- Freeradius-Users - lists.freeradius.org

Minor tags behaviour change
by Arran Cudbard-Bell 23 May '14

23 May '14

Hi All, Just a heads up for anyone tags. From 3.0.4 onwards in unlang <attr>:0 will be taken to mean operate only on attributes with no tag value set. If no tag specifier is used i.e. <attr> or &<attr> it's taken to mean operate on all instances of <attr> regardless of tag value. Previous behaviour was inconsistent and in some cases <attr>:0 was treated the same as <attr>. I highly doubt anyone was using <attr>:0 to select untagged attributes previously, so this shouldn't be a disruptive change. If you weren't aware, we now also support deleting attributes by index and/or tag. update request { Tunnel-Server-Endpoint:1[1] !* ANY } Will remove the second Tunnel-Server-Endpoint attributes with a tag of 1. update request { Tunnel-Server-Endpoint:1 -= 'foo' } Will remove any Tunnel-Server-Endpoint attributes with a tag of 1 which have a value of 'foo'. With 3.0.4 radius_map2request was changed to allow it to operate on multiple values. You won't see any change in normal unlang behaviour, but it does allow some extra special magic when using LDAP. For example if you have multiple instances of the same ldap attribute: naughtyWords: foo naughtyWords: bar naughtyWords: baz and you did ldap { update { reply:Reply-Message -= 'naughtyWords' } } It would remove any Reply-Message which had a value matching any one of the LDAP naughtyWords, just as: ldap { update { reply:Chargeable-User-Identity += 'naughtyWords' } } Would add multiple Chargeable-User-Identity attributes. There's some slight weirdness with this, if you do: ldap { update { reply:Reply-Message := 'naughtyWords' } } Reply-Message will actually be set to baz. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

2 2

New RHEL and Fedora package maintainer
by Nikolai Kondrashov 23 May '14

23 May '14

Hi everyone, My name is Nikolai Kondrashov (Nick for short, aka spbnick) and I'm the new maintainer of FreeRADIUS packages for RHEL and Fedora, replacing John Dennis. I have actually started about mid-February, but was mostly learning and then had a string of colds, which kept me from working. John was and hopefully will be assisting me in learning further. In addition to being the package maintainer, I'll also participate in SSSD [1] development and will continue maintaining my DIGImend [2] project, when time allows. You can find my working background on LinkedIn [3]. I'd like to ask both users and the development team what you would like to see from Fedora and RHEL packaging of FreeRADIUS and from me as a maintainer. Please voice any concerns or suggestions you have and I will try to address them. Thank you. Nick [1] https://fedorahosted.org/sssd/ [2] http://digimend.sourceforge.net/ [3] https://www.linkedin.com/in/spbnick

7 16

User-Name case insensitive, spaces - freeradius 2.1.12
by Bruno Correia 23 May '14

23 May '14

Hi all, Usage freeradius 2.1.2 and i'm with problems about username authentication. Simply authentication accept any variations of the same username. Example: Register user: "var" Is accept: "Var" "vAr" "vaR" VaR" "VAr" "vAR" "var " ... This ends "bypassing" the blockage i do for multiple sessions with the same user. ( attribute Simultaneous-Use ) I noticed that the file */**path/freeradius/policy.conf* have the function with filters if to solve problem, but not function. The unique that works is filter space start. filter_username { # spaces at the start: reject if (User-Name =~ /^ /) { reject } * # spaces at the end: reject** ** if (User-Name =~ / $$/) {** ** reject** ** }* *# Mixed case: reject** ** if (User-Name != "%{tolower:%{User-Name}}") {** ** reject** ** }* } Appreciate the help. -- * * **Bruno G Correia** Analista de Redes <http://br.linkedin.com/in/brunocorr> (83) 8812-2235 (83) 9862-0224

2 3

RE: Subject: Package availability question
by Mike Poole 23 May '14

23 May '14

Debian Wheezy would be greatly appreciated if possible. We are stuck at 2.1.12 unless we can get an enterprise change to Ubuntu. Message: 1 Date: Fri, 23 May 2014 12:35:02 -0400 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Package availability question Message-ID: <537F78B6.2030803(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Nikolai Kondrashov wrote: > Unfortunately, I'm not able to provide builds outside the standard > channels, i.e. RHEL and Fedora repos. For everyone else, there is interest in packages, please let us know. We may be able to start an official "freeradius" repository. It could have packages for pretty much all common distributions. Alan DeKok. ------------------------------

1 0

Using FreeRadius to coordinate access to cisco routers based on time
by Frank Cui 23 May '14

