Index: npl/commonservers/radius/post.radius
===================================================================
--- npl/commonservers/radius/post.radius	(revision 010568537c6a24bc6e83a1a5814a6f87df3223f6)
+++ 	(revision )
@@ -1,6 +1,0 @@
-chmod 700 /home/system/radius
-
-if ! ( getent group | grep "Windows VPN - pptp" &> /dev/null ) ; then
- smbldap-groupadd -g 520 "Windows VPN - pptp" || exit 1;
-fi
-exit 0
Index: npl/commonservers/radius/raddb/acct_users
===================================================================
--- npl/commonservers/radius/raddb/acct_users	(revision 010568537c6a24bc6e83a1a5814a6f87df3223f6)
+++ 	(revision )
@@ -1,16 +1,0 @@
-#
-#	$Id: acct_users,v 1.4 2003/08/13 16:54:40 aland Exp $
-#
-#	This is like the 'users' file, but it is processed only for
-#	accounting packets.
-#
-#DEFAULT Acct-Status-Type == Start
-#	Exec-Program = "/path/to/exec/acct/start"
-#
-#DEFAULT Acct-Status-Type == Stop
-#	Exec-Program = "/path/to/exec/acct/stop"
-#
-#  For information on how the attributes from the request are passed
-#  to the program, see 'doc/variables.txt'
-#
-#
Index: npl/commonservers/radius/raddb/attrs
===================================================================
--- npl/commonservers/radius/raddb/attrs	(revision 010568537c6a24bc6e83a1a5814a6f87df3223f6)
+++ 	(revision )
@@ -1,121 +1,0 @@
-#
-#	Configuration file for the rlm_attr_filter module.
-#	Please see rlm_attr_filter(5) manpage for more information.
-#
-#	$Id: attrs,v 1.4.8.1 2005/06/11 22:20:40 nbk Exp $
-#
-#	This file contains security and configuration information
-#	for each realm. The first field is the realm name and
-#	can be up to 253 characters in length. This is followed (on
-#	the next line) with the list of filter rules to be used to
-#	decide what attributes and/or values we allow proxy servers
-#	to pass to the NAS for this realm.
-#
-#	When a proxy-reply packet is received from a home server,
-#	these attributes and values are tested. Only the first match
-#	is used unless the "Fall-Through" variable is set to "Yes".
-#	In that case the rules defined in the DEFAULT case are
-#	processed as well.
-#
-#	A special realm named "DEFAULT" matches on all realm names.
-#	You can have only one DEFAULT entry. All entries are processed
-#	in the order they appear in this file. The first entry that
-#	matches the login-request will stop processing unless you use
-#	the Fall-Through variable.
-#
-#	Indented (with the tab character) lines following the first
-#	line indicate the filter rules.
-#
-#	You can include another `attrs' file with `$INCLUDE attrs.other'
-#
-
-#
-# This is a complete entry for realm "fisp". Note that there is no
-# Fall-Through entry so that no DEFAULT entry will be used, and the
-# server will NOT allow any other a/v pairs other than the ones
-# listed here.
-#
-# These rules allow:
-#     o  Only Framed-User Service-Types ( no telnet, rlogin, tcp-clear )
-#     o  PPP sessions ( no SLIP, CSLIP, etc. )
-#     o  dynamic ip assignment ( can't assign a static ip )
-#     o  an idle timeout value set to 600 seconds (10 min) or less
-#     o  a max session time set to 28800 seconds (8 hours) or less
-#
-#fisp
-#	Service-Type == Framed-User,
-#	Framed-Protocol == PPP,
-#	Framed-IP-Address == 255.255.255.254,
-#	Idle-Timeout <= 600,
-#	Session-Timeout <= 28800
-
-#
-# This is a complete entry for realm "tisp". Note that there is no
-# Fall-Through entry so that no DEFAULT entry will be used, and the
-# server will NOT allow any other a/v pairs other than the ones
-# listed here.
-#
-# These rules allow:
-#       o Only Login-User Service-Type ( no framed/ppp sessions )
-#       o Telnet sessions only ( no rlogin, tcp-clear )
-#       o Login hosts of either 192.168.1.1 or 192.168.1.2
-#
-#tisp
-#	Service-Type == Login-User,
-#	Login-Service == Telnet,
-#	Login-TCP-Port == 23,
-#	Login-IP-Host == 192.168.1.1,
-#	Login-IP-Host == 192.168.1.2
-
-#
-# The following example can be used for a home server which is only
-# allowed to supply a Reply-Message, a Session-Timeout attribute of
-# maximum 86400, a Idle-Timeout attribute of maximum 600 and a
-# Acct-Interim-Interval attribute between 300 and 3600.
-# All other attributes sent back will be filtered out.
-#
-#strictrealm
-#	Reply-Message =* ANY,
-#	Session-Timeout <= 86400,
-#	Idle-Timeout <= 600,
-#	Acct-Interim-Interval >= 300,
-#	Acct-Interim-Interval <= 3600
-
-#
-# This is a complete entry for realm "spamrealm". Fall-Through is used,
-# so that the DEFAULT filter rules are used in addition to these.
-#
-# These rules allow:
-#       o Force the application of Filter-ID attribute to be returned
-#         in the proxy reply, whether the proxy sent it or not.
-#       o The standard DEFAULT rules as defined below
-#
-#spamrealm
-#	Framed-Filter-Id := "nosmtp.in",
-#	Fall-Through = Yes
-
-#
-# The rest of this file contains the DEFAULT entry.
-# DEFAULT matches with all realm names. (except if the realm previously
-# matched an entry with no Fall-Through)
-#
-
-DEFAULT
-	Service-Type == Framed-User,
-	Service-Type == Login-User,
-	Login-Service == Telnet,
-	Login-Service == Rlogin,
-	Login-Service == TCP-Clear,
-	Login-TCP-Port <= 65536,
-	Framed-IP-Address == 255.255.255.254,
-	Framed-IP-Netmask == 255.255.255.255,
-	Framed-Protocol == PPP,
-	Framed-Protocol == SLIP,
-	Framed-Compression == Van-Jacobson-TCP-IP,
-	Framed-MTU >= 576,
-	Framed-Filter-ID =* ANY,
-	Reply-Message =* ANY,
-	Proxy-State =* ANY,
-	Session-Timeout <= 28800,
-	Idle-Timeout <= 600,
-	Port-Limit <= 2
Index: npl/commonservers/radius/raddb/clients
===================================================================
--- npl/commonservers/radius/raddb/clients	(revision 010568537c6a24bc6e83a1a5814a6f87df3223f6)
+++ 	(revision )
@@ -1,7 +1,0 @@
-#
-#	THIS FILE IS DEPRECATED.
-#
-#	You should NOT be using this file to configure the server.
-#	It is here ONLY for backwards compatibility.
-#
-#	See 'clients.conf' for the new configuration.
Index: npl/commonservers/radius/raddb/clients.conf
===================================================================
--- npl/commonservers/radius/raddb/clients.conf	(revision 010568537c6a24bc6e83a1a5814a6f87df3223f6)
+++ 	(revision )
@@ -1,111 +1,0 @@
-#
-# clients.conf - client configuration directives
-#
-#######################################################################
-
-#######################################################################
-#
-#  Definition of a RADIUS client (usually a NAS).
-#
-#  The information given here over rides anything given in the
-#  'clients' file, or in the 'naslist' file.  The configuration here
-#  contains all of the information from those two files, and allows
-#  for more configuration items.
-#
-#  The "shortname" is be used for logging.  The "nastype", "login" and
-#  "password" fields are mainly used for checkrad and are optional.
-#
-
-#
-#  Defines a RADIUS client.  The format is 'client [hostname|ip-address]'
-#
-#  '127.0.0.1' is another name for 'localhost'.  It is enabled by default,
-#  to allow testing of the server after an initial installation.  If you
-#  are not going to be permitting RADIUS queries from localhost, we suggest
-#  that you delete, or comment out, this entry.
-#
-client 127.0.0.1 {
-	#
-	#  The shared secret use to "encrypt" and "sign" packets between
-	#  the NAS and FreeRADIUS.  You MUST change this secret from the
-	#  default, otherwise it's not a secret any more!
-	#
-	#  The secret can be any string, up to 31 characters in length.
-	#
-	secret		= testing123
-
-	#
-	#  The short name is used as an alias for the fully qualified
-	#  domain name, or the IP address.
-	#
-	shortname	= localhost
-
-	#
-	# the following three fields are optional, but may be used by
-	# checkrad.pl for simultaneous use checks
-	#
-
-	#
-	# The nastype tells 'checkrad.pl' which NAS-specific method to
-	#  use to query the NAS for simultaneous use.
-	#
-	#  Permitted NAS types are:
-	#
-	#	cisco
-	#	computone
-	#	livingston
-	#	max40xx
-	#	multitech
-	#	netserver
-	#	pathras
-	#	patton
-	#	portslave
-	#	tc
-	#	usrhiper
-	#	other		# for all other types
-
-	#
-	nastype     = other	# localhost isn't usually a NAS...
-
-	#
-	#  The following two configurations are for future use.
-	#  The 'naspasswd' file is currently used to store the NAS
-	#  login name and password, which is used by checkrad.pl
-	#  when querying the NAS for simultaneous use.
-	#
-#	login       = !root
-#	password    = someadminpas
-}
-
-#client some.host.org {
-#	secret		= testing123
-#	shortname	= localhost
-#}
-
-#
-#  You can now specify one secret for a network of clients.
-#  When a client request comes in, the BEST match is chosen.
-#  i.e. The entry from the smallest possible network.
-#
-#client 192.168.0.0/24 {
-#	secret		= testing123-1
-#	shortname	= private-network-1
-#}
-#
-#client 192.168.0.0/16 {
-#	secret		= testing123-2
-#	shortname	= private-network-2
-#}
-
-
-#client 10.10.10.10 {
-#	# secret and password are mapped through the "secrets" file.
-#	secret      = testing123
-#	shortname   = liv1
-#       # the following three fields are optional, but may be used by
-#       # checkrad.pl for simultaneous usage checks
-#	nastype     = livingston
-#	login       = !root
-#	password    = someadminpas
-#}
-
Index: npl/commonservers/radius/raddb/dictionary
===================================================================
--- npl/commonservers/radius/raddb/dictionary	(revision 010568537c6a24bc6e83a1a5814a6f87df3223f6)
+++ 	(revision )
@@ -1,32 +1,0 @@
-#
-#	This is the master dictionary file, which references the
-#	pre-defined dictionary files included with the server.
-#
-#	Any new/changed attributes MUST be placed in this file, as
-#	the pre-defined dictionaries SHOULD NOT be edited.
-#
-#	$Id: dictionary.in,v 1.4 2004/04/14 15:26:20 aland Exp $
-#
-
-#
-#	The filename given here should be an absolute path. 
-#
-$INCLUDE	/usr/share/freeradius/dictionary
-
-#
-#	Place additional attributes or $INCLUDEs here.  They will
-#	over-ride the definitions in the pre-defined dictionaries.
-#
-#	See the 'man' page for 'dictionary' for information on
-#	the format of the dictionary files.
-
-#
-#	If you want to add entries to the dictionary file,
-#	which are NOT going to be placed in a RADIUS packet,
-#	add them here.  The numbers you pick should be between
-#	3000 and 4000.
-#
-
-#ATTRIBUTE	My-Local-String		3000	string
-#ATTRIBUTE	My-Local-IPAddr		3001	ipaddr
-#ATTRIBUTE	My-Local-Integer	3002	integer
Index: npl/commonservers/radius/raddb/hints
===================================================================
--- npl/commonservers/radius/raddb/hints	(revision 010568537c6a24bc6e83a1a5814a6f87df3223f6)
+++ 	(revision )
@@ -1,77 +1,0 @@
-# hints
-#
-#	The hints file.   This file is used to match
-#	a request, and then add attributes to it.  This
-#	process allows a user to login as "bob.ppp" (for example),
-#	and receive a PPP connection, even if the NAS doesn't
-#	ask for PPP.  The "hints" file is used to match the
-#	".ppp" portion of the username, and to add a set of
-#	"user requested PPP" attributes to the request.
-#
-#	Matching can take place with the the Prefix and Suffix
-#	attributes, just like in the "users" file.
-#	These attributes operate ONLY on the username, though.
-#
-#	Note that the attributes that are set for each
-#	entry are _NOT_ passed back to the terminal server.
-#	Instead they are added to the information that has
-#	been _SENT_ by the terminal server.
-#
-#	This extra information can be used in the users file to
-#	match on. Usually this is done in the DEFAULT entries,
-#	of which there can be more than one.
-#
-#	In addition a matching entry can transform a username
-#	for authentication purposes if the "Strip-User-Name"
-#	variable is set to Yes in an entry (default is Yes).
-#
-#	A special non-protocol name-value pair called "Hint"
-#	can be set to match on in the "users" file.
-#
-#	The following is how most ISPs want to set this up.
-#
-# Version:	$Id: hints,v 1.4 2004/01/29 16:42:43 aland Exp $
-#
-
-
-DEFAULT	Suffix == ".ppp", Strip-User-Name = Yes
-	Hint = "PPP",
-	Service-Type = Framed-User,
-	Framed-Protocol = PPP
-
-DEFAULT	Suffix == ".slip", Strip-User-Name = Yes
-	Hint = "SLIP",
-	Service-Type = Framed-User,
-	Framed-Protocol = SLIP
-
-DEFAULT	Suffix == ".cslip", Strip-User-Name = Yes
-	Hint = "CSLIP",
-	Service-Type = Framed-User,
-	Framed-Protocol = SLIP,
-	Framed-Compression = Van-Jacobson-TCP-IP
-
-######################################################################
-#
-#	These entries are old, and commented out by default.
-#	They confuse too many people when "Peter" logs in, and the
-#	server thinks that the user "eter" is asking for PPP.
