Hm, thats bad. Is it on the roadmap? I have seen a Howto, generating certs and switching eap-type to tls on freeradius?
Yes Windows hosts can be authenticated with EAP-TLS by choosing something like "SmartCard or certificate" under the Authentication Tab of the adapter properties.
How can the PC be authentified, even if the user is not? We have a lot student pc in a pool, but the students have no individual account. I want to protect the Ethernet-ports against plugging in another computer, not verified from us. How can this be achieved?
You want a certificate per host and not a certificate per user. I use the following procedure to enable Host EAP-TLS authentication: * Set the "HKEY_LOCAL_MACHINE\Software\Microsoft\EAPOL\Parameters \General\Global\AuthMode" value to '2 in the windows registry. This means: "Computer authentication is performed when the wireless client computer is started. User authentication is never performed." See http://www.microsoft.com/technet/itsolutions/network/wifi/wififaq.mspx * Create a certificate per host: - cn must contain the Netbios name of the PC - the extension SubjectAltName must contain the Netbios name of the PC (I think) - The field Extended Key Usage must contain the option 'TLS Web Client Authentication' (OID 1.3.6.1.5.5.7.3.2) - Note that the Radius server's certificate must contain the 1.3.6.1.5.5.7.3.1 extension - The certificate can be exported into a PKCS12 file .p12 (this includes the private key). The certificate MUST be installed in the HOST CERTIFICATE STORE (simply double clic the file will NOT work): Run 'mmc' and Add the Snap-in 'Certificate>Local Computer', then in the private folder import the .p12 file and in the Trusted Root CA the CA certificate). Authentication will use the following username: The string 'Host/' concatenated with the Netbios name of the host. For instance if then NetbiosName is MYPC, use the following rule format in the raddb/users file: Host/MYPC CheckItems, ... ReplyAttributes..., ReplyAttributes..., Fall-Through = no There might be other solutions, but at least this is how it works for us... HTH, Thibault