WPA2-enterprise + PEAP

[kadu]

Can ESP connect to WPA2-enterprise + PEAP networks ? If yes, how to do that ?

[bakercp]

There is a longer discussion of this topic on the esp8266 forum http://www.esp8266.com/viewtopic.php?f=6&t=1243&start=15.

[igrr]

WPA2-enterprise is supported in SDK 1.5, so linking this to #1102.

[joostd]

I suspect only eap-tls is supported.

See http://bbs.espressif.com/download/file.php?id=988. The only reference to wpa2-enterprise is in
wifi_station_set_cert_key

Also:

$ ar -t esp_iot_sdk_v1/esp_iot_sdk_v1.5.0/lib/libwpa2.a
/
//
asn1.o/
base64.o/
bignum.o/
eap_common.o/
eap.o/
/0
eap_tls.o/
ext_password.o/
pkcs1.o/
pkcs5.o/
pkcs8.o/
rsa.o/
tls_internal.o/
tlsv1_client.o/
/18
/39
tlsv1_common.o/
tlsv1_cred.o/
tlsv1_record.o/
tlsv1_server.o/
/61
/82
x509v3.o/

[JeroenBeemster]

HI guys. Finally WPA2 Enterprise is supported. But I cannot find any example. Actually I saw that only 1 person got it working.
My question is: I need to fill in a username (identity) and a password for the WPA2 and no private key or something like that. Where to fill in the "username" ? Or is this not supported yet. I know this is not an arduino question. But anyway here are the specialists :)

[igrr]

I have not yet added -lwpa2 to linker flag because I wasn't able to get WPA2-Enterprise to work.
If anyone wants to try, feel free to add this flag here

[pauldekkers]

@igrr shouldn't that be line 33? Either way that doesn't work for me, I included

#include <user_interface.h>
...
wifi_station_clear_cert_key();

... in my code to see if that would build, but it doesn't:

sketch_dec20a.ino:5: undefined reference to `wifi_station_clear_cert_key()'
collect2: error: ld returned 1 exit status

But I'm not sure this is the right way to call those functions.

[igrr]

You need to wrap that include with extern "C":

extern "C" {
#include "user_interface.h"
}

Regarding line number: after I wrote that comment a few lines got added, so now compiler.c.elf.libs is on line 33.

[pauldekkers]

@igrr extern "C" does get me further, except for this:

/Applications/Arduino.app/Contents/Java/hardware/esp8266com/esp8266/tools/sdk/lib/libcrypto.a(aes-internal-dec.o):(.irom0.text+0x4): undefined reference to Td0'
/Applications/Arduino.app/Contents/Java/hardware/esp8266com/esp8266/tools/sdk/lib/libcrypto.a(aes-internal-dec.o): In function aes_decrypt_init': (.irom0.text+0x134): undefined reference to Td4s'
collect2: error: ld returned 1 exit status`

I hope you know what's missing :-)

[JeroenBeemster]

I also added the -lwpa2 parameter.
I have exact the same error as Paul.
Same result when I tried this new function: wifi_station_clear_cert_key();

[igrr]

Should be fixed by 70cf3c3

[JeroenBeemster]

Yes, now it compiles. Thanks Igrr, Back to my first question. Where to put the username (Identity)?
How does it work? I am missing one part of the puzzle. And I do not know which

[pauldekkers]

@igrr Great, that compiles and I've actually got it to authenticate. But: with the wrong User-Name, that seems to be set to "tianhao" and not taken from the certificate CN. Maybe it uses the Microsoft UPN attribute or a subjectAltName; I'll try to experiment with that, but suggestions are welcome.

[DavidXanatos]

I also need to connect to a WPA2 Enterprise secured network, it requirers user authentication that is Username + Password, no certificate.
The server certificate is a self signed one.

Did anyone got this to work? And if so is there a guide + example

[pauldekkers]

So far only EAP-TLS is supported; so client-certificate based and not username/password. This works fine for me, but if you have no client-certificate and no control over the RADIUS server, I don't think you can do a lot (but wait for a series of other EAP-mechanisms to be supported).

[DavidXanatos]

I have full control over the RADIUS server just never configured anything else than user name based.
If I have to add certificate based (if that can coexist) than its doable.
Still how do I do that on the arduino side?

[joostd]

You can use something like https://github.com/joostd/esp8266-eduroam/blob/master/Arduino/eduroam/eduroam.ino. At the moment, it needs a patched esp8266 Arduino core (#1633)

[someburner]

FYI Espressif just released 1.5.3 which adds username/password support.

