Nefunkční rad_eap_test - Debian 10 (Buster)

[TrustWire]

Pokus o ověření:

# rad_eap_test -H 127.0.0.1 -P 1812 -S secret -u testuser@realm.domain -p password -m WPA-EAP -e PEAP -t 5
timeout; 5.01 sec |rtt=5010ms;;;0;5000 accept=1;0.5:;0:;0;1

V logu radiusu je pak vidět:

...
(4) eap_peap: Continuing EAP-TLS
(4) eap_peap: [eaptls verify] = ok
(4) eap_peap: Done initial handshake
(4) eap_peap: <<< recv UNKNOWN TLS VERSION ?0304? [length 0001] 
(4) eap_peap: TLS_accept: TLSv1.3 early data
(4) eap_peap: <<< recv UNKNOWN TLS VERSION ?0304? [length 0034] 
(4) eap_peap: TLS_accept: SSLv3/TLS read finished
(4) eap_peap: (other): SSLv3/TLS write session ticket
(4) eap_peap: >>> send UNKNOWN TLS VERSION ?0304? [length 0001] 
(4) eap_peap: >>> send UNKNOWN TLS VERSION ?0304? [length 0039] 
(4) eap_peap: TLS_accept: SSLv3/TLS write session ticket
(4) eap_peap: >>> send UNKNOWN TLS VERSION ?0304? [length 0001] 
(4) eap_peap: >>> send UNKNOWN TLS VERSION ?0304? [length 0039] 
...

Dočasným řešením může být přidání parametru tls_max_version = "1.2" do konfiguračního souboru eap.

diff --git a/ansible-freeradius/templates/eap.j2 b/ansible-freeradius/templates/eap.j2
index 0ad959d..c878c33 100644
--- a/ansible-freeradius/templates/eap.j2
+++ b/ansible-freeradius/templates/eap.j2
@@ -173,6 +173,7 @@ eap {
        #  ANYONE who has a certificate signed by them can
        #  authenticate via EAP-TLS!  This is likely not what you want.
        tls-config tls-common {
+               tls_max_version = "1.2"
 {% if eduroam.EAP is defined %}
 {% if eduroam.EAP.private_key_password is defined %}
                private_key_password = {{ eduroam.EAP.private_key_password }}