8021X PortminusBased Authentication HOWTO

Lars Strand

ltlars strand (at) gnist orggt

2004minus08minus18

Revision History

Revision 10 2004minus10minus18 Revised by LKS

Initial Release reviewed by TLDP

Revision 02b 2004minus10minus13 Revised by LKS

Various updates Thanks to Rick Moen ltrick (at) linuxmafia comgt for language review

Revision 00 2004minus07minus23 Revised by LKS

Initial draft

This document describes the software and procedures to set up and use IEEE 8021X PortminusBased NetworkAccess Control using Xsupplicant as Supplicant with FreeRADIUS as a backminusend Authentication Server

Table of Contents1 Introduction1

11 What is 8021X112 What is 80211i3

121 WEP3122 80211i3123 Key Management3124 TSN (WPA) RSN (WPA2)5

13 What is EAP614 EAP authentication methods615 What is RADIUS7

2 Obtaining Certificates8

3 Authentication Server Setting up FreeRADIUS931 Installing FreeRADIUS932 Configuring FreeRADIUS9

4 Supplicant Setting up Xsupplicant1241 Installing Xsupplicant1242 Configuring Xsupplicant12

5 Authenticator Setting up the Authenticator (Access Point)1551 Access Point1552 Linux Authenticator16

6 Testbed1761 Testcase1762 Running some tests17

7 Note about driver support and Xsupplicant20

8 FAQ21

9 Useful Resources22

10 Copyright acknowledgments and miscellaneous23101 Copyright and License23102 How this document was produced23103 Feedback23104 Acknowledgments23

A GNU Free Documentation License24

A1 PREAMBLE25

A2 APPLICABILITY AND DEFINITIONS26

8021X PortminusBased Authentication HOWTO

i

Table of ContentsA3 VERBATIM COPYING28

A4 COPYING IN QUANTITY 29

A5 MODIFICATIONS 30

A6 COMBINING DOCUMENTS32

A7 COLLECTIONS OF DOCUMENTS33

A8 AGGREGATION WITH INDEPENDENT WORKS34

A9 TRANSLATION 35

A10 TERMINATION 36

A11 FUTURE REVISIONS OF THIS LICENSE37

A12 ADDENDUM How to use this License for your documents38

8021X PortminusBased Authentication HOWTO

ii

1 IntroductionThis document describes the software and procedures to set up and use 8021X PortminusBased Network AccessControl using Xsupplicant with PEAP (PEAPMSminusCHAPv2) as authentication method and FreeRADIUS asbackminusend authentication server

If another authentication mechanism than PEAP is preferred eg EAPminusTLS or EAPminusTTLS only a smallnumber of configuration options needs to be changed PEAPMSminusCHAPv2 are also supported by WindowsXP SP1Windows 2000 SP3

11 What is 8021X

The 8021Xminus2001 standard states

Portminusbased network access control makes use of the physical access characteristics of IEEE 802 LANinfrastructures in order to provide a means of authenticating and authorizing devices attached to a LAN portthat has pointminustominuspoint connection characteristics and of preventing access to that port in cases which theauthentication and authorization fails A port in this context is a single point of attachment to the LANinfrastructure minusminusminus 8021Xminus2001 page 1

Figure 8021X A wireless node must be authenticated before it can gain access to other LAN resources

When a new wireless node (WN) requests access to a LAN resource the access point (AP) asks forthe WNs identity No other traffic than EAP is allowed before the WN is authenticated (the port isclosed)

The wireless node that requests authentication is often called Supplicant although it is more correct tosay that the wireless node contains a Supplicant The Supplicant is responsible for responding toAuthenticator data that will establish its credentials The same goes for the access point theAuthenticator is not the access point Rather the access point contains an Authenticator TheAuthenticator does not even need to be in the access point it can be an external component

1

1 Introduction 1

Table of ContentsA3 VERBATIM COPYING28

A4 COPYING IN QUANTITY 29

A5 MODIFICATIONS 30

A6 COMBINING DOCUMENTS32

A7 COLLECTIONS OF DOCUMENTS33

A8 AGGREGATION WITH INDEPENDENT WORKS34

A9 TRANSLATION 35

A10 TERMINATION 36

A11 FUTURE REVISIONS OF THIS LICENSE37

A12 ADDENDUM How to use this License for your documents38

8021X PortminusBased Authentication HOWTO

ii

1 IntroductionThis document describes the software and procedures to set up and use 8021X PortminusBased Network AccessControl using Xsupplicant with PEAP (PEAPMSminusCHAPv2) as authentication method and FreeRADIUS asbackminusend authentication server

If another authentication mechanism than PEAP is preferred eg EAPminusTLS or EAPminusTTLS only a smallnumber of configuration options needs to be changed PEAPMSminusCHAPv2 are also supported by WindowsXP SP1Windows 2000 SP3

11 What is 8021X

The 8021Xminus2001 standard states

Portminusbased network access control makes use of the physical access characteristics of IEEE 802 LANinfrastructures in order to provide a means of authenticating and authorizing devices attached to a LAN portthat has pointminustominuspoint connection characteristics and of preventing access to that port in cases which theauthentication and authorization fails A port in this context is a single point of attachment to the LANinfrastructure minusminusminus 8021Xminus2001 page 1

Figure 8021X A wireless node must be authenticated before it can gain access to other LAN resources

When a new wireless node (WN) requests access to a LAN resource the access point (AP) asks forthe WNs identity No other traffic than EAP is allowed before the WN is authenticated (the port isclosed)

The wireless node that requests authentication is often called Supplicant although it is more correct tosay that the wireless node contains a Supplicant The Supplicant is responsible for responding toAuthenticator data that will establish its credentials The same goes for the access point theAuthenticator is not the access point Rather the access point contains an Authenticator TheAuthenticator does not even need to be in the access point it can be an external component

1

1 Introduction 1

1 IntroductionThis document describes the software and procedures to set up and use 8021X PortminusBased Network AccessControl using Xsupplicant with PEAP (PEAPMSminusCHAPv2) as authentication method and FreeRADIUS asbackminusend authentication server

If another authentication mechanism than PEAP is preferred eg EAPminusTLS or EAPminusTTLS only a smallnumber of configuration options needs to be changed PEAPMSminusCHAPv2 are also supported by WindowsXP SP1Windows 2000 SP3

11 What is 8021X

The 8021Xminus2001 standard states

Portminusbased network access control makes use of the physical access characteristics of IEEE 802 LANinfrastructures in order to provide a means of authenticating and authorizing devices attached to a LAN portthat has pointminustominuspoint connection characteristics and of preventing access to that port in cases which theauthentication and authorization fails A port in this context is a single point of attachment to the LANinfrastructure minusminusminus 8021Xminus2001 page 1

Figure 8021X A wireless node must be authenticated before it can gain access to other LAN resources

When a new wireless node (WN) requests access to a LAN resource the access point (AP) asks forthe WNs identity No other traffic than EAP is allowed before the WN is authenticated (the port isclosed)

The wireless node that requests authentication is often called Supplicant although it is more correct tosay that the wireless node contains a Supplicant The Supplicant is responsible for responding toAuthenticator data that will establish its credentials The same goes for the access point theAuthenticator is not the access point Rather the access point contains an Authenticator TheAuthenticator does not even need to be in the access point it can be an external component

1

1 Introduction 1

EAP which is the protocol used for authentication was originally used for dialminusup PPP The identitywas the username and either PAP or CHAP authentication [RFC1994] was used to check the userspassword Since the identity is sent in clear (not encrypted) a malicious sniffer may learn the usersidentity Identity hiding is therefore used the real identity is not sent before the encrypted TLStunnel is upAfter the identity has been sent the authentication process begins The protocol used between theSupplicant and the Authenticator is EAP or more correctly EAP encapsulation over LAN (EAPOL)The Authenticator reminusencapsulates the EAP messages to RADIUS format and passes them to theAuthentication Server

During authentication the Authenticator just relays packets between the Supplicant and theAuthentication Server When the authentication process finishes the Authentication Server sends asuccess message (or failure if the authentication failed) The Authenticator then opens the port forthe Supplicant

2

After a successful authentication the Supplicant is granted access to other LAN resourcesInternet3

See figure 8021X for explanation

Why is it called portminusbased authentication The Authenticator deals with controlled and uncontrolled portsBoth the controlled and the uncontrolled port are logical entities (virtual ports) but use the same physicalconnection to the LAN (same point of attachment)

Figure port The authorization state of the controlled port

Before authentication only the uncontrolled port is open The only traffic allowed is EAPOL seeAuthenticator System 1 on figure port After the Supplicant has been authenticated the controlled port isopened and access to other LAN resources are granted see Authenticator System 2 on figure port

8021X plays a major role in the new IEEE wireless standard 80211i

8021X PortminusBased Authentication HOWTO

1 Introduction 2

12 What is 80211i

121 WEP

Wired Equivalent Privacy (WEP) which is part of the original 80211 standard should provideconfidentiality Unfortunately WEP is poorly designed and easily cracked There is no authenticationmechanism only a weak form of access control (must have the shared key to communicate) Read more here

As a response to WEP broken security IEEE has come up with a new wireless security standard named80211i 8021X plays a major role in this new standard

122 80211i

The new security standard 80211i which was ratified in June 2004 fixes all WEP weaknesses It is dividedinto three main categories

Temporary Key Integrity Protocol (TKIP) is a shortminusterm solution that fixes all WEP weaknessesTKIP can be used with old 80211 equipment (after a driverfirmware upgrade) and provides integrityand confidentiality

1

Counter Mode with CBCminusMAC Protocol (CCMP) [RFC2610] is a new protocol designed fromground up It uses AES [FIPS 197] as its cryptographic algorithm and since this is more CPUintensive than RC4 (used in WEP and TKIP) new 80211 hardware may be required Some driverscan implement CCMP in software CCMP provides integrity and confidentiality

2

8021X PortminusBased Network Access Control Either when using TKIP or CCMP 8021X is used forauthentication

3

In addition an optional encryption method called Wireless Robust Authentication Protocol (WRAP) may beused instead of CCMP WRAP was the original AESminusbased proposal for 80211i but was replaced by CCMPsince it became plagued by property encumbrances Support for WRAP is optional but CCMP support ismandatory in 80211i

80211i also has an extended key derivationmanagement described next

123 Key Management

1231 Dynamic key exchange and management

To enforce a security policy using encryption and integrity algorithms keys must be obtained Fortunately80211i implements a key derivationmanagement regime See figure KM

8021X PortminusBased Authentication HOWTO

1 Introduction 3

Figure KM Key management and distribution in 80211i

When the Supplicant (WN) and Authentication Server (AS) authenticate one of the last messagessent from AS given that authentication was successful is a Master Key (MK) After it has been sentthe MK is known only to the WN and the AS The MK is bound to this session between the WN andthe AS

1

Both the WN and the AS derive a new key called the Pairwise Master Key (PMK) from the MasterKey

2

The PMK is then moved from the AS to the Authenticator (AP) Only the WN and the AS can derivethe PMK else the AP could make accessminuscontrol decisions instead of the AS The PMK is a freshsymmetric key bound to this session between the WN and the AP

3

PMK and a 4minusway handshake are used between the WN and the AP to derive bind and verify aPairwise Transient Key (PTK) The PTK is a collection of operational keys

Key Confirmation Key (KCK) as the name implies is used to prove the posession of the PMKand to bind the PMK to the AP

diams

Key Encryption Key (KEK) is used to distributed the Group Transient Key (GTK) Describedbelow

diams

Temporal Key 1 amp 2 (TK1TK2) are used for encryption Usage of TK1 and TK2 isciphersuiteminusspecific

diams

See figure PKH for a overview of the Pairwise Key Hierarchy

4

The KEK and a 4minusway group handshake are then used to send the Group Transient Key (GTK) fromthe AP to the WN The GTK is a shared key among all Supplicants connected to the sameAuthenticator and is used to secure multicastbroadcast traffic

5

8021X PortminusBased Authentication HOWTO

1 Introduction 4

Figure PKH Pairwise Key Hierarchy

1232 Preminusshared Key

For small office home office (SOHO) adminushoc networks or home usage a preminusshared key (PSK) may beused When using PSK the whole 8021X authentication process is elided This has also been called WPAPersonal (WPAminusPSK) whereas WPA using EAP (and RADIUS) is WPA Enterprise or just WPA

The 256minusbit PSK is generated from a given password using PBKDFv2 from [RFC2898] and is used as theMaster Key (MK) described in the key management regime above It can be one single PSK for the wholenetwork (insecure) or one PSK per Supplicant (more secure)

124 TSN (WPA) RSN (WPA2)

The industry didnt have time to wait until the 80211i standard was completed They wanted the WEP issuesfixed now WiminusFi Alliance felt the pressure took a snapshot of the standard (based on draft 3) and called itWiminusFi Protected Access (WPA) One requirement was that existing 80211 equipment could be used withWPA so WPA is basically TKIP + 8021X

WPA is not the long term solution To get a Robust Secure Network (RSN) the hardware must support and useCCMP RSN is basically CCMP + 8021X

RSN which uses TKIP instead of CCMP is also called Transition Security Network (TSN) RSN may also be

8021X PortminusBased Authentication HOWTO

1 Introduction 5

Figure PKH Pairwise Key Hierarchy

1232 Preminusshared Key

For small office home office (SOHO) adminushoc networks or home usage a preminusshared key (PSK) may beused When using PSK the whole 8021X authentication process is elided This has also been called WPAPersonal (WPAminusPSK) whereas WPA using EAP (and RADIUS) is WPA Enterprise or just WPA

The 256minusbit PSK is generated from a given password using PBKDFv2 from [RFC2898] and is used as theMaster Key (MK) described in the key management regime above It can be one single PSK for the wholenetwork (insecure) or one PSK per Supplicant (more secure)

124 TSN (WPA) RSN (WPA2)

The industry didnt have time to wait until the 80211i standard was completed They wanted the WEP issuesfixed now WiminusFi Alliance felt the pressure took a snapshot of the standard (based on draft 3) and called itWiminusFi Protected Access (WPA) One requirement was that existing 80211 equipment could be used withWPA so WPA is basically TKIP + 8021X

WPA is not the long term solution To get a Robust Secure Network (RSN) the hardware must support and useCCMP RSN is basically CCMP + 8021X

RSN which uses TKIP instead of CCMP is also called Transition Security Network (TSN) RSN may also be

8021X PortminusBased Authentication HOWTO

1 Introduction 5

called WPA2 so that the market dont get confused

Confused

Basically

TSN = TKIP + 8021X = WPA(1)bull RSN = CCMP + 8021X = WPA2bull

In addition comes key management as described in the previous section

13 What is EAP

Extensible Authentication Protocol (EAP) [RFC 3748] is just the transport protocol optimized forauthentication not the authentication method itself

[EAP is] an authentication framework which supports multiple authentication methods EAP typically runsdirectly over data link layers such as PointminustominusPoint Protocol (PPP) or IEEE 802 without requiring IP EAPprovides its own support for duplicate elimination and retransmission but is reliant on lower layer orderingguarantees Fragmentation is not supported within EAP itself however individual EAP methods may supportthis minusminusminus RFC 3748 page 3

14 EAP authentication methods

Since 8021X is using EAP multiple different authentication schemes may be added including smart cardsKerberos public key one time passwords and others

Some of the mostminusused EAP authentication mechanism are listed below A full list of registered EAPauthentication types is available at IANA httpwwwianaorgassignmentseapminusnumbers

Not all authentication mechanisms are considered secure

EAPminusMD5 MD5minusChallenge requires usernamepassword and is equivalent to the PPP CHAPprotocol [RFC1994] This method does not provide dictionary attack resistance mutualauthentication or key derivation and has therefore little use in a wireless authentication enviroment

bull

Lightweight EAP (LEAP) A usernamepassword combination is sent to a Authentication Server(RADIUS) for authentication Leap is a proprietary protocol developed by Cisco and is notconsidered secure Cisco is phasing out LEAP in favor of PEAP The closest thing to a publishedstandard can be found here

bull

EAPminusTLS Creates a TLS session within EAP between the Supplicant and the Authentication ServerBoth the server and the client(s) need a valid (x509) certificate and therefore a PKI This methodprovides authentication both ways EAPminusTLS is described in [RFC2716]

bull

EAPminusTTLS Sets up a encrypted TLSminustunnel for safe transport of authentication data Within the TLStunnel (any) other authentication methods may be used Developed by Funk Software andMeetinghouse and is currently an IETF draft

bull

Protected EAP (PEAP) Uses as EAPminusTTLS an encrypted TLSminustunnel Supplicant certificates forboth EAPminusTTLS and EAPminusPEAP are optional but server (AS) certificates are required Developedby Microsoft Cisco and RSA Security and is currently an IETF draft

bull

8021X PortminusBased Authentication HOWTO

1 Introduction 6

EAPminusMSCHAPv2 Requires usernamepassword and is basically an EAP encapsulation ofMSminusCHAPminusv2 [RFC2759] Usually used inside of a PEAPminusencrypted tunnel Developed byMicrosoft and is currently an IETF draft

bull

15 What is RADIUS

Remote Authentication DialminusIn User Service (RADIUS) is defined in [RFC2865] (with friends) and wasprimarily used by ISPs who authenticated username and password before the user got authorized to use theISPs network

8021X does not specify what kind of backminusend authentication server must be present but RADIUS is thedeminusfacto backminusend authentication server used in 8021X

There are not many AAA protocols available but both RADIUS and DIAMETER [RFC3588] (including theirextensions) conform to full AAA support AAA stands for Authentication Authorization and Accounting(IETFs AAA Working Group)

8021X PortminusBased Authentication HOWTO

1 Introduction 7

2 Obtaining CertificatesOpenSSL must be installed to use either EAPminusTLS EAPminusTTLS or PEAP

When using EAPminusTLS both the Authentication Server and all the Supplicants (clients) need certificates[RFC2459] Using EAPminusTTLS or PEAP only the Authentication Server requires certificates Supplicantcertificates are optional

You get certificates from the local certificate authority (CA) If there is no local CA available OpenSSL maybe used to generate selfminussigned certificates

Included with the FreeRADIUS source are some helper scripts to generate selfminussigned certificates The scriptsare located under the scripts folder included with the FreeRADIUS source

CAall is a shell script that generates certificates based on some questions it ask CAcerts generatescertificates nonminusinteractively based on preminusdefined information at the start of the script

The scripts uses a Perl script called CApl included with OpenSSL The path to this Perl script inCAall and CAcerts may need to be changed to make it work

More information on how to generate your own certificates can be found in the SSL certificatesHOWTO

2 Obtaining Certificates 8

3 Authentication Server Setting up FreeRADIUSFreeRADIUS is a fully GPLed RADIUS server implementation It supports a wide range of authenticationmechanisms but PEAP is used for the example in this document

31 Installing FreeRADIUS

Installing FreeRADIUS

Head over to the FreeRADIUS site httpwwwfreeradiusorg and download the latest release cd usrlocalsrc

wget ftpftpfreeradiusorgpubradiusfreeradiusminus100targz tar zxfv freeradiusminus100targz cd freeradiusminus100

1

Configure make and install configure

make make install

You can pass options to configure Use configure minusminushelp or read the README file for moreinformation

2

The binaries are installed in usrlocalbin and usrlocalsbin The configuration files arefound under usrlocaletcraddb

If something went wrong check the INSTALL and README included with the source The RADIUS FAQalso contains valuable information

32 Configuring FreeRADIUS

FreeRADIUS has a big and mighty configuration file Its so big it has been split into several smaller files thatare just included into the main radiusconf file

There is numerous ways of using and setting up FreeRADIUS to do what you want ie fetch userinformation from LDAP SQL PDC Kerberos etc In this document user information from a plain text fileusers is used

The configuration files are thoroughly commented and if that is not enough the doc folder thatcomes with the source contains additional information

Configuring FreeRADIUS

The configuration files can be found under usrlocaletcraddb cd usrlocaletcraddb

1

Open the main configuration file radiusdconf and read the comments Inside the encryptedPEAP tunnel an MSminusCHAPv2 authentication mechanism is used

MPPE [RFC3078] is responsible for sending the PMK to the AP Make sure the followingsettings are set

a

2

3 Authentication Server Setting up FreeRADIUS 9

under MODULES make sure mschap is uncommented mschap authtype value if present will be used to overwrite (or add) AuthminusType during authorization Normally should be MSminusCHAP authtype = MSminusCHAP

if use_mppe is not set to no mschap will add MSminusCHAPminusMPPEminusKeys for MSminusCHAPv1 and MSminusMPPEminusRecvminusKeyMSminusMPPEminusSendminusKey for MSminusCHAPv2 use_mppe = yes

if mppe is enabled require_encryption makes encryption moderate require_encryption = yes

require_strong always requires 128 bit key encryption require_strong = yes

authtype = MSminusCHAP The module can perform authentication itself OR use a Windows Domain Controller See the radiusconf file for how to do this

Also make sure the authorize and authenticate contains authorize preprocess mschap suffix eap files

authenticate

MSCHAP authentication AuthminusType MSminusCHAP mschap

Allow EAP authentication eap

b

Then change the clientsconf file to specify what network its serving Here we specify which network were serving client 1921680016 This is the shared secret between the Authenticator (the access point) and the Authentication Server (RADIUS) secret = SharedSecret99 shortname = testnet

3

The eapconf should also be pretty straightforward4

8021X PortminusBased Authentication HOWTO

3 Authentication Server Setting up FreeRADIUS 10

Set default_eap_type to peap default_eap_type = peap

a

Since PEAP is using TLS the TLS section must contain tls The private key password private_key_password = SecretKeyPass77 The private key private_key_file = $raddbdircertscertminussrvpem Trusted Root CA list CA_file = $raddbdircertsdemoCAcacertpem dh_file = $raddbdircertsdh random_file = devurandom

b

Find the peap section and make sure it contain the following peap The tunneled EAP session needs a default EAP type which is separate from the one for the nonminustunneled EAP module Inside of the PEAP tunnel we recommend using MSminusCHAPv2 as that is the default type supported by Windows clients default_eap_type = mschapv2

c

The user information is stored in a plain text file users A more sophisticated solution to store userinformation may be preferred (SQL LDAP PDC etc)

Make sure the users file contains the following entry

testuser UserminusPassword == Secret149

5

8021X PortminusBased Authentication HOWTO

3 Authentication Server Setting up FreeRADIUS 11

4 Supplicant Setting up XsupplicantThe Supplicant is usually a laptop or other (wireless) device that requires authentication Xsupplicant does thebidding of being the Supplicant part of the IEEE 8021Xminus2001 standard

41 Installing Xsupplicant

Installing Xsupplicant

Download the latest source from from httpwwwopen1xorg cd usrlocalsrc

wget httpbelnetdlsourceforgenetsourceforgeopen1xxsupplicantminus10targz tar zxfv xsupplicantminus10targz cd xsupplicant

1

Configure make and install configure

make make install

2

If the configuration file wasnt installed (copied) into the etc folder do it manually mkdir minusp usrlocaletc1x

cp etctlsminusexampleconf usrlocaletc1x

3

If installation fails check the README and INSTALL files included with the source You may also check outthe official documentation

42 Configuring Xsupplicant

Configuring Xsupplicant

The Supplicant must have access to the root certificate

If the Supplicant needs to authenticate against the Authentication Server (authentication both ways)the Supplicant must have certificates as well

Create a certificate folder and move the certificates into it

mkdir minusp usrlocaletc1xcerts cp rootpem usrlocaletc1xcerts (copy optional client certificate(s) into the same folder)

1

Open and edit the configuration file startup_command the command to run when Xsupplicant is first started This command can do things such as configure the card to associate with the network properly startup_command = ltBEGIN_COMMANDgtusrlocaletc1xstartupshltEND_COMMANDgt

The startupsh will be created shortly

2

When the client is authenticated it will transmit a DHCP request or manually set an IP address Here3

4 Supplicant Setting up Xsupplicant 12

Set default_eap_type to peap default_eap_type = peap

a

Since PEAP is using TLS the TLS section must contain tls The private key password private_key_password = SecretKeyPass77 The private key private_key_file = $raddbdircertscertminussrvpem Trusted Root CA list CA_file = $raddbdircertsdemoCAcacertpem dh_file = $raddbdircertsdh random_file = devurandom

b

Find the peap section and make sure it contain the following peap The tunneled EAP session needs a default EAP type which is separate from the one for the nonminustunneled EAP module Inside of the PEAP tunnel we recommend using MSminusCHAPv2 as that is the default type supported by Windows clients default_eap_type = mschapv2

c

The user information is stored in a plain text file users A more sophisticated solution to store userinformation may be preferred (SQL LDAP PDC etc)

Make sure the users file contains the following entry

testuser UserminusPassword == Secret149

5

8021X PortminusBased Authentication HOWTO

3 Authentication Server Setting up FreeRADIUS 11

4 Supplicant Setting up XsupplicantThe Supplicant is usually a laptop or other (wireless) device that requires authentication Xsupplicant does thebidding of being the Supplicant part of the IEEE 8021Xminus2001 standard

41 Installing Xsupplicant

Installing Xsupplicant

Download the latest source from from httpwwwopen1xorg cd usrlocalsrc

wget httpbelnetdlsourceforgenetsourceforgeopen1xxsupplicantminus10targz tar zxfv xsupplicantminus10targz cd xsupplicant

1

Configure make and install configure

make make install

2

If the configuration file wasnt installed (copied) into the etc folder do it manually mkdir minusp usrlocaletc1x

cp etctlsminusexampleconf usrlocaletc1x

3

If installation fails check the README and INSTALL files included with the source You may also check outthe official documentation

42 Configuring Xsupplicant

Configuring Xsupplicant

The Supplicant must have access to the root certificate

If the Supplicant needs to authenticate against the Authentication Server (authentication both ways)the Supplicant must have certificates as well

Create a certificate folder and move the certificates into it

mkdir minusp usrlocaletc1xcerts cp rootpem usrlocaletc1xcerts (copy optional client certificate(s) into the same folder)

1

Open and edit the configuration file startup_command the command to run when Xsupplicant is first started This command can do things such as configure the card to associate with the network properly startup_command = ltBEGIN_COMMANDgtusrlocaletc1xstartupshltEND_COMMANDgt

The startupsh will be created shortly

2

When the client is authenticated it will transmit a DHCP request or manually set an IP address Here3

4 Supplicant Setting up Xsupplicant 12

4 Supplicant Setting up XsupplicantThe Supplicant is usually a laptop or other (wireless) device that requires authentication Xsupplicant does thebidding of being the Supplicant part of the IEEE 8021Xminus2001 standard

41 Installing Xsupplicant

Installing Xsupplicant

Download the latest source from from httpwwwopen1xorg cd usrlocalsrc

wget httpbelnetdlsourceforgenetsourceforgeopen1xxsupplicantminus10targz tar zxfv xsupplicantminus10targz cd xsupplicant

1

Configure make and install configure

make make install

2

If the configuration file wasnt installed (copied) into the etc folder do it manually mkdir minusp usrlocaletc1x

cp etctlsminusexampleconf usrlocaletc1x

3

If installation fails check the README and INSTALL files included with the source You may also check outthe official documentation

42 Configuring Xsupplicant

Configuring Xsupplicant

The Supplicant must have access to the root certificate

If the Supplicant needs to authenticate against the Authentication Server (authentication both ways)the Supplicant must have certificates as well

Create a certificate folder and move the certificates into it

mkdir minusp usrlocaletc1xcerts cp rootpem usrlocaletc1xcerts (copy optional client certificate(s) into the same folder)

1

Open and edit the configuration file startup_command the command to run when Xsupplicant is first started This command can do things such as configure the card to associate with the network properly startup_command = ltBEGIN_COMMANDgtusrlocaletc1xstartupshltEND_COMMANDgt

The startupsh will be created shortly

2

When the client is authenticated it will transmit a DHCP request or manually set an IP address Here3

4 Supplicant Setting up Xsupplicant 12

the Supplicant sets its IP address manually in startup2sh first_auth_command the command to run when Xsupplicant authenticates to a wireless network for the first time This will usually be used to start a DHCP client process first_auth_command = ltBEGIN_COMMANDgtdhclient iltEND_COMMANDgt first_auth_command = ltBEGIN_COMMANDgtusrlocaletc1xstartup2shltEND_COMMANDgt

Since minusi is just for debugging purpose (and may go away according to the developers)allow_interfaces must be set allow_interfaces = eth0 deny_interfaces = eth1

4

Next under the NETWORK SECTION well configure PEAP Well be using PEAP allow_types = eap_peap

Dont want any eavesdropper to learn the username during the first phase (which is unencrypted) so identity hiding is used (using a bogus username) identity = ltBEGIN_IDgtanonymousltEND_IDgt

eapminuspeap As in tls define either a root certificate or a directory containing root certificates root_cert = usrlocaletc1xcertsrootpem root_dir = pathtorootcertificatedir crl_dir = pathtodirwithcrl chunk_size = 1398 random_file = devurandom cncheck = myradiusradiuscom Verify that the server certificate has this value in its CN field cnexact = yes Should it be an exact match session_resume = yes

Currently all is just mschapv2 If no allow_types is defined all is assumed allow_types = all where all = MSCHAPv2 MD5 OTP GTC SIM allow_types = eap_mschapv2

Right now you can do any of these methods in PEAP eapminusmschapv2 username = ltBEGIN_UNAMEgttestuserltEND_UNAMEgt password = ltBEGIN_PASSgtSecret149ltEND_PASSgt

5

The Supplicant must first associate with the access point The script startupsh does that job It isalso the first command Xsupplicant executes

Notice the bogus key we give to iwconfig (enc 000000000) This key is used to tell the driver torun in encrypted mode The key gets replaced after successful authentication This can be set toenc off only if encryption is disabled in the AP (for testing purposes)

Both startupsh and startup2sh must be saved under usrlocaletc1x

binbash echo Starting startupsh Take down interface (if its up)

6

8021X PortminusBased Authentication HOWTO

4 Supplicant Setting up Xsupplicant 13

sbinifconfig eth0 down To make sure the routes are flushed sleep 1 Configuring the interface with a bogus key sbiniwconfig eth0 mode managed essid testnet enc 000000000 Bring the interface up and make sure it listens to multicast packets sbinifconfig eth0 allmulti up echo Finished startupsh

This next file is used to set the IP address statically This can be omitted if a DHCP server is present(as it typically is in many access points) binbash echo Starting startup2sh Assigning an IP address sbinifconfig eth0 19216815 netmask 2552552550 echo Finished startup2sh

7

8021X PortminusBased Authentication HOWTO

4 Supplicant Setting up Xsupplicant 14

5 Authenticator Setting up the Authenticator(Access Point)During the authentication process the Authenticator just relays all messages between the Supplicant and theAuthentication Server (RADIUS) EAPOL is used between the Supplicant and the Authenticator andbetween the Authenticator and the Authentication Server UDP is used

51 Access Point

Many access point have support for 8021X (and RADIUS) authentication It must first be configured to use8021X authentication

Configuring and setting up 8021X on the AP may differ between vendors Listed below are the requiredsettings to make a Cisco AP350 work Other settings to TIKP CCMP etc may also be configured

The AP must set the ESSID to testnet and must activate

Figure AP350 The RADIUS configuration screen for a Cisco APminus350

8021Xminus2001 Make sure the 8021X Protocol version is set to 8021Xminus2001 Some older AccessPoints support only the draft version of the 8021X standard (and may therefore not work)

bull

RADIUS Server the nameIP address of the RADIUS server and the shared secret between theRADIUS server and the Access Point (which in this document is SharedSecret99) See figureAP350

bull

EAP Authentication The RADIUS server should be used for EAP authenticationbull

5 Authenticator Setting up the Authenticator (Access Point) 15

Figure AP350minus2 The Encryption configuration screen for a Cisco APminus350

Full Encryption to allow only encrypted traffic Note that 8021X may be used without usingencryption which is nice for test purposes

bull

Open Authentication to make the Supplicant associate with the Access Point before encryption keysare available Once the association is done the Supplicant may start EAP authentication

bull

Require EAP for the Open Authentication That will ensure that only authenticated users areallowed into the network

bull

52 Linux Authenticator

An ordinary Linux node can be set up to function as a wireless Access Point and Authenticator How to set upand use Linux as an AP is beyond the scope of this document Simon Andersons Linux Wireless Access PointHOWTO may be of guidance

8021X PortminusBased Authentication HOWTO

5 Authenticator Setting up the Authenticator (Access Point) 16

sbinifconfig eth0 down To make sure the routes are flushed sleep 1 Configuring the interface with a bogus key sbiniwconfig eth0 mode managed essid testnet enc 000000000 Bring the interface up and make sure it listens to multicast packets sbinifconfig eth0 allmulti up echo Finished startupsh

This next file is used to set the IP address statically This can be omitted if a DHCP server is present(as it typically is in many access points) binbash echo Starting startup2sh Assigning an IP address sbinifconfig eth0 19216815 netmask 2552552550 echo Finished startup2sh

7

8021X PortminusBased Authentication HOWTO

4 Supplicant Setting up Xsupplicant 14

5 Authenticator Setting up the Authenticator(Access Point)During the authentication process the Authenticator just relays all messages between the Supplicant and theAuthentication Server (RADIUS) EAPOL is used between the Supplicant and the Authenticator andbetween the Authenticator and the Authentication Server UDP is used

51 Access Point

Many access point have support for 8021X (and RADIUS) authentication It must first be configured to use8021X authentication

Configuring and setting up 8021X on the AP may differ between vendors Listed below are the requiredsettings to make a Cisco AP350 work Other settings to TIKP CCMP etc may also be configured

The AP must set the ESSID to testnet and must activate

Figure AP350 The RADIUS configuration screen for a Cisco APminus350

8021Xminus2001 Make sure the 8021X Protocol version is set to 8021Xminus2001 Some older AccessPoints support only the draft version of the 8021X standard (and may therefore not work)

bull

RADIUS Server the nameIP address of the RADIUS server and the shared secret between theRADIUS server and the Access Point (which in this document is SharedSecret99) See figureAP350

bull

EAP Authentication The RADIUS server should be used for EAP authenticationbull

5 Authenticator Setting up the Authenticator (Access Point) 15

Figure AP350minus2 The Encryption configuration screen for a Cisco APminus350

Full Encryption to allow only encrypted traffic Note that 8021X may be used without usingencryption which is nice for test purposes

bull

Open Authentication to make the Supplicant associate with the Access Point before encryption keysare available Once the association is done the Supplicant may start EAP authentication

bull

Require EAP for the Open Authentication That will ensure that only authenticated users areallowed into the network

bull

52 Linux Authenticator

An ordinary Linux node can be set up to function as a wireless Access Point and Authenticator How to set upand use Linux as an AP is beyond the scope of this document Simon Andersons Linux Wireless Access PointHOWTO may be of guidance

8021X PortminusBased Authentication HOWTO

5 Authenticator Setting up the Authenticator (Access Point) 16

5 Authenticator Setting up the Authenticator(Access Point)During the authentication process the Authenticator just relays all messages between the Supplicant and theAuthentication Server (RADIUS) EAPOL is used between the Supplicant and the Authenticator andbetween the Authenticator and the Authentication Server UDP is used

51 Access Point

Many access point have support for 8021X (and RADIUS) authentication It must first be configured to use8021X authentication

Configuring and setting up 8021X on the AP may differ between vendors Listed below are the requiredsettings to make a Cisco AP350 work Other settings to TIKP CCMP etc may also be configured

The AP must set the ESSID to testnet and must activate

Figure AP350 The RADIUS configuration screen for a Cisco APminus350

8021Xminus2001 Make sure the 8021X Protocol version is set to 8021Xminus2001 Some older AccessPoints support only the draft version of the 8021X standard (and may therefore not work)

bull

RADIUS Server the nameIP address of the RADIUS server and the shared secret between theRADIUS server and the Access Point (which in this document is SharedSecret99) See figureAP350

bull

EAP Authentication The RADIUS server should be used for EAP authenticationbull

5 Authenticator Setting up the Authenticator (Access Point) 15

Figure AP350minus2 The Encryption configuration screen for a Cisco APminus350

Full Encryption to allow only encrypted traffic Note that 8021X may be used without usingencryption which is nice for test purposes

bull

Open Authentication to make the Supplicant associate with the Access Point before encryption keysare available Once the association is done the Supplicant may start EAP authentication

bull

Require EAP for the Open Authentication That will ensure that only authenticated users areallowed into the network

bull

52 Linux Authenticator

An ordinary Linux node can be set up to function as a wireless Access Point and Authenticator How to set upand use Linux as an AP is beyond the scope of this document Simon Andersons Linux Wireless Access PointHOWTO may be of guidance

8021X PortminusBased Authentication HOWTO

5 Authenticator Setting up the Authenticator (Access Point) 16

Figure AP350minus2 The Encryption configuration screen for a Cisco APminus350

Full Encryption to allow only encrypted traffic Note that 8021X may be used without usingencryption which is nice for test purposes

bull

Open Authentication to make the Supplicant associate with the Access Point before encryption keysare available Once the association is done the Supplicant may start EAP authentication

bull

Require EAP for the Open Authentication That will ensure that only authenticated users areallowed into the network

bull

52 Linux Authenticator

An ordinary Linux node can be set up to function as a wireless Access Point and Authenticator How to set upand use Linux as an AP is beyond the scope of this document Simon Andersons Linux Wireless Access PointHOWTO may be of guidance

8021X PortminusBased Authentication HOWTO

5 Authenticator Setting up the Authenticator (Access Point) 16

6 Testbed

61 Testcase

figure testbed A wireless node request authentication

Our testbed consists of two nodes and one Access Point (AP) One node functions as the Supplicant (WN) theother as the backminusend Authentication Server running RADIUS (AS) The Access Point is the AuthenticatorSee figure testbed for explanation

It is crucial that the Access Point be able to reach (ping) the Authentication Server and vice versa

62 Running some tests

Running some tests

The RADIUS server is started in debug mode This produces a lot of debug information Theimportant snippets are below radiusd minusX Starting minus reading configuration files reread_config reading radiusdconf Config including file usrlocaletcraddbproxyconf Config including file usrlocaletcraddbclientsconf Config including file usrlocaletcraddbsnmpconf Config including file usrlocaletcraddbeapconf Config including file usrlocaletcraddbsqlconf Module Loaded MSminusCHAP mschap use_mppe = yes mschap require_encryption = no

1

6 Testbed 17

mschap require_strong = no mschap with_ntdomain_hack = no mschap passwd = (null) mschap authtype = MSminusCHAP mschap ntlm_auth = (null) Module Instantiated mschap (mschap) Module Loaded eap eap default_eap_type = peap eap timer_expire = 60 eap ignore_unknown_eap_types = no eap cisco_accounting_username_bug = no rlm_eap Loaded and initialized type md5 tls rsa_key_exchange = no tls dh_key_exchange = yes tls rsa_key_length = 512 tls dh_key_length = 512 tls verify_depth = 0 tls CA_path = (null) tls pem_file_type = yes tls private_key_file = usrlocaletcraddbcertscertminussrvpem tls certificate_file = usrlocaletcraddbcertscertminussrvpem tls CA_file = usrlocaletcraddbcertsdemoCAcacertpem tls private_key_password = SecretKeyPass77 tls dh_file = usrlocaletcraddbcertsdh tls random_file = usrlocaletcraddbcertsrandom tls fragment_size = 1024 tls include_length = yes tls check_crl = no tls check_cert_cn = (null) rlm_eap Loaded and initialized type tls peap default_eap_type = mschapv2 peap copy_request_to_tunnel = no peap use_tunneled_reply = no peap proxy_tunneled_request_as_eap = yes rlm_eap Loaded and initialized type peap mschapv2 with_ntdomain_hack = no rlm_eap Loaded and initialized type mschapv2 Module Instantiated eap (eap) Module Loaded files files usersfile = usrlocaletcraddbusers Module Instantiated radutmp (radutmp) Listening on authentication 1812 Listening on accounting 1813 Ready to process requests

Default EAP type is set to PEAP

RADIUSs TLS settings are initiated here The certificate type location and password arelistet here

Inside the PEAP tunnel MSminusCHAPv2 is used

The usernamepassword information is found in the users file

RADIUS server started successfully Waiting for incoming requestsThe radius server is now ready to process requests

8021X PortminusBased Authentication HOWTO

6 Testbed 18

The most interesting output is included above If you get any error message instead of the last line goover the configuration (above) carefullyNow the Supplicant is ready to get authenticated Start Xsupplicant in debug mode Note that well seeoutput produced by the two startup scripts startupsh and startup2sh xsupplicant minusc usrlocaletc1x1xconf minusi eth0 minusd 6 Starting etc1xstartupsh Finished etc1xstartupsh Starting etc1xstartup2sh Finished etc1xstartup2sh

2

At the same time the RADIUS server is producing a lot of output Key snippets are shown below rlm_eap Request found released from the list rlm_eap EAPpeap rlm_eap processing type peap rlm_eap_peap Authenticate rlm_eap_tls processing TLS eaptls_verify returned 7 rlm_eap_tls Done initial handshake eaptls_process returned 7 rlm_eap_peap EAPTLS_OK rlm_eap_peap Session established Decoding tunneled attributes rlm_eap_peap Received EAPminusTLV response rlm_eap_peap Tunneled data is valid rlm_eap_peap Success rlm_eap Freeing handler modcall[authenticate] module eap returns ok for request 8modcall group authenticate returns ok for request 8Login OK [testuserltno UserminusPassword attributegt] (from client testnet port 37 cli 0002a56fa08a)Sending AccessminusAccept of id 8 to 192168211032 MSminusMPPEminusRecvminusKey = 0xf21757b96f52ddaefe084c343778d0082c2c8e12ce18ae10a79c550ae61a5206 MSminusMPPEminusSendminusKey = 0x5e1321e06a45f7ac9f78fb9d398cab5556bff6c9d003cdf8161683bfb7e7af18 EAPminusMessage = 0x030a0004 MessageminusAuthenticator = 0x00000000000000000000000000000000 UserminusName = testuser

TLS session startup Doing TLSminushandshake

The TLS session (PEAPminusencrypted tunnel) is up

The Supplicant has been authenticated successfully by the RADIUS server AnAccessminusAccept message is sent

The MSminusMPPEminusRecvminusKey [RFC2548 section 243] contains the Pairwise Master Key(PMK) destined to the Authenticator (access point) encrypted with the MPPE Protocol[RFC3078] using the shared secret between the Authenticator and Authentication Server askey The Supplicant derives the same PMK from MK as described in Key Management

3

The Authenticator (access point) may also show something like this in its log 000216 (Info) Station 0002a56fa08a Associated 000217 (Info) Station=0002a56fa08a User=testuser EAPminusAuthenticated

4

Thats it The Supplicant is now authenticated to use the Access Point

8021X PortminusBased Authentication HOWTO

6 Testbed 19

mschap require_strong = no mschap with_ntdomain_hack = no mschap passwd = (null) mschap authtype = MSminusCHAP mschap ntlm_auth = (null) Module Instantiated mschap (mschap) Module Loaded eap eap default_eap_type = peap eap timer_expire = 60 eap ignore_unknown_eap_types = no eap cisco_accounting_username_bug = no rlm_eap Loaded and initialized type md5 tls rsa_key_exchange = no tls dh_key_exchange = yes tls rsa_key_length = 512 tls dh_key_length = 512 tls verify_depth = 0 tls CA_path = (null) tls pem_file_type = yes tls private_key_file = usrlocaletcraddbcertscertminussrvpem tls certificate_file = usrlocaletcraddbcertscertminussrvpem tls CA_file = usrlocaletcraddbcertsdemoCAcacertpem tls private_key_password = SecretKeyPass77 tls dh_file = usrlocaletcraddbcertsdh tls random_file = usrlocaletcraddbcertsrandom tls fragment_size = 1024 tls include_length = yes tls check_crl = no tls check_cert_cn = (null) rlm_eap Loaded and initialized type tls peap default_eap_type = mschapv2 peap copy_request_to_tunnel = no peap use_tunneled_reply = no peap proxy_tunneled_request_as_eap = yes rlm_eap Loaded and initialized type peap mschapv2 with_ntdomain_hack = no rlm_eap Loaded and initialized type mschapv2 Module Instantiated eap (eap) Module Loaded files files usersfile = usrlocaletcraddbusers Module Instantiated radutmp (radutmp) Listening on authentication 1812 Listening on accounting 1813 Ready to process requests

Default EAP type is set to PEAP

RADIUSs TLS settings are initiated here The certificate type location and password arelistet here

Inside the PEAP tunnel MSminusCHAPv2 is used

The usernamepassword information is found in the users file

RADIUS server started successfully Waiting for incoming requestsThe radius server is now ready to process requests

8021X PortminusBased Authentication HOWTO

6 Testbed 18

The most interesting output is included above If you get any error message instead of the last line goover the configuration (above) carefullyNow the Supplicant is ready to get authenticated Start Xsupplicant in debug mode Note that well seeoutput produced by the two startup scripts startupsh and startup2sh xsupplicant minusc usrlocaletc1x1xconf minusi eth0 minusd 6 Starting etc1xstartupsh Finished etc1xstartupsh Starting etc1xstartup2sh Finished etc1xstartup2sh

2

At the same time the RADIUS server is producing a lot of output Key snippets are shown below rlm_eap Request found released from the list rlm_eap EAPpeap rlm_eap processing type peap rlm_eap_peap Authenticate rlm_eap_tls processing TLS eaptls_verify returned 7 rlm_eap_tls Done initial handshake eaptls_process returned 7 rlm_eap_peap EAPTLS_OK rlm_eap_peap Session established Decoding tunneled attributes rlm_eap_peap Received EAPminusTLV response rlm_eap_peap Tunneled data is valid rlm_eap_peap Success rlm_eap Freeing handler modcall[authenticate] module eap returns ok for request 8modcall group authenticate returns ok for request 8Login OK [testuserltno UserminusPassword attributegt] (from client testnet port 37 cli 0002a56fa08a)Sending AccessminusAccept of id 8 to 192168211032 MSminusMPPEminusRecvminusKey = 0xf21757b96f52ddaefe084c343778d0082c2c8e12ce18ae10a79c550ae61a5206 MSminusMPPEminusSendminusKey = 0x5e1321e06a45f7ac9f78fb9d398cab5556bff6c9d003cdf8161683bfb7e7af18 EAPminusMessage = 0x030a0004 MessageminusAuthenticator = 0x00000000000000000000000000000000 UserminusName = testuser

TLS session startup Doing TLSminushandshake

The TLS session (PEAPminusencrypted tunnel) is up

The Supplicant has been authenticated successfully by the RADIUS server AnAccessminusAccept message is sent

The MSminusMPPEminusRecvminusKey [RFC2548 section 243] contains the Pairwise Master Key(PMK) destined to the Authenticator (access point) encrypted with the MPPE Protocol[RFC3078] using the shared secret between the Authenticator and Authentication Server askey The Supplicant derives the same PMK from MK as described in Key Management

3

The Authenticator (access point) may also show something like this in its log 000216 (Info) Station 0002a56fa08a Associated 000217 (Info) Station=0002a56fa08a User=testuser EAPminusAuthenticated

4

Thats it The Supplicant is now authenticated to use the Access Point

8021X PortminusBased Authentication HOWTO

6 Testbed 19

The most interesting output is included above If you get any error message instead of the last line goover the configuration (above) carefullyNow the Supplicant is ready to get authenticated Start Xsupplicant in debug mode Note that well seeoutput produced by the two startup scripts startupsh and startup2sh xsupplicant minusc usrlocaletc1x1xconf minusi eth0 minusd 6 Starting etc1xstartupsh Finished etc1xstartupsh Starting etc1xstartup2sh Finished etc1xstartup2sh

