Hallo zusammen,
ich versuche gerade den WLAN-Zugang über WPA2-Enterprise zu realisieren. Daszu habe ich auf dem Server, wie in der Doku beschreiebn, die WLAN-Zertifikate eingerichtet.
Die Konfiguration des Radius-Servers hat ganz gut geklappt:
ba@r100-pc01:~$ radtest ba Muster! server:1812 10 Muster!
Sent Access-Request Id 64 from 0.0.0.0:35080 to 10.32.0.1:1812 length 72
User-Name = "ba"
User-Password = "Muster!"
NAS-IP-Address = 127.0.1.1
NAS-Port = 10
Message-Authenticator = 0x00
Cleartext-Password = "Muster!"
Received Access-Accept Id 64 from 10.32.0.1:1812 to 10.32.100.1:35080 length 38
Message-Authenticator = 0xa8f61e0a34e468f753884475997e4146
Dann habe ich mit der Erstellung der Zertifikate weiter gemacht.
Bei der Beantragung eines neuen Zertifikats habe ich Folgendes eingegeben:
root@server:/etc/linuxmuster/ssl# openssl req -new -key radius-key.pem -out radius.csr -sha512
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:DE
State or Province Name (full name) [Some-State]:BaWue
Locality Name (eg, city) []:Musterstadt
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Musterstadt
Organizational Unit Name (eg, section) []:Netzwerk
Common Name (e.g. server FQDN or YOUR name) []:radius.linuxmuster.lan
Email Address []:sysadmin@linuxmuster.lan
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:Muster!
An optional company name []:Name2
Was ist eigentlich dieses challenge password?
Zum Ausstellen des Zertifikats bin ich, wie in der Anleitung beschrieben, vorgegangen:
root@server:/etc/linuxmuster/ssl# openssl x509 -req -in radius.csr -CA /etc/linuxmuster/ssl/cacert.pem -CAkey /etc/linuxmuster/ssl/cakey.pem -CAcreateserial -out radius.pem -days 365 -sha512
Certificate request self-signature ok
subject=C = DE, ST = BaWue, L = Musterstadt, O = Musterstadt, OU = Netzwerk, CN = radius.linuxmuster.lan, emailAddress = sysadmin@linuxmuster.lan
Enter pass phrase for /etc/linuxmuster/ssl/cakey.pem:
Die nötige pass phrase habe ich mit cat /etc/linuxmuster/.secret/cakey ermttelt.
In /etc/freeradius/3.0/mods-enabled/eap habe ich Folgendes eingetragen:
private_key_password = Muster!
private_key_file = /etc/freeradius/3.0/certs/radius-key.pem
certificate_file = /etc/freeradius/3.0/certs/fullchain.pem
ca_file = /etc/freeradius/3.0/certs/cacert.pem
Wenn ich mich jetzt an einem WLAN-Client anmelden möchte, bekomme ich mit freeradius -X das:
...
Found Auth-Type = eap
(5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(5) authenticate {
(5) eap: Removing EAP session with state 0x1f0c3ef21b952734
(5) eap: Previous EAP request found for state 0x1f0c3ef21b952734, released from the list
(5) eap: Peer sent packet with method EAP PEAP (25)
(5) eap: Calling submodule eap_peap to process data
(5) eap_peap: (TLS) EAP Peer says that the final record size will be 7 bytes
(5) eap_peap: (TLS) EAP Got all data (7 bytes)
(5) eap_peap: (TLS) PEAP - recv TLS 1.2 Alert, fatal unknown_ca
(5) eap_peap: (TLS) PEAP - The client is informing us that it does not recognize the CA used to issue the server certificate. Please update the client so that it knows about the CA.
(5) eap_peap: ERROR: (TLS) PEAP - Alert read:fatal:unknown CA
(5) eap_peap: (TLS) PEAP - Server : Need to read more data: error
(5) eap_peap: ERROR: (TLS) Failed reading from OpenSSL: error:0A000418:SSL routines::tlsv1 alert unknown ca
(5) eap_peap: (TLS) PEAP - In Handshake Phase
(5) eap_peap: (TLS) PEAP - Application data.
(5) eap_peap: ERROR: (TLS) Cannot continue, as the peer is misbehaving.
(5) eap_peap: ERROR: [eaptls process] = fail
(5) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed
(5) eap: Sending EAP Failure (code 4) ID 153 length 4
Das gleiche Ergebnis erhalte ich auch, wenn ich private_key_password = Muster! auskommentiere 
Kann mir jemand sagen, an welcher Stelle ich falsch abgebogen bin?
Für einen Tip wäre ich echt dankbar.
Gruß
Mathias