-#
-#DEFAULT	Prefix == "U", Strip-User-Name = No
-#	Hint = "UUCP"
-
-#DEFAULT	Prefix == "P", Strip-User-Name = Yes
-#	Hint = "PPP",
-#	Service-Type = Framed-User,
-#	Framed-Protocol = PPP
-
-#DEFAULT	Prefix == "S", Strip-User-Name = Yes
-#	Hint = "SLIP",
-#	Service-Type = Framed-User,
-#	Framed-Protocol = SLIP
-
-#DEFAULT	Prefix == "C", Strip-User-Name = Yes
-#	Hint = "CSLIP",
-#	Service-Type = Framed-User,
-#	Framed-Protocol = SLIP,
-#	Framed-Compression = Van-Jacobson-TCP-IP
-
Index: npl/commonservers/radius/raddb/huntgroups
===================================================================
--- npl/commonservers/radius/raddb/huntgroups	(revision 010568537c6a24bc6e83a1a5814a6f87df3223f6)
+++ 	(revision )
@@ -1,46 +1,0 @@
-#
-# huntgroups	This file defines the `huntgroups' that you have. A
-#		huntgroup is defined by specifying the IP address of
-#		the NAS and possibly a port range. Port can be identified
-#		as just one port, or a range (from-to), and multiple ports
-#		or ranges of ports must be seperated by a comma. For
-#		example: 1,2,3-8
-#
-#		Matching is done while RADIUS scans the user file; if it
-#		includes the selection criterium "Huntgroup-Name == XXX"
-#		the huntgroup is looked up in this file to see if it
-#		matches. There can be multiple definitions of the same
-#		huntgroup; the first one that matches will be used.
-#
-#		This file can also be used to define restricted access
-#		to certain huntgroups. The second and following lines
-#		define the access restrictions (based on username and
-#		UNIX usergroup) for the huntgroup.
-#
-
-#
-# Our POP in Alphen a/d Rijn has 3 terminal servers. Create a Huntgroup-Name
-# called Alphen that matches on all three terminal servers.
-#
-#alphen		NAS-IP-Address == 192.168.2.5
-#alphen		NAS-IP-Address == 192.168.2.6
-#alphen		NAS-IP-Address == 192.168.2.7
-
-#
-# The POP in Delft consists of only one terminal server.
-#
-#delft		NAS-IP-Address == 192.168.3.5
-
-#
-# Ports 0-7 on the first terminal server in Alphen are connected to
-# a huntgroup that is for business users only. Note that only one
-# of the username or groupname has to match to get access (OR/OR).
-#
-# Note that this huntgroup is a subset of the "alphen" huntgroup.
-#
-#business	NAS-IP-Address == 192.168.2.5, NAS-Port-Id == 0-7
-#		User-Name = rogerl,
-#		User-Name = henks,
-#		Group = business,
-#		Group = staff
-
Index: npl/commonservers/radius/raddb/ldap.attrmap
===================================================================
--- npl/commonservers/radius/raddb/ldap.attrmap	(revision 010568537c6a24bc6e83a1a5814a6f87df3223f6)
+++ 	(revision )
@@ -1,61 +1,0 @@
-#
-# Mapping of RADIUS dictionary attributes to LDAP directory attributes
-# to be used by LDAP authentication and authorization module (rlm_ldap)
-#
-# Format:
-#   ItemType	RADIUS-Attribute-Name		ldapAttributeName
-#
-# Where:
-#   ItemType              = checkItem or replyItem 
-#   RADIUS-Attribute-Name = attribute name in RADIUS dictionary
-#   ldapAttributeName     = attribute name in LDAP schema
-#
-# If $GENERIC$ is specified as RADIUS-Attribute-Name, the line specifies
-# a LDAP attribute which can be used to store any RADIUS 
-# attribute/value-pair in LDAP directory.
-#
-# You should edit this file to suit it to your needs.
-#
-
-checkItem	$GENERIC$			radiusCheckItem
-replyItem	$GENERIC$			radiusReplyItem
-
-checkItem	Auth-Type			radiusAuthType
-checkItem	Simultaneous-Use		radiusSimultaneousUse
-checkItem	Called-Station-Id		radiusCalledStationId
-checkItem	Calling-Station-Id		radiusCallingStationId
-checkItem	LM-Password			sambaLMPassword
-checkItem	NT-Password			sambaNTPassword
-checkItem	SMB-Account-CTRL-TEXT		acctFlags
-checkItem	Expiration			radiusExpiration
-checkItem	NAS-IP-Address			radiusNASIpAddress
-checkItem	User-Password			userPassword
-
-replyItem	Service-Type			radiusServiceType
-replyItem	Framed-Protocol			radiusFramedProtocol
-replyItem	Framed-IP-Address		radiusFramedIPAddress
-replyItem	Framed-IP-Netmask		radiusFramedIPNetmask
-replyItem	Framed-Route			radiusFramedRoute
-replyItem	Framed-Routing			radiusFramedRouting
-replyItem	Filter-Id			radiusFilterId
-replyItem	Framed-MTU			radiusFramedMTU
-replyItem	Framed-Compression		radiusFramedCompression
-replyItem	Login-IP-Host			radiusLoginIPHost
-replyItem	Login-Service			radiusLoginService
-replyItem	Login-TCP-Port			radiusLoginTCPPort
-replyItem	Callback-Number			radiusCallbackNumber
-replyItem	Callback-Id			radiusCallbackId
-replyItem	Framed-IPX-Network		radiusFramedIPXNetwork
-replyItem	Class				radiusClass
-replyItem	Session-Timeout			radiusSessionTimeout
-replyItem	Idle-Timeout			radiusIdleTimeout
-replyItem	Termination-Action		radiusTerminationAction
-replyItem	Login-LAT-Service		radiusLoginLATService
-replyItem	Login-LAT-Node			radiusLoginLATNode
-replyItem	Login-LAT-Group			radiusLoginLATGroup
-replyItem	Framed-AppleTalk-Link		radiusFramedAppleTalkLink
-replyItem	Framed-AppleTalk-Network	radiusFramedAppleTalkNetwork
-replyItem	Framed-AppleTalk-Zone		radiusFramedAppleTalkZone
-replyItem	Port-Limit			radiusPortLimit
-replyItem	Login-LAT-Port			radiusLoginLATPort
-replyItem	Reply-Message			radiusReplyMessage
Index: npl/commonservers/radius/raddb/mssql.conf
===================================================================
--- npl/commonservers/radius/raddb/mssql.conf	(revision 010568537c6a24bc6e83a1a5814a6f87df3223f6)
+++ 	(revision )
@@ -1,131 +1,0 @@
-#
-#  Configuration for the SQL module, when using MSSQL.
-#
-#  The database schema is available at:
-#
-#	doc/examples/mssql.sql
-#
-#  $Id: mssql.conf,v 1.6.4.1 2006/02/04 14:53:44 nbk Exp $
-#
-sql {
-
-	# Database type
-	# Current supported are: rlm_sql_mysql, rlm_sql_postgresql,
-	# rlm_sql_iodbc, rlm_sql_oracle, rlm_sql_unixodbc
-	driver = "rlm_sql_unixodbc"
-
-	# Connect info
-	server = "localhost"
-	login = "root"
-	password = "rootpass"
-
-	# Database table configuration
-	radius_db = "radius"
-
-	# If you want both stop and start records logged to the
-	# same SQL table, leave this as is.  If you want them in
-	# different tables, put the start table in acct_table1
-	# and stop table in acct_table2
-	acct_table1 = "radacct"
-	acct_table2 = "radacct"
-
-	authcheck_table = "radcheck"
-	authreply_table = "radreply"
-
-	groupcheck_table = "radgroupcheck"
-	groupreply_table = "radgroupreply"
-
-	usergroup_table = "usergroup"
-
-	# Remove stale session if checkrad does not see a double login
-	deletestalesessions = yes
-
-	# Print all SQL statements when in debug mode (-x)
-	sqltrace = no
-	sqltracefile = ${logdir}/sqltrace.sql
-
-	# number of sql connections to make to server
-	num_sql_socks = 5
-
-	# Safe characters list for sql queries. Everything else is replaced
-	# with their mime-encoded equivalents.
-	# The default list should be ok
-	#safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"
-
-	#######################################################################
-	#  Query config:  Username
-	#######################################################################
-	# This is the username that will get substituted, escaped, and added
-	# as attribute 'SQL-User-Name'.  '%{SQL-User-Name}' should be used
-	# below everywhere a username substitution is needed so you you can
-	# be sure the username passed from the client is escaped properly.
-	#
-	# Uncomment the next line, if you want the sql_user_name to mean:
-	#
-	#    Use Stripped-User-Name, if it's there.
-	#    Else use User-Name, if it's there,
-	#    Else use hard-coded string "none" as the user name.
-	#sql_user_name = "%{Stripped-User-Name:-%{User-Name:-none}}"
-	#
-	sql_user_name = "%{User-Name}"
-
-
-	#######################################################################
-	#  Authorization Queries
-	#######################################################################
-	#  These queries compare the check items for the user
-	#  in ${authcheck_table} and setup the reply items in
-	#  ${authreply_table}.  You can use any query/tables
-	#  you want, but the return data for each row MUST
-	#  be in the  following order:
-	#
-	#  0. Row ID (currently unused)
-	#  1. UserName/GroupName
-	#  2. Item Attr Name
-	#  3. Item Attr Value
-	#  4. Item Attr Operation
-	#######################################################################
-	# Query for case sensitive usernames was removed. Please contact with me,
-	# if you know analog of STRCMP functions for MS SQL.
-
-	authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM ${authcheck_table} WHERE Username = '%{SQL-User-Name}' ORDER BY id"
-	authorize_reply_query = "SELECT id,UserName,Attribute,Value,op FROM ${authreply_table} WHERE Username = '%{SQL-User-Name}' ORDER BY id"
-
-	authorize_group_check_query = "SELECT ${groupcheck_table}.id,${groupcheck_table}.GroupName,${groupcheck_table}.Attribute,${groupcheck_table}.Value,${groupcheck_table}.op  FROM ${groupcheck_table},${usergroup_table} WHERE ${usergroup_table}.Username = '%{SQL-User-Name}' AND ${usergroup_table}.GroupName = ${groupcheck_table}.GroupName ORDER BY ${groupcheck_table}.id"
-	authorize_group_reply_query = "SELECT ${groupreply_table}.id,${groupreply_table}.GroupName,${groupreply_table}.Attribute,${groupreply_table}.Value,${groupreply_table}.op  FROM ${groupreply_table},${usergroup_table} WHERE ${usergroup_table}.Username = '%{SQL-User-Name}' AND ${usergroup_table}.GroupName = ${groupreply_table}.GroupName ORDER BY ${groupreply_table}.id"
-
-
-	#######################################################################
-	#  Accounting Queries
-	#######################################################################
-	# accounting_onoff_query	- query for Accounting On/Off packets
-	# accounting_update_query	- query for Accounting update packets
-	# accounting_update_query_alt	- query for Accounting update packets
-	#                               (alternate in case first query fails)
-	# accounting_start_query	- query for Accounting start packets
-	# accounting_start_query_alt	- query for Accounting start packets
-	#                               (alternate in case first query fails)
-	# accounting_stop_query		- query for Accounting stop packets
-	# accounting_stop_query_alt	- query for Accounting start packets
-	#                               (alternate in case first query doesn't
-	#                                affect any existing rows in the table)
-	#######################################################################
-	accounting_onoff_query = "UPDATE ${acct_table1} SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = %{Acct-Delay-Time} WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'"
-
-	accounting_update_query = "UPDATE ${acct_table1} SET FramedIPAddress = '%{Framed-IP-Address}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStopTime = 0"
-
-	accounting_update_query_alt = "INSERT into ${acct_table1} (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPort, NASPortType, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port-Id}', '%{NAS-Port-Type}', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')"
-
-	# accounting_start_query: Inserting of RadAcctId and AcctStopTime was
-	# removed. These fields are processing by a database
-	accounting_start_query = "INSERT into ${acct_table1} (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPort, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port-Id}', '%{NAS-Port-Type}', '%S', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')"
-
-	accounting_start_query_alt  = "UPDATE ${acct_table1} SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime = 0"
-
-	accounting_stop_query = "UPDATE ${acct_table2} SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime = 0"
-
-	# accounting_stop_query_alt: Inserting of RadAcctId and AcctStartTime was
-	# removed. These fields are processing by a database
-	accounting_stop_query_alt = "INSERT into ${acct_table2} (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPort, NASPortType, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port-Id}', '%{NAS-Port-Type}', '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')"
-
-}
Index: npl/commonservers/radius/raddb/preproxy_users
===================================================================
--- npl/commonservers/radius/raddb/preproxy_users	(revision 010568537c6a24bc6e83a1a5814a6f87df3223f6)
+++ 	(revision )
@@ -1,31 +1,0 @@
-#
-#  Configuration file for the rlm_files module.
-#  Please see rlm_files(5) manpage for more information.
-#
-#  $Id: preproxy_users,v 1.1.6.2 2005/06/11 22:20:40 nbk Exp $
-#
-#  This file is similar to the "users" file.  The check items
-#  are compared against the request, but the "reply" items are
-#  used to update the proxied packet, not the reply to the NAS.
-#
-#  You can use this file to re-write requests which are about to
-#  be sent to a home server.
-#
-
-#
-#  Requests destinated to realm "extisp" are sent to a RADIUS
-#  home server hosted by an other company which doesn't know about
-#  the IP addresses of our NASes. Therefore we replace the value of
-#  the NAS-IP-Address attribute by a unique value we communicated
-#  to them.
-#
-#DEFAULT Realm == "extisp"
-#	NAS-IP-Address := 10.1.2.3
-
-#
-#  For all proxied packets, set the User-Name in the proxied packet
-#  to the Stripped-User-Name, if it exists.  If not, set it to the
-#  User-Name from the original request.
-#
-#DEFAULT
-#	User-Name := `%{Stripped-User-Name:-%{User-Name}}`
Index: npl/commonservers/radius/raddb/proxy.conf
===================================================================
--- npl/commonservers/radius/raddb/proxy.conf	(revision 010568537c6a24bc6e83a1a5814a6f87df3223f6)
+++ 	(revision )
@@ -1,288 +1,0 @@
-#
-# proxy.conf - proxy radius and realm configuration directives
-#
-# This file is included by default.  To disable it, you will need
-# to modify the PROXY CONFIGURATION section of "radiusd.conf".
-#
-#######################################################################
-#
-#  Proxy server configuration
-#
-#  This entry controls the servers behaviour towards ALL other servers
-#  to which it sends proxy requests.
-#
-proxy server {
-
-#
-#  If the NAS re-sends the request to us, we can immediately re-send
-#  the proxy request to the end server.  To do so, use 'yes' here.
-#
-#  If this is set to 'no', then we send the retries on our own schedule,
-#  and ignore any duplicate NAS requests.
-#
-#  If you want to have the server send proxy retries ONLY when the NAS
-#  sends it's retries to the server, then set this to 'yes', and
-#  set the other proxy configuration parameters to 0 (zero).
-#
-#  Additionally, if you want 'failover' to work, the server must manage
-#  retries and timeouts.  Therefore, if this is set to yes, then no
-#  failover functionality is possible.
-#
-	synchronous = no
-
-#
-#  The time (in seconds) to wait for a response from the proxy, before
-#  re-sending the proxied request.
