I want to set up FreeRADIUS using EAP-TLS only. I'm running Ubuntu Server 12.04.2 LTS here with the packaged build of FreeRADIUS from the default Ubuntu/Debian apt-get package repository. I'm finding junk scattered all over the place for configuring this thing (typical), so my first objective is to get FreeRADIUS into a locked-down state so that 'freeradius -X' doesn't return things that bother me (i.e. pared back to minimal functionality first). Since I only want EAP-TLS, output lines like the following bother me (I've inlined my concerns): FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu, built on Sep 24 2012 at 17:58:57 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... ... including configuration file /etc/freeradius/modules/pam ... including configuration file /etc/freeradius/modules/chap ... ^^^^^^^ Does FreeRADIUS really need to load all of those config files to function? That is, does it hurt in any way to load all of the module config files? From what I can tell, they don't seem to be relevant until they are instantiated later on, but I would appreciate confirmation. radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } ^^^^^ What does this do? I don't think I need a proxy server. My setup is just a consumer router plus a single Ubuntu box with FreeRADIUS on it. home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } ^^^^^ All of this seems to be in proxy.conf. It doesn't look like I need any of it but I'm not sure if it is safe to get rid of it/comment it out. Again, this will be the only RADIUS server in the network and my understanding is that proxies are for forwarding requests to other RADIUS servers. Given my setup, can I safely comment out the '$INCLUDE proxy.conf' line in 'radiusd.conf'? radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } ^^^^^ Not sure why I would need this either. Based on the 'secret' string's value, I'm wagering it has to do with the 'proxy.conf' settings, but I'm not 100% confident about that. radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } ^^^^^^ Most of that seems irrelevant to EAP-TLS. A certificate isn't exactly a password - it can expire, but the message "Password Has Expired" seems like it will never appear (or, if it does, it'll be confusing to a user). I'm probably not going to use the 'logintime' features. 'exec' might be useful since I probably will use the external 'openssl' based 'verify' method in 'eap.conf' (unless someone can suggest a better approach). radiusd: #### Loading Virtual Servers #### ... ^^^^^^ Even when 'default' was the only thing in 'sites-enabled', it loaded a bunch of stuff other than EAP-TLS. I currently have nothing in 'sites-enabled' right now, but would like insight into what the configuration file should be to just do EAP-TLS. radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. ^^^^^^ Again, I don't think I need a proxy and I'm not sure what the 'accounting' port is for. My policy is that "fewer open ports is better". So do I really want/need all of this? A few additional questions of where I'm currently a bit stuck: What do I need to do to set up FreeRADIUS so that it only supports EAP-TLS? Some of the stuff in 'eap.conf' is confusing. I've commented out 'md5', 'leap', 'mschapv2', etc. with only the 'tls' section left uncommented and set 'default_eap_type = tls', but I'm not sure if that is all I need to do. Documentation on setting up an "EAP-TLS only" RADIUS server is limited. What is the best method of setting it up so that only the router can communicate with the RADIUS server on port 1812? Sorry for the long post. -- Thomas Hruska CubicleSoft President I've got great, time saving software that you might find useful. http://cubiclesoft.com/