2

Here the specifics, I have also the CA certificate chain installed on the machine

1 - hidden SSID (non-broadcast)

2 - The authentication protocol used is PEAP, which is a username and password protocol.

3 - The username and password are passed between the client and authentication server (RADIUS) over an SSL encrypted session.

4 - 3-tier CA environment.

Root (offline), intermediate (offline), and 2 issuing CA certificates (online)

The actual SSL certificates on the authentication servers (RADIUS) will come from on of the 2 issuing CAs. That enables a trusted SSL session to be established to pass the username and password.

5 - MS-CHAPv2 Support

My wpa_suplicant.conf file:

ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=wheel
ap_scan=1    # This is to make sure that we get the hidden SSID
update_config=1

network={
  priority=1
  mode=0
  scan_ssid=1                   
  ssid="FILTERED"
  proto=RSN                # WPA2/IEEE 802.11i
  key_mgmt=WPA-EAP         # WPA using EAP authentication
  eap=PEAP                     
  group=CCMP TKIP          # CCMP AES in Counter mode with CBC-MAC
  pairwise=CCMP TKIP       # TKIP = Temporal Key Integrity Protocol
  #phase1="peaplabel=1"
  phase2="auth=MSCHAPV2"
  identity="FILTERED"      # Identity string for EAP
  password="FILTERED"
  ca_cert="/etc/cert/CACertChain/CA1CertChain.pem"
}

How can I determine what failed?

bssid=34:XX:XX:XX:XX:02
ssid=FILTERED
id=0
pairwise_cipher=CCMP
group_cipher=TKIP
key_mgmt=WPA2/IEEE 802.1X/EAP
wpa_state=ASSOCIATED
ip_address=0.0.0.0
Supplicant PAE state=AUTHENTICATING
suppPortStatus=Unauthorized
EAP state=IDLE
> status  
bssid=34:XX:XX:XX:XX:02
ssid=pmwproc
id=0
pairwise_cipher=CCMP
group_cipher=TKIP
key_mgmt=WPA2/IEEE 802.1X/EAP
wpa_state=ASSOCIATED
ip_address=0.0.0.0
Supplicant PAE state=CONNECTING
suppPortStatus=Unauthorized
EAP state=IDLE
> status
bssid=34:XX:XX:XX:XX:02
ssid=FILTERED
id=0
pairwise_cipher=CCMP
group_cipher=TKIP
key_mgmt=WPA2/IEEE 802.1X/EAP
wpa_state=ASSOCIATED
ip_address=0.0.0.0
Supplicant PAE state=CONNECTING
suppPortStatus=Unauthorized
EAP state=IDLE
> <2>CTRL-EVENT-EAP-FAILURE EAP authentication failed
<1>Setting authentication timeout: 2 sec 0 usec
<2>Authentication with 34:XX:XX:XX:XX:02 timed out.
<1>Setting scan request: 0 sec 0 usec
<2>CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys
3

I know thats not 'the Anwser', and also a bit late - But its to large for a comment. Maybe it helps...

My Configuration was not wrong, it just took to long to connect and caused a timeout, setting explicit values speeded it up and the autentication was finished in time. Try to do so with eapol_flags and eap, try disabling eap_workaround or fast_reauth.

Here is how i made it with my AP:

First, temporary enabled broadcast and connected, then status looked like this:

# wpa_cli status
Selected interface 'wlanN'
bssid=XX:XX:XX:XX:XX:XX
ssid=MYHIDDENAP
id=0
mode=station
pairwise_cipher=CCMP
group_cipher=CCMP
key_mgmt=WPA2-PSK
wpa_state=COMPLETED
ip_address=NNN.NNN.NNN.NNN
address=XX:XX:XX:XX:XX:XX

Disabled broadcast and adapted the configuration based on that values, in my case:

# /etc/network/interfaces
auto wlanN
iface wlanN inet dhcp
        wpa-ssid MYHIDDENAP
        wpa-psk af20956209c382340d48ee1a34826c9da80734512e96b7b546d7d1d64f36ee3a
        wpa-pairwise CCMP
        wpa-group CCMP
        wpa-key-mgmt WPA-PSK
        # with this values i had to play, see 'man wpa_supplicant.conf'
        wpa-ap-scan 1
        wpa-scan-ssid 1
        wpa-proto RSN

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.