On Feb 8, 2025, at 3:25 AM, Alan Batie <alan@batie.org> wrote:
b) you didn't put "mschap" into the "authenticate" section
I missed that; one step closer at least
That's good, but...
One issue here is that you're not starting with the default configuration, and then gradually making it do what you want.
I'm starting with an ancient version that has been working for years, and trying to map it into a vastly different configuration where both of them are confusing. I did have mschap commented out because I didn't think the clients were using it though, and didn't get it fully re-enabled when I realized that was wrong.
This is where a methodical approach is best, along with creating tests for each piece of functionality. If the configuration is confusing, then making random changes is a guaranteed way to increase that confusion. It's best to understand how it all works, and then make directed changes in order to achieve a specific goal. Alan DeKok.