freeRadius / Unifi AP / EAP-TTLS ?

furom

@furom Something is very wrong with my tablet... It forgets the certs I install... Sometimes I can't see what I just installed... So perhaps an issue with the tablet itself more than the certs... Add to that, the strange firmware that just appeared for it too :/
It is old, but did work before, so should again. I will reinstall Android on it and see if that may help. If not, it may be time to get a new one

or... could it be it can't handle ed25519 certs... hm. will try rsa once more...

furom

@furom Unreal... You have been most helpful John, and still this fails to authenticate. I will put this to rest for now, it is not that important. Should be more fun than anything. If I ever manage to make it work again I will document every part down to the letter (thought I had that but no), but that is for a rainy day I suppose.

johnpoz

@furom do you not have something else to test with, iphone, ipad, windows machine?

furom

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom do you not have something else to test with, iphone, ipad, windows machine?

I may have an old windows laptop still around, it's should be Win10 I think, will see if I can find it, but now when I think of it, a VM with Ubuntu should do just as good, or would Windows have any advantages here?

johnpoz

@furom A vm that has access to your wireless should be able to work as well.

Don't you have phone - that is running newer version of android maybe?

furom

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom A vm that has access to your wireless should be able to work as well.

Well, I was thinking of wired 802.1X, that would still test the certs, right? But true, I've never really heard of a true wireless VM, probably not the easiest route...

Don't you have phone - that is running newer version of android maybe?

That I can configure, no

I'm still uncertain if I'm actually creating the certs to contain the correct stuff or not. I have read too much, tried way too many different configs. There aren't that many fields to fill, but plenty to create mistakes with stil.

I have the devices ("tablet")/("windows"), a domain ("domain.local") and a user ("raduser").

Common Name (CN): tablet.domain.local
Country Code: <code>
Alternative Names: tablet.domain.local

Would this seem to be correct?

Then in the connecting end, on the device;

ca cert
client cert
domain: domain.local
identity: unsure of this one, think it should be 'tablet.domain.local'?

johnpoz

@furom yes you have to have identity set and it has to exactly match your freeraduser.

furom

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom yes you have to have identity set and it has to exactly match your freebsd user.

Thanks. I thought I'd tried that already, but will do it again. It may of course well be something else blocking, but at least I then know the certs are correct, that's one down... :) I'll install it and test connecting with windows. Hoping for some good luck :)

johnpoz

@furom yeah some little mistake can cause it not to work, ie had Tablet.home.arpa as user and was putting in tablet.home.arpa as my identity ;)

It really shouldn't have to be case sensitive.. So that was really odd, but as soon as I made the case match it worked.

furom

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom yeah some little mistake can cause it not to work, ie had Tablet.home.arpa as user and was putting in tablet.home.arpa as my identity ;)

It really shouldn't have to be case sensitive.. So that was really odd, but as soon as I made the case match it worked.

OMG... I just may have got it I think. Not tried it yet, but from your picture... The "user" I never got what it was used for... It's actually the devices.... the missing link I hope. :)

furom

@furom Never been as close... Radius auth now passes,

but my stupid tablet now refuse the IP I want to serve it, so I have more digging to do, but this feels a lot better, thanks!

These are the rules for the wifi;

I don't see anything blocked, which makes me think this is on the Android side...

johnpoz

@furom why would it not take the IP it gets from dhcp? Why are you hiding it? Are you trying to hand it something that is not rfc1918? 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12 ?

What do you see in the dhcp log?

furom

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom why would it not take the IP it gets from dhcp? Why are you hiding it? Are you trying to hand it something that is not rfc1918? 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12 ?

What do you see in the dhcp log?

On pfSense, the /var/log/dhcpd.log shows no trace at all from having even tried giving out an IP... :/ Other clients, but nothing for the wifi net... I'm checking the Unifi part as well, but that I have notes from the old setup, so less insecure of those...

johnpoz

@furom if your not seeing anything come in for dhcp.. Then that would point to something wrong with your wifi setup.. Its not tagging the ssid vlan correctly, or your switch setup isn't right for the vlan..

Wifi just puts the traffic on the L2 - pfsense would see it.. Your not running maybe dhcp snooping/guarding on your unifi?

furom

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom if your not seeing anything come in for dhcp.. Then that would point to something wrong with your wifi setup.. Its not tagging the ssid vlan correctly, or your switch setup isn't right for the vlan..

Wifi just puts the traffic on the L2 - pfsense would see it.. Your not running maybe dhcp snooping/guarding on your unifi?

both enabled, and usually working as intended. No change turning them off though. Have restared both pfSense and tablet... Will try to setup the most basic wifi now...

furom

@furom Weird. If I don't enter "domain" when trying to connect on the tablet it says "Obtaining IP address", but if I do enter it, I instead get "Password may be incorrect"... Not exactly great error messages... dhcp log is still empty from anything related to this... Now running on basic default wifi, no other config than selecting the vlan...

johnpoz

@furom said in freeRadius / Unifi AP / EAP-TTLS ?:

I instead get "Password may be incorrect".

where would you be setting a password.. You didn't set a password on your freerad user did you?

furom

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom said in freeRadius / Unifi AP / EAP-TTLS ?:

I instead get "Password may be incorrect".

where would you be setting a password.. You didn't set a password on your freerad user did you?

This one?

I sure did...

johnpoz

@furom Why?? eap-tls is not meant to use a password.. Do not set a password on your freerad user.. It auths with its cert.

As you see when you setup eap-tls on your tablet and pick ca and cert and identity - where does it let you put in a password? ;) So how would that work if you have a password set on your freerad user.

furom

@johnpoz Well ok. Removed and restarted pfSense, no change. Tablet still thinks password is wrong...

I tried increasing the dhcp scoop slightly on the wifi net, and that shows in the log at least. But still no requests or anything from the tablet... In fact, nothing is coming through to the wifi net at all... I will look for the windows comp...

Ok, finally got windows up, but when trying to connect to my wifi, I get a password prompt... I have not installed the cert yet, will have too google that too, thought it would have asked when detecting TLS