2

Was looking for PEAP tutorials for raspbian but didn't found any solution so far.

In our manual for the LAN-connection to our network are following steps:

  1. Activate IEEE 802.1X-authentification
  2. Set Userauthentification as authentification-mode
  3. Uncheck the option to check the identity of the server through Certificate
  4. Select EAP-MSCHAP-V2 as authentification-method
  5. Proceed and enter credentials: domainxxx\usernamexxx passwordxxx

How can I reproduce these steps for raspbian?

Edit (efforts so far):

etc/wpa_supplicant/wpa_supplicant.conf:

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
update_config=1

network={
       key_mgmt=IEEE8021X
       eap=PEAP
       identity="domainxxx\usernamexxx"
       password="passwordxxx"
       phase1="peaplabel=0"
       phase2="auth=MSCHAPV2"
}

edited the line "iface eth0 inet manual" from /etc/network/interfaces to:

iface eth0 inet dhcp

Currently following error:

    `eth0: CTRL-EVENT-EAP-STARTED EAP authentication started
eth0: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=25
eth0: CTRL-EVENT-EAP-METHOD EAP vendor 0 method 25 (PEAP) selected
eth0: CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/DC=de/DC=MyDcxxxx/DC=domainxxx/CN=CNxxx'
eth0: CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/DC=de/DC=MyDcxxxx/DC=domainxxx/CN=CNxxx'
eth0: CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/DC=de/DC=MyDcxxxx/DC=domainxxx/CN=CNxxx'
SSL: SSL3 alert: write (local SSL3 detected an error):fatal:decrypt error
OpenSSL: openssl_handshake - SSL_connect error:04091068:rsa routines:INT_RSA_VERIFY:bad signature
OpenSSL: pending error: error:1408D07B:SSL routines:SSL3_GET_KEY_EXCHANGE:bad signature
eth0: CTRL-EVENT-EAP-FAILURE EAP authentication failed`

Distro is Raspbian. OpenSSL version is 1.0.1t 3 May 2016

  • 1
    Please document what have you tried so far with wpa-supplicant; this group is more geared to helping people with specific doubts than writing full tutorials. – Rui F Ribeiro Mar 20 '17 at 18:53
  • I'm sorry, I assumed my efforts were meaningless due to just incomprehension. I edited my question. – RumelDilDumpel Mar 20 '17 at 19:10
  • The ssl error could either be an old wpa_supplicant version, or a weak protocolo in the actual certificate....oddly enough wap_supplicant is supposed to ignore the certificate if you do not configure the certificate bits. – Rui F Ribeiro Mar 21 '17 at 18:12
2

As you are using MSCHAPv2 auth, you need the hash of the password, and not the actual password.

So, a password in cleartext as you have it now

password="passwordxx"

won't work.

Try

$echo -n passwordxx | iconv -t utf16le | openssl md4
cb21bd8890caee216f87cfb8d3248fe9

And then replace in etc/wpa_supplicant/wpa_supplicant.conf the password line with the hash obtained running the last command.

Example derivated from passwordxx:

password=hash:cb21bd8890caee216f87cfb8d3248fe9

Depending on the central RADIUS server configuration, you might also need to add an anonymous_identity, I would also add it for starters identical to the directive identity.

anonymous_identity="domainxxx\usernamexxx""

I also think key_mgmt is key_mgmt=WPA-EAP (a bit unsure about this point, test it out)

As in:

network={
   key_mgmt=WPA-EAP
   eap=PEAP
   identity="domainxxx\usernamexxx"
   anonymous_identity="domainxxx\usernamexxx"
   password=hash:cb21bd8890caee216f87cfb8d3248fe9
   phase1="peaplabel=0"
   phase2="auth=MSCHAPV2"
}

If all else fails, and it does not authenticate, I do recommend talking with your local network administrator to check up the local details.

  • Thanks for your recommendation. But it's not a Wi-fi connection. I followed your steps and the error SSL: SSL3 alert: ddecrypt error appears. – RumelDilDumpel Mar 21 '17 at 11:31
  • 2
    My fault, it if not an wifi connection, you do not need SSID. In which step do you have SSL3 alerts? Any errors in var/log/wpa_supplicant.log? – Rui F Ribeiro Mar 21 '17 at 11:38
  • 1
    Please also add to your question dristo name and version, and the output of openssl version. – Rui F Ribeiro Mar 21 '17 at 11:46
  • Edited the question with the whole error. – RumelDilDumpel Mar 21 '17 at 11:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.