-#
-#  If this time is set too high, then the NAS may re-send the request,
-#  or it may give up entirely, and reject the user.
-#
-#  If it is set too low, then the RADIUS server which receives the proxy
-#  request will get kicked unnecessarily.
-#
-	retry_delay = 5
-
-#
-#  The number of retries to send before giving up, and sending a reject
-#  message to the NAS.
-#
-	retry_count = 3
-
-#
-#  If the home server does not respond to any of the multiple retries,
-#  then FreeRADIUS will stop sending it proxy requests, and mark it 'dead'.
-#
-#  If there are multiple entries configured for this realm, then the
-#  server will fail-over to the next one listed.  If no more are listed,
-#  then no requests will be proxied to that realm.
-#
-#
-#  After a configurable 'dead_time', in seconds, FreeRADIUS will
-#  speculatively mark the home server active, and start sending requests
-#  to it again.
-#
-#  If this dead time is set too low, then you will lose requests,
-#  as FreeRADIUS will quickly switch back to the home server, even if
-#  it isn't up again.
-#
-#  If this dead time is set too high, then FreeRADIUS may take too long
-#  to switch back to the primary home server.
-#
-#  Realistic values for this number are in the range of minutes to hours.
-#  (60 to 3600)
-#
-	dead_time = 120
-
-#  An ldflag attribute for all realms to be included in a round-robin 
-#  setup must be specified, and that ldflag must be the same for all
-#  realms of the same name.
-#  Currently (0 or fail_over) and (1 or round_robin) are the 
-#  supported values for ldflag.  Fail over is the default setup.
-#
-#  DO NOT INCLUDE LOCAL AUTH/ACCT HOST REALMS IN A ROUND-ROBIN QUEUE.
-
-
-#
-#  If all exact matching realms did not respond, we can try the
-#  DEFAULT realm, too.  This is what the server normally does.
-#
-#  This behaviour may be undesired for some cases.  e.g. You are proxying
-#  for two different ISP's, and then act as a general dial-up for Gric.
-#  If one of the first two ISP's has their RADIUS server go down, you do
-#  NOT want to proxy those requests to GRIC.  Instead, you probably want
-#  to just drop the requests on the floor.  In that case, set this value
-#  to 'no'.
-#
-#  allowed values: {yes, no}
-#
-	default_fallback = yes
-
-#
-#  Older versions of the server would pass proxy requests through the
-#  'authorize' sections twice; once when the packet was received
-#  from the NAS, and again after the reply was received from the home
-#  server.  Now that we have a 'post_proxy' section, the replies from
-#  the home server should be sent through that, instead of through
-#  the 'authorize' section again.
-#
-#  However, for backwards compatibility, this behaviour is configurable.
-#  The default configuration is 'no', because this option is deprecated
-#  and will be removed in the future.
-#
-#  allowed values: {yes, no}
-#
-	post_proxy_authorize = no
-
-}
-
-#######################################################################
-#
-#  Configuration for the proxy realms.
-#
-#  The information given here is used in conjunction with the 'realms'
-#  file.  This format is preferred, as it is more flexible.  The realms
-#  listed here take priority over those listed in the 'realms' file.
-
-#  A standard realm entry. A request from "user@company.com" will be
-#  sent to radius.company.com as "user", unless the 'nostrip'
-#  configuration item is specified.  If the 'nostrip' configuration
-#  item is specified, then the request will be proxied as
-#  "user@company.com"
-#
-#realm company.com {
-#	type		= radius
-#	authhost	= radius.company.com:1600
-#	accthost	= radius.company.com:1601
-#	secret		= testing123
-#}
-
-#  A realm entry with an optional fail-over realm.  A request from
-#  "user@isp2.com" will be sent to radius.isp2.com as "user@isp2.com",
-#  because the 'nostrip' directive is specified for this realm.
-#
-#realm isp2.com {
-#	type        = radius
-#	authhost    = radius.isp2.com:1645
-#	accthost    = radius.isp2.com:1646
-#	secret      = TheirKey
-#	nostrip
-#}
-#
-#  The fail-over realm for isp2.com
-#
-#realm isp2.com {
-#	type        = radius
-#	authhost    = radius2.isp2.com:1645
-#	accthost    = radius2.isp2.com:1646
-#	secret      = TheirKey2
-#	nostrip
-#}
-
-#
-#  1st node serv.com...set up for round-robin.
-#
-#  The load balancing 'ldflag' attribute can be used to perform
-#  load balancing.  Allowed values are 'fail_over' and 'round_robin'.
-#
-#  If there is no ldflag attribute, or it is set to 'fail_over', then
-#  the realms are treated as "fail-over".  That is, the first matching
-#  realm is used, unless it is down, in which case the realm "fails
-#  over" to the second matching realm.  The process continues until an
-#  active matching realm is found, OR the DEFAULT realm is returned.
-#
-#  If the ldflag attribute is set to 'round_robin', then all active
-#  realms of the same name are put into a pool internally in the
-#  server, and the proxied requests are evenly divided among the
-#  realms in the pool.  For this to work, all realms of the same name
-#  MUST have the same value of their 'ldflag' attributes.  Mixing up
-#  different types of load balancing schemes for the same realm will
-#  cause problems.
-#
-#  The round_robin load balancing method is a probabilistic method
-#  which evenly scatters the requests among the home servers.
-#
-#  Note that you CANNOT include local auth/acct host realms in a
-#  round-robin queue.  Having a server load balance requests to itself
-#  doesn't make any sense, as it only doubles the amount of work
-#  which is needed to be done.
-#
-#realm serv.com {
-#	type        = radius
-#	authhost    = radius.serv.com:1645
-#	accthost    = radius.serv.com:1646
-#	secret      = TheirKey
-#	ldflag      = round_robin
-#	nostrip
-#}
-
-#
-#  Another node for serv.com
-#
-#realm serv.com {
-#	type        = radius
-#	authhost    = radius2.serv.com:1645
-#	accthost    = radius2.serv.com:1646
-#	secret      = TheirKey2
-#	ldflag	    = round_robin
-#	nostrip
-#}
-
-#
-#  A third round-robin node realm for serv.com
-#
-#realm serv.com {
-#	type        = radius
-#	authhost    = radius3.serv.com:1645
-#	accthost    = radius3.serv.com:1646
-#	secret      = TheirKey2
-#	ldflag      = round_robin
-#	nostrip
-#}
-#
-#
-
-#
-#  This is a local realm.  The requests are NOT proxied,
-#  but instead are authenticated by the RADIUS server itself.
-#
-#  You don't need a secret if BOTH 'authhost' and 'accthost' are
-#  set to LOCAL.
-#
-#realm bla.com {
-#	type		= radius
-#	authhost	= LOCAL
-#	accthost	= LOCAL
-#}
-
-#
-#  This is a sample entry for iPass.
-#
-#realm IPASS {
-#	type		= radius
-#	authhost	= ipass.server.hostname:11812
-#	accthost	= ipass.server.hostname:11813
-#
-	#  The shared secret here must be the same
-	#  value as the secret of the NetServer found in the
-	#  /usr/ipass/raddb/clients file of your NetServer software.
-#	secret		= mysecret
-#	nostrip
-#}
-
-#
-#  This realm is used mainly to cancel proxying.  You can have
-#  the "realm suffix" module configured to proxy all requests for
-#  a realm, and then later cancel the proxying, based on other
-#  configuration.
-#
-#  For example, you want to terminate PEAP or EAP-TTLS locally,
-#  you can add the following to the "users" file:
-#
-#  DEFAULT EAP-Type == PEAP, Proxy-To-Realm := LOCAL
-#
-realm LOCAL {
-	type		= radius
-	authhost	= LOCAL
-	accthost	= LOCAL
-}
-
-#
-#  This realm is for requests which don't have an explicit realm
-#  prefix or suffix.  User names like "bob" will match this one.
-#
-#realm NULL {
-#	type		= radius
-#	authhost	= radius.company.com:1600
-#	accthost	= radius.company.com:1601
-#	secret		= testing123
-#}
-
-#
-#  This realm is for ALL OTHER requests.
-#
-#realm DEFAULT {
-#	type		= radius
-#	authhost	= radius.company.com:1600
-#	accthost	= radius.company.com:1601
-#	secret		= testing123
-#}
Index: npl/commonservers/radius/raddb/radiusd.conf
===================================================================
--- npl/commonservers/radius/raddb/radiusd.conf	(revision 010568537c6a24bc6e83a1a5814a6f87df3223f6)
+++ 	(revision )
@@ -1,2110 +1,0 @@
-##
-## radiusd.conf	-- FreeRADIUS server configuration file.
-##
-##	http://www.freeradius.org/
-##	$Id: radiusd.conf.in,v 1.188.2.4.2.12 2006/07/29 19:43:30 nbk Exp $
-##
-
-#  	The location of other config files and
-#  	logfiles are declared in this file
-#
-#  	Also general configuration for modules can be done
-#  	in this file, it is exported through the API to
-#  	modules that ask for it.
-#
-#	The configuration variables defined here are of the form ${foo}
-#	They are local to this file, and do not change from request to
-#	request.
-#
-#	The per-request variables are of the form %{Attribute-Name}, and
-#	are taken from the values of the attribute in the incoming
-#	request.  See 'doc/variables.txt' for more information.
-
-prefix = /usr
-exec_prefix = ${prefix}
-sysconfdir = /home/system/radius
-localstatedir = /var
-sbindir = /usr/sbin
-logdir = ${localstatedir}/log/radius
-raddbdir = ${sysconfdir}/raddb
-radacctdir = ${logdir}/radacct
-
-#  Location of config and logfiles.
-confdir = ${raddbdir}
-run_dir = ${localstatedir}/run/radiusd
-#
-#  The logging messages for the server are appended to the
-#  tail of this file.
-#
-log_file = ${logdir}/radius.log
-
-#
-# libdir: Where to find the rlm_* modules.
-#
-#   This should be automatically set at configuration time.
-#
-#   If the server builds and installs, but fails at execution time
-#   with an 'undefined symbol' error, then you can use the libdir
-#   directive to work around the problem.
-#
-#   The cause is usually that a library has been installed on your
-#   system in a place where the dynamic linker CANNOT find it.  When
-#   executing as root (or another user), your personal environment MAY
-#   be set up to allow the dynamic linker to find the library.  When
-#   executing as a daemon, FreeRADIUS MAY NOT have the same
-#   personalized configuration.
-#
-#   To work around the problem, find out which library contains that symbol,
-#   and add the directory containing that library to the end of 'libdir',
-#   with a colon separating the directory names.  NO spaces are allowed.
-#
-#   e.g. libdir = /usr/local/lib:/opt/package/lib
-#
-#   You can also try setting the LD_LIBRARY_PATH environment variable
-#   in a script which starts the server.
-#
-#   If that does not work, then you can re-configure and re-build the
-#   server to NOT use shared libraries, via:
-#
-#	./configure --disable-shared
-#	make
-#	make install
-#
-libdir = /usr/lib
-
-#  pidfile: Where to place the PID of the RADIUS server.
-#
-#  The server may be signalled while it's running by using this
-#  file.
-#
-#  This file is written when ONLY running in daemon mode.
-#
-#  e.g.:  kill -HUP `cat /var/run/radiusd/radiusd.pid`
-#
-pidfile = ${run_dir}/radiusd.pid
-
-
-# user/group: The name (or #number) of the user/group to run radiusd as.
-#
-#   If these are commented out, the server will run as the user/group
-#   that started it.  In order to change to a different user/group, you
-#   MUST be root ( or have root privleges ) to start the server.
-#
-#   We STRONGLY recommend that you run the server with as few permissions
-#   as possible.  That is, if you're not using shadow passwords, the
-#   user and group items below should be set to 'nobody'.
-#
-#    On SCO (ODT 3) use "user = nouser" and "group = nogroup".
-#
-#  NOTE that some kernels refuse to setgid(group) when the value of
-#  (unsigned)group is above 60000; don't use group nobody on these systems!
-#
-#  On systems with shadow passwords, you might have to set 'group = shadow'
-#  for the server to be able to read the shadow password file.  If you can
-#  authenticate users while in debug mode, but not in daemon mode, it may be
-#  that the debugging mode server is running as a user that can read the
-#  shadow info, and the user listed below can not.
-#
-#user = nobody
-#group = nobody
-
-#  max_request_time: The maximum time (in seconds) to handle a request.
-#
-#  Requests which take more time than this to process may be killed, and
-#  a REJECT message is returned.
-#
-#  WARNING: If you notice that requests take a long time to be handled,
-#  then this MAY INDICATE a bug in the server, in one of the modules
-#  used to handle a request, OR in your local configuration.
-#
-#  This problem is most often seen when using an SQL database.  If it takes
-#  more than a second or two to receive an answer from the SQL database,
-#  then it probably means that you haven't indexed the database.  See your
-#  SQL server documentation for more information.
-#
-#  Useful range of values: 5 to 120
-#
-max_request_time = 30
-
-#  delete_blocked_requests: If the request takes MORE THAN 'max_request_time'
-#  to be handled, then maybe the server should delete it.
-#
-#  If you're running in threaded, or thread pool mode, this setting
-#  should probably be 'no'.  Setting it to 'yes' when using a threaded
-#  server MAY cause the server to crash!
-#
-delete_blocked_requests = no
-
-#  cleanup_delay: The time to wait (in seconds) before cleaning up
-#  a reply which was sent to the NAS.
-#
-#  The RADIUS request is normally cached internally for a short period
-#  of time, after the reply is sent to the NAS.  The reply packet may be
-#  lost in the network, and the NAS will not see it.  The NAS will then
-#  re-send the request, and the server will respond quickly with the
-#  cached reply.
-#
-#  If this value is set too low, then duplicate requests from the NAS
-#  MAY NOT be detected, and will instead be handled as seperate requests.
-#
-#  If this value is set too high, then the server will cache too many
-#  requests, and some new requests may get blocked.  (See 'max_requests'.)
-#
-#  Useful range of values: 2 to 10
-#
-cleanup_delay = 5
-
-#  max_requests: The maximum number of requests which the server keeps
-#  track of.  This should be 256 multiplied by the number of clients.
-#  e.g. With 4 clients, this number should be 1024.
-#
-#  If this number is too low, then when the server becomes busy,
-#  it will not respond to any new requests, until the 'cleanup_delay'
-#  time has passed, and it has removed the old requests.
-#
-#  If this number is set too high, then the server will use a bit more
-#  memory for no real benefit.
-#
-#  If you aren't sure what it should be set to, it's better to set it
-#  too high than too low.  Setting it to 1000 per client is probably
-#  the highest it should be.
