support for multiple EAP methods in one config?

support for multiple EAP methods in one config?

[Michael John]

Hello,

I'm looking to see if IWD supports the ability to support multiple EAP method, like what can be done in wpa_supplicant.

network={
    ssid="example"
    key_mgmt=WPA-EAP
    eap=TTLS PEAP
    identity="username"
    password="password"
    # Try basically every common inner method
    phase2="autheap=MSCHAPV2 autheap=MD5 autheap=GTC autheap=OTP autheap=TLS auth=MSCHAPV2 auth=MSCHAP auth=PAP auth=CHAP auth=GTC"
}

My use case is that I'm given a username and password for a network but don't know the outer or inner protocols (or even if its personal or enterprise but I can determine that from the broadcast beacon).

Thanks,

Michael John
Midmark Corporation

CONFIDENTIALITY NOTICE: This message, including any attachments, contains confidential information intended for a specific individual and purpose. If you are not the intended recipient, you should delete this message and any disclosure, copying, or distribution of this message, or the taking of any action based on it, by you is strictly prohibited.

Re: support for multiple EAP methods in one config?

[James Prestwood]

Hi Michael,

On 1/9/25 5:37 AM, Michael John wrote:
> Hello,
>
> I'm looking to see if IWD supports the ability to support multiple EAP method, like what can be done in wpa_supplicant.
At the moment no, there is no way to configure this.
>
> network={
>      ssid="example"
>      key_mgmt=WPA-EAP
>      eap=TTLS PEAP
>      identity="username"
>      password="password"
>      # Try basically every common inner method
>      phase2="autheap=MSCHAPV2 autheap=MD5 autheap=GTC autheap=OTP autheap=TLS auth=MSCHAPV2 auth=MSCHAP auth=PAP auth=CHAP auth=GTC"
> }
>
> My use case is that I'm given a username and password for a network but don't know the outer or inner protocols (or even if its personal or enterprise but I can determine that from the broadcast beacon).

So does the network actually support multiple inner methods? or is this 
just more of a "debugging" feature to determine which (single) method it 
supports. I'd be interested in the motivation for a feature like this. 
Is it:

   - There are _real_ networks that exist which support multiple EAP 
methods, or...

   - Your network administrators are not providing their clients with 
enough information.

I do know its possible to configure/allow multiple EAP methods with 
hostapd at least, so it is _possible_ that networks like this exist. I'm 
more just curious if its done ever in practice, and if so I guess that's 
something IWD might want to support.

Also, you should be able to determine at least if its PSK or enterprise 
based on the AKM in the beacon. And IWD will also print this in the 
debug logs when it scans.

Thanks,

James

>
> Thanks,
>
> Michael John
> Midmark Corporation
>
> CONFIDENTIALITY NOTICE: This message, including any attachments, contains confidential information intended for a specific individual and purpose. If you are not the intended recipient, you should delete this message and any disclosure, copying, or distribution of this message, or the taking of any action based on it, by you is strictly prohibited.
>

Re: support for multiple EAP methods in one config?

[Michael John]

Hi James,

> Hi Michael,

> On 1/9/25 5:37 AM, Michael John wrote:
>> Hello,
>>
>> I'm looking to see if IWD supports the ability to support multiple EAP method, like what can be done in wpa_supplicant.
>At the moment no, there is no way to configure this.
>>
>> network={
>>      ssid="example"
>>      key_mgmt=WPA-EAP
>>      eap=TTLS PEAP
>>      identity="username"
>>      password="password"
>>      # Try basically every common inner method
>>      phase2="autheap=MSCHAPV2 autheap=MD5 autheap=GTC autheap=OTP autheap=TLS auth=MSCHAPV2 auth=MSCHAP auth=PAP auth=CHAP auth=GTC"
>> }
>>
>> My use case is that I'm given a username and password for a network but don't know the outer or inner protocols (or even if its personal or enterprise but I can determine that from the broadcast beacon).
>
> So does the network actually support multiple inner methods? or is this
> just more of a "debugging" feature to determine which (single) method it
> supports. I'd be interested in the motivation for a feature like this.
> Is it:
>
>   - There are _real_ networks that exist which support multiple EAP
> methods, or...
>
>   - Your network administrators are not providing their clients with
> enough information.
>

I don't have enough information. The product I'm working on would go into medical offices and could be connected by a range of users and the username and password is all the information that is provided. So the user connecting the product will likely not know anything further about the network configuration.

I can determine PSK and Enterprise via the beacon, yes. For Enterprise with wpa_supplicant it allows multiple outer and inner methods to be supported. My understanding is the client sends the EAP-Request to the AP and then the AP proposes the EAP method to use and the client can decide to accept or reject the method, and when defining the multi 'eap' methods in wpa_supplicant you're defining which methods to accept. Allowing the configuration to work with multiple methods and not requiring the user from needing to know this information.

> I do know its possible to configure/allow multiple EAP methods with
> hostapd at least, so it is _possible_ that networks like this exist. I'm
> more just curious if its done ever in practice, and if so I guess that's
> something IWD might want to support.
>
> Also, you should be able to determine at least if its PSK or enterprise
> based on the AKM in the beacon. And IWD will also print this in the
> debug logs when it scans.
>
> Thanks,
>
> James
>
>
>> Thanks,
>>
>> Michael John
>> Midmark Corporation
>>

Thanks,
Michael

CONFIDENTIALITY NOTICE: This message, including any attachments, contains confidential information intended for a specific individual and purpose. If you are not the intended recipient, you should delete this message and any disclosure, copying, or distribution of this message, or the taking of any action based on it, by you is strictly prohibited.

