text:
She is tall, stately and proud, full of history and, as any grand matron who has witnessed the passing of 124 seasons, she needs some makeup, even a facelift.
According to an official historic plaque on the eight-bay wrap-around porch, in 1845 Ed Lott – who made his fortune in cattle – purchased the land there that was part of the Mission Rosario.
Thirty years later, he built an i-house there. The name is derived from the popularity of the style in Illinois, Iowa and Indiana that features two rooms either side of the entrance door, one room deep and two stories. More than a dozen years after that, Lott built the current Queen Anne house popular nationwide then – characterized by the wraparound porches – the eastern porch downstairs is screened – and rooms with high, high ceilings.
When it was built, the farm-to- market road that seems to lead to the front porch (before making an abrupt left turn) wasn't there.
An old road from Goliad west was behind the house, as is the San Antonio River.
Houses can't talk, but the people who live in them can, and the W.J. "Ed" and Mary Elizabeth Lott house has been occupied by six generations.
It was recorded as a Texas historic landmark in 1996 and is listed on the National Register of Historic Places.
Annie Mae Carrington, who grew up there but now lives in San Antonio, says the house was remodeled 15 years ago, including the installation of limited air conditioning and the removal of wallpaper – which required sheetrock to cover up "100,000 wallpaper tacks."
The Rev. Gina Frnke, who is Annie Mae's daughter and an Episcopal priest, lives in Goliad and is overseeing some further maintenance.
A local legend says the house was constructed of cypress wood, which refuses to hold a paint job.
"That's only partially true," Frnke says. "It's cypress wood, all right, but my stepfather, who was an architect, thought the house would be cheaper to maintain by letting the paint just flake off and just painting the trim. That didn't work."
Today, standing on the upper porch, Frnke says the wood on the west side of the building has suffered from the lack of paint. "We're changing my stepfather's plan."
It has a modern security system combined with one that is organic.
"Watch out for these plants," Frnke warns. "They're poison ivy. It's our five-day delayed burglar alarm."
"In remodeling, we haven't changed the home," Carrington says. "But it was a major undertaking."
To go inside is to walk into a living museum. Portraits of elderly family members decorate the dining room, which is separated from the living room by a sliding door.
"It still works," Carrington boasts. "It was made with well-aged lumber – not the green stuff they use now."
The center of the house is dominated by a split-level staircase.
"My grandmother remembers the house filled with children many years ago," Frnke recalls. "It takes a lot of people to make this place not so lonely.
"It's been decades since Christmas was celebrated here," Frnke says.
"But it was fun to go there in winter. There are six fireplaces."
And there are many places perfect for a Christmas tree.
But," Annie Mae adds, "my grandfather and grandmother never had a Christmas tree. It just wasn't the custom then."
For the last decade or more, the family has used the home only for weekends and holidays.
The house has an attic, accessible only by a vertical ladder.
"But there's nothing up there except some lumber," Carrington says. "My mother was a demon housecleaner. If something wasn't used, out it went," she laughs.
"So, there's no steamer trunks up there with old letters."
The rooms stay mostly empty now, but that appeals to Frnke. "I love the solitude of the house."
Sitting in rocking chairs on the side porch, Frnke the priest and Frnke the overseer combine to handle a crisis.
A hummingbird flies into the screened porch and struggles to find its way out. It hovers high up, beyond the reach of a gentle nudge from a straw broom, catching its beak again and again into the screen.
Frnke opens the doors at either end of the porch. "If I could find something red to attract it…"
When she returns from the kitchen, the hummingbird is gone.
"I can remember sitting here with my sisters when I was a child, listening to my parents talk about Goliad."
The only conversation now was the gossip of mockingbirds.
In San Antonio, Carrington rarely goes to the home anymore, but she is dedicated to maintaining it.
"It is such a treasure. I hope always to keep it for my grandchildren."
Bill Clough is a reporter at the Beeville Bee-Picayune and can be reached at 358-2550, ext. 122, or at firstname.lastname@example.com.


text:
I attended Frank Robisch's funeral yesterday.
A man who played a significant role in my childhood.
As a child he defined all goodness from the apples to the pigs, from the hills to the valleys.
And in thinking about his life, at least the earlier part, it always makes me feel happy—makes me feel the kind of warmth one finds in reading a good book.
I visited Frank this past spring at his nursing home in Honesdale. He barely remembered me.
And after the visit I felt odd. I felt disconnected with humanity.
I didn't know how to talk to Frank. I didn't know how to relate.
While sitting next to him, listening, waiting, he seemed very far away and although he was kind, he seemed uninterested in my presence.
I felt bad. I felt I had intruded on his personal space.
I was happy to see him though.
Today, while looking down at Frank's body, I felt close to him.
I didn't feel I was looking at Frank though.
I felt I was looking at a great calm and in his body's physical similarity there was the memory of a man named Frank—a man that was like a god—the kind of god that children find in their parents, or in farmers working in the distance who always appear to being do more than just farming, perhaps building arks that will save us all.
In the quiet that came with Frank's passing, I discovered a new home to visit old memories in.
After visiting Frank's body I turned around and was greeted by a friendly smile from my neighbor Dave Peters.
His smile assured me that I was home again. I felt warmth from this man.
Then at the cemetery I had a long conversation with a former dairy farmer, Richard Ferber.
Naturally, being in a cemetery, our conversation began with the local history, each chapter inspired by the next row of deceased mythological figures we came upon.
He told me about the history of these people and their families—the ones he knew and the ones he'd only heard story of.
Sometimes there was a quiet in between us and I felt a strong connection with Richard.
We walked and we talked and at the end of the path we both shook hands.
I was glad to have met Richard, I felt friendship with him, but I was nervous that I wouldn't get another chance to talk with him in this way—with this intimacy and with this camaraderie.
I feared more than anything that the "fracking" situation would divide us, or stop us from becoming friends.
He wants to drill his land. I don't want to drill mine. I couldn't even say that aloud without fear of losing the chance to become friends with him.
What are our differences? What are their limits? Can we live together, be friends together and be different? How different? Where is the line? Where is the bridge?
After the funeral I drove up to my childhood home on Robisch Hill Rd., which the Reynolds family has recently vacated.
I looked at the broken window on the second floor and at the scattered remains of furniture strewn across the lawn.
When I looked at the house I missed the Reynolds and then my childhood, too, even though the house looked nothing like the one in my memory.
Suddenly death overcame me. The sky was grey, the dog house was empty and a wild cat darted into the bushes.
I looked to my land, full of potential, and then back to the abandoned house I hoped to return to—"I will transform this land and this house into a school, a place for all, for everyone to have the chance to learn about one another."
Sitting here typing at my computer I strangely don't feel nostalgic or sad, just heavy with responsibility for the work I feel ahead of me.
So many bridges that need building. So many words that need listening.
In the end, I really just love humans.
I love the human presence that is evil and good.
I love that we make mistakes, that we get angry, that we are passionate, that we love and laugh.
I love the complexity of who we are. I love what I don't understand about us.
We are truly that aspect of nature that is beyond all logic. We make this planet the earth that it is, whether we kill it or save it.
[Frank Robisch passed away on September 1 at age 85. He was laid to rest on September 4 in North Branch Lutheran Cemetery, North Branch, NY. The author, Isaac Green Diebboll, born in New York City in 1989, is in the process of starting a school on his family's property in the Town of Delaware to honor his father, John Joseph Diebboll, The Diebbolls and the Robisches were neighbors on Robisch Hill in the Town of Delaware. For information about Isaac Diebboll's school, visit northschoolstudio.com or email him at firstname.lastname@example.com.]

subset: commoncrawl


text:
A fire has canceled classes at an elementary school in St. Croix County, possibly for the remainder of the school year.
St. Croix Central School District Superintendent David Bradley says fire officials told him it was unlikely classes could be held in the building for the remaining 26 days of the school year. Bradley tells KMSP-TV administrators are looking for alternative sites around the community of Roberts to hold classes.
Firefighters were dispatched to the elementary school about 4 a.m. Tuesday.


text:
Aran Winter Set - Scarf by Beth Brown-Reinsel
Welcome! You are browsing as a guestWould you like to see projects made from this pattern and much more? join Ravelry now What am I missing?
© Beth Brown-Reinsel
Aran Winter Set - Scarf
This pattern is available for download for $6.00.
Set of patterns includes: Hat, Mittens and Scarf worked in matching Cabled Rib.
Traditionalist and ardent scholar Brown-Reinsel: "Made primarily of a cabled rib in the round, the pieces are enhanced by a cabled medallion which proclaims one's knitting prowess. The scarf is knitted circularly in two pieces which are joined in the center; two options for finishing the ends are included."
This design first appeared in a Classic Elite Yarns booklet in 2002.
For more information, see: http://www.knittingtraditions.com/product-pattern/20...


