From 07cf2c4b20230ddedee1bf9dddc1e7cd407385f5 Mon Sep 17 00:00:00 2001
From: Renato Botelho <garga@FreeBSD.org>
Date: Thu, 5 Feb 2015 10:02:24 -0200
Subject: Packages repo cleanup:

- Drop support for pfSense < 2
- Remove archive/, old files can be reached using git
- Remove old and unused packages
- Move stale files from config subdir to a package subdir
---
 config/freeradius/freeradius.inc         | 546 +++++++++++++++++++++++++++++++
 config/freeradius/freeradius.xml         | 264 +++++++++++++++
 config/freeradius/freeradiusclients.xml  | 116 +++++++
 config/freeradius/freeradiussettings.xml | 179 ++++++++++
 4 files changed, 1105 insertions(+)
 create mode 100644 config/freeradius/freeradius.inc
 create mode 100644 config/freeradius/freeradius.xml
 create mode 100644 config/freeradius/freeradiusclients.xml
 create mode 100644 config/freeradius/freeradiussettings.xml

(limited to 'config/freeradius')

diff --git a/config/freeradius/freeradius.inc b/config/freeradius/freeradius.inc
new file mode 100644
index 00000000..6f0b1f38
--- /dev/null
+++ b/config/freeradius/freeradius.inc
@@ -0,0 +1,546 @@
+<?php
+require_once('config.inc');
+require_once('service-utils.inc');
+
+define('RADDB', '/usr/local/etc/raddb');
+
+function freeradius_deinstall_command() {
+	exec("cd /var/db/pkg && pkg_delete `ls | grep freeradius`");
+	exec("cd /var/db/pkg && pkg_delete `ls | grep libltdl`");
+}
+
+function freeradius_install_command() {
+	global $config;
+        conf_mount_rw();
+	$handle = opendir(RADDB);
+	while (false != ($file = readdir($handle))) {
+		if (false != ($pos = strpos($file, '.sample'))) {
+			$newfile = substr($file, 0, $pos);
+			if (copy(RADDB . "/$file", RADDB . "/$newfile"))
+				unlink(RADDB . "/$file");
+		}
+	}
+	closedir($handle);
+
+	freeradius_settings_resync();
+
+	$rcfile = array();
+	$rcfile['file'] = 'radiusd.sh';
+	$rcfile['start'] = 'logger -f /var/log/system.log "freeRADIUS rc_start: killing all existing radiusd processes" && killall -9 radiusd  ; sleep 5 && logger -f /var/log/system.log "freeRADIUS rc_start: starting radiusd " ; radiusd -s &';
+	$rcfile['stop'] = 'logger -f /var/log/system.log "freeRADIUS rc_stop: killing all existing radiusd processes" && killall -9 radiusd  ; sleep 5 && logger -f /var/log/system.log "freeRADIUS rc_stop: radiusd has quit"';
+        conf_mount_rw();
+	write_rcfile($rcfile);
+        conf_mount_ro();
+	start_service("freeradius");
+}
+
+function freeradius_settings_resync() {
+	global $config;
+	$settings = $config['installedpackages']['freeradiussettings']['config'][0];
+	$iface = ($settings['interface'] ? $settings['interface'] : 'LAN');
+	$iface = convert_friendly_interface_to_real_interface_name($iface);
+	$iface_ip = find_interface_ip($iface);
+	$interface_ip = $settings['interface_ip'];
+	$port = ($settings['port'] != '' ? $settings['port'] : 0);
+	$radiuslogging = $settings['radiuslogging'];
+	$radiuslogbadpass = $settings['radiuslogbadpass'];
+	$radiusloggoodpass = $settings['radiusloggoodpass'];
+	$max_requests_var = $settings['max_requests_var'];
+	$max_request_time_var = $settings['max_request_time_var'];
+	$cleanup_delay_var = $settings['cleanup_delay_var'];
+	$logdir_var = $settings['logdir_var'];
+
+	// FreeRADIUS's configuration is huge
+	// This is the standard default config file, trimmed down a bit. Somebody might want to implement more options. It should be as simple as editing this, then also providing the settings in each file that was included here (or maybe just put the config inlined here).
