Re: EAP-TTLS/PAP -> LDAP for WPA2

2006-07-12 Thread Laker Netman
--- John Allman <[EMAIL PROTECTED]> wrote: > Stefan Winter wrote: > >> I'm searching through my dell wireless wlan card > utility and i'm pretty sure > >> i can't hide it. Are dell breaking any rfcs or > other standards that i can > >> take them up on? > > > > No. It's optional. If Dell doesn't

Re: EAP-TTLS/PAP -> LDAP for WPA2

2006-07-07 Thread Stefan Winter
Hi, > I'm very impressed. I installed this and all of my complaints and > concerns are answered! Now, i'm assuming and hoping the linux wpa > supplicant also supports this... Sure thing :-) It's Free Open Source Software after all :-) > > Uh. You should consider that you will have _no_ link-laye

Re: EAP-TTLS/PAP -> LDAP for WPA2

2006-07-07 Thread John Allman
Stefan Winter wrote: >> I'm searching through my dell wireless wlan card utility and i'm pretty sure >> i can't hide it. Are dell breaking any rfcs or other standards that i can >> take them up on? > > No. It's optional. If Dell doesn't do it, bad luck. But you can always > install > a supplica

Re: EAP-TTLS/PAP -> LDAP for WPA2

2006-07-07 Thread Stefan Winter
> "Most supplicants". So there's a chance that a supplicant might not do > so? Yes. It's implementation-specific. The Win XP built-in supplicant for example does not do it. > Is the Identity in the EAP-Message in the first packet always the > same as the User-name i see in all packets? Yes, t

Re: EAP-TTLS/PAP -> LDAP for WPA2

2006-07-07 Thread John Allman
Stefan Winter wrote: > > The thing about anonymous outer identity is that it doesn't matter what you > put in there. If your real name is "iamcool" and your password > is "evencooler" you can happily send "foobar" as Identity. Authentication > will only depend on what's inside the tunneled PAP r

Re: EAP-TTLS/PAP -> LDAP for WPA2

2006-07-06 Thread Stefan Winter
Hi! > Hmmm. Well, in the first packet i see the Identity in the EAP-Message, > but the User-name attribute is in every packet sent by the AP. How would > i go about using an anonymous identity? Would that be up to the wireless > client configuration? It would be quite important for me to hide this

Re: EAP-TTLS/PAP -> LDAP for WPA2

2006-07-06 Thread John Allman
[EMAIL PROTECTED] wrote: >> The EAP-Message doesn't appear to be encrypted on the initial packet >> from the ap to the server. Inside i see Type and Identity (containing my >> username. The username is also in the User-Name attribute) >> > > that'll be your outer identity... which, as it is pl

Re: EAP-TTLS/PAP -> LDAP for WPA2

2006-07-06 Thread A . L . M . Buxey
Hi, > The EAP-Message doesn't appear to be encrypted on the initial packet > from the ap to the server. Inside i see Type and Identity (containing my > username. The username is also in the User-Name attribute) that'll be your outer identity... which, as it is plain to see (pun definately intend

Re: EAP-TTLS/PAP -> LDAP for WPA2

2006-07-06 Thread John Allman
[EMAIL PROTECTED] wrote: > "captive portal" - there are several software tools that will do this... > eg http://en.wikipedia.org/wiki/Captive_portal > > most people seem to be moving away from this method as it is riddled with > possible security compromises. > Thanks for the heads-up. I'll tak

Re: EAP-TTLS/PAP -> LDAP for WPA2

2006-07-06 Thread John Allman
Stefan Winter wrote: > You need to differentiate two parts of the link: a) the data that is passed > between the client device and the RADIUS server and b) the backend > communication between RADIUS server and LDAP. > > a) is encrypted when using EAP-TTLS > b) may or may not be encrypted, depend

Re: EAP-TTLS/PAP -> LDAP for WPA2

2006-07-06 Thread A . L . M . Buxey
Hi, > I'm using freeradius-1.1.2 on a freebsd server and i've compiled it > against openldap-2.3.24 which all went well. I'm attempting to set up > secure wireless with WPA2 using our ldap directory for authentication. > We have a replica of our directory running on the freeradius server. > Origin

Re: EAP-TTLS/PAP -> LDAP for WPA2

2006-07-06 Thread Stefan Winter
> Quite new to radius and struggling to get my head around things so > forgive me if my assumptions are wrong. I appear to have the setup > working but i'm concerned it's not doing what it think it is. I don't > think the authentication requests are actually going over an encrypted > channel. You

EAP-TTLS/PAP -> LDAP for WPA2

2006-07-06 Thread John Allman
Hi All, Quite new to radius and struggling to get my head around things so forgive me if my assumptions are wrong. I appear to have the setup working but i'm concerned it's not doing what it think it is. I don't think the authentication requests are actually going over an encrypted channel. I'm u