Hello, every now and then there's a mild interest on this list about enabling EAP-FAST. In our eduroam R&D group, we are currently looking into EAP-FAST, which naturally includes FreeRADIUS support. Is it worthwhile posting our results here, for others "play with it" as well? Or has everybody already run away from the somwhat complicated installation of EAP-FAST support in FreeRADIUS [we certainly had our difficulties...] Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473
Stefan Winter wrote:
every now and then there's a mild interest on this list about enabling EAP-FAST. In our eduroam R&D group, we are currently looking into EAP-FAST, which naturally includes FreeRADIUS support. Is it worthwhile posting our results here, for others "play with it" as well? Or has everybody already run away from the somwhat complicated installation of EAP-FAST support in FreeRADIUS [we certainly had our difficulties...]
Currently FreeRADIUS supports EAP-FAST only by using the hostap EAP library. It's a bit of a hack to implement... I have some possible EAP-FAST code for a very old version of FreeRADIUS (1.1.4). If someone is willing to play with it, it could be made to work with the latest version. My main concerns with the code is that it's pretty bad... Alan DeKok.
W dniu 19.01.2010 15:06, Alan DeKok pisze:
Stefan Winter wrote:
every now and then there's a mild interest on this list about enabling EAP-FAST. In our eduroam R&D group, we are currently looking into EAP-FAST, which naturally includes FreeRADIUS support. Is it worthwhile posting our results here, for others "play with it" as well? Or has everybody already run away from the somwhat complicated installation of EAP-FAST support in FreeRADIUS [we certainly had our difficulties...]
Currently FreeRADIUS supports EAP-FAST only by using the hostap EAP library. It's a bit of a hack to implement...
I have some possible EAP-FAST code for a very old version of FreeRADIUS (1.1.4). If someone is willing to play with it, it could be made to work with the latest version.
My main concerns with the code is that it's pretty bad... Following Stefan's Winter message, I attach my How-To deploy EAP-FAST on FreeRADIUS which summarizes what I've done to get it to work with version 2.1.8. A few changes in FreeRADIUS are needed to provide some configuration variables to the hostap EAP library. The biggest problem is that this solution works only with eapol_test client. In real world, on the wireless network we managed to authenticate using EAP-FAST on FreeRADIUS only with anonymous PAC provisioning, because EAP fragmentation seems to be not handled.
Greetings Maja -- Maja Gorecka-Wolniewicz mgw@umk.pl http://www.umk.pl/~mgw PGP key: http://www.umk.pl/~mgw/pgp_pub_key.asc Uczelniane Centrum Information & Communication Informatyczne Technology Centre Uniwersytet Mikolaja Kopernika Nicolaus Copernicus University Coll. Maximum, pl. Rapackiego 1, 87-100 Torun, Poland tel.: +48 56-611-27-40 fax: +48 56-622-18-50 tel. kom.: +48-693032574
Maja Wolniewicz wrote:
A few changes in FreeRADIUS are needed to provide some configuration variables to the hostap EAP library.
Could you send the changes as a patch? That way we can apply them to the server, and make it easier for everyone else.
The biggest problem is that this solution works only with eapol_test client. In real world, on the wireless network we managed to authenticate using EAP-FAST on FreeRADIUS only with anonymous PAC provisioning, because EAP fragmentation seems to be not handled.
I think that's an issue with the hostap library. Maybe there's an API for FreeRADIUS to set MTU for the library. (I haven't looked recently) Alan DeKok.
W dniu 10-01-20 08:52, Alan DeKok pisze:
Maja Wolniewicz wrote:
A few changes in FreeRADIUS are needed to provide some configuration variables to the hostap EAP library.
Could you send the changes as a patch? That way we can apply them to the server, and make it easier for everyone else.
I attach the patch. Maja
The biggest problem is that this solution works only with eapol_test client. In real world, on the wireless network we managed to authenticate using EAP-FAST on FreeRADIUS only with anonymous PAC provisioning, because EAP fragmentation seems to be not handled.
I think that's an issue with the hostap library. Maybe there's an API for FreeRADIUS to set MTU for the library. (I haven't looked recently)
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Maja Gorecka-Wolniewicz mgw@umk.pl PGP key: http://www.home.umk.pl/~mgw/pgp_pub_key.asc Uczelniane Centrum Information& Communication Informatyczne Technology Centre Uniwersytet Mikolaja Kopernika Nicolaus Copernicus University Coll. Maximum, pl. Rapackiego 1, 87-100 Torun, Poland tel.: +48 56-611-27-40 fax: +48 56-622-18-50 tel. kom.: +48-693032574
participants (3)
-
Alan DeKok -
Maja Wolniewicz -
Stefan Winter