2

At the same time the RADIUS server is producing a lot of output Key snippets are shown below rlm_eap Request found released from the list rlm_eap EAPpeap rlm_eap processing type peap rlm_eap_peap Authenticate rlm_eap_tls processing TLS eaptls_verify returned 7 rlm_eap_tls Done initial handshake eaptls_process returned 7 rlm_eap_peap EAPTLS_OK rlm_eap_peap Session established Decoding tunneled attributes rlm_eap_peap Received EAPminusTLV response rlm_eap_peap Tunneled data is valid rlm_eap_peap Success rlm_eap Freeing handler modcall[authenticate] module eap returns ok for request 8modcall group authenticate returns ok for request 8Login OK [testuserltno UserminusPassword attributegt] (from client testnet port 37 cli 0002a56fa08a)Sending AccessminusAccept of id 8 to 192168211032 MSminusMPPEminusRecvminusKey = 0xf21757b96f52ddaefe084c343778d0082c2c8e12ce18ae10a79c550ae61a5206 MSminusMPPEminusSendminusKey = 0x5e1321e06a45f7ac9f78fb9d398cab5556bff6c9d003cdf8161683bfb7e7af18 EAPminusMessage = 0x030a0004 MessageminusAuthenticator = 0x00000000000000000000000000000000 UserminusName = testuser

TLS session startup Doing TLSminushandshake

The TLS session (PEAPminusencrypted tunnel) is up

The Supplicant has been authenticated successfully by the RADIUS server AnAccessminusAccept message is sent

The MSminusMPPEminusRecvminusKey [RFC2548 section 243] contains the Pairwise Master Key(PMK) destined to the Authenticator (access point) encrypted with the MPPE Protocol[RFC3078] using the shared secret between the Authenticator and Authentication Server askey The Supplicant derives the same PMK from MK as described in Key Management

3

The Authenticator (access point) may also show something like this in its log 000216 (Info) Station 0002a56fa08a Associated 000217 (Info) Station=0002a56fa08a User=testuser EAPminusAuthenticated

4

Thats it The Supplicant is now authenticated to use the Access Point

8021X PortminusBased Authentication HOWTO

6 Testbed 19

7 Note about driver support and XsupplicantAs described in Key Management one of the big advantages of using Dynamic WEP80211i with 8021X isthe support for session keys A new encryption key is generated for each session

Xsupplicant only supports Dynamic WEP as of this writing Support for WPA and RSNWPA2 (80211i) isbeing worked on and is estimated to be supported at the end of the yearearly next year (20042005)according to Chris Hessing (one of the Xsupplicants developers)

Not all wireless drives support dynamic WEP nor WPA To use RSN (WPA2) new support in hardware mayeven be required Many older drivers assume only one WEP key will be used on the network at any time Thecard is reset whenever the key is changed to let the new key take effect This triggers a new authenticationand there is a neverminusending loop

At the time of writing most of the wireless drivers in the base Linux kernel require patching to make dynamicWEPWPA work They will in time be upgraded to support these new features Many drivers developedoutside the kernel however support for dynamic WEP HostAP madwifi Orinoco and atmel should workwithout problems

Instead of using Xsupplicant wpa_supplicant may be used It has support for both WPA and RSN (WPA2)and a wide range of EAP authentication methods

7 Note about driver support and Xsupplicant 20

8 FAQDo not forget to check out the FAQ section of both the FreeRADIUS (highly recommended) and XsupplicantWeb sites

81 Is it possible to allow userminusspecific Xsupplicant configuration to avoid having a global configurationfile82 I dont want to use PEAP can I use EAPminusTTLS or EAPminusTLS instead83 Can I use a Windows Supplicant (client) instead of GNULinux84 Can I use a Active Directory to authenticate users85 Is there any Windows Supplicant clients available

81 Is it possible to allow userminusspecific Xsupplicant configuration to avoid having a global configurationfile

No not at the moment

82 I dont want to use PEAP can I use EAPminusTTLS or EAPminusTLS instead

Yes To use EAPminusTTLS only small changes to the configuration used in this document are required To useEAPminusTLS client certificates must be used as well

83 Can I use a Windows Supplicant (client) instead of GNULinux

Yes Windows XP SP1Windows 2000 SP3 has support for PEAP MSCHAPv2 (used in this document) AWindows HOWTO can be found here FreeRADIUSWinXP Authentication Setup

84 Can I use a Active Directory to authenticate users

Yes FreeRADIUS can authenticate users from AD by using ntlm_auth

85 Is there any Windows Supplicant clients available

Yes As of Windows XP SP1 or Windows 2000 SP3 support for WPA (PEAPMSminusCHAPv2) is supportedOther clients include (not tested) Secure W2 (free for nonminuscommercial) and WIRE1X Funk Software alsohas a commercial client available

8 FAQ 21

9 Useful ResourcesOnly IEEE standards older than 12 months are available to the public in general (through the Get IEEE 802Program) So the new 80211i and 8021Xminus2004 standards documents are not available You must be a IEEEparticipant to get hold of any draftswork in progress papers (which actually isnt that hard minus just join amailing list and say you are interested)

FreeRADIUS Server Project httpwwwfreeradiusorg1 Open1x Open Source implementation of IEEE 8021X (Xsupplicant) httpwwwopen1xorg2 The Open1x Users Guidehttpsourceforgenetdocmandisplay_docphpdocid=23371ampgroup_id=60236

3

PortminusBased Network Access Control (8021Xminus2001)httpstandardsieeeorggetieee802download8021Xminus2001pdf

4

RFC2246 The TLS Protocol Version 10 httpwwwietforgrfcrfc2246txt5 RFC2459 Internet X509 Public Key Infrastructure minus Certificate and CRL Profilehttpwwwietforgrfcrfc2459txt

6

RFC2548 Microsoft Vendorminusspecific RADIUS Attributes httpwwwietforgrfcrfc2548txt7 RFC2716 PPP EAP TLS Authentication Protocol httpwwwietforgrfcrfc2716txt8 RFC2865 Remote Authentication DialminusIn User Service (RADIUS)httpwwwietforgrfcrfc2865txt

9

RFC3079 Deriving Keys for use with Microsoft PointminustominusPoint Encryption (MPPE)httpwwwietforgrfcrfc3079txt

10

RFC3579 RADIUS Support For EAP httpwwwietforgrfcrfc3579txt11 RFC3580 IEEE 8021X RADIUS Usage Guidelines httpwwwietforgrfcrfc3580txt12 RFC3588 Diameter Base Protocol httpwwwietforgrfcrfc3588txt13 RFC3610 Counter with CBCminusMAC (CCM) httpwwwietforgrfcrfc3610txt14 RFC3748 Extensible Authentication Protocol (EAP) httpwwwietforgrfcrfc3748txt15 Linux Wireless Access Point HOWTO httpoobfreeshellorgnzwirelessLWAPminusHOWTOhtml16 SSL Certificates HOWTO httpwwwtldporgHOWTOSSLminusCertificatesminusHOWTO17 OpenSSL x509(1) httpwwwopensslorgdocsappsx509html18

9 Useful Resources 22

10 Copyright acknowledgments andmiscellaneous

101 Copyright and License

Copyright (c) 2004 Lars Strand

Permission is granted to copy distribute andor modify this document under the terms of the GNU FreeDocumentation License Version 12 or any later version published by the Free Software Foundation with noInvariant Sections no FrontminusCover Texts and no BackminusCover Texts A copy of the license is included in thesection entitled GNU Free Documentation License

102 How this document was produced

This document was written in DocBook XML using Emacs

103 Feedback

Suggestions corrections additions wanted Contributors wanted and acknowledged Flames not wanted

I can always be reached at ltlars strand at gnist orggt

Homepage httpwwwgnistorg~lars

104 Acknowledgments

Thanks to Andreas Hafslund ltandreha at unik nogt and Thales Communication for initial support

Also thanks to Artur Hecker lthecker at enst frgt Chris Hessing ltchris hessing at utahedugt Jouni Malinen ltjkmaline at cc hut figt and Terry Simons ltgalimore at mac comgtfor valuable feedback

Thanks to Rick Moen ltrick at linuxmafia comgt for doing a language review

10 Copyright acknowledgments and miscellaneous 23

A GNU Free Documentation LicenseVersion 12 November 2002

Copyright (C) 200020012002 Free Software Foundation Inc 59 Temple Place Suite 330Boston MA 02111minus1307 USA Everyone is permitted to copy and distribute verbatim copiesof this license document but changing it is not allowed

A GNU Free Documentation License 24

A1 PREAMBLEThe purpose of this License is to make a manual textbook or other functional and useful document free inthe sense of freedom to assure everyone the effective freedom to copy and redistribute it with or withoutmodifying it either commercially or noncommercially Secondarily this License preserves for the author andpublisher a way to get credit for their work while not being considered responsible for modifications made byothers

This License is a kind of copyleft which means that derivative works of the document must themselves befree in the same sense It complements the GNU General Public License which is a copyleft license designedfor free software

We have designed this License in order to use it for manuals for free software because free software needsfree documentation a free program should come with manuals providing the same freedoms that the softwaredoes But this License is not limited to software manuals it can be used for any textual work regardless ofsubject matter or whether it is published as a printed book We recommend this License principally for workswhose purpose is instruction or reference

A1 PREAMBLE 25

A2 APPLICABILITY AND DEFINITIONSThis License applies to any manual or other work in any medium that contains a notice placed by thecopyright holder saying it can be distributed under the terms of this License Such a notice grants aworldminuswide royaltyminusfree license unlimited in duration to use that work under the conditions stated hereinThe Document below refers to any such manual or work Any member of the public is a licensee and isaddressed as you You accept the license if you copy modify or distribute the work in a way requiringpermission under copyright law

A Modified Version of the Document means any work containing the Document or a portion of it eithercopied verbatim or with modifications andor translated into another language

A Secondary Section is a named appendix or a frontminusmatter section of the Document that deals exclusivelywith the relationship of the publishers or authors of the Document to the Documents overall subject (or torelated matters) and contains nothing that could fall directly within that overall subject (Thus if theDocument is in part a textbook of mathematics a Secondary Section may not explain any mathematics) Therelationship could be a matter of historical connection with the subject or with related matters or of legalcommercial philosophical ethical or political position regarding them

The Invariant Sections are certain Secondary Sections whose titles are designated as being those ofInvariant Sections in the notice that says that the Document is released under this License If a section doesnot fit the above definition of Secondary then it is not allowed to be designated as Invariant The Documentmay contain zero Invariant Sections If the Document does not identify any Invariant Sections then there arenone

The Cover Texts are certain short passages of text that are listed as FrontminusCover Texts or BackminusCoverTexts in the notice that says that the Document is released under this License A FrontminusCover Text may be atmost 5 words and a BackminusCover Text may be at most 25 words

A Transparent copy of the Document means a machineminusreadable copy represented in a format whosespecification is available to the general public that is suitable for revising the document straightforwardlywith generic text editors or (for images composed of pixels) generic paint programs or (for drawings) somewidely available drawing editor and that is suitable for input to text formatters or for automatic translation toa variety of formats suitable for input to text formatters A copy made in an otherwise Transparent file formatwhose markup or absence of markup has been arranged to thwart or discourage subsequent modification byreaders is not Transparent An image format is not Transparent if used for any substantial amount of text Acopy that is not Transparent is called Opaque

Examples of suitable formats for Transparent copies include plain ASCII without markup Texinfo inputformat LaTeX input format SGML or XML using a publicly available DTD and standardminusconformingsimple HTML PostScript or PDF designed for human modification Examples of transparent image formatsinclude PNG XCF and JPG Opaque formats include proprietary formats that can be read and edited only byproprietary word processors SGML or XML for which the DTD andor processing tools are not generallyavailable and the machineminusgenerated HTML PostScript or PDF produced by some word processors foroutput purposes only

The Title Page means for a printed book the title page itself plus such following pages as are needed tohold legibly the material this License requires to appear in the title page For works in formats which do nothave any title page as such Title Page means the text near the most prominent appearance of the workstitle preceding the beginning of the body of the text

A2 APPLICABILITY AND DEFINITIONS 26

A section Entitled XYZ means a named subunit of the Document whose title either is precisely XYZ orcontains XYZ in parentheses following text that translates XYZ in another language (Here XYZ stands for aspecific section name mentioned below such as Acknowledgements Dedications Endorsements orHistory) To Preserve the Title of such a section when you modify the Document means that it remains asection Entitled XYZ according to this definition

The Document may include Warranty Disclaimers next to the notice which states that this License applies tothe Document These Warranty Disclaimers are considered to be included by reference in this License butonly as regards disclaiming warranties any other implication that these Warranty Disclaimers may have isvoid and has no effect on the meaning of this License

8021X PortminusBased Authentication HOWTO

A2 APPLICABILITY AND DEFINITIONS 27

A3 VERBATIM COPYINGYou may copy and distribute the Document in any medium either commercially or noncommerciallyprovided that this License the copyright notices and the license notice saying this License applies to theDocument are reproduced in all copies and that you add no other conditions whatsoever to those of thisLicense You may not use technical measures to obstruct or control the reading or further copying of thecopies you make or distribute However you may accept compensation in exchange for copies If youdistribute a large enough number of copies you must also follow the conditions in section 3

You may also lend copies under the same conditions stated above and you may publicly display copies

A3 VERBATIM COPYING 28

A4 COPYING IN QUANTITYIf you publish printed copies (or copies in media that commonly have printed covers) of the Documentnumbering more than 100 and the Documents license notice requires Cover Texts you must enclose thecopies in covers that carry clearly and legibly all these Cover Texts FrontminusCover Texts on the front coverand BackminusCover Texts on the back cover Both covers must also clearly and legibly identify you as thepublisher of these copies The front cover must present the full title with all words of the title equallyprominent and visible You may add other material on the covers in addition Copying with changes limited tothe covers as long as they preserve the title of the Document and satisfy these conditions can be treated asverbatim copying in other respects

If the required texts for either cover are too voluminous to fit legibly you should put the first ones listed (asmany as fit reasonably) on the actual cover and continue the rest onto adjacent pages

If you publish or distribute Opaque copies of the Document numbering more than 100 you must eitherinclude a machineminusreadable Transparent copy along with each Opaque copy or state in or with each Opaquecopy a computerminusnetwork location from which the general networkminususing public has access to downloadusing publicminusstandard network protocols a complete Transparent copy of the Document free of addedmaterial If you use the latter option you must take reasonably prudent steps when you begin distribution ofOpaque copies in quantity to ensure that this Transparent copy will remain thus accessible at the statedlocation until at least one year after the last time you distribute an Opaque copy (directly or through youragents or retailers) of that edition to the public

It is requested but not required that you contact the authors of the Document well before redistributing anylarge number of copies to give them a chance to provide you with an updated version of the Document

A4 COPYING IN QUANTITY 29

A5 MODIFICATIONSYou may copy and distribute a Modified Version of the Document under the conditions of sections 2 and 3above provided that you release the Modified Version under precisely this License with the ModifiedVersion filling the role of the Document thus licensing distribution and modification of the Modified Versionto whoever possesses a copy of it In addition you must do these things in the Modified Version

Use in the Title Page (and on the covers if any) a title distinct from that of the Document and fromthose of previous versions (which should if there were any be listed in the History section of theDocument) You may use the same title as a previous version if the original publisher of that versiongives permission

A

List on the Title Page as authors one or more persons or entities responsible for authorship of themodifications in the Modified Version together with at least five of the principal authors of theDocument (all of its principal authors if it has fewer than five) unless they release you from thisrequirement

B

State on the Title page the name of the publisher of the Modified Version as the publisherC Preserve all the copyright notices of the DocumentD Add an appropriate copyright notice for your modifications adjacent to the other copyright noticesE Include immediately after the copyright notices a license notice giving the public permission to usethe Modified Version under the terms of this License in the form shown in the Addendum below

F

Preserve in that license notice the full lists of Invariant Sections and required Cover Texts given in theDocuments license notice

G

Include an unaltered copy of this LicenseH Preserve the section Entitled History Preserve its Title and add to it an item stating at least the titleyear new authors and publisher of the Modified Version as given on the Title Page If there is nosection Entitled History in the Document create one stating the title year authors and publisher ofthe Document as given on its Title Page then add an item describing the Modified Version as statedin the previous sentence

I

Preserve the network location if any given in the Document for public access to a Transparent copyof the Document and likewise the network locations given in the Document for previous versions itwas based on These may be placed in the History section You may omit a network location for awork that was published at least four years before the Document itself or if the original publisher ofthe version it refers to gives permission

J

For any section Entitled Acknowledgements or Dedications Preserve the Title of the section andpreserve in the section all the substance and tone of each of the contributor acknowledgements andordedications given therein

K

Preserve all the Invariant Sections of the Document unaltered in their text and in their titles Sectionnumbers or the equivalent are not considered part of the section titles

L

Delete any section Entitled Endorsements Such a section may not be included in the ModifiedVersion

M

Do not retitle any existing section to be Entitled Endorsements or to conflict in title with anyInvariant Section

N

Preserve any Warranty DisclaimersO

If the Modified Version includes new frontminusmatter sections or appendices that qualify as Secondary Sectionsand contain no material copied from the Document you may at your option designate some or all of thesesections as invariant To do this add their titles to the list of Invariant Sections in the Modified Versionslicense notice These titles must be distinct from any other section titles

A5 MODIFICATIONS 30

You may add a section Entitled Endorsements provided it contains nothing but endorsements of yourModified Version by various partiesminusminusfor example statements of peer review or that the text has beenapproved by an organization as the authoritative definition of a standard

You may add a passage of up to five words as a FrontminusCover Text and a passage of up to 25 words as aBackminusCover Text to the end of the list of Cover Texts in the Modified Version Only one passage ofFrontminusCover Text and one of BackminusCover Text may be added by (or through arrangements made by) any oneentity If the Document already includes a cover text for the same cover previously added by you or byarrangement made by the same entity you are acting on behalf of you may not add another but you mayreplace the old one on explicit permission from the previous publisher that added the old one

The author(s) and publisher(s) of the Document do not by this License give permission to use their names forpublicity for or to assert or imply endorsement of any Modified Version

8021X PortminusBased Authentication HOWTO

A5 MODIFICATIONS 31

A6 COMBINING DOCUMENTSYou may combine the Document with other documents released under this License under the terms definedin section 4 above for modified versions provided that you include in the combination all of the InvariantSections of all of the original documents unmodified and list them all as Invariant Sections of your combinedwork in its license notice and that you preserve all their Warranty Disclaimers

The combined work need only contain one copy of this License and multiple identical Invariant Sections maybe replaced with a single copy If there are multiple Invariant Sections with the same name but differentcontents make the title of each such section unique by adding at the end of it in parentheses the name of theoriginal author or publisher of that section if known or else a unique number Make the same adjustment tothe section titles in the list of Invariant Sections in the license notice of the combined work

In the combination you must combine any sections Entitled History in the various original documentsforming one section Entitled History likewise combine any sections Entitled Acknowledgements and anysections Entitled Dedications You must delete all sections Entitled Endorsements

A6 COMBINING DOCUMENTS 32

A7 COLLECTIONS OF DOCUMENTSYou may make a collection consisting of the Document and other documents released under this License andreplace the individual copies of this License in the various documents with a single copy that is included inthe collection provided that you follow the rules of this License for verbatim copying of each of thedocuments in all other respects

You may extract a single document from such a collection and distribute it individually under this Licenseprovided you insert a copy of this License into the extracted document and follow this License in all otherrespects regarding verbatim copying of that document

A7 COLLECTIONS OF DOCUMENTS 33

A8 AGGREGATION WITH INDEPENDENT WORKSA compilation of the Document or its derivatives with other separate and independent documents or works inor on a volume of a storage or distribution medium is called an aggregate if the copyright resulting from thecompilation is not used to limit the legal rights of the compilations users beyond what the individual workspermit When the Document is included in an aggregate this License does not apply to the other works in theaggregate which are not themselves derivative works of the Document

If the Cover Text requirement of section 3 is applicable to these copies of the Document then if the Documentis less than one half of the entire aggregate the Documents Cover Texts may be placed on covers that bracketthe Document within the aggregate or the electronic equivalent of covers if the Document is in electronicform Otherwise they must appear on printed covers that bracket the whole aggregate

A8 AGGREGATION WITH INDEPENDENT WORKS 34

A9 TRANSLATIONTranslation is considered a kind of modification so you may distribute translations of the Document under theterms of section 4 Replacing Invariant Sections with translations requires special permission from theircopyright holders but you may include translations of some or all Invariant Sections in addition to theoriginal versions of these Invariant Sections You may include a translation of this License and all the licensenotices in the Document and any Warranty Disclaimers provided that you also include the original Englishversion of this License and the original versions of those notices and disclaimers In case of a disagreementbetween the translation and the original version of this License or a notice or disclaimer the original versionwill prevail

If a section in the Document is Entitled Acknowledgements Dedications or History the requirement(section 4) to Preserve its Title (section 1) will typically require changing the actual title

A9 TRANSLATION 35

A10 TERMINATIONYou may not copy modify sublicense or distribute the Document except as expressly provided for under thisLicense Any other attempt to copy modify sublicense or distribute the Document is void and willautomatically terminate your rights under this License However parties who have received copies or rightsfrom you under this License will not have their licenses terminated so long as such parties remain in fullcompliance

A10 TERMINATION 36

A11 FUTURE REVISIONS OF THIS LICENSEThe Free Software Foundation may publish new revised versions of the GNU Free Documentation Licensefrom time to time Such new versions will be similar in spirit to the present version but may differ in detail toaddress new problems or concerns See httpwwwgnuorgcopyleft

Each version of the License is given a distinguishing version number If the Document specifies that aparticular numbered version of this License or any later version applies to it you have the option offollowing the terms and conditions either of that specified version or of any later version that has beenpublished (not as a draft) by the Free Software Foundation If the Document does not specify a versionnumber of this License you may choose any version ever published (not as a draft) by the Free SoftwareFoundation

A11 FUTURE REVISIONS OF THIS LICENSE 37

A12 ADDENDUM How to use this License foryour documentsTo use this License in a document you have written include a copy of the License in the document and put thefollowing copyright and license notices just after the title page

Copyright (c) YEAR YOUR NAME Permission is granted to copy distribute andor modifythis document under the terms of the GNU Free Documentation License Version 12 or anylater version published by the Free Software Foundation with no Invariant Sections noFrontminusCover Texts and no BackminusCover Texts A copy of the license is included in thesection entitled GNU Free Documentation License

If you have Invariant Sections FrontminusCover Texts and BackminusCover Texts replace the withTexts linewith this

with the Invariant Sections being LIST THEIR TITLES with the FrontminusCover Texts beingLIST and with the BackminusCover Texts being LIST

If you have Invariant Sections without Cover Texts or some other combination of the three merge those twoalternatives to suit the situation

If your document contains nontrivial examples of program code we recommend releasing these examples inparallel under your choice of free software license such as the GNU General Public License to permit theiruse in free software

