Hi,
I would think that would work, I just don't know how to do that! It's really easy to create a module that returns "ok" or "handled" but, despite hours of pouring through the unlange manpages and documentation on rlm_example, rlm_perl, and rlm_exec, I cannot seem to create a module that will compel the RADIUS server to send back an Access-Accept. Mr. DeKok says this is impossible, and he would probably be the one to know. I'll keep investigating another way around this and update the list if I find anything. In the mean time, if anyone else thinks of something, please let me know.
you can use eg the Users file to send an accept - however, the 'impossible' bit didnt refer to FreeRADIUS - but to the end equipment and the EAP specification. dumb and/or broken NAS devices can receive a basic accept message...but anything that has even an ounce of security will expect the full EAP transaction to occur (cert checks, challenge response etc) not just a 'yep, alls okay, come on in!' message. imagine if you went to a shop and your credit card was just accepted without the PIN (or swipe + signature for those non-PIN places) would you feel comfortable? you shouldnt..and neither should your OS so, whilst you could do crazy things like accept by default, the NAS or the end device might - and should, ignore and reject that when EAP is involved it'd be better to just change the VLAN settings so guest/fail have full access for the day alan