freeRadius / Unifi AP / EAP-TTLS ?

johnpoz

@furom maybe linux wants a fqdn on the certs? I don't really have a linux box I could test with eap-tls.. I have lots of vms running linux and freebsd, and even have wsl on my windows - wonder if I could hand over my wifi card to my wsl instance on windows?

furom

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom maybe linux wants a fqdn on the certs? I don't really have a linux box I could test with eap-tls.. I have lots of vms running linux and freebsd, and even have wsl on my windows - wonder if I could hand over my wifi card to my wsl instance on windows?

Yeah, I had little success with linux either though. It did not seem to accept the export password, so will try setting one with openssl

johnpoz

@furom so question for you - when you say windows doesn't offer the ability to use certificate... You do have your ssid setup for enterprise right..

Maybe try wpa2 enterprise if wpa3 isn't working..

furom

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom so question for you - when you say windows doesn't offer the ability to use certificate... You do have your ssid setup for enterprise right..

My Access Point can't handle WPA3, but yes, WPA Enterprise is chosen for the SSID...

johnpoz

@furom What AP are you running? What controller version? I have some older gen2 AP the uap-ac-lite, pro and -lr.. And they support it.. What firmware are you on for your AP.. Are they gen 1??

furom

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom What AP are you running? What controller version?

I'm using an AC Lite and latest Unifi...

johnpoz

@furom the AC lite can do wpa3, what firmware do you have on it?

I am running 7.4.156 for the controller and 6.5.52 for firmware on my uap-ac-lite, all 4 of my APs on on this firmware.. I have a flex hd which is newer but don't really use it for anything - its connected to my controller but disabled, it use to be my son's that I bought for him when he first bought his house, but he changed his ISP and got some AX wifi gateway with his fiber - so his usg and flex hd came back to me and put on a shelf, haven't figured out where I could place the flex hd that would make any sense so it just sits on the floor of my computer room and I just update it when new firmware comes out ;)

furom

@furom I almost think I was lucky last time when I got it working... Now when I tries sometimes either one or both of the certs cannot be selected on the tablet... If I reset the cert store and re-import them I can start over. Perhaps it is simply worn out...? I mean, all flash eventually wear out, perhaps it's just acting up... :/ I may have an even older one around somewhere... This is the "new" one, lol

Hm... "Latest" as I called it is actually " 6.5.28.14491". It usually tells me if there is anything new to install... Maybe I have blocked it's checking, which would be suboptimal...

johnpoz

@furom or maybe it was never actually doing eap-tls and you just thought it was ;)

furom

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom or maybe it was never actually doing eap-tls and you just thought it was ;)

Well, I'm pretty sure as it did require the certificate, it actually ran EAP-TTLS. Now I reinstalled the CA and Cert and the CA vansished even before I got to install it once... I'm very puzzled... I see no other explanation than that the storage on it is unreliable

johnpoz

@furom said in freeRadius / Unifi AP / EAP-TTLS ?:

EAP-TTLS

You know those are way different right - the client isn't authed by cert in ttls

https://www.securew2.com/blog/eap-tls-vs-eap-ttls-pap

johnpoz

@furom said in freeRadius / Unifi AP / EAP-TTLS ?:

I see no other explanation than that the storage on it is unreliable

And what about your windows machine then? It doesn't even think the ssid your connecting to is eap-tls? Why can you not even present a cert?

furom

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom said in freeRadius / Unifi AP / EAP-TTLS ?:

EAP-TTLS

You know those are way different right - the client isn't authed by cert in ttls

https://www.securew2.com/blog/eap-tls-vs-eap-ttls-pap

True, not only. I had a separate radius server for that one until I got my USG. You can have it require a valid CA cert. I remember it as a bit tricky, but questionable if this isn't actually worse... I blame it on the tablet... ;) I cannot say for sure it is faulty, but why certs just disappear is else unheard of here...

johnpoz

@furom I just got my chromebook connected.. It didn't install the ca from .p12 but installed the user certs, once I installed the ca crt that I created for my freerad stuff - it saw my user account that I had installed from the p12.

Connected right away

edit: question for you - so the only thing you will ever connect to this using eap is some ancient tablet? Why bother to be honest then? Just use wpa2/3-psk and be done with it.. Seems like you trying to setup a complex setup for not sure what the reason is other than learning curve.. Which your having issues with just the basics.. I pretty much gave you step by step with screenshots of all my settings and connected multiple different types of clients. I did have some weirdness myself with the android tablet.. But really I chock that up to my own blindness that didn't use the same case in the name, and it requires fqdn where windows and iphones don't..

furom

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom said in freeRadius / Unifi AP / EAP-TTLS ?:

I see no other explanation than that the storage on it is unreliable

And what about your windows machine then? It doesn't even think the ssid your connecting to is eap-tls? Why can you not even present a cert?

No idea. It installed correct it seemed, but it will not recognize it... I have issues on Linux now as well.. It just refuse to accept the export passwords. I have tried all variants I can think of, with and without, "test" to be exact, exprted as x.509 and as PKCS12... Tried setting password with openssl... Nothing seems to work. It is "secure", I must say, lol

furom

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom I just got my chromebook connected.. It didn't install the ca from .p12 but installed the user certs, once I installed the ca crt that I created for my freerad stuff - it saw my user account that I had installed from the p12.

