IEEE_802.1X

[ilux]

Hello.

Can I use 802.1X authentication (en.wikipedia.org/wiki/IEEE_802.1X) with MSCHAP for my "hardware" network card on OpenBSD.

[jggimi]

Hello, and welcome!

802.1x authentication is available, via a port of the Linux WPA/WPA2/IEEE Supplicant -- the leaf of the ports tree is security/wpa_supplicant, available as a package from a nearby mirror.

See this OpenBSD Journal article for an example use case. I have never used it, but I understand it supports MSCHAPv2.

[ilux]

Thank you!

it works

I add to wpa_supplicant config
network={
ssid=""
key_mgmt=IEEE8021X
eap=PEAP
ca_cert="/etc/ssl/certs/my.cer"
phase2="auth=MSCHAPV2"
identity="user"
password="password"
}

and to /etc/rc.conf.local
pkg_scripts="${pkg_scripts} wpa_supplicant"
wpa_supplicant_flags="-c /etc/wpa_supplicant.conf -D wired -i re0"

after dhclient re0 I got authentication

[jggimi]

Yay!

I'm glad you got it working!

[J65nko]

According to https://en.wikipedia.org/wiki/MS-CHAP MS-CHAPv2 has some serious security flaws