text:
It's up to you to tell us who should be part of the Phillies All-Time team. During the winter, we'll unveil one position at a time for you to vote on. After all the votes are tallied, and all the position filled, we'll release the results. Make your vote count!
Below are the top choice and their totals as a member of the Phillies. WAR is used from Baseball-Reference.
- Tony Taylor (15 seasons, 1x All-star): .261 avg., .673 OPS, 75 HR, 598 RBI, 20 WAR
- Juan Samuel (7 seasons, 2x All-star): .263 avg., .749 OPS, 100 HR, 413 RBI, 10.7 WAR
- Mickey Morandini (9 seasons, 1x All-Star): .267 avg., .694 OPS, 20 HR, 254 RBI, 5.7 WAR
- Chase Utley (10 seasons, 5x All-Star): .288 avg., .876 OPS, 199 HR, 739 RBI, 53.5 WAR
Who we're voting for:
-Amanda Orr: How can you vote against anyone who Harry Kalas called "the man"? During his prime, he was the best second baseman in the league. He could always hit and he improved his defense as years went on. His scrappy play and hustle made him an instant fan favorite.
-Don M.: The first time I heard about Chase Utley he was still in the minors, and the comment was "He can definitely hit, but there are questions about his glove." The year was 2002; the remark was from my dad as Utley was finishing a AAA-season spent at 3B in which he committed 28 errors in 123 games. Utley was moved back to 2B, his game continued to improve, and for the past decade he's been the best player in the Phillies organization
-Jay Floyd: With an OPS that is over 200 points better than the next best option at this position (Tony Taylor, who spent plenty of time at other positions and coached with the team as well, sported a .668 OPS in 15 seasons with the Phils), Chase Utley is by far the greatest second baseman in team history.
-Corey Seidman: For me it's a tie between Marlon Anderson and Felipe Crespo. Most would go with Chase Utley, but I just don't think Utley's .301/.388/.535 five-year peak was better than what Anderson or Crespo contributed to the 2001-02 Phillies.
-Pat Gallen: It's pretty obvious who we all have to vote for, even if Corey is a smart ass. Chase Utley is one of the greatest Phillies in team history, and is, of course, the man.Sorry, there are no polls available at the moment.
45 Comments
Considering that I always held Juan Samuel in higher esteem than his numbers reflected (that's called massive potential), it about says it all within my mind that Chase is not quite, but close to twice the player Sammy was. I wonder if Chase's injuries the last couple years have buried memories like this.
The best part of that video is best compared to te way football players react to scoring a touchdown. A guy like Adrian Peterson scores, he acts like he's been in the end zone before. The passion of a spike plus is entertaining for sure, but by it's frequency, the guys who act like it's their first time in the end zone just seem over the top with the act, entertaining as it is.
When Chase stands up, when he greets his teammates, there's an air of this is normal stuff.
A Hall of Fame berth would only amplify what he's been. What he's been, like Mike Schmidt just doesn't come down the pike too often.
Utley is clearly the best Second Baseman in Phillies History. His fielding is good and the his Hitting is above any other. I would have to put Manny Trillo on the list, even though he only played here for 4 years. He hit .277 during that time and had a lot of key hits. He was the best fielding Second Baseman I ever saw (Galvis has a chance to be better) and the strongest arm in the history of the position. It was a delight to see him catch a ball, look at it and then whip it over to Pete Rose in a blur.
Love seeing what I think supported by stats!
If Utley's career ended right now, he's still be best, and would continue to be for quite a while. In his ten years, he's been way more dominant a player than any of the others.
So far, he's been the only one I've voted for; with the other positions it was either too little time with the Phils or they weren't all that spectacular for an extended time.
Is this even a serious vote? …
I'm with Corey.
All right, time to confess- Who voted for Morandini? Come on, admit it.
Some people must be answering a different question — i.e. who's your favorite.
Utley before his body gave out was the best.
Not much of a contest.
I remember 4 years ago thinking he might end up as the greatest 2nd baseman ever. For any team.
That didnt happen and now he isnt even going to Cooperstown.
He is the best of a mediocre group though.
Juan Samuel was one of my favorite players as a kid though. Was vastly under rated.
Obviously, longevity and being consistently good enables Utley to compile very impressive stats. So i have to vote for him. However, personally he is not my all time favorite 2nd baseman. As an oldster here, I have seen Tony Taylor and Manny Trillo played and were outstanding players for the Phillies. Juan Samuel was an exciting player too before the pitchers figured him out and found a hole in his swing (couldn't lay off low outside breaking pitches). Morandini was a steady reliable player who played to the best of his limited ability.
My favorite over the years?.. He with the catchy slogan.."Yes we can!"..Dave Cash. Offensively and defensively, he was an All-Star. He played with the Phillies from 1974 to 1976, Three FULL seasons as a true everyday player, missing only two games during that period. He made the All-Star team each year, and batted .300 or better with over 200 hits in both 1974 and 1975. Defensively, he led in putouts, assists and doubleplays each year. I loved this player for his contribution on and off the field (one of the inspirational leaders on the team). I only wish he stay with team for additional years and who knows.. Utley would have serious competition in the fan voting here. 🙂
"longevity and being consistently good" — and being one of the two or three best players in baseball over the last decade.
Cash was great for 2 of his 3 seasons here and his acquisition was the first step in turning around the culture of losing from the early 70's. He should have been mentioned in the article and I do think there's a strong case for him to be the runner-up as the team's all-time 2B. His 13 fWAR in 3 seasons here far outpaces the other options (excluding Utley) on the basis of fWAR per season and beats Samuel's production in 7 seasons and Morandini's in 9.
That's a good job, Bruce, mentioning Cash. It's not like he's a real candidate for the all time 2B because of lack of time in a Phillie uniform, let alone Utley's presence, but he deserves mention within the subject. Now if the subject was most important 2B, as opposed to all-time, then he inspires at least some degree of debate, consolation that it is. Manny Trillo is deserving of a mention as well, another short termer who provided some valuble impact.
I suppose if the question were asked in a broader sense:
"In your lifetime – name the best 2nd baseman you have ever had the pleasure to root for"
You would probably receive a similar response. I have been a baseball fan for over 50 years, first following the AL as a kid (60's through the late 70's) then the NL. No doubt in my mind, over that span and across both leagues Chase Utley rises to the top of my list as the best second baseman I have ever had the pleasure of cheering for.
Just for the record – my second all time favorite is Roberto Alomar
"did you spit in this?"
Chet from Weird Science
Hope you (Brooks) are keeping warm this winter with the help of a few adult beverages.
Less than 2 months to the season. Going to be a fun one Brooksie.
You come in expecting 62-100 and anything better thatn that is just a nice suprise.
You are right AFW – low expectations will hardly ever disappoint but, I can't bring myself to do it. I'm shooting for 90(+) wins this year and a playoff spot.
I actually saw Tony Taylor play the game and would consider him 2nd to Ut. Local guy who played the game like Chase does: hard and relentless. There is no doubt Chase is the choice on this one.
Since I started following the Phillies in the early 70's, but not really following stats all that much. I happy that some of you have should me stats of my second favorite player of my youth behind Larry Bowa, and that was Dave Cash, I would say he was my favorite phillies second basemen until Chase came along. By a purly numbers stats it is obvious Chase is by far the best, and what he brought to this organization over the last decade is unquestionably head and shoulders above any second basemen in my life time. And I truly feel that if he can get 3 more years out of his knees with similar numbers to last years if extended over a full season he has an outside shot at HOF.
But if you are asking favorite second basemen you can get many more answers.
Again one thing I like about these post is that I got to see that for 3 years Dave Cash was not just my favorite by was a top tier second basmen. Because I Randy Learch was my favoite Phillies Pitcher, and I am pretty sure his numbers are not that great.
There is no way Chase has any shot at the HOF with only 3 more years to accumulate stats.
I tend to agree, but I don't think it's so obvious. It would require that 8+ years from now, when he becomes eligible, advanced stats including WAR are considered more than they are today. I think it's clear that they will be, the question is how much. And how much will they be considered say 15 years from now, if he hasn't fallen below the 5% minimum by then, as old-guard voters die off and are replaced by more stat-savvy younger ones?
Under the specific scenario beta laid out (2012 stats extended over a full season), he would be at about 70 WAR after 2015. Now that's probably too optimistic, but if he hangs on even part time for a couple more years, 70 is definitely within reach.
There are 18 second basemen in the Hall of Fame, and 70 WAR would rank 6th out of those 18. Even today, his current WAR of 53.8 ranks 11th out of the 18 HoF second basemen.
Here are the second basemen NOT in the Hall with the highest rWAR:
71.4 Whitaker
67.3 Grich
63.0 Randolph
62.1 Biggio
53.3 Utley
51.9 Kent
(and Utley had a higher 8-year peak than anyone on that list)
I agree that advanced stats will play more of a role in the voting, especially WAR. But I also think that the traditional ones such as batting average, HR, RBI hits, etc. will still play a major role. And I just can't see Utley getting there.
The only one on your list that has a shot…in my opinion is Biggio…and he has 3060 hits compared to Utley's 1275 right now. They have similiar averages and OBP and one could argue that Ut could match or better his HR and RBI totals.
I think Chase would have to really rack up the stats over the next 5-6 years, get to somewhere around 2200 or more hits, and at least match Biggio's HR and RBI totals of 291 and 1175 (Utley has 199 and 739). And that's with keeping up with his average and OBP.
It's certainly doable and, again, I do think that more advanced will and probably should play a significant role in the decision-making, but I seriously have my doubts. It's definitely not happening in the next 3 years, however.
And that begs a totally different question…. how will his knees actually hold up for 3 to 6 more years?? He'd almost have to play first base or be a DH in the AL to really extend that career.
Schmenkman good point. I think the key to getting in is that he will have 15 years, and by then I would hope the makeup of the BBWAA will have changed enough that there will be fewer compilers getting in, and more great players.
The BBWAA will still look at compilers, though. I just think that's the culture of the HOF and it's requirements for election. I can't see it changing that much in 15 years to make much of a difference. Maybe I'm wrong but I just can't see it.
In a way, Utley's chances are inversely proportional to Rollins'. As long as voters put a lot of stock in counting stats, Rollins has a chance (if he stays productive for a few years), and Utley probably doesn't. If they put less emphasis on counting stats, Rollins almost certainly doesn't get in, but Utley might have a chance. I wrote a piece on Rollins' chances last week at another site.
Chuck, you may be right. I like to think that the way the sport is viewed is evolving, the question is whether or not the voters will.
schmenk, that's an excellent point concerning Rollins. I've been thinking that, with a few more good seasons to pad his stats, he might have a decent shot at the Hall. Certainly his MVP season doesn't hurt him either. I'd be interested to read your piece.
I won't link it, but it's called Jimmy Rollins and the Hall of Fame if you google.
Any particular reason you liked Cash more than Trillo?
In an all time deal like this, with only one winner, it can only be Chase Utley.
Dave Cash and Manny Trillo were both deserving of the mention they didn't get.
Now – if you want to rank them, we could do that. (and argue about it) Here's mine-
1 Utley
2 Cash
3 Samuel
4 Trillo
5 Taylor
I had a tough time with number 3 and 4- I could be persuaded to switch them.
I agree with 1, 2 and 5. For me, Trillo and Samuel are close – Trillo was the better defender while Sammy was the more dynamic offensive player – that I would put Trillo ahead of Samuel solely on the basis of Trillo's contributions to one of the team's two World Series titles.
hk, Consider me duly persuaded! Trillo was SO big in the 1980 Houston NLCS especially against Nolan Ryan in game 5.
Obviously Utley should be #1. But I agree with several others that Manny Trillo ranks well above Samuel, Taylor & Morandini.
For a while I thought Chase would be able to put up Hall of Fame numbers, but just too many injuries have blighted that idea.
When I said 3 years I meant three more years of elite second basemen, but I would assume that he would hang on o few more after that to compile numbers. I do follow all the numbers some on here do but they consistenly keep saying that he ranks first or second in second basemen during his career. And who knows maybe he stays healthy this year, hits 35 HR bats .330 and has 110 RBIs, with a OBS of .800 wins and though I really think it is a created stat for the simple reason to create a stat is a 9 WAR and adds an MVP to his collection of numbers that would help his HOF status.
(there is some sarcasim in there just so you all know)
I don't see him getting close to those numbers this year (except .800 OPS), but his 2012 2012 numbers extended to a full season would have made him an elite second baseman (one of the 2-3 best in the game).
(forgot about the last comment — if that was sarcasm, then never mind)
Trillo was the best defensive second baseman the Phillies ever had. His relays were as good as any second baseman who played the game. 1980 would not have happened without Manny Trillo.
Is this real? There is no question. Like who is the third basemen?
What about Nap Lajoie (HOF), Joe Morgan (HOF), Manny Trillo, Tony Taylor,
Lajoie's an interesting mention.It's a little hard to take him seriously as a candidate to me. Baseball 50, 70 years ago still seems comparable, but 110 seems pushing it.
He hit .426 once, but his OBP was "only" .463. Hornsby's .424, best modern day batting average was attached to a BA of .507.
This article is about what they did with the Phillies.
Lajoie: Ken's right, baseball was very different then, but comparing each one to their peers, Lajoie and Utley were comparable hitters relative to the league (132 wRC+ for Lajoie, 129 for Utley). Based on the available stats he was only average fielder, and he only had 492 games with the Phillies.
Morgan: only 1 year with Phils
Trillo: only 501 games with Phillies, great fielder but below average hitter
Taylor: long tenure with Phils, but a below average hitter and (again, based on available stats), not a great fielder.
Bob nailed it.
People think Hall voting is a mess these days, maybe has been for a while. Certainly a case for it, and how it could be different in attempt to make it "better."
But check out another era, and tell me this isn't BIG TIME screwed up.
Rogers Hornsby
24 years, career BA .358 included consecutive years of .370, .397, .401, .384, .424, .403 . 2 of those years with 42 and 39 homers. That's headline stuff, even if it's just headlines.
Got elected to the Hall on 182 out of 233 ballots. So 51 guys opted not to vote for him. WEIRD.
Even if enough HOF voters don't accept the newer stats, I think there's a chance)I realize I'm being optimistic, but I love Chase) he may get in if enough voters consider that his playing time was shortened by injury , and he was the best player at his position for several years.