A12 ADDENDUM How to use this License for your documents 38

• Table of Contents
• 1 Introduction
• • 11 What is 8021X
  • 12 What is 80211i
  • • 121 WEP
    • 122 80211i
    • 123 Key Management
    • 124 TSN (WPA) RSN (WPA2)
    • • 13 What is EAP
      • 14 EAP authentication methods
      • 15 What is RADIUS
      • • 2 Obtaining Certificates
        • 3 Authentication Server Setting up FreeRADIUS
        • • 31 Installing FreeRADIUS
          • 32 Configuring FreeRADIUS
          • • 4 Supplicant Setting up Xsupplicant
            • • 41 Installing Xsupplicant
              • 42 Configuring Xsupplicant
              • • 5 Authenticator Setting up the Authenticator (Access Point)
                • • 51 Access Point
                  • 52 Linux Authenticator
                  • • 6 Testbed
                    • • 61 Testcase
                      • 62 Running some tests
                      • • 7 Note about driver support and Xsupplicant
                        • 8 FAQ
                        • 9 Useful Resources
                        • 10 Copyright acknowledgments and miscellaneous
                        • • 101 Copyright and License
                          • 102 How this document was produced
                          • 103 Feedback
                          • 104 Acknowledgments
                          • • A GNU Free Documentation License
                            • A1 PREAMBLE
                            • A2 APPLICABILITY AND DEFINITIONS
                            • A3 VERBATIM COPYING
                            • A4 COPYING IN QUANTITY
                            • A5 MODIFICATIONS
                            • A6 COMBINING DOCUMENTS
                            • A7 COLLECTIONS OF DOCUMENTS
                            • A8 AGGREGATION WITH INDEPENDENT WORKS
                            • A9 TRANSLATION
                            • A10 TERMINATION
                            • A11 FUTURE REVISIONS OF THIS LICENSE
                            • A12 ADDENDUM How to use this License for your documents

A1 PREAMBLEThe purpose of this License is to make a manual textbook or other functional and useful document free inthe sense of freedom to assure everyone the effective freedom to copy and redistribute it with or withoutmodifying it either commercially or noncommercially Secondarily this License preserves for the author andpublisher a way to get credit for their work while not being considered responsible for modifications made byothers

This License is a kind of copyleft which means that derivative works of the document must themselves befree in the same sense It complements the GNU General Public License which is a copyleft license designedfor free software

We have designed this License in order to use it for manuals for free software because free software needsfree documentation a free program should come with manuals providing the same freedoms that the softwaredoes But this License is not limited to software manuals it can be used for any textual work regardless ofsubject matter or whether it is published as a printed book We recommend this License principally for workswhose purpose is instruction or reference

A1 PREAMBLE 25

A2 APPLICABILITY AND DEFINITIONSThis License applies to any manual or other work in any medium that contains a notice placed by thecopyright holder saying it can be distributed under the terms of this License Such a notice grants aworldminuswide royaltyminusfree license unlimited in duration to use that work under the conditions stated hereinThe Document below refers to any such manual or work Any member of the public is a licensee and isaddressed as you You accept the license if you copy modify or distribute the work in a way requiringpermission under copyright law

A Modified Version of the Document means any work containing the Document or a portion of it eithercopied verbatim or with modifications andor translated into another language

A Secondary Section is a named appendix or a frontminusmatter section of the Document that deals exclusivelywith the relationship of the publishers or authors of the Document to the Documents overall subject (or torelated matters) and contains nothing that could fall directly within that overall subject (Thus if theDocument is in part a textbook of mathematics a Secondary Section may not explain any mathematics) Therelationship could be a matter of historical connection with the subject or with related matters or of legalcommercial philosophical ethical or political position regarding them

The Invariant Sections are certain Secondary Sections whose titles are designated as being those ofInvariant Sections in the notice that says that the Document is released under this License If a section doesnot fit the above definition of Secondary then it is not allowed to be designated as Invariant The Documentmay contain zero Invariant Sections If the Document does not identify any Invariant Sections then there arenone

The Cover Texts are certain short passages of text that are listed as FrontminusCover Texts or BackminusCoverTexts in the notice that says that the Document is released under this License A FrontminusCover Text may be atmost 5 words and a BackminusCover Text may be at most 25 words

A Transparent copy of the Document means a machineminusreadable copy represented in a format whosespecification is available to the general public that is suitable for revising the document straightforwardlywith generic text editors or (for images composed of pixels) generic paint programs or (for drawings) somewidely available drawing editor and that is suitable for input to text formatters or for automatic translation toa variety of formats suitable for input to text formatters A copy made in an otherwise Transparent file formatwhose markup or absence of markup has been arranged to thwart or discourage subsequent modification byreaders is not Transparent An image format is not Transparent if used for any substantial amount of text Acopy that is not Transparent is called Opaque

Examples of suitable formats for Transparent copies include plain ASCII without markup Texinfo inputformat LaTeX input format SGML or XML using a publicly available DTD and standardminusconformingsimple HTML PostScript or PDF designed for human modification Examples of transparent image formatsinclude PNG XCF and JPG Opaque formats include proprietary formats that can be read and edited only byproprietary word processors SGML or XML for which the DTD andor processing tools are not generallyavailable and the machineminusgenerated HTML PostScript or PDF produced by some word processors foroutput purposes only

The Title Page means for a printed book the title page itself plus such following pages as are needed tohold legibly the material this License requires to appear in the title page For works in formats which do nothave any title page as such Title Page means the text near the most prominent appearance of the workstitle preceding the beginning of the body of the text

A2 APPLICABILITY AND DEFINITIONS 26

A section Entitled XYZ means a named subunit of the Document whose title either is precisely XYZ orcontains XYZ in parentheses following text that translates XYZ in another language (Here XYZ stands for aspecific section name mentioned below such as Acknowledgements Dedications Endorsements orHistory) To Preserve the Title of such a section when you modify the Document means that it remains asection Entitled XYZ according to this definition

The Document may include Warranty Disclaimers next to the notice which states that this License applies tothe Document These Warranty Disclaimers are considered to be included by reference in this License butonly as regards disclaiming warranties any other implication that these Warranty Disclaimers may have isvoid and has no effect on the meaning of this License

8021X PortminusBased Authentication HOWTO

A2 APPLICABILITY AND DEFINITIONS 27

A3 VERBATIM COPYINGYou may copy and distribute the Document in any medium either commercially or noncommerciallyprovided that this License the copyright notices and the license notice saying this License applies to theDocument are reproduced in all copies and that you add no other conditions whatsoever to those of thisLicense You may not use technical measures to obstruct or control the reading or further copying of thecopies you make or distribute However you may accept compensation in exchange for copies If youdistribute a large enough number of copies you must also follow the conditions in section 3

You may also lend copies under the same conditions stated above and you may publicly display copies

A3 VERBATIM COPYING 28

A4 COPYING IN QUANTITYIf you publish printed copies (or copies in media that commonly have printed covers) of the Documentnumbering more than 100 and the Documents license notice requires Cover Texts you must enclose thecopies in covers that carry clearly and legibly all these Cover Texts FrontminusCover Texts on the front coverand BackminusCover Texts on the back cover Both covers must also clearly and legibly identify you as thepublisher of these copies The front cover must present the full title with all words of the title equallyprominent and visible You may add other material on the covers in addition Copying with changes limited tothe covers as long as they preserve the title of the Document and satisfy these conditions can be treated asverbatim copying in other respects

If the required texts for either cover are too voluminous to fit legibly you should put the first ones listed (asmany as fit reasonably) on the actual cover and continue the rest onto adjacent pages

If you publish or distribute Opaque copies of the Document numbering more than 100 you must eitherinclude a machineminusreadable Transparent copy along with each Opaque copy or state in or with each Opaquecopy a computerminusnetwork location from which the general networkminususing public has access to downloadusing publicminusstandard network protocols a complete Transparent copy of the Document free of addedmaterial If you use the latter option you must take reasonably prudent steps when you begin distribution ofOpaque copies in quantity to ensure that this Transparent copy will remain thus accessible at the statedlocation until at least one year after the last time you distribute an Opaque copy (directly or through youragents or retailers) of that edition to the public

It is requested but not required that you contact the authors of the Document well before redistributing anylarge number of copies to give them a chance to provide you with an updated version of the Document

A4 COPYING IN QUANTITY 29

A5 MODIFICATIONSYou may copy and distribute a Modified Version of the Document under the conditions of sections 2 and 3above provided that you release the Modified Version under precisely this License with the ModifiedVersion filling the role of the Document thus licensing distribution and modification of the Modified Versionto whoever possesses a copy of it In addition you must do these things in the Modified Version

Use in the Title Page (and on the covers if any) a title distinct from that of the Document and fromthose of previous versions (which should if there were any be listed in the History section of theDocument) You may use the same title as a previous version if the original publisher of that versiongives permission

A

List on the Title Page as authors one or more persons or entities responsible for authorship of themodifications in the Modified Version together with at least five of the principal authors of theDocument (all of its principal authors if it has fewer than five) unless they release you from thisrequirement

B

State on the Title page the name of the publisher of the Modified Version as the publisherC Preserve all the copyright notices of the DocumentD Add an appropriate copyright notice for your modifications adjacent to the other copyright noticesE Include immediately after the copyright notices a license notice giving the public permission to usethe Modified Version under the terms of this License in the form shown in the Addendum below

F

Preserve in that license notice the full lists of Invariant Sections and required Cover Texts given in theDocuments license notice

G

Include an unaltered copy of this LicenseH Preserve the section Entitled History Preserve its Title and add to it an item stating at least the titleyear new authors and publisher of the Modified Version as given on the Title Page If there is nosection Entitled History in the Document create one stating the title year authors and publisher ofthe Document as given on its Title Page then add an item describing the Modified Version as statedin the previous sentence

I

Preserve the network location if any given in the Document for public access to a Transparent copyof the Document and likewise the network locations given in the Document for previous versions itwas based on These may be placed in the History section You may omit a network location for awork that was published at least four years before the Document itself or if the original publisher ofthe version it refers to gives permission

J

For any section Entitled Acknowledgements or Dedications Preserve the Title of the section andpreserve in the section all the substance and tone of each of the contributor acknowledgements andordedications given therein

K

Preserve all the Invariant Sections of the Document unaltered in their text and in their titles Sectionnumbers or the equivalent are not considered part of the section titles

L

Delete any section Entitled Endorsements Such a section may not be included in the ModifiedVersion

M

Do not retitle any existing section to be Entitled Endorsements or to conflict in title with anyInvariant Section

N

Preserve any Warranty DisclaimersO

If the Modified Version includes new frontminusmatter sections or appendices that qualify as Secondary Sectionsand contain no material copied from the Document you may at your option designate some or all of thesesections as invariant To do this add their titles to the list of Invariant Sections in the Modified Versionslicense notice These titles must be distinct from any other section titles

A5 MODIFICATIONS 30

You may add a section Entitled Endorsements provided it contains nothing but endorsements of yourModified Version by various partiesminusminusfor example statements of peer review or that the text has beenapproved by an organization as the authoritative definition of a standard

You may add a passage of up to five words as a FrontminusCover Text and a passage of up to 25 words as aBackminusCover Text to the end of the list of Cover Texts in the Modified Version Only one passage ofFrontminusCover Text and one of BackminusCover Text may be added by (or through arrangements made by) any oneentity If the Document already includes a cover text for the same cover previously added by you or byarrangement made by the same entity you are acting on behalf of you may not add another but you mayreplace the old one on explicit permission from the previous publisher that added the old one

The author(s) and publisher(s) of the Document do not by this License give permission to use their names forpublicity for or to assert or imply endorsement of any Modified Version

8021X PortminusBased Authentication HOWTO

A5 MODIFICATIONS 31

A6 COMBINING DOCUMENTSYou may combine the Document with other documents released under this License under the terms definedin section 4 above for modified versions provided that you include in the combination all of the InvariantSections of all of the original documents unmodified and list them all as Invariant Sections of your combinedwork in its license notice and that you preserve all their Warranty Disclaimers

The combined work need only contain one copy of this License and multiple identical Invariant Sections maybe replaced with a single copy If there are multiple Invariant Sections with the same name but differentcontents make the title of each such section unique by adding at the end of it in parentheses the name of theoriginal author or publisher of that section if known or else a unique number Make the same adjustment tothe section titles in the list of Invariant Sections in the license notice of the combined work

In the combination you must combine any sections Entitled History in the various original documentsforming one section Entitled History likewise combine any sections Entitled Acknowledgements and anysections Entitled Dedications You must delete all sections Entitled Endorsements

A6 COMBINING DOCUMENTS 32

A7 COLLECTIONS OF DOCUMENTSYou may make a collection consisting of the Document and other documents released under this License andreplace the individual copies of this License in the various documents with a single copy that is included inthe collection provided that you follow the rules of this License for verbatim copying of each of thedocuments in all other respects

You may extract a single document from such a collection and distribute it individually under this Licenseprovided you insert a copy of this License into the extracted document and follow this License in all otherrespects regarding verbatim copying of that document

A7 COLLECTIONS OF DOCUMENTS 33

A8 AGGREGATION WITH INDEPENDENT WORKSA compilation of the Document or its derivatives with other separate and independent documents or works inor on a volume of a storage or distribution medium is called an aggregate if the copyright resulting from thecompilation is not used to limit the legal rights of the compilations users beyond what the individual workspermit When the Document is included in an aggregate this License does not apply to the other works in theaggregate which are not themselves derivative works of the Document

If the Cover Text requirement of section 3 is applicable to these copies of the Document then if the Documentis less than one half of the entire aggregate the Documents Cover Texts may be placed on covers that bracketthe Document within the aggregate or the electronic equivalent of covers if the Document is in electronicform Otherwise they must appear on printed covers that bracket the whole aggregate

A8 AGGREGATION WITH INDEPENDENT WORKS 34

A9 TRANSLATIONTranslation is considered a kind of modification so you may distribute translations of the Document under theterms of section 4 Replacing Invariant Sections with translations requires special permission from theircopyright holders but you may include translations of some or all Invariant Sections in addition to theoriginal versions of these Invariant Sections You may include a translation of this License and all the licensenotices in the Document and any Warranty Disclaimers provided that you also include the original Englishversion of this License and the original versions of those notices and disclaimers In case of a disagreementbetween the translation and the original version of this License or a notice or disclaimer the original versionwill prevail

If a section in the Document is Entitled Acknowledgements Dedications or History the requirement(section 4) to Preserve its Title (section 1) will typically require changing the actual title

A9 TRANSLATION 35

A10 TERMINATIONYou may not copy modify sublicense or distribute the Document except as expressly provided for under thisLicense Any other attempt to copy modify sublicense or distribute the Document is void and willautomatically terminate your rights under this License However parties who have received copies or rightsfrom you under this License will not have their licenses terminated so long as such parties remain in fullcompliance

A10 TERMINATION 36

A11 FUTURE REVISIONS OF THIS LICENSEThe Free Software Foundation may publish new revised versions of the GNU Free Documentation Licensefrom time to time Such new versions will be similar in spirit to the present version but may differ in detail toaddress new problems or concerns See httpwwwgnuorgcopyleft

Each version of the License is given a distinguishing version number If the Document specifies that aparticular numbered version of this License or any later version applies to it you have the option offollowing the terms and conditions either of that specified version or of any later version that has beenpublished (not as a draft) by the Free Software Foundation If the Document does not specify a versionnumber of this License you may choose any version ever published (not as a draft) by the Free SoftwareFoundation

A11 FUTURE REVISIONS OF THIS LICENSE 37

A12 ADDENDUM How to use this License foryour documentsTo use this License in a document you have written include a copy of the License in the document and put thefollowing copyright and license notices just after the title page

Copyright (c) YEAR YOUR NAME Permission is granted to copy distribute andor modifythis document under the terms of the GNU Free Documentation License Version 12 or anylater version published by the Free Software Foundation with no Invariant Sections noFrontminusCover Texts and no BackminusCover Texts A copy of the license is included in thesection entitled GNU Free Documentation License

If you have Invariant Sections FrontminusCover Texts and BackminusCover Texts replace the withTexts linewith this

with the Invariant Sections being LIST THEIR TITLES with the FrontminusCover Texts beingLIST and with the BackminusCover Texts being LIST

If you have Invariant Sections without Cover Texts or some other combination of the three merge those twoalternatives to suit the situation

If your document contains nontrivial examples of program code we recommend releasing these examples inparallel under your choice of free software license such as the GNU General Public License to permit theiruse in free software

A12 ADDENDUM How to use this License for your documents 38

• Table of Contents
• 1 Introduction
• • 11 What is 8021X
  • 12 What is 80211i
  • • 121 WEP
    • 122 80211i
    • 123 Key Management
    • 124 TSN (WPA) RSN (WPA2)
    • • 13 What is EAP
      • 14 EAP authentication methods
      • 15 What is RADIUS
      • • 2 Obtaining Certificates
        • 3 Authentication Server Setting up FreeRADIUS
        • • 31 Installing FreeRADIUS
          • 32 Configuring FreeRADIUS
          • • 4 Supplicant Setting up Xsupplicant
            • • 41 Installing Xsupplicant
              • 42 Configuring Xsupplicant
              • • 5 Authenticator Setting up the Authenticator (Access Point)
                • • 51 Access Point
                  • 52 Linux Authenticator
                  • • 6 Testbed
                    • • 61 Testcase
                      • 62 Running some tests
                      • • 7 Note about driver support and Xsupplicant
                        • 8 FAQ
                        • 9 Useful Resources
                        • 10 Copyright acknowledgments and miscellaneous
                        • • 101 Copyright and License
                          • 102 How this document was produced
                          • 103 Feedback
                          • 104 Acknowledgments
                          • • A GNU Free Documentation License
                            • A1 PREAMBLE
                            • A2 APPLICABILITY AND DEFINITIONS
                            • A3 VERBATIM COPYING
                            • A4 COPYING IN QUANTITY
                            • A5 MODIFICATIONS
                            • A6 COMBINING DOCUMENTS
                            • A7 COLLECTIONS OF DOCUMENTS
                            • A8 AGGREGATION WITH INDEPENDENT WORKS
                            • A9 TRANSLATION
                            • A10 TERMINATION
                            • A11 FUTURE REVISIONS OF THIS LICENSE
                            • A12 ADDENDUM How to use this License for your documents

A2 APPLICABILITY AND DEFINITIONSThis License applies to any manual or other work in any medium that contains a notice placed by thecopyright holder saying it can be distributed under the terms of this License Such a notice grants aworldminuswide royaltyminusfree license unlimited in duration to use that work under the conditions stated hereinThe Document below refers to any such manual or work Any member of the public is a licensee and isaddressed as you You accept the license if you copy modify or distribute the work in a way requiringpermission under copyright law

A Modified Version of the Document means any work containing the Document or a portion of it eithercopied verbatim or with modifications andor translated into another language

A Secondary Section is a named appendix or a frontminusmatter section of the Document that deals exclusivelywith the relationship of the publishers or authors of the Document to the Documents overall subject (or torelated matters) and contains nothing that could fall directly within that overall subject (Thus if theDocument is in part a textbook of mathematics a Secondary Section may not explain any mathematics) Therelationship could be a matter of historical connection with the subject or with related matters or of legalcommercial philosophical ethical or political position regarding them

The Invariant Sections are certain Secondary Sections whose titles are designated as being those ofInvariant Sections in the notice that says that the Document is released under this License If a section doesnot fit the above definition of Secondary then it is not allowed to be designated as Invariant The Documentmay contain zero Invariant Sections If the Document does not identify any Invariant Sections then there arenone

The Cover Texts are certain short passages of text that are listed as FrontminusCover Texts or BackminusCoverTexts in the notice that says that the Document is released under this License A FrontminusCover Text may be atmost 5 words and a BackminusCover Text may be at most 25 words

A Transparent copy of the Document means a machineminusreadable copy represented in a format whosespecification is available to the general public that is suitable for revising the document straightforwardlywith generic text editors or (for images composed of pixels) generic paint programs or (for drawings) somewidely available drawing editor and that is suitable for input to text formatters or for automatic translation toa variety of formats suitable for input to text formatters A copy made in an otherwise Transparent file formatwhose markup or absence of markup has been arranged to thwart or discourage subsequent modification byreaders is not Transparent An image format is not Transparent if used for any substantial amount of text Acopy that is not Transparent is called Opaque

Examples of suitable formats for Transparent copies include plain ASCII without markup Texinfo inputformat LaTeX input format SGML or XML using a publicly available DTD and standardminusconformingsimple HTML PostScript or PDF designed for human modification Examples of transparent image formatsinclude PNG XCF and JPG Opaque formats include proprietary formats that can be read and edited only byproprietary word processors SGML or XML for which the DTD andor processing tools are not generallyavailable and the machineminusgenerated HTML PostScript or PDF produced by some word processors foroutput purposes only

The Title Page means for a printed book the title page itself plus such following pages as are needed tohold legibly the material this License requires to appear in the title page For works in formats which do nothave any title page as such Title Page means the text near the most prominent appearance of the workstitle preceding the beginning of the body of the text

A2 APPLICABILITY AND DEFINITIONS 26

A section Entitled XYZ means a named subunit of the Document whose title either is precisely XYZ orcontains XYZ in parentheses following text that translates XYZ in another language (Here XYZ stands for aspecific section name mentioned below such as Acknowledgements Dedications Endorsements orHistory) To Preserve the Title of such a section when you modify the Document means that it remains asection Entitled XYZ according to this definition

The Document may include Warranty Disclaimers next to the notice which states that this License applies tothe Document These Warranty Disclaimers are considered to be included by reference in this License butonly as regards disclaiming warranties any other implication that these Warranty Disclaimers may have isvoid and has no effect on the meaning of this License

8021X PortminusBased Authentication HOWTO

A2 APPLICABILITY AND DEFINITIONS 27

A3 VERBATIM COPYINGYou may copy and distribute the Document in any medium either commercially or noncommerciallyprovided that this License the copyright notices and the license notice saying this License applies to theDocument are reproduced in all copies and that you add no other conditions whatsoever to those of thisLicense You may not use technical measures to obstruct or control the reading or further copying of thecopies you make or distribute However you may accept compensation in exchange for copies If youdistribute a large enough number of copies you must also follow the conditions in section 3

You may also lend copies under the same conditions stated above and you may publicly display copies

A3 VERBATIM COPYING 28

A4 COPYING IN QUANTITYIf you publish printed copies (or copies in media that commonly have printed covers) of the Documentnumbering more than 100 and the Documents license notice requires Cover Texts you must enclose thecopies in covers that carry clearly and legibly all these Cover Texts FrontminusCover Texts on the front coverand BackminusCover Texts on the back cover Both covers must also clearly and legibly identify you as thepublisher of these copies The front cover must present the full title with all words of the title equallyprominent and visible You may add other material on the covers in addition Copying with changes limited tothe covers as long as they preserve the title of the Document and satisfy these conditions can be treated asverbatim copying in other respects

If the required texts for either cover are too voluminous to fit legibly you should put the first ones listed (asmany as fit reasonably) on the actual cover and continue the rest onto adjacent pages

If you publish or distribute Opaque copies of the Document numbering more than 100 you must eitherinclude a machineminusreadable Transparent copy along with each Opaque copy or state in or with each Opaquecopy a computerminusnetwork location from which the general networkminususing public has access to downloadusing publicminusstandard network protocols a complete Transparent copy of the Document free of addedmaterial If you use the latter option you must take reasonably prudent steps when you begin distribution ofOpaque copies in quantity to ensure that this Transparent copy will remain thus accessible at the statedlocation until at least one year after the last time you distribute an Opaque copy (directly or through youragents or retailers) of that edition to the public

It is requested but not required that you contact the authors of the Document well before redistributing anylarge number of copies to give them a chance to provide you with an updated version of the Document

A4 COPYING IN QUANTITY 29

A5 MODIFICATIONSYou may copy and distribute a Modified Version of the Document under the conditions of sections 2 and 3above provided that you release the Modified Version under precisely this License with the ModifiedVersion filling the role of the Document thus licensing distribution and modification of the Modified Versionto whoever possesses a copy of it In addition you must do these things in the Modified Version

Use in the Title Page (and on the covers if any) a title distinct from that of the Document and fromthose of previous versions (which should if there were any be listed in the History section of theDocument) You may use the same title as a previous version if the original publisher of that versiongives permission

A

List on the Title Page as authors one or more persons or entities responsible for authorship of themodifications in the Modified Version together with at least five of the principal authors of theDocument (all of its principal authors if it has fewer than five) unless they release you from thisrequirement

