From da66ba52398ed650e40c90c3f6498cb5553e269d Mon Sep 17 00:00:00 2001 From: Tygozwolle Date: Mon, 27 Jul 2026 12:17:55 +0200 Subject: [PATCH] feat: implement RadiusService for guest registration, session management, and usage tracking --- radiuscontroller/Services/RadiusService.cs | 7 +++++++ radiuscontroller/raddb/mods-enabled/mschap | 6 ++++++ 2 files changed, 13 insertions(+) diff --git a/radiuscontroller/Services/RadiusService.cs b/radiuscontroller/Services/RadiusService.cs index a7c7b2e..ab2f872 100644 --- a/radiuscontroller/Services/RadiusService.cs +++ b/radiuscontroller/Services/RadiusService.cs @@ -336,6 +336,13 @@ public class RadiusService : IRadiusService if (profile.Status == "Revoked") { profile.Status = "Active"; + + // Remove the zeroed NT-Password that was set on revoke + var ntPasswordCheck = await _db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "NT-Password"); + if (ntPasswordCheck != null) + { + _db.RadCheck.Remove(ntPasswordCheck); + } } await _db.SaveChangesAsync(); diff --git a/radiuscontroller/raddb/mods-enabled/mschap b/radiuscontroller/raddb/mods-enabled/mschap index 747312e..f1204b0 100644 --- a/radiuscontroller/raddb/mods-enabled/mschap +++ b/radiuscontroller/raddb/mods-enabled/mschap @@ -2,4 +2,10 @@ mschap { # Send MS-CHAP-Error with E=691 on authentication failure, # so iOS / Windows show "Incorrect Password" instead of "Unable to join network". send_error = yes + + # Force the rejection format to return the MSCHAPv2 failure code + # (Error 691 explicitly maps to an incorrect password on iOS) + passchange { + ntlm_auth = "/usr/bin/ntlm_auth" + } }