From: Alan T. DeKok <aland@freeradius.org>
Date: Tue, 26 Sep 2017 21:14:32 +0000 (-0400)
Subject: update documentation
X-Git-Tag: release_3_0_16~116
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=94c4ea8fdb3024568e7baf1df7a2458c8460bdec;p=thirdparty%2Ffreeradius-server.git

update documentation
---

diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
index 9da4a14aba7..dc88d1cb1de 100644
--- a/raddb/mods-available/eap
+++ b/raddb/mods-available/eap
@@ -875,15 +875,26 @@ eap {
 #	fast {
 		# Point to the common TLS configuration
 		#
-		# cipher_list though must include "ADH" for anonymous provisioning.
-		# This is not as straight forward as appending "ADH" alongside
-		# "DEFAULT" as "DEFAULT" contains "!aNULL" so instead it is
-		# recommended "ALL:!EXPORT:!eNULL:!SSLv2" is used
-		# Note - for OpenSSL 1.1.0 and above you may need
-		# to add ":@SECLEVEL=0"
-		#
 #		tls = tls-common
 
+		#
+		#  If 'cipher_list' is set here, it will over-ride the
+		#  'cipher_list' configuration from the 'tls-common'
+		#  configuration.  The EAP-FAST module has it's own
+		#  over-ride for 'cipher_list' because the
+		#  specifications mandata a different set of ciphers
+		#  than are used by the other EAP methods.
+		#
+		#  cipher_list though must include "ADH" for anonymous provisioning.
+		#  This is not as straight forward as appending "ADH" alongside
+		#  "DEFAULT" as "DEFAULT" contains "!aNULL" so instead it is
+		#  recommended "ALL:!EXPORT:!eNULL:!SSLv2" is used
+		#
+		#  Note - for OpenSSL 1.1.0 and above you may need
+		#  to add ":@SECLEVEL=0"
+		#
+#		cipher_list = "ALL:!EXPORT:!eNULL:!SSLv2"
+
 		# PAC lifetime in seconds (default: seven days)
 		#
 #		pac_lifetime = 604800