Home Site: http://www.missl.cs.umd.edu/wireless/eaptls/

This document describes how to setup strong cryptographic authentication between XSupplicant and FreeRADIUS. This is accomplished using part of 802.1x authentication for wireless network. In particular it uses EAP/TLS extension, and TLS handshake.

The solution presented here is the first open source implementation of 802.1x.

The server side implementation in FreeRADIUS is courtesy of Raghu (raghud[at]hereuare.com), and XSupplicant was developed here at University of Maryland by Bryan D. Payne (bdpayne[at]cs.umd.edu) and Nick Petroni (npetroni[at]cs.umd.edu). The work on integration of those two programs was done by me, Adam Sulmicki (adam[at]cfar.umd.edu), with help from Yuan Yuan (yuanyuan[at]cs.umd.edu). Lots of thanks go to William A. Arbaugh (waa[at]cs.umd.edu) for making it all possible.

The good news is that all radiusd and xsupplicant patches towards their interoperatibility have been integrated into respective sources, so grabbing current cvs version is enough. No need to apply any patches. However, those stuff are highly experimental so additional software is required and extra steps in setup are needed so read on :-)

The system used for my setup is RedHat 7.2. From its default installation 'libnet' package is missing, so you will have to install it first. On similar token the EAP/TLS module for FreeRADIUS will require that you use snapshot version of openssl (along with stable version of openssl!). Instructions on how to get this software installed and runnings are below:

OpenSSL
LibNet
FreeRADIUS
XSupplicant

http://www.openssl.org/

used by EAP/TLS module for FreeRADIUS

It is somewhat tricky. XSupplicant and FreeRADIUS in general will require stable version of SSL, but the EAP/TLS module requires latest snapshot (or any stable release after 1st March 2002, that is OpenSSL 0.9.7 or later), so generally you will have to have two versions of SSL and make sure EAP/TLS module is using the latest one and that *only* EAP-TLS is using it.

You will need *snapshot* version of SSL. The "stable-SNAP" will not do the trick, you need the one without word "stable". You are probably not interested in engine ("e") version neither as it is mostly for crypto _hardware_.

Just grab latest snapshot.
The snapshot I have used is openssl-SNAP-20020227.tar.gz.
You can get latest snapshots from ftp://ftp.openssl.org/snapshot/

http://www.openssl.org/
ftp://ftp.openssl.org/snapshot/openssl-SNAP-20020227.tar.gz
A local copy is stored here : openssl-SNAP-20020227.tar.gz

mkdir -p /usr/src/802/openssl
cd /usr/src/802/openssl
ncftpget ftp://ftp.openssl.org/snapshot/openssl-SNAP-20020227.tar.gz 
tar zxvf openssl-SNAP-20020227.tar.gz
cd openssl-SNAP-20020227
./config shared --prefix=/usr/local/openssl
make
make install

NOTE: Since it is snapshot, as opposed to stable version, it is not recommended that you put it any "usual" places as --prefix=/usr or --prefix=/usr/local/ssl as it is to be used by EAP/TLS module in FreeRADIUS only.

After that you will probably want to edit /usr/local/openssl/ssl/openssl.cnf and customize it to your needs. example of possible customizations openssl.conf-diff. Customizing the file makes life easier when you want to generate your own set of keys and certificates. Other than that it is not necessary.

To generate your own set of keys you could use this script CA.all (NOTE: the script preset whatever password it can to 'whatever' so it is more for reference than anything else.). It will generate private key and off that private key it will generate CA, and then use that CA to generate two certificates ('client' and 'server' certificates).

You will also need 'random file' with (obviously) contains random data and another file to generate Diffie-Hellman key agreement.

Example set generated of OpenSSL is here cert.tgz. All passwords are set to 'whatever'.

Later examples assume you put those certificates in /etc/1x/r/ . For example to get them setup so using my set keys, you could just do :

mkdir -p /usr/src/802/keys
cd /usr/src/802/keys
wget http://www.missl.cs.umd.edu/~adam/802/keys/cert.tgz
tar zxvf cert.tgz
mkdir -p /etc/1x
mv /usr/src/802/keys /etc/1x/

http://packages.debian.org/stable/devel/libnet0-dev.html
http://ftp.debian.org/debian/dists/potato/main/source/libs/libnet_1.0.orig.tar.gz
A local copy is stored here : libnet_1.0.orig.tar.gz

mkdir -p /usr/src/802/libnet
cd /usr/src/802/libnet
wget http://ftp.debian.org/debian/dists/potato/main/source/libs/libnet_1.0.orig.tar.gz
tar zxvf libnet_1.0.orig.tar.gz
cd Libnet-1.0/
./configure 
make
make install

http://www.freeradius.org/

A local copy is stored here : radiusd-02.28.02.tar.gz

Descriptions on how to get cvs tree are at: http://www.freeradius.org/development.html#cvs

basically:

mkdir -p /usr/src/802/radius
cd /usr/src/802/radius

cvs -d :pserver:anoncvs@cvs.freeradius.org:/source login

                        CVS password: anoncv

cvs -d :pserver:anoncvs@cvs.freeradius.org:/source checkout radiusd

cd radiusd
./configure --prefix=/usr/local/radius

See notes below : [0] [1]

make
make install

See notes below : [2] [3]

/usr/local/radius/sbin/run-radius -X -A

NOTES:

[0]
At this point you will want to modify the Makefile in the radiusd/src/modules/rlm_eap/types/rlm_eap_tls/ as follows: eap-TLS.Makefile This necessary in order so that:
a) it will compile EAP-TLS stuff, and
b) it will use the snapshot version of OpenSSL.

[1]
Also, if you are using Linux system at present time it will missdectedct your gethostbyadd_r() and gethostbyname_r(). Here's one way to fix it: radius-autoconf.h
Other way to fix is to edit radiusd/src/lib/misc.c file and change the calls to gethostbyaddr_r() and gethostbyname_r() to have syntax corresponding to this on Linux.
Yet another way to fix is to modify the configure.in script to handle those cases.
More info can be found at : http://marc.theaimsgroup.com/?t=101488214000003&r=1&w=2

[2]
At this point you want to configure radius server.

See OpenSSL section to see how to generate keys for free radius.

Now you want to configure your radius stuff at /usr/local/radius/etc/raddb. Here are some examples how I configured it. Especially important is the diff for the radius.conf file which has information how to enable EAP/TLS stuff, and how to setup pathes to appropriate certificate files.
doc/etc-raddb-radius.conf-diff
doc/etc-raddb-client.conf-diff
doc/etc-raddb-users-diff

NOTE: that I set fragment_size to 1750, this is because if I set more than that the CISCO AIRONET 340 AP will "myseriously" corrupt data, and stop passing packets, and just display non-descript message:

	RADIUS verification failed for Server 192.168.5.200. Probable shared secret mismatch

[3]
Finally you will want to have a wrapper around radiusd binary.

I would recommend this wrapper script run-radiusd to start radiusd. You will probably want to put it in /usr/local/radiusd/sbin/run-radiusd. Then you can run radius using 'run-radius -X -A' command as shown above.

This script is necessary so that:
a) EAP/TLS module loads right library libssl, and
b) libssl library loads correct libcrypto.
Especially the second part seems be some weird bug in OpenSSL where libssl picks wrong library for some reason.
LD_LIBRARY_PATH takes care of part a), and
LD_PRELOAD takes care of part b)

http://www.open1x.org/xsupplicant.html

update(10/26/2002)::http://www.open1x.org/

You want to make sure it uses stable version of OpenSSL and not the devel version. So it might be be necessary to specify patch to your stable version. for example for RedHat it is : "./configure --with-ossl-root=/usr". (you need to do that only if you put the devel version of openssl in some directory where xsupplicant can find it. that's usually /usr/local/ssl/)

You will need cvs version of xsupplicant as of 1st March 2002 or later. Stable release might be okay if it is dated after this date. You can grab current cvs tarball from http://www.open1x.org/xsupplicant-cvs-current.tar.gz

update(10/26/2002):: http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/open1x/xsupplicant/

A local copy is stored here : xsupplicant-cvs-current.tar.gz

mkdir -p /usr/src/802/xsup
cd /usr/src/802/xsup

wget http://www.open1x.org/xsupplicant-cvs-current.tar.gz

tar zxvf xsupplicant-cvs-current.tar.gz
cd xsupplicant-cvs-current
./configure
make
make install


/sbin/iwconfig eth1 essid rtest 	See notes below : [a]

/sbin/ifconfig eth1 up			See notes below : [b]

xsupplicant -i eth1			See notes below : [c]

NOTES:

[a]
The client and AP need to be associated first, before running xsupplicant.
You do association using 'iwconfig <dev> essid <name>' command.
Alternatively you could set ESSID in /etc/pcmcia/wireless.opts.

