[1] you need to share the SSL session cache between your different
FreeRADIUS boxen, the support for that is not in OpenSSL yet if
I remember correctly (or was it FreeRADIUS). This would be done
Shared SSL session caches are definitely supported in OpenSSL, and have
been for a while IIRC; see "distcache" for info. Whether it's compiled
into your SSL library, and whether there are caveats that mean it won't
work with FreeRadius... not sure.
Apache lists (commented out) config items like:
#SSLSessionCache dc:UNIX:/var/cache/mod_ssl/distcache
...in Fedora at least.
Whilst testing the SoH/NAP stuff, I saw some oddities with SSL session
resumption. I wasn't sure if it was something I did (i.e. broke inside
the PEAP code) or not, but the server seemed to be allowing resumption
even when it was disabled i.e. with the default FR config.
Random info: PEAP/SoH in fact *does* send traffic inside the tunnel on
session resumption - the spec has the SoH exchanged even when resumed,
adding a round trip, but it doesn't re-run the inner mschap auth. Weird.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
