Re: WPA2-Enterprise and server certificate verification

Dan Williams <dcbw redhat com> on Mon, 2016/02/08 10:21:
On Mon, 2016-02-08 at 12:09 +0100, Christian Hesse wrote:
Hello everybody,

when networkmanager connects to a WPA/WPA2-Enterprise secured notwork
it can
check the validity of the server certificate against a CA

Connecting to the authentication server does not include a domain
though. So by default there is no way to check the certificate CN
value. This
results in a potential security issue: If anybody has a certificate
*any* CN issued by the same CA networkmanager will accept it as
An attacker can set up access points with same SSID and forged
server to phish user credentials and redirect network traffic.

Since version 2.1 wpa_supplicant supports configuration option
'domain_suffix_match' to manually specify a domain (suffix) to match
server certificate against. 'domain_match' was added later on.

I would like to see a configuration option within networkmanager for
setting. Any chance to add that?  

Yes, it's come up recently on too and it should
likely get added

Ah, nice. Do you have a link for the bug? I did not find it...
And is anybody working on this?

alongside the existing subject matching support.

Ah, missed that.
But is there a way to change this in GUI?
main(a){char*c=/*    Schoene Gruesse                         */"B?IJj;MEH"
"CX:;",b;for(a/*    Chris           get my mail address:    */=0;b=c[a++];)
putchar(b-1/(/*               gcc -o sig sig.c && ./sig    */b/42*2-3)*42);}

Attachment: pgpL7elgFixXl.pgp
Description: OpenPGP digital signature

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]