Initial commit

- update else condition on the line 239 in templates/Deployment
- update  st-common version from 0.1.10 to 0.1.12 on Chart.yaml file
- add gitlab ci/cd pipeline to  package the Helm chart into a .tgz. and Publish it to GitLab’s Helm package registry

archive/tls-master

@@ -0,0 +1,247 @@
+######################################################################
+#
+#  RADIUS over TLS
+#
+######################################################################
+
+server radsec {
+	listen {
+		transport = tls
+
+		type = Access-Request
+		type = Accounting-Request
+
+		tls {
+
+			ipaddr = $ENV{FREERADIUS_SITES_TLS_LISTEN}
+			port = $ENV{FREERADIUS_SITES_TLS_PORT}
+
+			#  Connection limiting for sockets with "proto = tcp".
+			#
+			limit {
+			      #  Limit the number of simultaneous TCP connections to the socket
+			      #
+			      #  The default is 16.
+			      #  Setting this to 0 means "no limit"
+			      max_connections = 16
+
+			      #  The per-socket "max_requests" option does not exist.
+
+			      #  The lifetime, in seconds, of a TCP connection.  After this lifetime, the connection will be closed.
+			      #
+			      #  Setting this to 0 means "forever".
+			      lifetime = 0
+
+			      #  The idle timeout, in seconds, of a TCP connection.
+			      #  If no packets have been received over the connection for this time, the connection will be closed.
+			      #  Setting this to 0 means "no timeout".
+			      #
+			      #  We STRONGLY RECOMMEND that you set an idle timeout.
+			      idle_timeout = 30
+			}
+
+			private_key_password = $ENV{FREERADIUS_SITES_TLS_PRIVKEY_PASSWORD}
+			private_key_file = $ENV{FREERADIUS_SITES_TLS_PRIVKEY_FILE}
+
+			#  If Private key & Certificate are located in the same file, then private_key_file &
+			#  certificate_file must contain the same file  name.
+			#
+			#  If ca_file (below) is not used, then the  certificate_file below MUST include not only the server certificate, but ALSO all
+			#  of the CA certificates used to sign the server certificate.
+			certificate_file = $ENV{FREERADIUS_SITES_TLS_CERTIFICATE_FILE}
+
+			#  Trusted Root CA list
+			#
+			#  ALL of the CA's in this list will be trusted to issue client certificates for authentication.
+			#
+			#  In general, you should use self-signed certificates for 802.1x (EAP) authentication.
+			#  In that case, this CA file should contain *one* CA certificate.
+			#
+			#  This parameter is used only for EAP-TLS, when you issue client certificates.  If you do not use client certificates, and you do not want
+			#  to permit EAP-TLS authentication, then delete this configuration item.
+			ca_file = $ENV{FREERADIUS_SITES_TLS_CA_FILE}
+
+			#
+			#  For DH cipher suites to work, you have to run OpenSSL to create the DH file first:
+			#
+			#  	openssl dhparam -out certs/dh 1024
+			dh_file = ${certdir}/dh
+
+			#
+			#  If your system doesn't have /dev/urandom, you will need to create this file, and periodically change its contents.
+			#  For security reasons, FreeRADIUS doesn't write to files in its configuration directory.
+	#		random_file = /dev/urandom
+
+			#
+			#  The default fragment size is 1K. However, it's possible to send much more data than that over a TCP connection.  The upper limit is 64K.
+			#  Setting the fragment size to more than 1K means that there are fewer round trips when setting up a TLS connection.  But only if the certificates are large.
+			fragment_size = 8192
+
+			#  include_length is a flag which is by default set to yes If set to yes, Total Length of the message is
+			#  included in EVERY packet we send.
+			#  If set to no, Total Length of the message is included ONLY in the First packet of a fragment series.
+		#	include_length = yes
+
+			#  Check the Certificate Revocation List
+			#
+			#  1) Copy CA certificates and CRLs to same directory.
+			#  2) Execute 'c_rehash <CA certs&CRLs Directory>'.
+			#    'c_rehash' is OpenSSL's command.
+			#  3) uncomment the line below.
+			#  5) Restart radiusd
+		#	check_crl = yes
+			ca_path = ${cadir}
+
+			#  Accept an expired Certificate Revocation List
+			#
+		#	allow_expired_crl = no
+
+			#  Accept a not-yet-valid Certificate Revocation List
+			#
+		#	allow_not_yet_valid_crl = no
+
+			#
+			#  If check_cert_issuer is set, the value will
+			#  be checked against the DN of the issuer in
+			#  the client certificate.  If the values do not
+			#  match, the certificate verification will fail,
+			#  rejecting the user.
+			#
+			#  This check can be done more generally by checking
+			#  the value of the TLS-Client-Cert-Issuer attribute.
+			#  This check can be done via any mechanism you choose.
+			#
+		#	check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd"
+
+			#
+			#  If check_cert_cn is set, the value will
+			#  be xlat'ed and checked against the CN
+			#  in the client certificate.  If the values
+			#  do not match, the certificate verification
+			#  will fail rejecting the user.
+			#
+			#  This check is done only if the previous
+			#  "check_cert_issuer" is not set, or if
+			#  the check succeeds.
+			#
+			#  This check can be done more generally by checking
+			#  the value of the TLS-Client-Cert-Common-Name attribute.
+			#  This check can be done via any mechanism you choose.
+			#
+		#	check_cert_cn = %{User-Name}
+		#
+			#  Set this option to specify the allowed
+			#  TLS cipher suites.  The format is listed
+			#  in "man 1 ciphers".
+			cipher_list = "DEFAULT"
+
+			#  If enabled, OpenSSL will use server cipher list
+			#  (possibly defined by cipher_list option above)
+			#  for choosing right cipher suite rather than
+			#  using client-specified list which is OpenSSl default
+			#  behavior. Having it set to 'yes' is best practice
+			#  for TLS.
+			cipher_server_preference = yes
+
+			#
+			#  Session resumption / fast reauthentication
+			#  cache.
+			#
+			#  The cache contains the following information:
+			#
+			#  session Id - unique identifier, managed by SSL
+			#  User-Name  - from the Access-Accept
+			#  Stripped-User-Name - from the Access-Request
+			#  Cached-Session-Policy - from the Access-Accept
+			#
+			#  The "Cached-Session-Policy" is the name of a
+			#  policy which should be applied to the cached
+			#  session.  This policy can be used to assign
+			#  VLANs, IP addresses, etc.  It serves as a useful
+			#  way to re-apply the policy from the original
+			#  Access-Accept to the subsequent Access-Accept
+			#  for the cached session.
+			#
+			#  On session resumption, these attributes are
+			#  copied from the cache, and placed into the
+			#  reply list.
+			#
+			#  You probably also want "use_tunneled_reply = yes"
+			#  when using fast session resumption.
+			#
+			cache {
+			      #
+			      #  Lifetime of the cached entries, in hours.
+			      #  The sessions will be deleted after this
+			      #  time.
+			      #
+			      lifetime = 24 # hours
+
+			      #
+			      #  Internal "name" of the session cache.
+			      #  Used to distinguish which TLS context
+			      #  sessions belong to.
+			      #
+			      #  The server will generate a random value
+			      #  if unset. This will change across server
+			      #  restart so you MUST set the "name" if you
+			      #  want to persist sessions (see below).
+			      #
+			      #  If you use IPv6, change the "ipaddr" below
+			      #  to "ipv6addr"
+			      #
+			      #name = "TLS ${..ipaddr} ${..port} ${..proto}"
+
+			      #
+			      #  Simple directory-based storage of sessions.
+			      #  Two files per session will be written, the SSL
+			      #  state and the cached VPs. This will persist session
+			      #  across server restarts.
+			      #
+			      #  The server will need write perms, and the directory
+			      #  should be secured from anyone else. You might want
+			      #  a script to remove old files from here periodically:
+			      #
+			      #    find ${logdir}/tlscache -mtime +2 -exec rm -f {} \;
+			      #
+			      #  This feature REQUIRES "name" option be set above.
+			      #
+			      #persist_dir = "${logdir}/tlscache"
+			}
+
+			#  Require a client certificate.
+			#
+			require_client_cert = yes
+
+			#
+			#  As of version 2.1.10, client certificates can be validated via an external command.  This allows dynamic CRLs or OCSP to be used.
+			#
+			#  This configuration is commented out in the default configuration.  Uncomment it, and configure the correct paths below to enable it.
+			#
+			verify {
+				#  A temporary directory where the client certificates are stored.  This directory MUST be owned by the UID of the server,
+				#  and MUST not be accessible by any other users.  When the server starts, it will do "chmod go-rwx" on the directory, for
+				#  security reasons. The directory MUST exist when the server starts.
+				#
+				#  You should also delete all of the files in the directory when the server starts.
+				tmpdir = /startechnica/freeradius/tmp
+
+				#  The command used to verify the client cert. We recommend using the OpenSSL command-line tool.
+				#
+				#  The ${..ca_path} text is a reference to the ca_path variable defined above.
+				#
+				#  The %{TLS-Client-Cert-Filename} is the name of the temporary file containing the cert in PEM format.  This file is automatically
+				#  deleted by the server when the command returns.
+		#    	client = "/path/to/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}"
+			}
+		}
+	}
+
+	recv Access-Request {
+		ok
+	}
+
+	recv Accounting-Request {
+		ok
+	}
+}