+diff -Naur freeradius-server-2.1.4/raddb/attrs freeradius-server-2.1.4.new/raddb/attrs
+--- freeradius-server-2.1.4/raddb/attrs 2009-03-10 19:26:50.000000000 -0700
++++ freeradius-server-2.1.4.new/raddb/attrs 2009-04-07 15:09:02.000000000 -0700
+@@ -1,7 +1,4 @@
+ #
+-# Configuration file for the rlm_attr_filter module.
+-# Please see rlm_attr_filter(5) manpage for more information.
+-#
+ # $Id$
+ #
+ # This file contains security and configuration information
+diff -Naur freeradius-server-2.1.4/raddb/attrs.access_reject freeradius-server-2.1.4.new/raddb/attrs.access_reject
+--- freeradius-server-2.1.4/raddb/attrs.access_reject 2009-03-10 19:26:50.000000000 -0700
++++ freeradius-server-2.1.4.new/raddb/attrs.access_reject 2009-04-07 15:09:20.000000000 -0700
+@@ -1,7 +1,4 @@
+ #
+-# Configuration file for the rlm_attr_filter module.
+-# Please see rlm_attr_filter(5) manpage for more information.
+-#
+ # $Id$
+ #
+ # This configuration file is used to remove almost all of the attributes
+diff -Naur freeradius-server-2.1.4/raddb/attrs.accounting_response freeradius-server-2.1.4.new/raddb/attrs.accounting_response
+--- freeradius-server-2.1.4/raddb/attrs.accounting_response 2009-03-10 19:26:50.000000000 -0700
++++ freeradius-server-2.1.4.new/raddb/attrs.accounting_response 2009-04-07 15:09:32.000000000 -0700
+@@ -1,7 +1,4 @@
+ #
+-# Configuration file for the rlm_attr_filter module.
+-# Please see rlm_attr_filter(5) manpage for more information.
+-#
+ # $Id$
+ #
+ # This configuration file is used to remove almost all of the attributes
+diff -Naur freeradius-server-2.1.4/raddb/attrs.pre-proxy freeradius-server-2.1.4.new/raddb/attrs.pre-proxy
+--- freeradius-server-2.1.4/raddb/attrs.pre-proxy 2009-03-10 19:26:50.000000000 -0700
++++ freeradius-server-2.1.4.new/raddb/attrs.pre-proxy 2009-04-07 15:09:44.000000000 -0700
+@@ -1,7 +1,4 @@
+ #
+-# Configuration file for the rlm_attr_filter module.
+-# Please see rlm_attr_filter(5) manpage for more information.
+-#
+ # $Id$
+ #
+ # This file contains security and configuration information
+diff -Naur freeradius-server-2.1.4/raddb/dictionary.in freeradius-server-2.1.4.new/raddb/dictionary.in
+--- freeradius-server-2.1.4/raddb/dictionary.in 2009-03-10 19:26:50.000000000 -0700
++++ freeradius-server-2.1.4.new/raddb/dictionary.in 2009-04-07 15:10:18.000000000 -0700
+@@ -11,14 +11,12 @@
+ #
+ # The filename given here should be an absolute path.
+ #
+-$INCLUDE @prefix@/share/freeradius/dictionary
++$INCLUDE @prefix@/share/freeradius2/dictionary
+
+ #
+ # Place additional attributes or $INCLUDEs here. They will
+ # over-ride the definitions in the pre-defined dictionaries.
+ #
+-# See the 'man' page for 'dictionary' for information on
+-# the format of the dictionary files.
+
+ #
+ # If you want to add entries to the dictionary file,
+diff -Naur freeradius-server-2.1.4/raddb/eap.conf freeradius-server-2.1.4.new/raddb/eap.conf
+--- freeradius-server-2.1.4/raddb/eap.conf 2009-03-10 19:26:50.000000000 -0700
++++ freeradius-server-2.1.4.new/raddb/eap.conf 2009-04-07 15:20:28.000000000 -0700
+@@ -27,7 +27,7 @@
+ # then that EAP type takes precedence over the
+ # default type configured here.
+ #
+- default_eap_type = md5
++ default_eap_type = peap
+
+ # A list is maintained to correlate EAP-Response
+ # packets with EAP-Request packets. After a
+@@ -72,23 +72,8 @@
+ # for wireless connections. It is insecure, and does
+ # not provide for dynamic WEP keys.
