blob: 5db0d1fa12c8d6b4355cac3d71f7e55f390b5f86 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
|
eap {
default_eap_type = ttls
timer_expire = 60
ignore_unknown_eap_types = yes
cisco_accounting_username_bug = no
max_sessions = ${max_requests}
tls-config tls-common {
private_key_password =
private_key_file = {{ freeradius_certificate_key_path }}
certificate_file = {{ freeradius_certificate_path }}
ca_file = {{ freeradius_certificate_ca_path }}
auto_chain = no
ca_path = ${cadir}
cipher_list = "PROFILE=SYSTEM"
cipher_server_preference = no
tls_min_version = "1.2"
tls_max_version = "1.2"
ecdh_curve = "prime256v1"
cache {
enable = yes
lifetime = 24 # hours
name = "EAP module"
persist_dir = "${db_dir}/tlscache"
store {
Tunnel-Private-Group-Id
}
}
verify {
skip_if_ocsp_ok = yes
tmpdir = /var/run/radiusd/tmp
client = "/usr/bin/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}"
}
ocsp {
enable = yes
override_cert_url = no
}
}
tls {
tls = tls-common
}
ttls {
tls = tls-common
default_eap_type = md5
copy_request_to_tunnel = no
use_tunneled_reply = no
virtual_server = "inner-tunnel"
}
}
|
