Re: PEAP/MSCHAP doesn't run post-auth in inner-tunnel for reject?
For my installations I've disabled the EAP cache to make things work better. Only a few users noticed. Does anyone know if the same thing happens In the 3.0 branch? I was planning to put one of my production servers on the 3.0 code this Summer. Alan DeKok <aland@deployingradius.com> wrote:
Phil Mayers wrote:
Am I being dumb / getting something wrong or does the post-auth session not get called if PEAP/MSCHAP returns a reject?
It seems to run for successful auths, but not failures.
That is the case.
This is in the context of us not seeing log messages for EAP auth failures; I suspect that the client may just "hang up" and let the EAP session expire, and since the inner post-auth doesn't run, and the outer session expires, I have no logs.
There was talk about getting it to do Post-Auth-Type Reject in the inner tunnel. No code yet, tho.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Bruce Nunn <ironrake@yahoo.com> wrote: >For my installations I've disabled the EAP cache to make things work >better. Only a few users noticed. Does anyone know if the same thing >happens In the 3.0 branch? I was planning to put one of my production >servers on the 3.0 code this Summer. > >Alan DeKok <aland@deployingradius.com> wrote: > >>Phil Mayers wrote: >>> Am I being dumb / getting something wrong or does the post-auth >session >>> not get called if PEAP/MSCHAP returns a reject? >>> >>> It seems to run for successful auths, but not failures. >> >> That is the case. >> >>> This is in the context of us not seeing log messages for EAP auth >>> failures; I suspect that the client may just "hang up" and let the >EAP >>> session expire, and since the inner post-auth doesn't run, and the >outer >>> session expires, I have no logs. >> >> There was talk about getting it to do Post-Auth-Type Reject in the >>inner tunnel. No code yet, tho. >> >> Alan DeKok. >>- >>List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html Eap cache? If you're referring to session caching, that's a completely different issue. Cached session resumption by design doesn't run any inner tunnel including post-auth. You need to set Cached-Session-Policy in the inner-tunnel then match it on outer tunnel. -- Sent from my phone. Please excuse brevity and typos.
participants (2)
-
Bruce Nunn -
Phil Mayers