encrypt_key = no in FreeRADIUS snake oil certs
Hi, Question to you FR gents (Arran and Alan)... would you object if we popped in a request to set encrypt_key = no in the three CNF files? If there are objections... any reason why? :-) Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net Janet, the UK’s research and education network. Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238
For a default system we should have best security possible (the eap.conf/eap module has the same default passphrase) If people really don't want passwords then they can strip/remove them (like people do with Apache) alan
Thanks! Thought there was a reason. I'll feed that back :-) Stefan ________________________________ From: Alan Buxey [A.L.M.Buxey@lboro.ac.uk] Sent: 08 October 2014 19:49 To: FreeRadius users mailing list; Stefan Paetow Subject: Re: encrypt_key = no in FreeRADIUS snake oil certs For a default system we should have best security possible (the eap.conf/eap module has the same default passphrase) If people really don't want passwords then they can strip/remove them (like people do with Apache) alan Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238
Stefan Paetow wrote:
Hi,
Question to you FR gents (Arran and Alan)... would you object if we popped in a request to set encrypt_key = no in the three CNF files? If there are objections... any reason why? :-)
I'd leave the defaults as secure. Well, "secure" in that the password is on the same file system as the certificate. Alan DeKok.
participants (3)
-
Alan Buxey -
Alan DeKok -
Stefan Paetow