+	$conf = <<<EOD
+prefix = /usr/local
+exec_prefix = \${prefix}
+sysconfdir = \${prefix}/etc
+localstatedir = /var
+sbindir = \${exec_prefix}/sbin
+logdir = $logdir_var
+raddbdir = \${sysconfdir}/raddb
+radacctdir = \${logdir}/radacct
+confdir = \${raddbdir}
+run_dir = \${localstatedir}/run/radiusd
+log_file = \${logdir}/radius.log
+libdir = \${exec_prefix}/lib
+pidfile = \${run_dir}/radiusd.pid
+#user = nobody
+#group = nobody
+max_request_time = $max_request_time_var
+delete_blocked_requests = no
+cleanup_delay = $cleanup_delay_var
+max_requests = $max_requests_var
+bind_address = $interface_ip
+port = $port
+hostname_lookups = no
+allow_core_dumps = no
+regular_expressions	= yes
+extended_expressions	= yes
+log_stripped_names = no
+log_auth = $radiuslogging
+log_auth_badpass = $radiuslogbadpass
+log_auth_goodpass = $radiusloggoodpass
+usercollide = no
+lower_user = no
+lower_pass = no
+nospace_user = no
+nospace_pass = no
+checkrad = \${sbindir}/checkrad
+ 
+security {
+	max_attributes = 200
+	reject_delay = 1
+	status_server = no
+}
+ 
+proxy_requests = yes
+\$INCLUDE  \${confdir}/proxy.conf
+ 
+\$INCLUDE  \${confdir}/clients.conf
+ 
+snmp = no
+\$INCLUDE  \${confdir}/snmp.conf
+ 
+thread pool {
+	start_servers = 5
+	max_servers = 32
+	min_spare_servers = 3
+	max_spare_servers = 10
+	max_requests_per_server = 0
+}
+ 
+modules {
+	pap {
+		encryption_scheme = crypt
+	}
+ 
+	chap {
+		authtype = CHAP
+	}
+ 
+	pam {
+		pam_auth = radiusd
+	}
+ 
+	unix {
+		cache = no
+		cache_reload = 600
+		radwtmp = \${logdir}/radwtmp
+	}
+ 
+	\$INCLUDE \${confdir}/eap.conf
+ 
+	mschap {
+		authtype = MS-CHAP
+		#use_mppe = no
+		#require_encryption = yes
+		#require_strong = yes
+		#with_ntdomain_hack = no
+		#ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
+	}
+ 
+	ldap {
+		server = "ldap.your.domain"
+		basedn = "o=My Org,c=UA"
+		filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
+		#base_filter = "(objectclass=radiusprofile)"
+		start_tls = no
+		#tls_cacertfile = /path/to/cacert.pem
+		#tls_cacertdir = /path/to/ca/dir/
+		#tls_certfile = /path/to/radius.crt
+		#tls_keyfile = /path/to/radius.key
+		#tls_randfile = /path/to/rnd
+		#tls_require_cert = "demand"
+		access_attr = "dialupAccess"
+		dictionary_mapping = \${raddbdir}/ldap.attrmap
+		ldap_connections_number = 5
+		#groupname_attribute = cn
+		#groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"
+		#groupmembership_attribute = radiusGroupName
+		timeout = 4
+		timelimit = 3
+		net_timeout = 1
+		#compare_check_items = yes
+		#do_xlat = yes
+		#access_attr_used_for_allow = yes
+	}
+ 
+	realm IPASS {
+		format = prefix
+		delimiter = "/"
+		ignore_default = no
+		ignore_null = no
+	}
+ 
+	realm suffix {
+		format = suffix
+		delimiter = "@"
+		ignore_default = no
+		ignore_null = no
+	}
+ 
+	realm realmpercent {
+		format = suffix
+		delimiter = "%"
+		ignore_default = no
+		ignore_null = no
+	}
+ 
+	realm ntdomain {
+		format = prefix
+		delimiter = "\\"
+		ignore_default = no
+		ignore_null = no
+	}
+ 
+	checkval {
+		item-name = Calling-Station-Id
+		check-name = Calling-Station-Id
+		data-type = string
+		#notfound-reject = no
+	}
+ 
+	preprocess {
+		huntgroups = \${confdir}/huntgroups
+		hints = \${confdir}/hints
+		with_ascend_hack = no
+		ascend_channels_per_line = 23
+		with_ntdomain_hack = no
+		with_specialix_jetstream_hack = no
+		with_cisco_vsa_hack = no
+	}
+ 
+	files {
+		usersfile = \${confdir}/users
+		acctusersfile = \${confdir}/acct_users
+		preproxy_usersfile = \${confdir}/preproxy_users
+		compat = no
+	}
+ 
+	detail {
+		detailfile = \${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d
+		detailperm = 0600
+	}
