[решено] WPA PEAP Ubuntu 18 Приветствую сообщников!
Обновил в офисе одну машину с Ubuntu 16 на 18 и обнаружилось, что с неё теперь невозможно подключиться к WPA2 Enterprise (aka PEAP MSCHAPV2). После недолгого гугленья и ваиршарканья обнаружился такой баг:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=848982tl;dr - точка доступа требует TLS_RSA_WITH_3DES_EDE_CBC_SHA, а оно похоже выключено в новом openssl
Ubuntu 18:
# openssl ciphers
ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-A
ES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA3
84:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-R
SA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-PO
LY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECD
HE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-G
CM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDH
E-RSA-AES256-SHA384:DHE-RSA-AES256-SHA25
6:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AE
S128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-E
CDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-R
SA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECD
HE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:RSA-P
SK-AES256-GCM-SHA384:DHE-PSK-AES256-GCM-S
HA384:RSA-PSK-CHACHA20-POLY1305:DHE-PSK-C
HACHA20-POLY1305:ECDHE-PSK-CHACHA20-POLY
1305:AES256-GCM-SHA384:PSK-AES256-GCM-SH
A384:PSK-CHACHA20-POLY1305:RSA-PSK-AES12
8-GCM-SHA256:DHE-PSK-AES128-GCM-SHA256:A
ES128-GCM-SHA256:PSK-AES128-GCM-SHA256:A
ES256-SHA256:AES128-SHA256:ECDHE-PSK-AES
256-CBC-SHA384:ECDHE-PSK-AES256-CBC-SHA:S
RP-RSA-AES-256-CBC-SHA:SRP-AES-256-CBC-S
HA:RSA-PSK-AES256-CBC-SHA384:DHE-PSK-AES
256-CBC-SHA384:RSA-PSK-AES256-CBC-SHA:DH
E-PSK-AES256-CBC-SHA:AES256-SHA:PSK-AES2
56-CBC-SHA384:PSK-AES256-CBC-SHA:ECDHE-P
SK-AES128-CBC-SHA256:ECDHE-PSK-AES128-CB
C-SHA:SRP-RSA-AES-128-CBC-SHA:SRP-AES-12
8-CBC-SHA:RSA-PSK-AES128-CBC-SHA256:DHE-P
SK-AES128-CBC-SHA256:RSA-PSK-AES128-CBC-S
HA:DHE-PSK-AES128-CBC-SHA:AES128-SHA:PSK-A
ES128-CBC-SHA256:PSK-AES128-CBC-SHA
В то же время на Ubuntu 16:
$ openssl ciphers
ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-A
ES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:E
CDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES25
6-SHA:ECDHE-ECDSA-AES256-SHA:SRP-DSS-AES-2
56-CBC-SHA:SRP-RSA-AES-256-CBC-SHA:SRP-A
ES-256-CBC-SHA:DH-DSS-AES256-GCM-SHA384:D
HE-DSS-AES256-GCM-SHA384:DH-RSA-AES256-G
CM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-R
SA-AES256-SHA256:DHE-DSS-AES256-SHA256:D
H-RSA-AES256-SHA256:DH-DSS-AES256-SHA256:D
HE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DH-R
SA-AES256-SHA:DH-DSS-AES256-SHA:DHE-RSA-C
AMELLIA256-SHA:DHE-DSS-CAMELLIA256-SHA:D
H-RSA-CAMELLIA256-SHA:DH-DSS-CAMELLIA256-S
HA:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-A
ES256-GCM-SHA384:ECDH-RSA-AES256-SHA384:E
CDH-ECDSA-AES256-SHA384:ECDH-RSA-AES256-S
HA:ECDH-ECDSA-AES256-SHA:AES256-GCM-SHA3
84:AES256-SHA256:AES256-SHA:CAMELLIA256-S
HA:PSK-AES256-CBC-SHA:ECDHE-RSA-AES128-G
CM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:E
CDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES12
8-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDS
A-AES128-SHA:SRP-DSS-AES-128-CBC-SHA:SRP-R
SA-AES-128-CBC-SHA:SRP-AES-128-CBC-SHA:D
H-DSS-AES128-GCM-SHA256:DHE-DSS-AES128-G
CM-SHA256:DH-RSA-AES128-GCM-SHA256:DHE-R
SA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA2
56:DHE-DSS-AES128-SHA256:DH-RSA-AES128-S
HA256:DH-DSS-AES128-SHA256:DHE-RSA-AES12
8-SHA:DHE-DSS-AES128-SHA:DH-RSA-AES128-S
HA:DH-DSS-AES128-SHA:DHE-RSA-SEED-SHA:DH
E-DSS-SEED-SHA:DH-RSA-SEED-SHA:DH-DSS-SE
ED-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-DSS-C
AMELLIA128-SHA:DH-RSA-CAMELLIA128-SHA:DH-D
SS-CAMELLIA128-SHA:ECDH-RSA-AES128-GCM-S
HA256:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-R
SA-AES128-SHA256:ECDH-ECDSA-AES128-SHA25
6:ECDH-RSA-AES128-SHA:ECDH-ECDSA-AES128-S
HA:AES128-GCM-SHA256:AES128-SHA256:AES12
8-SHA:SEED-SHA:CAMELLIA128-SHA:PSK-AES12
8-CBC-SHA:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-R
C4-SHA:ECDH-RSA-RC4-SHA:ECDH-ECDSA-RC4-S
HA:RC4-SHA:RC4-MD5:PSK-RC4-SHA:ECDHE-RSA-D
ES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:SRP-D
SS-3DES-EDE-CBC-SHA:SRP-RSA-3DES-EDE-CBC-S
HA:SRP-3DES-EDE-CBC-SHA:EDH-RSA-DES-CBC3-S
HA:EDH-DSS-DES-CBC3-SHA:DH-RSA-DES-CBC3-S
HA:DH-DSS-DES-CBC3-SHA:ECDH-RSA-DES-CBC3-S
HA:ECDH-ECDSA-DES-CBC3-SHA:DES-CBC3-SHA:P
SK-3DES-EDE-CBC-SHA
Пытаюсь перекомпилить openssl:
./config --prefix=/root/openssl-1.1.0h/out shared enable-weak-ssl-ciphers
make
make install_sw
# LD_LIBRARY_PATH=/root/openssl-1.1.0h/out/l
ib out/bin/openssl ciphers
ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-A
ES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA3
84:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-R
SA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-PO
LY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECD
HE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-G
CM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDH
E-RSA-AES256-SHA384:DHE-RSA-AES256-SHA25
6:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AE
S128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-E
CDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-R
SA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECD
HE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:RSA-P
SK-AES256-GCM-SHA384:DHE-PSK-AES256-GCM-S
HA384:RSA-PSK-CHACHA20-POLY1305:DHE-PSK-C
HACHA20-POLY1305:ECDHE-PSK-CHACHA20-POLY
1305:AES256-GCM-SHA384:PSK-AES256-GCM-SH
A384:PSK-CHACHA20-POLY1305:RSA-PSK-AES12
8-GCM-SHA256:DHE-PSK-AES128-GCM-SHA256:A
ES128-GCM-SHA256:PSK-AES128-GCM-SHA256:A
ES256-SHA256:AES128-SHA256:ECDHE-PSK-AES
256-CBC-SHA384:ECDHE-PSK-AES256-CBC-SHA:S
RP-RSA-AES-256-CBC-SHA:SRP-AES-256-CBC-S
HA:RSA-PSK-AES256-CBC-SHA384:DHE-PSK-AES
256-CBC-SHA384:RSA-PSK-AES256-CBC-SHA:DH
E-PSK-AES256-CBC-SHA:AES256-SHA:PSK-AES2
56-CBC-SHA384:PSK-AES256-CBC-SHA:ECDHE-P
SK-AES128-CBC-SHA256:ECDHE-PSK-AES128-CB
C-SHA:SRP-RSA-AES-128-CBC-SHA:SRP-AES-12
8-CBC-SHA:RSA-PSK-AES128-CBC-SHA256:DHE-P
SK-AES128-CBC-SHA256:RSA-PSK-AES128-CBC-S
HA:DHE-PSK-AES128-CBC-SHA:AES128-SHA:PSK-A
ES128-CBC-SHA256:PSK-AES128-CBC-SHA
Список не изменился - нету DES
ЧЯДНТ?
UPDПосле перекомпиляции openssl надо также явно указать шифр в конфиге wpa_supplicant:
openssl_ciphers="SYSTEM:3DES"