'eth1' is assumed to be the name of device on which your wireless network card is. Adjust as appropriate.

'rtest' is ESSID name of the wireless network you want to connect to.
'rtest' is my test network I created for my own needs. Adjust this as appropriate.

[b]

You need to manually bring the interface up before running xsupplicant.

NOTE: if you forget to do this step xsupplicant will crash.

[c]

Once you have done that you need to configure the 1x.conf file (sample can be found source directory for xsupplicant) and put it in /etc/1x .

My sample xsupplicant configuration file can be found at 1x.conf and it can be put in /etc/1x/1x.conf

explanation:

 
	wireless network name is rtest

	ID to try to login with is adam-ctl (it is same as
	the one specified in etc/raddb/users file for radius.

	The three other options (cert/key/root) specify authentication files.
	

NOTE: at present time xsupplicant does not support DSA based keys.

Assuming you have done all the above, you run it as show before (ie 'xsupplicant -i eth1') assuming your wireless interface is 'eth1'. It will automagically look for the config file in /etc/1x/1x.conf. If you want to put your config file elsewhere, you can use '-c' option to xsupplicant.

TEST SETUP

equipment used:


	authentication server - radius server

		hardware
			IBM THINKPAD T23 2647-2KU
				built in 100 Mbps ethernet 

		software
			Linux Red Hat 7.2
			FreeRadius (cvs)
			OpenSSL    (snapshot)


	authenticator - access point

		hardware
			CISCO AIRONET 340 series
				11 Mbps ACCESS POINT
				AIR-AP342E2C

				Motherboard: MPC860 50MHz, 2048KB FLASH, 16384KB DRAM, Revision 21
				100 Mbps ethernet
		software
			OS : EnterpriseAP Sys 11.10
	supplicant - radius server
		hardware
			IBM THINKPAD T23 2647-2KU
			CISCO AIRONET 340 SERIES
				11 Mbps WIRELESS ADAPTER
				AIR-PCM342
		software
			Linux Red Hat 7.2
			xsupplicant (cvs tarball)

configuration:

	There are many many ways to set it up. For example
	at one point I just had two ethernet cards in my laptop 
	and one was connected to AP via cross-over, and the other card
	was a PcCard which would send data to AP (so the packets
	would go just in circle :-). Anyway. For the setup described
	above, which is the same as shown on the picture below:

	radius server 				AP
			ethernet cross over 
			null serial modem

	I would connect both via mincom  (9600 8N1) and mozilla to the AP.
	Here's how I configured the AP. 

Access patch:

Home -> Setup -> Security -> Authentication Server 
	

Home -> Setup -> Security -> Radio Data Encryption (WEP) 
	

	In the above setup I have configured the AP so that the password 
	it uses for radius server is 'whatever', setup the IP for radius 
	server as 192.168.5.200. (the IP for AP is 192.168.5.131).

Here's another picture stolen from Cisco's web site which is another way to show above setup.

	Also I have run dhcp server to serve IP's but it is not shown
	in this example as it does not add much to picture.

• server log
• client log

Here I have put example server log with EAP/TLS and TLS part full decoded and described what each byte means:
server log - FULL

EAP/TLS : RFC2716
RADIUS  : RFC 2865, RFC 2866, RFC 2867, RFC 2868, RFC 2869
TLS     : RFC2246

update(11/05/2002)::

update(12/02/2002)::

Corrections, additions, fixes and patches to adam@cfar.umd.edu.

This is not a help desk. You will have better luck asking on FreeRADIUS mailing list.

It is not likely I'll answer any email asking for help as I have since then moved to more exciting things (LinuxBIOS) and I don't even have this setup handy anymore.

However, if you send me ready for inclusion stuff, it is likely that I'll include them in the HOWTO.

todo:
- put eapclient sources
- links to RFC's
- status of : oddysey beta
- status of : windows XP
- generate xp-compatibile keys... (maybe just convert to x509!!!!)
- setup devel mailing list???
- better fix for gethostby name (as per list archives)