- Freeradius-Users - lists.freeradius.org

does peap/mschap-v2 must use with ldap?
by 张̍ 25 Feb '09

25 Feb '09

I configured my freeradius 1.1.7 + oracle + cisco 3750 switch to do 802.1x authentication for wired client. I configured it with EAP/MD5 method and it works well. Now I want to use peap/mschap-v2 method,but I didn't configure LDAP in radiusd.conf,and when the server start it report some error.Below are the details: radiusd.conf: authorize { preprocess mschap sql eap } authenticate { Auth-Type MS-CHAP { mschap } eap } eap.conf: eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no } tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no } mschapv2 { } The debug message of radiusd -X: rad_recv: Access-Request packet from host 10.0.99.1:1645, id=141, length=252 NAS-IP-Address = 10.0.99.1 NAS-Port = 50441 Cisco-NAS-Port = "FastEthernet4/0/41" NAS-Port-Type = Ethernet User-Name = "testuser" Called-Station-Id = "00-19-2F-E1-C0-AD" Calling-Station-Id = "00-10-C6-A8-DA-00" Service-Type = Framed-User Framed-MTU = 1500 State = 0xb9868a780c968e9716093b01742690ee EAP-Message = 0x0206005a1900170301004f4ea0464ecb62296c3fe83ddbe7cb46cfc87deccd3b5d7786299443f17d173f52209f2eefb5497f3153bdd751357d7b5beb55afb0d7e60d775792b375564444f5f30c0ad8cae5c74b398405d8cc4b63 Message-Authenticator = 0x3ced719a5b1cfdb5e3e3c49fa411e309 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 radius_xlat: '/usr/local/var/log/radius/radacct/10.0.99.1/auth-detail-20090225' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.0.99.1/auth-detail-20090225 modcall[authorize]: module "auth_log" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 90 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'testuser' and (mac = '00-10-C6-A8-DA-00' or mac is null) ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'testuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020600431a0206003e316cdcc08e1adf37fdb332d32419efee1300000000000000002667d1668b083c47ab1b70edc530d3d3d9f0bb9a4c254ce8007465737475736572 PEAP: Setting User-Name to testuser PEAP: Adding old state with 64 0b PEAP: Sending tunneled request EAP-Message = 0x020600431a0206003e316cdcc08e1adf37fdb332d32419efee1300000000000000002667d1668b083c47ab1b70edc530d3d3d9f0bb9a4c254ce8007465737475736572 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "testuser" State = 0x640b188d31bc5ddc785afe862ca9225f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 radius_xlat: '/usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20090225' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20090225 modcall[authorize]: module "auth_log" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 67 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'testuser' and (mac = '' or mac is null) ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): User testuser not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User testuser not found in radgroupcheck rlm_sql (sql): Released sql socket id: 1 rlm_sql (sql): User not found modcall[authorize]: module "sql" returns notfound for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for testuser with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 6 modcall: leaving group authenticate (returns reject) for request 6 auth: Failed to validate the user. Login incorrect: [testuser/<no User-Password attribute>] (from client localhost port 0) ...... and ...... modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 7 modcall: leaving group authenticate (returns invalid) for request 7 auth: Failed to validate the user. Login incorrect: [testuser/<no User-Password attribute>] (from client bg3750 port 50441 cli 00-10-C6-A8-DA-00) Delaying request 7 for 1 seconds Finished request 7 Going to the next request Does it because I'm not configure LDAP? Does PEAP/MSCHAP-V2 must use with LDAP? In my database I have already add the "testuser User-Password := test123" in radcheck table but it doesn't work. _________________________________________________________________ 讲述中国特色文化，体验不同的节日习俗，快来微软春节搜索！ http://chunjie.live.com/?form=PANER01

