Update raddb/sites-available/abfab-tls

diff --git a/raddb/sites-available/abfab-tls b/raddb/sites-available/abfab-tls
index cd514d92db4c1c03b7a0c8690519348d3f96754e..dde96e938ad671ee9d73c0a719454e5108539e55 100644 (file)
--- a/raddb/sites-available/abfab-tls
+++ b/raddb/sites-available/abfab-tls
@@ -1,7 +1,22 @@
+#  -*- text -*-
 #
-#      Example configuration for ABFAB listening on TLS.
+#  :toc:
 #
 #      $Id$
+
+#######################################################################
+#
+#  = ABFAB listening on TLS
+#
+#  If you need to provide the `abfab-tr-idp` with SSL support, enable it.
+#
+
+#
+#  # Example configuration
+#
+
+#
+#  ## listen { ... }
 #
 listen {
        ipaddr = *
@@ -9,11 +24,15 @@ listen {
        type = auth
        proto = tcp
 
+       #
+       #  ## tls { ... }
+       #
        tls {
-               #  Moonshot tends to distribute certs separate from keys
+               #
+               #  NOTE: Moonshot tends to distribute certs separate from keys.
+               #
                chain {
                        certificate_file = ${certdir}/server.pem
-
                        private_key_file = ${certdir}/server.key
                        private_key_password = whatever
                }
@@ -32,49 +51,76 @@ listen {
 
                require_client_cert = yes
                verify {
+
                }
 
                psk_query = "%{psksql:select hex(key) from psk_keys where keyid = '%{TLS-PSK-Identity}'}"
        }
 
+       #
+       #  .Please see the `sites-availables/abfab-idp` file.
+       #
        virtual_server = abfab-idp
 
+       #
+       #  .Reference to the next `clients {...}` section.
+       #
        clients = radsec-abfab
 }
 
+#
+#  ## clients { ... }
+#
+#  This client stanza will match other RP proxies from other realms
+#  established via the trustrouter.  In general additional client
+#  stanzas are also required for local services.
+#
 clients radsec-abfab {
        #
-       #  Allow all clients, but require TLS.
-       #  This client stanza will match other RP proxies from other
-       #  realms  established via the trustrouter.  In general
-       #  additional client stanzas are also required for local services.
+       #  .Allow all clients, but require TLS.
        #
-        client default {
-               ipaddr = 0.0.0.0/0
+       client default {
+               ipaddr = 0.0.0.0/0
                proto = tls
        }
 
-       #  An example local service
-       #  client service_1 {
-       #       ipaddr = 192.0.2.20
-       #       #  You should either set gss_acceptor_host_name below
-       #       #  or set up policy to confirm that a client claims
-       #       #  the right acceptor hostname when using ABFAB.  If
-       #       #  set,  the RADIUS server will confirm that all
-       #       #  requests have this value for the acceptor host name
-       #       gss_acceptor_host_name = "server.example.com"
-       #       #  If set, this acceptor realm name will be included.
-       #  Foreign realms will typically reject a request if this is not
-       #       #  properly set.
-       #       gss_acceptor_realm_name = "example.com"
-       #       #  Additionally, trust_router_coi can be set; if set
-       #       #  it will override the default_community in the realm
-       #       #  module
-       #       # trust_router_coi =  "community1.example.net"
-       #       #  In production depployments it is important to set
-       #       #       up certificate verification  so that even if
-       #       #  clients spoof IP addresses, one client cannot
-       #       #  impersonate another.
-       #  }
+       #
+       #  .An example local service.
+       #
+       client service_1 {
+
+       #
+       #  ipaddr::
+       #
+#              ipaddr = 192.0.2.20
+       #
+       #  gss_acceptor_host_name::
+       #
+       #  You should either set `gss_acceptor_host_name` below or set up policy to confirm
+       #  that a client claims the right acceptor hostname when using ABFAB.
+       #
+       #  If set, the RADIUS server will confirm that all requests have this value for the
+       #  acceptor host name.
+       #
+#              gss_acceptor_host_name = "server.example.com"
+
+       #
+       #  gss_acceptor_realm_name:: Foreign realms will typically reject a request
+       #  if this is not properly set.
+       #
+#              gss_acceptor_realm_name = "example.com"
+
+       #
+       #  trust_router_coi:: Override the `default_community` in the realm module.
+       #
+#              trust_router_coi =  "community1.example.net"
+
+       #
+       #  IMPORTANT: In production depployments it is important to set up certificate
+       #  verification so that even if clients spoof IP addresses, one client cannot
+       #  impersonate another.
+       #
+
+       }
 
 }