> > unlang? set a variable to the value of MS-CHAP-Error and then set the > Reply-Message > to be some text with that variable in it. > Unfortunately, this sends it back in the next packet, which is an Access-Challenge, not in the final Access-Reject.
Also, for some strange reason, the post-auth section in the inner-tunnel only gets called on a successful auth, not on a failure, so I can't output the failure to sql there either. > alternatively you could probably call PERL pr pythin etc at the right time and > do the required variable and reply-message settings with those languages > instead > > however....by sending such messages the remote user knows the reason for > failure > eg incorrect password but a successful user...and could bruteforce I plan to do something along the lines of: MS-Chap-Error=User wrong => login failed MS-Chap-Error=PAss wrong => login failed MS-Chap-Error=Account locked => Account locked --Mike - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html