+ #
+- md5 {
+- }
+-
+- # Cisco LEAP
+- #
+- # We do not recommend using LEAP in new deployments. See:
+- # http://www.securiteam.com/tools/5TP012ACKE.html
+- #
+- # Cisco LEAP uses the MS-CHAP algorithm (but not
+- # the MS-CHAP attributes) to perform it's authentication.
+- #
+- # As a result, LEAP *requires* access to the plain-text
+- # User-Password, or the NT-Password attributes.
+- # 'System' authentication is impossible with LEAP.
+- #
+- leap {
+- }
++# md5 {
++# }
+
+ # Generic Token Card.
+ #
+@@ -101,10 +86,10 @@
+ # the users password will go over the wire in plain-text,
+ # for anyone to see.
+ #
+- gtc {
++# gtc {
+ # The default challenge, which many clients
+ # ignore..
+- #challenge = "Password: "
++# challenge = "Password: "
+
+ # The plain-text response which comes back
+ # is put into a User-Password attribute,
+@@ -118,8 +103,8 @@
+ # configured for the request, and do the
+ # authentication itself.
+ #
+- auth_type = PAP
+- }
++# auth_type = PAP
++# }
+
+ ## EAP-TLS
+ #
+@@ -130,11 +115,6 @@
+ # built, the "tls", "ttls", and "peap" sections will
+ # be ignored.
+ #
+- # Otherwise, when the server first starts in debugging
+- # mode, test certificates will be created. See the
+- # "make_cert_command" below for details, and the README
+- # file in raddb/certs
+- #
+ # These test certificates SHOULD NOT be used in a normal
+ # deployment. They are created only to make it easier
+ # to install the server, and to perform some simple
+@@ -201,7 +181,7 @@
+ # In these cases, fragment size should be
+ # 1024 or less.
+ #
+- # fragment_size = 1024
++ fragment_size = 1024
+
+ # include_length is a flag which is
+ # by default set to yes If set to
+@@ -211,7 +191,7 @@
+ # message is included ONLY in the
+ # First packet of a fragment series.
+ #
+- # include_length = yes
++ include_length = yes
+
+ # Check the Certificate Revocation List
+ #
+@@ -220,83 +200,74 @@
+ # 'c_rehash' is OpenSSL's command.
+ # 3) uncomment the line below.
+ # 5) Restart radiusd
+- # check_crl = yes
+- # CA_path = /path/to/directory/with/ca_certs/and/crls/
++# check_crl = yes
++# CA_path = /path/to/directory/with/ca_certs/and/crls/
++
++ #
++ # If check_cert_issuer is set, the value will
++ # be checked against the DN of the issuer in
++ # the client certificate. If the values do not
++ # match, the cerficate verification will fail,
++ # rejecting the user.
++ #
++# check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd"
++
++ #
++ # If check_cert_cn is set, the value will
++ # be xlat'ed and checked against the CN
++ # in the client certificate. If the values
++ # do not match, the certificate verification
++ # will fail rejecting the user.
++ #
++ # This check is done only if the previous
++ # "check_cert_issuer" is not set, or if
++ # the check succeeds.
++ #
++# check_cert_cn = %{User-Name}
+
+- #
+- # If check_cert_issuer is set, the value will
+- # be checked against the DN of the issuer in
+- # the client certificate. If the values do not
+- # match, the cerficate verification will fail,
+- # rejecting the user.
+- #
+- # check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd"
+-
+- #
+- # If check_cert_cn is set, the value will
+- # be xlat'ed and checked against the CN
+- # in the client certificate. If the values
+- # do not match, the certificate verification
+- # will fail rejecting the user.
+- #
+- # This check is done only if the previous
+- # "check_cert_issuer" is not set, or if
+- # the check succeeds.
+- #
+- # check_cert_cn = %{User-Name}
+- #
+ # Set this option to specify the allowed
+ # TLS cipher suites. The format is listed
+ # in "man 1 ciphers".
+ cipher_list = "DEFAULT"
+
+ #
+-
+- # This configuration entry should be deleted
+- # once the server is running in a normal
+- # configuration. It is here ONLY to make
+- # initial deployments easier.
+- #
+- make_cert_command = "${certdir}/bootstrap"
+-
+- #
+ # Session resumption / fast reauthentication
+ # cache.
