Hello,
After reading
https://w1.fi/cgit/hostap/tree/hostapd/hostapd.eap_user
I'm trying to find a way to configure hostapd user database for
integrated EAP server (hostapd.eap_user text file) to allow only a few
client certs to be allowed to connect to AP using EAP-TLS.
I'm using hostapd 2:2.7+git20190128+0c1e29f-6+deb10u2 from Debian 10.
I would like only valid certs with CN=user1 and CN=user2 to be allowed
to connect. Valid certs from same CA but with different CN (i.e.
CN=user3) should NOT be allowed to connect.
With hostapd.eap_user
* TLS
"user1" TLS
"user2" TLS
or
* TLS
"user1" TLS [2]
"user2" TLS [2]
client using identity=user3 and valid cert with CN=user3 is allowed to
connect to AP.
With hostapd.eap_user
"user1" TLS
"user2" TLS
client using identity=user3 and valid cert with CN=user3 is NOT allowed
to connect to AP (blocked in phrase#1) but the same user may change
identity in connection properties and connect succesfully with
identity=user1 and valid cert with CN=user3.
How to force hostapd integrated EAP server (without external radius
service) to verify common name from client certs and allow only certs
with CN=user1 and CN=user2 to connect regardless of identity sent in
phrase#1 (here any login should be directed to TLS because identity is
not signed by CA = not trusted)?
--
Regards,
Paweł Bogusławski
IB Development Team
E: dev@xxxxx
_______________________________________________
Hostap mailing list
Hostap@xxxxxxxxxxxxxxxxxxx
http://lists.infradead.org/mailman/listinfo/hostap