+ 
+	acct_unique {
+		key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
+	}
+ 
+	\$INCLUDE  \${confdir}/sql.conf
+ 
+	radutmp {
+		filename = \${logdir}/radutmp
+		username = %{User-Name}
+		case_sensitive = yes
+		check_with_nas = yes
+		perm = 0600
+		callerid = "yes"
+	}
+ 
+	radutmp sradutmp {
+		filename = \${logdir}/sradutmp
+		perm = 0644
+		callerid = "no"
+	}
+ 
+	attr_filter {
+		attrsfile = \${confdir}/attrs
+	}
+ 
+	counter daily {
+		filename = \${raddbdir}/db.daily
+		key = User-Name
+		count-attribute = Acct-Session-Time
+		reset = daily
+		counter-name = Daily-Session-Time
+		check-name = Max-Daily-Session
+		allowed-servicetype = Framed-User
+		cache-size = 5000
+	}
+	
+	counter weekly {
+		filename = \${raddbdir}/db.weekly
+		key = User-Name
+		count-attribute = Acct-Session-Time
+		reset = weekly
+		counter-name = Weekly-Session-Time
+		check-name = Max-Weekly-Session
+		cache-size = 5000
+	}
+	
+  counter monthly {
+		filename = \${raddbdir}/db.monthly
+		key = User-Name
+		count-attribute = Acct-Session-Time
+		reset = monthly
+		counter-name = Monthly-Session-Time
+		check-name = Max-Monthly-Session
+		cache-size = 5000
+	}
+
+	counter forever {
+		filename = \${raddbdir}/db.forever
+		key = User-Name
+		count-attribute = Acct-Session-Time
+		reset = never
+		counter-name = Forever-Session-Time
+		check-name = Max-Forever-Session
+		cache-size = 5000
+	}
+ 
+	always fail {
+		rcode = fail
+	}
+	always reject {
+		rcode = reject
+	}
+	always ok {
+		rcode = ok
+		simulcount = 0
+		mpp = no
+	}
+ 
+	expr {
+	}
+ 
+	digest {
+	}
+ 
+	exec {
+		wait = yes
+		input_pairs = request
+	}
+ 
+	exec echo {
+		wait = yes
+		program = "/bin/echo %{User-Name}"
+		input_pairs = request
+		output_pairs = reply
+		#packet_type = Access-Accept
+	}
+ 
+	ippool main_pool {
+		range-start = 192.168.1.1
+		range-stop = 192.168.3.254
+		netmask = 255.255.255.0
+		cache-size = 800
+		session-db = \${raddbdir}/db.ippool
+		ip-index = \${raddbdir}/db.ipindex
+		override = no
+		maximum-timeout = 0
+	}
+}
+ 
+instantiate {
+	exec
+	expr
+	daily
+  weekly
+  monthly
+  forever
+}
+ 
+authorize {
+	preprocess
+	#auth_log
+	#attr_filter
+	chap
+	mschap
+	#digest
+	#IPASS
+	suffix
+	#ntdomain
+	eap
+	files
+	#sql
+	#etc_smbpasswd
+	#ldap
+	daily
+	weekly
+	monthly
+	forever
+	#checkval
+}
+ 
+authenticate {
+	Auth-Type PAP {
+		pap
+	}
+	Auth-Type CHAP {
+		chap
+	}
+	Auth-Type MS-CHAP {
+		mschap
+	}
+	#digest
+	#pam
+	unix
+	#Auth-Type LDAP {
+	#	ldap
+	#}
+	eap
+}
+ 
+preacct {
+	preprocess
+	acct_unique
+	#IPASS
+	suffix
+	#ntdomain
+	files
+}
+ 
+accounting {
+	detail
+	daily
+	weekly
+	monthly
+	forever
+	unix
+	radutmp
+	#sradutmp
+	#main_pool
+	#sql
+	#pgsql-voip
+}
+ 
+session {
+	radutmp
+	#sql
+}
+ 
+post-auth {
+	#main_pool
+	#reply_log
+	#sql
+	#ldap
+	#Post-Auth-Type REJECT {
+	#	insert-module-name-here
+	#}
+}
+ 
+pre-proxy {
+	#attr_rewrite
+	#files
+	#pre_proxy_log
+}
+ 
+post-proxy {
+	#post_proxy_log
+	#attr_rewrite
+	#attr_filter
+	eap
+}
+
+EOD;
+        conf_mount_rw();
+	file_put_contents(RADDB . '/radiusd.conf', $conf);
+        conf_mount_ro();
+	restart_service("freeradius");
+}
+
+function freeradius_users_resync() {
+	global $config;
+
+	$conf = '';
+	$users = $config['installedpackages']['freeradius']['config'];
+	if (is_array($users)) {
+		foreach ($users as $user) {
+			$username = $user['username'];
+			$password = $user['password'];
+	$multiconnect = $user['multiconnect'];
+	$ip = $user['ip'];
+        $subnetmask = $user['subnetmask'];
+        $gateway = $user['gateway'];
+	$userexpiration=$user['expiration'];
+	$sessiontime=$user['sessiontime'];
+	$onlinetime=$user['onlinetime'];