+ #
+- cache {
+- #
+- # Enable it. The default is "no".
+- # Deleting the entire "cache" subsection
+- # Also disables caching.
+- #
+- # You can disallow resumption for a
+- # particular user by adding the following
+- # attribute to the control item list:
+- #
+- # Allow-Session-Resumption = No
+- #
+- # If "enable = no" below, you CANNOT
+- # enable resumption for just one user
+- # by setting the above attribute to "yes".
+- #
+- enable = no
+-
+- #
+- # Lifetime of the cached entries, in hours.
+- # The sessions will be deleted after this
+- # time.
+- #
+- lifetime = 24 # hours
+-
+- #
+- # The maximum number of entries in the
+- # cache. Set to "0" for "infinite".
+- #
+- # This could be set to the number of users
+- # who are logged in... which can be a LOT.
+- #
+- max_entries = 255
+- }
++# cache {
++ #
++ # Enable it. The default is "no".
++ # Deleting the entire "cache" subsection
++ # Also disables caching.
++ #
++ # You can disallow resumption for a
++ # particular user by adding the following
++ # attribute to the control item list:
++ #
++ # Allow-Session-Resumption = No
++ #
++ # If "enable = no" below, you CANNOT
++ # enable resumption for just one user
++ # by setting the above attribute to "yes".
++ #
++# enable = no
++
++ #
++ # Lifetime of the cached entries, in hours.
++ # The sessions will be deleted after this
++ # time.
++ #
++# lifetime = 24 # hours
++
++ #
++ # The maximum number of entries in the
++ # cache. Set to "0" for "infinite".
++ #
++ # This could be set to the number of users
++ # who are logged in... which can be a LOT.
++ #
++# max_entries = 255
++# }
+ }
+
+ # The TTLS module implements the EAP-TTLS protocol,
+@@ -320,7 +291,7 @@
+ #
+ # in the control items for a request.
+ #
+- ttls {
++# ttls {
+ # The tunneled EAP session needs a default
+ # EAP type which is separate from the one for
+ # the non-tunneled EAP module. Inside of the
+@@ -328,7 +299,7 @@
+ # If the request does not contain an EAP
+ # conversation, then this configuration entry
+ # is ignored.
+- default_eap_type = md5
++# default_eap_type = mschapv2
+
+ # The tunneled authentication request does
+ # not usually contain useful attributes
+@@ -344,7 +315,7 @@
+ # is copied to the tunneled request.
+ #
+ # allowed values: {no, yes}
+- copy_request_to_tunnel = no
++# copy_request_to_tunnel = yes
+
+ # The reply attributes sent to the NAS are
+ # usually based on the name of the user
+@@ -357,20 +328,8 @@
+ # the tunneled request.
+ #
+ # allowed values: {no, yes}
+- use_tunneled_reply = no
+-
+- #
+- # The inner tunneled request can be sent
+- # through a virtual server constructed
+- # specifically for this purpose.
+- #
+- # If this entry is commented out, the inner
+- # tunneled request will be sent through
+- # the virtual server that processed the
+- # outer requests.
+- #
+- virtual_server = "inner-tunnel"
+- }
++# use_tunneled_reply = yes
++# }
+
+ ##################################################
+ #
+@@ -433,26 +392,16 @@
+
+ # the PEAP module also has these configuration
+ # items, which are the same as for TTLS.
+- copy_request_to_tunnel = no
+- use_tunneled_reply = no
++ copy_request_to_tunnel = yes
++ use_tunneled_reply = yes
+
+ # When the tunneled session is proxied, the
+ # home server may not understand EAP-MSCHAP-V2.
+ # Set this entry to "no" to proxy the tunneled
+ # EAP-MSCHAP-V2 as normal MSCHAPv2.
+- # proxy_tunneled_request_as_eap = yes
++ proxy_tunneled_request_as_eap = no
+
+- #
+- # The inner tunneled request can be sent
+- # through a virtual server constructed
+- # specifically for this purpose.
+- #
+- # If this entry is commented out, the inner
+- # tunneled request will be sent through
+- # the virtual server that processed the
+- # outer requests.
