FreeRADIUS InkBridge

EAP/Inner Module

The eap_inner module provides a sample configuration for an EAP module that occurs inside of a tunneled method. It is used to limit the EAP types that can occur inside of the inner tunnel.

See also sites-available/inner-tunnel

See the eap module for full documentation on the meaning of these configuration entries.

Configuration Settings

eap inner-eap { …​ }
default_eap_type

Set the correct method from the table below.

The inner method can be negotiated, but it’s more efficient to offer the correct one the first time.

EAP Types Description Key

PEAP

username/password

mschapv2

TTLS

username/password

gtc, mschapv2

PEAP

certificate

tls

TTLS

certificate

tls
type

Only EAP types listed below with a 'type = <EAP-Type>' pair will be allowed.

EAP-MD5

md5 is OK to use the inner tunnel, as keying material is provided by the outer EAP method.

EAP-GTC

See the eap module for common configuration explanation.

EAP-MSCHAPv2

See the eap module for common configuration explanation.

EAP-PSK

See the eap module for common configuration explanation.

To enable EAP-PSK, enable the "eap-psk" virtual server, then uncomment this section and the "type = psk" entry above.

EAP-PWD (Secure password-based authentication)

See the eap module for common configuration explanation.

No TTLS or PEAP configuration should be listed here.

tls-config tls-peer { …​ }

auto_chain

See the eap module for common configuration explanation.

chain { …​ }

See the eap module for common configuration explanation.

ca_file

See the eap module for common configuration explanation.

dh_file

See mods-available/eap

random_file

See the eap module for common configuration explanation.

fragment_size

See the eap module for common configuration explanation.

ca_path

See the eap module for common configuration explanation.

check_cert_issuer

See the eap module for common configuration explanation.

check_cert_cn

See the eap module for common configuration explanation.

EAP-TLS

We RECOMMEND using different certificates for the inner and outer EAP configuration!

You can create the inner-server.pem file by doing:

cd confdir/certs vi inner-server.cnf make inner-server

The inner certificate MUST be different from the server.cnf file.

Default Configuration

eap inner-eap {
	default_eap_type = mschapv2
	type = md5
	type = gtc
	type = mschapv2
#	type = psk
	type = pwd
	type = tls
	md5 {
	}
	gtc {
#		challenge = "Password: "
		auth_type = PAP
	}
	mschapv2 {
#		send_error = no
	}
##	psk {
##		virtual_server = eap-psk
##	}
	pwd {
		group = 19
		server_id = theserver@example.com
		fragment_size = 1020
	}
	tls-config tls-peer {
#		auto_chain = yes
		chain {
			certificate_file = ${certdir}/rsa/server.pem
			ca_file = ${certdir}/rsa/ca.pem
			private_key_password = whatever
			private_key_file = ${certdir}/rsa/server.key
		}
		ca_file = ${cadir}/rsa/ca.pem
#		dh_file = ${certdir}/dh
#		random_file = /dev/urandom
		fragment_size = 16384
		ca_path = ${cadir}
#		check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd"
#		check_cert_cn = %{User-Name}
	}
	tls {
		tls = tls-peer
		require_client_cert = yes
	}
}