B

State on the Title page the name of the publisher of the Modified Version as the publisherC Preserve all the copyright notices of the DocumentD Add an appropriate copyright notice for your modifications adjacent to the other copyright noticesE Include immediately after the copyright notices a license notice giving the public permission to usethe Modified Version under the terms of this License in the form shown in the Addendum below

F

Preserve in that license notice the full lists of Invariant Sections and required Cover Texts given in theDocuments license notice

G

Include an unaltered copy of this LicenseH Preserve the section Entitled History Preserve its Title and add to it an item stating at least the titleyear new authors and publisher of the Modified Version as given on the Title Page If there is nosection Entitled History in the Document create one stating the title year authors and publisher ofthe Document as given on its Title Page then add an item describing the Modified Version as statedin the previous sentence

I

Preserve the network location if any given in the Document for public access to a Transparent copyof the Document and likewise the network locations given in the Document for previous versions itwas based on These may be placed in the History section You may omit a network location for awork that was published at least four years before the Document itself or if the original publisher ofthe version it refers to gives permission

J

For any section Entitled Acknowledgements or Dedications Preserve the Title of the section andpreserve in the section all the substance and tone of each of the contributor acknowledgements andordedications given therein

K

Preserve all the Invariant Sections of the Document unaltered in their text and in their titles Sectionnumbers or the equivalent are not considered part of the section titles

L

Delete any section Entitled Endorsements Such a section may not be included in the ModifiedVersion

M

Do not retitle any existing section to be Entitled Endorsements or to conflict in title with anyInvariant Section

N

Preserve any Warranty DisclaimersO

If the Modified Version includes new frontminusmatter sections or appendices that qualify as Secondary Sectionsand contain no material copied from the Document you may at your option designate some or all of thesesections as invariant To do this add their titles to the list of Invariant Sections in the Modified Versionslicense notice These titles must be distinct from any other section titles

A5 MODIFICATIONS 30

You may add a section Entitled Endorsements provided it contains nothing but endorsements of yourModified Version by various partiesminusminusfor example statements of peer review or that the text has beenapproved by an organization as the authoritative definition of a standard

You may add a passage of up to five words as a FrontminusCover Text and a passage of up to 25 words as aBackminusCover Text to the end of the list of Cover Texts in the Modified Version Only one passage ofFrontminusCover Text and one of BackminusCover Text may be added by (or through arrangements made by) any oneentity If the Document already includes a cover text for the same cover previously added by you or byarrangement made by the same entity you are acting on behalf of you may not add another but you mayreplace the old one on explicit permission from the previous publisher that added the old one

The author(s) and publisher(s) of the Document do not by this License give permission to use their names forpublicity for or to assert or imply endorsement of any Modified Version

8021X PortminusBased Authentication HOWTO

A5 MODIFICATIONS 31

A6 COMBINING DOCUMENTSYou may combine the Document with other documents released under this License under the terms definedin section 4 above for modified versions provided that you include in the combination all of the InvariantSections of all of the original documents unmodified and list them all as Invariant Sections of your combinedwork in its license notice and that you preserve all their Warranty Disclaimers

The combined work need only contain one copy of this License and multiple identical Invariant Sections maybe replaced with a single copy If there are multiple Invariant Sections with the same name but differentcontents make the title of each such section unique by adding at the end of it in parentheses the name of theoriginal author or publisher of that section if known or else a unique number Make the same adjustment tothe section titles in the list of Invariant Sections in the license notice of the combined work

In the combination you must combine any sections Entitled History in the various original documentsforming one section Entitled History likewise combine any sections Entitled Acknowledgements and anysections Entitled Dedications You must delete all sections Entitled Endorsements

A6 COMBINING DOCUMENTS 32

A7 COLLECTIONS OF DOCUMENTSYou may make a collection consisting of the Document and other documents released under this License andreplace the individual copies of this License in the various documents with a single copy that is included inthe collection provided that you follow the rules of this License for verbatim copying of each of thedocuments in all other respects

You may extract a single document from such a collection and distribute it individually under this Licenseprovided you insert a copy of this License into the extracted document and follow this License in all otherrespects regarding verbatim copying of that document

A7 COLLECTIONS OF DOCUMENTS 33

A8 AGGREGATION WITH INDEPENDENT WORKSA compilation of the Document or its derivatives with other separate and independent documents or works inor on a volume of a storage or distribution medium is called an aggregate if the copyright resulting from thecompilation is not used to limit the legal rights of the compilations users beyond what the individual workspermit When the Document is included in an aggregate this License does not apply to the other works in theaggregate which are not themselves derivative works of the Document

If the Cover Text requirement of section 3 is applicable to these copies of the Document then if the Documentis less than one half of the entire aggregate the Documents Cover Texts may be placed on covers that bracketthe Document within the aggregate or the electronic equivalent of covers if the Document is in electronicform Otherwise they must appear on printed covers that bracket the whole aggregate

A8 AGGREGATION WITH INDEPENDENT WORKS 34

A9 TRANSLATIONTranslation is considered a kind of modification so you may distribute translations of the Document under theterms of section 4 Replacing Invariant Sections with translations requires special permission from theircopyright holders but you may include translations of some or all Invariant Sections in addition to theoriginal versions of these Invariant Sections You may include a translation of this License and all the licensenotices in the Document and any Warranty Disclaimers provided that you also include the original Englishversion of this License and the original versions of those notices and disclaimers In case of a disagreementbetween the translation and the original version of this License or a notice or disclaimer the original versionwill prevail

If a section in the Document is Entitled Acknowledgements Dedications or History the requirement(section 4) to Preserve its Title (section 1) will typically require changing the actual title

A9 TRANSLATION 35

A10 TERMINATIONYou may not copy modify sublicense or distribute the Document except as expressly provided for under thisLicense Any other attempt to copy modify sublicense or distribute the Document is void and willautomatically terminate your rights under this License However parties who have received copies or rightsfrom you under this License will not have their licenses terminated so long as such parties remain in fullcompliance

A10 TERMINATION 36

A11 FUTURE REVISIONS OF THIS LICENSEThe Free Software Foundation may publish new revised versions of the GNU Free Documentation Licensefrom time to time Such new versions will be similar in spirit to the present version but may differ in detail toaddress new problems or concerns See httpwwwgnuorgcopyleft

Each version of the License is given a distinguishing version number If the Document specifies that aparticular numbered version of this License or any later version applies to it you have the option offollowing the terms and conditions either of that specified version or of any later version that has beenpublished (not as a draft) by the Free Software Foundation If the Document does not specify a versionnumber of this License you may choose any version ever published (not as a draft) by the Free SoftwareFoundation

A11 FUTURE REVISIONS OF THIS LICENSE 37

A12 ADDENDUM How to use this License foryour documentsTo use this License in a document you have written include a copy of the License in the document and put thefollowing copyright and license notices just after the title page

Copyright (c) YEAR YOUR NAME Permission is granted to copy distribute andor modifythis document under the terms of the GNU Free Documentation License Version 12 or anylater version published by the Free Software Foundation with no Invariant Sections noFrontminusCover Texts and no BackminusCover Texts A copy of the license is included in thesection entitled GNU Free Documentation License

If you have Invariant Sections FrontminusCover Texts and BackminusCover Texts replace the withTexts linewith this

with the Invariant Sections being LIST THEIR TITLES with the FrontminusCover Texts beingLIST and with the BackminusCover Texts being LIST

If you have Invariant Sections without Cover Texts or some other combination of the three merge those twoalternatives to suit the situation

If your document contains nontrivial examples of program code we recommend releasing these examples inparallel under your choice of free software license such as the GNU General Public License to permit theiruse in free software

A12 ADDENDUM How to use this License for your documents 38

• Table of Contents
• 1 Introduction
• • 11 What is 8021X
  • 12 What is 80211i
  • • 121 WEP
    • 122 80211i
    • 123 Key Management
    • 124 TSN (WPA) RSN (WPA2)
    • • 13 What is EAP
      • 14 EAP authentication methods
      • 15 What is RADIUS
      • • 2 Obtaining Certificates
        • 3 Authentication Server Setting up FreeRADIUS
        • • 31 Installing FreeRADIUS
          • 32 Configuring FreeRADIUS
          • • 4 Supplicant Setting up Xsupplicant
            • • 41 Installing Xsupplicant
              • 42 Configuring Xsupplicant
              • • 5 Authenticator Setting up the Authenticator (Access Point)
                • • 51 Access Point
                  • 52 Linux Authenticator
                  • • 6 Testbed
                    • • 61 Testcase
                      • 62 Running some tests
                      • • 7 Note about driver support and Xsupplicant
                        • 8 FAQ
                        • 9 Useful Resources
                        • 10 Copyright acknowledgments and miscellaneous
                        • • 101 Copyright and License
                          • 102 How this document was produced
                          • 103 Feedback
                          • 104 Acknowledgments
                          • • A GNU Free Documentation License
                            • A1 PREAMBLE
                            • A2 APPLICABILITY AND DEFINITIONS
                            • A3 VERBATIM COPYING
                            • A4 COPYING IN QUANTITY
                            • A5 MODIFICATIONS
                            • A6 COMBINING DOCUMENTS
                            • A7 COLLECTIONS OF DOCUMENTS
                            • A8 AGGREGATION WITH INDEPENDENT WORKS
                            • A9 TRANSLATION
                            • A10 TERMINATION
                            • A11 FUTURE REVISIONS OF THIS LICENSE
                            • A12 ADDENDUM How to use this License for your documents

A section Entitled XYZ means a named subunit of the Document whose title either is precisely XYZ orcontains XYZ in parentheses following text that translates XYZ in another language (Here XYZ stands for aspecific section name mentioned below such as Acknowledgements Dedications Endorsements orHistory) To Preserve the Title of such a section when you modify the Document means that it remains asection Entitled XYZ according to this definition

The Document may include Warranty Disclaimers next to the notice which states that this License applies tothe Document These Warranty Disclaimers are considered to be included by reference in this License butonly as regards disclaiming warranties any other implication that these Warranty Disclaimers may have isvoid and has no effect on the meaning of this License

8021X PortminusBased Authentication HOWTO

A2 APPLICABILITY AND DEFINITIONS 27

A3 VERBATIM COPYINGYou may copy and distribute the Document in any medium either commercially or noncommerciallyprovided that this License the copyright notices and the license notice saying this License applies to theDocument are reproduced in all copies and that you add no other conditions whatsoever to those of thisLicense You may not use technical measures to obstruct or control the reading or further copying of thecopies you make or distribute However you may accept compensation in exchange for copies If youdistribute a large enough number of copies you must also follow the conditions in section 3

You may also lend copies under the same conditions stated above and you may publicly display copies

A3 VERBATIM COPYING 28

A4 COPYING IN QUANTITYIf you publish printed copies (or copies in media that commonly have printed covers) of the Documentnumbering more than 100 and the Documents license notice requires Cover Texts you must enclose thecopies in covers that carry clearly and legibly all these Cover Texts FrontminusCover Texts on the front coverand BackminusCover Texts on the back cover Both covers must also clearly and legibly identify you as thepublisher of these copies The front cover must present the full title with all words of the title equallyprominent and visible You may add other material on the covers in addition Copying with changes limited tothe covers as long as they preserve the title of the Document and satisfy these conditions can be treated asverbatim copying in other respects

If the required texts for either cover are too voluminous to fit legibly you should put the first ones listed (asmany as fit reasonably) on the actual cover and continue the rest onto adjacent pages

If you publish or distribute Opaque copies of the Document numbering more than 100 you must eitherinclude a machineminusreadable Transparent copy along with each Opaque copy or state in or with each Opaquecopy a computerminusnetwork location from which the general networkminususing public has access to downloadusing publicminusstandard network protocols a complete Transparent copy of the Document free of addedmaterial If you use the latter option you must take reasonably prudent steps when you begin distribution ofOpaque copies in quantity to ensure that this Transparent copy will remain thus accessible at the statedlocation until at least one year after the last time you distribute an Opaque copy (directly or through youragents or retailers) of that edition to the public

It is requested but not required that you contact the authors of the Document well before redistributing anylarge number of copies to give them a chance to provide you with an updated version of the Document

A4 COPYING IN QUANTITY 29

A5 MODIFICATIONSYou may copy and distribute a Modified Version of the Document under the conditions of sections 2 and 3above provided that you release the Modified Version under precisely this License with the ModifiedVersion filling the role of the Document thus licensing distribution and modification of the Modified Versionto whoever possesses a copy of it In addition you must do these things in the Modified Version

Use in the Title Page (and on the covers if any) a title distinct from that of the Document and fromthose of previous versions (which should if there were any be listed in the History section of theDocument) You may use the same title as a previous version if the original publisher of that versiongives permission

A

List on the Title Page as authors one or more persons or entities responsible for authorship of themodifications in the Modified Version together with at least five of the principal authors of theDocument (all of its principal authors if it has fewer than five) unless they release you from thisrequirement

B

State on the Title page the name of the publisher of the Modified Version as the publisherC Preserve all the copyright notices of the DocumentD Add an appropriate copyright notice for your modifications adjacent to the other copyright noticesE Include immediately after the copyright notices a license notice giving the public permission to usethe Modified Version under the terms of this License in the form shown in the Addendum below

F

Preserve in that license notice the full lists of Invariant Sections and required Cover Texts given in theDocuments license notice

G

Include an unaltered copy of this LicenseH Preserve the section Entitled History Preserve its Title and add to it an item stating at least the titleyear new authors and publisher of the Modified Version as given on the Title Page If there is nosection Entitled History in the Document create one stating the title year authors and publisher ofthe Document as given on its Title Page then add an item describing the Modified Version as statedin the previous sentence

I

Preserve the network location if any given in the Document for public access to a Transparent copyof the Document and likewise the network locations given in the Document for previous versions itwas based on These may be placed in the History section You may omit a network location for awork that was published at least four years before the Document itself or if the original publisher ofthe version it refers to gives permission

J

For any section Entitled Acknowledgements or Dedications Preserve the Title of the section andpreserve in the section all the substance and tone of each of the contributor acknowledgements andordedications given therein

K

Preserve all the Invariant Sections of the Document unaltered in their text and in their titles Sectionnumbers or the equivalent are not considered part of the section titles

L

Delete any section Entitled Endorsements Such a section may not be included in the ModifiedVersion

M

Do not retitle any existing section to be Entitled Endorsements or to conflict in title with anyInvariant Section

N

Preserve any Warranty DisclaimersO

If the Modified Version includes new frontminusmatter sections or appendices that qualify as Secondary Sectionsand contain no material copied from the Document you may at your option designate some or all of thesesections as invariant To do this add their titles to the list of Invariant Sections in the Modified Versionslicense notice These titles must be distinct from any other section titles

A5 MODIFICATIONS 30

You may add a section Entitled Endorsements provided it contains nothing but endorsements of yourModified Version by various partiesminusminusfor example statements of peer review or that the text has beenapproved by an organization as the authoritative definition of a standard

You may add a passage of up to five words as a FrontminusCover Text and a passage of up to 25 words as aBackminusCover Text to the end of the list of Cover Texts in the Modified Version Only one passage ofFrontminusCover Text and one of BackminusCover Text may be added by (or through arrangements made by) any oneentity If the Document already includes a cover text for the same cover previously added by you or byarrangement made by the same entity you are acting on behalf of you may not add another but you mayreplace the old one on explicit permission from the previous publisher that added the old one

The author(s) and publisher(s) of the Document do not by this License give permission to use their names forpublicity for or to assert or imply endorsement of any Modified Version

8021X PortminusBased Authentication HOWTO

A5 MODIFICATIONS 31

A6 COMBINING DOCUMENTSYou may combine the Document with other documents released under this License under the terms definedin section 4 above for modified versions provided that you include in the combination all of the InvariantSections of all of the original documents unmodified and list them all as Invariant Sections of your combinedwork in its license notice and that you preserve all their Warranty Disclaimers

The combined work need only contain one copy of this License and multiple identical Invariant Sections maybe replaced with a single copy If there are multiple Invariant Sections with the same name but differentcontents make the title of each such section unique by adding at the end of it in parentheses the name of theoriginal author or publisher of that section if known or else a unique number Make the same adjustment tothe section titles in the list of Invariant Sections in the license notice of the combined work

In the combination you must combine any sections Entitled History in the various original documentsforming one section Entitled History likewise combine any sections Entitled Acknowledgements and anysections Entitled Dedications You must delete all sections Entitled Endorsements

A6 COMBINING DOCUMENTS 32

A7 COLLECTIONS OF DOCUMENTSYou may make a collection consisting of the Document and other documents released under this License andreplace the individual copies of this License in the various documents with a single copy that is included inthe collection provided that you follow the rules of this License for verbatim copying of each of thedocuments in all other respects

You may extract a single document from such a collection and distribute it individually under this Licenseprovided you insert a copy of this License into the extracted document and follow this License in all otherrespects regarding verbatim copying of that document

A7 COLLECTIONS OF DOCUMENTS 33

A8 AGGREGATION WITH INDEPENDENT WORKSA compilation of the Document or its derivatives with other separate and independent documents or works inor on a volume of a storage or distribution medium is called an aggregate if the copyright resulting from thecompilation is not used to limit the legal rights of the compilations users beyond what the individual workspermit When the Document is included in an aggregate this License does not apply to the other works in theaggregate which are not themselves derivative works of the Document

If the Cover Text requirement of section 3 is applicable to these copies of the Document then if the Documentis less than one half of the entire aggregate the Documents Cover Texts may be placed on covers that bracketthe Document within the aggregate or the electronic equivalent of covers if the Document is in electronicform Otherwise they must appear on printed covers that bracket the whole aggregate

A8 AGGREGATION WITH INDEPENDENT WORKS 34

A9 TRANSLATIONTranslation is considered a kind of modification so you may distribute translations of the Document under theterms of section 4 Replacing Invariant Sections with translations requires special permission from theircopyright holders but you may include translations of some or all Invariant Sections in addition to theoriginal versions of these Invariant Sections You may include a translation of this License and all the licensenotices in the Document and any Warranty Disclaimers provided that you also include the original Englishversion of this License and the original versions of those notices and disclaimers In case of a disagreementbetween the translation and the original version of this License or a notice or disclaimer the original versionwill prevail

If a section in the Document is Entitled Acknowledgements Dedications or History the requirement(section 4) to Preserve its Title (section 1) will typically require changing the actual title

A9 TRANSLATION 35

A10 TERMINATIONYou may not copy modify sublicense or distribute the Document except as expressly provided for under thisLicense Any other attempt to copy modify sublicense or distribute the Document is void and willautomatically terminate your rights under this License However parties who have received copies or rightsfrom you under this License will not have their licenses terminated so long as such parties remain in fullcompliance

A10 TERMINATION 36

A11 FUTURE REVISIONS OF THIS LICENSEThe Free Software Foundation may publish new revised versions of the GNU Free Documentation Licensefrom time to time Such new versions will be similar in spirit to the present version but may differ in detail toaddress new problems or concerns See httpwwwgnuorgcopyleft

Each version of the License is given a distinguishing version number If the Document specifies that aparticular numbered version of this License or any later version applies to it you have the option offollowing the terms and conditions either of that specified version or of any later version that has beenpublished (not as a draft) by the Free Software Foundation If the Document does not specify a versionnumber of this License you may choose any version ever published (not as a draft) by the Free SoftwareFoundation

A11 FUTURE REVISIONS OF THIS LICENSE 37

A12 ADDENDUM How to use this License foryour documentsTo use this License in a document you have written include a copy of the License in the document and put thefollowing copyright and license notices just after the title page

Copyright (c) YEAR YOUR NAME Permission is granted to copy distribute andor modifythis document under the terms of the GNU Free Documentation License Version 12 or anylater version published by the Free Software Foundation with no Invariant Sections noFrontminusCover Texts and no BackminusCover Texts A copy of the license is included in thesection entitled GNU Free Documentation License

If you have Invariant Sections FrontminusCover Texts and BackminusCover Texts replace the withTexts linewith this

with the Invariant Sections being LIST THEIR TITLES with the FrontminusCover Texts beingLIST and with the BackminusCover Texts being LIST

If you have Invariant Sections without Cover Texts or some other combination of the three merge those twoalternatives to suit the situation

If your document contains nontrivial examples of program code we recommend releasing these examples inparallel under your choice of free software license such as the GNU General Public License to permit theiruse in free software

A12 ADDENDUM How to use this License for your documents 38

• Table of Contents
• 1 Introduction
• • 11 What is 8021X
  • 12 What is 80211i
  • • 121 WEP
    • 122 80211i
    • 123 Key Management
    • 124 TSN (WPA) RSN (WPA2)
    • • 13 What is EAP
      • 14 EAP authentication methods
      • 15 What is RADIUS
      • • 2 Obtaining Certificates
        • 3 Authentication Server Setting up FreeRADIUS
        • • 31 Installing FreeRADIUS
          • 32 Configuring FreeRADIUS
          • • 4 Supplicant Setting up Xsupplicant
            • • 41 Installing Xsupplicant
              • 42 Configuring Xsupplicant
              • • 5 Authenticator Setting up the Authenticator (Access Point)
                • • 51 Access Point
                  • 52 Linux Authenticator
                  • • 6 Testbed
                    • • 61 Testcase
                      • 62 Running some tests
                      • • 7 Note about driver support and Xsupplicant
                        • 8 FAQ
                        • 9 Useful Resources
                        • 10 Copyright acknowledgments and miscellaneous
                        • • 101 Copyright and License
                          • 102 How this document was produced
                          • 103 Feedback
                          • 104 Acknowledgments
                          • • A GNU Free Documentation License
                            • A1 PREAMBLE
                            • A2 APPLICABILITY AND DEFINITIONS
                            • A3 VERBATIM COPYING
                            • A4 COPYING IN QUANTITY
                            • A5 MODIFICATIONS
                            • A6 COMBINING DOCUMENTS
                            • A7 COLLECTIONS OF DOCUMENTS
                            • A8 AGGREGATION WITH INDEPENDENT WORKS
                            • A9 TRANSLATION
                            • A10 TERMINATION
                            • A11 FUTURE REVISIONS OF THIS LICENSE
                            • A12 ADDENDUM How to use this License for your documents

A3 VERBATIM COPYINGYou may copy and distribute the Document in any medium either commercially or noncommerciallyprovided that this License the copyright notices and the license notice saying this License applies to theDocument are reproduced in all copies and that you add no other conditions whatsoever to those of thisLicense You may not use technical measures to obstruct or control the reading or further copying of thecopies you make or distribute However you may accept compensation in exchange for copies If youdistribute a large enough number of copies you must also follow the conditions in section 3

You may also lend copies under the same conditions stated above and you may publicly display copies

A3 VERBATIM COPYING 28

A4 COPYING IN QUANTITYIf you publish printed copies (or copies in media that commonly have printed covers) of the Documentnumbering more than 100 and the Documents license notice requires Cover Texts you must enclose thecopies in covers that carry clearly and legibly all these Cover Texts FrontminusCover Texts on the front coverand BackminusCover Texts on the back cover Both covers must also clearly and legibly identify you as thepublisher of these copies The front cover must present the full title with all words of the title equallyprominent and visible You may add other material on the covers in addition Copying with changes limited tothe covers as long as they preserve the title of the Document and satisfy these conditions can be treated asverbatim copying in other respects

If the required texts for either cover are too voluminous to fit legibly you should put the first ones listed (asmany as fit reasonably) on the actual cover and continue the rest onto adjacent pages

If you publish or distribute Opaque copies of the Document numbering more than 100 you must eitherinclude a machineminusreadable Transparent copy along with each Opaque copy or state in or with each Opaquecopy a computerminusnetwork location from which the general networkminususing public has access to downloadusing publicminusstandard network protocols a complete Transparent copy of the Document free of addedmaterial If you use the latter option you must take reasonably prudent steps when you begin distribution ofOpaque copies in quantity to ensure that this Transparent copy will remain thus accessible at the statedlocation until at least one year after the last time you distribute an Opaque copy (directly or through youragents or retailers) of that edition to the public

