{"id":364,"date":"2015-07-03T21:47:59","date_gmt":"2015-07-03T20:47:59","guid":{"rendered":"http:\/\/www.flat-planet.net\/?p=364"},"modified":"2015-07-03T21:47:59","modified_gmt":"2015-07-03T20:47:59","slug":"horizon-wi-free-access-on-linux","status":"publish","type":"post","link":"https:\/\/flat-planet.net\/?p=364","title":{"rendered":"Horizon Wi-Free Access on Linux"},"content":{"rendered":"<p>Horizon Wi-Free is an 802.1x authenticated network service intended to allow UPC customers to use WiFi Offload via UPC broadband routers. Essentially almost all UPC modems are broadcasting a &#8220;Horizon Wi-Free&#8221; SSID, and authenticating via 802.1x in the backend.<\/p>\n<p>Note: You cannot connect to Horizon Wi-Free through your own router, so you will have to test against another customer&#8217;s one! I believe the idea behind this is to prevent you using the &#8216;roaming&#8217; network while at home.<\/p>\n<h2>Configuring wpa_supplicant.conf<\/h2>\n<p>Main points here are:<\/p>\n<ul>\n<li>SSID: this should be &#8220;Horizon Wi-Free&#8221;<\/li>\n<li>parwise and group = CCMP<\/li>\n<li>EAP: This needs to be PEAP as a username and password are required<\/li>\n<li>identity: this is your UPC Wi-Free username<\/li>\n<li>password: the Wi-Free password, not your web account password<\/li>\n<li>ca_cert: This cert is to verify that we are actually connecting to a network belonging to UPC (see below)<\/li>\n<li>phase2: This must be MSCHAPV2<\/li>\n<\/ul>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nnetwork={\r\n   ssid=&quot;Horizon Wi-Free&quot;\r\n   key_mgmt=WPA-EAP\r\n   pairwise=CCMP\r\n   group=CCMP\r\n   eap=PEAP\r\n   identity=&quot;username&quot;\r\n   password=&quot;my_secret_password&quot;\r\n   ca_cert=&quot;\/etc\/cert\/liberty_global.pem&quot;\r\n   phase1=&quot;peapver=0&quot;\r\n   phase2=&quot;MSCHAPV2&quot;\r\n   id_str=&quot;horizon-free-wifi&quot;\r\n}\r\n<\/pre>\n<p>&nbsp;<\/p>\n<h2>Getting the CA Cert for Network Verification<\/h2>\n<p>This step was a little more work then expected, as I had to track down a copy of the CA cert. The easiest way is to download the<a href=\"http:\/\/www.upc.ie\/horizonwifreedevicesetup\/\"> .mobileconfig file intended for iOS<\/a> and extract the required cert chain:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nwget http:\/\/www.upc.ie\/horizonwifreedevicesetup\/applesecurity\/\r\n\r\n&#x5B;user.local]&#x5B;~\/Downloads]=&amp;gt; openssl pkcs7 -inform DER -print_certs -in .\/HorizonWi-Freev1.mobileconfig\r\n&amp;nbsp;\r\nsubject=\/O=AlphaSSL\/CN=AlphaSSL CA - G2\r\nissuer=\/C=BE\/O=GlobalSign nv-sa\/OU=Root CA\/CN=GlobalSign Root CA\r\n-----BEGIN CERTIFICATE-----\r\nMIIELzCCAxegAwIBAgILBAAAAAABL07hNwIwDQYJKoZIhvcNAQEFBQAwVzELMAkG\r\nA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv\r\nb3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw0xMTA0MTMxMDAw\r\nMDBaFw0yMjA0MTMxMDAwMDBaMC4xETAPBgNVBAoTCEFscGhhU1NMMRkwFwYDVQQD\r\nExBBbHBoYVNTTCBDQSAtIEcyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\r\nAQEAw\/BliN8b3caChy\/JC7pUxmM\/RnWsSxQfmHKLHBD\/CalSbi9l32WEP1+Bstjx\r\nT9fwWrvJr9Ax3SZGKpme2KmjtrgHxMlx95WE79LqH1Sg5b7kQSFWMRBkfR5jjpxx\r\nXDygLt5n3MiaIPB1yLC2J4Hrlw3uIkWlwi80J+zgWRJRsx4F5Tgg0mlZelkXvhpL\r\nOQgSeTObZGj+WIHdiAxqulm0ryRPYeDK\/Bda0jxyq6dMt7nqLeP0P5miTcgdWPh\/\r\nUzWO1yKIt2F2CBMTaWawV1kTMQpwgiuT1\/biQBXQHQFyxxNYalrsGYkWPODIjYYq\r\n+jfwNTLd7OX+gI73BWe0i0J1NQIDAQABo4IBIzCCAR8wDgYDVR0PAQH\/BAQDAgEG\r\nMBIGA1UdEwEB\/wQIMAYBAf8CAQAwHQYDVR0OBBYEFBTqGVXwDg0yxh90M7eOZhpM\r\nEjEeMEUGA1UdIAQ+MDwwOgYEVR0gADAyMDAGCCsGAQUFBwIBFiRodHRwczovL3d3\r\ndy5hbHBoYXNzbC5jb20vcmVwb3NpdG9yeS8wMwYDVR0fBCwwKjAooCagJIYiaHR0\r\ncDovL2NybC5nbG9iYWxzaWduLm5ldC9yb290LmNybDA9BggrBgEFBQcBAQQxMC8w\r\nLQYIKwYBBQUHMAGGIWh0dHA6Ly9vY3NwLmdsb2JhbHNpZ24uY29tL3Jvb3RyMTAf\r\nBgNVHSMEGDAWgBRge2YaRQ2XyolQL30EzTSo\/\/z9SzANBgkqhkiG9w0BAQUFAAOC\r\nAQEABjBCm89JAn6J6fWDWj0C87yyRt5KUO65mpBz2qBcJsqCrA6ts5T6KC6y5kk\/\r\nUHcOlS9o82U8nxTyaGCStvwEDfakGKFpYA3jnWhbvJ4LOFmNIdoj+pmKCbkfpy61\r\nVWxH50Hs5uJ\/r1VEOeCsdO5l0\/qrUUgw8T53be3kD0CY7kd\/jbZYJ82Sb2AjzAKb\r\nWSh4olGd0Eqc5ZNemI\/L7z\/K\/uCvpMlbbkBYpZItvV1lVcW\/fARB2aS1gOmUYAIQ\r\nOGoICNdTHC2Tr8kTe9RsxDrE+4CsuzpOVHrNTrM+7fH8EU6f9fMUvLmxMc72qi+l\r\n+MPpZqmyIJ3E+LgDYqeF0RhjWw==\r\n-----END CERTIFICATE-----\r\n\r\nsubject=\/OU=Domain Control Validated\/CN=*.upcbroadband.com\r\nissuer=\/O=AlphaSSL\/CN=AlphaSSL CA - G2\r\n-----BEGIN CERTIFICATE-----\r\nMIIEtzCCA5+gAwIBAgISESEulCUW\/1LPLh5Wj7dtRUYSMA0GCSqGSIb3DQEBBQUA\r\nMC4xETAPBgNVBAoTCEFscGhhU1NMMRkwFwYDVQQDExBBbHBoYVNTTCBDQSAtIEcy\r\nMB4XDTEzMDExNjEyMzY0M1oXDTE1MDExNzEyMzY0M1owQDEhMB8GA1UECxMYRG9t\r\nYWluIENvbnRyb2wgVmFsaWRhdGVkMRswGQYDVQQDDBIqLnVwY2Jyb2FkYmFuZC5j\r\nb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCh0AMi+hy7flw92BCL\r\ndXuXeFVFGSE9nXnzhspXIPVTkMMGHfZrkbxw3DzTrLD490X3o3UcQ8gxwU80jf7I\r\n71wpxaXLdUxAFk2IpgSb6hAtOiBGtioTx8\/5ZxlGW+c1JPb6ompslyY4fe4f9y3k\r\n9u6cIKAzttnTNLCOe1IUIfy1HjjDm3\/lzVuuV4N7eu\/bYtPE6RB8xpm\/3lK2cRCB\r\nT8ueRokeU3Wiq3mZSKenT54rw+3kWBFfAAKVjyNHctQHlrtzSal28JQJ\/tVLhhOM\r\nsDO0kss0y+U0wbzjc\/sfjBHDaNxboTc4C9MwzEScNrn9WH8qj\/xT+nHTFBITiqSh\r\n1EF5AgMBAAGjggG7MIIBtzAOBgNVHQ8BAf8EBAMCBaAwTQYDVR0gBEYwRDBCBgor\r\nBgEEAaAyAQoKMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8vd3d3Lmdsb2JhbHNpZ24u\r\nY29tL3JlcG9zaXRvcnkvMC8GA1UdEQQoMCaCEioudXBjYnJvYWRiYW5kLmNvbYIQ\r\ndXBjYnJvYWRiYW5kLmNvbTAJBgNVHRMEAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMB\r\nBggrBgEFBQcDAjA6BgNVHR8EMzAxMC+gLaArhilodHRwOi8vY3JsMi5hbHBoYXNz\r\nbC5jb20vZ3MvZ3NhbHBoYWcyLmNybDB\/BggrBgEFBQcBAQRzMHEwPAYIKwYBBQUH\r\nMAKGMGh0dHA6Ly9zZWN1cmUyLmFscGhhc3NsLmNvbS9jYWNlcnQvZ3NhbHBoYWcy\r\nLmNydDAxBggrBgEFBQcwAYYlaHR0cDovL29jc3AyLmdsb2JhbHNpZ24uY29tL2dz\r\nYWxwaGFnMjAdBgNVHQ4EFgQUidh6RCyiMnWkZqNJ+NrOP9APjIswHwYDVR0jBBgw\r\nFoAUFOoZVfAODTLGH3Qzt45mGkwSMR4wDQYJKoZIhvcNAQEFBQADggEBABMneGO7\r\nKOzZ7pEB4NN9rHDizfz+3fauF68WQz9V3+byP53mwZWgfpX80nxi1uD3qGzgaNUB\r\nmgenNxrsvziw1aiDAgMiwc+uhN8BYh\/cezfp+pe2qBnyeu2CJBQ9tLIyyBp7cCl3\r\nPGNSBhXr4xBxsfVV+4xqk7aLkG9aVelPIrQWokwPZ5VWBxjSAmrWipvPRfzb7IeA\r\nDVM9W1ZhxyDY1D7d6F56Q0WTTNAsV\/nWv9sNOlkME9lpF4ytpvxNHLHgO7cKvgr\/\r\nlTZMhfRdQB9Djn3OJ22O5AratklkkxJquvIAOYHvg6GEhWk+IFbg2Lkrn6tuPwB5\r\nW24J6nCgFx\/jzvc=\r\n-----END