"Fossies" - the Fresh Open Source Software Archive

Member "freeradius-server-3.0.23/raddb/mods-available/eap" (10 Jun 2021, 32926 Bytes) of package /linux/misc/freeradius-server-3.0.23.tar.bz2:


As a special service "Fossies" has tried to format the requested text file into HTML format (style: standard) with prefixed line numbers. Alternatively you can here view or download the uninterpreted source code file. See also the latest Fossies "Diffs" side-by-side code changes report for "eap": 3.0.22_vs_3.0.23.

    1 # -*- text -*-
    2 ##
    3 ##  eap.conf -- Configuration for EAP types (PEAP, TTLS, etc.)
    4 ##
    5 ##	$Id: 0127de6421af08d2b7e3033d57762dd5f7109dad $
    6 
    7 #######################################################################
    8 #
    9 #  Whatever you do, do NOT set 'Auth-Type := EAP'.  The server
   10 #  is smart enough to figure this out on its own.  The most
   11 #  common side effect of setting 'Auth-Type := EAP' is that the
   12 #  users then cannot use ANY other authentication method.
   13 #
   14 eap {
   15 	#  Invoke the default supported EAP type when
   16 	#  EAP-Identity response is received.
   17 	#
   18 	#  The incoming EAP messages DO NOT specify which EAP
   19 	#  type they will be using, so it MUST be set here.
   20 	#
   21 	#  For now, only one default EAP type may be used at a time.
   22 	#
   23 	#  If the EAP-Type attribute is set by another module,
   24 	#  then that EAP type takes precedence over the
   25 	#  default type configured here.
   26 	#
   27 	default_eap_type = md5
   28 
   29 	#  A list is maintained to correlate EAP-Response
   30 	#  packets with EAP-Request packets.  After a
   31 	#  configurable length of time, entries in the list
   32 	#  expire, and are deleted.
   33 	#
   34 	timer_expire = 60
   35 
   36 	#  There are many EAP types, but the server has support
   37 	#  for only a limited subset.  If the server receives
   38 	#  a request for an EAP type it does not support, then
   39 	#  it normally rejects the request.  By setting this
   40 	#  configuration to "yes", you can tell the server to
   41 	#  instead keep processing the request.  Another module
   42 	#  MUST then be configured to proxy the request to
   43 	#  another RADIUS server which supports that EAP type.
   44 	#
   45 	#  If another module is NOT configured to handle the
   46 	#  request, then the request will still end up being
   47 	#  rejected.
   48 	#
   49 	ignore_unknown_eap_types = no
   50 
   51 	# Cisco AP1230B firmware 12.2(13)JA1 has a bug.  When given
   52 	# a User-Name attribute in an Access-Accept, it copies one
   53 	# more byte than it should.
   54 	#
   55 	# We can work around it by configurably adding an extra
   56 	# zero byte.
   57 	#
   58 	cisco_accounting_username_bug = no
   59 
   60 	#  Help prevent DoS attacks by limiting the number of
   61 	#  sessions that the server is tracking.  For simplicity,
   62 	#  this is taken from the "max_requests" directive in
   63 	#  radiusd.conf.
   64 	#
   65 	max_sessions = ${max_requests}
   66 
   67 
   68 	############################################################
   69 	#
   70 	#  Supported EAP-types
   71 	#
   72 
   73 
   74 	#  EAP-MD5
   75 	#
   76 	#  We do NOT recommend using EAP-MD5 authentication
   77 	#  for wireless connections.  It is insecure, and does
   78 	#  not provide for dynamic WEP keys.
   79 	#
   80 	md5 {
   81 	}
   82 
   83 
   84 	#  EAP-pwd -- secure password-based authentication
   85 	#
   86 	#pwd {
   87 	#	group = 19
   88 
   89 	#	server_id = theserver@example.com
   90 
   91 		#  This has the same meaning as for TLS.
   92 		#
   93 	#	fragment_size = 1020
   94 
   95 		# The virtual server which determines the
   96 		# "known good" password for the user.
   97 		# Note that unlike TLS, only the "authorize"
   98 		# section is processed.  EAP-PWD requests can be
   99 		# distinguished by having a User-Name, but
  100 		# no User-Password, CHAP-Password, EAP-Message, etc.
  101 		#
  102 	#	virtual_server = "inner-tunnel"
  103 	#}
  104 
  105 
  106 	#  Cisco LEAP
  107 	#
  108 	#  We do not recommend using LEAP in new deployments.  See:
  109 	#  http://www.securiteam.com/tools/5TP012ACKE.html
  110 	#
  111 	#  As of 3.0.22, LEAP has been removed from the server.
  112 	#  It is insecure, and no one should be using it.
  113 	#
  114 
  115 
  116 	#  EAP-GTC -- Generic Token Card
  117 	#
  118 	#  Currently, this is only permitted inside of EAP-TTLS,
  119 	#  or EAP-PEAP.  The module "challenges" the user with
  120 	#  text, and the response from the user is taken to be
  121 	#  the User-Password.
  122 	#
  123 	#  Proxying the tunneled EAP-GTC session is a bad idea,
  124 	#  the users password will go over the wire in plain-text,
  125 	#  for anyone to see.
  126 	#
  127 	gtc {
  128 		#  The default challenge, which many clients
  129 		#  ignore..
