freeRadius / Unifi AP / EAP-TTLS ?

furom · May 21, 2023, 2:29 PM

@johnpoz Thanks, right now battling with windows... For some reason I don't have this

When hitting "connect" it checks network requirements and decides I can't connect. Cert imported fine, no errors.

I will see if I have better luck with Linux instead...

johnpoz · May 21, 2023, 2:33 PM

@furom what version of windows are you running?

Not sure if home for example supports it even, or maybe if your way behind in version?

furom · May 21, 2023, 2:42 PM

@johnpoz Thanks... I removed the drive again, but only weeks ago I updated to whatever latest resembles to. It should be a Win10 Pro, it says on the bottom sticker at least.

But Linux thinks the "windows" cert is corrupted. Will redo that. The CA seemed to be accepted though

johnpoz · May 21, 2023, 2:44 PM

@furom maybe linux wants a fqdn on the certs? I don't really have a linux box I could test with eap-tls.. I have lots of vms running linux and freebsd, and even have wsl on my windows - wonder if I could hand over my wifi card to my wsl instance on windows?

furom · May 21, 2023, 3:11 PM

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom maybe linux wants a fqdn on the certs? I don't really have a linux box I could test with eap-tls.. I have lots of vms running linux and freebsd, and even have wsl on my windows - wonder if I could hand over my wifi card to my wsl instance on windows?

Yeah, I had little success with linux either though. It did not seem to accept the export password, so will try setting one with openssl

johnpoz · May 21, 2023, 3:24 PM

@furom so question for you - when you say windows doesn't offer the ability to use certificate... You do have your ssid setup for enterprise right..

Maybe try wpa2 enterprise if wpa3 isn't working..

furom · May 21, 2023, 3:42 PM

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom so question for you - when you say windows doesn't offer the ability to use certificate... You do have your ssid setup for enterprise right..

My Access Point can't handle WPA3, but yes, WPA Enterprise is chosen for the SSID...

johnpoz · May 21, 2023, 4:01 PM

@furom What AP are you running? What controller version? I have some older gen2 AP the uap-ac-lite, pro and -lr.. And they support it.. What firmware are you on for your AP.. Are they gen 1??

furom · May 21, 2023, 4:02 PM

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom What AP are you running? What controller version?

I'm using an AC Lite and latest Unifi...

johnpoz · May 21, 2023, 4:07 PM

@furom the AC lite can do wpa3, what firmware do you have on it?

I am running 7.4.156 for the controller and 6.5.52 for firmware on my uap-ac-lite, all 4 of my APs on on this firmware.. I have a flex hd which is newer but don't really use it for anything - its connected to my controller but disabled, it use to be my son's that I bought for him when he first bought his house, but he changed his ISP and got some AX wifi gateway with his fiber - so his usg and flex hd came back to me and put on a shelf, haven't figured out where I could place the flex hd that would make any sense so it just sits on the floor of my computer room and I just update it when new firmware comes out ;)

furom · May 21, 2023, 4:15 PM

@furom I almost think I was lucky last time when I got it working... Now when I tries sometimes either one or both of the certs cannot be selected on the tablet... If I reset the cert store and re-import them I can start over. Perhaps it is simply worn out...? I mean, all flash eventually wear out, perhaps it's just acting up... :/ I may have an even older one around somewhere... This is the "new" one, lol

Hm... "Latest" as I called it is actually " 6.5.28.14491". It usually tells me if there is anything new to install... Maybe I have blocked it's checking, which would be suboptimal...

johnpoz · May 21, 2023, 4:15 PM

@furom or maybe it was never actually doing eap-tls and you just thought it was ;)

furom · May 21, 2023, 4:57 PM

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom or maybe it was never actually doing eap-tls and you just thought it was ;)

Well, I'm pretty sure as it did require the certificate, it actually ran EAP-TTLS. Now I reinstalled the CA and Cert and the CA vansished even before I got to install it once... I'm very puzzled... I see no other explanation than that the storage on it is unreliable

johnpoz · May 21, 2023, 5:03 PM

@furom said in freeRadius / Unifi AP / EAP-TTLS ?:

EAP-TTLS

You know those are way different right - the client isn't authed by cert in ttls

https://www.securew2.com/blog/eap-tls-vs-eap-ttls-pap

johnpoz · May 21, 2023, 5:05 PM

@furom said in freeRadius / Unifi AP / EAP-TTLS ?:

I see no other explanation than that the storage on it is unreliable

And what about your windows machine then? It doesn't even think the ssid your connecting to is eap-tls? Why can you not even present a cert?

furom · May 21, 2023, 5:33 PM

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom said in freeRadius / Unifi AP / EAP-TTLS ?:

EAP-TTLS

You know those are way different right - the client isn't authed by cert in ttls

https://www.securew2.com/blog/eap-tls-vs-eap-ttls-pap

True, not only. I had a separate radius server for that one until I got my USG. You can have it require a valid CA cert. I remember it as a bit tricky, but questionable if this isn't actually worse... I blame it on the tablet... ;) I cannot say for sure it is faulty, but why certs just disappear is else unheard of here...

johnpoz · May 21, 2023, 5:40 PM

@furom I just got my chromebook connected.. It didn't install the ca from .p12 but installed the user certs, once I installed the ca crt that I created for my freerad stuff - it saw my user account that I had installed from the p12.