+- #
+- virtual_server = "inner-tunnel"
++ EAP-TLS-Require-Client-Cert = no
+ }
+
+ #
+diff -Naur freeradius-server-2.1.4/raddb/ldap.attrmap freeradius-server-2.1.4.new/raddb/ldap.attrmap
+--- freeradius-server-2.1.4/raddb/ldap.attrmap 2009-03-10 19:26:50.000000000 -0700
++++ freeradius-server-2.1.4.new/raddb/ldap.attrmap 2009-04-07 15:21:54.000000000 -0700
+@@ -13,8 +13,7 @@
+ # If not present, defaults to "==" for checkItems,
+ # and "=" for replyItems.
+ # If present, the operator here should be one
+-# of the same operators as defined in the "users"3
+-# file ("man users", or "man 5 users").
++# of the same operators as defined in the "users" file.
+ # If an operator is present in the value of the
+ # LDAP entry (i.e. ":=foo"), then it over-rides
+ # both the default, and any operator given here.
+diff -Naur freeradius-server-2.1.4/raddb/modules/counter freeradius-server-2.1.4.new/raddb/modules/counter
+--- freeradius-server-2.1.4/raddb/modules/counter 2009-03-10 19:26:50.000000000 -0700
++++ freeradius-server-2.1.4.new/raddb/modules/counter 2009-04-08 01:34:16.000000000 -0700
+@@ -69,7 +69,7 @@
+ # 'check-name' attribute.
+ #
+ counter daily {
+- filename = ${db_dir}/db.daily
++ filename = ${radacctdir}/db.daily
+ key = User-Name
+ count-attribute = Acct-Session-Time
+ reset = daily
+diff -Naur freeradius-server-2.1.4/raddb/modules/detail freeradius-server-2.1.4.new/raddb/modules/detail
+--- freeradius-server-2.1.4/raddb/modules/detail 2009-03-10 19:26:50.000000000 -0700
++++ freeradius-server-2.1.4.new/raddb/modules/detail 2009-04-07 15:28:33.000000000 -0700
+@@ -46,8 +46,7 @@
+
+ #
+ # Every entry in the detail file has a header which
+- # is a timestamp. By default, we use the ctime
+- # format (see "man ctime" for details).
++ # is a timestamp. By default, we use the ctime format.
+ #
+ # The header can be customized by editing this
+ # string. See "doc/variables.txt" for a description
+diff -Naur freeradius-server-2.1.4/raddb/modules/exec freeradius-server-2.1.4.new/raddb/modules/exec
+--- freeradius-server-2.1.4/raddb/modules/exec 2009-03-10 19:26:50.000000000 -0700
++++ freeradius-server-2.1.4.new/raddb/modules/exec 2009-04-07 15:29:45.000000000 -0700
+@@ -15,9 +15,8 @@
+ # of the program which is executed. Due to RADIUS protocol
+ # limitations, any output over 253 bytes will be ignored.
+ #
+-# The RADIUS attributes from the user request will be placed
+-# into environment variables of the executed program, as
+-# described in "man unlang" and in doc/variables.txt
++# The RADIUS attributes from the user request will be placed into environment
++# variables of the executed program, as described in doc/variables.txt
+ #
+ # See also "echo" for more sample configuration.
+ #
+diff -Naur freeradius-server-2.1.4/raddb/modules/pap freeradius-server-2.1.4.new/raddb/modules/pap
+--- freeradius-server-2.1.4/raddb/modules/pap 2009-03-10 19:26:50.000000000 -0700
++++ freeradius-server-2.1.4.new/raddb/modules/pap 2009-04-07 15:31:17.000000000 -0700
+@@ -4,8 +4,7 @@
+
+ # PAP module to authenticate users based on their stored password
+ #
+-# Supports multiple encryption/hash schemes. See "man rlm_pap"
+-# for details.
++# Supports multiple encryption/hash schemes.
+ #
+ # The "auto_header" configuration item can be set to "yes".
+ # In this case, the module will look inside of the User-Password
+@@ -14,5 +13,5 @@
+ # with the correct value. It will also automatically handle
+ # Base-64 encoded data, hex strings, and binary data.
+ pap {
+- auto_header = no
++ auto_header = yes
+ }
+diff -Naur freeradius-server-2.1.4/raddb/modules/radutmp freeradius-server-2.1.4.new/raddb/modules/radutmp
+--- freeradius-server-2.1.4/raddb/modules/radutmp 2009-03-10 19:26:50.000000000 -0700
++++ freeradius-server-2.1.4.new/raddb/modules/radutmp 2009-04-07 11:13:56.000000000 -0700
+@@ -12,7 +12,7 @@
+ # Where the file is stored. It's not a log file,
+ # so it doesn't need rotating.