[joostd]

Alas, all that 1.5.3 adds are the missing prototypes in include/user_interface.h (wifi_station_set_username and wifi_station_clear_username). These are not used for username/password authentication, but for setting/clearing the username used in EAP. As such, EAP-TLS (i.e. using client certificates) is still the only supported EAP method.
(In fact lib/libwpa2.a has not changed since version 1.5.2).

It does mean that PR #1633 is no longer necessary once the SDK is upgraded to 1.5.3.

[someburner]

@joostd Yeah I didn't notice that at first.. got a bit excited. I haven't been able to get PEAP going at my workplace.

[Potato-Matic]

I'm very interested. Can someone give a quick run down of the step by step for what almost "works" as of right now so I could give it a try? I take it it's only certificate based and not identity/password based that works (would be nice, but ok).

Edit: Are we waiting on Espressif for the identity/password bit?

[bloons3]

I'm interested in seeing the arduino implementation for username/password on 801.2x

[Potato-Matic]

What's the current status of this?

[joostd]

With the switch to V2.0 of the espressif sdk, EAP-TTLS and PEAP should now work as well.

[bospre]

Hi @ all,
but where is an example on how to use it?
I could not find one.
Does anybody has an example for WPA2 with PEAP?

[svatos-jirka]

I tried 2.4.0-rc but It looks, that WPA2 enterprise doesnt work. Did I mistake?

[exquisitetelescope]

@svatos-jirka WPA2 enterprise doesn't work is a very broad statement. Which authentication method are you trying to use (PEAP, TLS, etc.)? What code are you using and types of errors are you getting? Also, do note the previous comment by @victorclaessen where we were talking about a bug in the firmware with WPA2 auth selection which I hope they fix soon.

[mru4913]

@ninjabe86 and @victorclaessen As the code you mentioned, you directly upload programs to ESP8266 and treat it like Arduino. Is there a way to talk to ESP8266 via Arduino? (Arduino controls ESP8266 to connect to eduroam?)

[svatos-jirka]

Hi, I am not sure, if my answer is correct. It is wpa2-enterprise AES, network authentication Microsoft: smart card or other certificates ... so I should Ilso somehow download certifiacte from PKI card? or ask for certificate or It department. But, How should I upload certificate to esp8266? wit best regards, jiri 2017-11-10 13:06 GMT+01:00 gofex <[email protected]>:

…

@svatos-jirka <https://github.com/svatos-jirka> WPA2 enterprise doesn't work is a very broad statement. Which authentication method are you trying to use (PEAP, TLS, etc.)? What code are you using and types of errors are you getting? Also, do note the previous comment by @victorclaessen <https://github.com/victorclaessen> where we were talking about a bug in the firmware with WPA2 auth selection which I hope they fix soon. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1032 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AIYG0pzG-P5F7ID50Dmq6wfv-EAalGqHks5s1Dw8gaJpZM4Gj1mQ> .

[xsrf]

Hey, I'm watching this topic for a long time now... I also want to use WPA2 Enterprise, but in my case, I want to use EAP-PWD. Problem with MSCHAPv2 is, that it is actually very unsecure if not used right. And as far as I can tell from the conversations above, noone is using it correctly.
If you don't actually check that the radius servers certificate is issued by a trusted CA and also check that the certificate is issued for the radius server you want to connect to, you will actually leak your credentials to any fake access point that pretends to be one of your organisation... This is a huge problem with eduroam because most mainstream clients allow unsecure configurations, too.
However, I haven't found any hints for EAP-PWD implementation or good secure MSCHAPv2/TTLS examples. Is this still a topic for espressif, or might this never be usable?

[devyte]

@xsrf that is a question best asked directectly to Espressif.

[victorclaessen]

I'm afraid ExpressIf may not have any interest left in this topic, since they have stopped responding completely to any of my contact attempts.

…

On Dec 21, 2017 23:44, "Develo" ***@***.***> wrote: @xsrf <https://github.com/xsrf> that is a question best asked directectly to Espressif. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1032 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AKqUHA7IQcGhesEE-FNs5sFK1hY8J1sAks5tCt9pgaJpZM4Gj1mQ> .

[Burt-Silverman]

To reiterate what others have stated, the ESP8266 has an authentication type selection bug. In my case, using a freeradius server, the mode set as default_eap_type is the only type that ESP8266 will try to communicate with. I was able to authenticate with default_eap_type set to ttls, peap, or tls, and not able to authenticate with the nominal default_eap_type of md5. Totally different from the eapol_test program that exists in the Linux wpa_supplicant source package. Although tls worked well enough to authenticate, I found that my ESP8266 software crashed always about one minute after authentication succeeded. ttls and peap had no problems.

