3

I am trying to connect to this WPA2 Enterprise network but it is not working. I am able to connect with my android (on my mobile I put certificate as Do not validate) phone but not with the computer, using same credentials. I am using Debian 9 with Network Manager 1.4.2. My Android phone recognize the network as [WPA-EAP-CCMP][WPA2-EAP-CCMP+TKIP][ESS]. This is the configuration I am using on my debian laptop:

[connection]
id=myid
uuid=uid generated by the system
type=wifi
permissions=
secondaries=

[wifi]
mac-address-blacklist=
mac-address-randomization=0
mode=infrastructure
seen-bssids=
ssid=network-ssd

[wifi-security]
group=
key-mgmt=wpa-eap
pairwise=
proto=

[802-1x]
altsubject-matches=
anonymous-identity=username (same that is working on android)
eap=peap;
identity=username
password=password (same that is working on android)
phase2-altsubject-matches=
phase2-auth=mschapv2

[ipv4]
dns-search=
method=auto

[ipv6]
addr-gen-mode=stable-privacy
dns-search=
ip6-privacy=0
method=auto

This is the error I gen in syslog:

Nov  2 17:51:56 debian wpa_supplicant[847]: wlan0: CTRL-EVENT-EAP-STARTED EAP authentication started
Nov  2 17:51:56 debian NetworkManager[20347]: <info>  [1478105516.3576] device (wlan0): supplicant interface state: associating -> associated
Nov  2 17:51:56 debian wpa_supplicant[847]: wlan0: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=25
Nov  2 17:51:56 debian wpa_supplicant[847]: wlan0: CTRL-EVENT-EAP-METHOD EAP vendor 0 method 25 (PEAP) selected
Nov  2 17:51:56 debian wpa_supplicant[847]: wlan0: CTRL-EVENT-EAP-FAILURE EAP authentication failed

cat /usr/share/dbus-1/system-service/fi.epitest.hostap.WPASupplicant.service output:

[D-BUS Service]
Name=fi.epitest.hostap.WPASupplicant
Exec=/sbin/wpa_supplicant -u -s -O /run/wpa_supplicant
User=root
SystemdService=wpa_supplicant.service

UPDATE: I have tried also TTLS instead of PEAP but nothing, in this case the only meaningful log I get is

Nov  3 11:04:47 debian wpa_supplicant[1219]: wlan0: SME: Trying to authenticate with 6c:XX:XX:XX:XX:XX (SSID='my-ssid' freq=2437 MHz)
Nov  3 11:04:47 debian kernel: [ 5587.074393] wlan0: authenticate with 6c:XX:XX:XX:XX:XX
Nov  3 11:04:47 debian kernel: [ 5587.090537] wlan0: send auth to 6c:XX:XX:XX:XX:XX (try 1/3)
Nov  3 11:04:47 debian kernel: [ 5587.093252] wlan0: authenticated
Nov  3 11:04:47 debian NetworkManager[570]: <info>  [1478167487.1252] device (wlan0): supplicant interface state: scanning -> authenticating
Nov  3 11:04:52 debian kernel: [ 5592.093412] wlan0: aborting authentication with 6c:XX:XX:XX:XX:XX by local choice (Reason: 3=DEAUTH_LEAVING)
Nov  3 11:04:52 debian NetworkManager[570]: <info>  [1478167492.1457] device (wlan0): supplicant interface state: authenticating -> disconnected

UPDATE 2: since Network Manager is installed, there is no wpa_supplicant.conf file configuration.

Any ideas?

  • Welcome to U&L can you add the output of cat /usr/share/dbus-1/system-services/fi.epitest.hostap.WPASupplicant.service – GAD3R Nov 2 '16 at 17:29
  • 1
    Are you sure it is PEAP, and not EAP-TTLS-MSCHAPv2? – Rui F Ribeiro Nov 2 '16 at 19:36
  • Can you add the configuration file of wpa_supplicant.conf ? – GAD3R Nov 3 '16 at 10:30
  • you should register one of your accounts and have them merged – Jeff Schaller Nov 3 '16 at 11:01
1

I had exaclty the same issue as you, and after a long time looking for an answer, I found it here: https://ask.fedoraproject.org/en/question/79093/fedora-23-enterprise-wifi-network-connection-issue/https://ask.fedoraproject.org/en/question/79093/fedora-23-enterprise-wifi-network-connection-issue

EDIT (advice taken): in short, after some upgrade to wpa_supplicant package, it began using TLS 1.2 protocol, and some old servers don't support it yet, the solution is still not applicable to NetworkManager (there is no current way of passing the required option to wpa_supplicant), but it is directly possible with the wpa_supplicant conf file, as this one:

network={

ssid="BGU-WPA"

key_mgmt=WPA-EAP

eap=PEAP

identity="my_username"

password="my_password"

phase1="peaplabel=auto tls_disable_tlsv1_2=1"

phase2="auth=MSCHAPV2"

}

  • 1
    A link to a potential solution is always welcome, but please add context around the link so your fellow users will have some idea what it is and why it’s there. Always quote the most relevant part of an important link, in case the target site is unreachable or goes permanently offline. Take into account that being barely more than a link to an external site is a possible reason as to Why and how are some answers deleted?. – zuazo Dec 12 '16 at 2:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.