3

Was looking for PEAP tutorials for raspbian but didn't found any solution so far.

In our manual for the LAN-connection to our network are following steps:

  1. Activate IEEE 802.1X-authentification
  2. Set Userauthentification as authentification-mode
  3. Uncheck the option to check the identity of the server through Certificate
  4. Select EAP-MSCHAP-V2 as authentification-method
  5. Proceed and enter credentials: domainxxx\usernamexxx passwordxxx

How can I reproduce these steps for raspbian?

Edit (efforts so far):

etc/wpa_supplicant/wpa_supplicant.conf:

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
update_config=1

network={
       key_mgmt=IEEE8021X
       eap=PEAP
       identity="domainxxx\usernamexxx"
       password="passwordxxx"
       phase1="peaplabel=0"
       phase2="auth=MSCHAPV2"
}

edited the line "iface eth0 inet manual" from /etc/network/interfaces to:

iface eth0 inet dhcp

Currently following error:

    `eth0: CTRL-EVENT-EAP-STARTED EAP authentication started
eth0: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=25
eth0: CTRL-EVENT-EAP-METHOD EAP vendor 0 method 25 (PEAP) selected
eth0: CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/DC=de/DC=MyDcxxxx/DC=domainxxx/CN=CNxxx'
eth0: CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/DC=de/DC=MyDcxxxx/DC=domainxxx/CN=CNxxx'
eth0: CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/DC=de/DC=MyDcxxxx/DC=domainxxx/CN=CNxxx'
SSL: SSL3 alert: write (local SSL3 detected an error):fatal:decrypt error
OpenSSL: openssl_handshake - SSL_connect error:04091068:rsa routines:INT_RSA_VERIFY:bad signature
OpenSSL: pending error: error:1408D07B:SSL routines:SSL3_GET_KEY_EXCHANGE:bad signature
eth0: CTRL-EVENT-EAP-FAILURE EAP authentication failed`

Distro is Raspbian. OpenSSL version is 1.0.1t 3 May 2016

3
  • 1
    Please document what have you tried so far with wpa-supplicant; this group is more geared to helping people with specific doubts than writing full tutorials. Commented Mar 20, 2017 at 18:53
  • I'm sorry, I assumed my efforts were meaningless due to just incomprehension. I edited my question. Commented Mar 20, 2017 at 19:10
  • The ssl error could either be an old wpa_supplicant version, or a weak protocolo in the actual certificate....oddly enough wap_supplicant is supposed to ignore the certificate if you do not configure the certificate bits. Commented Mar 21, 2017 at 18:12

1 Answer 1

3

As you are using MSCHAPv2 auth, you need the hash of the password, and not the actual password.

So, a password in cleartext as you have it now

password="passwordxx"

won't work.

Try

$echo -n passwordxx | iconv -t utf16le | openssl md4
cb21bd8890caee216f87cfb8d3248fe9

And then replace in etc/wpa_supplicant/wpa_supplicant.conf the password line with the hash obtained running the last command.

Example derivated from passwordxx:

password=hash:cb21bd8890caee216f87cfb8d3248fe9

Depending on the central RADIUS server configuration, you might also need to add an anonymous_identity, I would also add it for starters identical to the directive identity.

anonymous_identity="domainxxx\usernamexxx""

I also think key_mgmt is key_mgmt=WPA-EAP (a bit unsure about this point, test it out)

As in:

network={
   key_mgmt=WPA-EAP
   eap=PEAP
   identity="domainxxx\usernamexxx"
   anonymous_identity="domainxxx\usernamexxx"
   password=hash:cb21bd8890caee216f87cfb8d3248fe9
   phase1="peaplabel=0"
   phase2="auth=MSCHAPV2"
}

If all else fails, and it does not authenticate, I do recommend talking with your local network administrator to check up the local details.

4
  • Thanks for your recommendation. But it's not a Wi-fi connection. I followed your steps and the error SSL: SSL3 alert: ddecrypt error appears. Commented Mar 21, 2017 at 11:31
  • 2
    My fault, it if not an wifi connection, you do not need SSID. In which step do you have SSL3 alerts? Any errors in var/log/wpa_supplicant.log? Commented Mar 21, 2017 at 11:38
  • 1
    Please also add to your question dristo name and version, and the output of openssl version. Commented Mar 21, 2017 at 11:46
  • Edited the question with the whole error. Commented Mar 21, 2017 at 11:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .