From owner-freebsd-questions  Tue Oct  1 08:54:58 1996
Return-Path: owner-questions
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.5/8.7.3) id IAA25483
          for questions-outgoing; Tue, 1 Oct 1996 08:54:58 -0700 (PDT)
Received: from apollo.it.hq.nasa.gov (apollo.it.hq.nasa.gov [131.182.119.87])
          by freefall.freebsd.org (8.7.5/8.7.3) with SMTP id IAA25467
          for <questions@freefall.freebsd.org>; Tue, 1 Oct 1996 08:54:56 -0700 (PDT)
Received: from wirehead.it.hq.nasa.gov (wirehead.it.hq.nasa.gov [131.182.119.88]) by apollo.it.hq.nasa.gov (8.6.12/8.6.12) with ESMTP id PAA10315; Tue, 1 Oct 1996 15:54:53 GMT
Received: from localhost (cshenton@localhost) by wirehead.it.hq.nasa.gov (8.6.12/8.6.12) with SMTP id PAA06712; Tue, 1 Oct 1996 15:52:06 GMT
Message-Id: <199610011552.PAA06712@wirehead.it.hq.nasa.gov>
X-Authentication-Warning: wirehead.it.hq.nasa.gov: cshenton owned process doing -bs
X-Authentication-Warning: wirehead.it.hq.nasa.gov: Host localhost didn't use HELO protocol
To: questions@freefall.freebsd.org
cc: isp@freebsd.org
Subject: Re: Portmaster dillema!
In-Reply-To: Your message of "Tue, 1 Oct 1996 07:06:21 -0700 (PDT)"
References: <199610011406.HAA18777@freefall.freebsd.org>
X-Mailer: Mew version 1.03 on Emacs 19.31.8
Mime-Version: 1.0
Content-Type: Text/Plain; charset=us-ascii
Date: Tue, 01 Oct 1996 11:52:06 -0400
From: Chris Shenton <cshenton@it.hq.nasa.gov>
Sender: owner-questions@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

On Mon, 30 Sep 1996, Christopher H. Taylor wrote:

> I just started my ISP, using FreeBSD-2.1.5..... I got my Portmaster, and 
> configured everything properly.
> ... am I supposed to be adding all of my users into
> the Portmaster user table? I figured the portmaster would read my  
> /etc/passwd database, but I guess not! This is getting to be a pain 
> adding new users to my passwd table, then to the portmaster user table! 
> Isn't there a limit on  the amount of users I can have in the table? What
> if I get another  Portmaster, will I have to add all of the users from the
> first one, into that one too?

Yeah, the manual indicates the user table is only good for about
50-100 users. What you want is RADIUS, a protocol which allows
portmasters (and other network access servers) to authenticate
username/password with a separate server. This is cool because then
you can have dozens of PortMasters (or Ascends, or...) all querying
the same RADIUS servers.  You can download the radius daemon from
ftp.livingston.com, or build the one in FreeBSD's ports collection.
You then configure the RADIUS server.

There's two basic ways to configure users:

1. add username/password into the RADIUS "users" table, or
2. tell radius daemon to validate against the UNIX /etc/passwd file.

I took latter approach, because I only wanted to have the sysadms
create user "accounts" once. Since most of the users were going to be
dial-in PPP only (non-shell), I modified the "adduser" script config
to set the default shell offered when creating accounts to
"/NoShell". 

So radiusd looks in the "users" file, finds only one user:

###############################################################################
# If no username match above, use UNIX /etc/passwd authentication method.
# This allows us to use our existing user account name/password for dialup
# PPP username/passwords. Thus, we don't need to maintain separate accounts.

DEFAULT Password = "UNIX"
        User-Service-Type       = Framed-User,
        Framed-Protocol         = PPP


If anyone else has comments on the wisdom of doing it this way, I'd be
happy to hear from you.

You might wanna subscribe to the freebsd-isp mailing list for
questions of this type; cc'd here.

Later.