feat: add mschap module configuration and inner-tunnel site definition for RADIUS authentication

radiuscontroller/Dockerfile

@@ -38,6 +38,7 @@ WORKDIR /app
 COPY radiuscontroller/raddb/clients.conf /etc/freeradius/3.0/clients.conf
 COPY radiuscontroller/raddb/mods-enabled/sql /etc/freeradius/3.0/mods-enabled/sql
 COPY radiuscontroller/raddb/mods-enabled/eap /etc/freeradius/3.0/mods-enabled/eap
+COPY radiuscontroller/raddb/mods-enabled/mschap /etc/freeradius/3.0/mods-enabled/mschap
 COPY radiuscontroller/raddb/sites-enabled/default /etc/freeradius/3.0/sites-enabled/default
 COPY radiuscontroller/raddb/sites-enabled/inner-tunnel /etc/freeradius/3.0/sites-enabled/inner-tunnel
 

radiuscontroller/Services/AccountEnforcementService.cs

@@ -87,19 +87,20 @@ public class AccountEnforcementService : BackgroundService
                 // Disable the account
                 profile.Status = "Expired";
 
-                // Remove Cleartext-Password from radcheck so FreeRADIUS rejects future auth
+                // Replace password with a zeroed NT-Password hash so mschap runs
+                // but always fails — returns MS-CHAP-Error E=691, prompting iOS
+                // to show "Incorrect Password" instead of "Unable to join network".
                 var checks = await db.RadCheck
                     .Where(rc => rc.Username == profile.Username)
                     .ToListAsync(ct);
                 db.RadCheck.RemoveRange(checks);
 
-                // Insert Auth-Type := Reject to explicitly deny
                 db.RadCheck.Add(new RadCheck
                 {
                     Username = profile.Username,
-                    Attribute = "Auth-Type",
+                    Attribute = "NT-Password",
                     Op = ":=",
-                    Value = "Reject"
+                    Value = "0x00000000000000000000000000000000"
                 });
 
                 _logger.LogInformation("Account '{Username}' disabled. Reason: {Reason}", profile.Username, reason);

radiuscontroller/Services/RadiusService.cs

@@ -272,16 +272,18 @@ public class RadiusService : IRadiusService
 
         profile.Status = "Revoked";
 
-        // Remove Cleartext-Password and insert Auth-Type := Reject
+        // Replace password with a zeroed NT-Password hash so mschap runs
+        // but always fails — returns MS-CHAP-Error E=691, prompting iOS to show
+        // "Incorrect Password" instead of "Unable to join network".
         var checks = await _db.RadCheck.Where(rc => rc.Username == profile.Username).ToListAsync();
         _db.RadCheck.RemoveRange(checks);
 
         _db.RadCheck.Add(new RadCheck
         {
             Username = profile.Username,
-            Attribute = "Auth-Type",
+            Attribute = "NT-Password",
             Op = ":=",
-            Value = "Reject"
+            Value = "0x00000000000000000000000000000000"
         });
 
         await _db.SaveChangesAsync();
@@ -334,10 +336,12 @@ public class RadiusService : IRadiusService
         if (profile.Status == "Revoked")
         {
             profile.Status = "Active";
-            var rejectCheck = await _db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "Auth-Type");
-            if (rejectCheck != null)
+
+            // Remove the zeroed NT-Password that was set on revoke
+            var ntPasswordCheck = await _db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "NT-Password");
+            if (ntPasswordCheck != null)
             {
-                _db.RadCheck.Remove(rejectCheck);
+                _db.RadCheck.Remove(ntPasswordCheck);
             }
         }
 

radiuscontroller/raddb/mods-enabled/mschap

@@ -0,0 +1,9 @@
+mschap {
+	# Send MS-CHAP-Error with E=691 on authentication failure,
+	# so iOS / Windows show "Incorrect Password" instead of "Unable to join network".
+	send_error = yes
+	use_mppe = yes
+	require_encryption = yes
+	require_strong = yes
+	with_ntdomain_hack = yes
+}

radiuscontroller/raddb/sites-enabled/inner-tunnel

@@ -30,7 +30,6 @@ post-auth {
 	sql
 	Post-Auth-Type REJECT {
 		sql
-		attr_filter.access_reject
 	}
 }
 }