Freeradius authentication with SSL client certificates

[Tom Yard]

Hi people, I wanto to implement a Freeradius authentication scheme, using
server and client SSL certificates: every client that require WiFI access
has to have a valid SSL certificate.

I think I have to use:

Authetication methos: EAP-TLS
Authentication protocol with NTLM: MSCHAP or MSCHAPv2

My clients are Windows, Linux and maybe Android.

Is my proposal correct ?

Thanking in advance.

Tommy
-
List info/subscribe/unsubscribe? See http://www.freerad

[Arran Cudbard-Bell]

Post by Tom Yard
Hi people, I wanto to implement a Freeradius authentication scheme, using
server and client SSL certificates: every client that require WiFI access
has to have a valid SSL certificate.
Authetication methos: EAP-TLS
Authentication protocol with NTLM: MSCHAP or MSCHAPv2
My clients are Windows, Linux and maybe Android.
Is my proposal correct ?

EAP-TLS can't carry and inner method, so not really. You can use EAP-TTLS with a client cert (so it behaves like EAP-TLS), and then run EAP-MSCHAPv2 as the inner method to do NTLM.


-Arran
-
List info/subscribe/uns

[Matthew Newton]

Post by Tom Yard
Hi people, I wanto to implement a Freeradius authentication scheme, using
server and client SSL certificates: every client that require WiFI access
has to have a valid SSL certificate.

If this is the _only_ requirement (i.e. that the client needs a cert to
authenticate) then you just need EAP-TLS.

[luckydog xf]

For wifi authentication, only two method are usable,

1. EAP-TTLS（ an extension of EAP）, which requires Certs installed on each
terminal( PC, Andriod, etc). 2. EAP-mschapv2( sometimes called
PEAP-MSCHAPV2).

Both of them are running inner layer of EAP, an alias is PEAP.

Correct me if I am wrong.

Post by Matthew Newton

Post by Tom Yard
Hi people, I wanto to implement a Freeradius authentication scheme, using
server and client SSL certificates: every client that require WiFI access
has to have a valid SSL certificate.

If this is the _only_ requirement (i.e. that the client needs a cert to
authenticate) then you just need EAP-TLS.
--
Matthew
-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

-
List info/subscribe/unsubscribe? See http://w

[Alan DeKok]

Post by luckydog xf
For wifi authentication, only two method are usable,

No.

Post by luckydog xf
1. EAP-TTLS（ an extension of EAP）, which requires Certs installed on each
terminal( PC, Andriod, etc). 2. EAP-mschapv2( sometimes called
PEAP-MSCHAPV2).

No. EAP-MSCHAPv2 is not PEAP. PEAP is an EAP method that uses TLS *and* EAP-MSCHAPv2.

Post by luckydog xf
Both of them are running inner layer of EAP, an alias is PEAP.

No.

Post by luckydog xf
Correct me if I am wrong.

Most of that was wrong.

There is documentation on Wikipedia that describes EAP, and the various EAP methods. It should help clarify this.

Alan DeKok.


-
List info/subscribe/unsub