I’ve been looking through docs but I couldn’t find an answer. Does Freeradius support fast reconnect (for roaming wifi users) with EAP PEAP by default or it needs to be enabled/configured? Regards Martin
On Aug 20, 2019, at 10:09 AM, Marcin Marszałkowski <m.marszal@wp.pl> wrote:
I’ve been looking through docs but I couldn’t find an answer. Does Freeradius support fast reconnect (for roaming wifi users) with EAP PEAP by default or it needs to be enabled/configured?
See raddb/mods-available/eap. Look for "session resumption" or "fast reauthentication" Alan DeKok.
See raddb/mods-available/eap. Look for "session resumption" or "fast reauthentication"
I went through wiki docs for cache module. But I’m not sure whether cache and cache_eap have anything in common with tlscache in eap module... BTW, is it possible to test fast reauthentication cache? I’m asking because specified tls-common section /var/lib/radiusd/tlscache folder (owner and group assigned to freerad) remains empty. Regards Martin
On Aug 21, 2019, at 4:57 AM, Marcin Marszałkowski <m.marszal@wp.pl> wrote:
See raddb/mods-available/eap. Look for "session resumption" or "fast reauthentication"
I went through wiki docs for cache module. But I’m not sure whether cache and cache_eap have anything in common with tlscache in eap module...
I said read See raddb/mods-available/eap, not raddb/mods-available/cache. They are different things. If the two caches had anything to do with each other, then the configuration would say that.
BTW, is it possible to test fast reauthentication cache? I’m asking because specified tls-common section /var/lib/radiusd/tlscache folder (owner and group assigned to freerad) remains empty.
There *is* debug output you can read. All of the documentation says to run "radiusd -X". Perhaps you missed that? If so, please suggest another place where we can add that suggestion so people will read it. Alan DeKok.
I said read See raddb/mods-available/eap, not raddb/mods-available/cache. They are different things. And I did read eap module. And I doubt because there’s nothing in configured folder.
There *is* debug output you can read. All of the documentation says to run "radiusd -X”. I know that, but I’m asking if there’s some tool to test cache content and not where to read debug...
Regards Martin
On Aug 21, 2019, at 7:55 AM, Marcin Marszałkowski <m.marszal@wp.pl> wrote:
I said read See raddb/mods-available/eap, not raddb/mods-available/cache. They are different things. And I did read eap module. And I doubt because there’s nothing in configured folder.
What does that mean? Which "configured folder"? The server shops with a default configuration for the eap module. If there is no file there, then someone deleted it. If you don't know which folder to look in for the eap module configuration, then run the server in debugging mode. and *READ* the output. It will tell you what folders / files it's reading. Maybe your local system puts the configuration files into /etc/freeradius instead of /etc/raddb. We don't know where the files are, because you haven't told us which OS you're using. And, you haven't posted the debug output which would show the configuration directory. Honestly, there's a *reason* we're so fanatical about "RUN IN DEBUG MODE AND READ THE OUTPUT". It's because reading the debug output solves an enormous amount of problems. Like the problem of "there's nothing in configured folder".
There *is* debug output you can read. All of the documentation says to run "radiusd -X”. I know that, but I’m asking if there’s some tool to test cache content and not where to read debug...
eapol_test is the testing tool to use. My web site has full instructions for how to test EAP: http://deployingradius.com It's been there for 15 years, and is the definitive guide to this subject. Alan DeKok.