It is requested but not required that you contact the authors of the Document well before redistributing anylarge number of copies to give them a chance to provide you with an updated version of the Document

A4 COPYING IN QUANTITY 29

A5 MODIFICATIONSYou may copy and distribute a Modified Version of the Document under the conditions of sections 2 and 3above provided that you release the Modified Version under precisely this License with the ModifiedVersion filling the role of the Document thus licensing distribution and modification of the Modified Versionto whoever possesses a copy of it In addition you must do these things in the Modified Version

Use in the Title Page (and on the covers if any) a title distinct from that of the Document and fromthose of previous versions (which should if there were any be listed in the History section of theDocument) You may use the same title as a previous version if the original publisher of that versiongives permission

A

List on the Title Page as authors one or more persons or entities responsible for authorship of themodifications in the Modified Version together with at least five of the principal authors of theDocument (all of its principal authors if it has fewer than five) unless they release you from thisrequirement

B

State on the Title page the name of the publisher of the Modified Version as the publisherC Preserve all the copyright notices of the DocumentD Add an appropriate copyright notice for your modifications adjacent to the other copyright noticesE Include immediately after the copyright notices a license notice giving the public permission to usethe Modified Version under the terms of this License in the form shown in the Addendum below

F

Preserve in that license notice the full lists of Invariant Sections and required Cover Texts given in theDocuments license notice

G

Include an unaltered copy of this LicenseH Preserve the section Entitled History Preserve its Title and add to it an item stating at least the titleyear new authors and publisher of the Modified Version as given on the Title Page If there is nosection Entitled History in the Document create one stating the title year authors and publisher ofthe Document as given on its Title Page then add an item describing the Modified Version as statedin the previous sentence

I

Preserve the network location if any given in the Document for public access to a Transparent copyof the Document and likewise the network locations given in the Document for previous versions itwas based on These may be placed in the History section You may omit a network location for awork that was published at least four years before the Document itself or if the original publisher ofthe version it refers to gives permission

J

For any section Entitled Acknowledgements or Dedications Preserve the Title of the section andpreserve in the section all the substance and tone of each of the contributor acknowledgements andordedications given therein

K

Preserve all the Invariant Sections of the Document unaltered in their text and in their titles Sectionnumbers or the equivalent are not considered part of the section titles

L

Delete any section Entitled Endorsements Such a section may not be included in the ModifiedVersion

M

Do not retitle any existing section to be Entitled Endorsements or to conflict in title with anyInvariant Section

N

Preserve any Warranty DisclaimersO

If the Modified Version includes new frontminusmatter sections or appendices that qualify as Secondary Sectionsand contain no material copied from the Document you may at your option designate some or all of thesesections as invariant To do this add their titles to the list of Invariant Sections in the Modified Versionslicense notice These titles must be distinct from any other section titles

A5 MODIFICATIONS 30

You may add a section Entitled Endorsements provided it contains nothing but endorsements of yourModified Version by various partiesminusminusfor example statements of peer review or that the text has beenapproved by an organization as the authoritative definition of a standard

You may add a passage of up to five words as a FrontminusCover Text and a passage of up to 25 words as aBackminusCover Text to the end of the list of Cover Texts in the Modified Version Only one passage ofFrontminusCover Text and one of BackminusCover Text may be added by (or through arrangements made by) any oneentity If the Document already includes a cover text for the same cover previously added by you or byarrangement made by the same entity you are acting on behalf of you may not add another but you mayreplace the old one on explicit permission from the previous publisher that added the old one

The author(s) and publisher(s) of the Document do not by this License give permission to use their names forpublicity for or to assert or imply endorsement of any Modified Version

8021X PortminusBased Authentication HOWTO

A5 MODIFICATIONS 31

A6 COMBINING DOCUMENTSYou may combine the Document with other documents released under this License under the terms definedin section 4 above for modified versions provided that you include in the combination all of the InvariantSections of all of the original documents unmodified and list them all as Invariant Sections of your combinedwork in its license notice and that you preserve all their Warranty Disclaimers

The combined work need only contain one copy of this License and multiple identical Invariant Sections maybe replaced with a single copy If there are multiple Invariant Sections with the same name but differentcontents make the title of each such section unique by adding at the end of it in parentheses the name of theoriginal author or publisher of that section if known or else a unique number Make the same adjustment tothe section titles in the list of Invariant Sections in the license notice of the combined work

In the combination you must combine any sections Entitled History in the various original documentsforming one section Entitled History likewise combine any sections Entitled Acknowledgements and anysections Entitled Dedications You must delete all sections Entitled Endorsements

A6 COMBINING DOCUMENTS 32

A7 COLLECTIONS OF DOCUMENTSYou may make a collection consisting of the Document and other documents released under this License andreplace the individual copies of this License in the various documents with a single copy that is included inthe collection provided that you follow the rules of this License for verbatim copying of each of thedocuments in all other respects

You may extract a single document from such a collection and distribute it individually under this Licenseprovided you insert a copy of this License into the extracted document and follow this License in all otherrespects regarding verbatim copying of that document

A7 COLLECTIONS OF DOCUMENTS 33

A8 AGGREGATION WITH INDEPENDENT WORKSA compilation of the Document or its derivatives with other separate and independent documents or works inor on a volume of a storage or distribution medium is called an aggregate if the copyright resulting from thecompilation is not used to limit the legal rights of the compilations users beyond what the individual workspermit When the Document is included in an aggregate this License does not apply to the other works in theaggregate which are not themselves derivative works of the Document

If the Cover Text requirement of section 3 is applicable to these copies of the Document then if the Documentis less than one half of the entire aggregate the Documents Cover Texts may be placed on covers that bracketthe Document within the aggregate or the electronic equivalent of covers if the Document is in electronicform Otherwise they must appear on printed covers that bracket the whole aggregate

A8 AGGREGATION WITH INDEPENDENT WORKS 34

A9 TRANSLATIONTranslation is considered a kind of modification so you may distribute translations of the Document under theterms of section 4 Replacing Invariant Sections with translations requires special permission from theircopyright holders but you may include translations of some or all Invariant Sections in addition to theoriginal versions of these Invariant Sections You may include a translation of this License and all the licensenotices in the Document and any Warranty Disclaimers provided that you also include the original Englishversion of this License and the original versions of those notices and disclaimers In case of a disagreementbetween the translation and the original version of this License or a notice or disclaimer the original versionwill prevail

If a section in the Document is Entitled Acknowledgements Dedications or History the requirement(section 4) to Preserve its Title (section 1) will typically require changing the actual title

A9 TRANSLATION 35

A10 TERMINATIONYou may not copy modify sublicense or distribute the Document except as expressly provided for under thisLicense Any other attempt to copy modify sublicense or distribute the Document is void and willautomatically terminate your rights under this License However parties who have received copies or rightsfrom you under this License will not have their licenses terminated so long as such parties remain in fullcompliance

A10 TERMINATION 36

A11 FUTURE REVISIONS OF THIS LICENSEThe Free Software Foundation may publish new revised versions of the GNU Free Documentation Licensefrom time to time Such new versions will be similar in spirit to the present version but may differ in detail toaddress new problems or concerns See httpwwwgnuorgcopyleft

Each version of the License is given a distinguishing version number If the Document specifies that aparticular numbered version of this License or any later version applies to it you have the option offollowing the terms and conditions either of that specified version or of any later version that has beenpublished (not as a draft) by the Free Software Foundation If the Document does not specify a versionnumber of this License you may choose any version ever published (not as a draft) by the Free SoftwareFoundation

A11 FUTURE REVISIONS OF THIS LICENSE 37

A12 ADDENDUM How to use this License foryour documentsTo use this License in a document you have written include a copy of the License in the document and put thefollowing copyright and license notices just after the title page

Copyright (c) YEAR YOUR NAME Permission is granted to copy distribute andor modifythis document under the terms of the GNU Free Documentation License Version 12 or anylater version published by the Free Software Foundation with no Invariant Sections noFrontminusCover Texts and no BackminusCover Texts A copy of the license is included in thesection entitled GNU Free Documentation License

If you have Invariant Sections FrontminusCover Texts and BackminusCover Texts replace the withTexts linewith this

with the Invariant Sections being LIST THEIR TITLES with the FrontminusCover Texts beingLIST and with the BackminusCover Texts being LIST

If you have Invariant Sections without Cover Texts or some other combination of the three merge those twoalternatives to suit the situation

If your document contains nontrivial examples of program code we recommend releasing these examples inparallel under your choice of free software license such as the GNU General Public License to permit theiruse in free software

A12 ADDENDUM How to use this License for your documents 38

• Table of Contents
• 1 Introduction
• • 11 What is 8021X
  • 12 What is 80211i
  • • 121 WEP
    • 122 80211i
    • 123 Key Management
    • 124 TSN (WPA) RSN (WPA2)
    • • 13 What is EAP
      • 14 EAP authentication methods
      • 15 What is RADIUS
      • • 2 Obtaining Certificates
        • 3 Authentication Server Setting up FreeRADIUS
        • • 31 Installing FreeRADIUS
          • 32 Configuring FreeRADIUS
          • • 4 Supplicant Setting up Xsupplicant
            • • 41 Installing Xsupplicant
              • 42 Configuring Xsupplicant
              • • 5 Authenticator Setting up the Authenticator (Access Point)
                • • 51 Access Point
                  • 52 Linux Authenticator
                  • • 6 Testbed
                    • • 61 Testcase
                      • 62 Running some tests
                      • • 7 Note about driver support and Xsupplicant
                        • 8 FAQ
                        • 9 Useful Resources
                        • 10 Copyright acknowledgments and miscellaneous
                        • • 101 Copyright and License
                          • 102 How this document was produced
                          • 103 Feedback
                          • 104 Acknowledgments
                          • • A GNU Free Documentation License
                            • A1 PREAMBLE
                            • A2 APPLICABILITY AND DEFINITIONS
                            • A3 VERBATIM COPYING
                            • A4 COPYING IN QUANTITY
                            • A5 MODIFICATIONS
                            • A6 COMBINING DOCUMENTS
                            • A7 COLLECTIONS OF DOCUMENTS
                            • A8 AGGREGATION WITH INDEPENDENT WORKS
                            • A9 TRANSLATION
                            • A10 TERMINATION
                            • A11 FUTURE REVISIONS OF THIS LICENSE
                            • A12 ADDENDUM How to use this License for your documents

A4 COPYING IN QUANTITYIf you publish printed copies (or copies in media that commonly have printed covers) of the Documentnumbering more than 100 and the Documents license notice requires Cover Texts you must enclose thecopies in covers that carry clearly and legibly all these Cover Texts FrontminusCover Texts on the front coverand BackminusCover Texts on the back cover Both covers must also clearly and legibly identify you as thepublisher of these copies The front cover must present the full title with all words of the title equallyprominent and visible You may add other material on the covers in addition Copying with changes limited tothe covers as long as they preserve the title of the Document and satisfy these conditions can be treated asverbatim copying in other respects

If the required texts for either cover are too voluminous to fit legibly you should put the first ones listed (asmany as fit reasonably) on the actual cover and continue the rest onto adjacent pages

If you publish or distribute Opaque copies of the Document numbering more than 100 you must eitherinclude a machineminusreadable Transparent copy along with each Opaque copy or state in or with each Opaquecopy a computerminusnetwork location from which the general networkminususing public has access to downloadusing publicminusstandard network protocols a complete Transparent copy of the Document free of addedmaterial If you use the latter option you must take reasonably prudent steps when you begin distribution ofOpaque copies in quantity to ensure that this Transparent copy will remain thus accessible at the statedlocation until at least one year after the last time you distribute an Opaque copy (directly or through youragents or retailers) of that edition to the public

It is requested but not required that you contact the authors of the Document well before redistributing anylarge number of copies to give them a chance to provide you with an updated version of the Document

A4 COPYING IN QUANTITY 29

A5 MODIFICATIONSYou may copy and distribute a Modified Version of the Document under the conditions of sections 2 and 3above provided that you release the Modified Version under precisely this License with the ModifiedVersion filling the role of the Document thus licensing distribution and modification of the Modified Versionto whoever possesses a copy of it In addition you must do these things in the Modified Version

Use in the Title Page (and on the covers if any) a title distinct from that of the Document and fromthose of previous versions (which should if there were any be listed in the History section of theDocument) You may use the same title as a previous version if the original publisher of that versiongives permission

A

List on the Title Page as authors one or more persons or entities responsible for authorship of themodifications in the Modified Version together with at least five of the principal authors of theDocument (all of its principal authors if it has fewer than five) unless they release you from thisrequirement

B

State on the Title page the name of the publisher of the Modified Version as the publisherC Preserve all the copyright notices of the DocumentD Add an appropriate copyright notice for your modifications adjacent to the other copyright noticesE Include immediately after the copyright notices a license notice giving the public permission to usethe Modified Version under the terms of this License in the form shown in the Addendum below

F

Preserve in that license notice the full lists of Invariant Sections and required Cover Texts given in theDocuments license notice

G

Include an unaltered copy of this LicenseH Preserve the section Entitled History Preserve its Title and add to it an item stating at least the titleyear new authors and publisher of the Modified Version as given on the Title Page If there is nosection Entitled History in the Document create one stating the title year authors and publisher ofthe Document as given on its Title Page then add an item describing the Modified Version as statedin the previous sentence

I

Preserve the network location if any given in the Document for public access to a Transparent copyof the Document and likewise the network locations given in the Document for previous versions itwas based on These may be placed in the History section You may omit a network location for awork that was published at least four years before the Document itself or if the original publisher ofthe version it refers to gives permission

J

For any section Entitled Acknowledgements or Dedications Preserve the Title of the section andpreserve in the section all the substance and tone of each of the contributor acknowledgements andordedications given therein

K

Preserve all the Invariant Sections of the Document unaltered in their text and in their titles Sectionnumbers or the equivalent are not considered part of the section titles

L

Delete any section Entitled Endorsements Such a section may not be included in the ModifiedVersion

M

Do not retitle any existing section to be Entitled Endorsements or to conflict in title with anyInvariant Section

N

Preserve any Warranty DisclaimersO

If the Modified Version includes new frontminusmatter sections or appendices that qualify as Secondary Sectionsand contain no material copied from the Document you may at your option designate some or all of thesesections as invariant To do this add their titles to the list of Invariant Sections in the Modified Versionslicense notice These titles must be distinct from any other section titles

A5 MODIFICATIONS 30

You may add a section Entitled Endorsements provided it contains nothing but endorsements of yourModified Version by various partiesminusminusfor example statements of peer review or that the text has beenapproved by an organization as the authoritative definition of a standard

You may add a passage of up to five words as a FrontminusCover Text and a passage of up to 25 words as aBackminusCover Text to the end of the list of Cover Texts in the Modified Version Only one passage ofFrontminusCover Text and one of BackminusCover Text may be added by (or through arrangements made by) any oneentity If the Document already includes a cover text for the same cover previously added by you or byarrangement made by the same entity you are acting on behalf of you may not add another but you mayreplace the old one on explicit permission from the previous publisher that added the old one

The author(s) and publisher(s) of the Document do not by this License give permission to use their names forpublicity for or to assert or imply endorsement of any Modified Version

8021X PortminusBased Authentication HOWTO

A5 MODIFICATIONS 31

A6 COMBINING DOCUMENTSYou may combine the Document with other documents released under this License under the terms definedin section 4 above for modified versions provided that you include in the combination all of the InvariantSections of all of the original documents unmodified and list them all as Invariant Sections of your combinedwork in its license notice and that you preserve all their Warranty Disclaimers

The combined work need only contain one copy of this License and multiple identical Invariant Sections maybe replaced with a single copy If there are multiple Invariant Sections with the same name but differentcontents make the title of each such section unique by adding at the end of it in parentheses the name of theoriginal author or publisher of that section if known or else a unique number Make the same adjustment tothe section titles in the list of Invariant Sections in the license notice of the combined work

In the combination you must combine any sections Entitled History in the various original documentsforming one section Entitled History likewise combine any sections Entitled Acknowledgements and anysections Entitled Dedications You must delete all sections Entitled Endorsements

A6 COMBINING DOCUMENTS 32

A7 COLLECTIONS OF DOCUMENTSYou may make a collection consisting of the Document and other documents released under this License andreplace the individual copies of this License in the various documents with a single copy that is included inthe collection provided that you follow the rules of this License for verbatim copying of each of thedocuments in all other respects

You may extract a single document from such a collection and distribute it individually under this Licenseprovided you insert a copy of this License into the extracted document and follow this License in all otherrespects regarding verbatim copying of that document

A7 COLLECTIONS OF DOCUMENTS 33

A8 AGGREGATION WITH INDEPENDENT WORKSA compilation of the Document or its derivatives with other separate and independent documents or works inor on a volume of a storage or distribution medium is called an aggregate if the copyright resulting from thecompilation is not used to limit the legal rights of the compilations users beyond what the individual workspermit When the Document is included in an aggregate this License does not apply to the other works in theaggregate which are not themselves derivative works of the Document

If the Cover Text requirement of section 3 is applicable to these copies of the Document then if the Documentis less than one half of the entire aggregate the Documents Cover Texts may be placed on covers that bracketthe Document within the aggregate or the electronic equivalent of covers if the Document is in electronicform Otherwise they must appear on printed covers that bracket the whole aggregate

A8 AGGREGATION WITH INDEPENDENT WORKS 34

A9 TRANSLATIONTranslation is considered a kind of modification so you may distribute translations of the Document under theterms of section 4 Replacing Invariant Sections with translations requires special permission from theircopyright holders but you may include translations of some or all Invariant Sections in addition to theoriginal versions of these Invariant Sections You may include a translation of this License and all the licensenotices in the Document and any Warranty Disclaimers provided that you also include the original Englishversion of this License and the original versions of those notices and disclaimers In case of a disagreementbetween the translation and the original version of this License or a notice or disclaimer the original versionwill prevail

If a section in the Document is Entitled Acknowledgements Dedications or History the requirement(section 4) to Preserve its Title (section 1) will typically require changing the actual title

A9 TRANSLATION 35

A10 TERMINATIONYou may not copy modify sublicense or distribute the Document except as expressly provided for under thisLicense Any other attempt to copy modify sublicense or distribute the Document is void and willautomatically terminate your rights under this License However parties who have received copies or rightsfrom you under this License will not have their licenses terminated so long as such parties remain in fullcompliance

A10 TERMINATION 36

A11 FUTURE REVISIONS OF THIS LICENSEThe Free Software Foundation may publish new revised versions of the GNU Free Documentation Licensefrom time to time Such new versions will be similar in spirit to the present version but may differ in detail toaddress new problems or concerns See httpwwwgnuorgcopyleft

Each version of the License is given a distinguishing version number If the Document specifies that aparticular numbered version of this License or any later version applies to it you have the option offollowing the terms and conditions either of that specified version or of any later version that has beenpublished (not as a draft) by the Free Software Foundation If the Document does not specify a versionnumber of this License you may choose any version ever published (not as a draft) by the Free SoftwareFoundation

A11 FUTURE REVISIONS OF THIS LICENSE 37

A12 ADDENDUM How to use this License foryour documentsTo use this License in a document you have written include a copy of the License in the document and put thefollowing copyright and license notices just after the title page

Copyright (c) YEAR YOUR NAME Permission is granted to copy distribute andor modifythis document under the terms of the GNU Free Documentation License Version 12 or anylater version published by the Free Software Foundation with no Invariant Sections noFrontminusCover Texts and no BackminusCover Texts A copy of the license is included in thesection entitled GNU Free Documentation License

If you have Invariant Sections FrontminusCover Texts and BackminusCover Texts replace the withTexts linewith this

with the Invariant Sections being LIST THEIR TITLES with the FrontminusCover Texts beingLIST and with the BackminusCover Texts being LIST

If you have Invariant Sections without Cover Texts or some other combination of the three merge those twoalternatives to suit the situation

If your document contains nontrivial examples of program code we recommend releasing these examples inparallel under your choice of free software license such as the GNU General Public License to permit theiruse in free software

A12 ADDENDUM How to use this License for your documents 38

• Table of Contents
• 1 Introduction
• • 11 What is 8021X
  • 12 What is 80211i
  • • 121 WEP
    • 122 80211i
    • 123 Key Management
    • 124 TSN (WPA) RSN (WPA2)
    • • 13 What is EAP
      • 14 EAP authentication methods
      • 15 What is RADIUS
      • • 2 Obtaining Certificates
        • 3 Authentication Server Setting up FreeRADIUS
        • • 31 Installing FreeRADIUS
          • 32 Configuring FreeRADIUS
          • • 4 Supplicant Setting up Xsupplicant
            • • 41 Installing Xsupplicant
              • 42 Configuring Xsupplicant
              • • 5 Authenticator Setting up the Authenticator (Access Point)
                • • 51 Access Point
                  • 52 Linux Authenticator
                  • • 6 Testbed
                    • • 61 Testcase
                      • 62 Running some tests
                      • • 7 Note about driver support and Xsupplicant
                        • 8 FAQ
                        • 9 Useful Resources
                        • 10 Copyright acknowledgments and miscellaneous
                        • • 101 Copyright and License
                          • 102 How this document was produced
                          • 103 Feedback
                          • 104 Acknowledgments
                          • • A GNU Free Documentation License
                            • A1 PREAMBLE
                            • A2 APPLICABILITY AND DEFINITIONS
                            • A3 VERBATIM COPYING
                            • A4 COPYING IN QUANTITY
                            • A5 MODIFICATIONS
                            • A6 COMBINING DOCUMENTS
                            • A7 COLLECTIONS OF DOCUMENTS
                            • A8 AGGREGATION WITH INDEPENDENT WORKS
                            • A9 TRANSLATION
                            • A10 TERMINATION
                            • A11 FUTURE REVISIONS OF THIS LICENSE
                            • A12 ADDENDUM How to use this License for your documents

A5 MODIFICATIONSYou may copy and distribute a Modified Version of the Document under the conditions of sections 2 and 3above provided that you release the Modified Version under precisely this License with the ModifiedVersion filling the role of the Document thus licensing distribution and modification of the Modified Versionto whoever possesses a copy of it In addition you must do these things in the Modified Version

Use in the Title Page (and on the covers if any) a title distinct from that of the Document and fromthose of previous versions (which should if there were any be listed in the History section of theDocument) You may use the same title as a previous version if the original publisher of that versiongives permission

A

List on the Title Page as authors one or more persons or entities responsible for authorship of themodifications in the Modified Version together with at least five of the principal authors of theDocument (all of its principal authors if it has fewer than five) unless they release you from thisrequirement

B

State on the Title page the name of the publisher of the Modified Version as the publisherC Preserve all the copyright notices of the DocumentD Add an appropriate copyright notice for your modifications adjacent to the other copyright noticesE Include immediately after the copyright notices a license notice giving the public permission to usethe Modified Version under the terms of this License in the form shown in the Addendum below

F

Preserve in that license notice the full lists of Invariant Sections and required Cover Texts given in theDocuments license notice

G

Include an unaltered copy of this LicenseH Preserve the section Entitled History Preserve its Title and add to it an item stating at least the titleyear new authors and publisher of the Modified Version as given on the Title Page If there is nosection Entitled History in the Document create one stating the title year authors and publisher ofthe Document as given on its Title Page then add an item describing the Modified Version as statedin the previous sentence

I

Preserve the network location if any given in the Document for public access to a Transparent copyof the Document and likewise the network locations given in the Document for previous versions itwas based on These may be placed in the History section You may omit a network location for awork that was published at least four years before the Document itself or if the original publisher ofthe version it refers to gives permission

J

For any section Entitled Acknowledgements or Dedications Preserve the Title of the section andpreserve in the section all the substance and tone of each of the contributor acknowledgements andordedications given therein

K

Preserve all the Invariant Sections of the Document unaltered in their text and in their titles Sectionnumbers or the equivalent are not considered part of the section titles