  130 		#
  131 	#	challenge = "Password: "
  132 
  133 		#  The plain-text response which comes back
  134 		#  is put into a User-Password attribute,
  135 		#  and passed to another module for
  136 		#  authentication.  This allows the EAP-GTC
  137 		#  response to be checked against plain-text,
  138 		#  or crypt'd passwords.
  139 		#
  140 		#  If you say "Local" instead of "PAP", then
  141 		#  the module will look for a User-Password
  142 		#  configured for the request, and do the
  143 		#  authentication itself.
  144 		#
  145 		auth_type = PAP
  146 	}
  147 
  148 
  149 	#  Common TLS configuration for TLS-based EAP types
  150 	#  ------------------------------------------------
  151 	#
  152 	#  See raddb/certs/README.md for additional comments
  153 	#  on certificates.
  154 	#
  155 	#  If OpenSSL was not found at the time the server was
  156 	#  built, the "tls", "ttls", and "peap" sections will
  157 	#  be ignored.
  158 	#
  159 	#  If you do not currently have certificates signed by
  160 	#  a trusted CA you may use the 'snakeoil' certificates.
  161 	#  Included with the server in raddb/certs.
  162 	#
  163 	#  If these certificates have not been auto-generated:
  164 	#    cd raddb/certs
  165 	#    make
  166 	#
  167 	#  These test certificates SHOULD NOT be used in a normal
  168 	#  deployment.  They are created only to make it easier
  169 	#  to install the server, and to perform some simple
  170 	#  tests with EAP-TLS, TTLS, or PEAP.
  171 	#
  172 	#  Note that you should NOT use a globally known CA here!
  173 	#  e.g. using a Verisign cert as a "known CA" means that
  174 	#  ANYONE who has a certificate signed by them can
  175 	#  authenticate via EAP-TLS!  This is likely not what you want.
  176 	#
  177 	tls-config tls-common {
  178 		private_key_password = whatever
  179 		private_key_file = ${certdir}/server.pem
  180 
  181 		#  If Private key & Certificate are located in
  182 		#  the same file, then private_key_file &
  183 		#  certificate_file must contain the same file
  184 		#  name.
  185 		#
  186 		#  If ca_file (below) is not used, then the
  187 		#  certificate_file below SHOULD also include all of
  188 		#  the intermediate CA certificates used to sign the
  189 		#  server certificate, but NOT the root CA.
  190 		#
  191 		#  Including the ROOT CA certificate is not useful and
  192 		#  merely inflates the exchanged data volume during
  193 		#  the TLS negotiation.
  194 		#
  195 		#  This file should contain the server certificate,
  196 		#  followed by intermediate certificates, in order.
  197 		#  i.e. If we have a server certificate signed by CA1,
  198 		#  which is signed by CA2, which is signed by a root
  199 		#  CA, then the "certificate_file" should contain
  200 		#  server.pem, followed by CA1.pem, followed by
  201 		#  CA2.pem.
  202 		#
  203 		#  When using "ca_file" or "ca_dir", the
  204 		#  "certificate_file" should contain only
  205 		#  "server.pem".  And then you may (or may not) need
  206 		#  to set "auto_chain", depending on your version of
  207 		#  OpenSSL.
  208 		#
  209 		#  In short, SSL / TLS certificates are complex.
  210 		#  There are many versions of software, each of which
  211 		#  behave slightly differently.  It is impossible to
  212 		#  give advice which will work everywhere.  Instead,
  213 		#  we give general guidelines.
  214 		#
  215 		certificate_file = ${certdir}/server.pem
  216 
  217 		#  Trusted Root CA list
  218 		#
  219 		#  This file can contain multiple CA certificates.
  220 		#  ALL of the CA's in this list will be trusted to
  221 		#  issue client certificates for authentication.
  222 		#
  223 		#  In general, you should use self-signed
  224 		#  certificates for 802.1x (EAP) authentication.
  225 		#  In that case, this CA file should contain
  226 		#  *one* CA certificate.
  227 		#
  228 		ca_file = ${cadir}/ca.pem
  229 
  230 	 	#  OpenSSL will automatically create certificate chains,
  231 	 	#  unless we tell it to not do that.  The problem is that
  232 	 	#  it sometimes gets the chains right from a certificate
  233 	 	#  signature view, but wrong from the clients view.
  234 		#
  235 		#  When setting "auto_chain = no", the server certificate
  236 		#  file MUST include the full certificate chain.
  237 		#
  238 	#	auto_chain = yes
  239 
  240 		#  If OpenSSL supports TLS-PSK, then we can use a
  241 		#  fixed PSK identity and (hex) password.  As of
  242 		#  3.0.18, these can be used at the same time as the
  243 		#  certificate configuration, but only for TLS 1.0
  244 		#  through 1.2.
  245 		#
  246 		#  If PSK and certificates are configured at the same
  247 		#  time for TLS 1.3, then the server will warn you,
  248 		#  and will disable TLS 1.3, as it will not work.
  249 		#
  250 		#  The work around is to have two modules (or for
  251 		#  RadSec, two listen sections).  One will have PSK
  252 		#  configured, and the other will have certificates
  253 		#  configured.