+ #
+- filename = ${logdir}/radutmp
++ filename = ${radacctdir}/radutmp
+
+ # The field in the packet to key on for the
+ # 'user' name, If you have other fields which you want
+diff -Naur freeradius-server-2.1.4/raddb/modules/sradutmp freeradius-server-2.1.4.new/raddb/modules/sradutmp
+--- freeradius-server-2.1.4/raddb/modules/sradutmp 2009-03-10 19:26:50.000000000 -0700
++++ freeradius-server-2.1.4.new/raddb/modules/sradutmp 2009-04-07 11:14:07.000000000 -0700
+@@ -10,7 +10,7 @@
+ # then name "sradutmp" to identify it later in the "accounting"
+ # section.
+ radutmp sradutmp {
+- filename = ${logdir}/sradutmp
++ filename = ${radacctdir}/sradutmp
+ perm = 0644
+ callerid = "no"
+ }
+diff -Naur freeradius-server-2.1.4/raddb/preproxy_users freeradius-server-2.1.4.new/raddb/preproxy_users
+--- freeradius-server-2.1.4/raddb/preproxy_users 2009-03-10 19:26:50.000000000 -0700
++++ freeradius-server-2.1.4.new/raddb/preproxy_users 2009-04-07 15:23:02.000000000 -0700
+@@ -1,6 +1,5 @@
+ #
+ # Configuration file for the rlm_files module.
+-# Please see rlm_files(5) manpage for more information.
+ #
+ # $Id$
+ #
+diff -Naur freeradius-server-2.1.4/raddb/proxy.conf freeradius-server-2.1.4.new/raddb/proxy.conf
+--- freeradius-server-2.1.4/raddb/proxy.conf 2009-03-10 19:26:50.000000000 -0700
++++ freeradius-server-2.1.4.new/raddb/proxy.conf 2009-04-07 15:22:45.000000000 -0700
+@@ -525,9 +525,8 @@
+ # This section defines a new-style "realm". Note the in version 2.0,
+ # there are many fewer configuration items than in 1.x for a realm.
+ #
+-# Automatic proxying is done via the "realms" module (see "man
+-# rlm_realm"). To manually proxy the request put this entry in the
+-# "users" file:
++# Automatic proxying is done via the "realms" module.
++# To manually proxy the request put this entry in the "users" file:
+
+ #
+ #
+diff -Naur freeradius-server-2.1.4/raddb/radiusd.conf.in freeradius-server-2.1.4.new/raddb/radiusd.conf.in
+--- freeradius-server-2.1.4/raddb/radiusd.conf.in 2009-03-10 19:26:50.000000000 -0700
++++ freeradius-server-2.1.4.new/raddb/radiusd.conf.in 2009-04-07 15:34:38.000000000 -0700
+@@ -8,11 +8,6 @@
+
+ ######################################################################
+ #
+-# Read "man radiusd" before editing this file. See the section
+-# titled DEBUGGING. It outlines a method where you can quickly
+-# obtain the configuration you want, without running into
+-# trouble.
+-#
+ # Run the server in debugging mode, and READ the output.
+ #
+ # $ radiusd -X
+@@ -41,14 +36,8 @@
+ # file, it is exported through the API to modules that ask for
+ # it.
+ #
+-# See "man radiusd.conf" for documentation on the format of this
+-# file. Note that the individual configuration items are NOT
+-# documented in that "man" page. They are only documented here,
+-# in the comments.
+-#
+ # As of 2.0.0, FreeRADIUS supports a simple processing language
+ # in the "authorize", "authenticate", "accounting", etc. sections.
+-# See "man unlang" for details.
+ #
+
+ prefix = @prefix@
+@@ -66,7 +55,7 @@
+
+ # Location of config and logfiles.
+ confdir = ${raddbdir}
+-run_dir = ${localstatedir}/run/${name}
++run_dir = ${localstatedir}/run
+
+ # Should likely be ${localstatedir}/lib/radiusd
+ db_dir = ${raddbdir}
+@@ -112,7 +101,7 @@
+ #
+ # This file is written when ONLY running in daemon mode.