text:
CRYSTAL LAKE – District 155 has set its fifth annual Parent University.
The event is geared toward current and future parents of District 155 students, and provides practical information to help parents guide their children through the high school years.
The free event runs from 8:30 a.m. to 12:30 p.m. on Saturday, Feb. 23. Tomorrow is the registration deadline.
Licensed clinical professional counselor Lorena Gorey will be the event's keynote speaker. She will talk about the changes to the parent-child relationship during the high school years.
A former District 155 guidance counselor, Gorey will provide productive ways in which parents can be part of their child's life. She will discuss how to ask questions with out interfering, how to be supportive but not controlling, and how to be an effective cheerleader for one's child.
Participants can choose two breakout sessions with topics that include bullying, college preparation, teen sexuality, teen depression and more.
A full list of courses and information can be found on the District's website at www.d155.org, or by calling 815-455-8500
– Chelsea McDougall


text:
Washington, DC - Congressman Maurice Hinchey (D-NY) and Congressman Paul Tonko (D-NY) today led 69 U.S. House members in calling on House leaders to schedule an immediate up or down vote on the emergency funding bill passed last week by the U.S. Senate to provide assistance to those affected by Hurricane Irene, Tropical Storm Lee and other natural disasters. This bipartisan legislation, which passed with 62 votes in the Senate, would provide $6.9 billion in emergency funding for ongoing disaster relief efforts across the country and prevent FEMA's Disaster Relief Fund from running into the red.
"The New Yorkers I represent don't want to see political games and half measures," said Hinchey. "The Senate legislation is comprehensive and fulfills the federal government's obligations to small businesses, families and local governments affected by Irene, Lee and other natural disasters. The House legislation falls well short and would require a complicated mess of additional bills and offsets that are a recipe for gridlock. We can't afford to play politics with this critical issue. Too many people in New York and across the country are counting on us. Congress has always provided the funding necessary to deal with natural disasters of this magnitude and this time should be no different."
"This is a time for effective government, not games and gridlock," said Tonko. "It has been three weeks since communities in Upstate New York and across the Northeast were first hit by devastating flooding. Since then, many have lost everything they own. The House legislation falls short of what our families need to rebuild their homes. It ignores disaster relief programs at USDA that should be guiding the recovery of our farmers and rural communities, but are hamstrung by backlogs and insufficient funds. The Senate bill gets us closer to where we need to be. There is no reason to keep this legislation from receiving a vote. With 48 states that have been impacted by federally declared emergencies this year, any Member – Republican or Democrat – should support allowing a vote on this bill."
President Obama has requested an additional $5.1 billion in funding for FEMA's Disaster Relief Fund, including $500 million for the remainder of Fiscal Year 2011 which ends September 30, and $4.6 billion for FY 2012. The U.S. Senate legislation meets the president's request of $5.1 billion and provides an additional $1.8 billion in funding for disaster recovery programs at other agencies. The House legislation provides a little over half that amount, with $3.65 billion for disaster recovery, including approximately $1 billion for FY 2011, divided between FEMA and the U.S. Army Corps of Engineers, and an additional $2.65 billion for FY 2012.


text:
Every year, the Sanford Health Foundation in Sioux Falls publishes a Donor Impact Report and enCourage newsletters. The publications highlight philanthropic leaders in the community, technologically-advanced equipment purchases, special events and updated Sanford Health facilities made possible by our generous donors.
The Sanford Health Foundation is grateful for you— the individuals, organizations and businesses that provided generous support to Sanford Health in 2013, and we are proud to honor and recognize you here.


text:
Welcome to Total Body DevelopmentSchedule
We offer Personal Training, Bootcamp Group Training, Team Training, Guidance on Nutritional / Diet Plans. Our Gym is located in Langley, BC and with in driving distance of Surrey (Cloverdale), Whiterock and Maple Ridge
TBD Bootcamp Langley
The Total Body Development's Langley Bootcamp is a challenging full body work out. We offer both morning and evening classes in our private Langley TBD Gym. Take your bootcamp to the next level!


text:
On most projects, I create the images, fine-tune the copy and lay out the ads. My knowledge of the field is helpful.
Cavalry Arms
Dark Horse Arms
NFATCA ad for Small Arms Review
SHOT Show booth graphic
Bus stop bench banner.
Buffalo horn grips made by Mr.Vu Kim Son
ultimak hostage ad web
Ultimak ad (Gun Digest)
Ad for Elite Tactical Systems
Ultimak catalog spread
Logo for Territorial Gunsmiths
Coca Cola billboard and magazine ad with 12 of my photos
Ad for left-hand bolt action rifles.
Territorial Gunsmithing brochure, front.
Territorial Gunsmithing brochure, inside.
Mesa Tactical
DVD cover.
Ad for GG&G distributor Lightfighter (Soldier of Fortune Magazine).
Valhalla ad (SWAT Magazine).
Full page ad for Valhalla (SWAT Magazine).
Lightfighter Product Catalog
Half page ad for Lightfighter (SWAT Magazine)
Price of Freedom postcard.


text:
According to Detective Lt. Eddie Garcia, officers responded to a call at about 9 p.m. regarding a verbal disturbance.
When police arrived at the scene they found evidence of a family disturbance and were told that a shotgun had been displayed during an assault.
Officers arrested Frank Guerra on charges of aggravated assault with a deadly weapon, a second degree felony, assault family/household member, impeding breath/circulation, a third degree felony, unlawful possession of a firearm and tampering or fabricating physical evidence with intent to impair.
The last two charges also are third degree felonies.
If convicted of the second degree felony, Guerra faces a possible 20-year prison sentence and a $10,000 fine.
A conviction on any of the third degree charges could result in a 10-year prison sentence and a $10,000 fine.


text:
Home List of Titles Self-consistent simulations of star cluster formation from gas clouds under the influence of galaxy-scale tidal fields
Please use this identifier to cite or link to this item: http://hdl.handle.net/1959.3/47740
|Download PDF (Accepted manuscript) (Adobe Acrobat PDF, 2 MB)
- Title
- Self-consistent simulations of star cluster formation from gas clouds under the influence of galaxy-scale tidal fields
- Author(s)
- Hurley, Jarrod R.; Bekki, Kenji
- Abstract
- We present the first results of a project aimed at following the formation and long-term dynamical evolution of star clusters within the potential of a host galaxy. Here, we focus on a model evolved within a simplified potential representing the Large Magellanic Cloud. This demonstrates for the first time the self-consistent formation of a bound star cluster from a giant molecular cloud. The model cluster reproduces the density profiles and structural characteristics of observed star clusters.
- Publication type
- Journal article
- Research centre
- Swinburne University of Technology. Faculty of Information and Communication Technologies. Centre for Astrophysics and Supercomputing
- Source
- Monthly Notices of the Royal Astronomical Society, Vol. 389, no. 1 (Sep 2008), pp. L61-L65
- Publication year
- 2008
- FOR Code(s)
- 0201 Astronomical and Space Sciences; 020110 Stellar Astronomy and Planetary Systems
- Keyword(s)
- Cluster galaxies; Evolution; Globular clusters; Large magellanic cloud; M67; Mass; Models; Monte-carlo simulations; N-body simulations methods; Open clusters; Stars formation; Stellar dynamics; Turbulence
- Publisher
- Wiley-Blackwell Publishing
- 0035-8711
- Publisher URL
- Copyright
- Copyright © 2008 The Authors. Journal compilation copyright © 2008 Royal Astronomical Society. The accepted manuscript is reproduced in accordance with the copyright policy of the publisher. The definitive publication is available at www.interscience.wiley.com.
- Full text
- Peer reviewed


