EAP-TLS separate client cert per ssid FR v3.0.17

[Alan Buxey]

Hi,

The easiest way is to just use inland,  change whichever ssid you want to
to call eg 'eap2' instead 'eap' and copy current eap module configuration
file to a new eap2 configuration file and edit it so that it's known as
eap2 . Then edit eap2 to provide/use new CA/cert/whatever

alan

On Sat, 30 Apr 2022, 15:02 thyde rndstudio.com, <thyde at rndstudio.com> wrote:

> Good morning,
> I've been using FR for a number of years, with some "approved" and some
> "less than approved" configuration edits, but mostly with straightforward
> single CA, single client cert, EAP-TLS configuration, which has been
> outstanding. I have other configs where I add in EAP-TTLS or do mac auth,
> however what I would like to try next is EAP-TLS with multiple SSIDs, where
> there is a single separate cert per SSID.
>
> Please note that the certs will have different issue dates, and may change
> per freeradius instance, so chaining client certs into a single file and
> trying to attack some cert property is not the preferred path, unless it is
> the ONLY path. It would make cert management difficult to say the least.
>
> I have reviewed documentation to the best of my ability, however a lot of
> the searching (including on netrad) turned up solutions that were for prior
> versions of FR, with results for FR2 being most popular. I also see a
> number of posts/responses that ask if it can be done, where the response is
> "yes lot of people do it" -  but there is no actual instruction on how to
> do so. There are also snippets of earlier versions of FR3 prior the
> "tls-common" update, which attempting those breaks my current version, as
> one would expect. (As noted in subject, my FR version is 3.0.17)
>
> So far, I have tried to replicate the eap module (mods-enabled/eap ->
> renaming both file and module) with no success as FR complains about my
> copied eap modules not being compiled (cannot fine {name}.so) - which I
> fully understand where that is coming from as a dev myself I'm not really
> interested in re-writing the eap module source just to accommodate this
> particular forced practice, of which I'm sure Alan would agree (just
> getting that taken care of early in the conversation).
>
> Is there an example doc that could illustrate how to "properly" instruct
> the eap module to test only ClientCertA against SSID-A and only ClientCertB
> against ClientCertB? A test of ClientCertB attempting to associate on
> SSID-A must​ fail.
>
> I would like to retain the ability to also pre-test mac auth on some SSIDs
> before eap as I currently do in my default site (ie in
> sites-enabled/default) Currently I test against SSID and mac in my
> site/server: (inside authorize)
>
>  if(Eap-Message) {
>
>                 # EAP-TLS with certificate, no u/p, no mac filter.
>                 if (Aruba-Essid-Name == "ALANSFREEWIFI") {
>                         eap
>                }
>                 # EAP-TLS with certificate, no u/p, WITH mac filter.
>                elsif (Aruba-Essid-Name == "ALANSPROTECTEDNETWORK") {
>                         if (Calling-Station-Id == "aabbccddeeff") {
>                                 eap
>                         }
>
>                 }
> etc...
>
> and the eap module is currently stock aside from the certificate details;
> however in the above version, the same cert is on all clients - and that's
> not my optimal deployment choice.
>
> Moving forward, should this test happen in the virt-server (ie in
> sites-enabled/default), or does the (mods-enabled/eap) get extended to test
> against the ssid and mac?
>
> Kindest regards,
> Ted.
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
>