+ #
+-# e.g.: kill -HUP `cat /var/run/radiusd/radiusd.pid`
++# e.g.: kill -HUP `cat /var/run/radiusd.pid`
+ #
+ pidfile = ${run_dir}/${name}.pid
+
+@@ -283,7 +272,7 @@
+ # If your system does not support this feature, you will
+ # get an error if you try to use it.
+ #
+-# interface = eth0
++ interface = br-lan
+
+ # Per-socket lists of clients. This is a very useful feature.
+ #
+@@ -310,7 +299,7 @@
+ # ipv6addr = ::
+ port = 0
+ type = acct
+-# interface = eth0
++ interface = br-lan
+ # clients = per_socket_clients
+ }
+
+@@ -445,9 +434,6 @@
+ auth_goodpass = no
+ }
+
+-# The program to execute to do concurrency checks.
+-checkrad = ${sbindir}/checkrad
+-
+ # SECURITY CONFIGURATION
+ #
+ # There may be multiple methods of attacking on the server. This
+@@ -522,8 +508,8 @@
+ #
+ # allowed values: {no, yes}
+ #
+-proxy_requests = yes
+-$INCLUDE proxy.conf
++proxy_requests = no
++#$INCLUDE proxy.conf
+
+
+ # CLIENTS CONFIGURATION
+@@ -675,10 +661,6 @@
+ #
+ # $INCLUDE sql/mysql/counter.conf
+
+- #
+- # IP addresses managed in an SQL table.
+- #
+-# $INCLUDE sqlippool.conf
+ }
+
+ # Instantiation
+@@ -703,7 +685,7 @@
+ # The entire command line (and output) must fit into 253 bytes.
+ #
+ # e.g. Framed-Pool = `%{exec:/bin/echo foo}`
+- exec
++# exec
+
+ #
+ # The expression module doesn't do authorization,
+@@ -716,15 +698,15 @@
+ # listed in any other section. See 'doc/rlm_expr' for
+ # more information.
+ #
+- expr
++# expr
+
+ #
+ # We add the counter module here so that it registers
+ # the check-name attribute before any module which sets
+ # it
+ # daily
+- expiration
+- logintime
++# expiration
++# logintime
+
+ # subsections here can be thought of as "virtual" modules.
+ #
+@@ -748,7 +730,7 @@
+ # to multiple times.
+ #
+ ######################################################################
+-$INCLUDE policy.conf
++#$INCLUDE policy.conf
+
+ ######################################################################
+ #
+@@ -758,9 +740,9 @@
+ # match the regular expression: /[a-zA-Z0-9_.]+/
+ #
+ # It allows you to define new virtual servers simply by placing
+-# a file into the raddb/sites-enabled/ directory.
++# a file into the /etc/freeradius2/sites/ directory.
+ #
+-$INCLUDE sites-enabled/
++$INCLUDE sites/
+
+ ######################################################################
+ #
+@@ -768,15 +750,11 @@
+ # "authenticate {}", "accounting {}", have been moved to the
+ # the file:
+ #
+-# raddb/sites-available/default
++# /etc/freeradius2/sites/default
+ #
+ # This is the "default" virtual server that has the same
+ # configuration as in version 1.0.x and 1.1.x. The default
+ # installation enables this virtual server. You should
+ # edit it to create policies for your local site.
+ #
+-# For more documentation on virtual servers, see:
+-#
+-# raddb/sites-available/README
+-#
+ ######################################################################
+diff -Naur freeradius-server-2.1.4/raddb/sites-available/default freeradius-server-2.1.4.new/raddb/sites-available/default
+--- freeradius-server-2.1.4/raddb/sites-available/default 2009-03-10 19:26:50.000000000 -0700
++++ freeradius-server-2.1.4.new/raddb/sites-available/default 2009-04-07 15:27:12.000000000 -0700
+@@ -11,12 +11,6 @@
+ #
+ ######################################################################
+ #
+-# Read "man radiusd" before editing this file. See the section
+-# titled DEBUGGING. It outlines a method where you can quickly
+-# obtain the configuration you want, without running into
+-# trouble. See also "man unlang", which documents the format
+-# of this file.
+-#
+ # This configuration is designed to work in the widest possible
+ # set of circumstances, with the widest possible number of
+ # authentication methods. This means that in general, you should
+@@ -69,7 +63,7 @@
+ # 'raddb/huntgroups' files.
+ #
+ # It also adds the %{Client-IP-Address} attribute to the request.