L

Delete any section Entitled Endorsements Such a section may not be included in the ModifiedVersion

M

Do not retitle any existing section to be Entitled Endorsements or to conflict in title with anyInvariant Section

N

Preserve any Warranty DisclaimersO

If the Modified Version includes new frontminusmatter sections or appendices that qualify as Secondary Sectionsand contain no material copied from the Document you may at your option designate some or all of thesesections as invariant To do this add their titles to the list of Invariant Sections in the Modified Versionslicense notice These titles must be distinct from any other section titles

A5 MODIFICATIONS 30

You may add a section Entitled Endorsements provided it contains nothing but endorsements of yourModified Version by various partiesminusminusfor example statements of peer review or that the text has beenapproved by an organization as the authoritative definition of a standard

You may add a passage of up to five words as a FrontminusCover Text and a passage of up to 25 words as aBackminusCover Text to the end of the list of Cover Texts in the Modified Version Only one passage ofFrontminusCover Text and one of BackminusCover Text may be added by (or through arrangements made by) any oneentity If the Document already includes a cover text for the same cover previously added by you or byarrangement made by the same entity you are acting on behalf of you may not add another but you mayreplace the old one on explicit permission from the previous publisher that added the old one

The author(s) and publisher(s) of the Document do not by this License give permission to use their names forpublicity for or to assert or imply endorsement of any Modified Version

8021X PortminusBased Authentication HOWTO

A5 MODIFICATIONS 31

A6 COMBINING DOCUMENTSYou may combine the Document with other documents released under this License under the terms definedin section 4 above for modified versions provided that you include in the combination all of the InvariantSections of all of the original documents unmodified and list them all as Invariant Sections of your combinedwork in its license notice and that you preserve all their Warranty Disclaimers

The combined work need only contain one copy of this License and multiple identical Invariant Sections maybe replaced with a single copy If there are multiple Invariant Sections with the same name but differentcontents make the title of each such section unique by adding at the end of it in parentheses the name of theoriginal author or publisher of that section if known or else a unique number Make the same adjustment tothe section titles in the list of Invariant Sections in the license notice of the combined work

In the combination you must combine any sections Entitled History in the various original documentsforming one section Entitled History likewise combine any sections Entitled Acknowledgements and anysections Entitled Dedications You must delete all sections Entitled Endorsements

A6 COMBINING DOCUMENTS 32

A7 COLLECTIONS OF DOCUMENTSYou may make a collection consisting of the Document and other documents released under this License andreplace the individual copies of this License in the various documents with a single copy that is included inthe collection provided that you follow the rules of this License for verbatim copying of each of thedocuments in all other respects

You may extract a single document from such a collection and distribute it individually under this Licenseprovided you insert a copy of this License into the extracted document and follow this License in all otherrespects regarding verbatim copying of that document

A7 COLLECTIONS OF DOCUMENTS 33

A8 AGGREGATION WITH INDEPENDENT WORKSA compilation of the Document or its derivatives with other separate and independent documents or works inor on a volume of a storage or distribution medium is called an aggregate if the copyright resulting from thecompilation is not used to limit the legal rights of the compilations users beyond what the individual workspermit When the Document is included in an aggregate this License does not apply to the other works in theaggregate which are not themselves derivative works of the Document

If the Cover Text requirement of section 3 is applicable to these copies of the Document then if the Documentis less than one half of the entire aggregate the Documents Cover Texts may be placed on covers that bracketthe Document within the aggregate or the electronic equivalent of covers if the Document is in electronicform Otherwise they must appear on printed covers that bracket the whole aggregate

A8 AGGREGATION WITH INDEPENDENT WORKS 34

A9 TRANSLATIONTranslation is considered a kind of modification so you may distribute translations of the Document under theterms of section 4 Replacing Invariant Sections with translations requires special permission from theircopyright holders but you may include translations of some or all Invariant Sections in addition to theoriginal versions of these Invariant Sections You may include a translation of this License and all the licensenotices in the Document and any Warranty Disclaimers provided that you also include the original Englishversion of this License and the original versions of those notices and disclaimers In case of a disagreementbetween the translation and the original version of this License or a notice or disclaimer the original versionwill prevail

If a section in the Document is Entitled Acknowledgements Dedications or History the requirement(section 4) to Preserve its Title (section 1) will typically require changing the actual title

A9 TRANSLATION 35

A10 TERMINATIONYou may not copy modify sublicense or distribute the Document except as expressly provided for under thisLicense Any other attempt to copy modify sublicense or distribute the Document is void and willautomatically terminate your rights under this License However parties who have received copies or rightsfrom you under this License will not have their licenses terminated so long as such parties remain in fullcompliance

A10 TERMINATION 36

A11 FUTURE REVISIONS OF THIS LICENSEThe Free Software Foundation may publish new revised versions of the GNU Free Documentation Licensefrom time to time Such new versions will be similar in spirit to the present version but may differ in detail toaddress new problems or concerns See httpwwwgnuorgcopyleft

Each version of the License is given a distinguishing version number If the Document specifies that aparticular numbered version of this License or any later version applies to it you have the option offollowing the terms and conditions either of that specified version or of any later version that has beenpublished (not as a draft) by the Free Software Foundation If the Document does not specify a versionnumber of this License you may choose any version ever published (not as a draft) by the Free SoftwareFoundation

A11 FUTURE REVISIONS OF THIS LICENSE 37

A12 ADDENDUM How to use this License foryour documentsTo use this License in a document you have written include a copy of the License in the document and put thefollowing copyright and license notices just after the title page

Copyright (c) YEAR YOUR NAME Permission is granted to copy distribute andor modifythis document under the terms of the GNU Free Documentation License Version 12 or anylater version published by the Free Software Foundation with no Invariant Sections noFrontminusCover Texts and no BackminusCover Texts A copy of the license is included in thesection entitled GNU Free Documentation License

If you have Invariant Sections FrontminusCover Texts and BackminusCover Texts replace the withTexts linewith this

with the Invariant Sections being LIST THEIR TITLES with the FrontminusCover Texts beingLIST and with the BackminusCover Texts being LIST

If you have Invariant Sections without Cover Texts or some other combination of the three merge those twoalternatives to suit the situation

If your document contains nontrivial examples of program code we recommend releasing these examples inparallel under your choice of free software license such as the GNU General Public License to permit theiruse in free software

A12 ADDENDUM How to use this License for your documents 38

• Table of Contents
• 1 Introduction
• • 11 What is 8021X
  • 12 What is 80211i
  • • 121 WEP
    • 122 80211i
    • 123 Key Management
    • 124 TSN (WPA) RSN (WPA2)
    • • 13 What is EAP
      • 14 EAP authentication methods
      • 15 What is RADIUS
      • • 2 Obtaining Certificates
        • 3 Authentication Server Setting up FreeRADIUS
        • • 31 Installing FreeRADIUS
          • 32 Configuring FreeRADIUS
          • • 4 Supplicant Setting up Xsupplicant
            • • 41 Installing Xsupplicant
              • 42 Configuring Xsupplicant
              • • 5 Authenticator Setting up the Authenticator (Access Point)
                • • 51 Access Point
                  • 52 Linux Authenticator
                  • • 6 Testbed
                    • • 61 Testcase
                      • 62 Running some tests
                      • • 7 Note about driver support and Xsupplicant
                        • 8 FAQ
                        • 9 Useful Resources
                        • 10 Copyright acknowledgments and miscellaneous
                        • • 101 Copyright and License
                          • 102 How this document was produced
                          • 103 Feedback
                          • 104 Acknowledgments
                          • • A GNU Free Documentation License
                            • A1 PREAMBLE
                            • A2 APPLICABILITY AND DEFINITIONS
                            • A3 VERBATIM COPYING
                            • A4 COPYING IN QUANTITY
                            • A5 MODIFICATIONS
                            • A6 COMBINING DOCUMENTS
                            • A7 COLLECTIONS OF DOCUMENTS
                            • A8 AGGREGATION WITH INDEPENDENT WORKS
                            • A9 TRANSLATION
                            • A10 TERMINATION
                            • A11 FUTURE REVISIONS OF THIS LICENSE
                            • A12 ADDENDUM How to use this License for your documents

You may add a section Entitled Endorsements provided it contains nothing but endorsements of yourModified Version by various partiesminusminusfor example statements of peer review or that the text has beenapproved by an organization as the authoritative definition of a standard

You may add a passage of up to five words as a FrontminusCover Text and a passage of up to 25 words as aBackminusCover Text to the end of the list of Cover Texts in the Modified Version Only one passage ofFrontminusCover Text and one of BackminusCover Text may be added by (or through arrangements made by) any oneentity If the Document already includes a cover text for the same cover previously added by you or byarrangement made by the same entity you are acting on behalf of you may not add another but you mayreplace the old one on explicit permission from the previous publisher that added the old one

The author(s) and publisher(s) of the Document do not by this License give permission to use their names forpublicity for or to assert or imply endorsement of any Modified Version

8021X PortminusBased Authentication HOWTO

A5 MODIFICATIONS 31

A6 COMBINING DOCUMENTSYou may combine the Document with other documents released under this License under the terms definedin section 4 above for modified versions provided that you include in the combination all of the InvariantSections of all of the original documents unmodified and list them all as Invariant Sections of your combinedwork in its license notice and that you preserve all their Warranty Disclaimers

The combined work need only contain one copy of this License and multiple identical Invariant Sections maybe replaced with a single copy If there are multiple Invariant Sections with the same name but differentcontents make the title of each such section unique by adding at the end of it in parentheses the name of theoriginal author or publisher of that section if known or else a unique number Make the same adjustment tothe section titles in the list of Invariant Sections in the license notice of the combined work

In the combination you must combine any sections Entitled History in the various original documentsforming one section Entitled History likewise combine any sections Entitled Acknowledgements and anysections Entitled Dedications You must delete all sections Entitled Endorsements

A6 COMBINING DOCUMENTS 32

A7 COLLECTIONS OF DOCUMENTSYou may make a collection consisting of the Document and other documents released under this License andreplace the individual copies of this License in the various documents with a single copy that is included inthe collection provided that you follow the rules of this License for verbatim copying of each of thedocuments in all other respects

You may extract a single document from such a collection and distribute it individually under this Licenseprovided you insert a copy of this License into the extracted document and follow this License in all otherrespects regarding verbatim copying of that document

A7 COLLECTIONS OF DOCUMENTS 33

A8 AGGREGATION WITH INDEPENDENT WORKSA compilation of the Document or its derivatives with other separate and independent documents or works inor on a volume of a storage or distribution medium is called an aggregate if the copyright resulting from thecompilation is not used to limit the legal rights of the compilations users beyond what the individual workspermit When the Document is included in an aggregate this License does not apply to the other works in theaggregate which are not themselves derivative works of the Document

If the Cover Text requirement of section 3 is applicable to these copies of the Document then if the Documentis less than one half of the entire aggregate the Documents Cover Texts may be placed on covers that bracketthe Document within the aggregate or the electronic equivalent of covers if the Document is in electronicform Otherwise they must appear on printed covers that bracket the whole aggregate

A8 AGGREGATION WITH INDEPENDENT WORKS 34

A9 TRANSLATIONTranslation is considered a kind of modification so you may distribute translations of the Document under theterms of section 4 Replacing Invariant Sections with translations requires special permission from theircopyright holders but you may include translations of some or all Invariant Sections in addition to theoriginal versions of these Invariant Sections You may include a translation of this License and all the licensenotices in the Document and any Warranty Disclaimers provided that you also include the original Englishversion of this License and the original versions of those notices and disclaimers In case of a disagreementbetween the translation and the original version of this License or a notice or disclaimer the original versionwill prevail

If a section in the Document is Entitled Acknowledgements Dedications or History the requirement(section 4) to Preserve its Title (section 1) will typically require changing the actual title

A9 TRANSLATION 35

A10 TERMINATIONYou may not copy modify sublicense or distribute the Document except as expressly provided for under thisLicense Any other attempt to copy modify sublicense or distribute the Document is void and willautomatically terminate your rights under this License However parties who have received copies or rightsfrom you under this License will not have their licenses terminated so long as such parties remain in fullcompliance

A10 TERMINATION 36

A11 FUTURE REVISIONS OF THIS LICENSEThe Free Software Foundation may publish new revised versions of the GNU Free Documentation Licensefrom time to time Such new versions will be similar in spirit to the present version but may differ in detail toaddress new problems or concerns See httpwwwgnuorgcopyleft

Each version of the License is given a distinguishing version number If the Document specifies that aparticular numbered version of this License or any later version applies to it you have the option offollowing the terms and conditions either of that specified version or of any later version that has beenpublished (not as a draft) by the Free Software Foundation If the Document does not specify a versionnumber of this License you may choose any version ever published (not as a draft) by the Free SoftwareFoundation

A11 FUTURE REVISIONS OF THIS LICENSE 37

A12 ADDENDUM How to use this License foryour documentsTo use this License in a document you have written include a copy of the License in the document and put thefollowing copyright and license notices just after the title page

Copyright (c) YEAR YOUR NAME Permission is granted to copy distribute andor modifythis document under the terms of the GNU Free Documentation License Version 12 or anylater version published by the Free Software Foundation with no Invariant Sections noFrontminusCover Texts and no BackminusCover Texts A copy of the license is included in thesection entitled GNU Free Documentation License

If you have Invariant Sections FrontminusCover Texts and BackminusCover Texts replace the withTexts linewith this

with the Invariant Sections being LIST THEIR TITLES with the FrontminusCover Texts beingLIST and with the BackminusCover Texts being LIST

If you have Invariant Sections without Cover Texts or some other combination of the three merge those twoalternatives to suit the situation

If your document contains nontrivial examples of program code we recommend releasing these examples inparallel under your choice of free software license such as the GNU General Public License to permit theiruse in free software

A12 ADDENDUM How to use this License for your documents 38

• Table of Contents
• 1 Introduction
• • 11 What is 8021X
  • 12 What is 80211i
  • • 121 WEP
    • 122 80211i
    • 123 Key Management
    • 124 TSN (WPA) RSN (WPA2)
    • • 13 What is EAP
      • 14 EAP authentication methods
      • 15 What is RADIUS
      • • 2 Obtaining Certificates
        • 3 Authentication Server Setting up FreeRADIUS
        • • 31 Installing FreeRADIUS
          • 32 Configuring FreeRADIUS
          • • 4 Supplicant Setting up Xsupplicant
            • • 41 Installing Xsupplicant
              • 42 Configuring Xsupplicant
              • • 5 Authenticator Setting up the Authenticator (Access Point)
                • • 51 Access Point
                  • 52 Linux Authenticator
                  • • 6 Testbed
                    • • 61 Testcase
                      • 62 Running some tests
                      • • 7 Note about driver support and Xsupplicant
                        • 8 FAQ
                        • 9 Useful Resources
                        • 10 Copyright acknowledgments and miscellaneous
                        • • 101 Copyright and License
                          • 102 How this document was produced
                          • 103 Feedback
                          • 104 Acknowledgments
                          • • A GNU Free Documentation License
                            • A1 PREAMBLE
                            • A2 APPLICABILITY AND DEFINITIONS
                            • A3 VERBATIM COPYING
                            • A4 COPYING IN QUANTITY
                            • A5 MODIFICATIONS
                            • A6 COMBINING DOCUMENTS
                            • A7 COLLECTIONS OF DOCUMENTS
                            • A8 AGGREGATION WITH INDEPENDENT WORKS
                            • A9 TRANSLATION
                            • A10 TERMINATION
                            • A11 FUTURE REVISIONS OF THIS LICENSE
                            • A12 ADDENDUM How to use this License for your documents

A6 COMBINING DOCUMENTSYou may combine the Document with other documents released under this License under the terms definedin section 4 above for modified versions provided that you include in the combination all of the InvariantSections of all of the original documents unmodified and list them all as Invariant Sections of your combinedwork in its license notice and that you preserve all their Warranty Disclaimers

The combined work need only contain one copy of this License and multiple identical Invariant Sections maybe replaced with a single copy If there are multiple Invariant Sections with the same name but differentcontents make the title of each such section unique by adding at the end of it in parentheses the name of theoriginal author or publisher of that section if known or else a unique number Make the same adjustment tothe section titles in the list of Invariant Sections in the license notice of the combined work

In the combination you must combine any sections Entitled History in the various original documentsforming one section Entitled History likewise combine any sections Entitled Acknowledgements and anysections Entitled Dedications You must delete all sections Entitled Endorsements

A6 COMBINING DOCUMENTS 32

A7 COLLECTIONS OF DOCUMENTSYou may make a collection consisting of the Document and other documents released under this License andreplace the individual copies of this License in the various documents with a single copy that is included inthe collection provided that you follow the rules of this License for verbatim copying of each of thedocuments in all other respects

You may extract a single document from such a collection and distribute it individually under this Licenseprovided you insert a copy of this License into the extracted document and follow this License in all otherrespects regarding verbatim copying of that document

A7 COLLECTIONS OF DOCUMENTS 33

A8 AGGREGATION WITH INDEPENDENT WORKSA compilation of the Document or its derivatives with other separate and independent documents or works inor on a volume of a storage or distribution medium is called an aggregate if the copyright resulting from thecompilation is not used to limit the legal rights of the compilations users beyond what the individual workspermit When the Document is included in an aggregate this License does not apply to the other works in theaggregate which are not themselves derivative works of the Document

If the Cover Text requirement of section 3 is applicable to these copies of the Document then if the Documentis less than one half of the entire aggregate the Documents Cover Texts may be placed on covers that bracketthe Document within the aggregate or the electronic equivalent of covers if the Document is in electronicform Otherwise they must appear on printed covers that bracket the whole aggregate

A8 AGGREGATION WITH INDEPENDENT WORKS 34

A9 TRANSLATIONTranslation is considered a kind of modification so you may distribute translations of the Document under theterms of section 4 Replacing Invariant Sections with translations requires special permission from theircopyright holders but you may include translations of some or all Invariant Sections in addition to theoriginal versions of these Invariant Sections You may include a translation of this License and all the licensenotices in the Document and any Warranty Disclaimers provided that you also include the original Englishversion of this License and the original versions of those notices and disclaimers In case of a disagreementbetween the translation and the original version of this License or a notice or disclaimer the original versionwill prevail

If a section in the Document is Entitled Acknowledgements Dedications or History the requirement(section 4) to Preserve its Title (section 1) will typically require changing the actual title

A9 TRANSLATION 35

A10 TERMINATIONYou may not copy modify sublicense or distribute the Document except as expressly provided for under thisLicense Any other attempt to copy modify sublicense or distribute the Document is void and willautomatically terminate your rights under this License However parties who have received copies or rightsfrom you under this License will not have their licenses terminated so long as such parties remain in fullcompliance

A10 TERMINATION 36

A11 FUTURE REVISIONS OF THIS LICENSEThe Free Software Foundation may publish new revised versions of the GNU Free Documentation Licensefrom time to time Such new versions will be similar in spirit to the present version but may differ in detail toaddress new problems or concerns See httpwwwgnuorgcopyleft

Each version of the License is given a distinguishing version number If the Document specifies that aparticular numbered version of this License or any later version applies to it you have the option offollowing the terms and conditions either of that specified version or of any later version that has beenpublished (not as a draft) by the Free Software Foundation If the Document does not specify a versionnumber of this License you may choose any version ever published (not as a draft) by the Free SoftwareFoundation

A11 FUTURE REVISIONS OF THIS LICENSE 37

A12 ADDENDUM How to use this License foryour documentsTo use this License in a document you have written include a copy of the License in the document and put thefollowing copyright and license notices just after the title page

Copyright (c) YEAR YOUR NAME Permission is granted to copy distribute andor modifythis document under the terms of the GNU Free Documentation License Version 12 or anylater version published by the Free Software Foundation with no Invariant Sections noFrontminusCover Texts and no BackminusCover Texts A copy of the license is included in thesection entitled GNU Free Documentation License

If you have Invariant Sections FrontminusCover Texts and BackminusCover Texts replace the withTexts linewith this

with the Invariant Sections being LIST THEIR TITLES with the FrontminusCover Texts beingLIST and with the BackminusCover Texts being LIST

If you have Invariant Sections without Cover Texts or some other combination of the three merge those twoalternatives to suit the situation

If your document contains nontrivial examples of program code we recommend releasing these examples inparallel under your choice of free software license such as the GNU General Public License to permit theiruse in free software

A12 ADDENDUM How to use this License for your documents 38

• Table of Contents
• 1 Introduction
• • 11 What is 8021X
  • 12 What is 80211i
  • • 121 WEP
    • 122 80211i
    • 123 Key Management
    • 124 TSN (WPA) RSN (WPA2)
    • • 13 What is EAP
      • 14 EAP authentication methods
      • 15 What is RADIUS
      • • 2 Obtaining Certificates
        • 3 Authentication Server Setting up FreeRADIUS
        • • 31 Installing FreeRADIUS
          • 32 Configuring FreeRADIUS
          • • 4 Supplicant Setting up Xsupplicant
            • • 41 Installing Xsupplicant
              • 42 Configuring Xsupplicant
              • • 5 Authenticator Setting up the Authenticator (Access Point)
                • • 51 Access Point
                  • 52 Linux Authenticator
                  • • 6 Testbed
                    • • 61 Testcase
                      • 62 Running some tests
                      • • 7 Note about driver support and Xsupplicant
                        • 8 FAQ
                        • 9 Useful Resources
                        • 10 Copyright acknowledgments and miscellaneous
                        • • 101 Copyright and License
                          • 102 How this document was produced
                          • 103 Feedback
                          • 104 Acknowledgments
                          • • A GNU Free Documentation License
                            • A1 PREAMBLE
                            • A2 APPLICABILITY AND DEFINITIONS
                            • A3 VERBATIM COPYING
                            • A4 COPYING IN QUANTITY
                            • A5 MODIFICATIONS
                            • A6 COMBINING DOCUMENTS
                            • A7 COLLECTIONS OF DOCUMENTS
                            • A8 AGGREGATION WITH INDEPENDENT WORKS
                            • A9 TRANSLATION
                            • A10 TERMINATION
                            • A11 FUTURE REVISIONS OF THIS LICENSE
                            • A12 ADDENDUM How to use this License for your documents

A7 COLLECTIONS OF DOCUMENTSYou may make a collection consisting of the Document and other documents released under this License andreplace the individual copies of this License in the various documents with a single copy that is included inthe collection provided that you follow the rules of this License for verbatim copying of each of thedocuments in all other respects

You may extract a single document from such a collection and distribute it individually under this Licenseprovided you insert a copy of this License into the extracted document and follow this License in all otherrespects regarding verbatim copying of that document

A7 COLLECTIONS OF DOCUMENTS 33

A8 AGGREGATION WITH INDEPENDENT WORKSA compilation of the Document or its derivatives with other separate and independent documents or works inor on a volume of a storage or distribution medium is called an aggregate if the copyright resulting from thecompilation is not used to limit the legal rights of the compilations users beyond what the individual workspermit When the Document is included in an aggregate this License does not apply to the other works in theaggregate which are not themselves derivative works of the Document

If the Cover Text requirement of section 3 is applicable to these copies of the Document then if the Documentis less than one half of the entire aggregate the Documents Cover Texts may be placed on covers that bracketthe Document within the aggregate or the electronic equivalent of covers if the Document is in electronicform Otherwise they must appear on printed covers that bracket the whole aggregate

A8 AGGREGATION WITH INDEPENDENT WORKS 34

A9 TRANSLATIONTranslation is considered a kind of modification so you may distribute translations of the Document under theterms of section 4 Replacing Invariant Sections with translations requires special permission from theircopyright holders but you may include translations of some or all Invariant Sections in addition to theoriginal versions of these Invariant Sections You may include a translation of this License and all the licensenotices in the Document and any Warranty Disclaimers provided that you also include the original Englishversion of this License and the original versions of those notices and disclaimers In case of a disagreementbetween the translation and the original version of this License or a notice or disclaimer the original versionwill prevail

