from Windows 802.1X connection instructions to linux

Question

Was looking for PEAP tutorials for raspbian but didn't found any solution so far.

In our manual for the LAN-connection to our network are following steps:

1. Activate IEEE 802.1X-authentification
2. Set Userauthentification as authentification-mode
3. Uncheck the option to check the identity of the server through Certificate
4. Select EAP-MSCHAP-V2 as authentification-method
5. Proceed and enter credentials: domainxxx\usernamexxx passwordxxx

How can I reproduce these steps for raspbian?

Edit (efforts so far):

etc/wpa_supplicant/wpa_supplicant.conf:

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
update_config=1

network={
       key_mgmt=IEEE8021X
       eap=PEAP
       identity="domainxxx\usernamexxx"
       password="passwordxxx"
       phase1="peaplabel=0"
       phase2="auth=MSCHAPV2"
}

edited the line "iface eth0 inet manual" from /etc/network/interfaces to:

iface eth0 inet dhcp

Currently following error:

    `eth0: CTRL-EVENT-EAP-STARTED EAP authentication started
eth0: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=25
eth0: CTRL-EVENT-EAP-METHOD EAP vendor 0 method 25 (PEAP) selected
eth0: CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/DC=de/DC=MyDcxxxx/DC=domainxxx/CN=CNxxx'
eth0: CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/DC=de/DC=MyDcxxxx/DC=domainxxx/CN=CNxxx'
eth0: CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/DC=de/DC=MyDcxxxx/DC=domainxxx/CN=CNxxx'
SSL: SSL3 alert: write (local SSL3 detected an error):fatal:decrypt error
OpenSSL: openssl_handshake - SSL_connect error:04091068:rsa routines:INT_RSA_VERIFY:bad signature
OpenSSL: pending error: error:1408D07B:SSL routines:SSL3_GET_KEY_EXCHANGE:bad signature
eth0: CTRL-EVENT-EAP-FAILURE EAP authentication failed`

Distro is Raspbian. OpenSSL version is 1.0.1t 3 May 2016

Answer 1

As you are using MSCHAPv2 auth, you need the hash of the password, and not the actual password.

So, a password in cleartext as you have it now

password="passwordxx"

won't work.

Try

$echo -n passwordxx | iconv -t utf16le | openssl md4
cb21bd8890caee216f87cfb8d3248fe9

And then replace in etc/wpa_supplicant/wpa_supplicant.conf the password line with the hash obtained running the last command.

Example derivated from passwordxx:

password=hash:cb21bd8890caee216f87cfb8d3248fe9

Depending on the central RADIUS server configuration, you might also need to add an anonymous_identity, I would also add it for starters identical to the directive identity.

anonymous_identity="domainxxx\usernamexxx""

I also think key_mgmt is key_mgmt=WPA-EAP (a bit unsure about this point, test it out)

As in:

network={
   key_mgmt=WPA-EAP
   eap=PEAP
   identity="domainxxx\usernamexxx"
   anonymous_identity="domainxxx\usernamexxx"
   password=hash:cb21bd8890caee216f87cfb8d3248fe9
   phase1="peaplabel=0"
   phase2="auth=MSCHAPV2"
}

If all else fails, and it does not authenticate, I do recommend talking with your local network administrator to check up the local details.