text:
It was difficult to sleep. Anticipation had kept me awake, as did the roosters crowing every half hour, the dogs barking (probably fighting over a discarded dinner bone), and the stuffy, humid air.
I wake up early and eagerly get ready for the long-planned visit with Ancyto, the Compassion International child my family and I sponsor in Haiti. The hired driver/interpreter is due to arrive at about 10 a.m.
I linger, getting things organized. Camera. Water bottles. Protein bar. Cell phone. When I get to our breakfast room I see the driver has already arrived. It's only 7:30 a.m.
The cab driver and I head out early. We must travel a roundabout route because the more direct road was washed out in the last hurricane and has yet to be repaired. It'll be a 90-minute ride. The driver and I chat as I stare out the window at the changing countryside. He tells me of history and events of Haiti.
I watch as we pass naked children. Women dip water from a mud puddle where their donkey is urinating. Other women are leaving the large, murky puddle with their containers filled.
We wind along bumpy, potholed roads, up and down mountain sides, to a large river where we stop.
The driver makes a phone call and talks loudly in Creole. He is concerned whether we can get through the river.
The driver then puts the vehicle in low gear. We start into the river and are soon up to the door in water. We begin to climb the bank on the other side. We made it. It is not far now.
The view is a lovely green-blue of ocean water; beaches are dotted with roaming cattle grazing on a few blades of grass.
We are in Cotes de Fer, another community seeped in despair and hopelessness. With no work available, men sit around the town park, looking about aimlessly. Earthquake rubble sits just as it did more than a year ago. Naked children run through the streets. Garbage litters the curbside.
Meeting Ancyto
We pull up to the child development center. My heart is beating wildly again. The palms of my hands are moist. I search for the face I have posted on my refrigerator at home.
We enter a small room and he stands from a chair in the corner. Ancyto! I put out my hand to touch his. He is so tall. Oh, that's right, he's 14. He doesn't smile and I'm wiping tears and chatting. The interpreter is trying to keep up with what I am saying, snapping pictures of us every 30 seconds.
We sit in a small, dark room of Ancyto's school and chat about his schoolwork and favorite subjects. I give him gifts — a soccer ball, a pair of sandals, a package of gum. Ancyto pockets the gum with a smile.
I tell him about my children and their interests and show him pictures from the small album I made for him — pictures from the farm, pictures of my children, pictures of us as a family. Ancyto looks intently and turns the pages slowly. He comes back to pictures of my 16-year-old. He looks again at pictures of my youngest son and smiles. I cry.
My heart longs to touch this young man's heart, to make a difference in his life. We go for a walk and he shows me his classrooms — simple plywood structures after the earthquake flattened the previous child development center.
I meet Ancyto's mother and sisters. We walk through town to visit their home and pass many of their friends. I'm introduced to his older brother. We meet Ancyto's father, who leaves the group of sitting men and walks with us.
We arrive at their simple, small, crowded, freshly cleaned home. Jagged cracks in the wall show the obvious earthquake damage. Ancyto's mother is so proud to have me in their home.
We talk about gardens. We talk about raising children. She shows me a basket of fresh fruit she has arranged for me to take home. I feel all warm and flushed because this is such a big gift for a family of little means.
Dad has no work. They have very few possessions. They struggle to survive, yet they give me a gift. Me — an American with a good job, a farm, and here in Haiti to minister to them. I am overwhelmed.
It is soon time to leave and I feel my heart tug. I want to stay longer. I want to crawl into their lives and be with them, listen to them, walk with them.
We return to the development center, where a meal has been prepared for us in honor of my visit. I am humbled. I don't deserve such honor. I'm just as human as they are. I'm the one with much.
Everyone is so gracious with so little to give. We break bread together, eat and laugh and talk about Ancyto playing soccer. Ancyto is spinning the soccer ball on his finger. His face shows anticipation of kicking that ball around with the other boys. The time has come and I must say good-bye. Ancyto's mother cries.
"Thank you, thank you so much for giving my son a better chance in life."
My vision blurs. I brush back the wetness in fear that if I cry I might not stop. I think,
"This is so big, Lord. I want to run. Help me say good-bye. Help me to leave here graciously."
I turn to Ancyto and touch his shoulder. He looks at me gently and touches my arm. The interpreter translates for him,
"Someday, I want to visit you — my other mother — and your family and your farm over in America."
I respond,
"Yes, Ancyto, we will pray God would make that dream come true."
I swallow, I hold his arms close and we embrace gently, tenderly, lingering. His 4-year-old sister tugs at my sleeve. She wants a hug too. We reach the vehicle. I get in, then turn and wave. The family huddles together, touching one another, wiping tears, waving and blowing kisses. And I pray,
Lord, I am not just sponsoring a Compassion child. Rather, You have given me another whole family. I am the one who is so blessed by these sweet people. Watch over them. Protect them. Keep their hearts only for You.
ABOUT THE AUTHOR: Leanne Beyer is a widowed mom of five children and has been a Compassion sponsor for several years. She was one of the first sponsors to visit her sponsored child in Haiti after the 2010 earthquake. When Leanne is not working as a registered nurse, you can find her working hard at her family's 75-acre farm in Wisconsin.


text:
Tony Q & A on Facebook 07/26/13
"We know that Mother Nature is a woman. If she were a man, there would be no rain on race day."
All things Tony
housesandhogans wrote:That's interesting. I wonder how that works. I have a personal dislike for FB, so I am usually lost when I go there, but might take a look if I can find it. lol Is that Eastern or Central time?
Users browsing this forum: No registered users and 5 guests


text:
- Sign-In to Store Account
Sign In to the LexisNexis StoreForgot Username/Password?
- Register
- Customer Service
- LexisNexis on FacebookLexisNexis on Twitter
Questions & Answers: Administrative Law
Publisher: Carolina Academic Press
Linda D. Jellum, Ellison Capers Palmer Sr. Professor of Law, Mercer University School of Law; Karen A. Jordan, Professor of Law, University of Louisville, Louis D. Brandeis School of Law
Available Formats
- eBook: epub
- for e-readers, including Adobe® Digital Editions, Apple® iPad®, SONY® Reader
Publisher:Carolina Academic Press
Recommended Products
Questions & Answers: Business Associations, Second Edition (2011)
Douglas M. Branson, W. Edward Sell Chair in Business Law, University of Pittsburgh School of Law
Questions & Answers: Criminal Procedure - Police Investigation, Third Edition
Neil P. Cohen; Michael J. Benza; Wayne A. Logan
Questions & Answers: Evidence, Third Edition (2013)
The Late David P. Leonard, Professor of Law & William M. Rains Fellow, Loyola Law School, Los Angeles; Paul C. Giannelli, Distinguished University Professor and Weatherhead Professor of Law, Case Western Reserve University
Questions & Answers: Professional Responsibility, Third Edition (2012)
Patrick Longan's text will help you better understand the material and prepare more effectively for exams.
Questions & Answers: Wills, Trusts, and Estates, Second Edition
This study guide includes 290 multiple-choice and short-answer questions arranged topically for ease of use during the semester, plus an additional set of 19 questions comprising a comprehensive "practice exam".


text:
This was mothers day weekend My good friend/sister Tami and her childern Grace and Jesse were up visiting and I took them fishing for the first time in Henderson NY. Family is everything to me a great way to spend a mothers day with best friend and her family and my daughter katelyn. To see the smiles on there faces to be able to cast a line and catch a fish and to let the little fish go back in the water was cute the kids would talk to the fish and say goodbye little fish it was nice meeting u enjoy my worm have a great day. this moment i spent with them was price les...
family fishing day
By: jo4413606Subscribe Channel: Summer Location: Henderson NY
1 Comment
This story is inappropriate and should be flagged for moderation. Please choose from one of the following options:
Also by jo4413606
You have indicated this comment should be removed.
The comment has been submitted for review. Thank you .
says ... on Friday, Jul 8 at 10:32 AM
this is a great shot of fishing should win70355207
Inappropriate? Alert Us!


text:
Upstairs, Lincoln gathered a few articles of clothing. "In New York some friend had given me a new beaver hat in a box, and in it had placed a soft wool hat," he later commented. "I had never worn one of the latter in my life. I had this box in my room. Having informed a very few friends of the secret of my new movements, and the cause, I put on an old overcoat that I had with me, and putting the soft hat in my pocket, I walked out of the house at a back door, bareheaded, without exciting any special curiosity. Then I put on the soft hat and joined my friends without being recognized by strangers, for I was not the same man."
A "vast throng" had gathered at the front of the Jones House, perhaps hoping to hear one of Lincoln's balcony speeches. Governor Curtin, anxious to quiet any rumors if Lincoln were spotted leaving the hotel, called out orders to a carriage driver that the president-elect was to be taken to the Executive Mansion. If the departure drew any notice, he reasoned, it would be assumed that Lincoln was simply paying a visit to the governor's residence. As Curtin made his way back inside, he was joined by Ward Hill Lamon, Lincoln's friend and self-appointed bodyguard. Drawing Lamon aside, Curtin asked if he was armed. Lamon "at once uncovered a small arsenal of deadly weapons. In addition to a pair of heavy revolvers, he had a slung-shot and brass knuckles and a huge knife nestled under his vest." The slung-shot, a crude street weapon involving a weight tied to a wrist strap, was popular at that time among street gangs.
When Lincoln emerged, Judd would report, he carried a shawl draped over his arm. The shawl, according to Lamon, would help mask Lincoln's features as he emerged from the hotel. Curtin led the group toward the side entrance of the hotel, where a carriage waited. As they made their way along the corridor, Judd whispered to Lamon: "As soon as Mr. Lincoln is in the carriage, drive off. The crowd must not be allowed to identify him."
Reaching the side door, Lamon climbed into the carriage first, then turned to help Lincoln and Curtin. The first phase of Pinkerton's scheme had gone according to plan.
Among the crew of Felton's railroad, it appeared that the most notable thing to occur on the evening of February 22 had been a set of special instructions concerning the 11 p.m. train from Philadelphia. Felton himself had directed the conductor to hold his train at the station to await the arrival of a special courier, who would hand off a vitally important parcel. Under no circumstance could the train depart without it, Felton warned, "as this package must go through to Washington on tonight's train."
In fact, the package was a decoy, part of an elaborate web of bluffs and blinds that Pinkerton had constructed. In order to make the package convincing, Felton would recall, he and Pinkerton assembled a formidable-looking parcel done up with an impressive wax seal. Inside was a stack of useless old railroad reports. "I marked it 'Very important — To be delivered, without fail, by eleven o'clock train,'" Felton recalled.
Lincoln would have to cover more than 200 miles in a single night, running in darkness for most of the route, with two changes of train. The revised scheme would accomplish Pinkerton's original goal of bringing Lincoln through Baltimore earlier than expected. In addition, Lincoln would make his approach to the city on a different rail line, and arrive at a different station.
Though Lincoln would be making the first leg of his trip in a private train, Pinkerton could not risk using special equipment for the remaining two segments of the journey, as it would draw attention to Lincoln's movements to have an unscheduled special on the tracks that night. In order to travel anonymously, Lincoln would have to ride on regular passenger trains, gambling that the privacy of an ordinary sleeping compartment would be sufficient to conceal his presence.
Having charted this route, Pinkerton now confronted a scheduling problem. The train carrying Lincoln from Harrisburg would likely not reach Philadelphia in time to connect with the second segment of the journey, the 11 p.m. train to Baltimore. Felton's decoy parcel, it was hoped, would hold the Baltimore-bound train at the depot without drawing undue suspicion, until Lincoln could be smuggled aboard. If all went according to plan, Lincoln would arrive in Baltimore in the dead of night. His sleeper car would be unhitched and drawn by horse to Camden Street Station, where it would be coupled to a Washington-bound train.
The task of getting Lincoln safely aboard the Baltimore-bound passenger train would be especially delicate, as it would have to be done in plain view of passengers and crew. For this, Pinkerton needed a second decoy, and he counted on Kate Warne to supply it. In Philadelphia, Warne made arrangements to reserve four double berths on the sleeper car at the back of the train. She had been instructed by Pinkerton to "get in the sleeping car and keep possession" until he arrived with Lincoln.


