From: Jorge Pereira Date: Mon, 4 Feb 2019 23:29:54 +0000 (-0200) Subject: Update raddb/mods-available/eap_inner X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f1a329c183bd85af5f5ac2f1e12712bcd84792b5;p=thirdparty%2Ffreeradius-server.git Update raddb/mods-available/eap_inner --- diff --git a/raddb/mods-available/eap_inner b/raddb/mods-available/eap_inner index 385d8c0f365..8432c5e69f9 100644 --- a/raddb/mods-available/eap_inner +++ b/raddb/mods-available/eap_inner @@ -1,34 +1,47 @@ # -*- text -*- # +# :toc: +# # $Id$ +####################################################################### +# +# = EAP/Inner Module # -# Sample configuration for an EAP module that occurs *inside* -# of a tunneled method. It is used to limit the EAP types that -# can occur inside of the inner tunnel. +# The `eap_inner` module provides a sample configuration for an `EAP` +# module that occurs *inside* of a tunneled method. It is used to limit +# the `EAP` types that can occur inside of the inner tunnel. # -# See also raddb/sites-available/inner-tunnel +# See also `raddb/sites-available/inner-tunnel` # -# See raddb/mods-available/eap for full documentation on the meaning of these +# See `eap` for full documentation on the meaning of these # configuration entries. # + +# # Default instance +# +# eap inner-eap { ... }:: +# eap inner-eap { # - # Set the correct method from the table below. The inner method can be - # negotiated, but it's more efficient to offer the correct one the - # first time. + # default_eap_type:: Set the correct method from the table below. # - # PEAP username/password - mschapv2 - # TTLS username/password - gtc, mschapv2 - # PEAP certificate - tls - # TTLS certificate - tls + # The inner method can be negotiated, but it's more efficient to + # offer the correct one the first time. + # + # [options="header,autowidth"] + # |=== + # | EAP Types | Description | Key + # | PEAP | username/password | mschapv2 + # | TTLS | username/password | gtc, mschapv2 + # | PEAP | certificate | tls + # | TTLS | certificate | tls + # |=== # default_eap_type = mschapv2 # - # Allowed EAP-types - # - # Only EAP types listed below with a 'type = ' pair will be allowed. + # type:: Only EAP types listed below with a 'type = ' pair will be allowed. # type = md5 type = gtc @@ -36,52 +49,49 @@ eap inner-eap { type = tls # - # MD5 is OK to use the inner tunnel, as keying material is provided by + # ## md5 { ... } + # + # `md5` is OK to use the inner tunnel, as keying material is provided by # the outer EAP method. # md5 { } + # + # ## gtc { ... } + # + # See the `eap` module for common configuration explanation. + # gtc { - # The default challenge, which many clients - # ignore.. - #challenge = "Password: " +# challenge = "Password: " auth_type = PAP } + # + # ## mschapv2 { ... } + # + # See the `eap` module for common configuration explanation. + # mschapv2 { - # See mods-available/eap for documentation # send_error = no } - # No TTLS or PEAP configuration should be listed here. - # - # The primary rationale for using PEAP-TLS or TTLS-TLS instead of - # EAP-TLS, is that it protects the certificate the user presents. + # CAUTION: No TTLS or PEAP configuration should be listed here. # - # In the case of PEAP it also allows SoH with client certificates. + + # + # ## tls-config tls-peer { ... } # tls-config tls-peer { # - # OpenSSL will automatically create certificate chains, unless - # we tell it to not do that. The problem is that it sometimes - # gets the chains right from a certificate signature view, but - # wrong from the clients view. - # - # When setting "auto_chain = no", the server chain {} stanza(s) - # below MUST include the full certificate chain. + # auto_chain:: See the `eap` module for common configuration explanation. # # auto_chain = yes # - # Multiple chain sections can be specified to allow - # different chains for different key types (RSA, DSA, EC). - # - # If multiple chains for the same key type are specified - # the last chain to be processed will be used for that - # key type. + # chain { ... }:: See the `eap` module for common configuration explanation. # chain { certificate_file = ${certdir}/rsa/server.pem @@ -91,74 +101,67 @@ eap inner-eap { } # - # Trusted Root CA list - # - # ALL of the CA's in this list will be trusted to issue client - # certificates for authentication. - # - # You should not use a public CA here. This should either be - # set to a certificate chain for your institution's CA - # or a self signed Root CA. + # ca_file:: See the `eap` module for common configuration explanation. # ca_file = ${cadir}/rsa/ca.pem # - # For DH cipher suites to work, you have to run OpenSSL to - # create the DH file first: - # - # openssl dhparam -out certs/dh 2048 + # dh_file:: # dh_file = ${certdir}/dh # - # If your system doesn't have /dev/urandom, you will need to - # create this file, and periodically change its contents. - # - # For security reasons, FreeRADIUS doesn't write to files in - # its configuration directory. + # random_file:: See the `eap` module for common configuration explanation. # # random_file = /dev/urandom # - # As this is the inner tunnel, the fragment size is limited by - # the TLVs used to represent the inner EAP method. - # - # For PEAPv0 and TTLS, the length field of these TLVs is 16bits. - # - # The maximum TLS record size however is 16k, so that's what - # we set here. - # - # This can be set lower for diagnostics, but will make EAP - # slightly less efficient, as there'll be additional header - # data in the inner tunnel. + # fragment_size:: See the `eap` module for common configuration explanation. # fragment_size = 16384 + # + # check_crl:: See the `eap` module for common configuration explanation. + # # check_crl = yes + + # + # ca_path:: See the `eap` module for common configuration explanation. + # ca_path = ${cadir} + + # + # check_cert_issuer:: See the `eap` module for common configuration explanation. + # # check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd" + + # + # check_cert_cn:: See the `eap` module for common configuration explanation. + # # check_cert_cn = %{User-Name} - # Accept an expired Certificate Revocation List + # + # allow_expired_crl:: See the `eap` module for common configuration explanation. # # allow_expired_crl = no } - ## EAP-TLS + # + # ## tls { ... } # # You SHOULD use different certificates than are used # for the outer EAP configuration! # - # You can create the "inner-server.pem" file by doing: + # You can create the `inner-server.pem` file by doing: # # cd raddb/certs # vi inner-server.cnf # make inner-server # - # The certificate MUST be different from the "server.cnf" + # NOTE: The certificate MUST be different from the `server.cnf` # file. # - # Support for PEAP/TLS and RFC 5176 TLS/TLS is experimental. + # CAUTION: Support for `PEAP/TLS` and `RFC 5176` `TLS/TLS` is experimental. # It might work, or it might not. # tls {