23 May '14

Hi Radius People, I'm a new user on FreeRadius and recently considering using FreeRadius version 2 in our environment. Basically we are an education/training environment where we have some students accessing the routers and switches for practise, terminal server are used to consolidate the console access, and these terminal servers authenticate the users through a Radius server (as shown in the following figure). Additionally, the students are categorized into few groups. We want to implement policy on the radius server so that only a certain group can access the pod in a given duration of time (the user should be dropped from the terminal when the subscribed time is reached and cannot access thereafter .) +++++++++++++++ +++++++++++++++ ++++++++++++++ User +++++++++++++++++++++ Cisco 2600 +++++++++++++++++++ Network ++ + + Terminal Serv + + Devices ++++++++++++++++ +++++++++++++++ +++++++++++++ (NAS) + + +++++++++++++++ + FreeRadius + +++++++++++++++ Right now I'm able to do the "hello-world" setup with the following users and clients.conf. On the terminal server side, aaa new-model is enabled on the cisco terminal server to communicate with this radius server. users=============cisco Auth-Type := System Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" clients.conf==============client 192.168.1.1 { secret = SECRET_KEY shortname = termserver nastype = cisco} A typical transaction would be : Access-Request======= NAS-IP-Address = 192.168.1.1 NAS-Port = 35 NAS-Port-Type = Async User-Name = "cisco" Calling-Station-Id = "1.1.1.1" User-Password = "cisco" Access-Accept======= Service-Type = NAS-Prompt-User Cisco-AVPair = "shell:priv-lvl=15" However, this doesn't really provide any timing or grouping policy. Could you please provide some hints on how typically the timing limits are enforced with the freeradius and cisco terminal server? Thanks a lot in advance. ThanksFrank

2 5

FreeRADIUS 3.0.3: radtest with eap-md5
by Axel Luttgens 23 May '14

23 May '14

Hello, IIRC, I've seen somewhere some recent changes in FR 3's code due to bring back a working radeapclient. I thus tried: $ ./radtest -x -t eap-md5 bob hello 127.0.0.1 0 testing123 with FR 3.0.3, and just got following output: including dictionary file /Tests/freeradius-3.0.3-p1/share/freeradius/dictionary including dictionary file /Tests/etc/raddb/dictionary No single attempt to connect to the server seems to occur, since the output of radiusd -X remains desperately silent... On the other hand, eapol_test works as expected: $ ./eapol_test -c /Tests/etc/eap-md5.conf -s testing123 -n [...] MPPE keys OK: 0 mismatch: 0 SUCCESS with corresponding debugging info written by radiusd. Could it be that I'm doing something wrong? (hint: I often do) TIA, Axel

2 2

Wild Card GoDaddy cert
by Ryan De Kock 23 May '14

23 May '14

Hi, I have a wildcard cert from godaddy.com. I have tested the cert on Microsoft NPS & IAS and it works fine. I'm sure it will work in freeradius too, however I can't figure it out. I have godaddy.crt bundl.e.crt & godaddy.key. I have added these to freeradius however it does work. This is what windows does when I don't validate certificates [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 37 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Alert [length 0002], fatal access_denied TLS Alert read:fatal:access denied [peap] WARNING: No data inside of the tunnel. [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state ? [peap] FAILED processing PEAP: Tunneled data is invalid. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. } # server Cerebus This is a successfull auth on my linux client [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] returns ok tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_file = ${certdir}/godaddy.key certificate_file = ${certdir}/godaddy.crt dh_file = ${certdir}/dh random_file = ${certdir}/random } So Im not sure if its got to do with no using the cert chain or what I'm doing wrong but would appreciate any guidance

3 2

EAP, Cleartext-Password & rlm_perl
by Ryan De Kock 23 May '14

23 May '14

Hi, I'm trying to get the cleartext-password so that I can authenticate PEAP users via sql using my schema and run the current checks etc that I do. Current config is like this peap { default_eap_type = gtc copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } gtc { auth_type = PAP } default_eap_type = peap authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } eap dot1x #Perl script } when I run radius in debug i see this ++[pap] returns noop rlm_perl: PERL USERNAME bob rlm_perl: PERL PASSWORD rlm_perl: Added pair User-Name = bob rlm_perl: Added pair EAP-Message = 0x0209003e1a0209003931530ee491420e92dc30f422120c9b847d0000000000000000ce9f9b75dd8a20d8099c9e4458d6e8ffcd192f39189c1ed900626f62 rlm_perl: Added pair EAP-Type = MS-CHAP-V2 rlm_perl: Added pair State = 0x644e622a654778ceff71975630b5ff5d rlm_perl: Added pair FreeRADIUS-Proxied-To = 127.0.0.1 rlm_perl: Added pair Cleartext-Password = hello rlm_perl: Added pair Auth-Type = EAP rlm_perl: Added pair Proxy-To-Realm = LOCAL So the perl script has access to "Cleartext-Password" thanks to GTC I think but I cant log it in perl. The script literally only does this currently &radiusd::radlog(1,"PERL USERNAME " . $RAD_REQUEST{'User-Name'}); &radiusd::radlog(1,"PERL PASSWORD " . $RAD_REQUEST{'Cleartext-Password'}); How can I get the Cleartext-Password in rlm_perl?

