wpa_supplicant가 서비스로 시작되면 Centos 6 EAP 인증이 실패합니다.

wpa_supplicant가 서비스로 시작되면 Centos 6 EAP 인증이 실패합니다.

wpa_supplicant서비스로 시작 하면 sudo service start wpa_supplicant(시작 파일에 있는 경우에도 동일한 문제가 발생함) 노트북이 EAP 네트워크에 연결하지 못하고 다음과 같은 오류가 발생합니다 /var/log/wpa_supplicant.

1478280999.154045: OpenSSL: pending error: error:2006D002:BIO routines:BIO_new_f
ile:system lib
1478280999.154052: OpenSSL: pending error: error:0B084002:x509 certificate routi
nes:X509_load_cert_crl_file:system lib
1478280999.154062: OpenSSL: tls_load_ca_der - Failed load CA in DER format error
:0200100D:system library:fopen:Permission denied
1478280999.154068: OpenSSL: pending error: error:20074002:BIO routines:FILE_CTRL
:system lib
1478280999.154074: OpenSSL: pending error: error:0B06F002:x509 certificate routi
nes:X509_load_cert_file:system lib
1478280999.154079: TLS: Failed to set TLS connection parameters
1478280999.154085: EAP-TLS: Failed to initialize SSL.
1478280999.154091: EAP: Failed to initialize EAP method: vendor 0 method 13 (TLS
)
1478281000.477040: CTRL-EVENT-EAP-FAILURE EAP authentication failed
1478281002.477915: Authentication with 6c:f3:7f:af:fb:62 timed out.
1478281002.493367: CTRL-EVENT-DISCONNECTED bssid=00:00:00:00:00:00 reason=0
1478281002.993907: Failed to initiate AP scan.
1478281003.994183: Failed to initiate AP scan.
1478281004.994662: Failed to initiate AP scan.
1478281005.558072: Trying to associate with 6c:f3:7f:af:fb:72 (SSID='eduroam' fr
eq=5825 MHz)
1478281005.561055: Association request to the driver failed
1478281005.569691: Associated with 6c:f3:7f:af:fb:72
1478281005.573148: CTRL-EVENT-EAP-STARTED EAP authentication started
1478281005.845088: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=13
1478281005.845239: OpenSSL: tls_connection_ca_cert - Failed to load root certifi
cates error:0200100D:system library:fopen:Permission denied
1478281005.845268: OpenSSL: pending error: error:2006D002:BIO routines:BIO_new_f
ile:system lib
1478281005.845291: OpenSSL: pending error: error:0B084002:x509 certificate routi
nes:X509_load_cert_crl_file:system lib
1478281005.845326: OpenSSL: tls_load_ca_der - Failed load CA in DER format error
:0200100D:system library:fopen:Permission denied
1478281005.845348: OpenSSL: pending error: error:20074002:BIO routines:FILE_CTRL
:system lib
1478281005.845368: OpenSSL: pending error: error:0B06F002:x509 certificate routi
nes:X509_load_cert_file:system lib
1478281005.845383: TLS: Failed to set TLS connection parameters
1478281005.845425: EAP-TLS: Failed to initialize SSL.
1478281005.845446: EAP: Failed to initialize EAP method: vendor 0 method 13 (TLS
)
1478281007.073725: CTRL-EVENT-EAP-FAILURE EAP authentication failed
1478281009.074324: Authentication with 6c:f3:7f:af:fb:72 timed out.

나에게 관련된 부분은 다음과 같습니다 /etc/wpa_supplicant/wpa_supplicant.log.

ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=wheel
update_config=1

network={
    ssid="eduroam"
    proto=RSN
    key_mgmt=WPA-EAP
    pairwise=CCMP
    group=CCMP
    eap=TLS
    identity="[email protected]"
    ca_cert="/home/chris/cert/ca.crt"
    client_cert="/home/chris/cert/cert.pem"
    private_key="/home/chris/cert/key.pem"
    private_key_passwd="LONGPASSWORD"
    priority=10
}

그리고 내 /etc/sysconfig/wpa_supplicant:

# Use the flag "-i" before each of your interfaces, like so:
#  INTERFACES="-ieth1 -iwlan0"
INTERFACES="-iwlan0"

# Use the flag "-D" before each driver, like so:
#  DRIVERS="-Dwext"
DRIVERS="-Dwext"

# Other arguments
#   -u   Enable the D-Bus interface (required for use with NetworkManager)
#   -f   Log to /var/log/wpa_supplicant.log
#   -P   Write pid file to /var/run/wpa_supplicant.pid 
#        required to return proper codes by init scripts (e.g. double "start" action)
#        -B to daemonize that has to be used together with -P is already in wpa_supplicant.init.d
#   -t   include timestamp in debug messages
OTHER_ARGS="-f /var/log/wpa_supplicant.log -P /var/run/wpa_supplicant.pid -t"

개방형 네트워크는 잘 작동하며 wpa_supplicant수동으로 실행하면 모든 네트워크가 sudo wpa_supplicant -Dwext -c/etc/wpa_supplicant/wpa_supplicant.conf -iwlan0 -B.

편집: 몇 가지 추가 정보 - WPA2-PSK 네트워크에 정상적으로 액세스할 수 있었기 때문에 EAP-TLS에만 해당되는 것 같습니다.

답변1

이는 SELinux 권한 관련 문제였습니다. chcon -t NetworkManager_var_run_t인증서에서 명령을 실행하면 문제가 해결되었습니다.

답변2

/home/chris/cert/루트가 이 폴더에 액세스할 수 있습니까? 또한, 이를 기반으로이것:

폴더가 암호화되어 있나요? 인증서를 다른 곳으로 옮겨 볼 수 있나요?

관련 정보