+	$vlanid=$user['vlanid'];
+	$additionaloptions=$user['additionaloptions'];
+	$atrib=''; 
+	$head="$username User-Password == ".'"'.$password.'"';
+      if ($multiconnect <> '') {
+        $head .=", Simultaneous-Use := $multiconnect";
+       }
+      if ($userexpiration <> '') {
+        $head .=", Expiration := ".'"'.$userexpiration.'"';
+       }
+      if ($subnetmask<> '') {
+        $head .=", Framed-IP-Netmask = $subnetmask";
+       }
+      if ($gateway<> '') {
+        $head .=", Framed-Route = $gateway";
+       }
+      if ($onlinetime <> '') {
+        $head .=", Login-Time := ". '"' . $onlinetime .'"';
+       }
+      if ($ip <> '') {
+        if ($atrib <> '') { $atrib .=","; }
+        $atrib .="\r\n\tFramed-IP-Address = $ip";
+       }
+      if ($sessiontime <> '') {
+        if ($atrib <> '') { $atrib .=","; }
+        $atrib .="\r\n\tSession-Timeout := $sessiontime";
+       }
+      if ($vlanid <> '') {
+        if ($atrib <> '') { $atrib .=","; }
+        $atrib .="\r\n\tTunnel-Type = VLAN,\r\n\tTunnel-Medium-Type = IEEE-802,\r\n\tTunnel-Private-Group-ID = \"$vlanid\"";
+       }
+      if ($additionaloptions <> '') {
+        if ($atrib <> '') { $atrib .=","; }
+        $atrib .="\r\n\t$additionaloptions";
+       }
+       
+      $conf .= <<<EOD
+$head 
+	$atrib
+
+EOD;
+		}
+	}
+	$filename = RADDB . '/users';
+        conf_mount_rw();
+	file_put_contents($filename, $conf);
+	chmod($filename, 0600);
+        conf_mount_ro();
+
+	restart_service('freeradius');
+}
+
+function freeradius_clients_resync() {
+	global $config;
+
+	$conf = '';
+	$clients = $config['installedpackages']['freeradiusclients']['config'];
+	if (is_array($clients) && !empty($clients)) {
+		foreach ($clients as $item) {
+			$client = $item['client'];
+			$secret = $item['sharedsecret'];
+			$shortname = $item['shortname'];
+			$conf .= <<<EOD
+client $client {
+	secret = $secret
+	shortname = $shortname
+}
+
+EOD;
+		}
+	}
+	else {
+		$conf .= <<<EOD
+client 127.0.0.1 {
+	secret = pfsense
+	shortname = localhost
+}
+
+EOD;
+	}
+
+        conf_mount_rw();
+	file_put_contents(RADDB . '/clients.conf', $conf);
+        conf_mount_ro();
+	restart_service("freeradius");
+}
+?>
diff --git a/config/freeradius/freeradius.xml b/config/freeradius/freeradius.xml
new file mode 100644
index 00000000..63cdc8d2
--- /dev/null
+++ b/config/freeradius/freeradius.xml
@@ -0,0 +1,264 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<!DOCTYPE packagegui SYSTEM "./schema/packages.dtd">
+<?xml-stylesheet type="text/xsl" href="./xsl/package.xsl"?>
+<packagegui>
+	<copyright>
+	<![CDATA[
+/* $Id$ */
+/* ========================================================================== */
+/*
+	freeradius.xml
+	part of pfSense (http://www.pfSense.com)
+	Copyright (C) 2007 to whom it may belong
+	All rights reserved.
+
+	Based on m0n0wall (http://m0n0.ch/wall)
+	Copyright (C) 2003-2006 Manuel Kasper <mk@neon1.net>.
+	All rights reserved.
+									      */
+/* ========================================================================== */
+/*
+	Redistribution and use in source and binary forms, with or without
+	modification, are permitted provided that the following conditions are met:
+
+	1. Redistributions of source code must retain the above copyright notice,
+	   this list of conditions and the following disclaimer.
+
+	2. Redistributions in binary form must reproduce the above copyright
+	   notice, this list of conditions and the following disclaimer in the
+	   documentation and/or other materials provided with the distribution.
+
+	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+	POSSIBILITY OF SUCH DAMAGE.
