files/usr/local/etc/raddb/mods-available/eap.radius_server


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50

eap {
  default_eap_type = tls
  timer_expire = 60
  ignore_unknown_eap_types = yes
  cisco_accounting_username_bug = no
  max_sessions = \${max_requests}

  tls-config tls-common {
    private_key_password =
    private_key_file = ${freeradius_tls_key}
    certificate_file = ${freeradius_tls_cert}
    ca_file = ${site_cacert_path}
    ca_path = \${cadir}
    auto_chain = no
    check_crl = no
    cipher_list = "DEFAULT"
    cipher_server_preference = no
    tls_min_version = "1.2"
    tls_max_version = "1.3"
    ecdh_curve = ""

    cache {
      enable = yes
      lifetime = 24 # hours
      name = "EAP module"
      persist_dir = "${freeradius_tlscache_dir}"
      store {
        Tunnel-Private-Group-Id
      }
    }

    verify { }

    ocsp {
      enable = no
    }
  }

  tls {
    tls = tls-common
  }

  ttls {
    tls = tls-common
    default_eap_type = md5
    copy_request_to_tunnel = no
    use_tunneled_reply = no
    virtual_server = "inner-tunnel"
  }
}