Questions tagged [wpa2-eap]
The wpa2-eap tag has no usage guidance.
36
questions
0
votes
1
answer
981
views
How to create PKCS12 container with no password
I have set up 802.1x authentication on my wireless network with EAP-TLS. The use case here is that I would like the presence of a certificate to be both necessary and sufficient for connecting to the ...
- 176
0
votes
1
answer
231
views
EAP-TLS for securing internal local WLAN?
I'm looking at securing a wi-fi network used in an industrial context.
I have a pool of client devices which should automatically connect to an AP (selecting SSIDs which match a specific pattern). ...
- 103
0
votes
1
answer
263
views
Does OpenSSL support EAP-TLS privacy
Does OpenSSL support EAP-TLS privacy?
It's an optional feature part of rfc5216, section 2.1.4.
1
vote
1
answer
164
views
How does the supplicant connect to the auth server in EAP TTLS?
I understand that a tls has to be established between the supplicant (end user device) and the auth server but a few things are unclear :
How does the supplicant know the ip adress of the auth server ...
- 29
0
votes
2
answers
452
views
WPA2-EAP-TLS with global client certificate
Is security compromised if every client uses the same client certificate to authenticate with WPA2-EAP-TLS?
In essence, we want to provide an open wifi network, but want to ensure users cannot see ...
- 103
2
votes
1
answer
686
views
Why is my RADIUS Certificate not automatically signed with the root CA Certificate on my iPhone
I have spent the last few days setting up a freeradius server with eap-tls as the only authentication method.
I have used this old tutorial for setting up my own CA and generating the certificates and ...
0
votes
1
answer
289
views
How are keys negotiated in wpa-eap?
Question about PEAP-MSCHAPV2 on RADIUS.
After MSCHAPV2 success keys are extracted from TLS context. Then it sent to AP.
Client failed to connect WiFi (or eapol, etc) with my handmade RADIUS Access-...
- 111
2
votes
2
answers
1k
views
EAP vs TLS authentication
I am having trouble understanding the point of EAP.
EAP is an authentication framework, which defines several TLS based methods and encapsulations like EAP-TLS, EAP-TTLS and PEAP. These all require ...
- 65
1
vote
2
answers
701
views
Capturing cleartext authentication (EAP-TTLS/PAP) with WPA-2 Enterprise?
I am running an evil twin attack with eaphammer, by default it seems to capture mschapv2 authentication which contains the username and NETNTLM hashes. I have manually created a WiFi connection (on ...
- 495
2
votes
2
answers
312
views
WPA2 Enterprise: no risks for preconfigured clients when it comes to Rogue APs?
We are using, as default, PEAP and MS-CHAPv2 as inner authentication.
I was concerned with security risks when it comes to rogue APs but a colleague told me that there are no risks for preconfigured ...
- 21
0
votes
1
answer
705
views
is it possible to evil twin a WPA 2 Wifi using one of EAP methods?
the same as fluxion but without the captive portal just like this video
Stealing 802.1x Credentials with Rogue AP & RADIUS server
he was able to get the username and the password of an EAP wifi ...
- 117
0
votes
1
answer
1k
views
How DHCP client can determine that 802.1x Port based authentication has been completed and its time to trigger DHCP discover
I have a Supplicant running on 1 Linux box attached with a Free radius server on other linux box with cisco catalyst switch (with 802.1x Port based access) in between. Now I have been able to ...
3
votes
0
answers
665
views
WPA2-Enterprise / EAP-TLS user identity
I'm currently in process of testing EAP-TLS before deploying it in production. My test setup consists of:
Supplicants: Android 6, Debian Buster with WICD-GTK.
Authenticator: Mikrotik RouterOS 6.43 (...
- 43
1
vote
1
answer
110
views
How WPA supplicant can determine whether switch supports authentication or not?
If a client(supplicant) configure to perform EAP-TLS authentication connects with a switch which doesn't requires authentication.
How can supplicant determine that authentication is not required and ...
0
votes
1
answer
704
views
How does Authenticator gets the PMK which is used to calculate PTK?
I am trying to setup a Supplicant- authenticator and AAA server to perform EAPOL mechanism.
I am able to successfully completed the EAP authentication procedure but 4-way handshake was not initiated ...
2
votes
1
answer
127
views
Does EAP exist as an independent authentication protocol, or just as a framework?
Does EAP exist as an authentication protocol itself, or will it only be found implemented as one of its methods (EAP-TLS, EAP-TTLS, etc)?
If EAP is only a framework, what additional detail do its ...
- 425
26
votes
1
answer
7k
views
What is stronger - WPA2 Enterprise with 2048 bit key, or Personal with 63 character passphrase?
Which of the two following has a stronger cryptographic strength in withstanding brute-force attacks?
WPA/WPA2 Enterprise using 2048-bit RSA public-key
WPA/WPA2 Personal using 63-character ...
- 261
0
votes
2
answers
810
views
How to prevent users sharing WPA RADIUS keys?
My office LAN does not have a Windows Active Directory.
The Wifi use WPA with a pre-shared key, which means that everyone in the world knows what the key is.