+									      */
+/* ========================================================================== */
+	]]>
+	</copyright>
+	<description>Describe your package here</description>
+	<requirements>Describe your package requirements here</requirements>
+	<faq>Currently there are no FAQ items provided.</faq>
+	<name>freeradius</name>
+	<version>1.1.2</version>
+	<title>FreeRADIUS: Users</title>
+	<include_file>/usr/local/pkg/freeradius.inc</include_file>
+	<menu>
+		<name>FreeRADIUS</name>
+		<tooltiptext>Modify FreeRADIUS users, clients, and settings.</tooltiptext>
+		<section>Services</section>
+		<url>/pkg.php?xml=freeradius.xml</url>
+	</menu>
+	<service>
+		<name>FreeRADIUS</name>
+		<rcfile>radiusd.sh</rcfile>
+		<executable>radiusd</executable>
+		<description>The FreeRADIUS daemon.</description>
+	</service>
+
+	<tabs>
+		<tab>
+			<text>Users</text>
+			<url>/pkg.php?xml=freeradius.xml</url>
+			<active/>
+		</tab>
+		<tab>
+			<text>Clients</text>
+			<url>/pkg.php?xml=freeradiusclients.xml</url>
+		</tab>
+		<tab>
+			<text>Settings</text>
+			<url>/pkg_edit.php?xml=freeradiussettings.xml&amp;id=0</url>
+		</tab>
+	</tabs>
+
+	<adddeleteeditpagefields>
+		<columnitem>
+			<fielddescr>Username</fielddescr>
+			<fieldname>username</fieldname>
+		</columnitem>
+		<columnitem>
+			<fielddescr>Description</fielddescr>
+			<fieldname>description</fieldname>
+		</columnitem>
+		<columnitem>
+			<fielddescr>IP address</fielddescr>
+			<fieldname>ip</fieldname>
+		</columnitem>
+		<columnitem>
+			<fielddescr>Subnet Mask</fielddescr>
+			<fieldname>subnetmask</fieldname>
+		</columnitem>
+		<columnitem>
+			<fielddescr>Multiple Connection</fielddescr>
+			<fieldname>multiconnect</fieldname>
+		</columnitem>
+		<columnitem>
+			<fielddescr>Expiration</fielddescr>
+			<fieldname>expiration</fieldname>
+		</columnitem>
+		<columnitem>
+			<fielddescr>Session time</fielddescr>
+			<fieldname>sessiontime</fieldname>
+		</columnitem>
+		<columnitem>
+			<fielddescr>Online time</fielddescr>
+			<fieldname>onlinetime</fieldname>
+		</columnitem>
+		<columnitem>
+			<fielddescr>VLAN ID</fielddescr>
+			<fieldname>vlanid</fieldname>
+		</columnitem>
+	</adddeleteeditpagefields>
+	<additional_files_needed>
+		<prefix>/usr/local/pkg/</prefix>
+		<chmod>0775</chmod>
+		<item>https://packages.pfsense.org/packages/config/freeradius/freeradiusclients.xml</item>
+	</additional_files_needed>
+	<additional_files_needed>
+		<prefix>/usr/local/pkg/</prefix>
+		<chmod>0775</chmod>
+		<item>https://packages.pfsense.org/packages/config/freeradius/freeradiussettings.xml</item>
+	</additional_files_needed>
+	<additional_files_needed>
+		<prefix>/usr/local/pkg/</prefix>
+		<chmod>0775</chmod>
+		<item>https://packages.pfsense.org/packages/config/freeradius/freeradius.inc</item>
+	</additional_files_needed>
+	<fields>
+		<field>
+			<fielddescr>Username</fielddescr>
+			<fieldname>username</fieldname>
+			<description>Enter the username.</description>
+			<type>input</type>
+			<required/>
+		</field>
+		<field>
+			<fielddescr>Password</fielddescr>
+			<fieldname>password</fieldname>
+			<description>Enter the password for this username.</description>
+			<type>password</type>
+			<required/>
+		</field>
+		<field>
+			<fieldname>ip</fieldname>
+			<fielddescr>IP address</fielddescr>
+			<description><![CDATA[Framed-IP-Address. If you want this user to be assigned a specific IP address from radius, enter the IP
+address here. Continuous IP address is available with "+" suffix(example:192.168.1.5+. It may help for assigning the
+different IP address to multiple simultaneous connections).   IMPORTANT, you MUST enter an IP address here if you checked
+"RADIUS issued IP" on vpn pptp or vpn pppoe configuration.]]></description>
+			<type>input</type>
+		</field>
+		<field>
+			<fieldname>subnetmask</fieldname>
+			<fielddescr>subnetmask</fielddescr>
+			<description>Framed-IP-Netmask. Needs support of the NAS (Switch) Example: 255.255.255.0</description>
+			<type>input</type>
+		</field>
+		<field>
+			<fieldname>gateway</fieldname>
+			<fielddescr>gateway</fielddescr>
+			<description>Framed-Route. Needs support of the NAS (Switch). Order is: Subnet Gateway Metric Example: 192.168.10.0 192.168.10.1 1</description>
+			<type>input</type>
+		</field>
+		<field>
+			<fieldname>multiconnect</fieldname>
+			<fielddescr>Number of Multiple connection</fielddescr>
+			<description>The available number of multiple simultaneous connections with this username.</description>
+			<required/>
+			<type>input</type>
+		</field>
+		<field>
+			<fieldname>expiration</fieldname>
+			<fielddescr>Expiration</fielddescr>
+			<description>You may enter the date that this account will stop working here.use Mmm dd yyyy example: 01 Jan 2007  will be Jan 01 2007</description>
+			<type>input</type>
+		</field>
+		<field>
+			<fieldname>sessiontime</fieldname>
+			<fielddescr>Session time</fielddescr>
+			<description>Time this user has until relogin in seconds</description>
+			<type>input</type>
+		</field>
+		<field>
+			<fieldname>onlinetime</fieldname>
+			<fielddescr>Online time</fielddescr>
+			<description><![CDATA[A time string may be a list of simple time strings separated with vertical bars `|' or commas `,'.
