Dynamic Client and TCP/TLS
Hi, I am trying to setup Dynamic Client configuration where Redis is used to retrieve the secret, setup the FreeRADIUS-Client attributes and redirect for authentication. The model is working perfectly for UDP with Dynamic Clients and for TCP/TLS non-dynamic clients. The moment I enable Dynamic Clients against the TCP/TLS configuration, I get the following error: Error: Receive - Error receiving packet. Transport endpoint is not connected. This error is followed by Error, Ignoring request ... from unknown client. I tried to re-install and out of the box configuration, Used Fedora built and a 3.0.19 based compiled built against the default configuration and keys. The response is unfortunately exactly the same. Lastly, I tried to connect via openssl s_client host_ip and via FreeRadius acting as a proxy. It is always the same error :( To reproduce, Please try the default configuration, add tls to sites-enabled and connect via a radsec client. I truly appreciate any hints on if anything special is required. Thanks you, Karim
On May 11, 2019, at 1:08 PM, Karim Benayed <benayed@gmail.com> wrote:
Hi, I am trying to setup Dynamic Client configuration where Redis is used to retrieve the secret, setup the FreeRADIUS-Client attributes and redirect for authentication.
The model is working perfectly for UDP with Dynamic Clients and for TCP/TLS non-dynamic clients.
The moment I enable Dynamic Clients against the TCP/TLS configuration, I get the following error:
In order to do TCP/TLS, the server has to do *full* TLS negotiation. Only then can it read any packets. The short answer is that it's not set up to do dynamic clients for TCP/TLS. Changing that isn't trivial. The simple solution is to just forbid dynamic clients when TCP/TLS is used. For TCP/TLS tho, you don't *need* dynamic clients. Just allow 0/0, and the require a known client certificate. If the certificate is OK, you don't really care where the packets come from. Alan DeKok.
participants (2)
-
Alan DeKok -
Karim Benayed