title: FreeRADIUS included users file not read correctly after a certain point
body: <p>I have a strange situation. When providing users in an included file, all the passwords from a certain point in that file seem to be "ignored".</p>
  
  <p>The setup:<br>
  - Default configuration, minimal changes (only clients.conf and users)<br>
  - The users config file includes a third file ($INCLUDE /etc/raddb/users-pppoe)<br>
  - This third file contains all the user info  </p>
  
  <p>This is what i found out myself / facts:<br>
  - The users file is generated by a bash script<br>
  - The config check says all is fine<br>
  - The first 17 users work fine (or: approx 190 lines, or: approx 6800 bytes/characters)<br>
  - On these new users the radius daemon gives error: FAILED: No NT/LM-Password.<br>
  - These new users do have the required Cleartext-Password option<br>
  - When i move the new user to the top of the file, it works fine<br>
  - <em>(My temporary solution)</em> I split up the file into four, including them separately. <em>Now all works fine!</em><br>
  - This splitup is made by the same bash script that generates the file itself, so if anything goes wrong there (eg. faulty hidden characters) it should be in these new files as well.  </p>
  
  <p>Ofcourse i'm wondering what is causing this, but mainly, will i get in trouble when the number of users grows. In the end I will have approx. 200 users that will not change much, so running an sql server is quite overkill.
  Basically, it's an acceptable workaround, but this has to be solved. If anyone has an idea please let me know.</p>
  
  <p>Thank you all in advance!</p>
  
  <p>/etc/raddb/users-pppoe (example entry):</p>
  
  <pre><code>user-00000005   Cleartext-Password := "oHs0sECre7"
                  Service-Type = Framed-User,
                  Framed-Protocol = PPP,
                  Framed-IP-Address = 10.0.0.5,
                  Framed-Route = 172.14.5.0/24,
                  Framed-Routing = Broadcast-Listen,
                  Framed-Filter-Id = "std.ppp",
                  Framed-MTU = 1500,
                  Rate-Limit = "20M",
                  Framed-Compression = Van-Jacobsen-TCP-IP
  </code></pre>
  