CERTIFICATE-----\r\n<\/pre>\n<p>Throw these into a file and get openssl to verify:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\n&#x5B;user@machine]&#x5B;~]=&amp;gt; openssl verify liberty_global.pem\r\nliberty_global.pem: OK\r\n<\/pre>\n<p>While the theory behind this is sound, unfortunately there was an issue when I attempted to test the connection:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nSSL: SSL_connect:SSLv3 read server hello A\r\nTLS: Certificate verification failed, error 19 (self signed certificate in certificate chain) depth 2 for '\/C=NL\/O=Liberty Global Operations B.V.\/OU=Root CA0001\/CN=Liberty Global Root Certification Authority'\r\nwlan1: CTRL-EVENT-EAP-TLS-CERT-ERROR reason=1 depth=2 subject='\/C=NL\/O=Liberty Global Operations B.V.\/OU=Root CA0001\/CN=Liberty Global Root Certification Authority' err='self signed certificate in certificate chain'\r\nSSL: (where=0x4008 ret=0x230)\r\nSSL: SSL3 alert: write (local SSL3 detected an error):fatal:unknown CA\r\nSSL: (where=0x1002 ret=0xffffffff)\r\nSSL: SSL_connect:error in SSLv3 read server certificate B\r\nOpenSSL: openssl_handshake - SSL_connect error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed\r\nSSL: 7 bytes pending from ssl_out\r\nSSL: Failed - tls_out available to report error\r\nSSL: 7 bytes left to be sent out (of total 7 bytes)\r\n<\/pre>\n<p>Apparently OpenSSL blows a fuse when pointed at the CA cert, as it seemingly tries to authenticate the CA cert against a higher authority &#8211; since this is a root cert that is not possible. <a href=\"http:\/\/lists.shmoo.com\/pipermail\/hostap\/2010-October\/021808.html\">Apparently I&#8217;m not the first to see this little problem<\/a>.<\/p>\n<p>Quick workaround is to disable the CA Cert setting in the wpa_supplicants file and we are in business:<\/p>\n<pre class=\"brush: bash; title: ; notranslate\" title=\"\">\r\nSSL: SSL_connect:SSLv3 read server hello A\r\nTLS: tls_verify_cb - preverify_ok=1 err=19 (self signed certificate in certificate chain) ca_cert_verify=0 depth=2 buf='\/C=NL\/O=Liberty Global Operations B.V.\/OU=Root CA0001\/CN=Liberty Global Root Certification Authority'\r\nwlan1: CTRL-EVENT-EAP-PEER-CERT depth=2 subject='\/C=NL\/O=Liberty Global Operations B.V.\/OU=Root CA0001\/CN=Liberty Global Root Certification Authority'\r\nTLS: tls_verify_cb - preverify_ok=1 err=19 (self signed certificate in certificate chain) ca_cert_verify=0 depth=2 buf='\/C=NL\/O=Liberty Global Operations B.V.\/OU=Root CA0001\/CN=Liberty Global Root Certification Authority'\r\nwlan1: CTRL-EVENT-EAP-PEER-CERT depth=2 subject='\/C=NL\/O=Liberty Global Operations B.V.