3 2

SMF manifest to run freeradius in solaris 10
by Thomas Noppe 25 Feb '09

25 Feb '09

Has anyone got such a manifest for solaris 10? Kind regards Thomas --------------------------------------------------------------------------------------------- Thomas Noppe Dienst Informatiesystemen - S&O thomas.noppe(a)uzleuven.be<mailto:thomas.noppe@uzleuven.be> +32 16 34 79 87 +32 16 34 78 01 UZ Leuven | campus Gasthuisberg | Herestraat 49 | B - 3000 Leuven | www.uzleuven.be<http://www.uzleuven.be>

2 3

Why is groupname field blank in radacct
by ngwarai zed 25 Feb '09

25 Feb '09

I installed freeradius and have noticed that all while other fields are filled in on the radacct table some are not. Of particular importance to me is the groupname field. I need this field because I need to know which group the customer is from so that I charge them accordingly. A person may belong to more than one group and we need a particular group the person used to log into the system. How can we cause the groupname to be written to the radacct table? Thank you.

2 1

RE: Freeradius-Users Digest, Vol 46, Issue 96
by Shimon Weinreich 25 Feb '09

25 Feb '09

Tnx Ivan, I'll upgrade it. ------- בברכה, שמעון ויינרייך האוניברסיטה הפתוחה -----Original Message----- From: freeradius-users-bounces+shimon=openu.ac.il(a)lists.freeradius.org [mailto:freeradius-users-bounces+shimon=openu.ac.il@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Wednesday, February 25, 2009 11:45 AM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 46, Issue 96 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. SMF manifest to run freeradius in solaris 10 (Thomas Noppe) 2. Re: does peap/mschap-v2 must use with ldap? (Nicolas Goutte) 3. RE: auth: Failed to validate the user - NEED SOME HELP ! (tnt(a)kalik.net) 4. RE: SMF manifest to run freeradius in solaris 10 (Mats Blomgren B) ---------------------------------------------------------------------- Message: 1 Date: Wed, 25 Feb 2009 10:09:45 +0100 From: Thomas Noppe <thomas.noppe(a)uz.kuleuven.ac.be> Subject: SMF manifest to run freeradius in solaris 10 To: freeradius <freeradius-users(a)lists.freeradius.org> Message-ID: <B44A93F24BD174408E495C668C3E3E763945333E06(a)EX2007-MBX-1.uz.kuleuven.ac.be> Content-Type: text/plain; charset="us-ascii" Has anyone got such a manifest for solaris 10? Kind regards Thomas --------------------------------------------------------------------------------------------- Thomas Noppe Dienst Informatiesystemen - S&O thomas.noppe(a)uzleuven.be<mailto:thomas.noppe@uzleuven.be> +32 16 34 79 87 +32 16 34 78 01 UZ Leuven | campus Gasthuisberg | Herestraat 49 | B - 3000 Leuven | www.uzleuven.be<http://www.uzleuven.be>

1 0

RE: Welcome to the "Freeradius-Users" mailing list
by Maitreyi Sharma 25 Feb '09

25 Feb '09

Hi I am facing strange issue while running radtest from remote IP and radiusd running on other IP but on the same network. My Radius server is not listening to any other client except localhost. I've added all clients entries in clients.conf file. What could be the issue? Pls advise. -Thanks Maitreyi -----Original Message----- From: freeradius-users-bounces+maitreyi.sharma=hcl.in(a)lists.freeradius.org [mailto:freeradius-users-bounces+maitreyi.sharma=hcl.in@lists.freeradius .org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Wednesday, February 25, 2009 1:21 PM To: Maitreyi Sharma Subject: Welcome to the "Freeradius-Users" mailing list Welcome to the Freeradius-Users(a)lists.freeradius.org mailing list! To post to this list, send your email to: freeradius-users(a)lists.freeradius.org General information about the mailing list is at: http://lists.freeradius.org/mailman/listinfo/freeradius-users If you ever want to unsubscribe or change your options (eg, switch to or from digest mode, change your password, etc.), visit your subscription page at: http://lists.freeradius.org/mailman/options/freeradius-users/maitreyi.sh arma%40hcl.in You can also make such adjustments via email by sending a message to: Freeradius-Users-request(a)lists.freeradius.org with the word `help' in the subject or body (don't include the quotes), and you will get back a message with instructions. You must know your password to change your options (including changing the password, itself) or to unsubscribe. It is: suhaanee Normally, Mailman will remind you of your lists.freeradius.org mailing list passwords once every month, although you can disable this if you prefer. This reminder will also include instructions on how to unsubscribe or change your account options. There is also a button on your options page that will email your current password to you. DISCLAIMER: ----------------------------------------------------------------------------------------------------------------------- The contents of this e-mail and any attachment(s) are confidential and intended for the named recipient(s) only. It shall not attach any liability on the originator or HCL or its affiliates. Any views or opinions presented in this email are solely those of the author and may not necessarily reflect the opinions of HCL or its affiliates. Any form of reproduction, dissemination, copying, disclosure, modification, distribution and / or publication of this message without the prior written consent of the author of this e-mail is strictly prohibited. If you have received this email in error please delete it and notify the sender immediately. Before opening any mail and attachments please check them for viruses and defect. -----------------------------------------------------------------------------------------------------------------------