4 5

FreeRADIUS, OpenLDAP and F5 VSAs
by Ajinkya Fotedar 23 May '14

23 May '14

Hi, I am trying to send F5 vendor-specific attributes in the Access-Accept packet. When freeradius (ldap module) searches and finds a specific user in openldap, It processes the user's attributes and adds them to the control list. One of the attributes specifies the group that user account belongs to. The next step is to find that user in the specified group, which is successful. Only this time, there are some F5 VSAs that are not getting added to the reply list. When I pass those VSAs in the Access-Accept packet, I see them as Attr-26 = 0x00000d2f I have read the rlm_ldap and related documentation on the wiki. I am not sure why I don't see the value of F5 VSAs in the reply as I can definitely process the attributes defined for a user account under the People subtree. Below is the debug output and some configuration. Can anyone point me to the right direction. Thank you. *RADIUS debug* Ready to process requests. rad_recv: Access-Request packet from host 198.82.169.55 port 52634, id=78, length=132 User-Name = 'dawson' NAS-IP-Address = 198.82.169.55 NAS-Port = 234234 Message-Authenticator = 0x9552e405f519c05100b3510ad97bcec0 MS-CHAP-Challenge = 0x9dcbb5409eb06d58 MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000dcc9a916ce5fc5419b592ba3be3e116831d411dc6e454c81 (0) # Executing section authorize from file /apps/home/radius/freeradius/load-balancing/etc/raddb/sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) ? if (User-Name != "%{tolower:%{User-Name}}") (0) expand: "%{tolower:%{User-Name}}" -> 'dawson' (0) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (0) ? if (User-Name =~ / /) (0) ? if (User-Name =~ / /) -> FALSE (0) ? if (User-Name =~ /@.*@/ ) (0) ? if (User-Name =~ /@.*@/ ) -> FALSE (0) ? if (User-Name =~ /\\.\\./ ) (0) ? if (User-Name =~ /\\.\\./ ) -> FALSE (0) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (0) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) ? if (User-Name =~ /\\.$/) (0) ? if (User-Name =~ /\\.$/) -> FALSE (0) ? if (User-Name =~ /(a)\\./) (0) ? if (User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [preprocess] = ok (0) auth_log : expand: "/apps/home/radius/freeradius/load-balancing/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" -> '/apps/home/radius/freeradius/load-balancing/var/log/radius/radacct/ 198.82.169.55/auth-detail-20140519' (0) auth_log : /apps/home/radius/freeradius/load-balancing/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /apps/home/radius/freeradius/load-balancing/var/log/radius/radacct/ 198.82.169.55/auth-detail-20140519 (0) auth_log : expand: "%t" -> 'Mon May 19 14:55:25 2014' (0) [auth_log] = ok (0) update control { (0) expand: "uid=%{User-Name},ou=People,ou=NIS,o=vt" -> 'uid=dawson,ou=People,ou=NIS,o=vt' (0) Ldap-UserDn := "uid=dawson,ou=People,ou=NIS,o=vt" (0) } # update control = noop rlm_ldap (ldap): Reserved connection (4) (0) ldap : expand: "(&(uid=%{%{Stripped-User-Name}:-%{User-Name}}))" -> '(&(uid=dawson))' (0) ldap : expand: "ou=People,ou=NIS,o=vt" -> 'ou=People,ou=NIS,o=vt' (0) ldap : Performing search in 'ou=People,ou=NIS,o=vt' with filter '(&(uid=dawson))' (0) ldap : Waiting for search result... (0) ldap : User object found at DN "uid=dawson,ou=People,ou=NIS,o=vt" (0) ldap : Processing user attributes (0) ldap : control:Password-With-Header += '{nt}D3055AE4C0D68D8BA71C538D1518B5CD' (0) ldap : control:Password-With-Header += '{SSHA}omkfyFmnMrEq1jWG9T86Gh+XlpR87z11' (0) ldap : control:Prohibited := FALSE (0) ldap : control:Group-Membership := 'cn=R&D,ou=Groups,ou=F5,ou=Configuration,ou=NIS,o=vt' (0) ldap : control:Group-Membership := 'cn=TLOS,ou=Groups,ou=F5,ou=Configuration,ou=NIS,o=vt' rlm_ldap (ldap): Released connection (4) (0) [-ldap] = ok (0) pap : Normalizing NT-Password from hex encoding (0) pap : Normalizing SSHA1-Password from base64 encoding (0) pap : No clear-text password in the request. Not performing PAP. (0) [pap] = noop (0) mschap : Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (0) [mschap] = ok (0) ? if (!(control:NT-Password) || control:Prohibited == TRUE) (0) ? if (!(control:NT-Password) || control:Prohibited == TRUE) -> FALSE (0) ? if (Ldap-Group != "%{control:Group-Membership}") (0) expand: "%{control:Group-Membership}" -> 'cn=R&D,ou=Groups,ou=F5,ou=Configuration,ou=NIS,o=vt' (0) Searching for user in group "cn=R&D,ou=Groups,ou=F5,ou=Configuration,ou=NIS,o=vt" rlm_ldap (ldap): Reserved connection (4) (0) Using user DN from request "uid=dawson,ou=People,ou=NIS,o=vt" (0) Checking for user in group objects (0) expand: "(&(objectClass=f5Group)(member=%{control:Ldap-UserDn}))" -> '(&(objectClass=f5Group)(member=uid\3ddawson\2cou\3dPeople\2cou\3dNIS\2co\3dvt))' (0) Performing search in 'cn=R&D,ou=Groups,ou=F5,ou=Configuration,ou=NIS,o=vt' with filter '(&(objectClass=f5Group)(member=uid\3ddawson\2cou\3dPeople\2cou\3dNIS\2co\3dvt))' (0) Waiting for search result... (0) User found in group object rlm_ldap (ldap): Released connection (4) (0) ? if (Ldap-Group != "%{control:Group-Membership}") -> FALSE (0) else else { (0) update reply { (0) expand: "%{reply:F5-LTM-User-Info-1}" -> '' (0) F5-LTM-User-Info-1 := "" (0) expand: "%{reply:F5-LTM-User-Role}" -> '' (0) F5-LTM-User-Role := Administrator (0) expand: "%{reply:F5-LTM-User-Partition}" -> '' (0) F5-LTM-User-Partition := "" (0) expand: "%{reply:F5-LTM-User-Shell}" -> '' (0) F5-LTM-User-Shell := "" (0) } # update reply = noop (0) } # else else = noop (0) ? if ("%{reply:F5-LTM-User-Info-1}") (0) expand: "%{reply:F5-LTM-User-Info-1}" -> '' (0) ? if ("%{reply:F5-LTM-User-Info-1}") -> FALSE (0) } # authorize = ok (0) Found Auth-Type = MSCHAP (0) # Executing group from file /apps/home/radius/freeradius/load-balancing/etc/raddb/sites-enabled/default (0) authenticate { (0) mschap : No Cleartext-Password configured. Cannot create LM-Password (0) mschap : Found NT-Password (0) mschap : Client is using MS-CHAPv1 with NT-Password (0) mschap : adding MS-CHAPv1 MPPE keys (0) [mschap] = ok (0) } # authenticate = ok (0) WARNING: Empty post-auth section. Using default return values. (0) # Executing section post-auth from file /apps/home/radius/freeradius/load-balancing/etc/raddb/sites-enabled/default Sending Access-Accept of id 78 from 198.82.169.55 port 1830 to 198.82.169.55 port 52634 F5-LTM-User-Info-1 = '' F5-LTM-User-Role = Administrator F5-LTM-User-Partition = '' F5-LTM-User-Shell = '' MS-CHAP-MPPE-Keys = 0x0000000000000000122d083be857e0cf1f5c975f5efd01cc0000000000000000 MS-MPPE-Encryption-Policy = Encryption-Allowed MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (0) Finished request 0. Waking up in 0.3 seconds. Waking up in 4.6 seconds. *radtest* $ radtest -t mschap -x dawson wakkawakka 198.82.169.55:1830 234234 testing123 /apps/radius/freeradius-3.0.1/bin/radclient: /usr/local/samba/lib/libtalloc.so.2: no version information available (required by /apps/radius/freeradius-3.0.1/bin/radclient) /apps/radius/freeradius-3.0.1/bin/radclient: /usr/local/samba/lib/libtalloc.so.2: no version information available (required by /apps/radius/freeradius-3.0.1/lib/libfreeradius-radius.so) Sending Access-Request of id 78 from 0.0.0.0 port 52634 to 198.82.169.55 port 1830 User-Name = 'dawson' NAS-IP-Address = 198.82.169.55 NAS-Port = 234234 Message-Authenticator = 0x00 MS-CHAP-Challenge = 0x9dcbb5409eb06d58 MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000dcc9a916ce5fc5419b592ba3be3e116831d411dc6e454c81 Code: 1 Id: 78 Length: 132 Vector: 1e35220367d4329bdebec2d38afe7fd6 Data: 01 08 64 61 77 73 6f 6e 04 06 c6 52 a9 37 05 06 00 03 92 fa 50 12 95 52 e4 05 f5 19 c0 51 00 b3 51 0a d9 7b ce c0 1a 10 00 00 01 37 0b 0a 9d cb b5 40 9e b0 6d 58 1a 3a 00 00 01 37 01 34 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc c9 a9 16 ce 5f c5 41 9b 59 2b a3 be 3e 11 68 31 d4 11 dc 6e 45 4c 81 rad_recv: Access-Accept packet from host 198.82.169.55 port 1830, id=78, length=114 Code: 2 Id: 78 Length: 114 Vector: e1389574bdb00555d937ba3d5fac91d7 Data: 1a 06 00 00 0d 2f 1a 0c 00 00 0d 2f 01 06 00 00 00 00 1a 06 00 00 0d 2f 1a 06 00 00 0d 2f 1a 28 00 00 01 37 0c 22 1d 16 9c ca 93 1c 0f eb 35 cd 73 0b ac 58 5c 61 81 2a d8 a6 81 3e bb 70 4a ce 98 0e d8 d5 d9 d3 1a 0c 00 00 01 37 07 06 00 00 00 01 1a 0c 00 00 01 37 08 06 00 00 00 06 Attr-26 = 0x00000d2f F5-LTM-User-Role = Administrator Attr-26 = 0x00000d2f Attr-26 = 0x00000d2f MS-CHAP-MPPE-Keys = 0x MS-MPPE-Encryption-Policy = Encryption-Allowed MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed *LDAP module* user { base_dn = "ou=People,${..base_dn}" filter = "(&(uid=%{%{Stripped-User-Name}:-%{User-Name}}))" scope = 'sub' } group { base_dn = "ou=Groups,ou=F5,ou=Configuration,${..base_dn}" filter = "(objectClass=f5Group)" scope = 'base' name_attribute = cn membership_filter = "(member=%{control:Ldap-UserDn})" } *Default server* authorize { filter_username preprocess auth_log update control{ Ldap-UserDn := "uid=%{User-Name},ou=People,ou=NIS,o=vt" } -ldap pap mschap #Invalid People if(!(control:NT-Password) || control:Prohibited == TRUE){ update control{ Auth-Type := Reject } } #"%{control:Group-Membership}" if(Ldap-Group != "%{control:Group-Membership}"){ update control{ Auth-Type:=Reject } } else{ update reply{ F5-LTM-User-Info-1 := "%{reply:F5-LTM-User-Info-1}" F5-LTM-User-Role := "%{reply:F5-LTM-User-Role}" F5-LTM-User-Partition := "%{reply:F5-LTM-User-Partition}" F5-LTM-User-Shell := "%{reply:F5-LTM-User-Shell}" } } } authenticate { mschap pap } *OpenLDAP Entries* # dawson, People, NIS, vt dn: uid=dawson,ou=People,ou=NIS,o=vt cn: Jacob M. Dawson uid: dawson sn: Dawson givenName: Jacob groupMembership: cn=R&D,ou=Groups,ou=F5,ou=Configuration,ou=NIS,o=vt prohibited: FALSE objectClass: inetOrgPerson objectClass: nisUserAccount # R&D, Groups, F5, Configuration, NIS, vt dn: cn=R&D,ou=Groups,ou=F5,ou=Configuration,ou=NIS,o=vt cn: R&D description: Entiries for the R&D group user accounts userInfo: R&D userPartition: RnD userRole: 100 userShell: tmsh member: uid=dawson,ou=People,ou=NIS,o=vt objectClass: f5Group objectClass: groupOfNames

3 7

radiusReplyItem attribute
by free.aaa 23 May '14

23 May '14

Hi all! In some documentations there are references to radiusReplyItem ldap attribute. However freeradius schema file does not contain it. I wonder do I have to add it manually or the docs are outdated and I need to use something else? freeradius-3.0.3 Thanks!

2 2