Sophie: howto-html-en-20080722-2mdv2010.1 noarch

howto-html-en-20080722-2mdv2010.1.noarch.rpm

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML
><HEAD
><TITLE
>Supplicant: Setting up Xsupplicant</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK
REL="HOME"
TITLE="802.1X Port-Based Authentication HOWTO"
HREF="index.html"><LINK
REL="PREVIOUS"
TITLE="Authentication Server: Setting up FreeRADIUS"
HREF="freeradius.html"><LINK
REL="NEXT"
TITLE="Authenticator: Setting up the Authenticator (Access
 Point)"
HREF="authenticator.html"></HEAD
><BODY
CLASS="sect1"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>802.1X Port-Based Authentication HOWTO</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="freeradius.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
></TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="authenticator.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="sect1"
><H1
CLASS="sect1"
><A
NAME="xsupplicant"
></A
>4. Supplicant: Setting up Xsupplicant</H1
><P
>&#13; The Supplicant is usually a laptop or other (wireless) device that
 requires authentication. <SPAN
CLASS="application"
>Xsupplicant</SPAN
>
 does the bidding of being the <SPAN
CLASS="QUOTE"
>"Supplicant"</SPAN
> part of the
 IEEE 802.1X-2001 standard.
 </P
><DIV
CLASS="sect2"
><H2
CLASS="sect2"
><A
NAME="instxsup"
></A
>4.1. Installing Xsupplicant</H2
><DIV
CLASS="procedure"
><P
><B
>Installing Xsupplicant</B
></P
><OL
TYPE="1"
><LI
><P
>&#13;    Download the latest source from from <A
HREF="http://www.open1x.org/"
TARGET="_top"
>http://www.open1x.org/</A
> 
    </P
><TABLE
BORDER="0"
BGCOLOR="#E0E0E0"
WIDTH="100%"
><TR
><TD
><FONT
COLOR="#000000"
><PRE
CLASS="screen"
>&#13;    <TT
CLASS="prompt"
># </TT
><TT
CLASS="userinput"
><B
><B
CLASS="command"
>cd </B
>/usr/local/src</B
></TT
>
    <TT
CLASS="prompt"
># </TT
><TT
CLASS="userinput"
><B
><B
CLASS="command"
>wget </B
>http://belnet.dl.sourceforge.net/sourceforge/open1x/xsupplicant-1.0.tar.gz</B
></TT
>
    <TT
CLASS="prompt"
># </TT
><TT
CLASS="userinput"
><B
><B
CLASS="command"
>tar </B
>zxfv xsupplicant-1.0.tar.gz</B
></TT
>
    <TT
CLASS="prompt"
># </TT
><TT
CLASS="userinput"
><B
><B
CLASS="command"
>cd </B
>xsupplicant</B
></TT
>
    </PRE
></FONT
></TD
></TR
></TABLE
></LI
><LI
><P
>&#13;    Configure, make, and install:
    </P
><TABLE
BORDER="0"
BGCOLOR="#E0E0E0"
WIDTH="100%"
><TR
><TD
><FONT
COLOR="#000000"
><PRE
CLASS="screen"
>&#13;    <TT
CLASS="prompt"
># </TT
><TT
CLASS="userinput"
><B
><B
CLASS="command"
>./configure</B
></B
></TT
>
    <TT
CLASS="prompt"
># </TT
><TT
CLASS="userinput"
><B
><B
CLASS="command"
>make</B
></B
></TT
>
    <TT
CLASS="prompt"
># </TT
><TT
CLASS="userinput"
><B
><B
CLASS="command"
>make install</B
></B
></TT
>
    </PRE
></FONT
></TD
></TR
></TABLE
></LI
><LI
><P
>&#13;    If the configuration file wasn't installed (copied) into the "etc"
    folder, do it manually:
    </P
><TABLE
BORDER="0"
BGCOLOR="#E0E0E0"
WIDTH="100%"
><TR
><TD
><FONT
COLOR="#000000"
><PRE
CLASS="screen"
>&#13;    <TT
CLASS="prompt"
># </TT
><TT
CLASS="userinput"
><B
><B
CLASS="command"
>mkdir </B
>-p /usr/local/etc/1x</B
></TT
>
    <TT
CLASS="prompt"
># </TT
><TT
CLASS="userinput"
><B
><B
CLASS="command"
>cp </B
>etc/tls-example.conf /usr/local/etc/1x</B
></TT
>
    </PRE
></FONT
></TD
></TR
></TABLE
></LI
></OL
></DIV
><P
>&#13;  If installation fails, check the <TT