I was thinking of implementing a RADIUS ...
- 101
1
vote
1
answer
347
views
How dangerous is it to trust an “Example Server Certificate”?
When connecting to the Wi-Fi of my university, which authenticates clients via “EAP-PEAP (MSCHAPv2)”, I got the following prompt:
I had no choice but to trust this certificate, because otherwise I ...
- 771
0
votes
1
answer
508
views
Hotspot SSL issues, MtTM like exceptions
I have doubt about how to implement hotspot for my startup. Idea is to have implemented WPA2-Enterprise with remote radius server and splash page. This implementation came after the reason of ease of ...
1
vote
1
answer
1k
views
Evil Twin Attacks against WPA-TLS
Today I'm getting into the details of WPA-Enterprise. Most of what I saw was difference between protocols that use certificates. Most posts say that EAP-TLS is the most secure authentication protocol ...
- 143
0
votes
1
answer
2k
views
What are the roles of PSK and GTK in a WPA setting?
I understand that PTK is ultimately the key that is used to encrypt traffic between a device and the WAP after the 4WHS and that the PMK is directly related to the 'passphrase' of the wireless network....
- 439
2
votes
1
answer
3k
views
Access-Challenge EAP Request
From my understanding, after the Access-Request, the authentication server (RADIUS) sends a reply (encapsulated in the Access-Challenge packet) to the authenticator (AP).
The Access-Challenge packet ...
- 177
1
vote
0
answers
160
views
Manipulate EAP negotiation
The EAP method to use is suggested from the client to the server during the EAP negotiation.
I'm trying to make the EAP negotiation ends on one specific EAP method (inner authentication included) of ...
- 41
1
vote
0
answers
164
views
Force/Suggest the client to use one specific EAP method
I would like to suggest to the client which one EAP method and inner authentication to use.
I'm using hostapd to create the AP.
I've tried by removing some methods in the hostapd.eap_user but I ...
- 41
2
votes
0
answers
552
views
Change default EAP type in hostapd [closed]
I'm trying to change the default EAP type in hostapd but I am not able to understand how to do that.
Here's what I've found reading the hostapd.conf file:
> # NAI Realm information
> # One or ...
- 41
7
votes
2
answers
4k
views
WPA2 Enterprise EAP-TLS Key Exchange
I'm in the process of implementing 802.1x WPA2 Enterprise Authentication using FreeRadius and EAP-TLS (Mutual TLS Cert Based Auth).
I am keen to understand how to actual protocols work together and ...
- 71
4
votes
3
answers
6k
views
Restrict Microsoft Network Policy Server (NPS) to only trust client certificates from a given CA?
I'm working on an install of a Microsoft Network Policy Sever (NPS) / RADIUS server for controlling access to corporate Wi-Fi using 802.1x / WPA2-Enterprise - using client certificates for ...
- 171
2
votes
0
answers
433
views
WPA2 EAP-TTLS with PAP: Does the authentication server know the password?
There's a wireless network that I sometimes need to connect to that uses WPA2 with EAP-TTLS and PAP as "inner" protocol.
I've been sent a certificate file (presumably for the TTLS to work) and given ...
- 196
3
votes
1
answer
3k
views
WPA2-EAP and Captive Portal
Is it possible to use Captive Portal for WiFi and WPA2-EAP at the same time?
Is there any EAP supporting Captive Portal?
For example - user connects to WiFi, goes to Captive Portal over unsecure ...
- 73
0
votes
1
answer
152
views
WPA2-Enterprise certs vs HTTPS certs
I was trying to download the certificate for a WPA2-Enterpise network I was connecting to. However, when I clicked on the link to install it, the browser said the cert was already installed as a CA. ...
- 737
8
votes
1
answer
417
views
How to provide user friendly WiFi access to gym members with WPA2 Enterprise?
Background
A friend of mine is the owner of a medium sized gym. He wants to provide WiFi to his customers and asked me to come up with a concept and eventually also deploy it. As a computer scientist ...
2
votes
2
answers
264
views
What auth info is locally revealed with eduroam WPA-Enterprise 802.1X?
If you authenticated with your eduroam credentials at a participating institution, your home institution is the one doing the authentication of the credentials, and the host institution is only ...
- 1,914
1
vote
0
answers
526
views
Guide on how to create certificates and setup an EAP-TLS on debian [closed]
I need to create an EAP-TLS authentication using a freeradius.
Currently I am a working EAp-PEAP setup, it is working fine.
However, I now needs to move to an EAP-TLS. For this I need to create some ...
- 11
2
votes
2
answers
3k
views
WPA with PSK and with Radius Server
In case of WPA2 using the Radius server, every client gets its own username and password. But what is the case in the WPA2 using a PSK without the authenticating server. In this case also we have a 4 ...
- 125
4
votes
3
answers
1k
views
Segregating a Printer in my Enterprise Network
I have a EAP-TLS network at home which I've managed for some time now. I just got a new Brother HL-5470 printer so I can finally print things at home, which is really nice.
The only problem is that ...
- 6,743