From ab703ae15eabcc4e56181f6353f3752e05c6e90a Mon Sep 17 00:00:00 2001 From: Tygozwolle Date: Mon, 27 Jul 2026 12:30:58 +0200 Subject: [PATCH] feat: add mschap module configuration and inner-tunnel site definition for RADIUS authentication --- radiuscontroller/raddb/mods-enabled/mschap | 10 ++++------ radiuscontroller/raddb/sites-enabled/inner-tunnel | 1 - 2 files changed, 4 insertions(+), 7 deletions(-) diff --git a/radiuscontroller/raddb/mods-enabled/mschap b/radiuscontroller/raddb/mods-enabled/mschap index f1204b0..d7e58fb 100644 --- a/radiuscontroller/raddb/mods-enabled/mschap +++ b/radiuscontroller/raddb/mods-enabled/mschap @@ -2,10 +2,8 @@ mschap { # Send MS-CHAP-Error with E=691 on authentication failure, # so iOS / Windows show "Incorrect Password" instead of "Unable to join network". send_error = yes - - # Force the rejection format to return the MSCHAPv2 failure code - # (Error 691 explicitly maps to an incorrect password on iOS) - passchange { - ntlm_auth = "/usr/bin/ntlm_auth" - } + use_mppe = yes + require_encryption = yes + require_strong = yes + with_ntdomain_hack = yes } diff --git a/radiuscontroller/raddb/sites-enabled/inner-tunnel b/radiuscontroller/raddb/sites-enabled/inner-tunnel index eef3b96..fe32bd0 100644 --- a/radiuscontroller/raddb/sites-enabled/inner-tunnel +++ b/radiuscontroller/raddb/sites-enabled/inner-tunnel @@ -30,7 +30,6 @@ post-auth { sql Post-Auth-Type REJECT { sql - attr_filter.access_reject } } }