如何从Freeradius的Access-Reply中移除Message-Authenticator属性

使用FreeRADIUS Docker镜像，需要从Access-Reply响应中移除Message-Authenticator属性。调试日志中未显示该属性，但radtest返回的最终响应里存在该属性。已在radiusd.conf中设置require_message_authenticator = no，但无效果。

调试日志片段 #

(0)   post-auth {
(0)     if (session-state:User-Name && reply:User-Name && request:User-Name && 
(reply:User-Name == request:User-Name)) {
(0)     if (session-state:User-Name && reply:User-Name && request:User-Name && 
(reply:User-Name == request:User-Name))  -> FALSE
(0)     update {
(0)       No attributes updated for RHS &session-state:
(0)     } # update = noop
(0)     [exec] = noop
(0)     policy remove_reply_message_if_eap {
(0)       if (&reply:EAP-Message && &reply:Reply-Message) {
(0)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(0)       else {
(0)         [noop] = noop
(0)       } # else = noop
(0)     } # policy remove_reply_message_if_eap = noop
(0)     if (EAP-Key-Name && &reply:EAP-Session-Id) {
(0)     if (EAP-Key-Name && &reply:EAP-Session-Id)  -> FALSE
(0)   } # post-auth = noop
(0) Login OK: [alice_cne/testing123] (from client localhost port 0)
(0) Sent Access-Accept Id 165 from 127.0.0.1:1812 to 127.0.0.1:60248 length 76
(0)   Reply-Message = "secAdmin"

radtest返回结果 #

radtest alice_cne testing123 127.0.0.1 0 testing123

Sent Access-Request Id 137 from 0.0.0.0:33567 to 127.0.0.1:1812 length 79
User-Name = "alice_cne"
User-Password = "testing123"
NAS-IP-Address = 172.16.0.2
NAS-Port = 0
Message-Authenticator = 0x00
Cleartext-Password = "testing123"
Received Access-Accept Id 137 from 127.0.0.1:1812 to 127.0.0.1:33567 length 76
Message-Authenticator = 0x8cafe05c5f22c9f535ace4738ac2cbb3
Reply-Message = "secAdmin"

已尝试的配置 #

require_message_authenticator = no

• require_message_authenticator = no仅控制是否要求请求携带Message-Authenticator属性，不会影响响应是否添加该属性。要移除响应中的Message-Authenticator，需在post-auth阶段添加属性删除规则：
  编辑radiusd.conf或站点配置文件（如sites-enabled/default），在post-auth块内添加：

  delete reply:Message-Authenticator
  

• 或者使用update语法：

  update reply {
    Message-Authenticator !* ANY
  }
  

• 修改配置后，重启FreeRADIUS容器使更改生效。

内容的提问来源于stack exchange，提问作者mr.Nobody