  254 		#
  255 	#	psk_identity = "test"
  256 	#	psk_hexphrase = "036363823"
  257 
  258 		#  Dynamic queries for the PSK.  If TLS-PSK is used,
  259 		#  and psk_query is set, then you MUST NOT use
  260 		#  psk_identity or psk_hexphrase.
  261 		#
  262 		#  Instead, use a dynamic expansion similar to the one
  263 		#  below.  It keys off of TLS-PSK-Identity.  It should
  264 		#  return a of string no more than 512 hex characters.
  265 		#  That string will be converted to binary, and will
  266 		#  be used as the dynamic PSK hexphrase.
  267 		#
  268 		#  Note that this query is just an example.  You will
  269 		#  need to customize it for your installation.
  270 		#
  271 	#	psk_query = "%{sql:select hex(key) from psk_keys where keyid = '%{TLS-PSK-Identity}'}"
  272 
  273 		#  For DH cipher suites to work, you have to
  274 		#  run OpenSSL to create the DH file first:
  275 		#
  276 		#    openssl dhparam -out certs/dh 2048
  277 		#
  278 		dh_file = ${certdir}/dh
  279 
  280 		#  If your system doesn't have /dev/urandom,
  281 		#  you will need to create this file, and
  282 		#  periodically change its contents.
  283 		#
  284 		#  For security reasons, FreeRADIUS doesn't
  285 		#  write to files in its configuration
  286 		#  directory.
  287 		#
  288 	#	random_file = /dev/urandom
  289 
  290 		#  This can never exceed the size of a RADIUS
  291 		#  packet (4096 bytes), and is preferably half
  292 		#  that, to accommodate other attributes in
  293 		#  RADIUS packet.  On most APs the MAX packet
  294 		#  length is configured between 1500 - 1600
  295 		#  In these cases, fragment size should be
  296 		#  1024 or less.
  297 		#
  298 	#	fragment_size = 1024
  299 
  300 		#  include_length is a flag which is
  301 		#  by default set to yes If set to
  302 		#  yes, Total Length of the message is
  303 		#  included in EVERY packet we send.
  304 		#  If set to no, Total Length of the
  305 		#  message is included ONLY in the
  306 		#  First packet of a fragment series.
  307 		#
  308 	#	include_length = yes
  309 
  310 
  311 		#  Check the Certificate Revocation List
  312 		#
  313 		#  1) Copy CA certificates and CRLs to same directory.
  314 		#  2) Execute 'c_rehash <CA certs&CRLs Directory>'.
  315 		#     'c_rehash' is OpenSSL's command.
  316 		#  3) uncomment the lines below.
  317 		#  5) Restart radiusd
  318 	#	check_crl = yes
  319 
  320 		# Check if intermediate CAs have been revoked.
  321 	#	check_all_crl = yes
  322 
  323 		ca_path = ${cadir}
  324 
  325 		# OpenSSL does not reload contents of ca_path dir over time.
  326 		# That means that if check_crl is enabled and CRLs are loaded
  327 		# from ca_path dir, at some point CRLs will expire and
  328 		# RADIUSd will stop authenticating users.
  329 		# If ca_path_reload_interval is non-zero, it will force OpenSSL
  330 		# to reload all data from ca_path periodically
  331 		#
  332 		# Flush ca_path each hour
  333 	#	ca_path_reload_interval = 3600
  334 
  335 
  336 		# Accept an expired Certificate Revocation List
  337 		#
  338 	#	allow_expired_crl = no
  339 
  340 		#  If check_cert_issuer is set, the value will
  341 		#  be checked against the DN of the issuer in
  342 		#  the client certificate.  If the values do not
  343 		#  match, the certificate verification will fail,
  344 		#  rejecting the user.
  345 		#
  346 		#  This check can be done more generally by checking
  347 		#  the value of the TLS-Client-Cert-Issuer attribute.
  348 		#  This check can be done via any mechanism you
  349 		#  choose.
  350 		#
  351 	#	check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd"
  352 
  353 		#  If check_cert_cn is set, the value will
  354 		#  be xlat'ed and checked against the CN
  355 		#  in the client certificate.  If the values
  356 		#  do not match, the certificate verification
  357 		#  will fail rejecting the user.
  358 		#
  359 		#  This check is done only if the previous
  360 		#  "check_cert_issuer" is not set, or if
  361 		#  the check succeeds.
  362 		#
  363 		#  This check can be done more generally by writing
  364 		#  "unlang" statements to examine the value of the
  365 		#  TLS-Client-Cert-Common-Name attribute.
  366 		#
  367 	#	check_cert_cn = %{User-Name}
  368 
  369 		#  Set this option to specify the allowed
  370 		#  TLS cipher suites.  The format is listed
  371 		#  in "man 1 ciphers".
  372 		#
  373 		cipher_list = "DEFAULT"
  374 
  375 		#  If enabled, OpenSSL will use server cipher list
  376 		#  (possibly defined by cipher_list option above)
  377 		#  for choosing right cipher suite rather than
  378 		#  using client-specified list which is OpenSSl default
  379 		#  behavior.  Setting this to "yes" means that OpenSSL
  380 		#  will choose the servers ciphers, even if they do not
  381 		#  best match what the client sends.
  382 		#
  383 		#  TLS negotiation is usually good, but can be imperfect.
  384 		#  This setting allows administrators to "fine tune" it
  385 		#  if necessary.
  386 		#
  387 		cipher_server_preference = no
  388 
  389 		#  You can selectively disable TLS versions for
  390 		#  compatability with old client devices.
  391 		#
  392 		#  If your system has OpenSSL 1.1.0 or greater, do NOT
  393 		#  use these.  Instead, set tls_min_version and
  394 		#  tls_max_version.
  395 		#
  396 #		disable_tlsv1_2 = yes
  397 #		disable_tlsv1_1 = yes
  398 #		disable_tlsv1 = yes
  399 
  400 
  401 		#  Set min / max TLS version.
  402 		#
  403 		#  Generally speaking you should NOT use TLS 1.0 or
  404 		#  TLS 1.1.  They are old, possibly insecure, and
  405 		#  deprecated.  However, it is sometimes necessary to
  406 		#  enable it for compatibility with legact systems.
  407 		#  We recommend replacing those legacy systems, and
  408 		#  using at least TLS 1.2.
  409 		#
  410 		#  Some Debian versions disable older versions of TLS,
  411 		#  and requires the application to manually enable
  412 		#  them.
  413 		#
  414 		#  If you are running such a distribution, you should
  415 		#  set these options, otherwise older clients will not
  416 		#  be able to connect.
  417 		#
  418 		#  Allowed values are "1.0", "1.1", "1.2", and "1.3".
  419 		#
  420 		#  As of 2021, it is STRONGLY RECOMMENDED to set
  421 		#
  422 		#	tls_min_version = "1.2"
  423 		#
  424 		#  Older TLS versions are insecure and deprecated.
  425 		#
  426 		#  In order to enable TLS 1.0 and TLS 1.1, you may
  427 		#  also need to update cipher_list below to:
  428 		#
  429 		#	cipher_list = "DEFAULT@SECLEVEL=1"
  430 		#
  431 		#  The values must be in quotes.
  432 		#
  433 		#  We also STRONGLY RECOMMEND to set
  434 		#
  435 		#	tls_max_version = "1.2"
  436 		#
  437 		#  While the server will accept "1.3" as a value,
  438 		#  most EAP supplicants WILL NOT DO TLS 1.3 PROPERLY.
  439 		#
  440 		#  i.e. they WILL NOT WORK, SO DO NOT ASK QUESTIONS ON
  441 		#  THE LIST ABOUT WHY IT DOES NOT WORK.
  442 		#
  443 		#  The TLS 1.3 support is here for future
  444 		#  compatibility, as clients get upgraded, and people
  445 		#  don't upgrade their copies of FreeRADIUS.
  446 		#
  447 		#  Also note that we only support TLS 1.3 for EAP-TLS.
  448 		#  Other versions of EAP (PEAP, TTLS, FAST) DO NOT
  449 		#  SUPPORT TLS 1.3.
  450 		#
  451 		tls_min_version = "1.2"
  452 		tls_max_version = "1.2"
  453 
  454 		#  Elliptical cryptography configuration
  455 		#
  456 		#  This configuration should be one of the following:
  457 		#
  458 		#  * a name of the curve to use, e.g. "prime256v1".
  459 		#
  460 		#  * a colon separated list of curve NIDs or names.
  461 		#
  462 		#  * an empty string, in which case OpenSSL will choose
  463 		#    the "best" curve for the situation.
  464 		#
  465 		#  For supported curve names, please run
  466 		#
  467 		#	openssl ecparam -list_curves
  468 		#
  469 		ecdh_curve = "prime256v1"
  470 
  471 		#  Session resumption / fast reauthentication
  472 		#  cache.
  473 		#
  474 		#  The cache contains the following information:
  475 		#
  476 		#   session Id - unique identifier, managed by SSL
  477 		#   User-Name  - from the Access-Accept
  478 		#   Stripped-User-Name - from the Access-Request
  479 		#   Cached-Session-Policy - from the Access-Accept
  480 		#
  481 		#  See also the "store" subsection below for
  482 		#  additional attributes which can be cached.
  483 		#
  484 		#  The "Cached-Session-Policy" is the name of a
  485 		#  policy which should be applied to the cached
  486 		#  session.  This policy can be used to assign
  487 		#  VLANs, IP addresses, etc.  It serves as a useful
  488 		#  way to re-apply the policy from the original
  489 		#  Access-Accept to the subsequent Access-Accept
  490 		#  for the cached session.
  491 		#
  492 		#  On session resumption, these attributes are
  493 		#  copied from the cache, and placed into the
  494 		#  reply list.
  495 		#
  496 		#  You probably also want "use_tunneled_reply = yes"
  497 		#  when using fast session resumption.
  498 		#
  499 		#  You can check if a session has been resumed by
  500 		#  looking for the existence of the EAP-Session-Resumed
  501 		#  attribute.  Note that this attribute will *only*
  502 		#  exist in the "post-auth" section.
  503 		#
  504 		#  CAVEATS: The cache is stored and reloaded BEFORE
  505 		#  the "post-auth" section is run.  This limitation
  506 		#  makes caching more difficult than it should be.  In
  507 		#  practice, it means that the first authentication
  508 		#  session must set the reply attributes before the
  509 		#  post-auth section is run.
  510 		#
  511 		#  When the session is resumed, the attributes are
  512 		#  restored and placed into the session-state list.
  513 		#
  514 		cache {
  515 			#  Enable it.  The default is "no". Deleting the entire "cache"
  516 			#  subsection also disables caching.
  517 			#
  518 			#  The session cache requires the use of the
  519 			#  "name" and "persist_dir" configuration
  520 			#  items, below.
  521 			#
  522 			#  The internal OpenSSL session cache has been permanently
  523 			#  disabled.
  524 			#
  525 			#  You can disallow resumption for a particular user by adding the
  526 			#  following attribute to the control item list:
  527 			#
  528 			#    Allow-Session-Resumption = No
  529 			#
  530 			#  If "enable = no" below, you CANNOT enable resumption for just one
  531 			#  user by setting the above attribute to "yes".
  532 			#
  533 			enable = no
  534 
  535 			#  Lifetime of the cached entries, in hours. The sessions will be
  536 			#  deleted/invalidated after this time.
  537 			#
  538 			lifetime = 24 # hours
  539 
  540 			#  Internal "name" of the session cache. Used to
  541 			#  distinguish which TLS context sessions belong to.
  542 			#
  543 			#  The server will generate a random value if unset.
  544 			#  This will change across server restart so you MUST
  545 			#  set the "name" if you want to persist sessions (see
  546 			#  below).
  547 			#
  548 		#	name = "EAP module"
  549 
  550 			#  Simple directory-based storage of sessions.
  551 			#  Two files per session will be written, the SSL
  552 			#  state and the cached VPs. This will persist session
  553 			#  across server restarts.
  554 			#
  555 			#  The default directory is ${logdir}, for historical
  556 			#  reasons.  You should ${db_dir} instead.  And check
  557 			#  the value of db_dir in the main radiusd.conf file.
  558 			#  It should not point to ${raddb}
  559 			#
  560 			#  The server will need write perms, and the directory
  561 			#  should be secured from anyone else. You might want
  562 			#  a script to remove old files from here periodically:
  563 			#
  564 			#    find ${logdir}/tlscache -mtime +2 -exec rm -f {} \;
  565 			#
  566 			#  This feature REQUIRES "name" option be set above.
  567 			#
  568 		#	persist_dir = "${logdir}/tlscache"
  569 
  570 			#
  571 			#  As of 3.0.20, it is possible to partially
  572 			#  control which attributes exist in the
  573 			#  session cache.  This subsection lists
  574 			#  attributes which are taken from the reply,
  575 			#  and saved to the on-disk cache.  When the
  576 			#  session is resumed, these attributes are
  577 			#  added to the "session-state" list.  The
  578 			#  default configuration will then take care
  579 			#  of copying them to the reply.
  580 			#
  581 			store {
  582 				Tunnel-Private-Group-Id
  583 			}
  584 		}
  585 
  586 		#  Client certificates can be validated via an
  587 		#  external command.  This allows dynamic CRLs or OCSP
  588 		#  to be used.
  589 		#
  590 		#  This configuration is commented out in the
  591 		#  default configuration.  Uncomment it, and configure
  592 		#  the correct paths below to enable it.
  593 		#
  594 		#  If OCSP checking is enabled, and the OCSP checks fail,
  595 		#  the verify section is not run.
  596 		#
  597 		#  If OCSP checking is disabled, the verify section is
  598 		#  run on successful certificate validation.
  599 		#
  600 		verify {
  601 			#  If the OCSP checks succeed, the verify section
  602 			#  is run to allow additional checks.
  603 			#
  604 			#  If you want to skip verify on OCSP success,
  605 			#  uncomment this configuration item, and set it
  606 			#  to "yes".
  607 			#
  608 		#	skip_if_ocsp_ok = no
  609 
  610 			#  A temporary directory where the client
  611 			#  certificates are stored.  This directory
  612 			#  MUST be owned by the UID of the server,
  613 			#  and MUST not be accessible by any other
  614 			#  users.  When the server starts, it will do
  615 			#  "chmod go-rwx" on the directory, for
  616 			#  security reasons.  The directory MUST
  617 			#  exist when the server starts.
  618 			#
  619 			#  You should also delete all of the files
  620 			#  in the directory when the server starts.
  621 			#
  622 		#	tmpdir = /tmp/radiusd
  623 
  624 			#  The command used to verify the client cert.
  625 			#  We recommend using the OpenSSL command-line
  626 			#  tool.
  627 			#
  628 			#  The ${..ca_path} text is a reference to
  629 			#  the ca_path variable defined above.
  630 			#
  631 			#  The %{TLS-Client-Cert-Filename} is the name
  632 			#  of the temporary file containing the cert
  633 			#  in PEM format.  This file is automatically
  634 			#  deleted by the server when the command
  635 			#  returns.
  636 			#
  637 		#	client = "/path/to/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}"
  638 		}
  639 
  640 		#  OCSP Configuration
  641 		#
  642 		#  Certificates can be verified against an OCSP
  643 		#  Responder. This makes it possible to immediately
  644 		#  revoke certificates without the distribution of
  645 		#  new Certificate Revocation Lists (CRLs).
  646 		#
  647 		ocsp {
  648 			#  Enable it.  The default is "no".
