What you are doing is actually okay (its one of those exceptions where auth-type needs to be present as the server has no idea to use krb5). I wonder if your server has been built with kerberos support?
alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html