3

I am trying to connect to this WPA2 Enterprise network but it is not working. I am able to connect with my android (on my mobile I put certificate as Do not validate) phone but not with the computer, using same credentials. I am using Debian 9 with Network Manager 1.4.2. My Android phone recognize the network as [WPA-EAP-CCMP][WPA2-EAP-CCMP+TKIP][ESS]. This is the configuration I am using on my debian laptop:

[connection]
id=myid
uuid=uid generated by the system
type=wifi
permissions=
secondaries=

[wifi]
mac-address-blacklist=
mac-address-randomization=0
mode=infrastructure
seen-bssids=
ssid=network-ssd

[wifi-security]
group=
key-mgmt=wpa-eap
pairwise=
proto=

[802-1x]
altsubject-matches=
anonymous-identity=username (same that is working on android)
eap=peap;
identity=username
password=password (same that is working on android)
phase2-altsubject-matches=
phase2-auth=mschapv2

[ipv4]
dns-search=
method=auto

[ipv6]
addr-gen-mode=stable-privacy
dns-search=
ip6-privacy=0
method=auto

This is the error I gen in syslog:

Nov  2 17:51:56 debian wpa_supplicant[847]: wlan0: CTRL-EVENT-EAP-STARTED EAP authentication started
Nov  2 17:51:56 debian NetworkManager[20347]: <info>  [1478105516.3576] device (wlan0): supplicant interface state: associating -> associated
Nov  2 17:51:56 debian wpa_supplicant[847]: wlan0: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=25
Nov  2 17:51:56 debian wpa_supplicant[847]: wlan0: CTRL-EVENT-EAP-METHOD EAP vendor 0 method 25 (PEAP) selected
Nov  2 17:51:56 debian wpa_supplicant[847]: wlan0: CTRL-EVENT-EAP-FAILURE EAP authentication failed

cat /usr/share/dbus-1/system-service/fi.epitest.hostap.WPASupplicant.service output:

[D-BUS Service]
Name=fi.epitest.hostap.WPASupplicant
Exec=/sbin/wpa_supplicant -u -s -O /run/wpa_supplicant
User=root
SystemdService=wpa_supplicant.service

UPDATE: I have tried also TTLS instead of PEAP but nothing, in this case the only meaningful log I get is

Nov  3 11:04:47 debian wpa_supplicant[1219]: wlan0: SME: Trying to authenticate with 6c:XX:XX:XX:XX:XX (SSID='my-ssid' freq=2437 MHz)
Nov  3 11:04:47 debian kernel: [ 5587.074393] wlan0: authenticate with 6c:XX:XX:XX:XX:XX
Nov  3 11:04:47 debian kernel: [ 5587.090537] wlan0: send auth to 6c:XX:XX:XX:XX:XX (try 1/3)
Nov  3 11:04:47 debian kernel: [ 5587.093252] wlan0: authenticated
Nov  3 11:04:47 debian NetworkManager[570]: <info>  [1478167487.1252] device (wlan0): supplicant interface state: scanning -> authenticating
Nov  3 11:04:52 debian kernel: [ 5592.093412] wlan0: aborting authentication with 6c:XX:XX:XX:XX:XX by local choice (Reason: 3=DEAUTH_LEAVING)
Nov  3 11:04:52 debian NetworkManager[570]: <info>  [1478167492.1457] device (wlan0): supplicant interface state: authenticating -> disconnected

UPDATE 2: since Network Manager is installed, there is no wpa_supplicant.conf file configuration.

Any ideas?

4
  • Welcome to U&L can you add the output of cat /usr/share/dbus-1/system-services/fi.epitest.hostap.WPASupplicant.service
    – GAD3R
    Commented Nov 2, 2016 at 17:29
  • 1
    Are you sure it is PEAP, and not EAP-TTLS-MSCHAPv2? Commented Nov 2, 2016 at 19:36
  • Can you add the configuration file of wpa_supplicant.conf ?
    – GAD3R
    Commented Nov 3, 2016 at 10:30
  • you should register one of your accounts and have them merged
    – Jeff Schaller
    Commented Nov 3, 2016 at 11:01

1 Answer 1

1

I had exaclty the same issue as you, and after a long time looking for an answer, I found it here.

EDIT (advice taken): in short, after some upgrade to wpa_supplicant package, it began using TLS 1.2 protocol, and some old servers don't support it yet, the solution is still not applicable to NetworkManager (there is no current way of passing the required option to wpa_supplicant), but it is directly possible with the wpa_supplicant conf file, as this one:

network={
ssid="BGU-WPA"
key_mgmt=WPA-EAP
eap=PEAP
identity="my_username"
password="my_password"
phase1="peaplabel=auto tls_disable_tlsv1_2=1"
phase2="auth=MSCHAPV2"
}
1
  • 2
    A link to a potential solution is always welcome, but please add context around the link so your fellow users will have some idea what it is and why it’s there. Always quote the most relevant part of an important link, in case the target site is unreachable or goes permanently offline. Take into account that being barely more than a link to an external site is a possible reason as to Why and how are some answers deleted?.
    – zuazo
    Commented Dec 12, 2016 at 2:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .