The tag has no usage guidance.

learn more… | top users | synonyms

5
votes
1answer
54 views

pfSense - IKEv2 with EAP-RADIUS: Any fallback option if the RADIUS server is down?

I'm deploying an IKEv2 VPN authenticating against a RADIUS service within a pfSense 2.3-RELEASE box. But I'm afraid of the complications of this approach when the RADIUS server is down. Since the ...
0
votes
0answers
12 views

PEAPv0 Used in Windows Server 2012?

I've read the Wikipedia article on PEAP and have searched Microsoft.com. By all indications, Windows (in my case, Server 2012), uses PEAPv0 (as opposed to PEAPv1 or PEAPv2) to wrap MSCHAPv2. Is ...
1
vote
1answer
102 views

Windows cannot connect to Enterprise WPA2 WiFi access point with EAP-TTLS PAP authentication using freeradius

I was working on having an Enterprise WiFi access point where my clients need to enter username and password (which are in OpenLDAP directory), using AES, TTLS PAP. I setup my freeradius according to ...
0
votes
0answers
236 views

Freeradius/Openldap/802.1X: PEAP-MSCHAPv2 XOR certificates

For WPA2 Enterprise I would like to have user authentication which is supported out-of-the-box by as many clients as possible (i.e., PEAP-MSCHAPv2). Furthermore, for laptops, workstations etc. I ...
0
votes
0answers
107 views

Freeradius not expanding “Calling-Station-Id” attribute in LDAP search

I'm trying to do PEAP-MSCHAPv2, then do a LDAP search to verify the user is in the correct group AND see if there MAC address is under a otherLoginWorkstation entry. If you look in the logs, ...
2
votes
1answer
348 views

EAP-TLS for Wireless with Active Directory

My question is more from a conceptual point of view, rather than implementation (even though I'm asking about proprietary protocols and products). Assuming I have users and credentials set up in my ...
1
vote
1answer
356 views

802.1x Login Window profile fails because it “can't prompt for missing properties”

I'm trying to configure a TTLS 802.1x Login Window profile on OS X 10.10.1 Yosemite. The profile has been installed (via MDM) and the login window now shows (above the username/password input boxes) ...
3
votes
0answers
115 views

JBoss EAP 6.2 high availability without HTTP server

i'm looking for some solution to make a Jboss Cluster ( 2 nodes ) in H.A. ( 1 live, 1 backup) but i don't want to use a third element ( machine, service or whatever ). Most configuration I found uses ...
0
votes
1answer
1k views

EAP-PWD with FreeRADIUS 3

I'm trying to setup EAP-PWD using FreeRADIUS 3. However, I can't get it to work and documentation is virtually non-existent. Thus, I don't know whether the problem I'm running into is a ...
1
vote
1answer
92 views

EAP-TLS: is it possible eavesdropping when sharing client certificate?

I want to know how to share a network of WPA2 enterprise with EAP-TLS, authenticating users with a common certificate. They share the same certificate. I'm afraid they can monitor each other. Is ...
0
votes
0answers
154 views

EAP-TLS Passthrough from pppd to Radius?

I am setting up an IPSec+L2TP VPN for a couple of Windows boxes connecting to a Debian 7.6 (Wheezy) machine running ipsec tools and xl2tpd/pppd. Client authentication via mschapv2 works well enough; ...
3
votes
1answer
382 views

Why does Windows CA Server issue multiple certificates for the same user?

I am currently implementing an EAP/TLS WIFI implementation to replace our EAP/MSCHAP2 wifi implementation. I am using Windows Server 2008 and I've installed a certificate authority. User certificates ...
0
votes
1answer
128 views

RADIUS authentication requests not relayed to RADIUS server

I am trying to set up a RADIUS server for 802.1x NAC over a Cisco IE 3000 Network Switch, using freeRadius to implement it. I know the switch knows where the RADIUS server is because I set up the ...
2
votes
1answer
276 views

Is using EAP-MD5 in strongSwan a security risk?

Quoting Wikipedia: It offers minimal security; the MD5 hash function is vulnerable to dictionary attacks, and does not support key generation, which makes it unsuitable for use with dynamic WEP, ...
0
votes
1answer
106 views

What decides what tunnels inside EAP-TTLS?

If EAP-TTLS is a EAP method that establishes a TLS tunnel, what goes in the tunnel? It could be another EAP method, but it could also be PAP. What decides? The server, the supplicant, or do they ...
0
votes
0answers
1k views

Windows 7 client unable to connect to Cisco Wireless Access point

My windows 7 pc is unable to connect to Cisco's Aironet 1040 AP(autonomous) AP is configured to use EAP with local RADIUS server. AP debug messages indicates RADIUS server rejected Windows client ...
0
votes
1answer
160 views

LEAP vs EAP/TLS?

I am given a choice between: LEAP Wireless Client ID 802.1x (EAP/TLS) Wireless Client ID (Digital Certificates) To connect to a wireless network. What are the differences? Which one would you ...
0
votes
1answer
561 views

JBoss AS EAP versions - What parts of EAP source code are closed source?

Question about the source code for JBoss EAP versions 4 5 or 6. Let's say we decided to purchase JBoss EAP 6 from RedHat. Can we still run maven to build JBoss EAP version? Are there closed source ...
4
votes
2answers
1k views

What should I use instead of MS-CHAP v2?

There's a new tool and service that makes it very easy to break MS-CHAP v2, which is used to secure VPNs. A good summary of the attach against MS-CHAP can be found at Ars Technica. Here's the way I ...
5
votes
3answers
20k views

Troubleshooting Windows EAP/RADIUS connectivity issues

So, I guess the short version of the question is: I'm unable to get clients to connect to an enterprise-WPA wireless network after setting up a "new" NPS server and a new CA. After I manually ...
3
votes
1answer
3k views

Auth-Type :- Reject in RADIUS users file matches inner tunnel request but sends Access-Accept

I have WPA2 802.11x EAP authentication setup using FreeRADIUS 2.1.8 on Ubuntu 10.04.4 talking to OpenLDAP, and can successfully authenticate using PEAP/MSCHAPv2, TTLS/MSCHAPv2 and TTLS/PAP (both via ...