From: Jorge Pereira Date: Fri, 3 May 2019 21:15:07 +0000 (-0300) Subject: Update raddb/sites-available/abfab-tls X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ffa759d46a73a13fc57348ea979a5736d1afe148;p=thirdparty%2Ffreeradius-server.git Update raddb/sites-available/abfab-tls --- diff --git a/raddb/sites-available/abfab-tls b/raddb/sites-available/abfab-tls index cd514d92db4..dde96e938ad 100644 --- a/raddb/sites-available/abfab-tls +++ b/raddb/sites-available/abfab-tls @@ -1,7 +1,22 @@ +# -*- text -*- # -# Example configuration for ABFAB listening on TLS. +# :toc: # # $Id$ + +####################################################################### +# +# = ABFAB listening on TLS +# +# If you need to provide the `abfab-tr-idp` with SSL support, enable it. +# + +# +# # Example configuration +# + +# +# ## listen { ... } # listen { ipaddr = * @@ -9,11 +24,15 @@ listen { type = auth proto = tcp + # + # ## tls { ... } + # tls { - # Moonshot tends to distribute certs separate from keys + # + # NOTE: Moonshot tends to distribute certs separate from keys. + # chain { certificate_file = ${certdir}/server.pem - private_key_file = ${certdir}/server.key private_key_password = whatever } @@ -32,49 +51,76 @@ listen { require_client_cert = yes verify { + } psk_query = "%{psksql:select hex(key) from psk_keys where keyid = '%{TLS-PSK-Identity}'}" } + # + # .Please see the `sites-availables/abfab-idp` file. + # virtual_server = abfab-idp + # + # .Reference to the next `clients {...}` section. + # clients = radsec-abfab } +# +# ## clients { ... } +# +# This client stanza will match other RP proxies from other realms +# established via the trustrouter. In general additional client +# stanzas are also required for local services. +# clients radsec-abfab { # - # Allow all clients, but require TLS. - # This client stanza will match other RP proxies from other - # realms established via the trustrouter. In general - # additional client stanzas are also required for local services. + # .Allow all clients, but require TLS. # - client default { - ipaddr = 0.0.0.0/0 + client default { + ipaddr = 0.0.0.0/0 proto = tls } - # An example local service - # client service_1 { - # ipaddr = 192.0.2.20 - # # You should either set gss_acceptor_host_name below - # # or set up policy to confirm that a client claims - # # the right acceptor hostname when using ABFAB. If - # # set, the RADIUS server will confirm that all - # # requests have this value for the acceptor host name - # gss_acceptor_host_name = "server.example.com" - # # If set, this acceptor realm name will be included. - # Foreign realms will typically reject a request if this is not - # # properly set. - # gss_acceptor_realm_name = "example.com" - # # Additionally, trust_router_coi can be set; if set - # # it will override the default_community in the realm - # # module - # # trust_router_coi = "community1.example.net" - # # In production depployments it is important to set - # # up certificate verification so that even if - # # clients spoof IP addresses, one client cannot - # # impersonate another. - # } + # + # .An example local service. + # + client service_1 { + + # + # ipaddr:: + # +# ipaddr = 192.0.2.20 + # + # gss_acceptor_host_name:: + # + # You should either set `gss_acceptor_host_name` below or set up policy to confirm + # that a client claims the right acceptor hostname when using ABFAB. + # + # If set, the RADIUS server will confirm that all requests have this value for the + # acceptor host name. + # +# gss_acceptor_host_name = "server.example.com" + + # + # gss_acceptor_realm_name:: Foreign realms will typically reject a request + # if this is not properly set. + # +# gss_acceptor_realm_name = "example.com" + + # + # trust_router_coi:: Override the `default_community` in the realm module. + # +# trust_router_coi = "community1.example.net" + + # + # IMPORTANT: In production depployments it is important to set up certificate + # verification so that even if clients spoof IP addresses, one client cannot + # impersonate another. + # + + } }