From ab028b5250071b7c47a036a037c9e91ddc1fcdd9 Mon Sep 17 00:00:00 2001
From: cruelsmith <92088441+cruelsmith@users.noreply.github.com>
Date: Tue, 9 Sep 2025 17:13:51 +0200
Subject: [PATCH 1/2] Add option to remove mschapv2 inside eap config

---
 manifests/module/eap.pp |  1 +
 templates/eap.erb       | 16 +++++++++++-----
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/manifests/module/eap.pp b/manifests/module/eap.pp
index 71e435f9..1d9c95af 100644
--- a/manifests/module/eap.pp
+++ b/manifests/module/eap.pp
@@ -74,6 +74,7 @@
   Boolean $eap_leap                                                 = true,
   Boolean $eap_gtc                                                  = true,
   Boolean $eap_peap                                                 = true,
+  Boolean $eap_mschapv2                                             = true,
 ) {
   freeradius::module { $name:
     ensure  => $ensure,
diff --git a/templates/eap.erb b/templates/eap.erb
index cfa45367..f729c43a 100644
--- a/templates/eap.erb
+++ b/templates/eap.erb
@@ -1032,7 +1032,7 @@ eap {
 	#  of MS-CHAPv2 in EAP by Cisco, which FreeRADIUS does not
 	#  currently support.
 	#
-	mschapv2 {
+#	mschapv2 {
 		#  Prior to version 2.1.11, the module never
 		#  sent the MS-CHAP-Error message to the
 		#  client.  This worked, but it had issues
@@ -1050,9 +1050,7 @@ eap {
 		#  working.
 		#
 	#	send_error = no
-<%- if @mschapv2_send_error -%>
-		send_error = <%= @mschapv2_send_error %>
-<%- end -%>
+
 
 		#  Server identifier to send back in the challenge.
 		#  This should generally be the host name of the
@@ -1060,11 +1058,19 @@ eap {
 		#  identify it.
 		#
 	#	identity = "FreeRADIUS"
+
+#	}
+<%- if @eap_mschapv2 -%>
+	mschapv2 {
+<%- if @mschapv2_send_error -%>
+		send_error = <%= @mschapv2_send_error %>
+<%- end -%>
+
 <%- if @mschapv2_identity -%>
 		identity = "<%= @mschapv2_identity %>"
 <%- end -%>
 	}
-
+<%- end -%>
 
 	#  EAP-FAST
 	#

From 6f87b745952c0628e653730c485ece907e9e435a Mon Sep 17 00:00:00 2001
From: cruelsmith <92088441+cruelsmith@users.noreply.github.com>
Date: Tue, 9 Sep 2025 17:16:07 +0200
Subject: [PATCH 2/2] Remove disable_tlsv1* from eap config if tls_min_version
 or tls_max_version are used

* Fixes warning / deprecation message about disable_tlsv1* config keys
---
 templates/eap.erb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/templates/eap.erb b/templates/eap.erb
index f729c43a..41dad422 100644
--- a/templates/eap.erb
+++ b/templates/eap.erb
@@ -461,10 +461,12 @@ eap {
 		#  tls_max_version.
 		#
 	#	disable_tlsv1_2 = no
+<%- unless @tls_min_version or @tls_max_version -%>
 		disable_tlsv1_1 = yes
 		disable_tlsv1 = yes
 <%- if @tls_disable_tlsv1_2 -%>
 		disable_tlsv1_2 = <%= @tls_disable_tlsv1_2 %>
+<%- end -%>
 <%- end -%>
 
 		#  Set min / max TLS version.  Mainly for Debian