Dan Williams <dcbw redhat com> on Mon, 2016/02/08 10:21:
On Mon, 2016-02-08 at 12:09 +0100, Christian Hesse wrote:Hello everybody, when networkmanager connects to a WPA/WPA2-Enterprise secured notwork it can check the validity of the server certificate against a CA certificate. Connecting to the authentication server does not include a domain name, though. So by default there is no way to check the certificate CN value. This results in a potential security issue: If anybody has a certificate with *any* CN issued by the same CA networkmanager will accept it as valid. An attacker can set up access points with same SSID and forged authentication server to phish user credentials and redirect network traffic. Since version 2.1 wpa_supplicant supports configuration option 'domain_suffix_match' to manually specify a domain (suffix) to match the server certificate against. 'domain_match' was added later on. I would like to see a configuration option within networkmanager for this setting. Any chance to add that?Yes, it's come up recently on bugzilla.gnome.org too and it should likely get added
Ah, nice. Do you have a link for the bug? I did not find it... And is anybody working on this?
alongside the existing subject matching support.
Ah, missed that.
But is there a way to change this in GUI?
--
main(a){char*c=/* Schoene Gruesse */"B?IJj;MEH"
"CX:;",b;for(a/* Chris get my mail address: */=0;b=c[a++];)
putchar(b-1/(/* gcc -o sig sig.c && ./sig */b/42*2-3)*42);}
Attachment:
pgpL7elgFixXl.pgp
Description: OpenPGP digital signature