Popular RADIUS server exploitable with TLS session caching

freeradius default

FreeRADIUS Version 2.2.5 on Debian 8.7

/etc/freeradius/eap.conf

has

eap {

...

tls {

...

cache {

# Enable it. The default is "no".

# Deleting the entire "cache" subsection

# Also disables caching.

#

# You can disallow resumption for a

# particular user by adding the following

# attribute to the control item list:

#

# Allow-Session-Resumption = No

#

# If "enable = no" below, you CANNOT

# enable resumption for just one user

# by setting the above attribute to "yes".

#

enable = no