Adding dot1x support

2026-06-22 20:50:48 +00:00
parent 1f62e5ab17
commit dea7ca451a
13 changed files with 592 additions and 0 deletions
@@ -0,0 +1,9 @@
+# RADIUS clients = the authenticator(s) (hostapd). The `secret` MUST match each
+# hostapd's auth_server_shared_secret (RADIUS_SECRET in .env). Scope ipaddr to
+# the serving VLAN the authenticator's uplink sits on.
+client authenticator {
+    ipaddr  = 192.168.50.0/24
+    secret  = testing123
+    nas_type = other
+    require_message_authenticator = yes
+}
@@ -0,0 +1,37 @@
+# EAP module, trimmed to EAP-TLS for the fleet bench. Replaces the stock eap mod.
+# EAP-TLS is mutual-cert by definition: the client (TPM cert) is validated against
+# ca_file (= step-ca root); the server presents server.pem so the supplicant can
+# validate it against the SAME root baked into the image as radius-ca.pem. On
+# success FreeRADIUS exports the MSK (MS-MPPE keys) → the authenticator derives
+# the MACsec CAK (MKA). No `users` entry is needed for cert-only auth.
+eap {
+    default_eap_type = tls
+    timer_expire     = 60
+    ignore_unknown_eap_types = no
+    cisco_accounting_username_bug = no
+    max_sessions = ${max_requests}
+
+    tls-config tls-common {
+        certificate_file = /etc/raddb/certs/fleet/server.pem
+        private_key_file = /etc/raddb/certs/fleet/server.key
+        # private_key_password unset — step-ca issues an unencrypted key here.
+        ca_file = /etc/raddb/certs/fleet/ca.pem      # step-ca root: validates client (TPM) certs
+        dh_file = ${certdir}/dh                       # shipped by the image's bootstrap
+        random_file = /dev/urandom
+
+        # BENCH-VERIFY: many wired-MACsec supplicants negotiate EAP-TLS 1.2; bump
+        # to 1.3 once confirmed working. Keep min>=1.2.
+        tls_min_version = "1.2"
+        tls_max_version = "1.2"
+        cipher_list = "DEFAULT"
+        cipher_server_preference = no
+        ecdh_curve = ""
+
+        # OCSP/CRL against step-ca for revocation can be enabled here later
+        # (ocsp { enable = yes ... }) — bench accepts any cert signed by the root.
+    }
+
+    tls {
+        tls = tls-common
+    }
+}