38 lines
1.6 KiB
Plaintext
38 lines
1.6 KiB
Plaintext
# EAP module, trimmed to EAP-TLS for the fleet bench. Replaces the stock eap mod.
|
|
# EAP-TLS is mutual-cert by definition: the client (TPM cert) is validated against
|
|
# ca_file (= step-ca root); the server presents server.pem so the supplicant can
|
|
# validate it against the SAME root baked into the image as radius-ca.pem. On
|
|
# success FreeRADIUS exports the MSK (MS-MPPE keys) → the authenticator derives
|
|
# the MACsec CAK (MKA). No `users` entry is needed for cert-only auth.
|
|
eap {
|
|
default_eap_type = tls
|
|
timer_expire = 60
|
|
ignore_unknown_eap_types = no
|
|
cisco_accounting_username_bug = no
|
|
max_sessions = ${max_requests}
|
|
|
|
tls-config tls-common {
|
|
certificate_file = /etc/raddb/certs/fleet/server.pem
|
|
private_key_file = /etc/raddb/certs/fleet/server.key
|
|
# private_key_password unset — step-ca issues an unencrypted key here.
|
|
ca_file = /etc/raddb/certs/fleet/ca.pem # step-ca root: validates client (TPM) certs
|
|
dh_file = ${certdir}/dh # shipped by the image's bootstrap
|
|
random_file = /dev/urandom
|
|
|
|
# BENCH-VERIFY: many wired-MACsec supplicants negotiate EAP-TLS 1.2; bump
|
|
# to 1.3 once confirmed working. Keep min>=1.2.
|
|
tls_min_version = "1.2"
|
|
tls_max_version = "1.2"
|
|
cipher_list = "DEFAULT"
|
|
cipher_server_preference = no
|
|
ecdh_curve = ""
|
|
|
|
# OCSP/CRL against step-ca for revocation can be enabled here later
|
|
# (ocsp { enable = yes ... }) — bench accepts any cert signed by the root.
|
|
}
|
|
|
|
tls {
|
|
tls = tls-common
|
|
}
|
|
}
|