[fti7]

Is there a github issue which tracks this Bug? This Issue here is closed. I dont think they will respond here

[victorclaessen]

I don't think so. Might be worth a shot. Feel free to link to this post on their own message board:
http://bbs.espressif.com/viewtopic.php?p=18595&sid=e8e14cd6f97ee908d96ca75d0d47edd8#p15165

[xsrf]

@fti7 no, since it's an issue with the underlying sdk of espressif, not with ESP8266 core for Arduino. There's also a post on espressifs forum for EAP+PWD: https://bbs.espressif.com/viewtopic.php?f=7&t=8802

[victorclaessen]

@xsrf. That is, of course, very true and a really good point. But at this stage, what other options do we have to get this issue some more attention?

[xsrf]

I don't know :( But I lost all hope espressif will ever address this issue. Maybe someone is actually implementing WPA2-Enterprise without the help of the SDK... I don't see other options.

[martinius96]

Hello there, some working sketch for WPA2 EAP OR PEAP?

[lzydavid]

Hi there, is there any working sketch for Arduino for WPA2 EAP for the current version : SDK:2.2.1(cfd48f3)/Core:2.4.1/lwIP:2.0.3(STABLE-2_0_3_RELEASE/glue:arduino-2.4.1)
I have been trying to connect my huzzah esp8266 to my school network for my project but still not succesful.

[ttimpe]

It seems some people were able to make it work, does anyone have a working sketch yet? I'm trying to connect my NodeMCU to a WPA2-Enterprise hotspot and it doesn't work using wifi_station_set_config etc.

[d-a-v]

It seems to depend on authentication protocol. It may work when using MSCHAPv2 but not PAP.
You should try first espressif's native SDK with their example.
I've made a repo to ease trying https://github.com/d-a-v/esp8266-nonos-easy-sdk
I still have no time to pursue, but I will at some point.
Best would be to setup a local (linux+hostapd) access point with WPA2+TTLS+MSCHAPv2 and test with SDKv3. Next step would be to setup a WPA2+TTLS+PAP and try it out too. With this feedback, open a new detailed issue with all the details on nonos-sdk repo.
There is already there an opened issue which is quite polluted. A nice and concise new issue with SDKv3 example and possibly hostapd conf files would be necessary. Without any mention to arduino in it, of course.

[Burt-Silverman]

Do not forget my January result above with the free radius server; unfortunately the default eap type was the only one the ESP8266 would authenticate with. So it helps to be able to change that setting in your server when you are testing things out.

[bospre]

Hello together,
good news.
I found a working sketch for wpa2 enterprise with username and password (PAP)
Look here:
https://github.com/jtuttas/ESP8266-WPA2-Enterprise/blob/master/ino/webserver/webserver.ino
I think the difference is resetting (or initialise) the certificate.
2 years of waiting are now ending....

[ttimpe]

I tried it, it doesn’t work for me and just kicks my board into a boot loop.

On Mon 17. Dec 2018 at 21:06, bospre ***@***.***> wrote: Hello together, good news. I found a working sketch for wpa2 enterprise with username and password (PAP) Look here: https://github.com/jtuttas/ESP8266-WPA2-Enterprise/blob/master/ino/webserver/webserver.ino I think the difference is resetting (or initialise) the certificate. 2 years of waiting are now ending.... — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#1032 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AATp8pGiCv2lE8EK3Ljynq7nbU2yTcdiks5u5_lHgaJpZM4Gj1mQ> .

-- Mit freundlichen Grüßen Tobias Timpe

[martinius96]

almost nobody is using PAP...
Most users are looking for sketch for network similar to Eduroam with PEAP method

[bospre]

I think i had a typo and the authentication PEAP.
At least i can now login with username and password.
@ ttimpe
Do you use the latest Arduino sdk?
I use 2.5.0-beta2
Maybe that makes a difference?

[xsrf]

Most eduroam / enterprise networks also support EAP-PWD which should be easier to implement than EAP-PEAP-MSCHAPV2 or EAP-TTLS-MSCHAPV2. EAP-TTLS-PAP shouldn't be used anyways because it leaks your password quite easily if not configured 100% right.

[bospre]

Okay it was a typo (PAP =>PEAP)
That is the log of the radiusserver:
Mon Dec 17 21:38:47 2018 : Auth: Login OK: [userESP8266/] (from client WLANxxxxx port 1 cli 5C-CF-7F-C8-80-01)

[bospre]

Huh, the server hides some part of the line.
Mon Dec 17 21:37:21 2018 : Auth: Login OK: [ESP8266/] (from client WLANxxx port 1 cli 5C-CF-7F-C8-80-01)

[bospre]

Still missing the part: via Auth-Type = EAP