OUR SITES NetworkRADIUS FreeRADIUS

ABFAB listening on TLS

If you need to provide the abfab-tr-idp with SSL support, enable it.

Example configuration

listen { …​ }

tls { …​ }

Moonshot tends to distribute certs separate from keys.

clients { …​ }

Reference to the next clients {…​} section.

This client stanza will match other RP proxies from other realms established via the trustrouter. In general additional client stanzas are also required for local services.

An example local service.
ipaddr
gss_acceptor_host_name

You should either set gss_acceptor_host_name below or set up policy to confirm that a client claims the right acceptor hostname when using ABFAB.

If set, the RADIUS server will confirm that all requests have this value for the acceptor host name.

gss_acceptor_realm_name

Foreign realms will typically reject a request if this is not properly set.

trust_router_coi

Override the default_community in the realm module.

In production deployments it is important to set up certificate verification so that even if clients spoof IP addresses, one client cannot impersonate another.

Default Configuration

listen {
	ipaddr = *
	port = 2083
	type = auth
	proto = tcp
	tls {
		chain {
			certificate_file = ${certdir}/server.pem
			private_key_file = ${certdir}/server.key
			private_key_password = whatever
		}
		ca_file = ${cadir}/ca.pem
		dh_file = ${certdir}/dh
		fragment_size = 8192
		ca_path = ${cadir}
		cipher_list = "DEFAULT"
		cache {
			enable = no
			lifetime = 24 # hours
			max_entries = 255
		}
		require_client_cert = yes
		verify {
		}
		psk_query = %psksql("select hex(key) from psk_keys where keyid = '%{TLS-PSK-Identity}'")
	}
	virtual_server = abfab-idp
	clients = radsec-abfab
}
clients radsec-abfab {
	client default {
		ipaddr = 0.0.0.0/0
		proto = tls
	}
	client service_1 {
#		ipaddr = 192.0.2.20
#		gss_acceptor_host_name = "server.example.com"
#		gss_acceptor_realm_name = "example.com"
#		trust_router_coi =  "community1.example.net"
	}
}