RE: unlang? - reject unknown?

"man unlang". Look for "case-insensitive". In this case, you would delete that "users" file entry, and use "unlang" authorize { ... if ("%{User-Name}" =~ /special/i) { update reply { Reply-Message = "Cannot use this user account" reject } } ... That should work.

I added this to the "authorize" section of radiusd.conf just after "preprocess" and before "auth_log" and it gives the error: radiusd.conf[1810]: ERROR: Unknown attribute reject radiusd.conf[1808]: Failed to parse "update" subsection. radiusd.conf[1788]: Errors parsing authorize section. Have I messed up here by misunderstanding you completely!