update documentation

diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
index 9da4a14aba7f326ae2b98387e0460fad88e293b4..dc88d1cb1def29c098f1199a6fde262dd7c85ae5 100644 (file)
--- a/raddb/mods-available/eap
+++ b/raddb/mods-available/eap
@@ -875,15 +875,26 @@ eap {
 #      fast {
                # Point to the common TLS configuration
                #
-               # cipher_list though must include "ADH" for anonymous provisioning.
-               # This is not as straight forward as appending "ADH" alongside
-               # "DEFAULT" as "DEFAULT" contains "!aNULL" so instead it is
-               # recommended "ALL:!EXPORT:!eNULL:!SSLv2" is used
-               # Note - for OpenSSL 1.1.0 and above you may need
-               # to add ":@SECLEVEL=0"
-               #
 #              tls = tls-common
 
+               #
+               #  If 'cipher_list' is set here, it will over-ride the
+               #  'cipher_list' configuration from the 'tls-common'
+               #  configuration.  The EAP-FAST module has it's own
+               #  over-ride for 'cipher_list' because the
+               #  specifications mandata a different set of ciphers
+               #  than are used by the other EAP methods.
+               #
+               #  cipher_list though must include "ADH" for anonymous provisioning.
+               #  This is not as straight forward as appending "ADH" alongside
+               #  "DEFAULT" as "DEFAULT" contains "!aNULL" so instead it is
+               #  recommended "ALL:!EXPORT:!eNULL:!SSLv2" is used
+               #
+               #  Note - for OpenSSL 1.1.0 and above you may need
+               #  to add ":@SECLEVEL=0"
+               #
+#              cipher_list = "ALL:!EXPORT:!eNULL:!SSLv2"
+
                # PAC lifetime in seconds (default: seven days)
                #
 #              pac_lifetime = 604800