What does that mean? Which "configured folder"? I meant „persist_dir”, as it is set in eap module and radius.conf. None of configuration files are missing, everything is in /etc/freeradius/3.0/
radiusd.conf: localstatedir = /var # Should likely be ${localstatedir}/lib/radiusd #db_dir = ${raddbdir} db_dir = ${localstatedir}/lib/radiusd eap: name = "EAP module" # The server will need write perms, and the directory # should be secured from anyone else. You might want # a script to remove old files from here periodically: # # find ${logdir}/tlscache -mtime +2 -exec rm -f {} \; # # This feature REQUIRES "name" option be set above. # persist_dir = "${db_dir}/tlscache" and in debug freeradius -X: cache { enable = yes lifetime = 24 name = "EAP module" max_entries = 255 persist_dir = "/var/lib/radiusd/tlscache" } And persist_dir = "/var/lib/radiusd/tlscache” is empty But another part of debug says (rejection is ok - user restricted by logintime): (41) eap_peap: Continuing EAP-TLS (41) eap_peap: [eaptls verify] = ok (41) eap_peap: Done initial handshake (41) eap_peap: [eaptls process] = ok (41) eap_peap: Session established. Decoding tunneled attributes (41) eap_peap: PEAP state send tlv failure (41) eap_peap: Received EAP-TLV response (41) eap_peap: ERROR: The users session was previously rejected: returning reject (again.) (41) eap_peap: This means you need to read the PREVIOUS messages in the debug output (41) eap_peap: to find out the reason why the user was rejected (41) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you (41) eap_peap: what went wrong, and how to fix the problem (41) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (41) eap: Sending EAP Failure (code 4) ID 75 length 4 (41) eap: Failed in EAP select To me it’s not written black on white that cache does work, since persist_dir is empty, I’m not sure of it. And that’s why I’ve asked about cache module. Regards Martin
On Aug 21, 2019, at 10:18 AM, Marcin Marszałkowski <m.marszal@wp.pl> wrote:
What does that mean? Which "configured folder"? I meant „persist_dir”, as it is set in eap module and radius.conf. None of configuration files are missing, everything is in /etc/freeradius/3.0/
Ok...
radiusd.conf:
No, we don't need to see the configuration files. The documentation says that.
And persist_dir = "/var/lib/radiusd/tlscache” is empty
Files get added there only when the user has been authenticated.
But another part of debug says (rejection is ok - user restricted by logintime):
It doesn't say "rejection is ok". it says SOME things succeed (ok), and OTHER things caused a reject.
(41) eap_peap: Continuing EAP-TLS (41) eap_peap: [eaptls verify] = ok (41) eap_peap: Done initial handshake (41) eap_peap: [eaptls process] = ok (41) eap_peap: Session established. Decoding tunneled attributes (41) eap_peap: PEAP state send tlv failure (41) eap_peap: Received EAP-TLV response
(41) eap_peap: ERROR: The users session was previously rejected: returning reject (again.)
(41) eap_peap: This means you need to read the PREVIOUS messages in the debug output (41) eap_peap: to find out the reason why the user was rejected (41) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you (41) eap_peap: what went wrong, and how to fix the problem
Those messages could not possibly be any more clear. Why are you ignoring the messages that tell you what to do?
To me it’s not written black on white that cache does work, since persist_dir is empty, I’m not sure of it.
If the user is rejected, you can't do "fast RE-authentication". Because the user wasn't authenticated. And if the user isn't authenticated, there's no cache entry.
And that’s why I’ve asked about cache module.
So instead of reading the messages in front of you, and following instructions, you look somewhere *else* with a similar name. No, the "cache" module does not magically do TLS session caching. Nothing in the documentation says it does. The "cache" module documentation DOES say exactly how that module works. Again, read the documentation and the debug output. I cannot be any more clear on this. Since you're NOT reading the documentation and debug output, you're just wasting everyones time. Alan DeKok.
Those messages could not possibly be any more clear. If I would have known freeradius as good as you guys do, than I don’t need to ask.
And persist_dir = "/var/lib/radiusd/tlscache” is empty
Files get added there only when the user has been authenticated.
That wasn’t the only one connection attempt, other were accepted. My problem is that I’m on the other side of the world where test and productive servers are and I contact them over slow and crowded sat link. Therefore I can’t run many tests and stay in debug mode since high and variable link latency causes problems. Anyway thanks.
On Aug 21, 2019, at 11:06 AM, Marcin Marszałkowski <m.marszal@wp.pl> wrote:
Those messages could not possibly be any more clear. If I would have known freeradius as good as you guys do, than I don’t need to ask.
That is not an acceptable answer. The debug messages you posted were *extremely* clear. You can't ignore them by saying "I'm not an expert". The way to become an expert is to *read* things. Your messages come across like you just can't be bothered to read things, which is bad.
And persist_dir = "/var/lib/radiusd/tlscache” is empty
Files get added there only when the user has been authenticated.
That wasn’t the only one connection attempt, other were accepted.
i.e you posted a debug output which showed a reject, where reauthentication is *impossible*. Instead of posting a debug output showing an accept, where reauthentication is possible.
My problem is that I’m on the other side of the world where test and productive servers are and I contact them over slow and crowded sat link. Therefore I can’t run many tests and stay in debug mode since high and variable link latency causes problems.
Use "mosh" https://mosh.org Alan DeKok.
participants (2)
-
Alan DeKok -
Marcin Marszałkowski