Apple .mobileconfig templates for user devices?
Does anyone have or can anyone point me in the direction of some good templates for .mobileconfig templates for authenticating against Freeradius? While I've deployed my Freeradius server at home successfully I have a mix of Android, Linux, Windows and Apple clients to connect and I'm struggling with the last. Android was super easy. Linux also. Windows was weird (I had to set it to use Enterprise WPA2 as the security method, but then way deeper down configure 802.1x settings). Apple is a monumental PITA. You cannot set up 802.1x without importing a profile in .mobileconfig format. Apple server versions might have an easy way to create these from a GUI or else you have to create an XML file from scratch (or hope that free web configs are good enough). I don't have Apple server so it's XML editing for me. I've got the full format specification here: https://developer.apple.com/library/content/featuredarticles/iPhoneConfigura... despite it targeting iPhones (this will be for Macbook Airs). Reading that full document makes my head hurt and I'm sure I'd screw up part of the profile anyway and then be hunting ghosts trying to get it correct. So does anyone have a working template they'd be willing to share, after redacting the secret information of course? Not that it's really important (I can modify something if I know it just about fits my config), but I'm using EAP-PEAP-mschapv2. Thanks, Toby
The .mobileconfig file can be generated with the apple iPhone configuration tool which is available for regular macos, not just apple servers. An older version used to run on windows too if you want to hint that out. Add for windows being 'weird', the correct wireless term is WPA2 Enterprise So it's not being wierd (Using 802.1X for the auth phases target than a pre shared key) ;) alan
Problem is my personal admin machine and my personal home devices are Linux and Android only :). I used to have Windows 10 until the SSD it was on died and now that you have to pay, well, I'm not paying. I can borrow an OS X machine but it's a shame it's not just a simple GUI. We tried yesterday to install the configuration tool but the OS X machine normally resides on a controlled/sterile environment and it's locked down so I can't install the configuration tool until the owner of the machine asks their IT department nicely for permission. Sigh. The thing that got me about the Windows machine is on Android you select 802.1x security, select the method, select the authentication and it all matches what you set up in Freeradius (in my mind). On Windows when you choose security there were (I think) four basic methods: none, wep, wpa or 802.1x. If you choose 802.1x there, then you can't get the config to work. If you choose wpa there, that's what you needed to do and then set up 802.1x authentication later on. I didn't understand why 802.1x was offered as an option early on and why I couldn't get that to work when I kept choosing it. I ended up trying to config a working profile using netsh wlan ... commands and still not having access to the options I thought I needed. If they'd only offered none, wep, wpa in the first pool of options then I would have probably managed to set it up much faster. Oh well, I know now after wasting a couple of hours. Toby On 13 November 2016 at 21:53, Alan Buxey <A.L.M.Buxey@lboro.ac.uk> wrote:
The .mobileconfig file can be generated with the apple iPhone configuration tool which is available for regular macos, not just apple servers. An older version used to run on windows too if you want to hint that out.
Add for windows being 'weird', the correct wireless term is WPA2 Enterprise So it's not being wierd (Using 802.1X for the auth phases target than a pre shared key) ;)
alan
hi, if you want a simple .mobileconfig for network profile to get started with, then maybe look at https://802.1x-config.org ? but if you are trying to do this stuff and dont have access to the clients, then 1) you're going to have problems with testing clients and support and 2) you need to invest (or get some investment) in some hardware as basic Windows platform (eg cheap laptop that can dual boot into eg 8 and 10) and an OSX device. I wouldnt even consider working in this space without such access. alan
Thanks Alan. That might actually do the trick. I'm not working in this space, so to speak. It's my home network. I've got access to all the machines if I want. I'd just prefer not to learn Apple if I can help it and just stick to the OSes I personally use. However for home harmony I need to get everything working. On 14 Nov. 2016 6:05 pm, <A.L.M.Buxey@lboro.ac.uk> wrote:
hi,
if you want a simple .mobileconfig for network profile to get started with, then maybe look at https://802.1x-config.org ? but if you are trying to do this stuff and dont have access to the clients, then 1) you're going to have problems with testing clients and support and 2) you need to invest (or get some investment) in some hardware as basic Windows platform (eg cheap laptop that can dual boot into eg 8 and 10) and an OSX device. I wouldnt even consider working in this space without such access.
alan
The .mobileconfig file can be generated with the apple iPhone configuration tool which is available for regular macos, not just apple servers. An older version used to run on windows too if you want to hint that out.
Add for windows being 'weird', the correct wireless term is WPA2 Enterprise So it's not being wierd (Using 802.1X for the auth phases target than a pre shared key) ;)
alan
You could use eduroam's CAT tool to generate these. Recently the source was moved over to github (not sure if that's every part to need to get a full CAT instance up and running.) https://github.com/GEANT/CAT A bit of overkill maybe for a home network, but not being an eduroam SP you'll need to build your own rather than use the live tool. At any rate, just google for mobileconfigs from universities. The ones that do not use PSK do not have any private info them so they are generally posted publicly, and many use EAP-PEAP-MSCHAPv2 also see: http://www.rootmanager.com/iphone-ota-configuration/iphone-ota-setup-with-si... ...for the instructions on how to sign them. You can embed your homegrown CA cert into the mobileconfig for one-step installation. If you also want add a VPN client config to the file as well, see the strongswan wiki; they have a posted example for that. ________________________________________ From: Freeradius-Users <freeradius-users-bounces+bjulin=clarku.edu@lists.freeradius.org> on behalf of Toby Walsh <walshtj@gmail.com> Sent: Sunday, November 13, 2016 5:48 PM To: Alan Buxey Cc: FreeRadius users mailing list Subject: Re: Apple .mobileconfig templates for user devices? Problem is my personal admin machine and my personal home devices are Linux and Android only :). I used to have Windows 10 until the SSD it was on died and now that you have to pay, well, I'm not paying. I can borrow an OS X machine but it's a shame it's not just a simple GUI. We tried yesterday to install the configuration tool but the OS X machine normally resides on a controlled/sterile environment and it's locked down so I can't install the configuration tool until the owner of the machine asks their IT department nicely for permission. Sigh. The thing that got me about the Windows machine is on Android you select 802.1x security, select the method, select the authentication and it all matches what you set up in Freeradius (in my mind). On Windows when you choose security there were (I think) four basic methods: none, wep, wpa or 802.1x. If you choose 802.1x there, then you can't get the config to work. If you choose wpa there, that's what you needed to do and then set up 802.1x authentication later on. I didn't understand why 802.1x was offered as an option early on and why I couldn't get that to work when I kept choosing it. I ended up trying to config a working profile using netsh wlan ... commands and still not having access to the options I thought I needed. If they'd only offered none, wep, wpa in the first pool of options then I would have probably managed to set it up much faster. Oh well, I know now after wasting a couple of hours. Toby On 13 November 2016 at 21:53, Alan Buxey <A.L.M.Buxey@lboro.ac.uk> wrote: - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan Buxey
-
Brian Julin -
Toby Walsh