freeradius support eap-fast?
Hi, Eap-fast introduction from cisco said freeradius support eap-fast. Is it right? http://www.t11.org/ftp/t11/pub/fc/sp-2/07-595v0.pdf John --------------------------------- 雅虎邮箱，终生伙伴！
Hi,
Hi, Eap-fast introduction from cisco said freeradius support eap-fast. Is it right? http://www.t11.org/ftp/t11/pub/fc/sp-2/07-595v0.pdf
iirc, there was a small patch submitted to the devel list a few weeks back...but it needed some formatting changes etc and a re-posting. alan
A.L.M.Buxey@lboro.ac.uk wrote:
iirc, there was a small patch submitted to the devel list a few weeks back...but it needed some formatting changes etc and a re-posting.
I don't think I saw that. Do you have a link? In other news... I've added EAP-TNC. It's a little rough, but the concept is there. Alan DeKok.
In other news... I've added EAP-TNC. It's a little rough, but the concept is there.
I saw this :-). I had a question: EAP-TNC is intended to be bound to any tunneled EAP method but the last time I looked at the code the FreeRADIUS EAP state machine did not appear to support binding consecutive EAP methods in sequence to an arbitrary tunneled EAP method. Does this EAP-TNC implementation therefore require the use of a specific tunneled EAP method, or have there been some improvements to the EAP state machine to support this flexibility? josh. JANET(UK) is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Science and Innovation Campus, Didcot, Oxfordshire. OX11 0SG
Josh Howlett wrote:
I saw this :-). I had a question: EAP-TNC is intended to be bound to any tunneled EAP method but the last time I looked at the code the FreeRADIUS EAP state machine did not appear to support binding consecutive EAP methods in sequence to an arbitrary tunneled EAP method.
I'm not sure what that means... Does EAP-TNC go inside of a tunneled method, or does it tunnel other methods? If it goes inside of a tunneled method, then there's no problem. PEAP and TTLS already support tunneling EAP types. PEAP is just EAP-TLS with EAP-MSCHAPv2 inside of the tunnel. I have also successfully tested PEAP/EAP-GTC, and TTLS/EAP-MSCHAPv2.
Does this EAP-TNC implementation therefore require the use of a specific tunneled EAP method, or have there been some improvements to the EAP state machine to support this flexibility?
If EAP-TNC can go only inside of TTLS/PEAP, then the code likely needs to be updated to check for that, and enforce that requirement. Alan DeKok.
Alan wrote:
Josh Howlett wrote:
I saw this :-). I had a question: EAP-TNC is intended to be bound to any tunneled EAP method but the last time I looked at the code the FreeRADIUS EAP state machine did not appear to support binding consecutive EAP methods in sequence to an arbitrary tunneled EAP method.
I'm not sure what that means... Does EAP-TNC go inside of a tunneled method, or does it tunnel other methods?
It normally tunnels inside other methods.
If it goes inside of a tunneled method, then there's no problem. PEAP and TTLS already support tunneling EAP types.
Sure, but do the FreeRADIUS PEAP and TTLS implementation support running an EAP method for AuthN followed immediately by EAP-TNC within the same tunnel? The original EAP RFC (2284) didn't explicitly prohibit method sequencing. However, this was obseleted by RFC 3748 which does prohibit sequencing authentication methods (where this is defined as Type > 4, excepting Notification). Of course, an EAP method itself is free to do what it likes; so both PEAP and TTLS support sequencing (although this isn't implemented much). The difficulty that I saw when I looked at the code, IIRC, is that FreeRADIUS re-uses the same functions (and therefore the same assumptions of what is permitted and what isn't) for the 'outer' EAP session as it does for the 'inner' session. Did that make sense :-) ?
Does this EAP-TNC implementation therefore require the use of a specific tunneled EAP method, or have there been some improvements to the EAP state machine to support this flexibility?
If EAP-TNC can go only inside of TTLS/PEAP, then the code likely needs to be updated to check for that, and enforce that requirement.
That's not a requirement, but a likely deployment scenario. EAP-TNC has no transport security, and depends on the transport layer for confidentiality, etc. josh. JANET(UK) is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Science and Innovation Campus, Didcot, Oxfordshire. OX11 0SG
Josh Howlett wrote:
It normally tunnels inside other methods.
OK. I'll hack the code to force that to be true.
Sure, but do the FreeRADIUS PEAP and TTLS implementation support running an EAP method for AuthN followed immediately by EAP-TNC within the same tunnel?
Nope. It shouldn't be too hard to add, though.
The difficulty that I saw when I looked at the code, IIRC, is that FreeRADIUS re-uses the same functions (and therefore the same assumptions of what is permitted and what isn't) for the 'outer' EAP session as it does for the 'inner' session.
That doesn't matter, really. The TTLS/PEAP modules can be hacked again. "If first tunneled method returned Access-Accept, run another tunneled method..."
That's not a requirement, but a likely deployment scenario. EAP-TNC has no transport security, and depends on the transport layer for confidentiality, etc.
Ok. I'll hack the code to force that to be true. Alan DeKok.
Hangjun He wrote:
Eap-fast introduction from cisco said freeradius support eap-fast. Is it right?
No. This came up on the EAP standards list: http://permalink.gmane.org/gmane.ietf.emu/597
A simple look on freeradius.org would reveal that EAP-FAST is not in the list of supported protocols. Alan DeKok.
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Hangjun He -
Josh Howlett