text:
Related Reading
Editor's note: RADIUS author Jonathan Hassell brings practical suggestions and advice in his book for implementing RADIUS, and he provides instructions for using an open source variation called FreeRADIUS. In this excerpt, Jonathan shows you how to install, configure, and test FreeRADIUS.
[RADIUS covers, among other things,] the theoretical underpinnings of both the authentication-authorization-accounting (AAA) architecture as well as the specific implementation of AAA characteristics that is the RADIUS protocol. [In this excerpt from Chapter 5], I will now focus on practical applications of RADIUS: implementing it, customizing it for your specific needs, and extending its capabilities to meet other needs in your business. First, though, I need a product that talks RADIUS.
Enter FreeRADIUS.
The developers of FreeRADIUS speak on their product and its development, from the FreeRADIUS Web site:
FreeRADIUS is one of the most modular and featureful [sic] RADIUS servers available today. It has been written by a team of developers who have more than a decade of collective experience in implementing and deploying RADIUS software, in software engineering, and in Unix package management. The product is the result of synergy between many of the best-known names in free software-based RADIUS implementations, including several developers of the Debian GNU/Linux operating system, and is distributed under the GNU GPL (version 2).
FreeRADIUS is a complete rewrite, ground-up compilation of a RADIUS server. The configuration files exhibit many similarities to the old Livingston RADIUS server. The product includes support for:
DEFAULT entry, with each being capable of "falling through" to the next
huntgroup to which they are connected
huntgroup specific
$INCLUDE filename format with configuration, users, and dictionary files
FreeRADIUS supports the following popular NAS equipment:
FreeRADIUS is available for a wide range of platforms, including Linux, FreeBSD, OpenBSD, OSF/Unix, and Solaris. For the purposes of this book, I will focus on FreeRADIUS running under Linux. Also, as of this printing, a stable Version 1.0 of the product had not been released. However, development of the server is very stable, careful, and somewhat slow, so changes to the procedures mentioned are unlikely. In the event a procedure does change, it's likely to be a relatively small modification. Always check the FreeRADIUS Web site for up-to-date details.
At present, the FreeRADIUS team doesn't offer precompiled binaries. The best way to start off is to grab the latest source code, compressed using tar and gzip, from the FreeRADIUS Web site. Once the file is on your computer, execute the following command to uncompress the file:
tar -zxvf freeradius.tar.gz
Next, you'll need to compile FreeRADIUS. Make sure your system at least has
binutils, and
gmake installed before trying to compile. To begin compiling, change to the directory where your uncompressed source code lies and execute
./configure from the command line. You can also run
./configure -flags and customize the settings for the flags in Table 5-1.
Table 5-1: Optional configuration flags for FreeRADIUS
|Builds shared libraries.
|Builds static libraries.
|Optimizes the resulting files for fastest installation.
|Makes the procedure assume the C compiler uses GNU lD.
|Avoids locking problems. This may break parallel builds.
|Not applicable
|Specifies the directory for log files.
|Specifies the directory for detail files.
|Specifies the directory for configuration files.
|Makes the dictionary case insensitive.
|Includes support for attributes provided with the Ascend binary filter.
|Uses threads if they're supported and available.
|Compiles SNMP support into the binaries.
|Specifies where the include files for MySQL can be found.
|Not applicable
|Specifies where the dictionary files for MySQL can be found.
|Not applicable
|Specifies where MySQL is installed on the local system.
|Not applicable
|Does not install
|Not applicable
|Compiles the list of modules statically.
|Not applicable
|Turns on extra developer warnings in the compiler.
|Not applicable
Commonly, the following locations are used when installing a RADIUS product (these practices go back to the Cistron RADIUS server):
Binaries: /usr/local/bin and /usr/local/sbin
Manual (man) pages: /usr/local/man
Configuration files: /etc/raddb
Log files: /var/log and /var/log/radacct
To make the compiler use these locations automatically, execute:
./configure --localstatedir=/var --sysconfdir=/etc
The programs will then be configured to compile. The rest of this chapter will assume that you installed FreeRADIUS in these locations.
Next, type
make. This will compile the binaries. Finally, type
make install. This will place all of the files in the appropriate locations. It will also install configuration files if this server has not had a RADIUS server installed before. Otherwise, the procedure will not overwrite your existing configuration and will report to you on what files it did not install.
At this point, your base FreeRADIUS software is installed. Before you begin, though, you'll need to customize some of the configuration files so that they point to machines and networks specific to your configuration. Most of these files are located in /etc/raddb. The following files are contained by default:
radius:/etc/raddb # ls -al
total 396
drwxr-xr-x 2 root root 4096 Apr 10 10:39 .
drwxr-xr-x 3 root root 4096 Apr 10 10:18 ..
-rw-r--r-- 1 root root 635 Apr 10 10:18 acct_users
-rw-r--r-- 1 root root 3431 Apr 10 10:18 attrs
-rw-r--r-- 1 root root 595 Apr 10 11:02 clients
-rw-r--r-- 1 root root 2235 Apr 10 10:39 clients.conf
-rw-r--r-- 1 root root 12041 Apr 10 10:18 dictionary
-rw-r--r-- 1 root root 10046 Apr 10 10:39 dictionary.acc
-rw-r--r-- 1 root root 1320 Apr 10 10:39 dictionary.aptis
-rw-r--r-- 1 root root 54018 Apr 10 10:39 dictionary.ascend
-rw-r--r-- 1 root root 11051 Apr 10 10:39 dictionary.bay
-rw-r--r-- 1 root root 4763 Apr 10 10:39 dictionary.cisco
-rw-r--r-- 1 root root 1575 Apr 10 10:39 dictionary.compat
-rw-r--r-- 1 root root 1576 Apr 10 10:39 dictionary.erx
-rw-r--r-- 1 root root 375 Apr 10 10:39 dictionary.foundry
-rw-r--r-- 1 root root 279 Apr 10 10:39 dictionary.freeradius
-rw-r--r-- 1 root root 2326 Apr 10 10:39 dictionary.livingston
-rw-r--r-- 1 root root 2396 Apr 10 10:39 dictionary.microsoft
-rw-r--r-- 1 root root 190 Apr 10 10:39 dictionary.nomadix
-rw-r--r-- 1 root root 1537 Apr 10 10:39 dictionary.quintum
-rw-r--r-- 1 root root 8563 Apr 10 10:39 dictionary.redback
-rw-r--r-- 1 root root 457 Apr 10 10:39 dictionary.shasta
-rw-r--r-- 1 root root 2958 Apr 10 10:39 dictionary.shiva
-rw-r--r-- 1 root root 1274 Apr 10 10:39 dictionary.tunnel
-rw-r--r-- 1 root root 63265 Apr 10 10:39 dictionary.usr
-rw-r--r-- 1 root root 2199 Apr 10 10:39 dictionary.versanet
-rw-r--r-- 1 root root 1767 Apr 10 10:18 hints
-rw-r--r-- 1 root root 1603 Apr 10 10:18 huntgroups
-rw-r--r-- 1 root root 2289 Apr 10 10:39 ldap.attrmap
-rw-r--r-- 1 root root 830 Apr 10 10:18 naslist
-rw-r--r-- 1 root root 856 Apr 10 10:18 naspasswd
-rw-r--r-- 1 root root 9533 Apr 10 10:39 postgresql.conf
-rw-r--r-- 1 root root 4607 Apr 10 10:39 proxy.conf
-rw-r--r-- 1 root root 27266 Apr 10 10:57 radiusd.conf
-rw-r--r-- 1 root root 27232 Apr 10 10:39 radiusd.conf.in
-rw-r--r-- 1 root root 1175 Apr 10 10:18 realms
-rw-r--r-- 1 root root 1405 Apr 10 10:39 snmp.conf
-rw-r--r-- 1 root root 9089 Apr 10 10:39 sql.conf
-rw-r--r-- 1 root root 6941 Apr 10 10:18 users
-rw-r--r-- 1 root root 6702 Apr 10 10:39 x99.conf
-rw-r--r-- 1 root root 3918 Apr 10 10:39 x99passwd.sample
First, take a look at the /etc/raddb/clients file. This file lists the hosts authorized to hit the FreeRADIUS server with requests and the secret key those hosts will use in their requests. Some common entries are already included in the /etc/raddb/clients file, so you may wish to simply uncomment the appropriate lines. Make sure the secret key that is listed in the clients file is the same as that programmed into your RADIUS client equipment. Also, add the IP address of a desktop console machine with which you can test your setup using a RADIUS ping utility. A sample clients file looks like this:
# Client Name Key
#---------------- ----------
#portmaster1.isp.com testing123
#portmaster2.isp.com testing123
#proxyradius.isp2.com TheirKey
localhost testing123
192.168.1.100 testing123
tc-clt.hasselltech.net oreilly
TIP: It's recommended by the FreeRADIUS developers that users move from the clients file to the clients.conf file. The clients.conf file wis not addressed in this chapter, but for the sake of simplicity and startup testing, I will continue using the plain clients file in this introduction.
While it may seem obvious, change the shared secrets from the defaults in the file or the samples listed previously. Failing to do so presents a significant security risk to your implementation and network.
Next, open the /etc/raddb/naslist file. Inside this file, you should list the full canonical name of every NAS that will hit this server, its nickname, and the type of NAS. For your test console, you can simply use the "
portslave" type. Table 5-2 lists the FreeRADIUS-supported NAS equipment and the type identifier needed for the naslist file.
Table 5-2: Supported NAS equipment and its type identifier
|NAS equipment
|Type identifier
|3Com/USR Hiper Arc Total Control
|3Com/USR NetServer
|3Com/USR TotalControl
|Ascend Max 4000 family
|Cisco Access Server family
|Cistron PortSlave
|Computone PowerRack
|Cyclades PathRAS
|Livingston PortMaster
|Multitech CommPlete Server
|Patton 2800 family
A sample /etc/raddb/naslist file looks like this:
# NAS Name Short Name Type
#---------------- ---------- ----
#portmaster1.isp.com pm1.NY livingston
localhost local portslave
192.168.1.100 local portslave
tc-clt.hasselltech.net tc.char tc
If you have 3Com/USR Total Control, NetServer, or Cyclades PathRAS equipment, you may need to edit the /etc/raddb/naspasswd file. This lets the
checkrad utility log onto your NAS machine and check to see who is logged on at what port--which is commonly used to detect multiple logins. Normally, the SNMP protocol can do this, but the equipment listed previously needs a helping hand from the
checkrad utility. A sample /etc/raddb/naspasswd file looks like this:
18.104.22.168 !root JoNAThaNHasSELl
18.104.22.168 !root FoOBaR
Progressing along with the FreeRADIUS setup you will come to the /etc/raddb/hints file. This file can be used to provide "hints" to the RADIUS server about how to provision services for a specific user based on how his login name is constructed. For example, when you've configured your default service to be a SLIP connection, then a SLIP connection will be set up if a user logs in with her standard username (e.g., meis). However, if that same user wanted a PPP connection, she could alter her username to be Prneis, and the RADIUS server (knowing about that convention from the /etc/raddb/hints file) would set up a PPP connection for her. Suffixes on the end of the username work in the same way. More on the hints file will be provided later in the chapter. You shouldn't need to edit this file initially since we're just testing, but if you'd like to check it out, a sample /etc/raddb/hints file looks like this:
DEFAULT Prefix = "P", Strip-User-Name = Yes
Hint = "PPP",
Service-Type = Framed-User,
Framed-Protocol = PPP
DEFAULT Prefix = "S", Strip-User-Name = Yes
Hint = "SLIP",
Service-Type = Framed-User,
Framed-Protocol = SLIP
DEFAULT Suffix = "P", Strip-User-Name = Yes
Hint = "PPP",
Service-Type = Framed-User,
Framed-Protocol = PPP
DEFAULT Suffix = "S", Strip-User-Name = Yes
Hint = "SLIP",
Service-Type = Framed-User,
Framed-Protocol = SLIP
Let's move on to the /etc/raddb/huntgroups file, where you define certain huntgroups. Huntgroups are sets of ports or other communication outlets on RADIUS client equipment. In the case of FreeRADIUS, a huntgroup can be a set of ports, a specific piece of RADIUS client equipment, or a set of calling station IDs that you want to separate from other ports.
You can filter these defined huntgroups to restrict their access to certain users and groups and match a username/password to a specific huntgroup, possibly to assign a static IP address. You define huntgroups based on the IP address of the NAS and a port range. (Keep in mind that a range can be anywhere from 1 to the maximum number of ports you have.) To configure this file, you first specify the terminal servers in each POP. Then, you configure a stanza that defines the restriction and the criteria that a potential user must satisfy to pass the restriction. That criteria is most likely a Unix username or groupname.
Again, you shouldn't have to configure this file to get basic functionality enabled for testing; if you would like to peruse the file and its features, however, I've provided a sample /etc/raddb/huntgroups file. It's for an ISP with a POP in Raleigh, North Carolina that wants to restrict the first five ports on its second of three terminal servers in that POP to only premium customers:
raleigh NAS-IP-Address == 192.168.1.101
raleigh NAS-IP-Address == 192.168.1.102
raleigh NAS-IP-Address == 192.168.1.103
premium NAS-IP-Address == 192.168.1.101, NAS-Port-Id == 0-4
Group = premium,
Group = staff
FreeRADIUS allows several modifications to the original RADIUS server's style of treating users unknown to the users file. In the past, if a user wasn't configured in the users file, the server would look in the Unix password file, and then deny him access if he didn't have an account on the machine. There was only one default entry permitted. In contrast, FreeRADIUS allows multiple default entries and can "fall through" each of them to find an optimal match. The entries are processed in the order they appear in the users file, and once a match is found, RADIUS stops processing it. The
Fall-Through = Yes attribute can be set to instruct the server to keep processing, even upon a match. The new FreeRADIUS users file can also accept spaces in the username attributes, either by escaping the space with a backslash (\) or putting the entire username inside quotation marks. Additionally, FreeRADIUS will not strip out spaces in usernames received from PortMaster equipment.
