0 a move to DIAMETER or is DIA not evolutionary?

  2.0 does not implement Diameter.  Diameter is used mainly in the 3GPP
world, but large telco's.  Almost no one else uses it.

> Is 2.0 recommended for production or should operators stick with 1.x?

  2.1.1 is widely used in production environments.  It makes 1.x look
like something out of the stone age.

  Alan DeKok.