Merge pull request 'Count9' (#7) from count9 into master

Reviewed-on: #7

radiuscontroller/Dockerfile

@@ -38,7 +38,6 @@ WORKDIR /app
 COPY radiuscontroller/raddb/clients.conf /etc/freeradius/3.0/clients.conf
 COPY radiuscontroller/raddb/mods-enabled/sql /etc/freeradius/3.0/mods-enabled/sql
 COPY radiuscontroller/raddb/mods-enabled/eap /etc/freeradius/3.0/mods-enabled/eap
-COPY radiuscontroller/raddb/mods-enabled/mschap /etc/freeradius/3.0/mods-enabled/mschap
 COPY radiuscontroller/raddb/sites-enabled/default /etc/freeradius/3.0/sites-enabled/default
 COPY radiuscontroller/raddb/sites-enabled/inner-tunnel /etc/freeradius/3.0/sites-enabled/inner-tunnel
 

radiuscontroller/Services/AccountEnforcementService.cs

@@ -87,20 +87,19 @@ public class AccountEnforcementService : BackgroundService
                 // Disable the account
                 profile.Status = "Expired";
 
-                // Replace password with a zeroed NT-Password hash so mschap runs
-                // but always fails — returns MS-CHAP-Error E=691, prompting iOS
-                // to show "Incorrect Password" instead of "Unable to join network".
+                // Remove Cleartext-Password from radcheck so FreeRADIUS rejects future auth
                 var checks = await db.RadCheck
                     .Where(rc => rc.Username == profile.Username)
                     .ToListAsync(ct);
                 db.RadCheck.RemoveRange(checks);
 
+                // Insert Auth-Type := Reject to explicitly deny
                 db.RadCheck.Add(new RadCheck
                 {
                     Username = profile.Username,
-                    Attribute = "NT-Password",
+                    Attribute = "Auth-Type",
                     Op = ":=",
-                    Value = "0x00000000000000000000000000000000"
+                    Value = "Reject"
                 });
 
                 _logger.LogInformation("Account '{Username}' disabled. Reason: {Reason}", profile.Username, reason);

radiuscontroller/Services/RadiusService.cs

@@ -272,18 +272,16 @@ public class RadiusService : IRadiusService
 
         profile.Status = "Revoked";
 
-        // Replace password with a zeroed NT-Password hash so mschap runs
-        // but always fails — returns MS-CHAP-Error E=691, prompting iOS to show
-        // "Incorrect Password" instead of "Unable to join network".
+        // Remove Cleartext-Password and insert Auth-Type := Reject
         var checks = await _db.RadCheck.Where(rc => rc.Username == profile.Username).ToListAsync();
         _db.RadCheck.RemoveRange(checks);
 
         _db.RadCheck.Add(new RadCheck
         {
             Username = profile.Username,
-            Attribute = "NT-Password",
+            Attribute = "Auth-Type",
             Op = ":=",
-            Value = "0x00000000000000000000000000000000"
+            Value = "Reject"
         });
 
         await _db.SaveChangesAsync();
@@ -336,12 +334,10 @@ public class RadiusService : IRadiusService
         if (profile.Status == "Revoked")
         {
             profile.Status = "Active";
-
-            // Remove the zeroed NT-Password that was set on revoke
-            var ntPasswordCheck = await _db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "NT-Password");
-            if (ntPasswordCheck != null)
+            var rejectCheck = await _db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "Auth-Type");
+            if (rejectCheck != null)
             {
-                _db.RadCheck.Remove(ntPasswordCheck);
+                _db.RadCheck.Remove(rejectCheck);
             }
         }
 

radiuscontroller/raddb/mods-enabled/mschap

@@ -1,9 +0,0 @@
-mschap {
-	# Send MS-CHAP-Error with E=691 on authentication failure,
-	# so iOS / Windows show "Incorrect Password" instead of "Unable to join network".
-	send_error = yes
-	use_mppe = yes
-	require_encryption = yes
-	require_strong = yes
-	with_ntdomain_hack = yes
-}

radiuscontroller/raddb/sites-enabled/inner-tunnel

@@ -30,6 +30,7 @@ post-auth {
 	sql
 	Post-Auth-Type REJECT {
 		sql
+		attr_filter.access_reject
 	}
 }
 }