Connected right away

edit: question for you - so the only thing you will ever connect to this using eap is some ancient tablet? Why bother to be honest then? Just use wpa2/3-psk and be done with it.. Seems like you trying to setup a complex setup for not sure what the reason is other than learning curve.. Which your having issues with just the basics.. I pretty much gave you step by step with screenshots of all my settings and connected multiple different types of clients. I did have some weirdness myself with the android tablet.. But really I chock that up to my own blindness that didn't use the same case in the name, and it requires fqdn where windows and iphones don't..

I hear you. I will do something about the ancient tablet.. But when shopping for one before it seems 12 is the latest available Android... And if you feel that's old there ought to come a newer one soon...
But even though I have only occasional use of the tablet, I will never ever broadcast my network with less than the best security available. And well, yes, WPA2-Enterprise is hardly the best any more, but the best my lousy gear can handle at the moment...

Did I get you correctly, can your UAP-AC-Lite actually do WPA3? I've tried to google that but has been inconclusive. You are on a later version than mine has though.

johnpoz

@furom said in freeRadius / Unifi AP / EAP-TTLS ?:

You are on a later version than mine has though.

they didn't make multiple versions of the uap-ac-lite

GuestRoom-BZ.6.5.52# info

Model:       UAP-AC-Lite
Version:     6.5.52.14729
MAC Address: 04:18:d6:c0:1f:6b
IP Address:  192.168.2.4
Hostname:    GuestRoom
Uptime:      520119 seconds
NTP:         Synchronized

Status:      Connected (http://192.168.2.12:8080/inform)
GuestRoom-BZ.6.5.52#

There is a first gen uap-ac

https://help.ui.com/hc/en-us/articles/4409162471447-UniFi-Network-Identify-your-Access-Point-Model

And yes my uap-ac-lite does wpa3.. Here I moved my phone into the guestroom so it would connect to the AP in there..

You can download a profile for iphone to give you details of what you connected to and auth, etc..

You can download them here
https://developer.apple.com/bug-reporting/profiles-and-logs/

Not sure why they don't just show this info out of the box.. Guess not going to do you much good since you don't have an iphone you can play with or ipad.

But from that you can see, that I connected to my guest AP which is a uap-ac-lite, using wpa3-enterprise. I can validate that what ap its connected by matching up the bssid, and with iwconfig on the ap it lists the bssid for each ssid you have.. So that is matching, and also the controller will list what clients are connected to which AP..

So yeah the uap-ac-lite supports wpa3, maybe you way behind on its firmware.. I know wpa3 was added to them with a firmware update.. I always run the latest beta which is currently the 6.5.52. If I recall wpa3 was added to the gen2 AP like back in 5.43 or something firmware.. Are you running something older than that?

And I am pretty sure the controller would scream at me if not all of my AP supported wpa3.. They don't support the high security 192 mode.. From my previous looking into that you need atleast gen3 AP for that.

furom

@johnpoz Oh, beta... That explains it. I always verify mine against UBNT here(https://www.ui.com/download/unifi/unifi-ap-ac-lite/uap-ac-lite), and it seems to match my version to the dot. Mine would most certainly be the gen 1. I never run beta if there isn't something substantial about it. Where do you get their software from?

johnpoz

@furom said in freeRadius / Unifi AP / EAP-TTLS ?:

shopping for one before it seems 12 is the latest available Android

No there are some that have 13 that is for sure, and I just did a quick google and 14 is out or is coming for some of the higher end Samsungs that is for sure.. I am not aware of what specific makes and models come with what, I was not looking to spend any real money on my train ride tablet ;)

At home I rarely use tablet/iphone/ipad, I have my PC and access to all my tools and multiple large monitors and access anything via a click of a few buttons on my full keyboard and mouse, etc. Why would I use a tablet... Tablet is good for when I want to watch something while sitting on the train ;) heheh

I am old schooler - I like my mechanical keyboard, with some feedback to what I am typing, etc. I use a tablet when its the only thing I have - or it makes sense like watching a movie on a train or plane and pain in the ass to breakout a full laptop, etc.

johnpoz

@furom said in freeRadius / Unifi AP / EAP-TTLS ?:

Mine would most certainly be the gen 1

then it isn't a uap-ac-lite.. It would be just a uap-ac.. Those are OLD, and eol I am pretty sure.. Just the normal uap-ac might be still life, but pretty sure they announced end of life for like
UAP-AC-EDU
UAP-AC-IW-PRO

there was a bit of stink about all over the unifi forums.

As to running beta bringing something the table - you mean like wpa3 ;) hehehe

I don't have any issues running with the latest and greatest beta for my AP or even the controller - because its only a couple of minutes to rollback if need be. I run my controller as a VM, and always take snapshot before doing any update on it.. And with the AP, its pretty simple to roll back to previous firmware.. To be honest I think in the multiple years I have been running them, I might have only rolled back on firmware like once.. Because it broke something..