Re: support for multiple EAP methods in one config?

[James Prestwood]

On 1/9/25 6:40 AM, Michael John wrote:
> Hi James,
>
>> Hi Michael,
>> On 1/9/25 5:37 AM, Michael John wrote:
>>> Hello,
>>>
>>> I'm looking to see if IWD supports the ability to support multiple EAP method, like what can be done in wpa_supplicant.
>> At the moment no, there is no way to configure this.
>>> network={
>>>       ssid="example"
>>>       key_mgmt=WPA-EAP
>>>       eap=TTLS PEAP
>>>       identity="username"
>>>       password="password"
>>>       # Try basically every common inner method
>>>       phase2="autheap=MSCHAPV2 autheap=MD5 autheap=GTC autheap=OTP autheap=TLS auth=MSCHAPV2 auth=MSCHAP auth=PAP auth=CHAP auth=GTC"
>>> }
>>>
>>> My use case is that I'm given a username and password for a network but don't know the outer or inner protocols (or even if its personal or enterprise but I can determine that from the broadcast beacon).
>> So does the network actually support multiple inner methods? or is this
>> just more of a "debugging" feature to determine which (single) method it
>> supports. I'd be interested in the motivation for a feature like this.
>> Is it:
>>
>>    - There are _real_ networks that exist which support multiple EAP
>> methods, or...
>>
>>    - Your network administrators are not providing their clients with
>> enough information.
>>
> I don't have enough information. The product I'm working on would go into medical offices and could be connected by a range of users and the username and password is all the information that is provided. So the user connecting the product will likely not know anything further about the network configuration.
>
> I can determine PSK and Enterprise via the beacon, yes. For Enterprise with wpa_supplicant it allows multiple outer and inner methods to be supported. My understanding is the client sends the EAP-Request to the AP and then the AP proposes the EAP method to use and the client can decide to accept or reject the method, and when defining the multi 'eap' methods in wpa_supplicant you're defining which methods to accept. Allowing the configuration to work with multiple methods and not requiring the user from needing to know this information.

Ok, kinda makes sense, but at the same time even wpa_supplicant's 
support is going to be fragile at best. Yes there are similarities 
between EAP methods, but also there are differences which a single 
profile can't possibly account for. Your example above allowing 
TTLS/PEAP might work (both are tunneled) but e.g. TLS and PEAP aren't 
going to take the same configuration values. Let alone stuff like PWD 
which is completely user/password based... I'll have to think if there 
is a way to support this in a sane way. Maybe Denis has some input as well.

Thanks,

James

>
>> I do know its possible to configure/allow multiple EAP methods with
>> hostapd at least, so it is _possible_ that networks like this exist. I'm
>> more just curious if its done ever in practice, and if so I guess that's
>> something IWD might want to support.
>>
>> Also, you should be able to determine at least if its PSK or enterprise
>> based on the AKM in the beacon. And IWD will also print this in the
>> debug logs when it scans.
>>
>> Thanks,
>>
>> James
>>
>>
>>> Thanks,
>>>
>>> Michael John
>>> Midmark Corporation
>>>
> Thanks,
> Michael
>
> CONFIDENTIALITY NOTICE: This message, including any attachments, contains confidential information intended for a specific individual and purpose. If you are not the intended recipient, you should delete this message and any disclosure, copying, or distribution of this message, or the taking of any action based on it, by you is strictly prohibited.

Re: support for multiple EAP methods in one config?

[Denis Kenzior]

Hi Michael,

On 1/9/25 7:37 AM, Michael John wrote:
> Hello,
> 

Please get rid of the confidentiality footer.  It doesn't make any sense when 
you're corresponding on a public mailing list.

> I'm looking to see if IWD supports the ability to support multiple EAP method, like what can be done in wpa_supplicant.
> 
> network={
>      ssid="example"
>      key_mgmt=WPA-EAP
>      eap=TTLS PEAP
>      identity="username"
>      password="password"
>      # Try basically every common inner method
>      phase2="autheap=MSCHAPV2 autheap=MD5 autheap=GTC autheap=OTP autheap=TLS auth=MSCHAPV2 auth=MSCHAP auth=PAP auth=CHAP auth=GTC"
> }
> 

No, and it probably doesn't even work with wpa_supplicant.  Not in a way you 
expect anyway.  See https://w1.fi/cgit/hostap/tree/src/eap_peer/eap_ttls.c#n112.

The fundamental problem is that some methods, like EAP-TTLS, expect the client 
to start the inner authentication, and there's no good retry mechanism in case 
the tried inner method fails.  With PEAP this is less of a problem, but then 
PEAP is pretty much only deployed with MSCHAPv2 as the inner method.

> My use case is that I'm given a username and password for a network but don't know the outer or inner protocols (or even if its personal or enterprise but I can determine that from the broadcast beacon).

If you have a username, then that precludes PSK networks as those don't have 
such a concept?

However, username/password is really not enough.  PEAP/TTLS based authentication 
really requires a CA certificate to be set.  Otherwise anyone can spoof your 
Enterprise network with $50 router.  If public CAs are used, then a 
ServerDomainMatch setting is also advised.

iwd doesn't support a 'Trust on First Use' style scenario where the signature / 
certificate reported by the peer AP would be presented to the user for 
verification on the initial connection.  We didn't think supporting such a use 
case was good a good security practice.

For enterprise networks I strongly advise figuring out some sort of provisioning 
mechanism.  There's even some code in iwd to convert iOS provisioning format to 
iwd settings files.  See tools/ios_convert.py

Regards,
-Denis