On May 20, 2004, at 10:08 AM, Chris Bshaw wrote:
Hi....
Thanx to everyone who has replied so far....very helpful. A few more questions.
Bob.....I tried your settings below. My client does connect and I can see the EAP-TLS exchange via the radiusd debugging info. I also see MS-MPPE-Recv-Key and MS-MPPE-Send-Key in the debug output, and in ethereal on the client I see the EAPOL packets. However.....
1. Again, both ends say security = none (or Encryption = off)
On the AP, what command are you running that says there is no encryption?
2. A show logging on the AP has a line like this when a client machine associates with it:
*Mar 3 01:26:04.607: %DOT11-6-ASSOC: Interface Dot11Radio0, Station 0009.5b65.d55c Associated KEY_MGMT[NONE]
.....is KEY_MGMT[NONE] relevant here?
Do you have TKIP or CKIP enabled in your config? The config I sent you does not. It's possible the log message is talking about TKIP key management? I'm not certain.
3. I thought guest-mode meant that anyone could connect without EAP (or WEP)....am I wrong on this?
You are completely wrong. :-)
A Cisco AP can support multiple SSID's, but only one SSID can be broadcast in the beacon. The SSID that is in "Guest mode" is the one being beaconed. You can also have no guest mode SSID's at all, and then no SSID will be included in your AP's beacons. (but it *will* still beacon).
4. I set the dynamic rekeying interval to 120 seconds (instead of 600 seconds as you have below).....however, after the first successful connection, I never see any transaction on the radiusd server.....you mention I should configure the AP to honor the Session-Timeout from the radius server.....should I also set Session-Timeout = 120 on the freeradius server and if so where? (eg: in the raddb/attrs file?)...
When you're using 802.1x authentication, there are actually 2 wep keys involved. One is the per-user key assigned by the radius server. It's used to encrypt unicast traffic. Then there is a broadcast key used to encrypt broadcast and multicast traffic. That key is shared by all clients that are associated to the AP. The statement "broadcast-key change 600", causes a Cisco AP to change the broadcast WEP key every 600 seconds and distribute the new key to all associated clients. The Session-Timeout causes the AP to disassociate the client from the AP. When client will attempt to automatically re-associate. When it does, the radius server will give the client a new unicast WEP key. So yes, in addition to telling the AP to honor the Session-Timeout, you will need to tell Freeradius to send a Session-Timeout. It looks like this: (in your Freeradius users file)
# BDM - for all users, send a session-timeout value of 15 minutes (900 seconds)
# to the AP. For Cisco AP's you MUST make sure the AP is configured
# to honor the Session-Timeout value (it doesn't by default)
DEFAULT
Session-Timeout := 900,
Fall-Through = Yes
Put that at the VERY top of your users file.
5. Does my client wlan card and/or card driver need to support WEP dynamic rekeying? Or is it the w2k supplicant which handles this? (in case you missed it below I am using a NetGear WG511 card).
As long as your card supports 802.1x I believe you're fine. The supplicant will handle everything else.
One think you might do to verify that your clients *are* indeed using a WEP key would be to download a wireless sniffer like Kismet (or Kismac for Macintosh). They'll tell you if the traffic on the SSID is WEP encrypted or not. Kismac is a damn useful tool to have around anyway. It's a great way to look for rogue AP's, even if they have hidden SSID's. The config snippets I sent you are from my Cisco 1100 AP, and Kismac shows it's SSID as WEP encrypted.
Thanx again in advance
Chris Bradshaw
From: Bob McCormick <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Re: EAP-TLS and WEP key generation Date: Thu, 20 May 2004 08:54:41 -0600
What kind of cipher suite did you configure on your AP? For a Cisco AP, you should have something like this:
interface Dot11Radio0
no ip address
no ip route-cache
! ##### Require wep128 encryption
encryption mode ciphers wep128
! ##### rotate broadcast wep key every 10 minutes
broadcast-key change 600
! ##### Create an SSID named "ssid1"
! ##### Require EAP authentication
! ##### broadcast the SSID
ssid ssid1
authentication open eap eap_methods
guest-mode
! ###### set the data rates support and/or required by the AP
! ###### These are the rates recommended by Cisco for best throughput
! ###### for supporting both 802.11.b and 802.11g
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
You'll also need to configure the AP to honor the Session-Timeout value returned by the Radius server (by default, Cisco AP's don't).
