Wireless network: WindowsXP supplicant, EAP-TLS and computer certificates.
I try to use FreeRADIUS for building 801.1X EAP-TLS authorization. I want to use only computer certificates (not user ones) on WinXP. such certificates contains FQDN of client in `commonName' field. But WinXP/SP2 sent `User-Name' in such case as `host/FQDN'. And checking of commonName fails. How can re-map such `User-Names'? I've tried to create realm with LOCAL mapping, but it doesn't help much :( It seems, that eap-tls `xlat' user-name before check, but xlat is not well-documented :( -- // Lev Serebryakov - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Check the subject and issuer in the EAP-TLS
Michal Prochazka wrote: I'm open for every remark and enhancement of this patch. IMHO, it is very breakable script: it compare only strings (issuer name, subject, etc), which can be forged easily. IMHO, we need to check sha1/md5 signatures of CA certificates, not strings. -- // Lev Serebryakov - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Check the subject and issuer in the EAP-TLS
Michal Prochazka wrote: I'm open for every remark and enhancement of this patch. BTW, here is `CA_file' parameter in `tls' module, so CA certificate know to us. And we can check this CA without any external script -- // Lev Serebryakov - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Check the subject and issuer in the EAP-TLS
Michal Prochazka wrote: I don't agree with you. Freeradius checks that the certificate is issued by one of the CA defined in config of EAP-TLS. And then this script compare the subject, you cannot forged it. And of course this patch can be easily enhanced to export sha1/md5 signatures. Oh, I've missed your point, sorry. This patch is against using some (for example, e-mail signing) certificate (issued by proper CA!) as wireless client's one, am I right on second try? :) -- // Lev Serebryakov - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html