CLASS="filename"
>README</TT
> and
  <TT
CLASS="filename"
>INSTALL</TT
> files included with the source. You may
  also check out the <A
HREF="http://sourceforge.net/docman/display_doc.php?docid=23371&#38;group_id=60236"
TARGET="_top"
>official
  documentation</A
>.
  </P
></DIV
><DIV
CLASS="sect2"
><H2
CLASS="sect2"
><A
NAME="confxsup"
></A
>4.2. Configuring Xsupplicant</H2
><DIV
CLASS="procedure"
><P
><B
>Configuring Xsupplicant</B
></P
><OL
TYPE="1"
><LI
><P
>&#13;   The Supplicant must have access to the root certificate.
   </P
><P
>&#13;   If the Supplicant needs to authenticate against the Authentication
   Server (authentication both ways), the Supplicant must have
   certificates as well.
   </P
><P
>&#13;   Create a certificate folder, and move the certificates into it: 
   </P
><TABLE
BORDER="0"
BGCOLOR="#E0E0E0"
WIDTH="100%"
><TR
><TD
><FONT
COLOR="#000000"
><PRE
CLASS="screen"
>&#13;    <TT
CLASS="prompt"
># </TT
><TT
CLASS="userinput"
><B
><B
CLASS="command"
>mkdir</B
> -p /usr/local/etc/1x/certs</B
></TT
>
    <TT
CLASS="prompt"
># </TT
><TT
CLASS="userinput"
><B
><B
CLASS="command"
>cp</B
> root.pem /usr/local/etc/1x/certs/</B
></TT
>
    <TT
CLASS="prompt"
># </TT
>(copy optional client certificate(s) into the same folder)
   </PRE
></FONT
></TD
></TR
></TABLE
></LI
><LI
><P
>&#13;   Open and edit the configuration file:
   </P
><TABLE
BORDER="0"
BGCOLOR="#E0E0E0"
WIDTH="100%"
><TR
><TD
><FONT
COLOR="#000000"
><PRE
CLASS="programlisting"
>&#13;   # startup_command: the command to run when Xsupplicant is first started.
   #   This command can do things such as configure the card to associate with
   #   the network properly.
   startup_command = &#60;BEGIN_COMMAND&#62;/usr/local/etc/1x/startup.sh&#60;END_COMMAND&#62;
   </PRE
></FONT
></TD
></TR
></TABLE
><P
>&#13;   The <TT
CLASS="filename"
>startup.sh</TT
> will be created shortly.
   </P
></LI
><LI
><P
>&#13;   When the client is authenticated, it will transmit a DHCP request or
   manually set an IP address. Here, the Supplicant sets its IP address
   manually in <TT
CLASS="filename"
>startup2.sh</TT
>:
   </P
><TABLE
BORDER="0"
BGCOLOR="#E0E0E0"
WIDTH="100%"
><TR
><TD
><FONT
COLOR="#000000"
><PRE
CLASS="programlisting"
>&#13;   # first_auth_command: the command to run when Xsupplicant authenticates to
   #   a wireless network for the first time.  This will usually be used to
   #   start a DHCP client process.
   #first_auth_command = &#60;BEGIN_COMMAND&#62;dhclient %i&#60;END_COMMAND&#62;
   first_auth_command = &#60;BEGIN_COMMAND&#62;/usr/local/etc/1x/startup2.sh&#60;END_COMMAND&#62;
   </PRE
></FONT
></TD
></TR
></TABLE
></LI
><LI
><P
>&#13;   Since <SPAN
CLASS="QUOTE"
>"-i"</SPAN
> is just for debugging purpose (and may
   go away according to the developers),
   <SPAN
CLASS="QUOTE"
>"allow_interfaces"</SPAN
> must be set:
   </P
><TABLE
BORDER="0"
BGCOLOR="#E0E0E0"
WIDTH="100%"
><TR
><TD
><FONT
COLOR="#000000"
><PRE
CLASS="programlisting"
>&#13;   allow_interfaces = eth0
   deny_interfaces = eth1
   </PRE
></FONT
></TD
></TR
></TABLE
></LI
><LI
><P
>&#13;   Next, under the <SPAN
CLASS="QUOTE"
>"NETWORK SECTION"</SPAN
>, we'll configure
   PEAP:
   </P
><TABLE
BORDER="0"
BGCOLOR="#E0E0E0"
WIDTH="100%"
><TR
><TD
><FONT
COLOR="#000000"
><PRE
CLASS="programlisting"
>&#13;   # We'll be using PEAP
   allow_types = eap_peap

