Using FreeRadius to authenticate your WPA enterprise mobile users is comparatively easy especially if you use daloRadius to manage your users however setting up the certificates that you need for it to work with more recent android phones is poorly documented and if you only have a hazy idea of how certificates work can be frustrating.<\/p>\n\n\n\n
In this short article I’ll try and explain how to set up FreeRadius with PEAP authentication including what to do to install the Certification Authority certificate on your android mobile.<\/p>\n\n\n\n
I’m not going to explain how to install FreeRadius or daloRadius. There are good tutorials out on the web and it is comparatively simple to set up your server. What is less obvious is setting up the certificates you need for your phone to accept that the radius server you are running is the one that it expects. Consider why this is important. In a corporate setting, or something like a university campus it is quite possible for a bad character to set up a wireless access point (WAP) that masquerades as the official network. If a user can be fooled into connecting to this bogus network then all his data is available for inspection: credit card numbers, passwords and corporate data. Somehow the user needs a means of being confident that the WAP he is connected to is a real one. And this is where certificates come into play.<\/p>\n\n\n\n
The protocol used to authenticate a user onto the network is called RADIUS, short for Remote Authentication Dial-In User Service. The reference to dial-in gives a clue as to how old it is, it dates back to the early days of the internet when a common means of connection was to dial in over a phone line. RADIUS allows for a centralised management of usernames and passwords to connect to networks. These days it is very commonly used to authenticate users onto wifi networks and an opensource implementation of RADIUS is the FreeRadius software package.<\/p>\n\n\n\n
I’m assuming that you are running a Linux server and that you have installed FreeRadius and got it to authenticate users onto your wifi network using a simple password. However, users with an android phone will have found recently that they can no longer connect because the option to ignore network credentials has been greyed out. This was a conscious decision by the android developers to try and improve overall network security but it has left a whole set of users and network administrators with non-functional network connections. Fortunately FreeRadius has all the tools to create and install self-signed certificates to get connected again. So, lets go…<\/p>\n\n\n\n
First this to do is go to the certificates directory on your FreeRadius server <\/p>\n\n\n\n
\n$ cd \/etc\/freeradius\/3.0\/certs<\/p>\n<\/blockquote>\n\n\n\n
There are all the tools you need in this directory. <\/p>\n\n\n\n
Generating a CA certificate<\/h2>\n\n\n\n
You are going to generate a self signed Certification Authority (CA) certificate and then use it to generate a signed server certificate. Let’s start with the CA certificate.<\/p>\n\n\n\n
Look for the file ca.cnf <\/em>in this directory and open it for editing<\/p>\n\n\n\n
\n$ sudo nano ca.cnf<\/p>\n<\/blockquote>\n\n\n\n
Your now need to find the section that is describing your organisation<\/p>\n\n\n\n
\n[certificate_authority]
countryName = FR
stateOrProvinceName = Radius
localityName = Somewhere
organizationName = Example Inc.
emailAddress = admin@example.org
commonName = “Example Certificate Authority”<\/p>\n<\/blockquote>\n\n\n\nThis is the default information and you will want to update it with your real data<\/p>\n\n\n\n
\n[certificate_authority]
countryName = US
stateOrProvinceName = Wisconsin
localityName = Whitewater
organizationName = Purple Skyhooks Inc.
emailAddress = admin@purple-skyhooks.com
commonName = “Purple Skyhooks Certificate Authority”<\/p>\n<\/blockquote>\n\n\n\nYou will also want to choose a password for accessing this certificate for when you want to sign something and you need to add this into the password section of the ca.cnf file<\/p>\n\n\n\n
\n[ req ]
prompt = no
distinguished_name = certificate_authority
default_bits = 2048
input_password = whatever
output_password = whatever
x509_extensions = v3_ca<\/p>\n<\/blockquote>\n\n\n\ngiving you something like<\/p>\n\n\n\n
\n[ req ]
prompt = no
distinguished_name = certificate_authority
default_bits = 2048
input_password = hqa7ara4mcr@zqk3WNA
output_password = hqa7ara4mcr@zqk3WNA
x509_extensions = v3_ca<\/p>\n<\/blockquote>\n\n\n\nFinally you may want to extend the life of your certificate by editing<\/p>\n\n\n\n
\ndefault_days = 60<\/p>\n<\/blockquote>\n\n\n\n
To something more lengthy. Choose a period that balances security (short life) against convenience (long life). I tend to choose something like 400 days otherwise you will spend the whole of your life generating and distributing CA certificates.<\/p>\n\n\n\n
Now you are ready to generate your CA certificates<\/p>\n\n\n\n
\n$ sudo make ca.pem<\/p>\n<\/blockquote>\n\n\n\n
This will generate a private key file ca.key<\/em> and a public certificate file ca.pem<\/em>. The private key file must remain private and secure and generally will not leave your server. It will be used to sign <\/em>the server certificate that you will generate in the next step.<\/p>\n\n\n\n
Generating a server certificate<\/h2>\n\n\n\n
Now we will edit the server.cnf <\/em>in a similar way to describe our FreeRadius server. We start by modifying the [server] section to describe our radius server<\/p>\n\n\n\n
\n[server]
countryName = US
stateOrProvinceName = Delaware
localityName = New Castle
organizationName = Grabitt Radius Services
emailAddress = dodgy_radius@grabbit-radius.com
commonName = “server1.grabbit-radius.com”<\/p>\n<\/blockquote>\n\n\n\nThe important attribute here is the commonName <\/em>value which should be set to a fully qualified domain name FQDN. This name does not have to actually exist in the DNS but you will use it later when setting up your phone. But it makes sense to set it to something reasonable.<\/p>\n\n\n\n
You will also have to set up the password values and the default-days <\/em>value to give the certificate a reasonable life. Same security\/convenience trade-off as above.<\/p>\n\n\n\n
Now generate the server certificate and key by typing<\/p>\n\n\n\n
\n$ sudo make server.pem<\/p>\n<\/blockquote>\n\n\n\n
This will generate a private key file server.key <\/em>and a certificate file server.pem.<\/em><\/p>\n\n\n\n
The last thing to do is to change the ownership of the files to the freeradius user so that the radius server can read them<\/p>\n\n\n\n
\n$ sudo chown freerad.freerad server.key server.pem ca.pem<\/p>\n<\/blockquote>\n\n\n\n
Configuring the FreeRadius server<\/h2>\n\n\n\n
Now it’s time to tell the FreeRadius server about the certificates you’ve just generated. Go to the EAP module configuration file<\/p>\n\n\n\n
\n$ cd ..\/mods-enabled<\/p>\n\n\n\n
$ sudo nano eap<\/p>\n<\/blockquote>\n\n\n\n
and find the tls-config tls-common<\/em> section<\/p>\n\n\n\n
Edit the following lines<\/p>\n\n\n\n
\nprivate_key_password = whatever
private_key_file = \/etc\/ssl\/private\/ssl-cert-snakeoil.key<\/p>\n<\/blockquote>\n\n\n\nand change them to<\/p>\n\n\n\n
\nprivate_key_password = <the password you chose for server.cnf>
private_key_file = ${certdir}\/server.key<\/p>\n<\/blockquote>\n\n\n\nThen find the line<\/p>\n\n\n\n
\ncertificate_file = \/etc\/ssl\/certs\/ssl-cert-snakeoil.pem<\/p>\n<\/blockquote>\n\n\n\n
and replace it with<\/p>\n\n\n\n
\ncertificate_file = ${certdir}\/server.pem<\/p>\n<\/blockquote>\n\n\n\n
Find the line<\/p>\n\n\n\n
\nca_file = \/etc\/ssl\/certs\/ca-certificates.crt<\/p>\n<\/blockquote>\n\n\n\n
and replace it with<\/p>\n\n\n\n
\nca_file = ${certdir}\/ca.pem<\/p>\n<\/blockquote>\n\n\n\n
