From owner-freebsd-net@freebsd.org Sun Jan 14 06:31:51 2018 Return-Path: Delivered-To: freebsd-net@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 8F68BE7E98C for ; Sun, 14 Jan 2018 06:31:51 +0000 (UTC) (envelope-from vas@mpeks.tomsk.su) Received: from relay2.tomsk.ru (mail.sibptus.tomsk.ru [212.73.124.5]) by mx1.freebsd.org (Postfix) with ESMTP id F24C66E255 for ; Sun, 14 Jan 2018 06:31:49 +0000 (UTC) (envelope-from vas@mpeks.tomsk.su) X-Virus-Scanned: by clamd daemon 0.98.5_1 for FreeBSD at relay2.tomsk.ru Received: from [212.73.125.240] (HELO admin.sibptus.transneft.ru) by relay2.tomsk.ru (CommuniGate Pro SMTP 5.1.16) with ESMTPS id 39912301; Sun, 14 Jan 2018 12:26:58 +0600 Received: from admin.sibptus.transneft.ru (sudakov@localhost [127.0.0.1]) by admin.sibptus.transneft.ru (8.15.2/8.15.2) with ESMTP id w0E6ViwR028855; Sun, 14 Jan 2018 13:31:46 +0700 (+07) (envelope-from vas@mpeks.tomsk.su) Received: (from sudakov@localhost) by admin.sibptus.transneft.ru (8.15.2/8.15.2/Submit) id w0E6Vek0028854; Sun, 14 Jan 2018 13:31:40 +0700 (+07) (envelope-from vas@mpeks.tomsk.su) X-Authentication-Warning: admin.sibptus.transneft.ru: sudakov set sender to vas@mpeks.tomsk.su using -f Date: Sun, 14 Jan 2018 13:31:40 +0700 From: Victor Sudakov To: Marek Zarychta Cc: freebsd-net@freebsd.org Subject: Re: Fwd: Re: Quasi-enterprise WiFi network Message-ID: <20180114063140.GA28750@admin.sibptus.transneft.ru> References: <20180107180422.GA46756@admin.sibptus.transneft.ru> <52165.108.68.171.12.1515350430.squirrel@cosmo.uchicago.edu> <20180108072035.GB52442@admin.sibptus.transneft.ru> <20180113095553.GA19901@admin.sibptus.transneft.ru> <20180113110739.GA20415@admin.sibptus.transneft.ru> <20180113144157.GA33988@plan-b.pwste.edu.pl> MIME-Version: 1.0 Content-Type: text/plain; charset=koi8-r Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20180113144157.GA33988@plan-b.pwste.edu.pl> Organization: AO "Svyaztransneft", SibPTUS X-PGP-Key: http://www.dreamwidth.org/pubkey?user=victor_sudakov X-PGP-Fingerprint: 10E3 1171 1273 E007 C2E9 3532 0DA4 F259 9B5E C634 User-Agent: Mutt/1.9.1 (2017-09-22) X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Jan 2018 06:31:51 -0000 Marek Zarychta wrote: > On Sat, Jan 13, 2018 at 06:07:39PM +0700, Victor Sudakov wrote: > > Eitan Adler wrote: > > > > > > > > > > > > Are there any network experts willing to look at the dump of RADIUS > > > > traffic at http://noc.sibptus.ru/~sudakov/radius.pcap ? > > > > > > > > > >From wireshark: PEAP / EAP-MD5-CHALLENGE > > > > Eitan, do you mean it's EAP-MD5 encapsulated in PEAP (TLS tunnel)? > > > > Why is the client not checking the server's certificate authenticity > > and how do I make the client check it against a CA (if I need to)? > > Dear Виктор, > > Android client doesn't care for server certificate authenticity, so you > don't have to install CA certificate, which was probably automatically > generated by radius and written to file: > /usr/local/etc/raddb/certs/ca.der $raddbdir/certs/{server,ca}.pem for the server and CA respectively, if I read mods-enabled/eap correctly. > > Windows and Mac clients do care for it, so the CA cert should be > installed as a Trusted Root Certificate Authority for these clients. This is bad news for me. However I'll report here when I have experimented with different supplicants. > > If you want to have 0 problems with Windows clients, I recommend building > simple captive portal based on PF redirection and simple login page. There are ready-to-use captive portals in pfSense and m0n0wall (I did not test the latter though), so I think there is no need for me to code in PHP or whatever. What I'm trying to avoid is deploying a dedicated FreeBSD/pfSense box at remote hotspots. And the TL-WR740N router/AP does not do any traffic tunneling via a central hub (or I have not found a way to enable it). Do you know how commercial captive portals handle this problem? Do they install their own box near every customer's AP? -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN AS43859