<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7654.12">
<TITLE>RE: working example of wpa_supplicant to hostapd setup thatauthenticates using WPA-EAP with EAP-TLS ???</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>On Mon 10/26/2009 6:45 PM, John Lumby wrote:<BR>
> I have been trying to establish a wireless connection between two<BR>
> laptops each running linux kernel 2.6.28 :<BR>
...<BR>
> Could anyone please show me a working example of a pair of hostapd /<BR>
> wpa_supplicant setup including wpa_supplicant.conf that authenticates to<BR>
> the hostapd using WPA-EAP with EAP-TLS (or if impossible as per previous<BR>
> paragraph - EAP-other ), and if possible answer my questions 1-3? I<BR>
> would be very grateful ...<BR>
<BR>
I don't have a hostapd.conf for you to see (we use an off-the-shelf AP),<BR>
but the following is what I use for EAP-TLS testing on the STA side<BR>
<BR>
[335] cat wpa_supplicant.conf.wpa2e<BR>
ctrl_interface=/var/run/wpa_supplicant<BR>
update_config=1<BR>
<BR>
network={<BR>
ssid="***"<BR>
<BR>
# 802.1X<BR>
key_mgmt=WPA-EAP<BR>
proto=RSN<BR>
eap=TLS<BR>
ca_cert="/certs/wifi_ca_cert.pem"<BR>
client_cert="/certs/client_keycert.pem"<BR>
private_key="/certs/client_keycert.pem"<BR>
private_key_passwd="whatever"<BR>
<BR>
identity="root"<BR>
}<BR>
<BR>
If you are using FreeRADIUS, the private_key_passwd is the same value you<BR>
need in the eap.conf file for the variable of the same name. The identity<BR>
goes in the users file IIRC.<BR>
<BR>
The part that tripped me up the most was creating the certificates. There<BR>
seem to be a large number of different ways to do this, but the one that<BR>
worked for me was a script called certhelper.py from the Fedora project.<BR>
<BR>
The directions I wrote up for QA look something like:<BR>
<BR>
# ./certhelper.py ca --outdir=/etc/freeradius/certs --name=wifi<BR>
# ./certhelper.py normal --outdir=/etc/freeradius/certs --name=server --cadir=/etc/freeradius/certs --caname=wifi<BR>
# mv /etc/freeradius/certs/server_key{_and_,}cert.pem<BR>
# ./certhelper.py normal --outdir=/etc/freeradius/certs --name=client --cadir=/etc/freeradius/certs --caname=wifi<BR>
# mv /etc/freeradius/certs/client_key{_and_,}cert.pem<BR>
<BR>
HTH<BR>
<BR>
---chuck<BR>
</FONT>
</P>
<BR>
______________________________________________________________________<BR>
DSP Group, Inc. automatically scans all emails and attachments using MessageLabs Email Security System.<BR>
_____________________________________________________________________<BR>
</BODY>
</HTML>