Clean up loopback / inaddr_any checks

[freeradius.git] / raddb / eap.conf

diff --git a/raddb/eap.conf b/raddb/eap.conf
index faaf8d8..4e769ee 100644 (file)
--- a/raddb/eap.conf
+++ b/raddb/eap.conf
@@ -225,7 +225,7 @@
                        #  3) uncomment the line below.
                        #  5) Restart radiusd
                #       check_crl = yes
-               #       CA_path = /path/to/directory/with/ca_certs/and/crls/
+                       CA_path = ${cadir}
 
                       #
                       #  If check_cert_issuer is set, the value will
@@ -267,6 +267,25 @@
                        #  Session resumption / fast reauthentication
                        #  cache.
                        #
+                       #  The cache contains the following information:
+                       #
+                       #  session Id - unique identifier, managed by SSL
+                       #  User-Name  - from the Access-Accept
+                       #  Stripped-User-Name - from the Access-Request
+                       #  Cached-Session-Policy - from the Access-Accept
+                       #
+                       #  The "Cached-Session-Policy" is the name of a
+                       #  policy which should be applied to the cached
+                       #  session.  This policy can be used to assign
+                       #  VLANs, IP addresses, etc.  It serves as a useful
+                       #  way to re-apply the policy from the original
+                       #  Access-Accept to the subsequent Access-Accept
+                       #  for the cached session.
+                       #
+                       #  On session resumption, these attributes are
+                       #  copied from the cache, and placed into the
+                       #  reply list.
+                       #
                        cache {
                              #
                              #  Enable it.  The default is "no".
@@ -301,6 +320,44 @@
                              #
                              max_entries = 255
                        }
+
+                       #
+                       #  As of version 2.1.10, client certificates can be
+                       #  validated via an external command.  This allows
+                       #  dynamic CRLs or OCSP to be used.
+                       #
+                       #  This configuration is commented out in the
+                       #  default configuration.  Uncomment it, and configure
+                       #  the correct paths below to enable it.
+                       #
+                       verify {
+                               #  A temporary directory where the client
+                               #  certificates are stored.  This directory
+                               #  MUST be owned by the UID of the server,
+                               #  and MUST not be accessible by any other
+                               #  users.  When the server starts, it will do
+                               #  "chmod go-rwx" on the directory, for
+                               #  security reasons.  The directory MUST
+                               #  exist when the server starts.
+                               #
+                               #  You should also delete all of the files
+                               #  in the directory when the server starts.
+               #               tmpdir = /tmp/radiusd
+
+                               #  The command used to verify the client cert.
+                               #  We recommend using the OpenSSL command-line
+                               #  tool.
+                               #
+                               #  The ${..CA_path} text is a reference to
+                               #  the CA_path variable defined above.
+                               #
+                               #  The %{TLS-Client-Cert-Filename} is the name
+                               #  of the temporary file containing the cert
+                               #  in PEM format.  This file is automatically
+                               #  deleted by the server when the command
+                               #  returns.
+               #               client = "/path/to/openssl verify -CApath ${..CA_path} %{TLS-Client-Cert-Filename}"
+                       }
                }
 
                #  The TTLS module implements the EAP-TTLS protocol,
@@ -404,6 +461,12 @@
                #
                #       http://support.microsoft.com/kb/885453/en-us
                #
+               #
+               #  If is still doesn't work, and you're using Samba,
+               #  you may be encountering a Samba bug.  See:
+               #
+               #       https://bugzilla.samba.org/show_bug.cgi?id=6563
+               #
                #  Note that we do not necessarily agree with their
                #  explanation... but the fix does appear to work.
                #