\/OU=Root CA0001\/CN=Liberty Global Root Certification Authority'\r\nTLS: tls_verify_cb - preverify_ok=1 err=19 (self signed certificate in certificate chain) ca_cert_verify=0 depth=1 buf='\/C=NL\/O=Liberty Global Operations B.V.\/OU=HORIZON Service Operator CA0001\/CN=Liberty Global HORIZON Service Operator Certification Authority'\r\nwlan1: CTRL-EVENT-EAP-PEER-CERT depth=1 subject='\/C=NL\/O=Liberty Global Operations B.V.\/OU=HORIZON Service Operator CA0001\/CN=Liberty Global HORIZON Service Operator Certification Authority'\r\nTLS: tls_verify_cb - preverify_ok=1 err=19 (self signed certificate in certificate chain) ca_cert_verify=0 depth=0 buf='\/CN=Liberty Global WiFi\/OU=HORIZON\/O=Liberty Global Operations B.V.\/C=NL'\r\nwlan1: CTRL-EVENT-EAP-PEER-CERT depth=0 subject='\/CN=Liberty Global WiFi\/OU=HORIZON\/O=Liberty Global Operations B.V.\/C=NL'\r\nSSL: (where=0x1001 ret=0x1)\r\nSSL: SSL_connect:SSLv3 read server certificate A\r\nSSL: (where=0x1001 ret=0x1)\r\nSSL: SSL_connect:SSLv3 read server done A\r\nSSL: (where=0x1001 ret=0x1)\r\nSSL: SSL_connect:SSLv3 write client key exchange A\r\nSSL: (where=0x1001 ret=0x1)\r\nSSL: SSL_connect:SSLv3 write change cipher spec A\r\nSSL: (where=0x1001 ret=0x1)\r\nSSL: SSL_connect:SSLv3 write finished A\r\nSSL: (where=0x1001 ret=0x1)\r\nSSL: SSL_connect:SSLv3 flush data\r\nSSL: (where=0x1002 ret=0xffffffff)\r\nSSL: SSL_connect:error in SSLv3 read finished A\r\nSSL: SSL_connect - want more data\r\nSSL: 318 bytes pending from ssl_out\r\nSSL: 318 bytes left to be sent out (of total 318 bytes)\r\nEAP: method process -&amp;gt; ignore=FALSE methodState=MAY_CONT decision=FAIL\r\nEAP: EAP entering state SEND_RESPONSE\r\nEAP: EAP entering state IDLE\r\nEAPOL: SUPP_BE entering state RESPONSE\r\nEAPOL: txSuppRsp\r\nTX EAPOL: dst=54:88:0e:b8:5d:79\r\nTX EAPOL - hexdump(len=332): 01 00 01 48 02 07 01 48 19 80 00 00 01 3e 16 03 01 01 06 10 00 01 02 01 00 75 1a fa 59 f4 52 82 d3 c2 c4 da 8e 12 6b 25 ab bd 77 93 3c a4 0f bb a0 34 bf f9 63 d0 4c 8a 2d 5d 71 11 24 a6 33 71 8e 8f b9 87 36 18 21 b8 c0 09 11 3a 59 6a 6a 77 65 b3 75 69 24 75 8f be ef 2b 07 2c 20 78 89 84 6e 54 dd f0 34 80 d8 39 cf 6b 5c 10 cb cf 99 90 d5 12 7f 5d 08 17 49 79 28 d1 23 11 c5 dc 2f a7 19 2c e2 c4 5d 4b 35 18 93 dc c5 e9 6d 82 40 ff 13 a6 19 79 dd fb c6 20 e6 0a 02 4f 24 90 3b 5c ea 6a 1b 80 16 85 9e ab 04 51 b4 ac dd dd a5 59 b1 84 12 89 65 a9 64 82 f7 7f f2 6c 48 5d 0f e7 7d c8 5b 60 ee 8a 41 98 55 4e c2 92 55 8e b1 0a dd 55 d5 4f 7b 2d 0a 4a 8b df 1a e1 cf 12 0d cd c5 3e 45 18 e9 69 cb 96 5a 9e 69 cd 4d 72 63 07 ab ab c0 c4 a1 04 e1 2f ad 12 a9 c9 82 9c 1b fe 8e a1 d7 48 6c 6e dd 90 08 5d 8a 5f 0b 54 eb b0 4e e8 17 04 45 64 2e 67 6d 14 03 01 00 01 01 16 03 01 00 28 11 ea 76 36 ea 35 2f 95 eb f3 ff 22 9e 41 31 17 08 f9 e5 53 48 b1 96 c9 f7 6d a3 9b 25 f7 7a cb b3 a9 5d 8f f2 9e 9e 02\r\nEAPOL: SUPP_BE entering state RECEIVE\r\nwlan1: RX EAPOL from 54:88:0e:b8:5d:79\r\nRX EAPOL - hexdump(len=63): 01 00 00 39 01 