Mandi! Alan DeKok In chel di` si favelave...

...

But this client (an HP Color LaserJet M452nw) claim to have support for PEAP, LEAP and EAP-TLS, not explicitly citing MSCHAPv2.

If the client doesn't do PEAP/MSCHAPv2, then no amount of poking FreeRADIUS will make the client do PEAP/MSCHAPv2. [...] Find out what the printer supports, and configure FreeRADIUS to do that,

OK, but AFAI've understood well, 'PEAP' is an empty container where a subsequent authentication method need to be nested, like MD5, MSCHAPv2 and so on. So, 'PEAP' support what really mean? PEAP with what? And if i need to 'configure freeradius', how? I need to setup modules, or write passwords in some fancy way? Really, i'm groping in the dark...

In this case, likely EAP-TLS.

See in detail next post. Thanks. -- Il computer è come la morosa: meno ci mettono mano gli altri e meglio è! ;-) (Enrico)

Mandi! Alan Buxey In chel di` si favelave...

Apparently that's the behaviour when the printer doesn't recognise the RADIUS cert. (I support that EAP type but I dont support that type because I'm not happy with the server cert). You need to import the root (and intermediate certificates) into the HP printer then it will do 802.1X happily

Printer have a self-signed certiifcate (the default HP one); i've loaded the CA certificate (an internal one) into the printer, CA certificate that was used to sign the cert the freeradius server use. I need also to create, sign and load to the printer a client certificate signed by the same CA? Also, i was sure that EAP-TLS mean 'auth by the way of certificates'; but if i choose EAP-TLS, still the printer ask me to input user and password. I'm a bit confused... -- Fino a quando il colore della pelle sarà più importante del colore degli occhi, sarà sempre guerra. (Bob Marley)

Mandi! Alan DeKok In chel di` si favelave...

This is really a "how to configure the printer" issue. We can't help much there, unfortunately. Either the printer is sane, and has good documentation, or it doesn't. Once you've figured out what the printer does, we can help you configure FreeRADIUS.

Manual is here: https://h10032.www1.hp.com/ctg/Manual/c04628719.pdf but don't have info about PEAP or so. There's another doc 'HP Printers - Certificate-based authentication for data security (whitepaper)' that point to a dead link; i've found on internet archive: https://web.archive.org/web/20240411135917/http://h10032.www1.hp.com/ctg/Man... but still no clue on PEAP, seems only a generic cert handling paper. Probably it is not specific to these models, but for a (generic) set of HP printers firmwares; i'll give a try on loosing the search. But, there's some way to debug what the printer (try to) do server side? Thanks. -- Molti italiani sognavano di vedere Berlusconi in un cellulare, prima o poi... (Stardust®, da i.n.n-a)

Mandi! Alan Buxey In chel di` si favelave...

...

But, there's some way to debug what the printer (try to) do server side? you've kind-of seen all you'll see already - the client starts a connection, EAP starts, server says heres a PEAP with cert, client says no, I can't do that but I can do 'this' instead where 'this' is actually the previously suggested method - because its the printers way of saying it isnt happy with the servers cert. so it can do PEAP but it cant do the PEAP offered due to the not happy with the provided cert. its a naff implementation. as previously said, install the servers CA/server certs onto the printer.

As just stated, local CA certificates (the one used to sign the freeradius server certificate) was just loaded on the printer. I've tried to generate and sign with the same CA a server certificate for the printer, but (in PCK#12 formatas requested) the printer refuse it (invalid format, wrong password, ... no a meaningfull error at all). Still trying... -- Ci sono 3 professori di statistica che vanno a caccia di lepri. ad un tratto ne vedono una. il primo spara... un metro a destra. il secondo spara... un metro a sinistra. il terzo esclama: "l'abbiamo presa". (Gino)