Gentlemen:

I've been working in a project to build a hotspot under Linux for some weeks now. I've checked FreeRADIUS, OpenSSL and ChilliSpot documentation, and practiced with many Linux distros.
The requirements say that it must be SECURE (i.e. protected against wireless sniffing and no connectivity until the supplicant provides the correct credentials). For example, the supplicant connects to the AP and uses port-based authentication to provide Username/Password, which are verified by a RADIUS-SQL mix (FreeRADIUS + MySQL). If the credentials are valid, then the client is given a IP address and access to the network; else, no connectivity is provided.
Other requirement is that must support Windows XP clients, and nothing must be installed in the clients (except Microsoft patches if needed), not even digital certificates.
Can such an implementation be done? If so, what would I need (software)? Which protocols must I use?

Thanks in advance.

Sherman

You need 80211i:
Software:
* FreeRadius (+MySQL) + Xsupplicant for the supplicants
* OpenSSL for creating certificates.

Protocols:
* EAP-TLS to authenticate by certificates
or
PEAP-MS-CHAPv2 which established a TLS tunnel to authenticate by passwords.

Ah just seen this
Remove the Windows XP

So, my solution is FreeRADIUS + MySQL + PEAP-MSCHAPv2. Any FAQs/tutorials/HOWTOs on that?

lol

And the last question: Which Linux distro is the most convenient for this server impementation? I've tried Slackware and I've got used to it, but Ubuntu's package management and simplicity really caught me. Maybe Fedora is an option, too...

Here's a decent writeup on PEAP/CHAP: http://www.microsoft.com/technet/com...uy/cg0702.mspx

The basic FreeRADIUS instructions, some specific to EAP/TLS, should give you the rest of the guidance you need: www.freeradius.org/doc/EAPTLS.pdf

As for distros, I'm a Slack bigot. Once you set up the authentication server, you'll not be doing much in the way of packages. I'm running a RADIUS box and I only add security updates (via Swaret). It you want to create packages for Slack, for easy removal or upgrades (without using the native Slack tools), try Checkinstall: http://asic-linux.com.mx/~izto/checkinstall/

Tahnks for all your help.

Well, after struggling a lot, I finally made it. All my tech requirements have been met. Now I'm gonna organize all that and write a FAQ if someone wants to do it too.
Man, it's gonna take loooooooong...