08 00 39 19 00 14 03 01 00 01 01 16 03 01 00 28 03 7e 2e d8 7e ce 49 a8 3e 53 d3 90 47 40 b3 c7 00 f2 00 7d d0 23 ae ba 9a 27 2d cd aa 0b 7f 68 52 48 f6 4a 58 f6 11 89 00 00\r\nEAPOL: Received EAP-Packet frame\r\nEAPOL: SUPP_BE entering state REQUEST\r\nEAPOL: getSuppRsp\r\nEAP: EAP entering state RECEIVED\r\nEAP: Received EAP-Request id=8 method=25 vendor=0 vendorMethod=0\r\nEAP: EAP entering state METHOD\r\nSSL: Received packet(len=57) - Flags 0x00\r\nSSL: (where=0x1001 ret=0x1)\r\nSSL: SSL_connect:SSLv3 read finished A\r\nSSL: (where=0x20 ret=0x1)\r\nSSL: (where=0x1002 ret=0x1)\r\nSSL: 0 bytes pending from ssl_out\r\nSSL: No Application Data included\r\nSSL: No data to be sent out\r\nEAP-PEAP: TLS done, proceed to Phase 2\r\nEAP-PEAP: using label 'client EAP encryption' in key derivation\r\nEAP-PEAP: Derived key - hexdump(len=64): &#x5B;REMOVED]\r\nSSL: Building ACK (type=25 id=8 ver=0)\r\nEAP: method process -&amp;gt; ignore=FALSE methodState=MAY_CONT decision=FAIL\r\nEAP: EAP entering state SEND_RESPONSE\r\nEAP: EAP entering state IDLE\r\nEAPOL: SUPP_BE entering state RESPONSE\r\nEAPOL: txSuppRsp\r\nTX EAPOL: dst=54:88:0e:b8:5d:79\r\nTX EAPOL - hexdump(len=10): 01 00 00 06 02 08 00 06 19 00\r\nEAPOL: SUPP_BE entering state RECEIVE\r\nwlan1: RX EAPOL from 54:88:0e:b8:5d:79\r\nRX EAPOL - hexdump(len=41): 01 00 00 23 01 09 00 23 19 00 17 03 01 00 18 ee f5 c3 a9 be 73 08 05 92 fd e0 52 73 8b 2a 53 a5 d9 64 8d cc 3c 20 f6 00 00\r\nEAPOL: Received EAP-Packet frame\r\nEAPOL: SUPP_BE entering state REQUEST\r\nEAPOL: getSuppRsp\r\nEAP: EAP entering state RECEIVED\r\nEAP: Received EAP-Request id=9 method=25 vendor=0 vendorMethod=0\r\nEAP: EAP entering state METHOD\r\nSSL: Received packet(len=35) - Flags 0x00\r\nEAP-PEAP: received 29 bytes encrypted data for Phase 2\r\nEAP-PEAP: Decrypted Phase 2 EAP - hexdump(len=1): 01\r\nEAP-PEAP: received Phase 2: code=1 identifier=9 length=5\r\nEAP-PEAP: Phase 2 Request: type=1\r\nEAP: using real identity - hexdump_ascii(len=8):\r\n63 6f 6c 69 6e 6d 61 63\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 colinmac\r\nEAP-PEAP: Encrypting Phase 2 data - hexdump(len=13): &#x5B;REMOVED]\r\nSSL: 66 bytes left to be sent out (of total 66 bytes)\r\nEAP: method process -&amp;gt; ignore=FALSE methodState=MAY_CONT decision=FAIL\r\nEAP: EAP entering state SEND_RESPONSE\r\nEAP: EAP entering state IDLE\r\nEAPOL: SUPP_BE entering state RESPONSE\r\nEAPOL: txSuppRsp\r\nTX EAPOL: dst=54:88:0e:b8:5d:79\r\nTX EAPOL - hexdump(len=76): 01 00 00 48 02 09 00 48 19 00 17 03 01 00 18 0c 6d 84 e3 05 5a ed 21 51 24 0a f4 f3 c6 c7 49 df 39 c5 27 ad 3e cd 8d 17 03 01 00 20 46 a2 79 7f 71 23 e0 91 8a b0 24 11 c8 0f 48 44 09 78 ba ec 81 29 c8 dd 61 9e f1 42 87 92 ec b1\r\nEAPOL: SUPP_BE entering state RECEIVE\r\nEAPOL: startWhen --&amp;gt; 0\r\nwlan1: RX EAPOL from 54:88:0e:b8:5d:79\r\nRX EAPOL - hexdump(len=65): 01 00 00 3b 01 0a 00 3b 19 00 17 03 01 00 30 26 88 61 ea ad c4 b0 dd 63 c9 18 29 ee 