  649 			#  Deleting the entire "ocsp" subsection
  650 			#  also disables ocsp checking
  651 			#
  652 			enable = no
  653 
  654 			#  The OCSP Responder URL can be automatically
  655 			#  extracted from the certificate in question.
  656 			#  To override the OCSP Responder URL set
  657 			#  "override_cert_url = yes".
  658 			#
  659 			override_cert_url = yes
  660 
  661 			#  If the OCSP Responder address is not extracted from
  662 			#  the certificate, the URL can be defined here.
  663 			#
  664 			url = "http://127.0.0.1/ocsp/"
  665 
  666 			# If the OCSP Responder can not cope with nonce
  667 			# in the request, then it can be disabled here.
  668 			#
  669 			# For security reasons, disabling this option
  670 			# is not recommended as nonce protects against
  671 			# replay attacks.
  672 			#
  673 			# Note that Microsoft AD Certificate Services OCSP
  674 			# Responder does not enable nonce by default. It is
  675 			# more secure to enable nonce on the responder than
  676 			# to disable it in the query here.
  677 			# See http://technet.microsoft.com/en-us/library/cc770413%28WS.10%29.aspx
  678 			#
  679 		#	use_nonce = yes
  680 
  681 			# Number of seconds before giving up waiting
  682 			# for OCSP response. 0 uses system default.
  683 			#
  684 		#	timeout = 0
  685 
  686 			# Normally an error in querying the OCSP
  687 			# responder (no response from server, server did
  688 			# not understand the request, etc) will result in
  689 			# a validation failure.
  690 			#
  691 			# To treat these errors as 'soft' failures and
  692 			# still accept the certificate, enable this
  693 			# option.
  694 			#
  695 			# Warning: this may enable clients with revoked
  696 			# certificates to connect if the OCSP responder
  697 			# is not available. Use with caution.
  698 			#
  699 		#	softfail = no
  700 		}
  701 	}
  702 
  703 
  704 	#  EAP-TLS
  705 	#
  706 	#  The TLS configuration for TLS-based EAP types is held in
  707 	#  the "tls-config" section, above.
  708 	#
  709 	tls {
  710 		#  Point to the common TLS configuration
  711 		#
  712 		tls = tls-common
  713 
  714 		#  As part of checking a client certificate, the EAP-TLS
  715 		#  sets some attributes such as TLS-Client-Cert-Common-Name. This
  716 		#  virtual server has access to these attributes, and can
  717 		#  be used to accept or reject the request.
  718 		#
  719 	#	virtual_server = check-eap-tls
  720 
  721 		#  You can control whether or not EAP-TLS requires a
  722 		#  client certificate by setting
  723 		#
  724 		#	configurable_client_cert = yes
  725 		#
  726 		#  Once that setting has been changed, you can then set
  727 		#
  728 		#	EAP-TLS-Require-Client-Cert = No
  729 		#
  730 		#  in the control items for a request, and the EAP-TLS
  731 		#  module will not require a client certificate from
  732 		#  the supplicant.
  733 		#
  734 		#  WARNING: This configuration should only be used
  735 		#  when the users are placed into a "captive portal"
  736 		#  or "walled garden", where they have limited network
  737 		#  access.  Otherwise the configuraton will allow
  738 		#  anyone on the network, without authenticating them!
  739 		#
  740 #		configurable_client_cert = no
  741 	}
  742 
  743 
  744 	#  EAP-TTLS -- Tunneled TLS
  745 	#
  746 	#  The TTLS module implements the EAP-TTLS protocol,
  747 	#  which can be described as EAP inside of Diameter,
  748 	#  inside of TLS, inside of EAP, inside of RADIUS...
  749 	#
  750 	#  Surprisingly, it works quite well.
  751 	#
  752 	ttls {
  753 		#  Which tls-config section the TLS negotiation parameters
  754 		#  are in - see EAP-TLS above for an explanation.
  755 		#
  756 		#  In the case that an old configuration from FreeRADIUS
  757 		#  v2.x is being used, all the options of the tls-config
  758 		#  section may also appear instead in the 'tls' section
  759 		#  above. If that is done, the tls= option here (and in
  760 		#  tls above) MUST be commented out.
  761 		#
  762 		tls = tls-common
  763 
  764 		#  The tunneled EAP session needs a default EAP type
  765 		#  which is separate from the one for the non-tunneled
  766 		#  EAP module.  Inside of the TTLS tunnel, we recommend
  767 		#  using EAP-MD5.  If the request does not contain an
  768 		#  EAP conversation, then this configuration entry is
  769 		#  ignored.
  770 		#
  771 		default_eap_type = md5
  772 
  773 		#  The tunneled authentication request does not usually
  774 		#  contain useful attributes like 'Calling-Station-Id',
  775 		#  etc.  These attributes are outside of the tunnel,
  776 		#  and normally unavailable to the tunneled
  777 		#  authentication request.
  778 		#
  779 		#  By setting this configuration entry to 'yes',
  780 		#  any attribute which is NOT in the tunneled
  781 		#  authentication request, but which IS available
  782 		#  outside of the tunnel, is copied to the tunneled
  783 		#  request.