2 1

RE: Freeradius-Users Digest, Vol 46, Issue 94
by Shimon Weinreich 25 Feb '09

25 Feb '09

Hey Tim, Tnx for the quick answer. In the meantime I figured out my problem. In 'users' file I commented out: ----- # First setup all accounts to be checked against the UNIX /etc/passwd. # (Unless a password was already given earlier in this file). # #DEFAULT Auth-Type = System # Fall-Through = 1 ----- Which 'tells' Radius to authenticate with /etc/passwd. Now localcheck works fine. I have another problem. I enter a client with a secret in clients.conf file: ---- Client 192.168.10.10 { secret = XXXXXXXX shortname = Test } But while testing from Client 192.168.10.10 - I got: --- rad_recv: Access-Request packet from host: 192.168.10.10:45931, id=56, length=53 Ignoring request from unknown client 192.168.10.10:45931 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. ------------ Any hint?? ------- בברכה, שמעון ויינרייך האוניברסיטה הפתוחה -----Original Message----- From: freeradius-users-bounces+shimon=openu.ac.il(a)lists.freeradius.org [mailto:freeradius-users-bounces+shimon=openu.ac.il@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Wednesday, February 25, 2009 8:45 AM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 46, Issue 94 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. auth: Failed to validate the user - NEED SOME HELP ! (Shimon Weinreich) 2. RE: auth: Failed to validate the user - NEED SOME HELP ! (Tim Sylvester) ---------------------------------------------------------------------- Message: 1 Date: Wed, 25 Feb 2009 08:35:38 +0200 From: "Shimon Weinreich" <shimon(a)openu.ac.il> Subject: auth: Failed to validate the user - NEED SOME HELP ! To: <freeradius-users(a)lists.freeradius.org> Message-ID: <A8DAF37AB05CA74C938F57DD1909576614360D(a)AMNON.openu.local> Content-Type: text/plain; charset="windows-1255" Hello, My name is Shimon from the Open Univ. of Israel. I installed freeradius and I want the Users to authenticate with /etc/raddb/users file NOT /etc/passwd file. Below is a printout of /usr/sbin/radius ?X ?y ---------------------- rad_recv: Access-Request packet from host 127.0.0.1:54057, id=172, length=59 User-Name = "monitor" User-Password = "XXXXXXXX" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "monitor", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry monitor at line 216 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 172 to 127.0.0.1 port 54057 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 172 with timestamp 49a4e630 Nothing to do. Sleeping until we see a request. ----------------------------------------------------- Can someone help me with defining radius NOT to authenticate with /etc/passwd But with /etc/raddb/users file. Tnx, ------- ?????, ????? ???????? ??????????? ??????