Connected right away

edit: question for you - so the only thing you will ever connect to this using eap is some ancient tablet? Why bother to be honest then? Just use wpa2/3-psk and be done with it.. Seems like you trying to setup a complex setup for not sure what the reason is other than learning curve.. Which your having issues with just the basics.. I pretty much gave you step by step with screenshots of all my settings and connected multiple different types of clients. I did have some weirdness myself with the android tablet.. But really I chock that up to my own blindness that didn't use the same case in the name, and it requires fqdn where windows and iphones don't..

furom · May 21, 2023, 5:37 PM

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom said in freeRadius / Unifi AP / EAP-TTLS ?:

I see no other explanation than that the storage on it is unreliable

And what about your windows machine then? It doesn't even think the ssid your connecting to is eap-tls? Why can you not even present a cert?

No idea. It installed correct it seemed, but it will not recognize it... I have issues on Linux now as well.. It just refuse to accept the export passwords. I have tried all variants I can think of, with and without, "test" to be exact, exprted as x.509 and as PKCS12... Tried setting password with openssl... Nothing seems to work. It is "secure", I must say, lol

furom · May 21, 2023, 5:49 PM

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom I just got my chromebook connected.. It didn't install the ca from .p12 but installed the user certs, once I installed the ca crt that I created for my freerad stuff - it saw my user account that I had installed from the p12.

Connected right away

edit: question for you - so the only thing you will ever connect to this using eap is some ancient tablet? Why bother to be honest then? Just use wpa2/3-psk and be done with it.. Seems like you trying to setup a complex setup for not sure what the reason is other than learning curve.. Which your having issues with just the basics.. I pretty much gave you step by step with screenshots of all my settings and connected multiple different types of clients. I did have some weirdness myself with the android tablet.. But really I chock that up to my own blindness that didn't use the same case in the name, and it requires fqdn where windows and iphones don't..

I hear you. I will do something about the ancient tablet.. But when shopping for one before it seems 12 is the latest available Android... And if you feel that's old there ought to come a newer one soon...
But even though I have only occasional use of the tablet, I will never ever broadcast my network with less than the best security available. And well, yes, WPA2-Enterprise is hardly the best any more, but the best my lousy gear can handle at the moment...

Did I get you correctly, can your UAP-AC-Lite actually do WPA3? I've tried to google that but has been inconclusive. You are on a later version than mine has though.

johnpoz · May 21, 2023, 6:28 PM

@furom said in freeRadius / Unifi AP / EAP-TTLS ?:

You are on a later version than mine has though.

they didn't make multiple versions of the uap-ac-lite

GuestRoom-BZ.6.5.52# info

Model:       UAP-AC-Lite
Version:     6.5.52.14729
MAC Address: 04:18:d6:c0:1f:6b
IP Address:  192.168.2.4
Hostname:    GuestRoom
Uptime:      520119 seconds
NTP:         Synchronized

Status:      Connected (http://192.168.2.12:8080/inform)
GuestRoom-BZ.6.5.52#

There is a first gen uap-ac

https://help.ui.com/hc/en-us/articles/4409162471447-UniFi-Network-Identify-your-Access-Point-Model

And yes my uap-ac-lite does wpa3.. Here I moved my phone into the guestroom so it would connect to the AP in there..

You can download a profile for iphone to give you details of what you connected to and auth, etc..

You can download them here
https://developer.apple.com/bug-reporting/profiles-and-logs/

Not sure why they don't just show this info out of the box.. Guess not going to do you much good since you don't have an iphone you can play with or ipad.

But from that you can see, that I connected to my guest AP which is a uap-ac-lite, using wpa3-enterprise. I can validate that what ap its connected by matching up the bssid, and with iwconfig on the ap it lists the bssid for each ssid you have.. So that is matching, and also the controller will list what clients are connected to which AP..

So yeah the uap-ac-lite supports wpa3, maybe you way behind on its firmware.. I know wpa3 was added to them with a firmware update.. I always run the latest beta which is currently the 6.5.52. If I recall wpa3 was added to the gen2 AP like back in 5.43 or something firmware.. Are you running something older than that?

And I am pretty sure the controller would scream at me if not all of my AP supported wpa3.. They don't support the high security 192 mode.. From my previous looking into that you need atleast gen3 AP for that.