radius/radiuscontroller/raddb/mods-enabled/mschap

mschap {
	# Send MS-CHAP-Error with E=691 on authentication failure,
	# so iOS / Windows show "Incorrect Password" instead of "Unable to join network".
	send_error = yes

	# Force the rejection format to return the MSCHAPv2 failure code
	# (Error 691 explicitly maps to an incorrect password on iOS)
	passchange {
		ntlm_auth = "/usr/bin/ntlm_auth"
	}
}