Since we won't add any users to the users file for our testing purposes, FreeRADIUS will fall back to accounts configured locally on the Unix machine. However, if you want to add a user to the users file to test that functionality, a sample /etc/raddb/users file looks like this:
steve Auth-Type := Local, User-Password == "testing"
Service-Type = Framed-User,
Framed-Protocol = PPP,
Framed-IP-Address = 172.16.3.33,
Framed-IP-Netmask = 255.255.255.0,
Framed-Routing = Broadcast-Listen,
Framed-Filter-Id = "std.ppp",
Framed-MTU = 1500,
Framed-Compression = Van-Jacobsen-TCP-IP
DEFAULT Service-Type == Framed-User
Framed-IP-Address = 255.255.255.254,
Framed-MTU = 576,
Service-Type = Framed-User,
Fall-Through = Yes
DEFAULT Framed-Protocol == PPP
Framed-Protocol = PPP,
Framed-Compression = Van-Jacobson-TCP-IP
There will be much more about the users file later in this chapter.
This file is much like Apache's httpd.conf file in that it lists nearly every directive and option for the basic functionality of the FreeRADIUS product. You will need to edit the Unix section of this file to make sure that the locations of the passwd, shadow, and group files are not commented out and are correct. FreeRADIUS needs these locations to start up. The appropriate section looks like this:
unix {
(some content removed)
# Define the locations of the normal passwd, shadow, and group files.
# 'shadow' is commented out by default, because not all
# systems have shadow passwords.
# To force the module to use the system passwd fnctns,
# instead of reading the files, comment out the 'passwd'
# and 'shadow' configuration entries. This is required
# for some systems, like FreeBSD.
passwd = /etc/passwd
shadow = /etc/shadow
group = /etc/group
(some content removed)
I will cover the radiusd.conf file in more detail later in this chapter.
With that done, it's now time to launch the
radiusd daemon and test your setup. Execute
radiusd from the command line; it should look similar to this:
radius:/etc/raddb # radiusd
radiusd: Starting - reading configuration files ...
radius:/etc/raddb #
If you receive no error messages, you now have a functional FreeRADIUS server. Congratulations!
Once you have FreeRADIUS running, you need to test the configuration to make sure it is responding to requests. FreeRADIUS starts up listening, by default, on the port specified either in the local /etc/services file or in the port directive in radiusd.conf. While RFC 2138 defines the standard RADIUS port to be 1812, historically RADIUS client equipment has used port 1645. Communicating via two different ports is obviously troublesome, so many users start the FreeRADIUS daemon with the
-p flag, which overrides the setting in both the /etc/services file and anything set in radiusd.conf. To do this, run the following from the command line:
radius:/etc/raddb # radiusd -p 1645
radiusd: Starting - reading configuration files ...
radius:/etc/raddb #
The server is now running; it is listening for and accepting requests on port 1645.
So, what is an easy way to test your configuration to see if it functions properly? It's easier than you might think, in fact. MasterSoft, Inc. has released a Windows desktop RADIUS server testing tool called NTRadPing, available at http://www.dialways.com. The latest version as of this writing is 1.2, and it's a freeware tool. Download and install this utility on a Windows machine, and then run it. The initial application window should look much like Figure 5-1.
Figure 5-1. The NTRadPing 1.2 application window
To do a quick test, follow these steps:
Enter the IP address of your FreeRADIUS machine in the RADIUS Server/port box, and then the port number in the adjacent box. For this example, I've used IP address
192.168.1.103 and port 1645.
Type in the secret key you added in /etc/raddb/clients for this Windows console machine. For this example, I used the key "testing123."
In the User-Name field, enter root, and in the Password field, enter the root password for your FreeRADIUS machine.
Select Authentication Request from the Request Type drop-down list box.
Click Send.
If your server is working properly, and you entered a valid root password, you should see the reply in the RADIUS Server reply box to the right of the NTRadPing window. You should see something like:
Sending authentication request to server 192.168.1.103:1645
Transmitting packet, code=1 id=1 length=47
Received response from the server in 15 milliseconds
Reply packet code=2 id=1 length=20
Response: Access-Accept
------------------attribute dump----------------------
Now, change the password for root inside NTRadPing to something incorrect, and resend the request. You should get an
Access-Reject message much like the one shown here:
Sending authentication request to server 192.168.1.103:1645
Transmitting packet, code=1 id=3 length=47
No response from server (timed out), new attempt (#1)
Received response from the server in 3516 milliseconds
Reply packet code=3 id=3 length=20
Response: Access-Reject
------------------attribute dump----------------------
Next, you'll need to test accounting packets. The old standard for RADIUS accounting used port 1646. Change the port number in NTRadPing accordingly, and select Accounting Start from the Request Type drop-down list box. Make sure the root password is correct again, and send your request along. The response should be similar to the following:
Sending authentication request to server 192.168.1.103:1646
Transmitting packet, code=4 id=5 length=38
Received response from the server in 15 milliseconds
Reply packet code=5 id=5 length=20
Response: Accounting-Response
------------------attribute dump----------------------
Finally, stop that accounting process by changing the Request Type box selection to Accounting Stop and resending the request. You should receive a response like this:
Sending authentication request to server 192.168.1.103:1645
Transmitting packet, code=4 id=6 length=38
Received response from the server in 16 milliseconds
Reply packet code=5 id=6 length=20
Response: Accounting-Response
------------------attribute dump----------------------
If you received successful responses to all four ping tests, then FreeRADIUS is working properly. If you haven't, here's a quick list of things to check:
Is FreeRADIUS running? Use
ps -aux | grep radiusd
to determine whether the process is active or not.
Is FreeRADIUS listening on the port you're pinging? If necessary, start
radiusd with an explicit port, i.e.,
radiusd -p 1645
Have you added your Windows console machine to the list of authorized clients that can hit the RADIUS server? Do this in the /etc/raddb/clients file.
Are you using the correct secret key? This as well is configured in the /etc/raddb/clients file.
Have you double-checked the locations of the group, passwd, and shadow files inside the radiusd.conf file? These locations are specified in the Unix section. Make sure they're not commented out and that the locations are correct.
Can FreeRADIUS read the group, passwd, and shadow files? If you're running FreeRADIUS as root, this shouldn't be a problem, but check the permissions on these files to make sure the user/group combination under which
radiusd is running can access those files.
Is there any port filtering or firewalling between your console machine and the RADIUS server that is blocking communications on the ping port?
Is the daemon taking a long time to actually start up and print a ready message (if you're running in debugging mode)? If so, your DNS configuration is broken.
To assist in diagnosing your problem, you may want to try running the server in debugging mode. While operating in this mode, FreeRADIUS outputs just about everything it does, and by simply sifting through all of the messages it prints while running, you can identify most problems.
To run the server in debugging mode, enter the following on the command line to start
radiusd -sfxxyz -l stdout
It should respond with a ready message if all is well. If it doesn't, then look at the error (or errors as the case may be) and run through the checklist above.
You can also check the configuration of FreeRADIUS using the following command:
radiusd -c
This command checks the configuration of the RADIUS server and alerts you to any syntax errors in the files. It prints the status and exits with either a zero, if everything is correct, or a one if errors were present. This command is also useful when you're updating a production server that cannot be down: if there were a syntax error in the files,
radiusd would fail to load correctly, and downtime would obviously ensue. With the check capability, this situation can be avoided.
At this point, you've compiled, installed, configured, started, and tested a simple FreeRADIUS implementation that is functional. However, 99.5% of the RADIUS/AAA implementations around the world are just not that simple. In this section, I'll delve into the two major configuration files and discuss how to tweak, tune, customize, and effect change to the default FreeRADIUS installation.
radiusd.conf file is the central location to configure most aspects of the FreeRADIUS product. It includes configuration directives as well as pointers and two other configuration files that may be located elsewhere on the machine. There are also general configuration options for the multitude of modules available now and in the future for FreeRADIUS. The modules can request generic options, and FreeRADIUS will pass those defined options to the module through its API.
Before we begin, some explanation is needed of the operators used in the statements and directives found in these configuration files. The
= operator, as you might imagine, sets the value of an attribute. The
:= operator sets the value of an attribute and overwrites any previous value that was set for that attribute. The
== operator compares a state with a set value. It's critical to understand how these operators work in order to obtain your desired configuration.
In this chapter, I'll look at several of the general configuration options inside radiusd.conf.
This file contains the process identification number for the
radiusd daemon. You can use this file from the command line to perform any action to a running instance of FreeRADIUS. For example, to shut FreeRADIUS down without any protests, issue:
kill -9 `cat /var/run/radiusd.pid'
pidfile = [path]
pidfile = ${run_dir}/radiusd.pid
user and
These options dictate under what user and group
radiusd runs. It is not prudent to allow FreeRADIUS to run under a user and group with excessive permissions. In fact, to minimize the permissions granted to FreeRADIUS, use the
user and
group "nobody." However, on systems configured to use shadow passwords, you may need to set the
user to "nobody" and the
group to "shadow" so that
radiusd can read the shadow file. This is not a desirable idea. On some systems, you may need to set both the user and group to "root," although it's clear why that is an even worse idea.
user = [username]; group = [groupname]
user = nobody; group = nobody
This option specifies the maximum number of seconds a request will be processed by FreeRADIUS. If the handling of a request takes longer than this threshold, the process can be killed off and an
Access-Reject message returned. This value can range from 5 to 120 seconds.
max_request_time = 30
max_request_time = 60
This directive is paired with the
max_request_time directive in that it controls when requests that exceed the time threshold should be killed. Most of the time, this value should be set to "no."
delete_blocked_requests = [yes/no]
delete_blocked_requests = no
When FreeRADIUS sends a reply to RADIUS client equipment, it generally caches that request internally for a few seconds to ensure that the RADIUS client will receive the message (sometimes network problems, offline servers, and large traffic loads might prevent the client from picking up the packet). The client receives a quick reply on its prompting for a second copy of the packet, since the internal cache mechanism for FreeRADIUS is much quicker than processing the request again. This value should be set between 2 and 10: this range is the happy medium between treating every request as a new request and caching so many processed requests that some new requests are turned away.
cleanup_delay = [value]
cleanup_delay = 6
This directive specifies the maximum number of requests FreeRADIUS will keep tabs on during operation. The value starts at 256 and scales with no upper limit, and ideally this is set at the number of RADIUS clients you have multiplied by 256. Setting this value too high causes the server to eat up more system memory, while setting it too low causes a delay in processing new requests once this threshold has been met. New requests must wait for the cleanup delay period to finish before they can be serviced.
max_requests = [value]
max_requests = [256 * x number of clients]
This directive specifies the address under which
radiusd will accept requests and reply to them. The "address" can be an IP address, fully qualified domain name, or the
* wildcard character (to instruct the daemon to listen on all interfaces).
bind_address = [value]
bind_address = *
This setting instructs FreeRADIUS to listen on a specific port. While the RADIUS RFC specifies that the official RADIUS port is 1812, historically NAS equipment and some RADIUS servers have used port 1645. You should be aware of the port your implementation uses. While you can specify a certain port here, you can also instruct
radiusd to use the machine's /etc/services file to find the port to use. Additionally, using the
-p switch when executing
radiusd will override any port setting provided here.
port = [value]
port = 1645
This directive tells FreeRADIUS whether to look up the canonical names of the requesting clients or simply log their IP address and move on. Much like with Apache, DNS queries take a long time and, especially on highly loaded servers, can be a detriment to performance. Turning this option on also causes
radiusd to block the request for 30 seconds while it determines the CNAME associates with that IP address. Only turn this option on if you are sure you need it.
hostname_lookups = [yes/no]
hostname_lookups = no