  784 		#
  785 		#  allowed values: {no, yes}
  786 		#
  787 		copy_request_to_tunnel = no
  788 
  789 		#  This configuration item is deprecated.  Instead,
  790 		#  you should use:
  791 		#
  792 		#    update outer.session-state {
  793 		#      ...
  794 		#    }
  795 		#
  796 		#  This will cache attributes for the final Access-Accept.
  797 		#
  798 		#  See "update outer.session-state" in the "post-auth"
  799 		#  sections of sites-available/default, and of
  800 		#  sites-available/inner-tunnel
  801 		#
  802 		#  The reply attributes sent to the NAS are usually
  803 		#  based on the name of the user 'outside' of the
  804 		#  tunnel (usually 'anonymous').  If you want to send
  805 		#  the reply attributes based on the user name inside
  806 		#  of the tunnel, then set this configuration entry to
  807 		#  'yes', and the reply to the NAS will be taken from
  808 		#  the reply to the tunneled request.
  809 		#
  810 		#  allowed values: {no, yes}
  811 		#
  812 		use_tunneled_reply = no
  813 
  814 		#  The inner tunneled request can be sent
  815 		#  through a virtual server constructed
  816 		#  specifically for this purpose.
  817 		#
  818 		#  A virtual server MUST be specified.
  819 		#
  820 		virtual_server = "inner-tunnel"
  821 
  822 		#  This has the same meaning, and overwrites, the
  823 		#  same field in the "tls" configuration, above.
  824 		#  The default value here is "yes".
  825 		#
  826 	#	include_length = yes
  827 
  828 		#  Unlike EAP-TLS, EAP-TTLS does not require a client
  829 		#  certificate. However, you can require one by setting the
  830 		#  following option. You can also override this option by
  831 		#  setting
  832 		#
  833 		#    EAP-TLS-Require-Client-Cert = Yes
  834 		#
  835 		#  in the control items for a request.
  836 		#
  837 		#  Note that the majority of supplicants do not support using a
  838 		#  client certificate with EAP-TTLS, so this option is unlikely
  839 		#  to be usable for most people.
  840 		#
  841 	#	require_client_cert = yes
  842 	}
  843 
  844 
  845 	#  EAP-PEAP
  846 	#
  847 
  848 	##################################################
  849 	#
  850 	#  !!!!! WARNINGS for Windows compatibility  !!!!!
  851 	#
  852 	##################################################
  853 	#
  854 	#  If you see the server send an Access-Challenge,
  855 	#  and the client never sends another Access-Request,
  856 	#  then
  857 	#
  858 	#		STOP!
  859 	#
  860 	#  The server certificate has to have special OID's
  861 	#  in it, or else the Microsoft clients will silently
  862 	#  fail.  See the "scripts/xpextensions" file for
  863 	#  details, and the following page:
  864 	#
  865 	#	https://support.microsoft.com/en-us/help/814394/
  866 	#
  867 	#  If is still doesn't work, and you're using Samba,
  868 	#  you may be encountering a Samba bug.  See:
  869 	#
  870 	#	https://bugzilla.samba.org/show_bug.cgi?id=6563
  871 	#
  872 	#  Note that we do not necessarily agree with their
  873 	#  explanation... but the fix does appear to work.
  874 	#
  875 	##################################################
  876 
  877 	#  The tunneled EAP session needs a default EAP type
  878 	#  which is separate from the one for the non-tunneled
  879 	#  EAP module.  Inside of the TLS/PEAP tunnel, we
  880 	#  recommend using EAP-MS-CHAPv2.
  881 	#
  882 	peap {
  883 		#  Which tls-config section the TLS negotiation parameters
  884 		#  are in - see EAP-TLS above for an explanation.
  885 		#
  886 		#  In the case that an old configuration from FreeRADIUS
  887 		#  v2.x is being used, all the options of the tls-config
  888 		#  section may also appear instead in the 'tls' section
  889 		#  above. If that is done, the tls= option here (and in
  890 		#  tls above) MUST be commented out.
  891 		#
  892 		tls = tls-common
  893 
  894 		#  The tunneled EAP session needs a default
  895 		#  EAP type which is separate from the one for
  896 		#  the non-tunneled EAP module.  Inside of the
  897 		#  PEAP tunnel, we recommend using MS-CHAPv2,
  898 		#  as that is the default type supported by
  899 		#  Windows clients.
  900 		#
  901 		default_eap_type = mschapv2
  902 
  903 		#  The PEAP module also has these configuration
  904 		#  items, which are the same as for TTLS.
  905 		#
  906 		copy_request_to_tunnel = no
  907 
  908 		#  This configuration item is deprecated.  Instead,
  909 		#  you should use:
  910 		#
  911 		#    update outer.session-state {
  912 		#      ...
  913 		#    }
  914 		#
  915 		#  This will cache attributes for the final Access-Accept.
  916 		#
  917 		#  See "update outer.session-state" in the "post-auth"
  918 		#  sections of sites-available/default, and of
  919 		#  sites-available/inner-tunnel
  920 		#
  921 		use_tunneled_reply = no
  922 
  923 		#  When the tunneled session is proxied, the
  924 		#  home server may not understand EAP-MSCHAP-V2.
  925 		#  Set this entry to "no" to proxy the tunneled
  926 		#  EAP-MSCHAP-V2 as normal MSCHAPv2.