+
+Each simple time string must begin either with a day-of-week abbreviation (one of `Su', `Mo', `Tu', `We', `Th', `Fr', `Sa'), or `Wk' for any day from Monday to Friday inclusive, or `Any' or `Al' for any day.
+
+Following the day may be a range of hours separated with a hyphen, using 24-hour time. The range of hours may cross 0; for example `2300-0700' means any time except 7 AM to 11 PM. If no time is given, calls may be made at any time on the specified day(s).
+
+The time string may also be the single word `Never', which does not match any time.
+
+Here are a few sample time strings with an explanation of what they mean.
+
+`Wk2305-0855,Sa,Su2305-1655'
+
+    This means weekdays before 8:55 AM or after 11:05 PM, any time Saturday, or Sunday before 4:55 PM or after 11:05 PM. These are approximately the times during which night rates apply to phone calls in the U.S.A. Note that this time string uses, for example, `2305' rather than `2300'; this will ensure a cheap rate even if the computer clock is running up to five minutes ahead of the real time.
+
+`Wk0905-2255,Su1705-2255'
+
+    This means weekdays from 9:05 AM to 10:55 PM, or Sunday from 5:05 PM to 10:55 PM. This is approximately the opposite of the previous example.
+
+`Any'
+
+    This means any day. Since no time is specified, it means any time on any day.]]></description>
+
+			<type>input</type>
+		</field>
+		<field>
+			<fieldname>description</fieldname>
+			<fielddescr>Description</fielddescr>
+			<description>You may enter a description here for your reference (not parsed).</description>
+			<type>input</type>
+		</field>
+		<field>
+			<fieldname>vlanid</fieldname>
+			<fielddescr>VLAN ID</fielddescr>
+			<description><![CDATA[
+	Enter the VLAN ID (integer from 1-4095) OR the VLAN name that this user/device should be assigned. In general, this parameter is used in conjunction with switches and access points that support mac-based authentication.<br><br>
+
+	This setting can be used for switches/wireless access points that support the following radius parameters:<br>
+	  Tunnel-Type = VLAN<br>
+	  Tunnel-Medium-Type = IEEE-802<br>
+	  Tunnel-Private-Group-ID = "insert vlan identifier here"<br><br>
+
+	This was implemented and tested with HP Procurve Switches (3500yl, and 2626). HP Procurve switches support using either the VLAN ID or the VLAN name, while other switches will only work using the VLAN ID.
+	]]>
+			</description>
+			<type>input</type>
+		</field>
+		<field>
+			<fieldname>additionaloptions</fieldname>
+			<fielddescr>Additional RADIUS Options</fielddescr>
+			<description><![CDATA[
+	Experts only.<br>
+	You may append extra custom RADIUS options to this user account (separated by commas).<br>
+	IMPORTANT: If you don't format this field correctly, FreeRADIUS may not properly start because the users file will contain a syntax error.
+	]]>
+			</description>
+			<type>textarea</type>
+			<rows>10</rows>
+			<cols>75</cols>
+		</field>
+	</fields>
+	<custom_delete_php_command>
+		freeradius_users_resync();
+	</custom_delete_php_command>
+	<custom_php_resync_config_command>
+		freeradius_users_resync();
+	</custom_php_resync_config_command>
+	<custom_php_install_command>
+		freeradius_install_command();
+	</custom_php_install_command>
+	<custom_php_deinstall_command>
+		freeradius_deinstall_command();
+	</custom_php_deinstall_command>
+</packagegui>
diff --git a/config/freeradius/freeradiusclients.xml b/config/freeradius/freeradiusclients.xml
new file mode 100644
index 00000000..e9417581
--- /dev/null
+++ b/config/freeradius/freeradiusclients.xml
@@ -0,0 +1,116 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<!DOCTYPE packagegui SYSTEM "./schema/packages.dtd">
+<?xml-stylesheet type="text/xsl" href="./xsl/package.xsl"?>
+<packagegui>
+        <copyright>
+        <![CDATA[
+/* $Id$ */
+/* ========================================================================== */
+/*
+    authng.xml
+    part of pfSense (http://www.pfSense.com)
+    Copyright (C) 2007 to whom it may belong
+    All rights reserved.
