Thanks! I didn't actually know about the eapol_test utility. I'll get that and see what I get. Oddly enough, when searching the PacketFence archives, none of my searches popped up a reference to that tool. Oh well, at least now I have something more definitive to search for. =)
Thanks, Joshua Nathan Level 3 IT Support and Development Black Forest Academy +49 (0) 7626-9161-630 On Thu, Apr 7, 2016 at 4:05 PM, Louis Munro <[email protected]> wrote: > Didn’t quite finish that post… > > Regardless of which EAP method you use, I can’t recommend eapol_test > enough. > It will allow to test your configuration in a reproducible manner and > eliminate the supplicant and OS from the equation. > > Google around for instructions regarding building eapol_test. > The first hit will probably be good enough. > The archives will also provide numerous time where I explained it. > (hint: on RedHat and derivatives the two build dependencies are > libnl-devel and openssl-devel). > > Once you have a successful eapol_test authentication going, then it’s time > to start testing with an actual device to find out how to configure it. > > Experience has shown me that testing with hardware before the > configuration is shown to be valid is only a recipe for more frustration. > > Regards, > -- > Louis Munro > [email protected] :: www.inverse.ca > +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 > Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence ( > www.packetfence.org) > > On Apr 7, 2016, at 9:56 , Louis Munro <[email protected]> wrote: > > Hi Nathan, > > Let’s take this one step at a time. > > Both PEAP and EAP-TLS are configured through > /usr/local/pf/radiusd/eap.conf. > Please paste that file for our perusal. > > Essentially, when using either the server certificate must be valid. > Which means that the supplicant must be able to validate the chain of > trust all the way up to a known trusted root. > So if your server certificate was signed by an intermdiate cert (itself > signed by a trusted root CA) you will need to provide the supplicant with > both the server cert and the intermediate so that the chain is complete. > The usual way to do that is to concatenate both the server and > intermediate certificate in the same file to which you then point > FreeRADIUS (as it’s server cert file). > > > Regards, > -- > Louis Munro > [email protected] :: www.inverse.ca > +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 > Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence ( > www.packetfence.org) > > On Apr 7, 2016, at 6:57 , Nathan, Josh <[email protected]> wrote: > > Has anyone else come across this, or is it time for a rebuild? > > It makes me wonder if something similar is happening even with the TLS > connection because Windows won't connect even if I turn off Server > Certificate Validation. When I tell the Windows Provisioner that it's a > PEAP connection, the CA install fails. All of this is on PacketFence > 5.5.2, sitting on CentOS 6.7. > > I can actually just tell my Android to connect to the WPA2-Enterprise > network, and it'll hash out the PEAP without trouble even if I don't use a > provisioner. I'll confess I've only tried with a provisioner on iOS, but > it works... I just am presented somehow with the default RADIUS certificate > with all the bogus information (country: FR, locality: Somewhere, CA: > Example Certificate Authority, etc). > > Thanks, > Joshua Nathan > Level 3 IT Support and Development > Black Forest Academy > +49 (0) 7626-9161-630 > > > On Wed, Apr 6, 2016 at 4:21 PM, Nathan, Josh <[email protected]> > wrote: > >> OK, so I've been having no luck with getting EAP-TLS to work properly >> with my Windows computers, but I'm interested in testing PEAP. However, I >> can see from my iPad that RADIUS *always* hands out its own self-made CA >> cert for PEAP. I've even removed the entire raddb/certs directory, >> restarted radius, and it still somehow pulls out its own cert. I have the >> certs I made with the PacketFence PKI setup in the eap.conf file, but I'm >> guessing they're not applying because they're contained within the tls >> block. I tried copying down the line for the CA file into the peap block, >> but it didn't make a difference. Is this tree even with barking down? How >> do I direct the cert to be used when PEAP is in use? >> >> Thanks, >> Joshua Nathan >> Level 3 IT Support and Development >> Black Forest Academy >> +49 (0) 7626-9161-630 >> >> > > ------------------------------------------------------------------------------ > _______________________________________________ > PacketFence-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/packetfence-users > > > > ------------------------------------------------------------------------------ > _______________________________________________ > PacketFence-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/packetfence-users > > > > > ------------------------------------------------------------------------------ > > _______________________________________________ > PacketFence-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/packetfence-users > >
------------------------------------------------------------------------------
_______________________________________________ PacketFence-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/packetfence-users
