title: Freeradius and PHP auth script
body: <p>I'm trying to authenticate freeradius users against a PHP script, with no success.
  I've been trying for hours to config this right, and all the threads I found with Google are either deadlinked or obsolete...</p>
  
  <p>radiusd.conf</p>
  
  <pre><code>prefix = /usr
  exec_prefix = /usr
  sysconfdir = /etc
  localstatedir = /var
  sbindir = ${exec_prefix}/sbin
  logdir = /var/log/freeradius
  raddbdir = /etc/freeradius
  radacctdir = ${logdir}/radacct
  
  #  Name of the running server
  name = freeradius
  
  #  Location of config and logfiles.
  confdir = ${raddbdir}
  run_dir = ${localstatedir}/run/${name}
  
  # Should likely be ${localstatedir}/lib/radiusd
  db_dir = ${raddbdir}
  
  libdir = /usr/lib/freeradius
  
  pidfile = ${run_dir}/${name}.pid
  
  # user/group: The name (or #number) of the user/group to run radiusd as.
  user = freerad
  group = freerad
  
  #  max_request_time: The maximum time (in seconds) to handle a request.
  max_request_time = 30
  
  #  cleanup_delay: The time to wait (in seconds) before cleaning up
  #  a reply which was sent to the NAS.
  cleanup_delay = 5
  
  #  max_requests: The maximum number of requests which the server keeps
  #  track of.  This should be 256 multiplied by the number of clients.
  #  e.g. With 4 clients, this number should be 1024.
  max_requests = 1024
  
  #  listen: Make the server listen on a particular IP address, and send
  #  replies out from that address. This directive is most useful for
  #  hosts with multiple IP addresses on one interface.
  listen {
      type = auth
      ipaddr = *
      port = 0
  }
  
  #  This second "listen" section is for listening on the accounting
  #  port, too.
  listen {
      ipaddr = *
      port = 0
      type = acct
  }
  
  hostname_lookups = no
  allow_core_dumps = no
  regular_expressions = yes
  extended_expressions    = yes
  
  log {
      destination = files
      file = ${logdir}/radius.log
      syslog_facility = daemon
      stripped_names = no
      auth = no
      auth_badpass = no
      auth_goodpass = no
  }
  
  checkrad = ${sbindir}/checkrad
  
  security {
      max_attributes = 200
      reject_delay = 1
      status_server = yes
  }
  
  proxy_requests  = off
  
  # CLIENTS CONFIGURATION
  client 0.0.0.0/0 {
      secret = secret
      shortname = wireless
  }
  
  # THREAD POOL CONFIGURATION
  thread pool {
      start_servers = 5
      max_servers = 32
      min_spare_servers = 3
      max_spare_servers = 10
      max_requests_per_server = 0
  }
  
  # MODULE CONFIGURATION
  modules {
      $INCLUDE ${confdir}/modules/
      $INCLUDE eap.conf
  }
  
  # Instantiation
  instantiate {
      exec
      expr
      expiration
      logintime
  }
  
  $INCLUDE policy.conf
  
  $INCLUDE sites-enabled/
  </code></pre>
  
  <p>modules/exec</p>
  
  <pre><code>exec {
      wait = yes 
      program = "/usr/bin/php -f /usr/local/auth.php %{User-Name} %{User-Password}"
      input_pairs = request 
      output_pairs = reply
      shell_escape = yes
  }
  </code></pre>
  
  <p>sites-available/default</p>
  
  <pre><code>authorize {
      preprocess
      exec
      chap
      suffix
      files
      expiration
      logintime
      pap
  }
  
  authenticate {
      Auth-Type PAP {
          pap
      }
      Auth-Type CHAP {
          chap
      }
      eap
  }
  
  
  preacct {
      preprocess
      acct_unique
      suffix
      files
  }
  
  accounting {
      detail
      radutmp
      exec
      attr_filter.accounting_response
  }
  
  session {
      radutmp
  }
  
  post-auth {
      exec
      Post-Auth-Type REJECT {
          attr_filter.access_reject
      }
  }
  
  pre-proxy {
  }
  
  post-proxy {
  }
  </code></pre>
  
  <p>Although I have no idea what to put in the users file...</p>