  <p>radiusd -X</p>
  
  <pre><code>FreeRADIUS Version 3.0.13
  Copyright (C) 1999-2017 The FreeRADIUS server project and contributors
  There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
  PARTICULAR PURPOSE
  You may redistribute copies of FreeRADIUS under the terms of the
  GNU General Public License
  For more information about these matters, see the file named COPYRIGHT
  Starting - reading configuration files ...
  [...]
  (0) Received Access-Request Id 40 from 192.168.0.10:56726 to 192.168.0.235:1812 length 209
  (0)   Service-Type = Framed-User
  (0)   Framed-Protocol = PPP
  (0)   NAS-Port = 15729311
  (0)   NAS-Port-Type = Ethernet
  (0)   User-Name = "user-00000005"
  (0)   Calling-Station-Id = "XX:XX:XX:XX:XX:XX"
  (0)   Called-Station-Id = "XXXXX"
  (0)   NAS-Port-Id = "XXXXXXXX"
  (0)   MS-CHAP-Challenge = 0x3a9fbb09c454698c577ecda8de0a6c5e
  (0)   MS-CHAP2-Response = 0x01000c96d60e85b8b37cfe9da70ab58f7f50000000000000000039177e3ff8b31533f8fe81dd126a5b553e4a9e76474b0757
  (0)   NAS-Identifier = "HOSTxxxx"
  (0)   NAS-IP-Address = 192.168.0.10
  (0) # Executing section authorize from file /etc/raddb/sites-enabled/default
  (0)   authorize {
  (0)     policy filter_username {
  (0)       if (!&amp;User-Name) {
  (0)       if (!&amp;User-Name)  -&gt; FALSE
  (0)       if (&amp;User-Name =~ / /) {
  (0)       if (&amp;User-Name =~ / /)  -&gt; FALSE
  (0)       if (&amp;User-Name =~ /@.*@/ ) {
  (0)       if (&amp;User-Name =~ /@.*@/ )  -&gt; FALSE
  (0)       if (&amp;User-Name =~ /\\.\\./ ) {
  (0)       if (&amp;User-Name =~ /\\.\\./ )  -&gt; FALSE
  (0)       if ((&amp;User-Name =~ /@/) &amp;&amp; (&amp;User-Name !~ /@(.+)\\.(.+)$/))  {
  (0)       if ((&amp;User-Name =~ /@/) &amp;&amp; (&amp;User-Name !~ /@(.+)\\.(.+)$/))   -&gt; FALSE
  (0)       if (&amp;User-Name =~ /\\.$/)  {
  (0)       if (&amp;User-Name =~ /\\.$/)   -&gt; FALSE
  (0)       if (&amp;User-Name =~ /@\\./)  {
  (0)       if (&amp;User-Name =~ /@\\./)   -&gt; FALSE
  (0)     } # policy filter_username = notfound
  (0)     [preprocess] = ok
  (0)     [chap] = noop
  (0) mschap: Found MS-CHAP attributes.  Setting 'Auth-Type  = mschap'
  (0)     [mschap] = ok
  (0)     [digest] = noop
  (0) suffix: Checking for suffix after "@"
  (0) suffix: No '@' in User-Name = "user-00000005", looking up realm NULL
  (0) suffix: No such realm "NULL"
  (0)     [suffix] = noop
  (0) eap: No EAP-Message, not doing EAP
  (0)     [eap] = noop
  (0) files: users: Matched entry DEFAULT at line 187
  (0)     [files] = ok
  (0)     [expiration] = noop
  (0)     [logintime] = noop
  (0) pap: WARNING: No "known good" password found for the user.  Not setting Auth-Type
  (0) pap: WARNING: Authentication will fail unless a "known good" password is available
  (0)     [pap] = noop
  (0)   } # authorize = ok
  (0) Found Auth-Type = MS-CHAP
  (0) # Executing group from file /etc/raddb/sites-enabled/default
  (0)   Auth-Type MS-CHAP {
  (0) mschap: WARNING: No Cleartext-Password configured.  Cannot create NT-Password
  (0) mschap: WARNING: No Cleartext-Password configured.  Cannot create LM-Password
  (0) mschap: Creating challenge hash with username: user-00000005
  (0) mschap: Client is using MS-CHAPv2
  (0) mschap: ERROR: FAILED: No NT/LM-Password.  Cannot perform authentication
  (0) mschap: ERROR: MS-CHAP2-Response is incorrect
  (0)     [mschap] = reject
  (0)   } # Auth-Type MS-CHAP = reject
  (0) Failed to authenticate the user
  (0) Using Post-Auth-Type Reject
  (0) # Executing group from file /etc/raddb/sites-enabled/default
  (0)   Post-Auth-Type REJECT {
  (0) attr_filter.access_reject: EXPAND %{User-Name}
  (0) attr_filter.access_reject:    --&gt; user-00000005
  (0) attr_filter.access_reject: Matched entry DEFAULT at line 11
  (0)     [attr_filter.access_reject] = updated
  (0)     [eap] = noop
  (0)     policy remove_reply_message_if_eap {
  (0)       if (&amp;reply:EAP-Message &amp;&amp; &amp;reply:Reply-Message) {
  (0)       if (&amp;reply:EAP-Message &amp;&amp; &amp;reply:Reply-Message)  -&gt; FALSE
  (0)       else {
  (0)         [noop] = noop
  (0)       } # else = noop
  (0)     } # policy remove_reply_message_if_eap = noop
  (0)   } # Post-Auth-Type REJECT = updated
  (0) Delaying response for 1.000000 seconds
  Waking up in 0.3 seconds.
  (0) (0) Discarding duplicate request from client HOSTxxxx port 56726 - ID: 40 due to delayed response
  Waking up in 0.6 seconds.
  (0) (0) Discarding duplicate request from client HOSTxxxx port 56726 - ID: 40 due to delayed response
  Waking up in 0.4 seconds.
  (0) Sending delayed response
  (0) Sent Access-Reject Id 40 from 192.168.0.235:1812 to 192.168.0.10:56726 length 101
  (0)   MS-CHAP-Error = "\001E=691 R=1 C=ab1fa89cc9439fe9c076aebb6a5e2532 V=3 M=Authentication failed"
  Waking up in 3.9 seconds.
  </code></pre>