-#
-#  Useful range of values: 256 to infinity
-#
-max_requests = 1024
-
-#  bind_address:  Make the server listen on a particular IP address, and
-#  send replies out from that address.  This directive is most useful
-#  for machines with multiple IP addresses on one interface.
-#
-#  It can either contain "*", or an IP address, or a fully qualified
-#  Internet domain name.  The default is "*"
-#
-#  As of 1.0, you can also use the "listen" directive.  See below for
-#  more information.
-#
-bind_address = *
-
-#  port: Allows you to bind FreeRADIUS to a specific port.
-#
-#  The default port that most NAS boxes use is 1645, which is historical.
-#  RFC 2138 defines 1812 to be the new port.  Many new servers and
-#  NAS boxes use 1812, which can create interoperability problems.
-#
-#  The port is defined here to be 0 so that the server will pick up
-#  the machine's local configuration for the radius port, as defined
-#  in /etc/services.
-#
-#  If you want to use the default RADIUS port as defined on your server,
-#  (usually through 'grep radius /etc/services') set this to 0 (zero).
-#
-#  A port given on the command-line via '-p' over-rides this one.
-#
-#  As of 1.0, you can also use the "listen" directive.  See below for
-#  more information.
-#
-port = 0
-
-#
-#  By default, the server uses "bind_address" to listen to all IP's
-#  on a machine, or just one IP.  The "port" configuration is used
-#  to select the authentication port used when listening on those
-#  addresses.
-#
-#  If you want the server to listen on additional addresses, you can
-#  use the "listen" section.  A sample section (commented out) is included
-#  below.  This "listen" section duplicates the functionality of the
-#  "bind_address" and "port" configuration entries, but it only listens
-#  for authentication packets.
-#
-#  If you comment out the "bind_address" and "port" configuration entries,
-#  then it becomes possible to make the server accept only accounting,
-#  or authentication packets.  Previously, it always listened for both
-#  types of packets, and it was impossible to make it listen for only
-#  one type of packet.
-#
-#listen {
-	#  IP address on which to listen.
-	#  Allowed values are:
-	#	dotted quad (1.2.3.4)
-	#       hostname    (radius.example.com)
-	#       wildcard    (*)
-#	ipaddr = *
-
-	#  Port on which to listen.
-	#  Allowed values are:
-	#	integer port number (1812)
-	#	0 means "use /etc/services for the proper port"
-#	port = 0
-
-	#  Type of packets to listen for.
-	#  Allowed values are:
-	#	auth	listen for authentication packets
-	#	acct	listen for accounting packets
-	#
-#	type = auth
-#}
-
-
-#  hostname_lookups: Log the names of clients or just their IP addresses
-#  e.g., www.freeradius.org (on) or 206.47.27.232 (off).
-#
-#  The default is 'off' because it would be overall better for the net
-#  if people had to knowingly turn this feature on, since enabling it
-#  means that each client request will result in AT LEAST one lookup
-#  request to the nameserver.   Enabling hostname_lookups will also
-#  mean that your server may stop randomly for 30 seconds from time
-#  to time, if the DNS requests take too long.
-#
-#  Turning hostname lookups off also means that the server won't block
-#  for 30 seconds, if it sees an IP address which has no name associated
-#  with it.
-#
-#  allowed values: {no, yes}
-#
-hostname_lookups = no
-
-#  Core dumps are a bad thing.  This should only be set to 'yes'
-#  if you're debugging a problem with the server.
-#
-#  allowed values: {no, yes}
-#
-allow_core_dumps = no
-
-#  Regular expressions
-#
-#  These items are set at configure time.  If they're set to "yes",
-#  then setting them to "no" turns off regular expression support.
-#
-#  If they're set to "no" at configure time, then setting them to "yes"
-#  WILL NOT WORK.  It will give you an error.
-#
-regular_expressions	= @REGEX@
-extended_expressions	= @REGEX_EXTENDED@
-
-#  Log the full User-Name attribute, as it was found in the request.
-#
-# allowed values: {no, yes}
-#
-log_stripped_names = no
-
-#  Log authentication requests to the log file.
-#
-#  allowed values: {no, yes}
-#
-log_auth = no
-
-#  Log passwords with the authentication requests.
-#  log_auth_badpass  - logs password if it's rejected
-#  log_auth_goodpass - logs password if it's correct
-#
-#  allowed values: {no, yes}
-#
-log_auth_badpass = no
-log_auth_goodpass = no
-
-# usercollide:  Turn "username collision" code on and off.  See the
-# "doc/duplicate-users" file
-#
-#  WARNING
-#  !!!!!!!  Setting this to "yes" may result in the server behaving
-#  !!!!!!!  strangely.  The "username collision" code will ONLY work
-#  !!!!!!!  with clear-text passwords.  Even then, it may not do what
-#  !!!!!!!  you want, or what you expect.
-#  !!!!!!!
-#  !!!!!!!  We STRONGLY RECOMMEND that you do not use this feature,
-#  !!!!!!!  and that you find another way of acheiving the same goal.
-#  !!!!!!!
-#  !!!!!!!  e,g. module fail-over.  See 'doc/configurable_failover'
-#  WARNING
-#
-usercollide = no
-
-# lower_user / lower_pass:  
-# Lower case the username/password "before" or "after"
-# attempting to authenticate.  
-#
-#  If "before", the server will first modify the request and then try
-#  to auth the user.  If "after", the server will first auth using the
-#  values provided by the user.  If that fails it will reprocess the
-#  request after modifying it as you specify below.
-#
-#  This is as close as we can get to case insensitivity.  It is the
-#  admin's job to ensure that the username on the auth db side is
-#  *also* lowercase to make this work
-#
-# Default is 'no' (don't lowercase values)
-# Valid values = "before" / "after" / "no"
-#
-lower_user = no
-lower_pass = no
-
-# nospace_user / nospace_pass:
-#
-#  Some users like to enter spaces in their username or password
-#  incorrectly.  To save yourself the tech support call, you can
-#  eliminate those spaces here:
-#
-# Default is 'no' (don't remove spaces)
-# Valid values = "before" / "after" / "no" (explanation above)
-#
-nospace_user = no
-nospace_pass = no
-
-#  The program to execute to do concurrency checks.
-checkrad = ${sbindir}/checkrad
-
-# SECURITY CONFIGURATION
-#
-#  There may be multiple methods of attacking on the server.  This
-#  section holds the configuration items which minimize the impact
-#  of those attacks
-#
-security {
-	#
-	#  max_attributes: The maximum number of attributes
-	#  permitted in a RADIUS packet.  Packets which have MORE
-	#  than this number of attributes in them will be dropped.
-	#
-	#  If this number is set too low, then no RADIUS packets
-	#  will be accepted.
-	#
-	#  If this number is set too high, then an attacker may be
-	#  able to send a small number of packets which will cause
-	#  the server to use all available memory on the machine.
-	#
-	#  Setting this number to 0 means "allow any number of attributes"
-	max_attributes = 200
-
-	#
-	#  reject_delay: When sending an Access-Reject, it can be
-	#  delayed for a few seconds.  This may help slow down a DoS
-	#  attack.  It also helps to slow down people trying to brute-force
-	#  crack a users password.
-	#
-	#  Setting this number to 0 means "send rejects immediately"
-	#
-	#  If this number is set higher than 'cleanup_delay', then the
-	#  rejects will be sent at 'cleanup_delay' time, when the request
-	#  is deleted from the internal cache of requests.
-	#
-	#  Useful ranges: 1 to 5
-	reject_delay = 1
-
-	#
-	#  status_server: Whether or not the server will respond
-	#  to Status-Server requests.
-	#
-	#  Normally this should be set to "no", because they're useless.
-	#  See: http://www.freeradius.org/rfc/rfc2865.html#Keep-Alives
-	#
-	#  However, certain NAS boxes may require them.	
-	#
-	#  When sent a Status-Server message, the server responds with
-	#  an Access-Accept packet, containing a Reply-Message attribute,
-	#  which is a string describing how long the server has been
-	#  running.
-	#
-	status_server = no
-}
-
-# PROXY CONFIGURATION
-#
-#  proxy_requests: Turns proxying of RADIUS requests on or off.
-#
-#  The server has proxying turned on by default.  If your system is NOT
-#  set up to proxy requests to another server, then you can turn proxying
-#  off here.  This will save a small amount of resources on the server.
-#
-#  If you have proxying turned off, and your configuration files say
-#  to proxy a request, then an error message will be logged.
-#
-#  To disable proxying, change the "yes" to "no", and comment the
-#  $INCLUDE line.
-#
-#  allowed values: {no, yes}
-#
-#proxy_requests  = yes
-#$INCLUDE  ${confdir}/proxy.conf
-
-
-# CLIENTS CONFIGURATION
-#
-#  Client configuration is defined in "clients.conf".  
-#
-
-#  The 'clients.conf' file contains all of the information from the old
-#  'clients' and 'naslist' configuration files.  We recommend that you
-#  do NOT use 'client's or 'naslist', although they are still
-#  supported.
-#
-#  Anything listed in 'clients.conf' will take precedence over the
-#  information from the old-style configuration files.
-#
-#
-$INCLUDE  ${confdir}/clients.conf
-
-
-# SNMP CONFIGURATION
-#
-#  Snmp configuration is only valid if SNMP support was enabled
-#  at compile time.
-#
-#  To enable SNMP querying of the server, set the value of the
-#  'snmp' attribute to 'yes'
-#
-snmp	= no
-#$INCLUDE  ${confdir}/snmp.conf
-
-
-# THREAD POOL CONFIGURATION
-#
-#  The thread pool is a long-lived group of threads which
-#  take turns (round-robin) handling any incoming requests.
-#
-#  You probably want to have a few spare threads around,
-#  so that high-load situations can be handled immediately.  If you
-#  don't have any spare threads, then the request handling will
-#  be delayed while a new thread is created, and added to the pool.
-#
-#  You probably don't want too many spare threads around,
-#  otherwise they'll be sitting there taking up resources, and
-#  not doing anything productive.
-#
-#  The numbers given below should be adequate for most situations.
-#
-thread pool {
-	#  Number of servers to start initially --- should be a reasonable
-	#  ballpark figure.
-	start_servers = 5
-
-	#  Limit on the total number of servers running.
-	#
-	#  If this limit is ever reached, clients will be LOCKED OUT, so it
-	#  should NOT BE SET TOO LOW.  It is intended mainly as a brake to
-	#  keep a runaway server from taking the system with it as it spirals
-	#  down...
-	#
-	#  You may find that the server is regularly reaching the
-	#  'max_servers' number of threads, and that increasing
-	#  'max_servers' doesn't seem to make much difference.
-	#
-	#  If this is the case, then the problem is MOST LIKELY that
-	#  your back-end databases are taking too long to respond, and
-	#  are preventing the server from responding in a timely manner.
-	#
-	#  The solution is NOT do keep increasing the 'max_servers'
-	#  value, but instead to fix the underlying cause of the
-	#  problem: slow database, or 'hostname_lookups=yes'.
-	#
-	#  For more information, see 'max_request_time', above.
-	#
-	max_servers = 32
-
-	#  Server-pool size regulation.  Rather than making you guess
-	#  how many servers you need, FreeRADIUS dynamically adapts to
-	#  the load it sees, that is, it tries to maintain enough
-	#  servers to handle the current load, plus a few spare
-	#  servers to handle transient load spikes.
-	#
-	#  It does this by periodically checking how many servers are
-	#  waiting for a request.  If there are fewer than
-	#  min_spare_servers, it creates a new spare.  If there are
-	#  more than max_spare_servers, some of the spares die off.
-	#  The default values are probably OK for most sites.
-	#
-	min_spare_servers = 3
-	max_spare_servers = 10
-
-	#  There may be memory leaks or resource allocation problems with
-	#  the server.  If so, set this value to 300 or so, so that the
-	#  resources will be cleaned up periodically.
-	#
-	#  This should only be necessary if there are serious bugs in the
-	#  server which have not yet been fixed.
-	#
-	#  '0' is a special value meaning 'infinity', or 'the servers never
-	#  exit'
-	max_requests_per_server = 0
-}
-
-# MODULE CONFIGURATION
-#
-#  The names and configuration of each module is located in this section.
-#
-#  After the modules are defined here, they may be referred to by name,
-#  in other sections of this configuration file.
-#
-modules {
-	#
-	#  Each module has a configuration as follows:
-	#
-	#	name [ instance ] {
-	#		config_item = value
-	#		...
-	#	}
-	#
-	#  The 'name' is used to load the 'rlm_name' library
-	#  which implements the functionality of the module.
-	#
-	#  The 'instance' is optional.  To have two different instances
-	#  of a module, it first must be referred to by 'name'.
-	#  The different copies of the module are then created by
-	#  inventing two 'instance' names, e.g. 'instance1' and 'instance2'
-	#
-	#  The instance names can then be used in later configuration
-	#  INSTEAD of the original 'name'.  See the 'radutmp' configuration
-	#  below for an example.
-	#
-
-	# PAP module to authenticate users based on their stored password
-	#
-	#  Supports multiple encryption schemes
-	#  clear: Clear text
-	#  crypt: Unix crypt
-	#    md5: MD5 ecnryption
-	#   sha1: SHA1 encryption.
-	#  DEFAULT: crypt
-	pap {
-		encryption_scheme = crypt
-	}
-
-	# CHAP module
-	#
-	#  To authenticate requests containing a CHAP-Password attribute.
-	#
-	chap {
-		authtype = CHAP
-	}
-
-	# Pluggable Authentication Modules
-	#
-	#  For Linux, see:
-	#	http://www.kernel.org/pub/linux/libs/pam/index.html
-	#
-	#  WARNING: On many systems, the system PAM libraries have
-	#           memory leaks!  We STRONGLY SUGGEST that you do not
-	#	    use PAM for authentication, due to those memory leaks.
-	#
-	pam {
-		#
-		#  The name to use for PAM authentication.
-		#  PAM looks in /etc/pam.d/${pam_auth_name}
-		#  for it's configuration.  See 'redhat/radiusd-pam'
-		#  for a sample PAM configuration file.
-		#
-		#  Note that any Pam-Auth attribute set in the 'authorize'
-		#  section will over-ride this one.
-		#
-		pam_auth = radiusd
-	}
-
-	# Unix /etc/passwd style authentication
-	#
-	unix {
-		#
-		#  Cache /etc/passwd, /etc/shadow, and /etc/group
-		#
-		#  The default is to NOT cache them.
-		#
-		#  For FreeBSD and NetBSD, you do NOT want to enable
-		#  the cache, as it's password lookups are done via a
-		#  database, so set this value to 'no'.
-		#
-		#  Some systems (e.g. RedHat Linux with pam_pwbd) can
-		#  take *seconds* to check a password, when th passwd
-		#  file containing 1000's of entries.  For those systems,
-		#  you should set the cache value to 'yes', and set
-		#  the locations of the 'passwd', 'shadow', and 'group'
-		#  files, below.
-		#
-		# allowed values: {no, yes}
-		cache = no
-
-		# Reload the cache every 600 seconds (10mins). 0 to disable.
-		cache_reload = 600
-
-		#
-		#  Define the locations of the normal passwd, shadow, and
-		#  group files.
-		#
-		#  'shadow' is commented out by default, because not all
-		#  systems have shadow passwords.
-		#
-		#  To force the module to use the system password functions,
-		#  instead of reading the files, leave the following entries
-		#  commented out.
-		#
-		#  This is required for some systems, like FreeBSD,
-		#  and Mac OSX.
-		#
-		#	passwd = /etc/passwd
-		#	shadow = /etc/shadow
-		#	group = /etc/group
-
-		#
-		#  The location of the "wtmp" file.
-		#  This should be moved to it's own module soon.
-		#
-		#  The only use for 'radlast'.  If you don't use
-		#  'radlast', then you can comment out this item.
-		#
-		radwtmp = ${logdir}/radwtmp
-	}
-
-
-	# Microsoft CHAP authentication
-	#
-	#  This module supports MS-CHAP and MS-CHAPv2 authentication.
-	#  It also enforces the SMB-Account-Ctrl attribute.
-	#
-	mschap {
-		#
-		#  As of 0.9, the mschap module does NOT support
-		#  reading from /etc/smbpasswd.
-		#
-		#  If you are using /etc/smbpasswd, see the 'passwd'
-		#  module for an example of how to use /etc/smbpasswd
-
-		# if use_mppe is not set to no mschap will
-		# add MS-CHAP-MPPE-Keys for MS-CHAPv1 and
-		# MS-MPPE-Recv-Key/MS-MPPE-Send-Key for MS-CHAPv2
-		#
-		use_mppe = yes
-
-		# if mppe is enabled require_encryption makes
-		# encryption moderate
-		#
-		require_encryption = yes
-
-		# require_strong always requires 128 bit key
-		# encryption
-		#
-		require_strong = yes
-
-		# Windows sends us a username in the form of
-		# DOMAIN\user, but sends the challenge response
-		# based on only the user portion.  This hack
-		# corrects for that incorrect behavior.
-		#
-		#with_ntdomain_hack = no
-
-		# The module can perform authentication itself, OR
-		# use a Windows Domain Controller.  This configuration
-		# directive tells the module to call the ntlm_auth
-		# program, which will do the authentication, and return
-		# the NT-Key.  Note that you MUST have "winbindd" and
-		# "nmbd" running on the local machine for ntlm_auth
-		# to work.  See the ntlm_auth program documentation
-		# for details.
-		#
-		# Be VERY careful when editing the following line!
-		#
-		#ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
-	}
-
-	# Lightweight Directory Access Protocol (LDAP)
-	#
-	#  This module definition allows you to use LDAP for
-	#  authorization and authentication.
-	#
-	#  See doc/rlm_ldap for description of configuration options 
-	#  and sample authorize{} and authenticate{} blocks 
-	#
-	#  However, LDAP can be used for authentication ONLY when the
-	#  Access-Request packet contains a clear-text User-Password
-	#  attribute.  LDAP authentication will NOT work for any other
-	#  authentication method.
-	#
-	#  This means that LDAP servers don't understand EAP.  If you
-	#  force "Auth-Type = LDAP", and then send the server a
-	#  request containing EAP authentication, then authentication
-	#  WILL NOT WORK.
-	#
-	#  The solution is to use the default configuration, which does
-	#  work.
-	#
-	#  Setting "Auth-Type = LDAP" is ALMOST ALWAYS WRONG.  We
-	#  really can't emphasize this enough.
-	#	
-	ldap {
-		server = "ldap-master"
-		identity = "cn=Manager,dc=syn-3"
-		password = asje2
-		basedn = "dc=syn-3"
-		filter = "(&(OXGroupID=520)(uid=%u))"
-		base_filter = "(objectclass=OXUserObject)"
-
-		# set this to 'yes' to use TLS encrypted connections
-		# to the LDAP database by using the StartTLS extended
-		# operation.
-		# The StartTLS operation is supposed to be used with normal
-		# ldap connections instead of using ldaps (port 689) connections
-		start_tls = no
-
-		# tls_cacertfile	= /path/to/cacert.pem
-		# tls_cacertdir		= /path/to/ca/dir/
-		# tls_certfile		= /path/to/radius.crt
-		# tls_keyfile		= /path/to/radius.key
-		# tls_randfile		= /path/to/rnd
-		# tls_require_cert	= "demand"
-
-		# default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA"
-		# profile_attribute = "radiusProfileDn"
-		#access_attr = "OXUserObject"
-
-		# Mapping of RADIUS dictionary attributes to LDAP
-		# directory attributes.
-		dictionary_mapping = ${raddbdir}/ldap.attrmap
-
-		ldap_connections_number = 5
-
-		#
-		# NOTICE: The password_header directive is NOT case insensitive
-		#
-		#password_header = "{CRYPT}"
-		#
-		# Set:
-		password_attribute = userPassword
-		#
-		# to get the user's password from a Novell eDirectory
-		# backend. This will work *only if* freeRADIUS is
-		# configured to build with --with-edir option.
-		#
-		#
-		#  The server can usually figure this out on its own, and pull
-		#  the correct User-Password or NT-Password from the database.
-		#
-		#  Note that NT-Passwords MUST be stored as a 32-digit hex
-		#  string, and MUST start off with "0x", such as:
-		#
-		#	0x000102030405060708090a0b0c0d0e0f
-		#
-		#  Without the leading "0x", NT-Passwords will not work.
-		#  This goes for NT-Passwords stored in SQL, too.
-		#
-		# password_attribute = userPassword
-		#
-		# Un-comment the following to disable Novell eDirectory account
-		# policy check and intruder detection. This will work *only if*
-		# FreeRADIUS is configured to build with --with-edir option.
-		#
-		# edir_account_policy_check=no
-		#
-		timeout = 4
-		timelimit = 3
-		net_timeout = 1
-		compare_check_items = no 
-		# do_xlat = yes
-		# access_attr_used_for_allow = yes
-
-		#
-		#  By default, if the packet contains a User-Password,
-		#  and no other module is configured to handle the
-		#  authentication, the LDAP module sets itself to do
-		#  LDAP bind for authentication.
-		#
-		#  You can disable this behavior by setting the following
-		#  configuration entry to "no".
-		#
-		#  allowed values: {no, yes}
-		set_auth_type = yes
-	}
-	# passwd module allows to do authorization via any passwd-like
-	# file and to extract any attributes from these modules
-	#
-	# parameters are:
-	#   filename - path to filename
-	#   format - format for filename record. This parameters
-	#            correlates record in the passwd file and RADIUS
-	#            attributes.
-	#
-	#            Field marked as '*' is key field. That is, the parameter
-	#            with this name from the request is used to search for
-	#            the record from passwd file
-	#            Attribute marked as '=' is added to reply_itmes instead
-	#            of default configure_itmes
-	#	     Attribute marked as '~' is added to request_items
-	#
-	#            Field marked as ',' may contain a comma separated list
-	#            of attributes.
-	#   authtype - if record found this Auth-Type is used to authenticate
-	#            user
-	#   hashsize - hashtable size. If 0 or not specified records are not
-	#            stored in memory and file is red on every request.
-	#   allowmultiplekeys - if few records for every key are allowed
-	#   ignorenislike - ignore NIS-related records
-	#   delimiter - symbol to use as a field separator in passwd file,
-	#            for format ':' symbol is always used. '\0', '\n' are
-        #	     not allowed 
-	#
-
-	#  An example configuration for using /etc/smbpasswd.
-	#
-	#passwd etc_smbpasswd {
-	#	filename = /etc/smbpasswd
-	#	format = "*User-Name::LM-Password:NT-Password:SMB-Account-CTRL-TEXT::"
-	#	authtype = MS-CHAP
-	#	hashsize = 100
-	#	ignorenislike = no
-	#	allowmultiplekeys = no
-	#}
-
-	#  Similar configuration, for the /etc/group file. Adds a Group-Name
-	#  attribute for every group that the user is member of.
-	#
-	#passwd etc_group {
-	#	filename = /etc/group
-	#	format = "=Group-Name:::*,User-Name"
-	#	hashsize = 50
-	#	ignorenislike = yes
-	#	allowmultiplekeys = yes
-	#	delimiter = ":"
-	#}
-
-	# Realm module, for proxying.
-	#
-	#  You can have multiple instances of the realm module to
-	#  support multiple realm syntaxs at the same time.  The
-	#  search order is defined by the order in the authorize and
-	#  preacct sections.
-	#
-	#  Four config options:
-	#	format         -  must be 'prefix' or 'suffix'
-	#	delimiter      -  must be a single character
-	#	ignore_default -  set to 'yes' or 'no'
-	#       ignore_null    -  set to 'yes' or 'no'
-	#
-	#  ignore_default and ignore_null can be set to 'yes' to prevent
-	#  the module from matching against DEFAULT or NULL realms.  This
-	#  may be useful if you have have multiple instances of the
-	#  realm module.
-	#
-	#  They both default to 'no'.
-	#
-
-	#  'realm/username'
-	#
-	#  Using this entry, IPASS users have their realm set to "IPASS".
-	realm IPASS {
-		format = prefix
-		delimiter = "/"
-		ignore_default = no
-		ignore_null = no
-	}
-
-	#  'username@realm'
-	#
-	realm suffix {
-		format = suffix
-		delimiter = "@"
-		ignore_default = no
-		ignore_null = no
-	}
-
-	#  'username%realm'
-	#
-	realm realmpercent {
-		format = suffix
-		delimiter = "%"
-		ignore_default = no
-		ignore_null = no
-	}
-
-	#
-	#  'domain\user'
-	#
-	realm ntdomain {
-		format = prefix
-		delimiter = "\\"
-		ignore_default = no
-		ignore_null = no
-	}	
-
-	#  A simple value checking module
-	#
-	#  It can be used to check if an attribute value in the request
-	#  matches a (possibly multi valued) attribute in the check
-	#  items This can be used for example for caller-id
-	#  authentication.  For the module to run, both the request
-	#  attribute and the check items attribute must exist
-	#
-	#  i.e.
-	#  A user has an ldap entry with 2 radiusCallingStationId
-	#  attributes with values "12345678" and "12345679".  If we
-	#  enable rlm_checkval, then any request which contains a
-	#  Calling-Station-Id with one of those two values will be
-	#  accepted.  Requests with other values for
-	#  Calling-Station-Id will be rejected.
-	#
-	#  Regular expressions in the check attribute value are allowed
-	#  as long as the operator is '=~'
-	#
-	checkval {
-		# The attribute to look for in the request
-		item-name = Calling-Station-Id
-
-		# The attribute to look for in check items. Can be multi valued
-		check-name = Calling-Station-Id
-
-		# The data type. Can be
-		# string,integer,ipaddr,date,abinary,octets
-		data-type = string
-
-		# If set to yes and we dont find the item-name attribute in the
-		# request then we send back a reject
-		# DEFAULT is no
-		#notfound-reject = no
-	}
-	
-	#  rewrite arbitrary packets.  Useful in accounting and authorization.
-	#
-	#
-	#  The module can also use the Rewrite-Rule attribute. If it
-	#  is set and matches the name of the module instance, then
-	#  that module instance will be the only one which runs.
-	#
-	#  Also if new_attribute is set to yes then a new attribute
-	#  will be created containing the value replacewith and it
-	#  will be added to searchin (packet, reply, proxy, proxy_reply or config).
-	# searchfor,ignore_case and max_matches will be ignored in that case.
-	#
-	# Backreferences are supported: %{0} will contain the string the whole match
-	# and %{1} to %{8} will contain the contents of the 1st to the 8th parentheses
-	#
-	# If max_matches is greater than one the backreferences will correspond to the
-	# first match
-
-	#
-	#attr_rewrite sanecallerid {
-	#	attribute = Called-Station-Id
-		# may be "packet", "reply", "proxy", "proxy_reply" or "config"
-	#	searchin = packet
-	#	searchfor = "[+ ]"
-	#	replacewith = ""
-	#	ignore_case = no
-	#	new_attribute = no
-	#	max_matches = 10
-	#	## If set to yes then the replace string will be appended to the original string
-	#	append = no
-	#}
-
-	# Preprocess the incoming RADIUS request, before handing it off
-	# to other modules.
-	#
-	#  This module processes the 'huntgroups' and 'hints' files.
-	#  In addition, it re-writes some weird attributes created
-	#  by some NASes, and converts the attributes into a form which
-	#  is a little more standard.
-	#
-	preprocess {
-		huntgroups = ${confdir}/huntgroups
-		hints = ${confdir}/hints
-
-		# This hack changes Ascend's wierd port numberings
-		# to standard 0-??? port numbers so that the "+" works
-		# for IP address assignments.
-		with_ascend_hack = no
-		ascend_channels_per_line = 23
-
-		# Windows NT machines often authenticate themselves as
-		# NT_DOMAIN\username
-		#
-		# If this is set to 'yes', then the NT_DOMAIN portion
-		# of the user-name is silently discarded.
-		#
-		# This configuration entry SHOULD NOT be used.
-		# See the "realms" module for a better way to handle
-		# NT domains.
-		with_ntdomain_hack = no
-
-		# Specialix Jetstream 8500 24 port access server.
-		#
-		# If the user name is 10 characters or longer, a "/"
-		# and the excess characters after the 10th are
-		# appended to the user name.
-		#
-		# If you're not running that NAS, you don't need
-		# this hack.
-		with_specialix_jetstream_hack = no
-
-		# Cisco (and Quintum in Cisco mode) sends it's VSA attributes
-		# with the attribute name *again* in the string, like:
-		#
-		#   H323-Attribute = "h323-attribute=value".
-		#
-		# If this configuration item is set to 'yes', then
-		# the redundant data in the the attribute text is stripped
-		# out.  The result is:
-		#
-		#  H323-Attribute = "value"
-		#
-		# If you're not running a Cisco or Quintum NAS, you don't
-		# need this hack.
-		with_cisco_vsa_hack = no
-	}
-
-	# Livingston-style 'users' file
-	#
-	files {
-		usersfile = ${confdir}/users
-		acctusersfile = ${confdir}/acct_users
-		preproxy_usersfile = ${confdir}/preproxy_users
-
-		#  If you want to use the old Cistron 'users' file
-		#  with FreeRADIUS, you should change the next line
-		#  to 'compat = cistron'.  You can the copy your 'users'
-		#  file from Cistron.
-		compat = no
-	}
-
-	# Write a detailed log of all accounting records received.
-	#
-	detail {
-		#  Note that we do NOT use NAS-IP-Address here, as
-		#  that attribute MAY BE from the originating NAS, and
-		#  NOT from the proxy which actually sent us the
-		#  request.  The Client-IP-Address attribute is ALWAYS
-		#  the address of the client which sent us the
-		#  request.
-		#
-		#  The following line creates a new detail file for
-		#  every radius client (by IP address or hostname).
-		#  In addition, a new detail file is created every
-		#  day, so that the detail file doesn't have to go
-		#  through a 'log rotation'
-		#
-		#  If your detail files are large, you may also want
-		#  to add a ':%H' (see doc/variables.txt) to the end
-		#  of it, to create a new detail file every hour, e.g.:
-		#
-		#   ..../detail-%Y%m%d:%H
-		#
-		#  This will create a new detail file for every hour.
-		#
-		detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d
-
-		#
-		#  The Unix-style permissions on the 'detail' file.
-		#
-		#  The detail file often contains secret or private
-		#  information about users.  So by keeping the file
-		#  permissions restrictive, we can prevent unwanted
-		#  people from seeing that information.
-		detailperm = 0600
-
-		#
-		# Certain attributes such as User-Password may be
-		# "sensitive", so they should not be printed in the
-		# detail file.  This section lists the attributes
-		# that should be suppressed.
-		#
-		# The attributes should be listed one to a line.
-		#
-		#suppress {
-			# User-Password
-		#}
-	}
-
-	#
-	#  Many people want to log authentication requests.
-	#  Rather than modifying the server core to print out more
-	#  messages, we can use a different instance of the 'detail'
-	#  module, to log the authentication requests to a file.
-	#
-	#  You will also need to un-comment the 'auth_log' line
-	#  in the 'authorize' section, below.
-	#
-	# detail auth_log {
-		# detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d
-
-		#
-		#  This MUST be 0600, otherwise anyone can read
-		#  the users passwords!
-		# detailperm = 0600
-	# }
-
-	#
-	#  This module logs authentication reply packets sent
-	#  to a NAS.  Both Access-Accept and Access-Reject packets
-	#  are logged.
-	#
-	#  You will also need to un-comment the 'reply_log' line
-	#  in the 'post-auth' section, below.
-	#
-	# detail reply_log {
-		# detailfile = ${radacctdir}/%{Client-IP-Address}/reply-detail-%Y%m%d
-
-		#
-		#  This MUST be 0600, otherwise anyone can read
-		#  the users passwords!
-		# detailperm = 0600
-	# }
-
-	#
-	#  This module logs packets proxied to a home server.
-	#
-	#  You will also need to un-comment the 'pre_proxy_log' line
-	#  in the 'pre-proxy' section, below.
-	#
-	# detail pre_proxy_log {
-		# detailfile = ${radacctdir}/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d
-
-		#
-		#  This MUST be 0600, otherwise anyone can read
-		#  the users passwords!
-		# detailperm = 0600
-	# }
-
-	#
-	#  This module logs response packets from a home server.
-	#
-	#  You will also need to un-comment the 'post_proxy_log' line
-	#  in the 'post-proxy' section, below.
-	#
-	# detail post_proxy_log {
-		# detailfile = ${radacctdir}/%{Client-IP-Address}/post-proxy-detail-%Y%m%d
-
-		#
-		#  This MUST be 0600, otherwise anyone can read
-		#  the users passwords!
-		# detailperm = 0600
-	# }
-
-	#
-	#  The rlm_sql_log module appends the SQL queries in a log
-	#  file which is read later by the radsqlrelay program.
-	#
-	#  This module only performs the dynamic expansion of the
-	#  variables found in the SQL statements. No operation is
-	#  executed on the database server. (this could be done
-	#  later by an external program) That means the module is
-	#  useful only with non-"SELECT" statements.
-	#
-	#  See rlm_sql_log(5) manpage.
-	#
-#	sql_log {
-#		path = ${radacctdir}/sql-relay
-#		acct_table = "radacct"
-#		postauth_table = "radpostauth"
-#
-#		Start = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \
-#		 NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \
-#		 AcctSessionTime, AcctTerminateCause) VALUES                 \
-#		 ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \
-#		 '%{Framed-IP-Address}', '%S', '0', '0', '');"
-#		Stop = "INSERT INTO ${acct_table} (AcctSessionId, UserName,  \
-#		 NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \
-#		 AcctSessionTime, AcctTerminateCause) VALUES                 \
-#		 ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \
-#		 '%{Framed-IP-Address}', '0', '%S', '%{Acct-Session-Time}',  \
-#		 '%{Acct-Terminate-Cause}');"
-#		Alive = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \
-#		 NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \
-#		 AcctSessionTime, AcctTerminateCause) VALUES                 \
-#		 ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \
-#		 '%{Framed-IP-Address}', '0', '0', '%{Acct-Session-Time}','');"
-#
-#		Post-Auth = "INSERT INTO ${postauth_table}                   \
-#		 (user, pass, reply, date) VALUES                            \
-#		 ('%{User-Name}', '%{User-Password:-Chap-Password}',         \
-#		 '%{reply:Packet-Type}', '%S');"
-#	}
-
-	#
-	#  Create a unique accounting session Id.  Many NASes re-use
-	#  or repeat values for Acct-Session-Id, causing no end of
-	#  confusion.
-	#
-	#  This module will add a (probably) unique session id 
-	#  to an accounting packet based on the attributes listed
-	#  below found in the packet.  See doc/rlm_acct_unique for
-	#  more information.
-	#
-	acct_unique {
-		key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
-	}
-
-
-	#  Include another file that has the SQL-related configuration.
-	#  This is another file only because it tends to be big.
-	#
-	#  The following configuration file is for use with MySQL.
-	#
-	#  For Postgresql, use:		${confdir}/postgresql.conf
-	#  For MS-SQL, use:	 	${confdir}/mssql.conf
-	#  For Oracle, use:	 	${confdir}/oraclesql.conf
-	#
-	#$INCLUDE  ${confdir}/sql.conf
-
-
-	#  For Cisco VoIP specific accounting with Postgresql,
-	#  use:		${confdir}/pgsql-voip.conf
-	#
-	#  You will also need the sql schema from:
-	#  	 src/billing/cisco_h323_db_schema-postgres.sql
-	#  Note: This config can be use AS WELL AS the standard sql
-	#  config if you need SQL based Auth
-	
-
-	#  Write a 'utmp' style file, of which users are currently
-	#  logged in, and where they've logged in from.
-	#
-	#  This file is used mainly for Simultaneous-Use checking,
-	#  and also 'radwho', to see who's currently logged in.
-	#
-	radutmp {
-		#  Where the file is stored.  It's not a log file,
-		#  so it doesn't need rotating.
-		#
-		filename = ${logdir}/radutmp
-
-		#  The field in the packet to key on for the
-		#  'user' name,  If you have other fields which you want
-		#  to use to key on to control Simultaneous-Use,
-		#  then you can use them here.
-		#
-		#  Note, however, that the size of the field in the
-		#  'utmp' data structure is small, around 32
-		#  characters, so that will limit the possible choices
-		#  of keys.
-		#
-		#  You may want instead: %{Stripped-User-Name:-%{User-Name}}
-		username = %{User-Name}
-
-
-		#  Whether or not we want to treat "user" the same
-		#  as "USER", or "User".  Some systems have problems
-		#  with case sensitivity, so this should be set to
-		#  'no' to enable the comparisons of the key attribute
-		#  to be case insensitive.
-		#
-		case_sensitive = yes
-
-		#  Accounting information may be lost, so the user MAY
-		#  have logged off of the NAS, but we haven't noticed.
-		#  If so, we can verify this information with the NAS,
-		#
-		#  If we want to believe the 'utmp' file, then this
-		#  configuration entry can be set to 'no'.
-		#
-		check_with_nas = yes		
-
-		# Set the file permissions, as the contents of this file
-		# are usually private.
-		perm = 0600
-
-		callerid = "yes"
-	}
-
-	# "Safe" radutmp - does not contain caller ID, so it can be
-	# world-readable, and radwho can work for normal users, without
-	# exposing any information that isn't already exposed by who(1).
-	#
-	# This is another 'instance' of the radutmp module, but it is given
-	# then name "sradutmp" to identify it later in the "accounting"
-	# section.
-	radutmp sradutmp {
-		filename = ${logdir}/sradutmp
-		perm = 0644
-		callerid = "no"
-	}
-
-	# attr_filter - filters the attributes received in replies from
-	# proxied servers, to make sure we send back to our RADIUS client
-	# only allowed attributes.
-	attr_filter {
-		attrsfile = ${confdir}/attrs
-	}
-
-	#  counter module:
-	#  This module takes an attribute (count-attribute).
-	#  It also takes a key, and creates a counter for each unique
-	#  key.  The count is incremented when accounting packets are
-	#  received by the server.  The value of the increment depends
-	#  on the attribute type.
-	#  If the attribute is Acct-Session-Time or of an integer type we add the
-	#  value of the attribute. If it is anything else we increase the
-	#  counter by one.
-	#
-	#  The 'reset' parameter defines when the counters are all reset to
-	#  zero.  It can be hourly, daily, weekly, monthly or never.
-	#
-	#  hourly: Reset on 00:00 of every hour
-	#  daily: Reset on 00:00:00 every day
-	#  weekly: Reset on 00:00:00 on sunday
-	#  monthly: Reset on 00:00:00 of the first day of each month
-	#
-	#  It can also be user defined. It should be of the form:
-	#  num[hdwm] where:
-	#  h: hours, d: days, w: weeks, m: months
-	#  If the letter is ommited days will be assumed. In example:
-	#  reset = 10h (reset every 10 hours)
-	#  reset = 12  (reset every 12 days)
-	#
-	#
-	#  The check-name attribute defines an attribute which will be
-	#  registered by the counter module and can be used to set the
-	#  maximum allowed value for the counter after which the user
-	#  is rejected.
-	#  Something like:
-	#
-	#  DEFAULT Max-Daily-Session := 36000
-	#          Fall-Through = 1
-	#
-	#  You should add the counter module in the instantiate
-	#  section so that it registers check-name before the files
-	#  module reads the users file.
-	#
-	#  If check-name is set and the user is to be rejected then we
-	#  send back a Reply-Message and we log a Failure-Message in
-	#  the radius.log
-	#  If the count attribute is Acct-Session-Time then on each login
-	#  we send back the remaining online time as a Session-Timeout attribute
-	#
-	#  The counter-name can also be used instead of using the check-name
-	#  like below:
-	#
-	#  DEFAULT  Daily-Session-Time > 3600, Auth-Type = Reject
-	#      Reply-Message = "You've used up more than one hour today"
-	#
-	#  The allowed-servicetype attribute can be used to only take
-	#  into account specific sessions. For example if a user first
-	#  logs in through a login menu and then selects ppp there will
-	#  be two sessions. One for Login-User and one for Framed-User
-	#  service type. We only need to take into account the second one.
-	#
-	#  The module should be added in the instantiate, authorize and
-	#  accounting sections.  Make sure that in the authorize
-	#  section it comes after any module which sets the
-	#  'check-name' attribute.
-	#
-	counter daily {
-		filename = ${raddbdir}/db.daily
-		key = User-Name
-		count-attribute = Acct-Session-Time
-		reset = daily
-		counter-name = Daily-Session-Time
-		check-name = Max-Daily-Session
-		allowed-servicetype = Framed-User
-		cache-size = 5000
-	}
-
-	#
-	#  This module is an SQL enabled version of the counter module.
-	#
-	#  Rather than maintaining seperate (GDBM) databases of
-	#  accounting info for each counter, this module uses the data
-	#  stored in the raddacct table by the sql modules. This
-	#  module NEVER does any database INSERTs or UPDATEs.  It is
-	#  totally dependent on the SQL module to process Accounting
-	#  packets.
-	#
-	#  The 'sqlmod_inst' parameter holds the instance of the sql
-	#  module to use when querying the SQL database. Normally it
-	#  is just "sql".  If you define more and one SQL module
-	#  instance (usually for failover situations), you can
-	#  specify which module has access to the Accounting Data
-	#  (radacct table).
-	#
-	#  The 'reset' parameter defines when the counters are all
-	#  reset to zero.  It can be hourly, daily, weekly, monthly or
-	#  never.  It can also be user defined. It should be of the
-	#  form:
-	#  	num[hdwm] where:
-	#  	h: hours, d: days, w: weeks, m: months
-	#  	If the letter is ommited days will be assumed. In example:
-	#  	reset = 10h (reset every 10 hours)
-	#  	reset = 12  (reset every 12 days)
-	#
-	#  The 'key' parameter specifies the unique identifier for the
-	#  counter records (usually 'User-Name').
-	#
-	#  The 'query' parameter specifies the SQL query used to get
-	#  the current Counter value from the database. There are 3
-	#  parameters that can be used in the query:
-	#		%k	'key' parameter
-	#		%b	unix time value of beginning of reset period
-	#		%e	unix time value of end of reset period
-	#
-	#  The 'check-name' parameter is the name of the 'check'
-	#  attribute to use to access the counter in the 'users' file
-	#  or SQL radcheck or radcheckgroup tables.