If a section in the Document is Entitled Acknowledgements Dedications or History the requirement(section 4) to Preserve its Title (section 1) will typically require changing the actual title

A9 TRANSLATION 35

A10 TERMINATIONYou may not copy modify sublicense or distribute the Document except as expressly provided for under thisLicense Any other attempt to copy modify sublicense or distribute the Document is void and willautomatically terminate your rights under this License However parties who have received copies or rightsfrom you under this License will not have their licenses terminated so long as such parties remain in fullcompliance

A10 TERMINATION 36

A11 FUTURE REVISIONS OF THIS LICENSEThe Free Software Foundation may publish new revised versions of the GNU Free Documentation Licensefrom time to time Such new versions will be similar in spirit to the present version but may differ in detail toaddress new problems or concerns See httpwwwgnuorgcopyleft

Each version of the License is given a distinguishing version number If the Document specifies that aparticular numbered version of this License or any later version applies to it you have the option offollowing the terms and conditions either of that specified version or of any later version that has beenpublished (not as a draft) by the Free Software Foundation If the Document does not specify a versionnumber of this License you may choose any version ever published (not as a draft) by the Free SoftwareFoundation

A11 FUTURE REVISIONS OF THIS LICENSE 37

A12 ADDENDUM How to use this License foryour documentsTo use this License in a document you have written include a copy of the License in the document and put thefollowing copyright and license notices just after the title page

Copyright (c) YEAR YOUR NAME Permission is granted to copy distribute andor modifythis document under the terms of the GNU Free Documentation License Version 12 or anylater version published by the Free Software Foundation with no Invariant Sections noFrontminusCover Texts and no BackminusCover Texts A copy of the license is included in thesection entitled GNU Free Documentation License

If you have Invariant Sections FrontminusCover Texts and BackminusCover Texts replace the withTexts linewith this

with the Invariant Sections being LIST THEIR TITLES with the FrontminusCover Texts beingLIST and with the BackminusCover Texts being LIST

If you have Invariant Sections without Cover Texts or some other combination of the three merge those twoalternatives to suit the situation

If your document contains nontrivial examples of program code we recommend releasing these examples inparallel under your choice of free software license such as the GNU General Public License to permit theiruse in free software

A12 ADDENDUM How to use this License for your documents 38

• Table of Contents
• 1 Introduction
• • 11 What is 8021X
  • 12 What is 80211i
  • • 121 WEP
    • 122 80211i
    • 123 Key Management
    • 124 TSN (WPA) RSN (WPA2)
    • • 13 What is EAP
      • 14 EAP authentication methods
      • 15 What is RADIUS
      • • 2 Obtaining Certificates
        • 3 Authentication Server Setting up FreeRADIUS
        • • 31 Installing FreeRADIUS
          • 32 Configuring FreeRADIUS
          • • 4 Supplicant Setting up Xsupplicant
            • • 41 Installing Xsupplicant
              • 42 Configuring Xsupplicant
              • • 5 Authenticator Setting up the Authenticator (Access Point)
                • • 51 Access Point
                  • 52 Linux Authenticator
                  • • 6 Testbed
                    • • 61 Testcase
                      • 62 Running some tests
                      • • 7 Note about driver support and Xsupplicant
                        • 8 FAQ
                        • 9 Useful Resources
                        • 10 Copyright acknowledgments and miscellaneous
                        • • 101 Copyright and License
                          • 102 How this document was produced
                          • 103 Feedback
                          • 104 Acknowledgments
                          • • A GNU Free Documentation License
                            • A1 PREAMBLE
                            • A2 APPLICABILITY AND DEFINITIONS
                            • A3 VERBATIM COPYING
                            • A4 COPYING IN QUANTITY
                            • A5 MODIFICATIONS
                            • A6 COMBINING DOCUMENTS
                            • A7 COLLECTIONS OF DOCUMENTS
                            • A8 AGGREGATION WITH INDEPENDENT WORKS
                            • A9 TRANSLATION
                            • A10 TERMINATION
                            • A11 FUTURE REVISIONS OF THIS LICENSE
                            • A12 ADDENDUM How to use this License for your documents

A8 AGGREGATION WITH INDEPENDENT WORKSA compilation of the Document or its derivatives with other separate and independent documents or works inor on a volume of a storage or distribution medium is called an aggregate if the copyright resulting from thecompilation is not used to limit the legal rights of the compilations users beyond what the individual workspermit When the Document is included in an aggregate this License does not apply to the other works in theaggregate which are not themselves derivative works of the Document

If the Cover Text requirement of section 3 is applicable to these copies of the Document then if the Documentis less than one half of the entire aggregate the Documents Cover Texts may be placed on covers that bracketthe Document within the aggregate or the electronic equivalent of covers if the Document is in electronicform Otherwise they must appear on printed covers that bracket the whole aggregate

A8 AGGREGATION WITH INDEPENDENT WORKS 34

A9 TRANSLATIONTranslation is considered a kind of modification so you may distribute translations of the Document under theterms of section 4 Replacing Invariant Sections with translations requires special permission from theircopyright holders but you may include translations of some or all Invariant Sections in addition to theoriginal versions of these Invariant Sections You may include a translation of this License and all the licensenotices in the Document and any Warranty Disclaimers provided that you also include the original Englishversion of this License and the original versions of those notices and disclaimers In case of a disagreementbetween the translation and the original version of this License or a notice or disclaimer the original versionwill prevail

If a section in the Document is Entitled Acknowledgements Dedications or History the requirement(section 4) to Preserve its Title (section 1) will typically require changing the actual title

A9 TRANSLATION 35

A10 TERMINATIONYou may not copy modify sublicense or distribute the Document except as expressly provided for under thisLicense Any other attempt to copy modify sublicense or distribute the Document is void and willautomatically terminate your rights under this License However parties who have received copies or rightsfrom you under this License will not have their licenses terminated so long as such parties remain in fullcompliance

A10 TERMINATION 36

A11 FUTURE REVISIONS OF THIS LICENSEThe Free Software Foundation may publish new revised versions of the GNU Free Documentation Licensefrom time to time Such new versions will be similar in spirit to the present version but may differ in detail toaddress new problems or concerns See httpwwwgnuorgcopyleft

Each version of the License is given a distinguishing version number If the Document specifies that aparticular numbered version of this License or any later version applies to it you have the option offollowing the terms and conditions either of that specified version or of any later version that has beenpublished (not as a draft) by the Free Software Foundation If the Document does not specify a versionnumber of this License you may choose any version ever published (not as a draft) by the Free SoftwareFoundation

A11 FUTURE REVISIONS OF THIS LICENSE 37

A12 ADDENDUM How to use this License foryour documentsTo use this License in a document you have written include a copy of the License in the document and put thefollowing copyright and license notices just after the title page

Copyright (c) YEAR YOUR NAME Permission is granted to copy distribute andor modifythis document under the terms of the GNU Free Documentation License Version 12 or anylater version published by the Free Software Foundation with no Invariant Sections noFrontminusCover Texts and no BackminusCover Texts A copy of the license is included in thesection entitled GNU Free Documentation License

If you have Invariant Sections FrontminusCover Texts and BackminusCover Texts replace the withTexts linewith this

with the Invariant Sections being LIST THEIR TITLES with the FrontminusCover Texts beingLIST and with the BackminusCover Texts being LIST

If you have Invariant Sections without Cover Texts or some other combination of the three merge those twoalternatives to suit the situation

If your document contains nontrivial examples of program code we recommend releasing these examples inparallel under your choice of free software license such as the GNU General Public License to permit theiruse in free software

A12 ADDENDUM How to use this License for your documents 38

• Table of Contents
• 1 Introduction
• • 11 What is 8021X
  • 12 What is 80211i
  • • 121 WEP
    • 122 80211i
    • 123 Key Management
    • 124 TSN (WPA) RSN (WPA2)
    • • 13 What is EAP
      • 14 EAP authentication methods
      • 15 What is RADIUS
      • • 2 Obtaining Certificates
        • 3 Authentication Server Setting up FreeRADIUS
        • • 31 Installing FreeRADIUS
          • 32 Configuring FreeRADIUS
          • • 4 Supplicant Setting up Xsupplicant
            • • 41 Installing Xsupplicant
              • 42 Configuring Xsupplicant
              • • 5 Authenticator Setting up the Authenticator (Access Point)
                • • 51 Access Point
                  • 52 Linux Authenticator
                  • • 6 Testbed
                    • • 61 Testcase
                      • 62 Running some tests
                      • • 7 Note about driver support and Xsupplicant
                        • 8 FAQ
                        • 9 Useful Resources
                        • 10 Copyright acknowledgments and miscellaneous
                        • • 101 Copyright and License
                          • 102 How this document was produced
                          • 103 Feedback
                          • 104 Acknowledgments
                          • • A GNU Free Documentation License
                            • A1 PREAMBLE
                            • A2 APPLICABILITY AND DEFINITIONS
                            • A3 VERBATIM COPYING
                            • A4 COPYING IN QUANTITY
                            • A5 MODIFICATIONS
                            • A6 COMBINING DOCUMENTS
                            • A7 COLLECTIONS OF DOCUMENTS
                            • A8 AGGREGATION WITH INDEPENDENT WORKS
                            • A9 TRANSLATION
                            • A10 TERMINATION
                            • A11 FUTURE REVISIONS OF THIS LICENSE
                            • A12 ADDENDUM How to use this License for your documents

A9 TRANSLATIONTranslation is considered a kind of modification so you may distribute translations of the Document under theterms of section 4 Replacing Invariant Sections with translations requires special permission from theircopyright holders but you may include translations of some or all Invariant Sections in addition to theoriginal versions of these Invariant Sections You may include a translation of this License and all the licensenotices in the Document and any Warranty Disclaimers provided that you also include the original Englishversion of this License and the original versions of those notices and disclaimers In case of a disagreementbetween the translation and the original version of this License or a notice or disclaimer the original versionwill prevail

If a section in the Document is Entitled Acknowledgements Dedications or History the requirement(section 4) to Preserve its Title (section 1) will typically require changing the actual title

A9 TRANSLATION 35

A10 TERMINATIONYou may not copy modify sublicense or distribute the Document except as expressly provided for under thisLicense Any other attempt to copy modify sublicense or distribute the Document is void and willautomatically terminate your rights under this License However parties who have received copies or rightsfrom you under this License will not have their licenses terminated so long as such parties remain in fullcompliance

A10 TERMINATION 36

A11 FUTURE REVISIONS OF THIS LICENSEThe Free Software Foundation may publish new revised versions of the GNU Free Documentation Licensefrom time to time Such new versions will be similar in spirit to the present version but may differ in detail toaddress new problems or concerns See httpwwwgnuorgcopyleft

Each version of the License is given a distinguishing version number If the Document specifies that aparticular numbered version of this License or any later version applies to it you have the option offollowing the terms and conditions either of that specified version or of any later version that has beenpublished (not as a draft) by the Free Software Foundation If the Document does not specify a versionnumber of this License you may choose any version ever published (not as a draft) by the Free SoftwareFoundation

A11 FUTURE REVISIONS OF THIS LICENSE 37

A12 ADDENDUM How to use this License foryour documentsTo use this License in a document you have written include a copy of the License in the document and put thefollowing copyright and license notices just after the title page

Copyright (c) YEAR YOUR NAME Permission is granted to copy distribute andor modifythis document under the terms of the GNU Free Documentation License Version 12 or anylater version published by the Free Software Foundation with no Invariant Sections noFrontminusCover Texts and no BackminusCover Texts A copy of the license is included in thesection entitled GNU Free Documentation License

If you have Invariant Sections FrontminusCover Texts and BackminusCover Texts replace the withTexts linewith this

with the Invariant Sections being LIST THEIR TITLES with the FrontminusCover Texts beingLIST and with the BackminusCover Texts being LIST

If you have Invariant Sections without Cover Texts or some other combination of the three merge those twoalternatives to suit the situation

If your document contains nontrivial examples of program code we recommend releasing these examples inparallel under your choice of free software license such as the GNU General Public License to permit theiruse in free software

A12 ADDENDUM How to use this License for your documents 38

• Table of Contents
• 1 Introduction
• • 11 What is 8021X
  • 12 What is 80211i
  • • 121 WEP
    • 122 80211i
    • 123 Key Management
    • 124 TSN (WPA) RSN (WPA2)
    • • 13 What is EAP
      • 14 EAP authentication methods
      • 15 What is RADIUS
      • • 2 Obtaining Certificates
        • 3 Authentication Server Setting up FreeRADIUS
        • • 31 Installing FreeRADIUS
          • 32 Configuring FreeRADIUS
          • • 4 Supplicant Setting up Xsupplicant
            • • 41 Installing Xsupplicant
              • 42 Configuring Xsupplicant
              • • 5 Authenticator Setting up the Authenticator (Access Point)
                • • 51 Access Point
                  • 52 Linux Authenticator
                  • • 6 Testbed
                    • • 61 Testcase
                      • 62 Running some tests
                      • • 7 Note about driver support and Xsupplicant
                        • 8 FAQ
                        • 9 Useful Resources
                        • 10 Copyright acknowledgments and miscellaneous
                        • • 101 Copyright and License
                          • 102 How this document was produced
                          • 103 Feedback
                          • 104 Acknowledgments
                          • • A GNU Free Documentation License
                            • A1 PREAMBLE
                            • A2 APPLICABILITY AND DEFINITIONS
                            • A3 VERBATIM COPYING
                            • A4 COPYING IN QUANTITY
                            • A5 MODIFICATIONS
                            • A6 COMBINING DOCUMENTS
                            • A7 COLLECTIONS OF DOCUMENTS
                            • A8 AGGREGATION WITH INDEPENDENT WORKS
                            • A9 TRANSLATION
                            • A10 TERMINATION
                            • A11 FUTURE REVISIONS OF THIS LICENSE
                            • A12 ADDENDUM How to use this License for your documents

A10 TERMINATIONYou may not copy modify sublicense or distribute the Document except as expressly provided for under thisLicense Any other attempt to copy modify sublicense or distribute the Document is void and willautomatically terminate your rights under this License However parties who have received copies or rightsfrom you under this License will not have their licenses terminated so long as such parties remain in fullcompliance

A10 TERMINATION 36

A11 FUTURE REVISIONS OF THIS LICENSEThe Free Software Foundation may publish new revised versions of the GNU Free Documentation Licensefrom time to time Such new versions will be similar in spirit to the present version but may differ in detail toaddress new problems or concerns See httpwwwgnuorgcopyleft

Each version of the License is given a distinguishing version number If the Document specifies that aparticular numbered version of this License or any later version applies to it you have the option offollowing the terms and conditions either of that specified version or of any later version that has beenpublished (not as a draft) by the Free Software Foundation If the Document does not specify a versionnumber of this License you may choose any version ever published (not as a draft) by the Free SoftwareFoundation

A11 FUTURE REVISIONS OF THIS LICENSE 37

A12 ADDENDUM How to use this License foryour documentsTo use this License in a document you have written include a copy of the License in the document and put thefollowing copyright and license notices just after the title page

Copyright (c) YEAR YOUR NAME Permission is granted to copy distribute andor modifythis document under the terms of the GNU Free Documentation License Version 12 or anylater version published by the Free Software Foundation with no Invariant Sections noFrontminusCover Texts and no BackminusCover Texts A copy of the license is included in thesection entitled GNU Free Documentation License

If you have Invariant Sections FrontminusCover Texts and BackminusCover Texts replace the withTexts linewith this

with the Invariant Sections being LIST THEIR TITLES with the FrontminusCover Texts beingLIST and with the BackminusCover Texts being LIST

If you have Invariant Sections without Cover Texts or some other combination of the three merge those twoalternatives to suit the situation

If your document contains nontrivial examples of program code we recommend releasing these examples inparallel under your choice of free software license such as the GNU General Public License to permit theiruse in free software

A12 ADDENDUM How to use this License for your documents 38

• Table of Contents
• 1 Introduction
• • 11 What is 8021X
  • 12 What is 80211i
  • • 121 WEP
    • 122 80211i
    • 123 Key Management
    • 124 TSN (WPA) RSN (WPA2)
    • • 13 What is EAP
      • 14 EAP authentication methods
      • 15 What is RADIUS
      • • 2 Obtaining Certificates
        • 3 Authentication Server Setting up FreeRADIUS
        • • 31 Installing FreeRADIUS
          • 32 Configuring FreeRADIUS
          • • 4 Supplicant Setting up Xsupplicant
            • • 41 Installing Xsupplicant
              • 42 Configuring Xsupplicant
              • • 5 Authenticator Setting up the Authenticator (Access Point)
                • • 51 Access Point
                  • 52 Linux Authenticator
                  • • 6 Testbed
                    • • 61 Testcase
                      • 62 Running some tests
                      • • 7 Note about driver support and Xsupplicant
                        • 8 FAQ
                        • 9 Useful Resources
                        • 10 Copyright acknowledgments and miscellaneous
                        • • 101 Copyright and License
                          • 102 How this document was produced
                          • 103 Feedback
                          • 104 Acknowledgments
                          • • A GNU Free Documentation License
                            • A1 PREAMBLE
                            • A2 APPLICABILITY AND DEFINITIONS
                            • A3 VERBATIM COPYING
                            • A4 COPYING IN QUANTITY
                            • A5 MODIFICATIONS
                            • A6 COMBINING DOCUMENTS
                            • A7 COLLECTIONS OF DOCUMENTS
                            • A8 AGGREGATION WITH INDEPENDENT WORKS
                            • A9 TRANSLATION
                            • A10 TERMINATION
                            • A11 FUTURE REVISIONS OF THIS LICENSE
                            • A12 ADDENDUM How to use this License for your documents

A11 FUTURE REVISIONS OF THIS LICENSEThe Free Software Foundation may publish new revised versions of the GNU Free Documentation Licensefrom time to time Such new versions will be similar in spirit to the present version but may differ in detail toaddress new problems or concerns See httpwwwgnuorgcopyleft

Each version of the License is given a distinguishing version number If the Document specifies that aparticular numbered version of this License or any later version applies to it you have the option offollowing the terms and conditions either of that specified version or of any later version that has beenpublished (not as a draft) by the Free Software Foundation If the Document does not specify a versionnumber of this License you may choose any version ever published (not as a draft) by the Free SoftwareFoundation

A11 FUTURE REVISIONS OF THIS LICENSE 37

A12 ADDENDUM How to use this License foryour documentsTo use this License in a document you have written include a copy of the License in the document and put thefollowing copyright and license notices just after the title page

Copyright (c) YEAR YOUR NAME Permission is granted to copy distribute andor modifythis document under the terms of the GNU Free Documentation License Version 12 or anylater version published by the Free Software Foundation with no Invariant Sections noFrontminusCover Texts and no BackminusCover Texts A copy of the license is included in thesection entitled GNU Free Documentation License

If you have Invariant Sections FrontminusCover Texts and BackminusCover Texts replace the withTexts linewith this

with the Invariant Sections being LIST THEIR TITLES with the FrontminusCover Texts beingLIST and with the BackminusCover Texts being LIST

If you have Invariant Sections without Cover Texts or some other combination of the three merge those twoalternatives to suit the situation

If your document contains nontrivial examples of program code we recommend releasing these examples inparallel under your choice of free software license such as the GNU General Public License to permit theiruse in free software

A12 ADDENDUM How to use this License for your documents 38

• Table of Contents
• 1 Introduction
• • 11 What is 8021X
  • 12 What is 80211i
  • • 121 WEP
    • 122 80211i
    • 123 Key Management
    • 124 TSN (WPA) RSN (WPA2)
    • • 13 What is EAP
      • 14 EAP authentication methods
      • 15 What is RADIUS
      • • 2 Obtaining Certificates
        • 3 Authentication Server Setting up FreeRADIUS
        • • 31 Installing FreeRADIUS
          • 32 Configuring FreeRADIUS
          • • 4 Supplicant Setting up Xsupplicant
            • • 41 Installing Xsupplicant
              • 42 Configuring Xsupplicant
              • • 5 Authenticator Setting up the Authenticator (Access Point)
                • • 51 Access Point
                  • 52 Linux Authenticator
                  • • 6 Testbed
                    • • 61 Testcase
                      • 62 Running some tests
                      • • 7 Note about driver support and Xsupplicant
                        • 8 FAQ
                        • 9 Useful Resources
                        • 10 Copyright acknowledgments and miscellaneous
                        • • 101 Copyright and License
                          • 102 How this document was produced
                          • 103 Feedback
                          • 104 Acknowledgments
                          • • A GNU Free Documentation License
                            • A1 PREAMBLE
                            • A2 APPLICABILITY AND DEFINITIONS
                            • A3 VERBATIM COPYING
                            • A4 COPYING IN QUANTITY
                            • A5 MODIFICATIONS
                            • A6 COMBINING DOCUMENTS
                            • A7 COLLECTIONS OF DOCUMENTS
                            • A8 AGGREGATION WITH INDEPENDENT WORKS
                            • A9 TRANSLATION
                            • A10 TERMINATION
                            • A11 FUTURE REVISIONS OF THIS LICENSE
                            • A12 ADDENDUM How to use this License for your documents

A12 ADDENDUM How to use this License foryour documentsTo use this License in a document you have written include a copy of the License in the document and put thefollowing copyright and license notices just after the title page

Copyright (c) YEAR YOUR NAME Permission is granted to copy distribute andor modifythis document under the terms of the GNU Free Documentation License Version 12 or anylater version published by the Free Software Foundation with no Invariant Sections noFrontminusCover Texts and no BackminusCover Texts A copy of the license is included in thesection entitled GNU Free Documentation License

If you have Invariant Sections FrontminusCover Texts and BackminusCover Texts replace the withTexts linewith this

with the Invariant Sections being LIST THEIR TITLES with the FrontminusCover Texts beingLIST and with the BackminusCover Texts being LIST

If you have Invariant Sections without Cover Texts or some other combination of the three merge those twoalternatives to suit the situation

If your document contains nontrivial examples of program code we recommend releasing these examples inparallel under your choice of free software license such as the GNU General Public License to permit theiruse in free software

A12 ADDENDUM How to use this License for your documents 38

• Table of Contents
• 1 Introduction
• • 11 What is 8021X
  • 12 What is 80211i
  • • 121 WEP
    • 122 80211i
    • 123 Key Management
    • 124 TSN (WPA) RSN (WPA2)
    • • 13 What is EAP
      • 14 EAP authentication methods
      • 15 What is RADIUS
      • • 2 Obtaining Certificates
        • 3 Authentication Server Setting up FreeRADIUS
        • • 31 Installing FreeRADIUS
          • 32 Configuring FreeRADIUS
          • • 4 Supplicant Setting up Xsupplicant
            • • 41 Installing Xsupplicant
              • 42 Configuring Xsupplicant
              • • 5 Authenticator Setting up the Authenticator (Access Point)
                • • 51 Access Point
                  • 52 Linux Authenticator
                  • • 6 Testbed
                    • • 61 Testcase
                      • 62 Running some tests
                      • • 7 Note about driver support and Xsupplicant
                        • 8 FAQ
                        • 9 Useful Resources
                        • 10 Copyright acknowledgments and miscellaneous
                        • • 101 Copyright and License
                          • 102 How this document was produced
                          • 103 Feedback
                          • 104 Acknowledgments
                          • • A GNU Free Documentation License
                            • A1 PREAMBLE
                            • A2 APPLICABILITY AND DEFINITIONS
                            • A3 VERBATIM COPYING
                            • A4 COPYING IN QUANTITY
                            • A5 MODIFICATIONS
                            • A6 COMBINING DOCUMENTS
                            • A7 COLLECTIONS OF DOCUMENTS
                            • A8 AGGREGATION WITH INDEPENDENT WORKS
                            • A9 TRANSLATION
                            • A10 TERMINATION
                            • A11 FUTURE REVISIONS OF THIS LICENSE
                            • A12 ADDENDUM How to use this License for your documents