   # Don't want any eavesdropper to learn the username during the
   # first phase (which is unencrypted), so 'identity hiding' is 
   # used (using a bogus username).
   identity = &#60;BEGIN_ID&#62;anonymous&#60;END_ID&#62;

   eap-peap {
      # As in tls, define either a root certificate or a directory
      # containing root certificates.
      root_cert = /usr/local/etc/1x/certs/root.pem
      #root_dir = /path/to/root/certificate/dir
      #crl_dir = /path/to/dir/with/crl
      chunk_size = 1398
      random_file = /dev/urandom
      #cncheck = myradius.radius.com   # Verify that the server certificate
                                       # has this value in its CN field.
      #cnexact = yes                   # Should it be an exact match?
      session_resume = yes

      # Currently 'all' is just mschapv2.
      # If no allow_types is defined, all is assumed.
      #allow_types = all # where all = MSCHAPv2, MD5, OTP, GTC, SIM
      allow_types = eap_mschapv2

      # Right now, you can do any of these methods in PEAP:
      eap-mschapv2 {
        username = &#60;BEGIN_UNAME&#62;testuser&#60;END_UNAME&#62;
        password = &#60;BEGIN_PASS&#62;Secret149&#60;END_PASS&#62;
      }
   }
   </PRE
></FONT
></TD
></TR
></TABLE
></LI
><LI
><P
>&#13;   The Supplicant must first associate with the access point. The
   script <TT
CLASS="filename"
>startup.sh</TT
> does that job. It is also
   the first command <SPAN
CLASS="application"
>Xsupplicant</SPAN
> executes.
   </P
><DIV
CLASS="note"
><P
></P
><TABLE
CLASS="note"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="../images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>&#13;   Notice the bogus key we give to iwconfig (<EM
>enc
   000000000</EM
>)! This key is used to tell the driver
   to run in encrypted mode. The key gets replaced after successful
   authentication. This can be set to <EM
>enc 
   off</EM
> only if encryption is disabled in the AP (for
   testing purposes).
   </P
></TD
></TR
></TABLE
></DIV
><P
>&#13;   Both <TT
CLASS="filename"
>startup.sh</TT
> and
   <TT
CLASS="filename"
>startup2.sh</TT
> must be saved under
   <TT
CLASS="filename"
>/usr/local/etc/1x/</TT
>.
   </P
><TABLE
BORDER="0"
BGCOLOR="#E0E0E0"
WIDTH="100%"
><TR
><TD
><FONT
COLOR="#000000"
><PRE
CLASS="programlisting"
>&#13;   #!/bin/bash
   echo "Starting startup.sh"
   # Take down interface (if it's up)
   /sbin/ifconfig eth0 down
   # To make sure the routes are flushed
   sleep 1
   # Configuring the interface with a bogus key
   /sbin/iwconfig eth0 mode managed essid testnet enc 000000000
   # Bring the interface up and make sure it listens to multicast packets
   /sbin/ifconfig eth0 allmulti up
   echo "Finished startup.sh"
   </PRE
></FONT
></TD
></TR
></TABLE
></LI
><LI
><P
>&#13;   This next file is used to set the IP address statically. This can
   be omitted if a DHCP server is present (as it typically is, in many
   access points).
   </P
><TABLE
BORDER="0"
BGCOLOR="#E0E0E0"
WIDTH="100%"
><TR
><TD
><FONT
COLOR="#000000"
><PRE
CLASS="programlisting"
>&#13;   #!/bin/bash
   echo "Starting startup2.sh"
   # Assigning an IP address
   /sbin/ifconfig eth0 192.168.1.5 netmask 255.255.255.0
   echo "Finished startup2.sh"
   </PRE
></FONT
></TD
></TR
></TABLE
></LI
></OL
></DIV
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="freeradius.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="index.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="authenticator.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Authentication Server: Setting up FreeRADIUS</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
>&nbsp;</TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Authenticator: Setting up the Authenticator (Access
 Point)</TD
></TR
></TABLE
></DIV
></BODY
></HTML
>