+
+    Based on m0n0wall (http://m0n0.ch/wall)
+    Copyright (C) 2003-2006 Manuel Kasper <mk@neon1.net>.
+    All rights reserved.
+                                                                              */
+/* ========================================================================== */
+/*
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+
+     1. Redistributions of source code must retain the above copyright notice,
+        this list of conditions and the following disclaimer.
+
+     2. Redistributions in binary form must reproduce the above copyright
+        notice, this list of conditions and the following disclaimer in the
+        documentation and/or other materials provided with the distribution.
+
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+                                                                              */
+/* ========================================================================== */
+        ]]>
+        </copyright>
+    <description>Describe your package here</description>
+    <requirements>Describe your package requirements here</requirements>
+    <faq>Currently there are no FAQ items provided.</faq>
+	<name>freeradiusclients</name>
+	<version>none</version>
+	<title>FreeRADIUS: Clients</title>
+	<include_file>freeradius.inc</include_file>
+	<tabs>
+                <tab>
+                        <text>Users</text>
+                        <url>/pkg.php?xml=freeradius.xml</url>
+                </tab>
+                <tab>
+                        <text>Clients</text>
+                        <url>/pkg.php?xml=freeradiusclients.xml</url>
+			<active/>
+                </tab>
+                <tab>
+                        <text>Settings</text>
+                        <url>/pkg_edit.php?xml=freeradiussettings.xml&amp;id=0</url>
+                </tab>
+        </tabs>
+	<adddeleteeditpagefields>
+		<columnitem>
+			<fielddescr>Client</fielddescr>
+			<fieldname>client</fieldname>
+		</columnitem>
+		<columnitem>
+			<fielddescr>Shortname</fielddescr>
+			<fieldname>shortname</fieldname>
+		</columnitem>
+		<columnitem>
+			<fielddescr>Description</fielddescr>
+			<fieldname>description</fieldname>
+		</columnitem>
+	</adddeleteeditpagefields>
+	<fields>
+		<field>
+			<fielddescr>Client</fielddescr>
+			<fieldname>client</fieldname>
+			<description>Enter the client's IP address.</description>
+			<type>input</type>
+			<required/>
+		</field>
+		<field>
+			<fielddescr>Shortname</fielddescr>
+			<fieldname>shortname</fieldname>
+			<description>Enter the client's shortname.</description>
+			<type>input</type>
+			<required/>
+		</field>
+		<field>
+			<fielddescr>Shared Secret</fielddescr>
+			<fieldname>sharedsecret</fieldname>
+			<description>Enter the client's shared secret here</description>
+			<type>password</type>
+			<required/>
+		</field>
+		<field>
+			<fielddescr>Description</fielddescr>
+			<fieldname>description</fieldname>
+			<description>Enter the description of the user here</description>
+			<type>input</type>
+		</field>
+	</fields>
+	<custom_delete_php_command>
+		freeradius_clients_resync();
+	</custom_delete_php_command>
+	<custom_php_resync_config_command>
+		freeradius_clients_resync();
+	</custom_php_resync_config_command>
+</packagegui>
diff --git a/config/freeradius/freeradiussettings.xml b/config/freeradius/freeradiussettings.xml
new file mode 100644
index 00000000..31634a37
--- /dev/null
+++ b/config/freeradius/freeradiussettings.xml
@@ -0,0 +1,179 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<!DOCTYPE packagegui SYSTEM "./schema/packages.dtd">
+<?xml-stylesheet type="text/xsl" href="./xsl/package.xsl"?>
+<packagegui>
+        <copyright>
+        <![CDATA[
+/* $Id$ */
+/* ========================================================================== */
+/*
+    authng.xml
+    part of pfSense (http://www.pfSense.com)
+    Copyright (C) 2007 to whom it may belong
+    All rights reserved.
+
+    Based on m0n0wall (http://m0n0.ch/wall)
+    Copyright (C) 2003-2006 Manuel Kasper <mk@neon1.net>.
+    All rights reserved.
+                                                                              */
+/* ========================================================================== */
+/*
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+
+     1. Redistributions of source code must retain the above copyright notice,
+        this list of conditions and the following disclaimer.
+
+     2. Redistributions in binary form must reproduce the above copyright
+        notice, this list of conditions and the following disclaimer in the
+        documentation and/or other materials provided with the distribution.