80 d1 0a 69 ab f4 b1 e9 2a 1e 26 26 37 22 4c 2e 3a 4a 15 43 43 62 3f 11 f9 4e df a3 f3 a8 d2 c4 71 68 bc 00 00\r\nEAPOL: Received EAP-Packet frame\r\nEAPOL: SUPP_BE entering state REQUEST\r\nEAPOL: getSuppRsp\r\nEAP: EAP entering state RECEIVED\r\nEAP: Received EAP-Request id=10 method=25 vendor=0 vendorMethod=0\r\nEAP: EAP entering state METHOD\r\nSSL: Received packet(len=59) - Flags 0x00\r\nEAP-PEAP: received 53 bytes encrypted data for Phase 2\r\nEAP-PEAP: Decrypted Phase 2 EAP - hexdump(len=25): 1a 01 0a 00 18 10 ef 8b 8c 7b 1e 81 00 f8 0c c9 af 89 fd f6 2e 38 46 45 31\r\nEAP-PEAP: received Phase 2: code=1 identifier=10 length=29\r\nEAP-PEAP: Phase 2 Request: type=26\r\nEAP-PEAP: Selected Phase 2 EAP vendor 0 method 26\r\nEAP-MSCHAPV2: RX identifier 10 mschapv2_id 10\r\nEAP-MSCHAPV2: Received challenge\r\nEAP-MSCHAPV2: Authentication Servername - hexdump_ascii(len=3):\r\n46 45 31\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 FE1\r\nEAP-MSCHAPV2: Generating Challenge Response\r\nGet randomness: len=16 entropy=21\r\nMSCHAPV2: Identity - hexdump_ascii(len=8):\r\n63 6f 6c 69 6e 6d 61 63\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 colinmac\r\nMSCHAPV2: Username - hexdump_ascii(len=8):\r\n63 6f 6c 69 6e 6d 61 63\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 colinmac\r\nMSCHAPV2: auth_challenge - hexdump(len=16): ef 8b 8c 7b 1e 81 00 f8 0c c9 af 89 fd f6 2e 38\r\nMSCHAPV2: peer_challenge - hexdump(len=16): 67 d4 8e 8e e8 48 22 57 9d be b7 2e 73 83 49 44\r\nMSCHAPV2: username - hexdump_ascii(len=8):\r\n63 6f 6c 69 6e 6d 61 63\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 colinmac\r\nMSCHAPV2: password - hexdump_ascii(len=16): &#x5B;REMOVED]\r\nMSCHAPV2: NT Response - hexdump(len=24): 10 79 02 a5 f2 bf eb 3e 3a 61 f8 2f 8d 32 35 56 4e 35 78 61 8a ef f7 95\r\nMSCHAPV2: Auth Response - hexdump(len=20): 32 2c 46 ee 9d 2d c6 75 34 e7 df ca fa 35 2b 76 8a 5a 42 d9\r\nMSCHAPV2: Master Key - hexdump(len=16): &#x5B;REMOVED]\r\nEAP-MSCHAPV2: TX identifier 10 mschapv2_id 10 (response)\r\nEAP-PEAP: Encrypting Phase 2 data - hexdump(len=67): &#x5B;REMOVED]\r\nSSL: 122 bytes left to be sent out (of total 122 bytes)\r\nEAP: method process -&amp;gt; ignore=FALSE methodState=MAY_CONT decision=FAIL\r\nEAP: EAP entering state SEND_RESPONSE\r\nEAP: EAP entering state IDLE\r\nEAPOL: SUPP_BE entering state RESPONSE\r\nEAPOL: txSuppRsp\r\nTX EAPOL: dst=54:88:0e:b8:5d:79\r\nTX EAPOL - hexdump(len=132): 01 00 00 80 02 0a 00 80 19 00 17 03 01 00 18 55 ca 7a 1f a1 5d 3a 0a fc 0d db 15 36 2c 6b af 4b 79 39 4c 40 45 62 83 17 03 01 00 58 c1 08 63 3f a0 5e 42 9a 7f 41 9f bf a3 c7 ae 76 50 17 67 6e 94 ea 41 d8 91 70 04 90 b2 8d dd 8d 18 7f 4b f5 67 7a 4f 1a b3 da 86 4d 24 b6 bf 87 ac 0b 31 05 56 39 2e ec 7a 67 65 8f 3a 99 6c 6e d1 53 02 49 02 d6 19 20 cf 19 33 6a c1 05 5e 75 76 b7 c0 e2 dc fb 49 04\r\nEAPOL: SUPP_BE entering state RECEIVE\r\nwlan1: RX EAPOL from 54:88:0e:b8:5d:79\r\nRX EAPOL - hexdump(len=89): 01 00 00 53 01 0b 00 53 19 00 17 03 01 00 48 6b ee 0f 37 d5 50 c5 65 30 01 05 78 12 a5 e5 e1 81 80 dd c4 ee 6c f3 d6 7c ab fd 1b 92 42 5c 8b fb 5d 8d 0d 2f 7b 82 86 2b 72 71 f8 8d 91 ae ef e0 4a d2 17 d1 c4 4b e2 6d 36 ae d2 fd 88 a7 96 b8 45 b5 69 e4 54 5f 12 00 00\r\nEAPOL: Received EAP-Packet frame\r\nEAPOL: SUPP_BE entering state REQUEST\r\nEAPOL: getSuppRsp\r\nEAP: EAP entering state RECEIVED\r\nEAP: Received EAP-Request id=11 method=25 vendor=0 vendorMethod=0\r\nEAP: EAP entering state METHOD\r\nSSL: Received packet(len=83) - Flags 0x00\r\nEAP-PEAP: received 77 bytes encrypted data for Phase 2\r\nEAP-PEAP: Decrypted Phase 2 EAP - hexdump(len=47): 1a 03 0a 00 2e 53 3d 33 32 32 43 34 36 45 45 39 44 32 44 43 36 37 35 33 34 45 37 44 46 43 41 46 41 33 35 32 42 37 36 38 41 35 41 34 32 44 39\r\nEAP-PEAP: received Phase 2: code=1 identifier=11 length=51\r\nEAP-PEAP: Phase 2 Request: type=26\r\nEAP-MSCHAPV2: RX identifier 11 mschapv2_id 10\r\nEAP-MSCHAPV2: Received success\r\nEAP-MSCHAPV2: Success message - hexdump_ascii(len=0):\r\nEAP-MSCHAPV2: Authentication succeeded\r\nEAP-PEAP: Encrypting Phase 2 data - hexdump(len=6): &#x5B;REMOVED]\r\nSSL: 58 bytes left to be sent out (of total 58 bytes)\r\nEAP: method process -&amp;gt; ignore=FALSE methodState=MAY_CONT decision=FAIL\r\nEAP: EAP entering state SEND_RESPONSE\r\nEAP: EAP entering state IDLE\r\nEAPOL: SUPP_BE entering state RESPONSE\r\nEAPOL: txSuppRsp\r\nTX EAPOL: dst=54:88:0e:b8:5d:79\r\nTX EAPOL - hexdump(len=68): 01 00 00 40 02 0b 00 40 19 00 17 03 01 00 18 39 d5 bf 6d ab 16 a3 06 c3 c3 25 b2 73 e5 67 a7 67 d9 d7 aa a8 8e 23 51 17 03 01 00 18 79 03 52 49 f6 02 7e 4d a5 7f 9d 2c 1b b5 29 b5 aa 31 8a 1e 5b ed a5 d9\r\nEAPOL: SUPP_BE entering state RECEIVE\r\nwlan1: RX EAPOL from 54:88:0e:b8:5d:79\r\nRX EAPOL - hexdump(len=49): 01 00 00 2b 01 0c 00 2b 19 00 17 03 01 00 20 13 ba 7a c4 11 66 26 d0 30 0c 03 18 f1 b7 de 1e 21 22 6e 19 0a ff e9 46 de 42 dc bf d7 81 11 24 00 00\r\nEAPOL: Received EAP-Packet frame\r\nEAPOL: SUPP_BE entering state REQUEST\r\nEAPOL: getSuppRsp\r\nEAP: EAP entering state RECEIVED\r\nEAP: Received EAP-Request id=12 method=25 vendor=0 vendorMethod=0\r\nEAP: EAP entering state METHOD\r\nSSL: Received packet(len=43) - Flags 0x00\r\nEAP-PEAP: received 37 bytes encrypted data for Phase 2\r\nEAP-PEAP: Decrypted Phase 2 EAP - hexdump(len=11): 01 0c 00 0b 21 80 03 00 02 00 01\r\nEAP-PEAP: received Phase 2: code=1 identifier=12 length=11\r\nEAP-PEAP: Phase 2 Request: type=33\r\nEAP-TLV: Received TLVs - hexdump(len=6): 80 03 00 02 00 01\r\nEAP-TLV: Result TLV - hexdump(len=2): 00 01\r\nEAP-TLV: TLV Result - Success - EAP-TLV\/Phase2 Completed\r\nEAP-PEAP: Encrypting Phase 2 data - hexdump(len=11): &#x5B;REMOVED]\r\nSSL: 66 bytes left to be sent out (of total 66 bytes)\r\nEAP: method process -&amp;gt; ignore=FALSE methodState=DONE decision=UNCOND_SUCC\r\nEAP: EAP entering state SEND_RESPONSE\r\nEAP: EAP entering state IDLE\r\nEAPOL: SUPP_BE entering state RESPONSE\r\nEAPOL: txSuppRsp\r\nTX EAPOL: dst=54:88:0e:b8:5d:79\r\nTX EAPOL - hexdump(len=76): 01 00 00 48 02 0c 00 48 19 00 17 03 01 00 18 73 64 46 7d 38 e3 b0 07 de 23 4c 48 10 ac 96 c0 39 23 61 d5 34 03 14 af 17 03 01 00 20 01 9c d7 1c 26 ff f6 77 cf c0 d5 42 f3 56 b4 d0 9d b5 09 d5 77 b2 37 dc 40 41 c5 4c 09 fa 0c 4f\r\nEAPOL: SUPP_BE entering state RECEIVE\r\nwlan1: RX EAPOL from 54:88:0e:b8:5d:79\r\nRX EAPOL - hexdump(len=10): 01 00 00 04 03 0c 00 04 00 00\r\nEAPOL: Received EAP-Packet frame\r\nEAPOL: SUPP_BE entering state REQUEST\r\nEAPOL: getSuppRsp\r\nEAP: EAP entering state RECEIVED\r\nEAP: Received EAP-Success\r\nEAP: EAP entering state SUCCESS\r\nwlan1: CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully\r\n<\/pre>\n<p>Otherwise, the <a href=\"http:\/\/gagravarr.org\/writing\/openssl-certs\/others.shtml\">proper way is to install the cert into the system<\/a><\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Horizon Wi-Free is an 802.1x authenticated network service intended to allow UPC customers to use WiFi Offload via UPC broadband routers. Essentially almost all UPC modems are broadcasting a &#8220;Horizon Wi-Free&#8221; SSID, and authenticating via 802.1x in the backend. Note: You cannot connect to Horizon Wi-Free through your own router, so you will have to [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[63,83,95,38],"tags":[64,88,201,202,203,40,42],"series":[],"class_list":["post-364","post","type-post","status-publish","format-standard","hentry","category-raspberry-pi","category-internet","category-data-networking","category-linux","tag-raspberry-pi-2","tag-upc","tag-horizon-wi-free","tag-802-1x","tag-wpa_supplicant","tag-networking","tag-linux-2"],"_links":{"self":[{"href":"https:\/\/flat-planet.net\/index.php?rest_route=\/wp\/v2\/posts\/364","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/flat-planet.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/flat-planet.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/flat-planet.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/flat-planet.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=364"}],"version-history":[{"count":5,"href":"https:\/\/flat-planet.net\/index.php?rest_route=\/wp\/v2\/posts\/364\/revisions"}],"predecessor-version":[{"id":375,"href":"https:\/\/flat-planet.net\/index.php?rest_route=\/wp\/v2\/posts\/364\/revisions\/375"}],"wp:attachment":[{"href":"https:\/\/flat-planet.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=364"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/flat-planet.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=364"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/flat-planet.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=364"},{"taxonomy":"series","embeddable":true,"href":"https:\/\/flat-planet.net\/index.php?rest_route=%2Fwp%2Fv2%2Fseries&post=364"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}