  927 		#
  928 		#  This setting can be over-ridden on a packet by
  929 		#  packet basis by setting
  930 		#
  931 		#	&control:Proxy-Tunneled-Request-As-EAP = yes
  932 		#
  933 	#	proxy_tunneled_request_as_eap = yes
  934 
  935 		#  The inner tunneled request can be sent
  936 		#  through a virtual server constructed
  937 		#  specifically for this purpose.
  938 		#
  939 		#  A virtual server MUST be specified.
  940 		#
  941 		virtual_server = "inner-tunnel"
  942 
  943 		#  This option enables support for MS-SoH
  944 		#  see doc/SoH.txt for more info.
  945 		#  It is disabled by default.
  946 		#
  947 	#	soh = yes
  948 
  949 		#  The SoH reply will be turned into a request which
  950 		#  can be sent to a specific virtual server:
  951 		#
  952 	#	soh_virtual_server = "soh-server"
  953 
  954 		#  Unlike EAP-TLS, PEAP does not require a client certificate.
  955 		#  However, you can require one by setting the following
  956 		#  option. You can also override this option by setting
  957 		#
  958 		#    EAP-TLS-Require-Client-Cert = Yes
  959 		#
  960 		#  in the control items for a request.
  961 		#
  962 		#  Note that the majority of supplicants do not support using a
  963 		#  client certificate with PEAP, so this option is unlikely to
  964 		#  be usable for most people.
  965 		#
  966 	#	require_client_cert = yes
  967 	}
  968 
  969 
  970 	#  EAP-MSCHAPv2
  971 	#
  972 	#  Note that it is the EAP MS-CHAPv2 sub-module, not
  973 	#  the main 'mschap' module.
  974 	#
  975 	#  Note also that in order for this sub-module to work,
  976 	#  the main 'mschap' module MUST ALSO be configured.
  977 	#
  978 	#  This module is the *Microsoft* implementation of MS-CHAPv2
  979 	#  in EAP.  There is another (incompatible) implementation
  980 	#  of MS-CHAPv2 in EAP by Cisco, which FreeRADIUS does not
  981 	#  currently support.
  982 	#
  983 	mschapv2 {
  984 		#  In earlier versions of the server, this module
  985 		#  never sent the MS-CHAP-Error message to the client.
  986 		#  This worked, but it had issues when the cached
  987 		#  password was wrong.  The server *should* send
  988 		#  "E=691 R=0" to the client, which tells it to prompt
  989 		#  the user for a new password.
  990 		#
  991 		#  The default is to use that functionality.  which is
  992 		#  known to work.  If you set "send_error = yes", then
  993 		#  the error message will be sent back to the client.
  994 		#  This *may* help some clients work better, but *may*
  995 		#  also cause other clients to stop working.
  996 		#
  997 	#	send_error = no
  998 
  999 		#  Server identifier to send back in the challenge.
 1000 		#  This should generally be the host name of the
 1001 		#  RADIUS server.  Or, some information to uniquely
 1002 		#  identify it.
 1003 		#
 1004 	#	identity = "FreeRADIUS"
 1005 	}
 1006 
 1007 
 1008 	#  EAP-FAST
 1009 	#
 1010 	#  The FAST module implements the EAP-FAST protocol
 1011 	#
 1012 	#fast {
 1013 		#  Point to the common TLS configuration
 1014 		#
 1015 	#	tls = tls-common
 1016 
 1017 		#  If 'cipher_list' is set here, it will over-ride the
 1018 		#  'cipher_list' configuration from the 'tls-common'
 1019 		#  configuration.  The EAP-FAST module has it's own
 1020 		#  over-ride for 'cipher_list' because the
 1021 		#  specifications mandata a different set of ciphers
 1022 		#  than are used by the other EAP methods.
 1023 		#
 1024 		#  cipher_list though must include "ADH" for anonymous provisioning.
 1025 		#  This is not as straight forward as appending "ADH" alongside
 1026 		#  "DEFAULT" as "DEFAULT" contains "!aNULL" so instead it is
 1027 		#  recommended "ALL:!EXPORT:!eNULL:!SSLv2" is used
 1028 		#
 1029 	#	cipher_list = "ALL:!EXPORT:!eNULL:!SSLv2"
 1030 
 1031 		#  PAC lifetime in seconds (default: seven days)
 1032 		#
 1033 	#	pac_lifetime = 604800
 1034 
 1035 		#  Authority ID of the server
 1036 		#
 1037 		#  If you are running a cluster of RADIUS servers, you should make
 1038 		#  the value chosen here (and for "pac_opaque_key") the same on all
 1039 		#  your RADIUS servers.  This value should be unique to your
 1040 		#  installation.  We suggest using a domain name.
 1041 		#
 1042 	#	authority_identity = "1234"
 1043 
 1044 		#  PAC Opaque encryption key (must be exactly 32 bytes in size)
 1045 		#
 1046 		#  This value MUST be secret, and MUST be generated using
 1047 		#  a secure method, such as via 'openssl rand -hex 32'
 1048 		#
 1049 	#	pac_opaque_key = "0123456789abcdef0123456789ABCDEF"
 1050 
 1051 		#  Same as for TTLS, PEAP, etc.
 1052 		#
 1053 	#	virtual_server = inner-tunnel
 1054 	#}
 1055 }