Breezy! Site

A search through this site will discover a couple of articles on WPA2 Enterprise including some links to how-to's on how to configure the network equipment and RADIUS server to support it. The information needs a bit of freshening up since FreeRADIUS is now into version 2.x (current version 2.1.9) and it still doesn't support EAP/TLS out of the box because of some licensing SNAFU with Ubuntu/Debian Linux. Despite the lack of support in the Debian packages and Ubuntu repositories, it doesn't mean that you can't support WPA2 Enterprise with your favourite flavour of Linux...Ubuntu of course! What you need to do is download the latest version of the FreeRADIUS source code binaries from www.freeradius.org (where else?!) and then compile it for yourself with support for EAP/TLS. This will culminate in the very happy situation of a FreeRADIUS server which can authenticate users both using username/password (standard MS CHAP v2 challenge) or better yet the much more scalable (and thus enterprise-class) solution of using certificates that have been issued by a Certificate Authority in the context of a PKI (Public Key Infrastructure).

The certificates that need to be installed on the client (for example your Windows PC) and the server (ie: the FreeRADIUS server) require Extended Key Usage certificates per this posting here: http://www.breezy.ca/?q=node/221. This will not be discussed here.

The procedure that I followed was from this link here: http://www.linuxinsight.com/building-debian-freeradius-package-with-eap-.... The only part of the instructions that I followed to the letter were the instructions that involved the editing of the ./debian/rules file, which is found in path of where the tarball extracts. I didn't do any of the other changes but I did install the packages that were referred to a bit later in someone's comments to the original poster.

Anyway, it's working fine. I have a Linksys WAP610N wireless access point which I've configured as my NAS and it's connected into my internal VLAN. I installed an identity certificate on the Windows 7 Ultimate 64-bit client per my posting in the first paragraph. The radius server has a server certificate per that same posting.