I've been waiting for someone else to say this, but since no one has I will.
RADIUS 2.0.1 handels this quite well. Here is a one line entry to keep
members of the mailonly group from authenticating on a dial-in:
DEFAULT Auth-Type = Reject, Group = "mailonly"
It could just as easily be:
luser Auth-Type = Reject
The examples in the release notes showed "Auth-Type = Reject" with several
return values (User-Service-Type =, and so on), but it works just fine for
me with out them.
Joe Brewer
joe@net1.net