+
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+                                                                              */
+/* ========================================================================== */
+        ]]>
+        </copyright>
+    <description>Describe your package here</description>
+    <requirements>Describe your package requirements here</requirements>
+    <faq>Currently there are no FAQ items provided.</faq>
+	<name>freeradiussettings</name>
+	<version>none</version>
+	<title>FreeRADIUS: Settings</title>
+	<aftersaveredirect>pkg_edit.php?xml=freeradiussettings.xml&amp;id=0</aftersaveredirect>
+	<include_file>freeradius.inc</include_file>
+	<tabs>
+                <tab>
+                        <text>Users</text>
+                        <url>/pkg.php?xml=freeradius.xml</url>
+                </tab>
+                <tab>
+                        <text>Clients</text>
+                        <url>/pkg.php?xml=freeradiusclients.xml</url>
+                </tab>
+                <tab>
+                        <text>Settings</text>
+                        <url>/pkg_edit.php?xml=freeradiussettings.xml&amp;id=0</url>
+			<active/>
+                </tab>
+        </tabs>
+	<fields>
+		<field>
+			<fielddescr>Listening Interface(s)</fielddescr>
+			<fieldname>interface_ip</fieldname>
+			<description>Enter the desired listening interface IP here ( 192.168.1.0 ) or use "*" (without "") for any interface.</description>
+			<type>input</type>
+			<required/>
+		</field>
+		<field>
+			<fielddescr>Port</fielddescr>
+			<fieldname>port</fieldname>
+			<description>Enter the port the RADIUS server will listen on. Leave blank to default to the system default, i.e., 1812.</description>
+			<type>input</type>
+			<default_value>1812</default_value>
+		</field>
+		<field>
+			<fielddescr>Maximum requests server</fielddescr>
+			<fieldname>max_requests_var</fieldname>
+			<description>The maximum number of requests the RADIUS server can handle. Default is 1024. It should be 256 * number of clients e.g.: 4 Switches * 256 = 1024.</description>
+			<type>input</type>
+			<default_value>1024</default_value>
+		</field>
+		<field>
+			<fielddescr>Max request time</fielddescr>
+			<fieldname>max_request_time_var</fieldname>
+			<description>The maximum time (in seconds) to handle a request. Default is 30. Useful range of values: 5 to 120.</description>
+			<type>input</type>
+			<default_value>30</default_value>
+		</field>
+		<field>
+			<fielddescr>Cleanup delay</fielddescr>
+			<fieldname>cleanup_delay_var</fieldname>
+			<description>The time to wait (in seconds) before cleaning up a reply which was sent to the NAS. Default is 5. Useful range of values: 2 to 10.</description>
+			<type>input</type>
+			<default_value>5</default_value>
+		</field>
+		<field>
+			<fielddescr>Radius Logging Destination</fielddescr>
+			<fieldname>logdir_var</fieldname>
+			<description>Logging to "syslog" or "/var/log/radius.log" ?</description>
+			<type>select</type>
+			<default_value>/var/log</default_value>
+					<options>
+						<option>
+						<name>radius.log</name>
+						<value>/var/log</value>
+						</option>
+						<option>
+						<name>syslog</name>
+						<value>syslog</value>
+						</option>
+					</options>
+		</field>		
+		<field>
+			<fielddescr>Radius Logging</fielddescr>
+			<fieldname>radiuslogging</fieldname>
+			<description>Enable logging?</description>
+			<type>select</type>
+			<default_value>no</default_value>
+					<options>
+						<option>
+						<name>no</name>
+						<value>no</value>
+						</option>
+						<option>
+						<name>yes</name>
+						<value>yes</value>
+						</option>
+					</options>
+		</field>
+		<field>
+			<fielddescr>Log bad authentication attempts?</fielddescr>
+			<fieldname>radiuslogbadpass</fieldname>
+			<description>Specifies whether to log bad authentication attempts to the radius.log file. Radius Logging must be enabled for this to work.</description>
+			<type>select</type>
+			<default_value>no</default_value>
+					<options>
+						<option>
+						<name>no</name>
+						<value>no</value>
+						</option>
+						<option>
+						<name>yes</name>
+						<value>yes</value>
+						</option>
+					</options>
+		</field>
+		<field>
+			<fielddescr>Log good authentication attempts?</fielddescr>
+			<fieldname>radiusloggoodpass</fieldname>
+			<description>Specifies whether to log good authentication attempts to the radius.log file. Radius Logging must be enabled for this to work.</description>
+			<type>select</type>
+			<default_value>no</default_value>
+					<options>
+						<option>
+						<name>no</name>
+						<value>no</value>
+						</option>
+						<option>
+						<name>yes</name>
+						<value>yes</value>
+						</option>
+					</options>
+		</field>
+	</fields>
+	<custom_delete_php_command>
+		freeradius_settings_resync();
+	</custom_delete_php_command>
+	<custom_php_resync_config_command>
+		freeradius_settings_resync();
+	</custom_php_resync_config_command>
+</packagegui>
-- 
cgit v1.2.3