Logging EAP-PEAP/TTLS TLS version and Ciphers
Hi *, (using freeradius 3.0.17) To evaluate how many clients use which TLS version and what cipher has been negotiated between freeradius and supplicant, I want to log those values via linelog. (To get an idea, if and when it is feasible to tighten the cipher_list and TLS versions supported.) I've been looking through dictionary.freeradius.internal and know about TLS-Cert-* and TLS-Client-Cert-*, but those of course don't contain the information I seek. (No client cert for PEAP/TTLS and I already know all about the server cert, no need to log them.) Is there any attribute I missed or an xlat I need to do to get this into a log message? Grüße, Sven.
On Mar 13, 2019, at 10:50 AM, Sven Hartge <sven@svenhartge.de> wrote:
To evaluate how many clients use which TLS version and what cipher has been negotiated between freeradius and supplicant, I want to log those values via linelog. (To get an idea, if and when it is feasible to tighten the cipher_list and TLS versions supported.)
This information isn't exposed in v3.
I've been looking through dictionary.freeradius.internal and know about TLS-Cert-* and TLS-Client-Cert-*, but those of course don't contain the information I seek. (No client cert for PEAP/TTLS and I already know all about the server cert, no need to log them.)
Is there any attribute I missed or an xlat I need to do to get this into a log message?
You'll need to edit the source to add this information as attributes. Alan DeKok.
On 13.03.19 16:27, Alan DeKok wrote:
On Mar 13, 2019, at 10:50 AM, Sven Hartge <sven@svenhartge.de> wrote:
To evaluate how many clients use which TLS version and what cipher has been negotiated between freeradius and supplicant, I want to log those values via linelog. (To get an idea, if and when it is feasible to tighten the cipher_list and TLS versions supported.)
This information isn't exposed in v3.
OK, fair enough. It would have been nice, but is no life-or-death essential feature for me. Does you explicitly mentioning v3 mean that this information will be available in some way or form in vNext? Grüße, Sven.
On Mar 13, 2019, at 2:31 PM, Sven Hartge <sven@svenhartge.de> wrote:
Does you explicitly mentioning v3 mean that this information will be available in some way or form in vNext?
It meant that I answered your question, because you asked about v3. It may be available in a later version. Alan DeKok.
On 13.03.19 20:33, Alan DeKok wrote:
On Mar 13, 2019, at 2:31 PM, Sven Hartge <sven@svenhartge.de> wrote:
Does you explicitly mentioning v3 mean that this information will be available in some way or form in vNext?
It meant that I answered your question, because you asked about v3.
It may be available in a later version.
Right. I keep an eye on the commit logs then. Grüße, Sven.
On Mar 14, 2019, at 3:58 AM, Sven Hartge <sven@svenhartge.de> wrote:
On 13.03.19 20:33, Alan DeKok wrote:
On Mar 13, 2019, at 2:31 PM, Sven Hartge <sven@svenhartge.de> wrote:
Does you explicitly mentioning v3 mean that this information will be available in some way or form in vNext?
It meant that I answered your question, because you asked about v3.
It may be available in a later version.
Right. I keep an eye on the commit logs then.
It's already there - https://github.com/FreeRADIUS/freeradius-server/blob/master/src/lib/tls/sess... -Arran
participants (3)
-
Alan DeKok -
Arran Cudbard-Bell -
Sven Hartge