Paranoid Penguin - Securing Your WLAN with WPA and FreeRADIUS, Part II
For EAP-TLS, you need at least two certificates besides your CA certificate, a server certificate for your FreeRADIUS server and one client certificate for each wireless client on your network. Creating certificates is a three-step process:
Generate a signing request, that is, an unsigned certificate.
Sign the signing request with your CA key.
Copy the signed certificate to the host on which it will be used.
Let's start by creating a server certificate signing request using OpenSSL's req command:
$ openssl req -new -nodes -keyout server_key.pem -out server_req.pem -days 730 -config ./openssl.cnf
This command creates the files server_req.pem, which contains the actual request—an unsigned certificate—and server_key.pem, its passphrase-less private key. First, though, you are prompted for your organization's Country Code, State and so on, much of which can use the default values you tweaked in openssl.conf. Pay special attention, however, to Common Name. When prompted for this, type the fully qualified domain name of your server, for example, server.wiremonkeys.org.
Next, let's use our CA key to sign the request by using OpenSSL's ca command:
$ openssl ca -config ./openssl.cnf \ -policy policy_anything -out server_cert.pem \ -extensions xpserver_ext -extfile ./xpextensions \ -infiles ./server_req.pem
This command reads the file server_req.pem and, after prompting for your CA key's passphrase, saves a signed version of it plus its corresponding private key to the file server_cert.pem. Notice the -extensions and -extfile options—this is why earlier we created the file xpextensions.
Open your signed certificate with the text editor of your choice and delete everything before the line -----BEGIN CERTIFICATE-----. Concatenate it and your key into a single file, like this:
$ cat server_key.pem server.cert.pem > \ server_keycert.pem
Now we've got a server certificate with a key that we can copy over to our FreeRADIUS server. Its private key isn't password-protected, however, so be sure to delete any extraneous copies after you've got it in place.
Now we need to create a client certificate signing request. The OpenSSL command to do this is similar to that used to create server certificates:
$ openssl req -new -keyout client_key.pem \ -out client_req.pem -days 730 -config ./openssl.cnf
As you can see, we're writing our signing request and key to the files client_req.pem and client_key, respectively. Unlike with the server signing requests, however, we're omitting the -nodes option. Therefore, when you run this command, you are prompted for a passphrase with which the certificate's private key can be encrypted.
Next we sign the client certificate's signing request:
$ openssl ca -config ./openssl.cnf \ -policy policy_anything -out client_cert.pem \ -extensions xpclient_ext -extfile ./xpextensions \ -infiles ./client_req.pem
Again, this is similar to the equivalent command for our server, except this time the -extensions command references a different entry in xpextensions. Also, if your clients run Linux, you should delete the extraneous stuff in the certificate, like you did with server_cert.pem. You then either can leave the certificate and key files separate or concatenate them. From there, copy your client certificate file(s) to your Linux client system.
If your certificate is to be used by a Windows XP client, you have one more step to take. You need to convert the certificate file(s) to a PKCS12-format file, with this command:
openssl pkcs12 -export -in client_cert.pem \ -inkey client_key.pem -out client_cert.p12 -clcerts
You are prompted for client_key.pem's passphrase and then for a new passphrase for the new file; you can use the same password as before if you like. You may be tempted simply to press Enter instead, especially given that the WPA supplicant in Windows XP works only when you store its certificates without passphrases. It's very, very bad practice, however, to move private keys around networks unprotected, so I strongly recommend that you not remove the passphrase until after this file is copied safely over to your Windows XP client.
Lest you be tempted to take this opportunity to bash Microsoft, I must note that both Xsupplicant and wpa_supplicant on Linux require you to either use a blank passphrase or store the passphrase in clear text in a configuration file. This is contrary to good certificate-handling wisdom. I hope we some day see WPA supplicants intelligent enough to prompt the user for its certificate passphrase on startup.
The resulting file, in this example client_cert.p12, contains both your signed certificate and its private key. Copy it to your Windows XP client system.
|Making Linux and Android Get Along (It's Not as Hard as It Sounds)||May 16, 2013|
|Drupal Is a Framework: Why Everyone Needs to Understand This||May 15, 2013|
|Home, My Backup Data Center||May 13, 2013|
|Non-Linux FOSS: Seashore||May 10, 2013|
|Trying to Tame the Tablet||May 08, 2013|
|Dart: a New Web Programming Experience||May 07, 2013|
- RSS Feeds
- New Products
- Making Linux and Android Get Along (It's Not as Hard as It Sounds)
- Drupal Is a Framework: Why Everyone Needs to Understand This
- A Topic for Discussion - Open Source Feature-Richness?
- Home, My Backup Data Center
- New Products
- Developer Poll
- Trying to Tame the Tablet
- Tech Tip: Really Simple HTTP Server with Python
- Deceptive Advertising and
8 min 57 sec ago
- Let\'s declare that you have
9 min 54 sec ago
- Alterations in Contest Due
11 min ago
- At a numbers mindset, your
12 min 11 sec ago
- Do not get Just Almost any
15 min 40 sec ago
- A fantastic rule-of-thumb to
17 min 3 sec ago
- Keren mastah..
1 hour 14 min ago
- mini tablet compare
2 hours 33 min ago
- Looking Good
6 hours 6 min ago
- Hey God - You may not be
10 hours 20 min ago
Enter to Win an Adafruit Prototyping Pi Plate Kit for Raspberry Pi
It's Raspberry Pi month at Linux Journal. Each week in May, Adafruit will be giving away a Pi-related prize to a lucky, randomly drawn LJ reader. Winners will be announced weekly.
Fill out the fields below to enter to win this week's prize-- a Prototyping Pi Plate Kit for Raspberry Pi.
Congratulations to our winners so far:
- 5-8-13, Pi Starter Pack: Jack Davis
- 5-15-13, Pi Model B 512MB RAM: Patrick Dunn
- Next winner announced on 5-21-13!
Free Webinar: Linux Backup and Recovery
Most companies incorporate backup procedures for critical data, which can be restored quickly if a loss occurs. However, fewer companies are prepared for catastrophic system failures, in which they lose all data, the entire operating system, applications, settings, patches and more, reducing their system(s) to “bare metal.” After all, before data can be restored to a system, there must be a system to restore it to.
In this one hour webinar, learn how to enhance your existing backup strategies for better disaster recovery preparedness using Storix System Backup Administrator (SBAdmin), a highly flexible bare-metal recovery solution for UNIX and Linux systems.