# -*- text -*-
#
+# :toc:
+#
# $Id$
+#######################################################################
+#
+# = EAP/Inner Module
#
-# Sample configuration for an EAP module that occurs *inside*
-# of a tunneled method. It is used to limit the EAP types that
-# can occur inside of the inner tunnel.
+# The `eap_inner` module provides a sample configuration for an `EAP`
+# module that occurs *inside* of a tunneled method. It is used to limit
+# the `EAP` types that can occur inside of the inner tunnel.
#
-# See also raddb/sites-available/inner-tunnel
+# See also `raddb/sites-available/inner-tunnel`
#
-# See raddb/mods-available/eap for full documentation on the meaning of these
+# See `eap` for full documentation on the meaning of these
# configuration entries.
#
+
+# # Default instance
+#
+# eap inner-eap { ... }::
+#
eap inner-eap {
#
- # Set the correct method from the table below. The inner method can be
- # negotiated, but it's more efficient to offer the correct one the
- # first time.
+ # default_eap_type:: Set the correct method from the table below.
#
- # PEAP username/password - mschapv2
- # TTLS username/password - gtc, mschapv2
- # PEAP certificate - tls
- # TTLS certificate - tls
+ # The inner method can be negotiated, but it's more efficient to
+ # offer the correct one the first time.
+ #
+ # [options="header,autowidth"]
+ # |===
+ # | EAP Types | Description | Key
+ # | PEAP | username/password | mschapv2
+ # | TTLS | username/password | gtc, mschapv2
+ # | PEAP | certificate | tls
+ # | TTLS | certificate | tls
+ # |===
#
default_eap_type = mschapv2
#
- # Allowed EAP-types
- #
- # Only EAP types listed below with a 'type = <EAP-Type>' pair will be allowed.
+ # type:: Only EAP types listed below with a 'type = <EAP-Type>' pair will be allowed.
#
type = md5
type = gtc
type = tls
#
- # MD5 is OK to use the inner tunnel, as keying material is provided by
+ # ## md5 { ... }
+ #
+ # `md5` is OK to use the inner tunnel, as keying material is provided by
# the outer EAP method.
#
md5 {
}
+ #
+ # ## gtc { ... }
+ #
+ # See the `eap` module for common configuration explanation.
+ #
gtc {
- # The default challenge, which many clients
- # ignore..
- #challenge = "Password: "
+# challenge = "Password: "
auth_type = PAP
}
+ #
+ # ## mschapv2 { ... }
+ #
+ # See the `eap` module for common configuration explanation.
+ #
mschapv2 {
- # See mods-available/eap for documentation
# send_error = no
}
- # No TTLS or PEAP configuration should be listed here.
-
#
- # The primary rationale for using PEAP-TLS or TTLS-TLS instead of
- # EAP-TLS, is that it protects the certificate the user presents.
+ # CAUTION: No TTLS or PEAP configuration should be listed here.
#
- # In the case of PEAP it also allows SoH with client certificates.
+
+ #
+ # ## tls-config tls-peer { ... }
#
tls-config tls-peer {
#
- # OpenSSL will automatically create certificate chains, unless
- # we tell it to not do that. The problem is that it sometimes
- # gets the chains right from a certificate signature view, but
- # wrong from the clients view.
- #
- # When setting "auto_chain = no", the server chain {} stanza(s)
- # below MUST include the full certificate chain.
+ # auto_chain:: See the `eap` module for common configuration explanation.
#
# auto_chain = yes
#
- # Multiple chain sections can be specified to allow
- # different chains for different key types (RSA, DSA, EC).
- #
- # If multiple chains for the same key type are specified
- # the last chain to be processed will be used for that
- # key type.
+ # chain { ... }:: See the `eap` module for common configuration explanation.
#
chain {
certificate_file = ${certdir}/rsa/server.pem
}
#
- # Trusted Root CA list
- #
- # ALL of the CA's in this list will be trusted to issue client
- # certificates for authentication.
- #
- # You should not use a public CA here. This should either be
- # set to a certificate chain for your institution's CA
- # or a self signed Root CA.
+ # ca_file:: See the `eap` module for common configuration explanation.
#
ca_file = ${cadir}/rsa/ca.pem
#
- # For DH cipher suites to work, you have to run OpenSSL to
- # create the DH file first:
- #
- # openssl dhparam -out certs/dh 2048
+ # dh_file::
#
dh_file = ${certdir}/dh
#
- # If your system doesn't have /dev/urandom, you will need to
- # create this file, and periodically change its contents.
- #
- # For security reasons, FreeRADIUS doesn't write to files in
- # its configuration directory.
+ # random_file:: See the `eap` module for common configuration explanation.
#
# random_file = /dev/urandom
#
- # As this is the inner tunnel, the fragment size is limited by
- # the TLVs used to represent the inner EAP method.
- #
- # For PEAPv0 and TTLS, the length field of these TLVs is 16bits.
- #
- # The maximum TLS record size however is 16k, so that's what
- # we set here.
- #
- # This can be set lower for diagnostics, but will make EAP
- # slightly less efficient, as there'll be additional header
- # data in the inner tunnel.
+ # fragment_size:: See the `eap` module for common configuration explanation.
#
fragment_size = 16384
+ #
+ # check_crl:: See the `eap` module for common configuration explanation.
+ #
# check_crl = yes
+
+ #
+ # ca_path:: See the `eap` module for common configuration explanation.
+ #
ca_path = ${cadir}
+
+ #
+ # check_cert_issuer:: See the `eap` module for common configuration explanation.
+ #
# check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd"
+
+ #
+ # check_cert_cn:: See the `eap` module for common configuration explanation.
+ #
# check_cert_cn = %{User-Name}
- # Accept an expired Certificate Revocation List
+ #
+ # allow_expired_crl:: See the `eap` module for common configuration explanation.
#
# allow_expired_crl = no
}
- ## EAP-TLS
+ #
+ # ## tls { ... }
#
# You SHOULD use different certificates than are used
# for the outer EAP configuration!
#
- # You can create the "inner-server.pem" file by doing:
+ # You can create the `inner-server.pem` file by doing:
#
# cd raddb/certs
# vi inner-server.cnf
# make inner-server
#
- # The certificate MUST be different from the "server.cnf"
+ # NOTE: The certificate MUST be different from the `server.cnf`
# file.
#
- # Support for PEAP/TLS and RFC 5176 TLS/TLS is experimental.
+ # CAUTION: Support for `PEAP/TLS` and `RFC 5176` `TLS/TLS` is experimental.
# It might work, or it might not.
#
tls {
projects / thirdparty / freeradius-server.git / commitdiff
