Didn’t quite finish that post… Regardless of which EAP method you use, I can’t recommend eapol_test enough. It will allow to test your configuration in a reproducible manner and eliminate the supplicant and OS from the equation.
Google around for instructions regarding building eapol_test. The first hit will probably be good enough. The archives will also provide numerous time where I explained it. (hint: on RedHat and derivatives the two build dependencies are libnl-devel and openssl-devel). Once you have a successful eapol_test authentication going, then it’s time to start testing with an actual device to find out how to configure it. Experience has shown me that testing with hardware before the configuration is shown to be valid is only a recipe for more frustration. Regards, -- Louis Munro [email protected] :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org) > On Apr 7, 2016, at 9:56 , Louis Munro <[email protected]> wrote: > > Hi Nathan, > > Let’s take this one step at a time. > > Both PEAP and EAP-TLS are configured through /usr/local/pf/radiusd/eap.conf. > Please paste that file for our perusal. > > Essentially, when using either the server certificate must be valid. > Which means that the supplicant must be able to validate the chain of trust > all the way up to a known trusted root. > So if your server certificate was signed by an intermdiate cert (itself > signed by a trusted root CA) you will need to provide the supplicant with > both the server cert and the intermediate so that the chain is complete. > The usual way to do that is to concatenate both the server and intermediate > certificate in the same file to which you then point FreeRADIUS (as it’s > server cert file). > > > Regards, > -- > Louis Munro > [email protected] <mailto:[email protected]> :: www.inverse.ca > <http://www.inverse.ca/> > +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 > Inverse inc. :: Leaders behind SOGo (www.sogo.nu <http://www.sogo.nu/>) and > PacketFence (www.packetfence.org <http://www.packetfence.org/>) > >> On Apr 7, 2016, at 6:57 , Nathan, Josh <[email protected] >> <mailto:[email protected]>> wrote: >> >> Has anyone else come across this, or is it time for a rebuild? >> >> It makes me wonder if something similar is happening even with the TLS >> connection because Windows won't connect even if I turn off Server >> Certificate Validation. When I tell the Windows Provisioner that it's a >> PEAP connection, the CA install fails. All of this is on PacketFence 5.5.2, >> sitting on CentOS 6.7. >> >> I can actually just tell my Android to connect to the WPA2-Enterprise >> network, and it'll hash out the PEAP without trouble even if I don't use a >> provisioner. I'll confess I've only tried with a provisioner on iOS, but it >> works... I just am presented somehow with the default RADIUS certificate >> with all the bogus information (country: FR, locality: Somewhere, CA: >> Example Certificate Authority, etc). >> >> Thanks, >> Joshua Nathan >> Level 3 IT Support and Development >> Black Forest Academy >> +49 (0) 7626-9161-630 >> >> >> On Wed, Apr 6, 2016 at 4:21 PM, Nathan, Josh <[email protected] >> <mailto:[email protected]>> wrote: >> OK, so I've been having no luck with getting EAP-TLS to work properly with >> my Windows computers, but I'm interested in testing PEAP. However, I can >> see from my iPad that RADIUS always hands out its own self-made CA cert for >> PEAP. I've even removed the entire raddb/certs directory, restarted radius, >> and it still somehow pulls out its own cert. I have the certs I made with >> the PacketFence PKI setup in the eap.conf file, but I'm guessing they're not >> applying because they're contained within the tls block. I tried copying >> down the line for the CA file into the peap block, but it didn't make a >> difference. Is this tree even with barking down? How do I direct the cert >> to be used when PEAP is in use? >> >> Thanks, >> Joshua Nathan >> Level 3 IT Support and Development >> Black Forest Academy >> +49 (0) 7626-9161-630 <tel:%2B49%20%280%29%207626-9161-630> >> >> >> ------------------------------------------------------------------------------ >> _______________________________________________ >> PacketFence-users mailing list >> [email protected] >> <mailto:[email protected]> >> https://lists.sourceforge.net/lists/listinfo/packetfence-users > > ------------------------------------------------------------------------------ > _______________________________________________ > PacketFence-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/packetfence-users
------------------------------------------------------------------------------
_______________________________________________ PacketFence-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/packetfence-users
