FreeRadius EAP-TLS configuration - Revision history

Wlarro: 'openssl dhparam' can only accept the bit-length argument after all options

2024-03-25T22:54:00Z

'openssl dhparam' can only accept the bit-length argument after all options

← Older revision		Revision as of 22:54, 25 March 2024
Line 87:		Line 87:

	= Create the Diffie-Hellman nonce file =		= Create the Diffie-Hellman nonce file =
	{{cmd\|openssl dhparam -check -text -5 ~~1024~~ -out /etc/raddb/certs/dh}}		{{cmd\|openssl dhparam -check -text -5 -out /etc/raddb/certs/dh 1024}}

	Or you can use a larger one, eg (this can take a while if you're unlucky!).		Or you can use a larger one, eg (this can take a while if you're unlucky!).

	{{cmd\|openssl dhparam -check -text -5 ~~4096~~ -out /etc/raddb/certs/dh}}		{{cmd\|openssl dhparam -check -text -5 -out /etc/raddb/certs/dh 4096}}

	= Server config =		= Server config =

Zcrayfish: Fixed broken link.

2023-09-03T05:55:20Z

Fixed broken link.

← Older revision		Revision as of 05:55, 3 September 2023
Line 95:		Line 95:
	= Server config =		= Server config =

	The [https://www.wi-fi.org/~~download.php?file=/sites/default~~/files/~~private/WPA3_Specification_v3~~.0.pdf WPA3 specification] (p12), has a few changes to EAP. Even if you're not using WPA3 it still effects your EAP RADIUS authentication, particularly for clients such as Android 11+. Further discussion was [https://reddit.com/comments/l4fdzp here].		The [https://www.wi-fi.org/system/files/WPA3%20Specification%20v3.1.pdf WPA3 specification] (p12), has a few changes to EAP. Even if you're not using WPA3 it still effects your EAP RADIUS authentication, particularly for clients such as Android 11+. Further discussion was [https://reddit.com/comments/l4fdzp here].

	{{Box\|WPA 3.1 Page 12\|		{{Box\|WPA 3.1 Page 12\|

Zcrayfish: /* References */ Remove irrelevant reference: Support for Android 4.4.4 ended in 2017.

2023-08-30T22:34:40Z

References: Remove irrelevant reference: Support for Android 4.4.4 ended in 2017.

← Older revision		Revision as of 22:34, 30 August 2023
Line 334:		Line 334:
	= References =		= References =
	* https://forums.freebsd.org/threads/howto-wpa2-enterprise-with-freeradius.28467		* https://forums.freebsd.org/threads/howto-wpa2-enterprise-with-freeradius.28467
	* https://samhobbs.co.uk/2013/12/remove-network-may-be-monitored-by-an-unknown-third-party-in-android-4-4-kitkat {{dead link}}

	[[Category:Server]]		[[Category:Server]]

Sertonix: use https

2023-08-25T21:26:36Z

use https

← Older revision		Revision as of 21:26, 25 August 2023
Line 1:		Line 1:
	= Introduction =		= Introduction =
	A more secure way than using pre-shared keys (WPA2) is to use [https://en.wikipedia.org/wiki/Extensible_Authentication_Protocol#EAP-TLS EAP-TLS] and use separate certificates for each device. In the previous tutorial [[Linux Router with VPN on a Raspberry Pi]] I mentioned I'd be doing this with a		A more secure way than using pre-shared keys (WPA2) is to use [https://en.wikipedia.org/wiki/Extensible_Authentication_Protocol#EAP-TLS EAP-TLS] and use separate certificates for each device. In the previous tutorial [[Linux Router with VPN on a Raspberry Pi]] I mentioned I'd be doing this with a
	([~~http~~://wiki.openwrt.org/toh/ubiquiti/unifi Ubiquiti UniFi AP]). I have tested this with two phones running CyanogenMod 11 (Android 4.4.4).		([https://wiki.openwrt.org/toh/ubiquiti/unifi Ubiquiti UniFi AP]). I have tested this with two phones running CyanogenMod 11 (Android 4.4.4).

	= Installation =		= Installation =

Zcrayfish: Marked some dead links.

2023-08-25T02:41:42Z

Marked some dead links.

← Older revision		Revision as of 02:41, 25 August 2023
Line 334:		Line 334:
	= References =		= References =
	* https://forums.freebsd.org/threads/howto-wpa2-enterprise-with-freeradius.28467		* https://forums.freebsd.org/threads/howto-wpa2-enterprise-with-freeradius.28467
	* https://samhobbs.co.uk/2013/12/remove-network-may-be-monitored-by-an-unknown-third-party-in-android-4-4-kitkat		* https://samhobbs.co.uk/2013/12/remove-network-may-be-monitored-by-an-unknown-third-party-in-android-4-4-kitkat {{dead link}}

	[[Category:Server]]		[[Category:Server]]

Dngray: Mention domain_suffix_match as a part of WPA3

2021-06-14T11:36:07Z

Mention domain_suffix_match as a part of WPA3

← Older revision		Revision as of 11:36, 14 June 2021
Line 92:		Line 92:

	{{cmd\|openssl dhparam -check -text -5 4096 -out /etc/raddb/certs/dh}}		{{cmd\|openssl dhparam -check -text -5 4096 -out /etc/raddb/certs/dh}}

			= Server config =

			The [https://www.wi-fi.org/download.php?file=/sites/default/files/private/WPA3_Specification_v3.0.pdf WPA3 specification] (p12), has a few changes to EAP. Even if you're not using WPA3 it still effects your EAP RADIUS authentication, particularly for clients such as Android 11+. Further discussion was [https://reddit.com/comments/l4fdzp here].