This directive determines whether FreeRADIUS should dump to core when it encounters an error or simply silently quit with the error. Only enable this option if you're developing for FreeRADIUS or attempting to debug a problem with the code.
allow_core_dumps = [yes/no]
allow_core_dumps = no
This set of controls configures regular and extended expression support. Realistically, you shouldn't need to alter these as they're set when running the ./configure command upon initial install.
regular_expressions = [yes/no]; extended_expressions = [yes/no]
regular_expressions = yes; extended_expressions = yes
These directives control how access to and requests of the FreeRADIUS server are logged. The
log_stripped_names control instructs FreeRADIUS whether to include the full
User-Name attribute as it appeared in the packet. The
log_auth directive specifies whether to log authentication requests or simply carry them out without logging. The
log_auth_badpass control, when set to yes, causes
radiusd to log the bad password that was attempted, while the
log_auth_goodpass logs the password if it's correct.
log_stripped_names = [yes/no]; log_auth = [yes/no];
log_auth_badpass = [yes/no]; log_auth_goodpass = [yes/no]
log_stripped_names = no; log_auth = yes;
log_auth_badpass = yes; log_auth_goodpass = no
lower_user and
To eliminate case problems that often plague authentication methods such as RADIUS, the FreeRADIUS developers have included a feature that will attempt to modify the
User-Name and
User-Password attributes to make them all lowercase; this is done either before an authentication request, after a failed authentication request using the values of the attributes as they came, or not at all.
Clearly setting the
lower_user directive to
after makes the most sense: it adds processing time to each request, but unless this particular machine normally carries a high load, the reduced troubleshooting time is worth the extra performance cost. However, a secure password often makes use of a combination of uppercase and lowercase letters, so security dictates leaving the password attribute alone.
lower_user = [before/after/no]; lower_pass = [before/after/no]
lower_user = after; lower_pass = no
nospace_user and
Much like the
lower_user and
lower_pass controls, these directives preprocess an
Access-Request packet and ensure that no spaces are included. The available options are the same:
after, or
no. Again, the most obvious choice is to set
nospace_user to
after to save helpdesk time. Some administrators have a tendency to not allow spaces in passwords; if this is the case, set
nospace_pass to
before (since there is a system-wide policy against spaces in passwords, testing a request as-is is not required).
nospace_user = [before/after/no]; nospace_password = [before/after/no]
nospace_user = after; nospace_password = before
The users file, located at /etc/raddb/users, is the home of all authentication security information for each user configured to access the system. Each user has an individual stanza, or entry. The file has a standard format for each stanza:
The first field is the username for each user, up to 253 characters.
On the same line, the next criteria are a list of required authentication attributes such as protocol type, password, and port number.
Following the first line, each user has a set of defined characteristics that allow FreeRADIUS to provision a service best for that user. These characteristics are indented under the first line and separated into one characteristic per line. For example, you might find a Login-Host entry, a dial-back configuration, or perhaps PPP configuration information.
The users file also comes with a default username of--you guessed it--
DEFAULT, which is generally the catchall configuration. That is to say, if there is no explicit match for a particular user, or perhaps the attribute information for a user is incomplete,
radiusd will configure the session based on the information in the
DEFAULT entry.
FreeRADIUS processes this file in the order in which the entries are listed. When information received from the RADIUS client equipment matches an entry in the users file, FreeRADIUS stops processing and sets the service up based on that users file entry. However, you can alter this behavior by setting the
Fall-Through attribute to yes in an entry. When
radiusd encounters a positive fall-through entry, it will continue processing the users file and then select the best match for the particular session. The
DEFAULT user can also have a
Fall-Through attribute, which means you can have multiple
DEFAULT entries for various connection scenarios.
If you don't want to issue a password for each user via their entry in the users file, then simply set
Auth-Type := System on the first line for each user. FreeRADIUS will then query the system password database for the correct password, which saves some administrative headache.
The following is a complete entry for the user jhassell, dialing into a NAS server using PPP. Note that (a) there is no
Fall-Through attribute set, so FreeRADIUS will stop processing when it encounters this entry, and (b) no
DEFAULT entry will be used to add attribute information to this connection:
jhassell Auth-Type := System
Service-Type = Framed-User,
Framed-Protocol = PPP,
Framed-IP-Address = 192.168.1.152,
Framed-IP-Netmask = 255.255.255.0,
Framed-Routing = Broadcast-Listen,
Framed-Filter-Id = "20modun",
Framed-MTU = 1500,
Framed-Compression = Van-Jacobsen-TCP-IP
Next, here's a complete entry for the user Anna Watson. She has a space in her user-name and she also has a password specified in her entry. She also gets a positive fall-through so that she can use some of the
DEFAULT user's attributes with her connection:
"Anna Watson" Auth-Type := Local, User-Password == "yes123"
Reply-Message = "Hello, %u"
Service-Type = Framed-User,
Framed-Routing = Broadcast-Listen,
Framed-Filter-Id = "20modun",
Fall-Through = Yes
DEFAULT entries
DEFAULT user configurations match with all usernames that can get to them (i.e., the individual users must have a positive
Fall-Through attribute). Recall from the earlier discussion that
DEFAULT entries may also have
Fall-Through attributes.
First, let's make sure that all users are checked against the system password file unless they have a password explicitly assigned in the entry.
DEFAULT Auth-Type := System
Fall-Through = Yes
Now, include a
DEFAULT entry for all users connecting via a framed protocol, such as PPP or SLIP. Note that I tell the RADIUS client to assign the IP address via the
Framed-IP-Address attribute's value.
DEFAULT Service-Type = Framed-User
Framed-IP-Address = 255.255.255.254,
Framed-MTU = 576,
Service-Type = Framed-User,
Fall-Through = Yes
Finally, set the
DEFAULT entry for PPP users. I've already told FreeRADIUS to assign framed protocol users with a dynamic IP address, so all I need to do is set the compression method and explicitly designate PPP as the framed protocol for this default.
DEFAULT Framed-Protocol == PPP
Framed-Protocol = PPP,
Framed-Compression = Van-Jacobsen-TCP-IP
If a user attempts to connect and matches neither any of the explicit user entries nor any of the
DEFAULT entries, then he will be denied access. Notice that with the last
DEFAULT entry,
Fall-Through isn't set: this ensures the user is kicked off if he doesn't match any of the scenarios.
You can use prefixes and suffixes appended to the user name to determine what kind of service to provision for that particular connection. For example, if a user adds .shell to their username, you add the following
DEFAULT entry to the users file to provision a shell service for her. FreeRADIUS authenticates her against the system password file, telnets to your shell account machine, and logs her in.
DEFAULT Suffix == ".shell", Auth-Type := System
Service-Type = Login-User,
Login-Service = Telnet,
Login-IP-Host = shellacct1.rduinternet.com
Similarly, you can set up an entry in the users file where if a user connects with a prefix of "s.", then you can provision SLIP service for him. FreeRADIUS can authenticate him against the system passwords, and then fall through to pick up the SLIP attributes from another
DEFAULT entry. Here is an example:
DEFAULT Prefix == "s.", Auth-Type := System
Service-Type = Framed-User,
Framed-Protocol = SLIP,
Fall-Through = Yes
callback feature of the RADIUS protocol is one of the most interesting and useful security measures that you, as an administrator, can enforce. You can configure FreeRADIUS to call a specific user back via his individual entry in the users file. (Of course, you could make a
DEFAULT entry that calls every user back, but the application of that technique is more limited and requires many more resources than a standard implementation.) The following is an example of a callback configuration for user rneis: she dials in, is then called back, is authenticated, and then given a session on the shell account machine.
rneis Auth-Type := System
Service-Type = Callback-Login-User,
Login-Service = Telnet,
Login-IP-Host = shellacct1.rduinternet.com,
Callback-Number = "9,1-919-555-1212"
You can set up a specific user entry to deny access to him. For example, you may have an automated script that takes input from your billing system (a list of usernames that have not paid their bills, possibly) and re-writes user entries to deny access. They would write something like the following, for the user aslyter:
aslyter Auth-Type := Reject
Reply-Message = "Account disabled for nonpayment."
Alternatively, you could also set up a group on your system called "suspended," and FreeRADIUS could detect whether an individual username was contained within that group and reject access as necessary. To do this, create a
DEFAULT entry much like the following:
DEFAULT Group == "suspended", Auth-Type := Reject
Reply-Message = "Account suspended for late payment."
In this section, I'll take a look at some of the most frequently occurring problems with a new FreeRADIUS setup and how to fix them.
If you receive an error similar to the following:
Module: Loaded SQL
rlm_sql: Could not link driver rlm_sql_mysql: file not found
rlm_sql: Make sure it (and all its depend libraries!) are in the search path
radiusd.conf[50]: sql: Module instantiation failed.
It means that some shared libraries on the server are not available. There are a couple of possible causes from this.
First, the libraries that are needed by the module listed in the error messages couldn't be found when FreeRADIUS was being compiled. However, if a static version of the module was available, it was built at compile time. This would have been indicated with very prominent messages at compile time.
The other cause is that the dynamic linker on your server is not configured correctly. This would result in the libraries that are required being found at compile time, but not run time. FreeRADIUS makes use of standard calls to link to these shared libraries, so if these calls fail, the system is misconfigured. This can be fixed by telling the linker where these libraries are on your system, which can be done in one of the following ways:
Write a script that starts FreeRADIUS and includes the variable
LD_LIBRARY_PATH. This sets the paths where these libraries can be found.
If your system allows it, edit the /etc/ld.so.conf file and add the directory containing the shared libraries to the list.
Set the path to these libraries inside radiusd.conf using the libdir configuration directive. The radiusd.conf file has more details on this.
Gibberish is usually indicative of an incorrectly formed or mismatched shared secret, the phrase shared between the server and the RADIUS client machine and used to perform secure encryption on packets. To identify the problem, run the server in debugging mode, as described previously. The first password printed to the console screen will be inside a RADIUS attribute (e.g.,
Password = "rneis\dfkjdf7482odf") and the second will be in a logged message (e.g.,
Login failed [rneis/dfkjdf7482odf]). If the data after the slash is gibberish--ensure it's not just a really secure password--then the shared secret is not consistent between the server and the RADIUS client. This may even be due to hidden characters, so to be completely sure both are the same, delete and re-enter the secret on both machines.
The gibberish may also result from a shared secret that is too long. FreeRADIUS limits the secret length to 16 characters, since some NAS equipment has limitations on the length of the secret yet don't make it evident in error logs or the documentation.
You may be seeing duplicate accounting or authentication requests without accompanying successful user logins. In this case, it's likely that you have a multi-homed RADIUS server, or at least a server with multiple IP addresses. If the server receives a request on one IP address, but responds with a different one, even if the reply comes from the machine for which the original packet was destined, the NAS machine will not accept it. To rectify this, launch FreeRADIUS with the
-i command-line switch, which binds the daemon to one specific IP address.
If PAP authentication works normally, but users authenticating with the CHAP protocol receive errors and denials, you do not have plain text passwords in the users file. CHAP requires this, while PAP can take passwords from the system or from any other source. For each user who needs CHAP authentication, you must add the
Password = changeme check item to his individual entry, of course changing the value of the password as appropriate.
Some people may say using CHAP is much more secure, since the user passwords are not transmitted in plain text over the connection between the user and the NAS. This is simply not true in practice. While hiding the password during transmission is beneficial, the CHAP protocol requires you to leave plain text passwords sitting in a file on a server, completely unencrypted. Obviously, it's much more likely that a cracker will gain access to your RADIUS server, grab the users file with all of these plainly available passwords, and wreak havoc and harm on your network than it is that the same cracker would intercept one user's password during the establishment of the connection.
Jonathan Hassell is a system administrator, IT consultant, and industry author residing in Raleigh, North Carolina.
Return to ONLamp.com.
Copyright © 2009 O'Reilly Media, Inc.


text:
Satchel - Grenadine
Price: $60.00Availability: In Stock
Special Price: $42.00 Ex Tax: $42.00
Special Price: $42.00 Ex Tax: $42.00
Model: HDK877
Dimension (L x W x H) 15.0 in x 6.0 in x 10.0 in
Ideal sized handbag. Big enough to carry a full night's necessities, but small enough to never overburden you.
- Large zippered opening reveals multiple internal organization options.
- Metal feet protect the bag when resting on the floor
- A fun design and soft sides make sure this bag can always move with you.
- Water repellant interior easily wipes clean
- Eco friendly. HADAKI products are AZO free. We use no Phthalates / DEHP or DBP.
Write a reviewYour Name:
Your Review: Note: HTML is not translated!
Rating: Bad Good
Enter the code in the box below:


text:
Watch: Donnel Pumphrey uses sick spin move to score TD
Watch: Mike Gesicki makes incredible TD catch
Alabama Crimson Tide roll over Florida, strengthen grip on t
Watch: Corey Clement busts 67 yd TD run in Big Ten Champions
Video: Don Cherry calls Gerard Gallant firing the worst in t
KHL player takes dabbing to a whole new level
Oklahoma QB Baker Mayfield will return for 2017 season
How does Alex Morgan's expected move to France affect the
NHLPA rejects NHL's proposed Olympics / CBA extension offe
Video: Matthew Tkachuk headbutts Marco Scandella
Chelsea win 3-1 over Manchester City as Aguero and Fernandin
Washington Huskies destroy Colorado, prove they belong in th
B1G Championship: Wisconsin Vs. Penn State, Five Things To W
Watch: Norman Powell throws down monster break-away dunk
The Blues are realizing Jori Lehtera is a liability
The Liver Punch: Give Me A Trainwreck
Barcelona, Real Madrid to meet in season's first 'Clasic
Paul Maurice: Game plans won't work when trying to stop Mc
Messi and Ronaldo: A brief history of one of the great sport
This Week in NHL Stupid: Dumping Gallant on the side of the
Who needs this win more: Chelsea or Manchester City?
Arizona Diamondbacks' new direction already evident, with
The most interesting team in the NFL: Week 13 edition
College Football Rooting Interests: Week 14
Five highlights, lowlights from CW's excellent superhero T
The Army – Navy game won't hold up the bowl selection pr
Video: Jonathan Toews and Auston Matthews play a game of "
Phil Kessel hilariously gives cold shoulder to Pierre McGuir
Gareth Southgate hire is more of the same from England
Here's what you need to know about the new MLB CBA
Report: Flames listening to offers on Dougie Hamilton, Leafs
Five Premier League teams itching for the January transfer w
MLB finally nixes All-Star Game determining World Series hom
Week 13 NFL game watchability rankings
College Football Playoff Bubble Watch: Week 14
Toronto and Montreal will decide who becomes the first Canad
Allied has gorgeous stars, fascinating premise, yet never fe
If the 2016 NFL playoffs started today…
Why is Jose Mourinho so afraid of making a big move
Netflix finally gives people what they want: TV and movies f
NFL quarterback power rankings: Week 13 edition
Netflix's Gilmore Girls revival is a lot of fun, despite a
Breaking down NFL coaches on the hot seat entering December
TGS weekly MVP tracker: Carr moves ahead in a close race
George R.R. Martin's The Winds of Winter isn't coming an
Soccer community comes through for Chapecoense after tragic
Top 5 NFL players from week 12
As ratings plummet, The Walking Dead reaps what it sowed
Iron Chef reboot 'Iron Chef Gauntlet' is coming to Food
This Weekend in NFL Stupid: Breaking down Gary Kubiak's bi
2014 Archives
2012 Archives
2011 Archives
2010 Archives
About Us
Team Personnel
get your own
embeddable forum
with Talki
Legal Information
Privacy Policy
HornsToTheHardwood.com is a Chicago Bulls fan web site and is in no way affiliated with the Chicago Bulls, the National Basketball Association, or its Properties. This site is for informational and entertainment purposes only. HornsToTheHardwood.com is not an official web site for the Chicago Bulls.
Copyright © 2010 www.HornsToTheHardwood.com - All Rights Reserved -
Trademarks used herein are property of their respective owners.