I have in the modules/ntlm_auth_vpn command: .. Is it possible to add another command ( with different domain ) and to add OR in order to choose which one will pass ?

Something like this:

exec ntlm_auth_vpn { program = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --password=%{User-Password} --require-membership-of=domain1"

OR

program = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --password=%{User-Password} --require-membership-of=domain2"

}

It means that auth-type ntml_auth_vpn is right if one of these command will pass

You can write a shell script to do that. There's no need to do anything in the server. #1/bin/sh /usr/bin/ntlm_auth ... if [ "$?" = "0"]; then ... Alan DeKok. Thank you Alan Yes I was thinking about it but I don't know how can I pass the aregumens to that script ( like mschap:User-Name and so on ) When and who will call this script ? thanks

...

I have in the modules/ntlm_auth_vpn command:

there is another way to. simply make a second copy of that module....eg have ntlm_auth_vpn1 and ntlm_auth_vpn2 (each configured with what you want/need) and then read: http://wiki.freeradius.org/Fail-over you can then have this sort of thing in your config group { ntlm_auth_vpn1 { reject = 1 ok = return } ntlm_auth_vpn2 { reject = 1 ok = return } } Hi Alan, thank you for your answer. Yes , it's good idea, I can create another module ntlm_auth_vpn2 But how should I combine this group section with the my command: DEFAULT Auth-Type := ntlm_auth_vpn Fall-Through = Yes thanks