TLS - Config - Cache

Synopsis

Subsection of tls-config_tls-common.

Session resumption / fast reauthentication cache.

The cache contains the following information:

session Id

unique identifier managed by SSL

User-Name

from the Access-Accept

Stripped-User-Name

from the Access-Request

Cached-Session-Policy

from the Access-Accept

The Cached-Session-Policy is the name of a policy that should be applied to the cached session. This policy can be used to assign VLANs, IP addresses, etc. It serves as a useful way to re-apply the policy from the original Access-Accept to the subsequent Access-Accept for the cached session. On session resumption, these attributes are copied from the cache and placed into the reply list. You probably also want use_tunneled_reply = yes when using fast session resumption.

Processing Sections

Any.

Expansions

None.

Directives

enable
Syntax

enable = boolean

Default

yes

Description

Enable it. The default is no. Deleting the entire cache subsection also disables caching. You can disallow resumption for a particular user by adding Allow-Session-Resumption=no to the control item list.

Note
If enable = no, you CANNOT enable resumption for just one user by setting the above attribute to yes.
lifetime
Syntax

lifetime = string

Default

24 hours

Description

Lifetime of the cached entries, in hours. The sessions will be deleted after this time.

max_entries
Syntax

max_entries = integer

Default

255

Description

The maximum number of entries in the cache. Set to "0" for "infinite". This could be set to the number of users who are logged in…​ which can be a LOT.

name
Syntax

name = ++

Default

string

Description

Internal name of the session cache. Used to distinguish to which TLS context the sessions belong. If no value is input, the server will generate a random value. This will change across server restart so you MUST set the name if you want that value to remain constant (persist) for each session.

persist_dir
Syntax

persist_dir = string

Default

${logdir}/tlscache

Description

Simple directory-based storage of sessions. Two files per session will be written, the SSL state and the cached VPs. This will persist session across server restarts. The server will need write permissions, and the directory should be secured. The following script will remove old files from this location periodically:

find ${logdir}/tlscache -mtime +2 -exec rm -f {} \;

This feature REQUIRES name option be set above.