! ###### Tell the AP to honor the Session-Timeout returned by the Radius server
dot1x reauth-period server
On May 20, 2004, at 3:28 AM, Chris Bshaw wrote:
Hi Andrea....
Thanx for the reply. Using ethereal I can see the EAPOL packets on the wireless client.
However, if I go into the status monitor for the wireless card, its says security = none (would normally say security = wep if I was using static non-EAP/TLS wep).
Also, as I mentioned below, the Cisco AP also says that the client is 'EAP-associated' but that Encryption is off.
However, everything works.....I am connected to the WLAN just fine.....I am just unsure whether or not my connection is encrypted with a WEP key.
I have read some more on this. I am not sure if I understand this correctly....so feel free to correct me. Once the mutual authentication is complete via EAP, the AP maintains per-client WEP keys which are generated once per 1x auth (and can be regenerated after some period of time, e.g. 1 hr) and a broadcast WEP key which is the same across clients (also can be regenerated after some period of time.)
So it seems that the AP is responsible for the WEP keys and their rotation......correct?
If so, I currently have WEP encrypyion disabled on my AP, and on my client. I had assumed that EAP-TLS took care of everything.
How do you have your client and hostapd configured? Do you have WEP enabled?
If so, since the keys are generated dynamically, do you just leave the WEP key fields on the client and AP blank?
Thanx in advance
Chris Bradshaw
From: "Andrea G. Forte" <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Re: EAP-TLS and WEP key generation Date: Wed, 19 May 2004 17:25:12 -0400 (EDT)
Chris,
the whole purpose of 802.1x is to generate a secure auth mechanism and
dynamic re-keying. I have used hostapd together with freeradius and the
key generation as well as the re-keying are automatic. You can set the
re-keying interval as well.
I am not familiar with your setup, but a way to find out, would be to
sniff the traffic and look for EAPOL-Key frames which are exchanged at the
end of the auth process.
Hope this can help. Andrea
On Wed, 19 May 2004, Chris Bshaw wrote:
> Hi....
>
> I have created the following setup:
>
> W2K 802.1x supplicant client with NetGear WG511 card
> Cisco Aironet 1200 AP
> RH9 Linux server with a cvs download of freeradius
>
> As per the many docs on the subject, I have successfully setup
> EAP-TLS.....however, I can't tell if WEP keys are being generated.
>
> When I look on the web admin page of the Aironet 1200 the associations list
> says that my W2K client is EAP-associated (so that works OK) but Encryption
> is marked as 'none'.
>
> ....and I have looked in the radiusd logs but can't work out whether WEP
> keys are being generated. I know that the session key is used to generate
> the keys, so perhaps something in the logs (without the word WEP in it) is
> responsible for WEP key generation.
>
> I thought that if you used EAP-TLS then you automatically got WEP keys
> generated....? Is this true?
> If so how can I confirm that this is happening (other than trying to sniff
> the traffic off the air to see if it is encrypted ;-)...
>
> If this isn't true, does this mean that it is possible to use EAP-TLS
> without WEP key generation?
>
> If so, are there extra steps I need to follow to activate WEP key generation
> as part of EAP-TLS?
>
> Sorry if some of these questions seem a bit strange....I am a bit new to
> 802.1x and EAP....
>
> Thanx in advance for any help.
>
> Chris Bradshaw
>
> _________________________________________________________________
> Help STOP SPAM with the new MSN 8 and get 2 months FREE*
> http://join.msn.com/?page=features/junkmail
>
>
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
>
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
_________________________________________________________________
Tired of spam? Get advanced junk mail protection with MSN 8. http://join.msn.com/?page=features/junkmail
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
_________________________________________________________________
The new MSN 8: advanced junk mail protection and 2 months FREE* http://join.msn.com/?page=features/junkmail
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
