GrapheneOS & FreeRADIUS (on OpenBSD) EAP-PEAP (WARNING USB DEBUGGING REQUIRED)

mxb78

Hey, writing what I found and have it working on GOS build 2025112101

Import your self-created CA into GOS
enable developer mode, enable USB debugging, install Android SDK (gives you "adb" to move in/out files)
and transfer to /sdcard.
GOS wants TLS 1.3
so freeradius config needs some modds.
modify eap module:
vi /etc/raddb/mods-enabled/eap :
eap {
.....
.....
tls_min_version = "1.2"
tls_max_version = "1.3"

Hope this helps someone.

de0u

mxb78 enable developer mode, enable USB debugging, install Android SDK (gives you "adb" to move in/out files)
and transfer to /sdcard

Is this part necessary, in the sense that other ways to get the CA cert onto the device won't work?

mxb78

de0u

I ended up with no working WIFI for GOS at home. :) I had no other way.
sure, should be possible with other ways. as long as you can get CA file into GOS.

Novalissoide

de0u Dde0u, is this a normal thing, to me it seems like a weird surge of accounts asking for risky transgressions, several mentioning cloud services in just a day?

de0u

Novalissoide Is this a normal thing, to me it seems like a weird surge of accounts asking for risky transgressions, several mentioning cloud services in just a day?

It seems that there is an uptick in the number of GrapheneOS users. There's a lot going on recently... the end of DivestOS, the CalyxOS pause(?), and the public attacks by the French government. So maybe it's not surprising if there are more forum users, and maybe also not surprising if people who are switching to GrapheneOS from other AOSP variants, instead of iOS or Google's OS, are asking different questions.

n3t_admin

Is this part necessary, in the sense that other ways to get the CA cert onto the device won't work?

I dunno, maybe my setup is different, but I had FreeRADIUS working without needing to move the cert to /sdcard. I just moved it to the file system via regular MTP transfer and installed it. I don't understand either why it needs to be on /sdcard or why adb is required here.

MetropleX

n3t_admin if this can be tested to confirm working without the aforementioned step I will be happy to amend and edit as required.

Just for brevity and others finding this thread, use of developer options and even more so USB Debugging/ADB is NOT advised. The attack surface is massive.

mxb78

n3t_admin
I have own., selfsigned CA. iOS for example, gives one possibility to accept CA. but not GOS.
I had to move in CA file into /sdcard, import it, use it for wifi. and its worked.

Novalissoide

de0u thank you Yes. I hope you're right. I'll try keep some extra eyes on the, emm, let's briefly name it the 'Gos-targeting AI-slop-quota'.

n3t_admin

mxb78 yes, me as well. You have to import (trust) the CA first, then import the client cert. Has worked flawlessly for me when I was still on GOS.