and save the file.<\/p>\n\n\n\n
You now need to restart the FreeRadius server <\/p>\n\n\n\n
\n$ sudo service freeradius restart<\/p>\n<\/blockquote>\n\n\n\n
and your WPA Enterprise wifi network will be running with a self-signed certificate. <\/p>\n\n\n\n
Configuring your Android phones<\/h2>\n\n\n\n
Install the CA certificate<\/h2>\n\n\n\n
You phone now needs to be told to trust the certificate that the RADIUS server is presenting. This is actually fairly simple except for the first part. You are about to encounter at first hand one of the most difficult parts of establishing a trusted connection. Somehow you have to get the ca.pem<\/em> CA certificate onto your phone and you have to do it in a trusted fashion. There are several possible ways to do this:<\/p>\n\n\n\n
\n
- Link your phone to your computer via a USB cable and transfer the file<\/li>\n\n\n\n
- Write the certificate file to an SD card<\/li>\n\n\n\n
- Use a trusted messaging service such as Signal<\/em> or WhatsApp<\/em> to transfer the file.<\/li>\n<\/ul>\n\n\n\n
Once you have it over to your phone go to your settings menu and select <\/p>\n\n\n\n
Security -> Advanced -> Encryption and Credentials -> Install a certificate -> Wi-Fi certificate<\/p>\n\n\n\n
All being well you will then be presented with a file chooser with your ca.pem<\/em> in it. Select the file and give the certificate a name when asked by the pop-up. Choose something obvious like “Corporate Wifi”. Click on OK. You should get a message telling you that the certificate has been installed. Your phone will now trust certificates signed by your Certification Authority.<\/p>\n\n\n\n
Connect to your wi-fi<\/h2>\n\n\n\n
Yes! We’re nearly there. <\/p>\n\n\n\n
Go your network configuration section and select the wi-fi section. You should see the wi-fi network you want displayed (assuming that the network side of things is all set up). Click on this network. You will be presented with a screen with a number of incomprehensible questions:<\/p>\n\n\n\n
\n
- For “EAP method” select “PEAP”<\/li>\n\n\n\n
- For “Phase 2 authentication method” select “MSCHAPV2”<\/li>\n\n\n\n
- For “CA certificate” select the name you gave the CA certificate above (“Corporate Wifi”)<\/li>\n\n\n\n
- For “Domain” select the commonName value you set in the server.cnf file (“server1.grabbit-radius.com”).<\/li>\n\n\n\n
- Fill in your username and password under “Identity” and “Password”.<\/li>\n\n\n\n
- Press “Save”<\/li>\n<\/ul>\n\n\n\n
All being well you will connect securely to the wifi. Subsequent connections will be automatic.<\/p>\n","protected":false},"excerpt":{"rendered":"
Using FreeRadius to authenticate your WPA enterprise mobile users is comparatively easy especially if you use daloRadius to manage your users however setting up the certificates that you need for it to work with more recent android phones is poorly documented and if you only have a hazy idea of how certificates work can be […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":14,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-137","page","type-page","status-publish","hentry","post-preview"],"_links":{"self":[{"href":"https:\/\/www.titley.com\/index.php\/wp-json\/wp\/v2\/pages\/137","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.titley.com\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.titley.com\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.titley.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.titley.com\/index.php\/wp-json\/wp\/v2\/comments?post=137"}],"version-history":[{"count":8,"href":"https:\/\/www.titley.com\/index.php\/wp-json\/wp\/v2\/pages\/137\/revisions"}],"predecessor-version":[{"id":147,"href":"https:\/\/www.titley.com\/index.php\/wp-json\/wp\/v2\/pages\/137\/revisions\/147"}],"up":[{"embeddable":true,"href":"https:\/\/www.titley.com\/index.php\/wp-json\/wp\/v2\/pages\/14"}],"wp:attachment":[{"href":"https:\/\/www.titley.com\/index.php\/wp-json\/wp\/v2\/media?parent=137"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}