FreeRADIUS已设置tls_min_version为1.2仍提示允许TLS 1.0/1.1的问题排查求助

我在树莓派的Debian系统上用FreeRADIUS 3.0.21部署EAP-TTLS，目前设备能正常连接，服务也在运行，但启动日志里一直提示TLS 1.0/1.1仍处于可用状态，明明我已经按照提示在配置里设置了tls_min_version = "1.2"，实在搞不懂哪里出问题了，麻烦大家帮忙排查下！

服务状态日志 #

执行systemctl status freeradius的输出如下：

● freeradius.service - FreeRADIUS multi-protocol policy server

Loaded: loaded (/lib/systemd/system/freeradius.service; enabled; vendor preset: enabled)

Active: active (running) since Thu 2023-03-09 17:22:55 UTC; 2h 33min ago

Docs: man:radiusd(8)
man:radiusd.conf(5)
http://wiki.freeradius.org/
http://networkradius.com/doc/

Process: 783 ExecStartPre=/usr/sbin/freeradius $FREERADIUS_OPTIONS -Cx -lstdout (code=exited, status=0/SUCCESS)

Main PID: 786 (freeradius)

Status: "Processing requests"

Tasks: 6 (limit: 2101)

Memory: 81.7M (limit: 2.0G)

CPU: 1.621s

CGroup: /system.slice/freeradius.service
└─786 /usr/sbin/freeradius -f

Mar 09 17:22:54 rpi4-20230308 freeradius[783]: rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output

Mar 09 17:22:54 rpi4-20230308 freeradius[783]: rlm_sql (sql): Attempting to connect to database "radius"

Mar 09 17:22:54 rpi4-20230308 freeradius[783]: rlm_sql (sql): Initialising connection pool

Mar 09 17:22:54 rpi4-20230308 freeradius[783]: Ignoring "ldap" (see raddb/mods-available/README.rst)

Mar 09 17:22:54 rpi4-20230308 freeradius[783]:  # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/3.0/sites-enabled/inner-tunnel:336

Mar 09 17:22:54 rpi4-20230308 freeradius[783]: radiusd: #### Skipping IP addresses and Ports ####

Mar 09 17:22:54 rpi4-20230308 freeradius[783]: The configuration allows TLS 1.0 and/or TLS 1.1.  We STRONGLY recommned using only TLS 1.2 for security

Mar 09 17:22:54 rpi4-20230308 freeradius[783]: Please set: tls_min_version = "1.2"

Mar 09 17:22:54 rpi4-20230308 freeradius[783]: Configuration appears to be OK

Mar 09 17:22:55 rpi4-20230308 systemd[1]: Started FreeRADIUS multi-protocol policy server.

已配置的mods-available/eap文件 #

我已经在该文件中设置了tls_min_version = "1.2"，完整内容如下：

eap {

default_eap_type = ttls

timer_expire = 60

ignore_unknown_eap_types = no

cisco_accounting_username_bug = no

max_sessions = ${max_requests}

md5 {

}

leap {

}

gtc {

auth_type = PAP

}

tls-config tls-common {

private_key_password = secretpassword

private_key_file = ${certdir}/freeradius.key.pem

certificate_file = ${certdir}/freeradius.pem

ca_file = ${certdir}/ca.pem

dh_file = ${certdir}/dh

random_file = /dev/urandom

ca_path = ${cadir}

cipher_list = "DEFAULT"

#cipher_list = "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:DHE-RSA-CAMELLIA128-SHA"

cipher_server_preference = no

tls_min_version = "1.2"

tls_max_version = "1.2"

ecdh_curve = "secp384r1"

cache {

enable = no

lifetime = 24 # hours

persist_dir = "${logdir}/tlscache"

store {

Tunnel-Private-Group-Id

}

}

verify {

}

ocsp {

enable = no

override_cert_url = yes

url = "http://127.0.0.1/ocsp/"

}

}

tls {

tls = tls-common

}

ttls {

tls = tls-common

default_eap_type = md5

copy_request_to_tunnel = no

use_tunneled_reply = no

virtual_server = "inner-tunnel"

}

peap {

tls = tls-common

default_eap_type = mschapv2

copy_request_to_tunnel = no

use_tunneled_reply = no

virtual_server = "inner-tunnel"

}

mschapv2 {

}

}

sites-available/tls文件配置 #

另外我的TLS站点配置文件内容如下：

listen {

ipaddr = *

port = 2083

type = auth+acct

proto = tcp

virtual_server = default

clients = radsec

limit {

max_connections = 16

lifetime = 0

idle_timeout = 30

}

tls {

private_key_password = secretpassword

private_key_file = ${certdir}/freeradius.key.pem

certificate_file = ${certdir}/freeradius.pem

ca_file = ${certdir}/ca.pem

dh_file = ${certdir}/dh

random_file = /dev/urandom

fragment_size = 8192

ca_path = ${cadir}

cipher_list = "DEFAULT"

cipher_server_preference = no

cache {

enable = no

lifetime = 24 # hours

}

require_client_cert = yes

verify {

}

}

}

clients radsec {

client 127.0.0.1 {

ipaddr = 127.0.0.1

proto = tls

secret = radsec

}

}

home_server tls {

ipaddr = 127.0.0.1

port = 2083

type = auth

secret = radsec

proto = tcp

status_check = none

tls {

private_key_password = whatever

private_key_file = /etc/ssl/private/ssl-cert-snakeoil.key

certificate_file = /etc/ssl/certs/ssl-cert-snakeoil.pem

ca_file = /etc/ssl/certs/ca-certificates.crt

dh_file = ${certdir}/dh

random_file = /dev/urandom

fragment_size = 8192

ca_path = ${cadir}

cipher_list = "DEFAULT"

}

}

home_server_pool tls {

type = fail-over

home_server = tls

}

realm tls {

auth_pool = tls

}

系统环境信息 #

• 内核版本：执行uname -a输出

Linux rpi4-20230308 5.10.0-21-arm64 #1 SMP Debian 5.10.162-1 (2023-01-21) aarch64 GNU/Linux

• OpenSSL版本：执行openssl version输出

OpenSSL 1.1.1n  15 Mar 2022

请大家帮忙看看，我的配置哪里有问题？为什么FreeRADIUS还是认为它会接受TLS 1.0/1.1的握手请求？

备注：内容来源于stack exchange，提问作者Václav