TLS accept client certificate failed about hostapd-mana HOT 4 OPEN

from hostapd-mana.

Yeah weird enough my android wifi profile setup let's me connect without providing a client certificate.. I checked the logs and hostapd receives my Identity (hacker) so android seems to accept this. Haven't tested it with a real client cert yet though whether a MITM will work.

wlan0: STA d4:38:9c:60:0f:18 IEEE 802.1X: received EAP packet (code=2 id=204 len=11) from STA: EAP Response-Identity (1) IEEE 802.1X: d4:38:9c:60:0f:18 BE_AUTH entering state RESPONSE EAP: EAP entering state RECEIVED EAP: parseEapResp: rxResp=1 rxInitiate=0 respId=204 respMethod=1 respVendor=0 respVendorMethod=0 EAP: EAP entering state INTEGRITY_CHECK EAP: EAP entering state METHOD_RESPONSE EAP-Identity: Peer identity - hexdump_ascii(len=6): 68 61 63 6b 65 72 hacker EAP: EAP entering state SELECT_ACTION MANA EAP Identity Phase 0: hacker EAP: getDecision: another method available -> CONTINUE EAP: EAP entering state PROPOSE_METHOD EAP: getNextMethod: vendor 0 type 25 wlan0: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=25 EAP: EAP entering state METHOD_REQUEST EAP: building EAP-Request: Identifier 205 EAP-PEAP: START -> PHASE1 EAP: EAP entering state SEND_REQUEST EAP: EAP entering state IDLE

from hostapd-mana.

Your device is trying to connect with PEAP. I've tried, but have been unable to get hostapd to create a network that advertises itself as only EAP-TLS, even with the following directive:

nai_realm=0,MANA,12[5:6]

Which should advertise the network as EAP-TLS, my iOS and macOS devices will still try PEAP.

Also, hostapd.eap_user let's you configure the EAP modes accepted, so by default, hostapd networks will negotiate the EAP type based on what you configure in there, and most device default to PEAP if it's available. Which means, at least on iOS you need a MDM profile to configure EAP-TLS, and on macOS you need to config the network explicitly.

from hostapd-mana.

Thanks singe! I'm going to play with this abit more.

from hostapd-mana.