$ cvs update $ more raddb/sites-available/dynamic-clients It Just Works. You can now manage clients in an SQL table. When the server receives packets from a new client, it looks up the IP in SQL. The clients can expire (so shared secrets can be changed). When 'readclients=yes' is set in sql.conf, you only need one "client" entry in the configuration files. The dynamic clients can be read from anywhere... not just from SQL. The configuration needs to be tested, as the SQL example in the "dynamic-clients" file may not be exactly correct. But it should be relatively easy to fix. Client lookups are rate-limited, so DoS attacks won't affect the server. The lookups are done NO MORE THAN once a second after the server starts. Alan DeKok.