+- preprocess
++# preprocess
+
+ #
+ # If you want to have a log of authentication requests,
+@@ -80,7 +74,7 @@
+ #
+ # The chap module will set 'Auth-Type := CHAP' if we are
+ # handling a CHAP request and Auth-Type has not already been set
+- chap
++# chap
+
+ #
+ # If the users are logging in with an MS-CHAP-Challenge
+@@ -88,13 +82,7 @@
+ # the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP'
+ # to the request, which will cause the server to then use
+ # the mschap module for authentication.
+- mschap
+-
+- #
+- # If you have a Cisco SIP server authenticating against
+- # FreeRADIUS, uncomment the following line, and the 'digest'
+- # line in the 'authenticate' section.
+-# digest
++# mschap
+
+ #
+ # Look for IPASS style 'realm/', and if not found, look for
+@@ -108,7 +96,7 @@
+ # Otherwise, when the first style of realm doesn't match,
+ # the other styles won't be checked.
+ #
+- suffix
++# suffix
+ # ntdomain
+
+ #
+@@ -133,14 +121,6 @@
+ }
+
+ #
+- # Pull crypt'd passwords from /etc/passwd or /etc/shadow,
+- # using the system API's to get the password. If you want
+- # to read /etc/passwd or /etc/shadow directly, see the
+- # passwd module in radiusd.conf.
+- #
+- unix
+-
+- #
+ # Read the 'users' file
+ files
+
+@@ -152,28 +132,11 @@
+ # sql
+
+ #
+- # If you are using /etc/smbpasswd, and are also doing
+- # mschap authentication, the un-comment this line, and
+- # configure the 'etc_smbpasswd' module, above.
+-# etc_smbpasswd
+-
+- #
+ # The ldap module will set Auth-Type to LDAP if it has not
+ # already been set
+ # ldap
+
+ #
+- # Enforce daily limits on time spent logged in.
+-# daily
+-
+- #
+- # Use the checkval module
+-# checkval
+-
+- expiration
+- logintime
+-
+- #
+ # If no other module has claimed responsibility for
+ # authentication, then try to use PAP. This allows the
+ # other modules listed above to add a "known good" password
+@@ -248,24 +211,6 @@
+ mschap
+ }
+
+- #
+- # If you have a Cisco SIP server authenticating against
+- # FreeRADIUS, uncomment the following line, and the 'digest'
+- # line in the 'authorize' section.
+-# digest
+-
+- #
+- # Pluggable Authentication Modules.
+-# pam
+-
+- #
+- # See 'man getpwent' for information on how the 'unix'
+- # module checks the users password. Note that packets
+- # containing CHAP-Password attributes CANNOT be authenticated
+- # against /etc/passwd! See the FAQ for details.
+- #
+- unix
+-
+ # Uncomment it if you want to use ldap for authentication
+ #
+ # Note that this means "check plain-text password against
+@@ -278,19 +223,15 @@
+ #
+ # Allow EAP authentication.
+ eap
++ pap
+ }
+
+
+ #
+ # Pre-accounting. Decide which accounting type to use.
+ #
+-preacct {
+- preprocess
+-
+- #
+- # Ensure that we have a semi-unique identifier for every
+- # request, and many NAS boxes are broken.
+- acct_unique
++#preacct {
++# preprocess
+
+ #
+ # Look for IPASS-style 'realm/', and if not found, look for
+@@ -300,13 +241,13 @@
+ # Accounting requests are generally proxied to the same
+ # home server as authentication requests.
+ # IPASS
+- suffix
++# suffix
+ # ntdomain
+
+ #
+ # Read the 'acct_users' file
+- files
+-}
++# files
++#}
+
+ #
+ # Accounting. Log the accounting data.
+@@ -316,14 +257,9 @@
+ # Create a 'detail'ed log of the packets.
+ # Note that accounting requests which are proxied
+ # are also logged in the detail file.
+- detail
++# detail
+ # daily
+
+- # Update the wtmp file
+- #
+- # If you don't use "radlast", you can delete this line.
+- unix
+-
+ #
+ # For Simultaneous-Use tracking.
+ #
+@@ -332,9 +268,6 @@
+ radutmp
+ # sradutmp
+
+- # Return an address to the IP Pool when we see a stop record.
+-# main_pool
+-
+ #
+ # Log traffic to an SQL database.
