###################################################################### # # RADIUS over TLS # ###################################################################### server radsec { listen { transport = tls type = Access-Request type = Accounting-Request tls { ipaddr = $ENV{FREERADIUS_SITES_TLS_LISTEN} port = $ENV{FREERADIUS_SITES_TLS_PORT} # Connection limiting for sockets with "proto = tcp". # limit { # Limit the number of simultaneous TCP connections to the socket # # The default is 16. # Setting this to 0 means "no limit" max_connections = 16 # The per-socket "max_requests" option does not exist. # The lifetime, in seconds, of a TCP connection. After this lifetime, the connection will be closed. # # Setting this to 0 means "forever". lifetime = 0 # The idle timeout, in seconds, of a TCP connection. # If no packets have been received over the connection for this time, the connection will be closed. # Setting this to 0 means "no timeout". # # We STRONGLY RECOMMEND that you set an idle timeout. idle_timeout = 30 } private_key_password = $ENV{FREERADIUS_SITES_TLS_PRIVKEY_PASSWORD} private_key_file = $ENV{FREERADIUS_SITES_TLS_PRIVKEY_FILE} # If Private key & Certificate are located in the same file, then private_key_file & # certificate_file must contain the same file name. # # If ca_file (below) is not used, then the certificate_file below MUST include not only the server certificate, but ALSO all # of the CA certificates used to sign the server certificate. certificate_file = $ENV{FREERADIUS_SITES_TLS_CERTIFICATE_FILE} # Trusted Root CA list # # ALL of the CA's in this list will be trusted to issue client certificates for authentication. # # In general, you should use self-signed certificates for 802.1x (EAP) authentication. # In that case, this CA file should contain *one* CA certificate. # # This parameter is used only for EAP-TLS, when you issue client certificates. If you do not use client certificates, and you do not want # to permit EAP-TLS authentication, then delete this configuration item. ca_file = $ENV{FREERADIUS_SITES_TLS_CA_FILE} # # For DH cipher suites to work, you have to run OpenSSL to create the DH file first: # # openssl dhparam -out certs/dh 1024 dh_file = ${certdir}/dh # # If your system doesn't have /dev/urandom, you will need to create this file, and periodically change its contents. # For security reasons, FreeRADIUS doesn't write to files in its configuration directory. # random_file = /dev/urandom # # The default fragment size is 1K. However, it's possible to send much more data than that over a TCP connection. The upper limit is 64K. # Setting the fragment size to more than 1K means that there are fewer round trips when setting up a TLS connection. But only if the certificates are large. fragment_size = 8192 # include_length is a flag which is by default set to yes If set to yes, Total Length of the message is # included in EVERY packet we send. # If set to no, Total Length of the message is included ONLY in the First packet of a fragment series. # include_length = yes # Check the Certificate Revocation List # # 1) Copy CA certificates and CRLs to same directory. # 2) Execute 'c_rehash '. # 'c_rehash' is OpenSSL's command. # 3) uncomment the line below. # 5) Restart radiusd # check_crl = yes ca_path = ${cadir} # Accept an expired Certificate Revocation List # # allow_expired_crl = no # Accept a not-yet-valid Certificate Revocation List # # allow_not_yet_valid_crl = no # # If check_cert_issuer is set, the value will # be checked against the DN of the issuer in # the client certificate. If the values do not # match, the certificate verification will fail, # rejecting the user. # # This check can be done more generally by checking # the value of the TLS-Client-Cert-Issuer attribute. # This check can be done via any mechanism you choose. # # check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd" # # If check_cert_cn is set, the value will # be xlat'ed and checked against the CN # in the client certificate. If the values # do not match, the certificate verification # will fail rejecting the user. # # This check is done only if the previous # "check_cert_issuer" is not set, or if # the check succeeds. # # This check can be done more generally by checking # the value of the TLS-Client-Cert-Common-Name attribute. # This check can be done via any mechanism you choose. # # check_cert_cn = %{User-Name} # # Set this option to specify the allowed # TLS cipher suites. The format is listed # in "man 1 ciphers". cipher_list = "DEFAULT" # If enabled, OpenSSL will use server cipher list # (possibly defined by cipher_list option above) # for choosing right cipher suite rather than # using client-specified list which is OpenSSl default # behavior. Having it set to 'yes' is best practice # for TLS. cipher_server_preference = yes # # Session resumption / fast reauthentication # cache. # # The cache contains the following information: # # session Id - unique identifier, managed by SSL # User-Name - from the Access-Accept # Stripped-User-Name - from the Access-Request # Cached-Session-Policy - from the Access-Accept # # The "Cached-Session-Policy" is the name of a # policy which should be applied to the cached # session. This policy can be used to assign # VLANs, IP addresses, etc. It serves as a useful # way to re-apply the policy from the original # Access-Accept to the subsequent Access-Accept # for the cached session. # # On session resumption, these attributes are # copied from the cache, and placed into the # reply list. # # You probably also want "use_tunneled_reply = yes" # when using fast session resumption. # cache { # # Lifetime of the cached entries, in hours. # The sessions will be deleted after this # time. # lifetime = 24 # hours # # Internal "name" of the session cache. # Used to distinguish which TLS context # sessions belong to. # # The server will generate a random value # if unset. This will change across server # restart so you MUST set the "name" if you # want to persist sessions (see below). # # If you use IPv6, change the "ipaddr" below # to "ipv6addr" # #name = "TLS ${..ipaddr} ${..port} ${..proto}" # # Simple directory-based storage of sessions. # Two files per session will be written, the SSL # state and the cached VPs. This will persist session # across server restarts. # # The server will need write perms, and the directory # should be secured from anyone else. You might want # a script to remove old files from here periodically: # # find ${logdir}/tlscache -mtime +2 -exec rm -f {} \; # # This feature REQUIRES "name" option be set above. # #persist_dir = "${logdir}/tlscache" } # Require a client certificate. # require_client_cert = yes # # As of version 2.1.10, client certificates can be validated via an external command. This allows dynamic CRLs or OCSP to be used. # # This configuration is commented out in the default configuration. Uncomment it, and configure the correct paths below to enable it. # verify { # A temporary directory where the client certificates are stored. This directory MUST be owned by the UID of the server, # and MUST not be accessible by any other users. When the server starts, it will do "chmod go-rwx" on the directory, for # security reasons. The directory MUST exist when the server starts. # # You should also delete all of the files in the directory when the server starts. tmpdir = /startechnica/freeradius/tmp # The command used to verify the client cert. We recommend using the OpenSSL command-line tool. # # The ${..ca_path} text is a reference to the ca_path variable defined above. # # The %{TLS-Client-Cert-Filename} is the name of the temporary file containing the cert in PEM format. This file is automatically # deleted by the server when the command returns. # client = "/path/to/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}" } } } recv Access-Request { ok } recv Accounting-Request { ok } }