On Wed, Jul 20, 2016 at 03:13:25PM +0200, Linus Lüssing wrote: > I'm currently trying to get a hostapd v2.3 running for WPA-EAP on > a Debian unstable (kernel 4.6). I am trying to connect with a Nokia N900 > (OS: Linux/Maemo) which unfortunately always results in the lines: > > wlan0: STA 00:0d:d5:8c:7a:97 IEEE 802.1X: authentication failed - EAP type: 0 ((null)) > wlan0: STA 00:0d:d5:8c:7a:97 IEEE 802.1X: Supplicant used different EAP type: 1 (Identity) This indicates that authentication failed very early after the identify exchange (in processing TLS ClientHello based on the logs in this email thread). > On the N900 GUI I have selected the following options: > > ----- > EAP Type: TTLS > Certificate: None > EAP Methode: EAP-MSCHAPv2 > User: testuser > Password: testpw > ----- > > On the hostapd side, eap_user.conf looks like this: > > ----- > "testuser" TTLS > "testuser" TTLS-MSCHAPV2 "testpw" [2] This does not match the client side configuration. TTLS-MSCHAPV2 is the non-EAP version of MSCHAPV2 with EAP-TTLS while the client side has been configured to use the EAP-version of MSCHAPV2 within EAP-TTLS. This will fail authentication, but that would happen number of messages later than the earlier issue you are seeing now.. > PS: The following combinations did not work either, they resulted > in the same output and error on the hostapd side: > > ----- > N900: EAP Type: TTLS; EAP Methode: MSCHAPv2 (instead of "EAP-MSCHAPv2") > eap_user.conf: phase1 -> TTLS, phase2 -> TTLS-MSCHAPV2 This has matching configuration. > N900: EAP Type: TTLS; EAP Methode: EAP-MSCHAPv2 (or just "MSCHAPv2") > eap_user.conf: phase1 -> TTLS, phase2 -> MSCHAPV2 (instead of "TTLS-MSCHAPV2") So does this. > N900: EAP Type: PEAP; EAP Methode: EAP-MSCHAPv2 > eap_user.conf: phase1 -> PEAP, phase2 -> MSCHAPv2 And this. Anyway, the earlier issue with TLS ClientHello prevents you from hitting the place where the failures related to the Phase 2 (authentication within the TLS tunnel) of EAP-TTLS. -- Jouni Malinen PGP id EFC895FA _______________________________________________ Hostap mailing list Hostap@xxxxxxxxxxxxxxxxxxx http://lists.infradead.org/mailman/listinfo/hostap
