Configure wpa_supplicant.conf to Hidden SSID using WPA2 / PEAP / MS-CHAPv2

Question

Here the specifics, I have also the CA certificate chain installed on the machine

1 - hidden SSID (non-broadcast)

2 - The authentication protocol used is PEAP, which is a username and password protocol.

3 - The username and password are passed between the client and authentication server (RADIUS) over an SSL encrypted session.

4 - 3-tier CA environment.

Root (offline), intermediate (offline), and 2 issuing CA certificates (online)

The actual SSL certificates on the authentication servers (RADIUS) will come from on of the 2 issuing CAs. That enables a trusted SSL session to be established to pass the username and password.

5 - MS-CHAPv2 Support

My wpa_suplicant.conf file:

ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=wheel
ap_scan=1    # This is to make sure that we get the hidden SSID
update_config=1

network={
  priority=1
  mode=0
  scan_ssid=1                   
  ssid="FILTERED"
  proto=RSN                # WPA2/IEEE 802.11i
  key_mgmt=WPA-EAP         # WPA using EAP authentication
  eap=PEAP                     
  group=CCMP TKIP          # CCMP AES in Counter mode with CBC-MAC
  pairwise=CCMP TKIP       # TKIP = Temporal Key Integrity Protocol
  #phase1="peaplabel=1"
  phase2="auth=MSCHAPV2"
  identity="FILTERED"      # Identity string for EAP
  password="FILTERED"
  ca_cert="/etc/cert/CACertChain/CA1CertChain.pem"
}

How can I determine what failed?

bssid=34:XX:XX:XX:XX:02
ssid=FILTERED
id=0
pairwise_cipher=CCMP
group_cipher=TKIP
key_mgmt=WPA2/IEEE 802.1X/EAP
wpa_state=ASSOCIATED
ip_address=0.0.0.0
Supplicant PAE state=AUTHENTICATING
suppPortStatus=Unauthorized
EAP state=IDLE
> status  
bssid=34:XX:XX:XX:XX:02
ssid=pmwproc
id=0
pairwise_cipher=CCMP
group_cipher=TKIP
key_mgmt=WPA2/IEEE 802.1X/EAP
wpa_state=ASSOCIATED
ip_address=0.0.0.0
Supplicant PAE state=CONNECTING
suppPortStatus=Unauthorized
EAP state=IDLE
> status
bssid=34:XX:XX:XX:XX:02
ssid=FILTERED
id=0
pairwise_cipher=CCMP
group_cipher=TKIP
key_mgmt=WPA2/IEEE 802.1X/EAP
wpa_state=ASSOCIATED
ip_address=0.0.0.0
Supplicant PAE state=CONNECTING
suppPortStatus=Unauthorized
EAP state=IDLE
> <2>CTRL-EVENT-EAP-FAILURE EAP authentication failed
<1>Setting authentication timeout: 2 sec 0 usec
<2>Authentication with 34:XX:XX:XX:XX:02 timed out.
<1>Setting scan request: 0 sec 0 usec
<2>CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys

Answer 1

I know thats not 'the Anwser', and also a bit late - But its to large for a comment. Maybe it helps...

My Configuration was not wrong, it just took to long to connect and caused a timeout, setting explicit values speeded it up and the autentication was finished in time. Try to do so with eapol_flags and eap, try disabling eap_workaround or fast_reauth.

Here is how i made it with my AP:

First, temporary enabled broadcast and connected, then status looked like this:

# wpa_cli status
Selected interface 'wlanN'
bssid=XX:XX:XX:XX:XX:XX
ssid=MYHIDDENAP
id=0
mode=station
pairwise_cipher=CCMP
group_cipher=CCMP
key_mgmt=WPA2-PSK
wpa_state=COMPLETED
ip_address=NNN.NNN.NNN.NNN
address=XX:XX:XX:XX:XX:XX

Disabled broadcast and adapted the configuration based on that values, in my case:

# /etc/network/interfaces
auto wlanN
iface wlanN inet dhcp
        wpa-ssid MYHIDDENAP
        wpa-psk af20956209c382340d48ee1a34826c9da80734512e96b7b546d7d1d64f36ee3a
        wpa-pairwise CCMP
        wpa-group CCMP
        wpa-key-mgmt WPA-PSK
        # with this values i had to play, see 'man wpa_supplicant.conf'
        wpa-ap-scan 1
        wpa-scan-ssid 1
        wpa-proto RSN