			{{Box\|WPA 3.1 Page 12\|

			5.1.2 The STA is configured with EAP credentials that explicitly specify a CA root certificate that matches the root certificate in the received Server Certificate message and, if the EAP credentials also include a domain name
			(FQDN or suffix-only), it matches the domain name (SubjectAltName dNSName if present, otherwise SubjectName CN) of the certificate [2] in the received Server Certificate message.

			5.1.3 The STA is configured with EAP credentials that include a domain name (FQDN or suffix-only) that matches the domain name (SubjectAltName dNSName if present, otherwise SubjectName CN) of the certificate [2] in the received Server Certificate message, and the root certificate of that certificate is present in the STA's trust root store.}}

			Without these changes you'll see errors in logcat like:

			<pre>EAP: Status notification: remote certificate verification (param=self signed certificate in certificate chain)
			SSL: SSL3 alert: write (local SSL3 detected an error):fatal:unknown CA
			EAP: Status notification: local TLS alert (param=unknown CA)</pre>

			== /etc/raddb/server.cnf ==
			<pre>[ v3_req ]
			basicConstraints = CA:FALSE
			keyUsage = nonRepudiation, digitalSignature, keyEncipherment
			subjectAltName = @alt_names

			# This should be a host name of the RADIUS server.
			# Note that the host name is exchanged in EAP before
			# the user machine has network access. So the host name
			# here doesn't really have to match anything in DNS.
			+ [alt_names]
			+ DNS.1 = radius.example.com
			+
			+ # NAIRealm from RFC 7585
			+ otherName.0 = 1.3.6.1.5.5.7.8.8;FORMAT:UTF8,UTF8:*.example.com</pre>

			Then you'd need to put "radius.example.com" in the "Domain" box when you add the WiFi Network. It's also known as "domain_suffix_match" in wpa_supplicant.conf or NetworkManager configuration files.

			== /etc/raddb/certs/xpextensions ==

			Then you need to update xpextensions before making your configs.

			<pre>+ [ xpserver_ext]
			+ extendedKeyUsage = 1.3.6.1.5.5.7.3.1
			+ crlDistributionPoints = URI:http://www.example.com/example_ca.crl

			+ subjectAltName = @alt_names

			and then at the bottom:

			+ [alt_names]
			+ DNS.1 = radius.example.com

			+ # NAIRealm from RFC 7585
			+ otherName.0 = 1.3.6.1.5.5.7.8.8;FORMAT:UTF8,UTF8:*.example.com</pre>

	= Configuration =		= Configuration =

Sillysausage: /* Certificates */ Fixed broken link

2018-05-30T13:18:14Z

Certificates: Fixed broken link

← Older revision		Revision as of 13:18, 30 May 2018
Line 11:		Line 11:
	You will want to create your certificates. The easiest way to do that is to use the scripts provided by FreeRadius. The scripts allow you to easily create a CA (certificate authority), Server certificate, and Client certificates. Remember to increase the expiry time from 60 days if that doesn't suit you and fill in the other information in the .cnf files like the README says.		You will want to create your certificates. The easiest way to do that is to use the scripts provided by FreeRadius. The scripts allow you to easily create a CA (certificate authority), Server certificate, and Client certificates. Remember to increase the expiry time from 60 days if that doesn't suit you and fill in the other information in the .cnf files like the README says.

	The readme for that script is in /etc/raddb/certs/README or can be found [https://github.com/FreeRADIUS/freeradius-server/~~blob~~/~~master~~/raddb/certs~~/README~~ here].		The readme for that script is in /etc/raddb/certs/README or can be found [https://github.com/FreeRADIUS/freeradius-server/tree/v3.0.x/raddb/certs here].

	= Certificate Revocation List =		= Certificate Revocation List =

John3-16: Categorized: Server

2017-09-19T21:42:48Z

Categorized: Server

← Older revision		Revision as of 21:42, 19 September 2017
Line 282:		Line 282:
	* https://forums.freebsd.org/threads/howto-wpa2-enterprise-with-freeradius.28467		* https://forums.freebsd.org/threads/howto-wpa2-enterprise-with-freeradius.28467
	* https://samhobbs.co.uk/2013/12/remove-network-may-be-monitored-by-an-unknown-third-party-in-android-4-4-kitkat		* https://samhobbs.co.uk/2013/12/remove-network-may-be-monitored-by-an-unknown-third-party-in-android-4-4-kitkat

			[[Category:Server]]

Sillysausage: /* Installation */

2015-11-20T13:14:35Z

Installation

← Older revision		Revision as of 13:14, 20 November 2015
Line 5:		Line 5:
	= Installation =		= Installation =

	Install ~~freeradius and haveged. You'll need haveged to increase randomness of /dev/random [[Entropy and randomness]]. When [http~~:~~//bugs.alpinelinux.org/issues/3465 feature 3465] is resolved if you have a Raspberry Pi you could use it's own hardware random number generator (bcm2708-rng).~~		Install FreeRadius:
			{{cmd\|apk add freeradius freeradius-eap}}
	{{cmd\|apk add freeradius freeradius-eap ~~haveged}}~~

	~~Haveged requires no configuration:~~
	~~{{cmd\|service haveged start}}~~
	~~{{cmd\|rc-update add haveged default~~}}

	= Certificates =		= Certificates =

Sillysausage: /* IPtables rules */

2015-08-15T13:56:27Z

IPtables rules

← Older revision		Revision as of 13:56, 15 August 2015
Line 223:		Line 223:

	= IPtables rules =		= IPtables rules =
	Next up you're going to want some iptables rules. ~~Using the rules from the previous tutorial add them somewhere near the top:~~		Next up you're going to want some iptables rules.

	<pre>#Accept incoming connections from client FreeRadius		<pre>#Accept incoming connections from client FreeRadius