-	#
-	#  DEFAULT  Max-Daily-Session > 3600, Auth-Type = Reject
-	#      Reply-Message = "You've used up more than one hour today"
-	#
-	sqlcounter dailycounter {
-		counter-name = Daily-Session-Time
-		check-name = Max-Daily-Session
-		sqlmod-inst = sql
-		key = User-Name
-		reset = daily
-
-		# This query properly handles calls that span from the
-		# previous reset period into the current period but
-		# involves more work for the SQL server than those
-		# below
-		# For mysql:
-		query = "SELECT SUM(AcctSessionTime - \
-                 GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \
-                 FROM radacct WHERE UserName='%{%k}' AND \
-                 UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'"
-
-		# For postgresql:
-#		query = "SELECT SUM(AcctSessionTime - \
-#                GREATER((%b - AcctStartTime::ABSTIME::INT4), 0)) \
-#                FROM radacct WHERE UserName='%{%k}' AND \
-#                AcctStartTime::ABSTIME::INT4 + AcctSessionTime > '%b'"
-
-		# This query ignores calls that started in a previous
-		# reset period and continue into into this one. But it
-		# is a little easier on the SQL server
-		# For mysql:
-#		query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE \
-#                UserName='%{%k}' AND AcctStartTime > FROM_UNIXTIME('%b')"
-
-		# For postgresql:
-#		query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE \
-#                UserName='%{%k}' AND AND AcctStartTime::ABSTIME::INT4 > '%b'"
-
-		# This query is the same as above, but demonstrates an
-		# additional counter parameter '%e' which is the
-		# timestamp for the end of the period
-		# For mysql:
-#		query = "SELECT SUM(AcctSessionTime) FROM radacct \
-#                WHERE UserName='%{%k}' AND AcctStartTime BETWEEN \
-#                FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')"
-
-		# For postgresql:
-#		query = "SELECT SUM(AcctSessionTime) FROM radacct \
-#                WHERE UserName='%{%k}' AND AcctStartTime::ABSTIME::INT4 \
-#                BETWEEN '%b' AND '%e'"
-	}
-
-	sqlcounter monthlycounter {
-		counter-name = Monthly-Session-Time
-		check-name = Max-Monthly-Session
-		sqlmod-inst = sql
-		key = User-Name
-		reset = monthly
-
-		# This query properly handles calls that span from the
-		# previous reset period into the current period but
-		# involves more work for the SQL server than those
-		# below
-		# The same notes above about the differences between mysql
-		# versus postgres queries apply here.
-		query = "SELECT SUM(AcctSessionTime - \
-                 GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \
-                 FROM radacct WHERE UserName='%{%k}' AND \
-                 UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'"
-
-		# This query ignores calls that started in a previous
-		# reset period and continue into into this one. But it
-		# is a little easier on the SQL server
-#		query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE \
-#                UserName='%{%k}' AND AcctStartTime > FROM_UNIXTIME('%b')"
-
-		# This query is the same as above, but demonstrates an
-		# additional counter parameter '%e' which is the
-		# timestamp for the end of the period
-#		query = "SELECT SUM(AcctSessionTime) FROM radacct \
-#                WHERE UserName='%{%k}' AND AcctStartTime BETWEEN \
-#                FROM_UNIXTIME('%b') AND FROM_UNIXTIME('%e')"
-	}
-
-	#
-	# The "always" module is here for debugging purposes. Each
-	# instance simply returns the same result, always, without
-	# doing anything.
-	always fail {
-		rcode = fail
-	}
-	always reject {
-		rcode = reject
-	}
-	always ok {
-		rcode = ok
-		simulcount = 0
-		mpp = no
-	}
-
-	#
-	#  The 'expression' module currently has no configuration.
-	#
-	#  This module is useful only for 'xlat'.  To use it,
-	#  put 'exec' into the 'instantiate' section.  You can then
-	#  do dynamic translation of attributes like:
-	#
-	#  Attribute-Name = `%{expr:2 + 3 + %{exec: uid -u}}`
-	#
-	#  The value of the attribute will be replaced with the output
-	#  of the program which is executed.  Due to RADIUS protocol
-	#  limitations, any output over 253 bytes will be ignored.
-	expr {
-	}
-
-	#
-	#  The 'digest' module currently has no configuration.
-	#
-	#  "Digest" authentication against a Cisco SIP server.
-	#  See 'doc/rfc/draft-sterman-aaa-sip-00.txt' for details
-	#  on performing digest authentication for Cisco SIP servers.
-	#
-	digest {
-	}
-
-	#
-	#  Execute external programs
-	#
-	#  This module is useful only for 'xlat'.  To use it,
-	#  put 'exec' into the 'instantiate' section.  You can then
-	#  do dynamic translation of attributes like:
-	#
-	#  Attribute-Name = `%{exec:/path/to/program args}`
-	#
-	#  The value of the attribute will be replaced with the output
-	#  of the program which is executed.  Due to RADIUS protocol
-	#  limitations, any output over 253 bytes will be ignored.
-	#
-	#  The RADIUS attributes from the user request will be placed
-	#  into environment variables of the executed program, as
-	#  described in 'doc/variables.txt'
-	#
-	exec {
-		wait = yes
-		input_pairs = request
-	}
-
-	#
-	#  This is a more general example of the execute module.
-	#
-	#  This one is called "echo".
-	#
-	#  Attribute-Name = `%{echo:/path/to/program args}`
-	#
-	#  If you wish to execute an external program in more than
-	#  one section (e.g. 'authorize', 'pre_proxy', etc), then it
-	#  is probably best to define a different instance of the
-	#  'exec' module for every section.	
-	#	
-	exec echo {
-		#
-		#  Wait for the program to finish.
-		#
-		#  If we do NOT wait, then the program is "fire and
-		#  forget", and any output attributes from it are ignored.
-		#
-		#  If we are looking for the program to output
-		#  attributes, and want to add those attributes to the
-		#  request, then we MUST wait for the program to
-		#  finish, and therefore set 'wait=yes'
-		#
-		# allowed values: {no, yes}
-		wait = yes
-
-		#
-		#  The name of the program to execute, and it's
-		#  arguments.  Dynamic translation is done on this
-		#  field, so things like the following example will
-		#  work.
-		#
-		program = "/bin/echo %{User-Name}"
-
-		#
-		#  The attributes which are placed into the
-		#  environment variables for the program.
-		#
-		#  Allowed values are:
-		#
-		#	request		attributes from the request
-		#	config		attributes from the configuration items list
-		#	reply		attributes from the reply
-		#	proxy-request	attributes from the proxy request
-		#	proxy-reply	attributes from the proxy reply
-		#
-		#  Note that some attributes may not exist at some
-		#  stages.  e.g. There may be no proxy-reply
-		#  attributes if this module is used in the
-		#  'authorize' section.
-		#
-		input_pairs = request
-
-		#
-		#  Where to place the output attributes (if any) from
-		#  the executed program.  The values allowed, and the
-		#  restrictions as to availability, are the same as
-		#  for the input_pairs.
-		#
-		output_pairs = reply
-
-		#
-		#  When to execute the program.  If the packet
-		#  type does NOT match what's listed here, then
-		#  the module does NOT execute the program.
-		#
-		#  For a list of allowed packet types, see
-		#  the 'dictionary' file, and look for VALUEs
-		#  of the Packet-Type attribute.
-		#
-		#  By default, the module executes on ANY packet.
-		#  Un-comment out the following line to tell the
-		#  module to execute only if an Access-Accept is
-		#  being sent to the NAS.
-		#
-		#packet_type = Access-Accept
-	}
-
-	#  Do server side ip pool management. Should be added in post-auth and
-	#  accounting sections.
-	#
-	#  The module also requires the existance of the Pool-Name
-	#  attribute. That way the administrator can add the Pool-Name
-	#  attribute in the user profiles and use different pools
-	#  for different users. The Pool-Name attribute is a *check* item not
-	#  a reply item.
-	#
-	# Example:
-	# radiusd.conf: ippool students { [...] }
-	# users file  : DEFAULT Group == students, Pool-Name := "students"
-	#
-	# ********* IF YOU CHANGE THE RANGE PARAMETERS YOU MUST *********
-	# ********* THEN ERASE THE DB FILES                     *********
-	#
-	ippool main_pool {
-
-		#  range-start,range-stop: The start and end ip
-		#  addresses for the ip pool
-		range-start = 192.168.1.1
-		range-stop = 192.168.3.254
-
-		#  netmask: The network mask used for the ip's
-		netmask = 255.255.255.0
-
-		#  cache-size: The gdbm cache size for the db
-		#  files. Should be equal to the number of ip's
-		#  available in the ip pool
-		cache-size = 800
-
-		# session-db: The main db file used to allocate ip's to clients
-		session-db = ${raddbdir}/db.ippool
-
-		# ip-index: Helper db index file used in multilink
-		ip-index = ${raddbdir}/db.ipindex
-
-		# override: Will this ippool override a Framed-IP-Address already set
-		override = no
-
-		# maximum-timeout: If not zero specifies the maximum time in seconds an
-		# entry may be active. Default: 0
-		maximum-timeout = 0
-	}
-
-	# $INCLUDE  ${confdir}/sqlippool.conf
-
-	# OTP token support.  Not included by default.
-	# $INCLUDE  ${confdir}/otp.conf
-
-}
-
-# Instantiation
-#
-#  This section orders the loading of the modules.  Modules
-#  listed here will get loaded BEFORE the later sections like
-#  authorize, authenticate, etc. get examined.
-#
-#  This section is not strictly needed.  When a section like
-#  authorize refers to a module, it's automatically loaded and
-#  initialized.  However, some modules may not be listed in any
-#  of the following sections, so they can be listed here.
-#
-#  Also, listing modules here ensures that you have control over
-#  the order in which they are initalized.  If one module needs
-#  something defined by another module, you can list them in order
-#  here, and ensure that the configuration will be OK.
-#
-instantiate {
-	#
-	#  Allows the execution of external scripts.
-	#  The entire command line (and output) must fit into 253 bytes.
-	#
-	#  e.g. Framed-Pool = `%{exec:/bin/echo foo}`
-	exec
-
-	#
-	#  The expression module doesn't do authorization,
-	#  authentication, or accounting.  It only does dynamic
-	#  translation, of the form:
-	#
-	#	Session-Timeout = `%{expr:2 + 3}`
-	#
-	#  So the module needs to be instantiated, but CANNOT be
-	#  listed in any other section.  See 'doc/rlm_expr' for
-	#  more information.
-	#
-	expr
-
-	#
-	# We add the counter module here so that it registers
-	# the check-name attribute before any module which sets
-	# it
-#	daily
-}
-
-#  Authorization. First preprocess (hints and huntgroups files),
-#  then realms, and finally look in the "users" file.
-#
-#  The order of the realm modules will determine the order that
-#  we try to find a matching realm.
-#
-#  Make *sure* that 'preprocess' comes before any realm if you 
-#  need to setup hints for the remote radius server
-authorize {
-	#
-	#  The preprocess module takes care of sanitizing some bizarre
-	#  attributes in the request, and turning them into attributes
-	#  which are more standard.
-	#
-	#  It takes care of processing the 'raddb/hints' and the
-	#  'raddb/huntgroups' files.
-	#
-	#  It also adds the %{Client-IP-Address} attribute to the request.
-	preprocess
-
-	#
-	#  If you want to have a log of authentication requests,
-	#  un-comment the following line, and the 'detail auth_log'
-	#  section, above.
-#	auth_log
-	
-#	attr_filter
-
-	#
-	#  The chap module will set 'Auth-Type := CHAP' if we are
-	#  handling a CHAP request and Auth-Type has not already been set
-	chap
-
-	#
-	#  If the users are logging in with an MS-CHAP-Challenge
-	#  attribute for authentication, the mschap module will find
-	#  the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP'
-	#  to the request, which will cause the server to then use
-	#  the mschap module for authentication.
-	mschap
-
-	#
-	#  If you have a Cisco SIP server authenticating against
-	#  FreeRADIUS, uncomment the following line, and the 'digest'
-	#  line in the 'authenticate' section.
-#	digest
-
-	#
-	#  Look for IPASS style 'realm/', and if not found, look for
-	#  '@realm', and decide whether or not to proxy, based on
-	#  that.
-#	IPASS
-
-	#
-	#  If you are using multiple kinds of realms, you probably
-	#  want to set "ignore_null = yes" for all of them.
-	#  Otherwise, when the first style of realm doesn't match,
-	#  the other styles won't be checked.
-	#
-	suffix
-#	ntdomain
-
-	#
-	#  This module takes care of EAP-MD5, EAP-TLS, and EAP-LEAP
-	#  authentication.
-	#
-	#  It also sets the EAP-Type attribute in the request
-	#  attribute list to the EAP type from the packet.
-
-	#
-	#  Read the 'users' file
-	files
-
-	#
-	#  Look in an SQL database.  The schema of the database
-	#  is meant to mirror the "users" file.
-	#
-	#  See "Authorization Queries" in sql.conf
-#	sql
-
-	#
-	#  If you are using /etc/smbpasswd, and are also doing
-	#  mschap authentication, the un-comment this line, and
-	#  configure the 'etc_smbpasswd' module, above.
-#	etc_smbpasswd
-
-	#
-	#  The ldap module will set Auth-Type to LDAP if it has not
-	#  already been set
-	ldap
-
-	#
-	#  Enforce daily limits on time spent logged in.
-#	daily
-
-	#
-	# Use the checkval module
-#	checkval
-}
-
-
-#  Authentication.
-#
-#
-#  This section lists which modules are available for authentication.
-#  Note that it does NOT mean 'try each module in order'.  It means
-#  that a module from the 'authorize' section adds a configuration
-#  attribute 'Auth-Type := FOO'.  That authentication type is then
-#  used to pick the apropriate module from the list below.
-#
-
-#  In general, you SHOULD NOT set the Auth-Type attribute.  The server
-#  will figure it out on its own, and will do the right thing.  The
-#  most common side effect of erroneously setting the Auth-Type
-#  attribute is that one authentication method will work, but the
-#  others will not.
-#
-#  The common reasons to set the Auth-Type attribute by hand
-#  is to either forcibly reject the user, or forcibly accept him.
-#
-authenticate {
-	#
-	#  PAP authentication, when a back-end database listed
-	#  in the 'authorize' section supplies a password.  The
-	#  password can be clear-text, or encrypted.
-	Auth-Type PAP {
-		pap
-	}
-
-	#
-	#  Most people want CHAP authentication
-	#  A back-end database listed in the 'authorize' section
-	#  MUST supply a CLEAR TEXT password.  Encrypted passwords
-	#  won't work.
-	Auth-Type CHAP {
-		chap
-	}
-
-	#
-	#  MSCHAP authentication.
-	Auth-Type MS-CHAP {
-		mschap
-	}
-
-	#
-	#  If you have a Cisco SIP server authenticating against
-	#  FreeRADIUS, uncomment the following line, and the 'digest'
-	#  line in the 'authorize' section.
-#	digest
-
-	#
-	#  Pluggable Authentication Modules.
-#	pam
-
-	#
-	#  See 'man getpwent' for information on how the 'unix'
-	#  module checks the users password.  Note that packets
-	#  containing CHAP-Password attributes CANNOT be authenticated
-	#  against /etc/passwd!  See the FAQ for details.
-	#  
-	unix
-
-	# Uncomment it if you want to use ldap for authentication
-	#
-	# Note that this means "check plain-text password against
-	# the ldap database", which means that EAP won't work,
-	# as it does not supply a plain-text password.
-	Auth-Type LDAP {
-		ldap
-	}
-
-	#
-	#  Allow EAP authentication.