2 1

auth: Failed to validate the user - NEED SOME HELP !
by Shimon Weinreich 25 Feb '09

25 Feb '09

Hello, My name is Shimon from the Open Univ. of Israel. I installed freeradius and I want the Users to authenticate with /etc/raddb/users file NOT /etc/passwd file. Below is a printout of /usr/sbin/radius –X –y ---------------------- rad_recv: Access-Request packet from host 127.0.0.1:54057, id=172, length=59 User-Name = "monitor" User-Password = "XXXXXXXX" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "monitor", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry monitor at line 216 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 172 to 127.0.0.1 port 54057 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 172 with timestamp 49a4e630 Nothing to do. Sleeping until we see a request. ----------------------------------------------------- Can someone help me with defining radius NOT to authenticate with /etc/passwd But with /etc/raddb/users file. Tnx, ------- בברכה, שמעון ויינרייך האוניברסיטה הפתוחה

3 2

auth type as check item in users file
by Luke 24 Feb '09

24 Feb '09

Hi, I'm trying to figure out how to check to see if the auth type is mschap in the users file. I can find tons of help on setting the Auth-Type, but not a lot on how to compare it. Additional background info: I'm running 802.1x with two auth types, certificate based and mschap. I have a default (meaning, no other checks performed) users entry to assign anyone who authenticates but doesn't match a group entry further up the file into a specific vlan. However, if I'm going to add in certificate based authentication, these will also hit that default setting, and I don't want it to... I want the certificate based authenticators to not have a vlan assigned to them by 802.1x.

2 1

trigger an Access Challenge
by Ronny Voigt 24 Feb '09

24 Feb '09

Hello! I want to test a radius client with the freeradius server. Access Requests and Replies works fine, but although I searched this mailing list and several websites I still have no idea how to trigger an Access Challenge. It would be very nice, if somebody could tell me how I have to configure freeradius, so that it sends an access challenge to my client. Thanks in advance Regards, Ronny

2 6

Free Radius problem with sending large certificate chains, using EAP-TLS
by Smith, Brian (ESEA IS&A) 24 Feb '09

24 Feb '09

Hi, We are running freeradius, version 1.1.7, on Fedora. We are testing WPA2/EAP-TLS authentication, with large certificate chains (just under 64K in PEM format). Some individual cert sizes in the chain approach 10K in DER format. If the chain is small enough to fit in a single TLS message, authentication works fine. But is the chain is greater than 16,384 bytes, eap-tls fails. Looking at a packet trace, freeradius does not send a message above 16.438 bytes. Instead of breaking it up into different records, it attempts to send it in one TLS record, with fragments that are too large. Wireshark trace of Radius traffic shows the following: TLS Server Hello, Certificate, Certificate Request {Malformed Packet} Frame: 1239, payload 16384-17407 (1024 bytes) [Fragment overlap: True] {Fragment too long: True] This frame pattern repeats with later fragments ... Per RFC's 2716 and 5216, it seems freeradius should brake a single TLS message (larger than one 16,384 byte record can support) into multiple TLS records. We could not find anything on this problem in the FAQ or user lists. Can someone tell us what we are doing wrong, or is this a bug which hasn't been reports, since this large cert chain is rare? We will update to the latest freeradius release. Thanks, Brian Smith RFC's 2716 and 5216 - EAP-TLS Authentication Protocol Section 2.1.5. Fragmentation A single TLS record may be up to 16384 octets in length, but a TLS message may span multiple TLS records, and a TLS certificate message may in principle be as long as 16 MB. The group of EAP-TLS messages sent in a single round may thus be larger than the MTU size or the maximum Remote Authentication Dail-In User Service (RADIUS) packet size of 4096 octets. As a result, an EAP-TLS implementation MUST provide its own support for fragmentation and reassembly. However, in order to ensure interoperability with existing implementations, TLS handshake messages SHOULD NOT be fragmented into multiple TLS records if they fit within a single TLS record. In order to protect against reassembly lockup and denial-of-service attacks, it may be desirable for an implementation to set a maximum size for one such group of TLS messages. Since a single certificate is rarely longer than a few thousand octets, and no other field is likely to be anywhere near as long, a reasonable choice of maximum acceptable message length might be 64 KB.

4 10