+ #
+@@ -351,7 +284,7 @@
+ # pgsql-voip
+
+ # Filter attributes from the accounting response.
+- attr_filter.accounting_response
++ #attr_filter.accounting_response
+
+ #
+ # See "Autz-Type Status-Server" for how this works.
+@@ -377,10 +310,7 @@
+ # Post-Authentication
+ # Once we KNOW that the user has been authenticated, there are
+ # additional steps we can take.
+-post-auth {
+- # Get an address from the IP Pool.
+-# main_pool
+-
++#post-auth {
+ #
+ # If you want to have a log of authentication replies,
+ # un-comment the following line, and the 'detail reply_log'
+@@ -406,7 +336,7 @@
+ #
+ # ldap
+
+- exec
++# exec
+
+ #
+ # Access-Reject packets are sent through the REJECT sub-section of the
+@@ -415,10 +345,10 @@
+ # Add the ldap module name (or instance) if you have set
+ # 'edir_account_policy_check = yes' in the ldap module configuration
+ #
+- Post-Auth-Type REJECT {
+- attr_filter.access_reject
+- }
+-}
++# Post-Auth-Type REJECT {
++# attr_filter.access_reject
++# }
++#}
+
+ #
+ # When the server decides to proxy a request to a home server,
+@@ -428,7 +358,7 @@
+ #
+ # Only a few modules currently have this method.
+ #
+-pre-proxy {
++#pre-proxy {
+ # attr_rewrite
+
+ # Uncomment the following line if you want to change attributes
+@@ -444,14 +374,14 @@
+ # server, un-comment the following line, and the
+ # 'detail pre_proxy_log' section, above.
+ # pre_proxy_log
+-}
++#}
+
+ #
+ # When the server receives a reply to a request it proxied
+ # to a home server, the request may be massaged here, in the
+ # post-proxy stage.
+ #
+-post-proxy {
++#post-proxy {
+
+ # If you want to have a log of replies from a home server,
+ # un-comment the following line, and the 'detail post_proxy_log'
+@@ -475,7 +405,7 @@
+ # hidden inside of the EAP packet, and the end server will
+ # reject the EAP request.
+ #
+- eap
++# eap
+
+ #
+ # If the server tries to proxy a request and fails, then the
+@@ -497,6 +427,5 @@
+ # Post-Proxy-Type Fail {
+ # detail
+ # }
+-
+-}
++#}
+
+diff -Naur freeradius-server-2.1.4/raddb/users freeradius-server-2.1.4.new/raddb/users
+--- freeradius-server-2.1.4/raddb/users 2009-03-10 19:26:50.000000000 -0700
++++ freeradius-server-2.1.4.new/raddb/users 2009-04-07 15:23:54.000000000 -0700
+@@ -1,6 +1,5 @@
+ #
+-# Please read the documentation file ../doc/processing_users_file,
+-# or 'man 5 users' (after installing the server) for more information.
++# Please read the documentation file ../doc/processing_users_file.
+ #
+ # This file contains authentication security and configuration
+ # information for each user. Accounting requests are NOT processed
+@@ -169,22 +168,22 @@
+ # by the terminal server in which case there may not be a "P" suffix.
+ # The terminal server sends "Framed-Protocol = PPP" for auto PPP.
+ #
+-DEFAULT Framed-Protocol == PPP
+- Framed-Protocol = PPP,
+- Framed-Compression = Van-Jacobson-TCP-IP
++#DEFAULT Framed-Protocol == PPP
++# Framed-Protocol = PPP,
++# Framed-Compression = Van-Jacobson-TCP-IP
+
+ #
+ # Default for CSLIP: dynamic IP address, SLIP mode, VJ-compression.
+ #
+-DEFAULT Hint == "CSLIP"
+- Framed-Protocol = SLIP,
+- Framed-Compression = Van-Jacobson-TCP-IP
++#DEFAULT Hint == "CSLIP"
++# Framed-Protocol = SLIP,
++# Framed-Compression = Van-Jacobson-TCP-IP
+
+ #
+ # Default for SLIP: dynamic IP address, SLIP mode.
+ #
+-DEFAULT Hint == "SLIP"
+- Framed-Protocol = SLIP
++#DEFAULT Hint == "SLIP"
++# Framed-Protocol = SLIP
+
+ #
+ # Last default: rlogin to our main server.
projects / openwrt / svn-archive / archive.git / commitdiff