-}
-
-
-#
-#  Pre-accounting.  Decide which accounting type to use.
-#
-preacct {
-	preprocess
-
-	#
-	#  Ensure that we have a semi-unique identifier for every
-	#  request, and many NAS boxes are broken.
-	acct_unique
-
-	#
-	#  Look for IPASS-style 'realm/', and if not found, look for
-	#  '@realm', and decide whether or not to proxy, based on
-	#  that.
-	#
-	#  Accounting requests are generally proxied to the same
-	#  home server as authentication requests.
-#	IPASS
-	suffix
-#	ntdomain
-
-	#
-	#  Read the 'acct_users' file
-	files
-}
-
-#
-#  Accounting.  Log the accounting data.
-#
-accounting {
-	#
-	#  Create a 'detail'ed log of the packets.
-	#  Note that accounting requests which are proxied
-	#  are also logged in the detail file.
-	detail
-#	daily
-
-	#  Update the wtmp file
-	#
-	#  If you don't use "radlast", you can delete this line.
-	unix
-
-	#
-	#  For Simultaneous-Use tracking.
-	#
-	#  Due to packet losses in the network, the data here
-	#  may be incorrect.  There is little we can do about it.
-	radutmp
-#	sradutmp
-
-	#  Return an address to the IP Pool when we see a stop record.
-#	main_pool
-
-	#
-	#  Log traffic to an SQL database.
-	#
-	#  See "Accounting queries" in sql.conf
-#	sql
-
-	#
-	#  Instead of sending the query to the SQL server,
-	#  write it into a log file.
-	#
-#	sql_log
-
-	#  Cisco VoIP specific bulk accounting
-#	pgsql-voip
-
-}
-
-
-#  Session database, used for checking Simultaneous-Use. Either the radutmp 
-#  or rlm_sql module can handle this.
-#  The rlm_sql module is *much* faster
-session {
-	radutmp
-
-	#
-	#  See "Simultaneous Use Checking Querie" in sql.conf
-#	sql
-}
-
-
-#  Post-Authentication
-#  Once we KNOW that the user has been authenticated, there are
-#  additional steps we can take.
-post-auth {
-	#  Get an address from the IP Pool.
-#	main_pool
-
-	#
-	#  If you want to have a log of authentication replies,
-	#  un-comment the following line, and the 'detail reply_log'
-	#  section, above.
-#	reply_log
-
-	#
-	#  After authenticating the user, do another SQL query.
-	#
-	#  See "Authentication Logging Queries" in sql.conf
-#	sql
-
-	#
-	#  Instead of sending the query to the SQL server,
-	#  write it into a log file.
-	#
-#	sql_log
-
-	#
-	#  Un-comment the following if you have set
-	#  'edir_account_policy_check = yes' in the ldap module sub-section of
-	#  the 'modules' section.
-	#
-#	ldap
-	#
-	#  Access-Reject packets are sent through the REJECT sub-section of the
-	#  post-auth section.
-	#  Uncomment the following and set the module name to the ldap instance
-	#  name if you have set 'edir_account_policy_check = yes' in the ldap
-	#  module sub-section of the 'modules' section.
-	#
-#	Post-Auth-Type REJECT {
-#		insert-module-name-here
-#	}
-
-}
-
-#
-#  When the server decides to proxy a request to a home server,
-#  the proxied request is first passed through the pre-proxy
-#  stage.  This stage can re-write the request, or decide to
-#  cancel the proxy.
-#
-#  Only a few modules currently have this method.
-#
-pre-proxy {
-#	attr_rewrite
-
-	#  Uncomment the following line if you want to change attributes
-	#  as defined in the preproxy_users file.
-#	files
-
-	#  If you want to have a log of packets proxied to a home
-	#  server, un-comment the following line, and the
-	#  'detail pre_proxy_log' section, above.
-#	pre_proxy_log
-}
-
-#
-#  When the server receives a reply to a request it proxied
-#  to a home server, the request may be massaged here, in the
-#  post-proxy stage.
-#
-post-proxy {
-
-	#  If you want to have a log of replies from a home server,
-	#  un-comment the following line, and the 'detail post_proxy_log'
-	#  section, above.
-#	post_proxy_log
-
-#	attr_rewrite
-
-	#  Uncomment the following line if you want to filter replies from
-	#  remote proxies based on the rules defined in the 'attrs' file.
-
-#	attr_filter
-
-	#
-	#  If you are proxying LEAP, you MUST configure the EAP
-	#  module, and you MUST list it here, in the post-proxy
-	#  stage.
-	#
-	#  You MUST also use the 'nostrip' option in the 'realm'
-	#  configuration.  Otherwise, the User-Name attribute
-	#  in the proxied request will not match the user name
-	#  hidden inside of the EAP packet, and the end server will
-	#  reject the EAP request.
-	#
-}
Index: npl/commonservers/radius/raddb/realms
===================================================================
--- npl/commonservers/radius/raddb/realms	(revision 010568537c6a24bc6e83a1a5814a6f87df3223f6)
+++ 	(revision )
@@ -1,7 +1,0 @@
-#
-#	THIS FILE IS DEPRECATED.
-#
-#	You should NOT be using this file to configure the server.
-#	It is here ONLY for backwards compatibility.
-#
-#	See 'proxy.conf' for the new configuration.
Index: npl/commonservers/radius/raddb/snmp.conf
===================================================================
--- npl/commonservers/radius/raddb/snmp.conf	(revision 010568537c6a24bc6e83a1a5814a6f87df3223f6)
+++ 	(revision )
@@ -1,48 +1,0 @@
-#
-# snmp.conf - snmp configuration directives
-#
-# This file is *NOT* included by default.  To enable it, you will need
-# to modify the SNMP CONFIGURATION section of "radiusd.conf".
-#
-#######################################################################
-
-#######################################################################
-#
-#  SNMP configuration
-#
-#  NOTE: This part is only working if your radiusd is compiled with SNMP
-#  support.
-#
-#  smux_password: Password used for SMUX registration.
-#
-#  Specifies password used when connecting to the SNMP master agent.
-#  This must match the password as configured on the agent. The OID
-#  used to register the radius subagent is 1.3.6.1.4.1.3317.1.3.1.
-#  A sample entry for the ucd-snmp deamon looks like this:
-#
-#  smuxpeer .1.3.6.1.4.1.3317.1.3.1 verysecret
-#
-#  A sample entry for AIX 4.3 is:
-#
-#  smux 1.3.6.1.4.1.3317.1.3.1 verysecret
-#
-#  The default password is an empty password.
-#
-#smux_password = verysecret
-
-#
-#  snmp_write_access:
-#
-#  Controls if write access to the radiusd via SNMP is enabled or not.
-#  Set this value to yes, if you want to be able to reload radiusd from
-#  your network management station.
-#
-#  For this to work, you also have to make sure that your master agent
-#  is configured to allow SNMP set requests. For security reasons, this
-#  setting defaults to no.
-#
-# allowed values: {no, yes}
-#
-#snmp_write_access = yes
-
-
Index: npl/commonservers/radius/radius.SlackBuild
===================================================================
--- npl/commonservers/radius/radius.SlackBuild	(revision 010568537c6a24bc6e83a1a5814a6f87df3223f6)
+++ npl/commonservers/radius/radius.SlackBuild	(revision 749056afe40faf03739819a1fd5144c01a39367a)
@@ -13,7 +13,6 @@
 mkdir -p $PKG
 
-VERSION=2.2.9
+VERSION=2.2.10
 ARCH=${ARCH:-i486}
-BUILD=1DatuX
 NAME=radius
 
@@ -21,5 +20,5 @@
 cd $TMP
 
-tar xjvf $CWD/freeradius-server-$VERSION.tar.bz2 || exit 1
+tar xvf $CWD/freeradius-server-$VERSION.tar.gz || exit 1
 cd freeradius-server-$VERSION || exit 1
 echo "Uitvoeren van configure..." &&
@@ -29,45 +28,11 @@
  --sbindir=/usr/sbin \
  --libdir=/usr/lib \
- --libexecdir=/usr/sbin || exit 1										
-make  || exit 1 
+ --libexecdir=/usr/sbin || exit 1
+make  || exit 1
 make  R="${PKG}" install || exit 1
 
-#deamontools zooi fixxen
-mkdir -p $PKG/service/radius
-cat << EOF > $PKG/service/radius/run
-#!/bin/sh
-# LDAP Settings.
-LDAPPASSWD="\`cat /etc/webint/LDAP_MASTER_PASSWD\`"
-cat /home/system/radius/raddb/radiusd.conf | sed 's/^\t\tpassword = .*/\t\tpassword = '\$LDAPPASSWD'/' >> /home/system/radius/raddb/radiusd.conf-new
-if [ -s /home/system/radius/raddb/radiusd.conf-new ]; then
-mv /home/system/radius/raddb/radiusd.conf-new /home/system/radius/raddb/radiusd.conf
-fi
-exec /usr/sbin/radiusd -f -l /var/log/radius/radius.log
-EOF
-chmod +x $PKG/service/radius/run
 
-# En uiteraard mag de vette postinstall niet ontbreken.
-mkdir -p $PKG/etc/postinst.d/
-cp $CWD/post.radius $PKG/etc/postinst.d/post.radius
-chmod +x $PKG/etc/postinst.d/post.radius || exit 1
-
-#aangepaste configfiles op plek zetten
-rm -rf $PKG/home/system/radius/raddb || exit 1
-mkdir -p $PKG/home/system/radius/raddb || exit 1
-cp -R $CWD/raddb $PKG/home/system/radius/ || exit 1
-
-#logrotate fixxen voor de logfiles
-mkdir -p $PKG/etc/logrotate.d
-cat <<EOF > $PKG/etc/logrotate.d/radius
-/var/log/radius/radius.log {
-    weekly
-    rotate 4
-    copytruncate
-    compress
-    notifempty
-    missingok
-}
-EOF
-chmod 644 $PKG/etc/logrotate.d/radius	  
+### config stuff is in seperate package
+rm -rf $PKG/home
 
 
@@ -85,5 +50,2 @@
 #make main package
 syn3_makepkg /tmp/pkg $NAME $VER $ARCH || exit 1
-
-
-
Index: npl/commonservers/radius/radius.build
===================================================================
--- npl/commonservers/radius/radius.build	(revision 010568537c6a24bc6e83a1a5814a6f87df3223f6)
+++ npl/commonservers/radius/radius.build	(revision 749056afe40faf03739819a1fd5144c01a39367a)
@@ -1,1 +1,1 @@
-6526
+6528
Index: npl/commonservers/radius/radius.check
===================================================================
--- npl/commonservers/radius/radius.check	(revision 010568537c6a24bc6e83a1a5814a6f87df3223f6)
+++ 	(revision )
@@ -1,3 +1,0 @@
-#!/bin/bash
-lynx -dump "ftp://ftp.freeradius.org/pub/freeradius/"
-
Index: npl/commonservers/radius/radius.md5
===================================================================
--- npl/commonservers/radius/radius.md5	(revision 010568537c6a24bc6e83a1a5814a6f87df3223f6)
+++ npl/commonservers/radius/radius.md5	(revision 749056afe40faf03739819a1fd5144c01a39367a)
@@ -1,21 +1,5 @@
-d1398327ba4e23c75da06d8a0e01096b  ./freeradius-server-2.2.9.tar.bz2
-aacd8d36f4acd946521215e491551b0d  ./post.radius
-602c3c8baf57abf04433843b251b21c9  ./raddb/acct_users
-24958dbed540952e6522a135ccf8f500  ./raddb/attrs
-ea7a327c39e9e35c6b2be287cc48f535  ./raddb/clients
-6aa242ad9a63c4eee8f3e688875f14f5  ./raddb/clients.conf
-eef27703f10def7a7ed60e8455e75a38  ./raddb/dictionary
-c8e1968891c82f8131f44c1d3e203257  ./raddb/hints
-2621bb91a534b66f16d517d8ea80585a  ./raddb/huntgroups
-d1163ef7b4d22dc85c90c4cf6896b8b4  ./raddb/ldap.attrmap
-63608ee9c237a5cc112b291dc407b895  ./raddb/mssql.conf
-067ed8b5f055750776a10de804fc377c  ./raddb/preproxy_users
-c7e7b2abd223328a75f43b2236279ed4  ./raddb/proxy.conf
-877b630e0eb08740ef01745000e3b457  ./raddb/radiusd.conf
-acf1740a4df53b70c80a89af061fc690  ./raddb/realms
-f1ee1316b33c26797cba1f1966e8e932  ./raddb/snmp.conf
-d41d8cd98f00b204e9800998ecf8427e  ./raddb/users
-f5405f164de313791721f1c74dcf3871  ./radius_dev.pkg
-9ddb85744cd6c4b4af99f4dd62b0a244  ./radius.pkg
-be865e2d8b513dca879fbe7c27b73718  ./radius.SlackBuild
-01a3862a402a7d1bb75de7f9651b9ec8  ./radius.SlackBuild.log.gz
+8273e27778e6f39022b93f7ee459cd28  ./freeradius-server-2.2.10.tar.gz
+084afec3567dc8682de04f81cf5ad43c  ./radius_dev.pkg
+59ce872b32527e7a64624ed9c3bc7077  ./radius.pkg
+e3bafec8459e3b553c63821c35cb579f  ./radius.SlackBuild
+eb2f3712eb2d44170f2c25b543a88ea5  ./radius.SlackBuild.log.gz
Index: npl/commonservers/radius/radius.version
===================================================================
--- npl/commonservers/radius/radius.version	(revision 010568537c6a24bc6e83a1a5814a6f87df3223f6)
+++ npl/commonservers/radius/radius.version	(revision 749056afe40faf03739819a1fd5144c01a39367a)
@@ -1,1 +1,1 @@
-2.2.9
+2.2.10
Index: npl/commonservers/radius/radius_dev.build
===================================================================
--- npl/commonservers/radius/radius_dev.build	(revision 010568537c6a24bc6e83a1a5814a6f87df3223f6)
+++ npl/commonservers/radius/radius_dev.build	(revision 749056afe40faf03739819a1fd5144c01a39367a)
@@ -1,1 +1,1 @@
-6526
+6528
Index: npl/commonservers/radius/radius_dev.version
===================================================================
--- npl/commonservers/radius/radius_dev.version	(revision 010568537c6a24bc6e83a1a5814a6f87df3223f6)
+++ npl/commonservers/radius/radius_dev.version	(revision 749056afe40faf03739819a1fd5144c01a39367a)
@@ -1,1 +1,1 @@
-2.2.9
+2.2.10
