The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Stefan Winter <address@concealed>]

Hello,

> I've checked a machine without eduroam cat configurantion and see that
> EAP properties (Notifications before connecting) is set to "Tell user if
> the server's identity can't be verified" (1). When I install the eduroam
> cat application, this options is set to "Do not prompt user to authorize
> new servers or trusted certification authorities" (2).
> 
> When I change this options on a cliente machine from (2) to (1), The
> machine connect to the eduroam network.
> 
> Has anyone had this problem before and solved?

The "Do not prompt" is actually a very important setting. CAT configures
the end user device so that server validation /will/ work (if the admin
has uploaded the correct server details).

If the user is presented with a server certificate which does not match
those preset security parameters then it is not the genuine
authentication server, i.e. it is probably a rogue attacker trying to
steal user passwords. Giving the end user the opportunity to override
the no-trust problem means allowing them to be fooled by such an attacker.

As to why the cert validation fails, I cannot say much because your CAT
profile is not on the public download page, so I cannot inspect it (or I
didn't find your institution despite looking for "esprito" and "santo").

I suggest you log into CAT as administrator and use the "Check realm
reachability" button. It will not only check reachability but also the
properties of the server certificate you are sending. Discrepancies
against the CAT configuration for your institution will be mentioned in
the generated report.

Greetings,

Stefan Winter


-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
2, avenue de l'Université
L-4365 Esch-sur-Alzette

Tel: +352 424409 1
Fax: +352 422473

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

Attachment: 0xC0DE6A358A39DC66.asc
Description: application/pgp-keys

Attachment: signature.asc
Description: OpenPGP digital signature