text:
Pony 4 Honey playlist 27/03/07
The "All in the Family Show"...where I attempt to link together all the songs in my hour & a half playlist, non-lamely. If only I knew how to draw Venn diagrams or family trees or something.
Malaria – You You
Is German, just like:
Hanin Elias – Girl Serial Killer (the Dear Hanin remix)
This song was remixed by Le Tigre, who, at the end of the Dear Hanin remix address a letter to Hanin about the deaths of Patrick Dorsman and Amadou Diallo, which they also sing about on:
Le Tigre – Bang! Bang!
Sadie Benning from Le Tigre was replaced by JD Samson who is now in:
The New England Roses – All for the Night
And is it true that JD and Wynne Greenwood used to be together? (ha ha gossip gossip) For sure Johanna Fatemen, also from Le Tigre is now working on a project called LIBBER with Wynne Greenwood, who used to be:
Tracy & the Plastics – Queerion
Who once covered a song by:
Lesbians on Ecstasy – Sedition
Who have also been remixed by:
Scream Club v Leonard DeLeonard – International
Rachel Carns has a guest appearance on Scream Club's album "Don't Bite Your Sister", and she also was in:
The Need – Don't Touch the Ribbon
The King Cobra – This Town Ain't Big Enough For the Both of Us
And drummed at some point for:
Slant 6 – Babydoll
The lead singer of Slant 6, Christina Billotte is now the lead singer of:
The Casual Dots – Mama's Gonna Make Us a Cake
Which of course features the beautiful Kathi Wilcox, formally a member of:
The Frumpies- Be Good
In which she shared vocals with Tobi Vail, who, on the KRS site reviewed the next band and said they were exactly the kind of band Bikini Kill was hoping to inspire:
Finally Punk – What the Fuck Missile
Who often seem to play with another up-and-coming punk band:
Kiosk – I'm Floored
Who are Australian like:
Macromantics – Apple Crumble
And Romy from Macromantics used to be in Noise Addict with Ben Lee, and this band performed a song (about Evan Dando) called "I Wish I Was Him", which was later covered by Kathleen Hanna on one of the Kill Rockstars compilations. Kathleen Hanna, of course being the lead singer of:
Bikini Kill – Strawberry Julius
Which of course features Tobi Vail (mentioned above), who is now in:Spider and the Webs – A Kid Named Jay
Along with a member of Dub Narcotics, a band that Calvin Johnson used to also be in, as well as being in the next band with Tobi Vail back in the day:
The Go Team – Bikini Twilight
And this band, which is probably his most famous(?) band:
Beat Happening – Sleepyhead
A band which Kurt Cobain used to like (and he also played guitar on Bikini Twilight by the Go Team), which leads us to:
Nirvana – Territorial Pissings
And Kurt, being the big fanboy he was, also really liked the next band, and in fact wrote in the liner notes for the re-release of their first album, and invited them to tour with Nirvana, but died a week before the tour. He also randomly met Ana Da Silva, the lead singer, in a record shop in London while he was searching for this band's first album, and he wrote about this experience in the liner notes to Insecticide. Hole also covered the next song. The band? It was of course:
The Raincoats – The Void
Who, in one incarnation had Steve Shelley playing with them, who is from:
Sonic Youth – Kim Gordon & the Arthur Doyle Hand Cream
This song was originally entitled "Mariah Carey & the Arthur Doyle Handcream", and was done as part of a split single "Buddy Series" release by Narnack Records, which they shared with the next band. who also did a song about Mariah Carey (this is not that song though):
Erase Errata – Hotel Suicide
Who, I read somewhere, formed a side band with Kim Gordon at the ATP festival, but I don't think they've recorded anything. Kim Gordon, being in the next band:
Free Kitten – Noise Doll
Which also has Yoshimi who, as well as being in the Boredoms and Free Kitten is in Japanese noise band:
OOIOO – Right Hand Ponk
And has worked with Yuka on an album called "Flower with No Color". Where is Yuka from?
Cibo Matto – Sci Fi Wasabi
And Cibo Matto are a band who have a lot of different people doing guest spots, including one Arto Lindsay, most famous for being in No Wave band
DNA – I'm Not Moving
And it was from DNA that the next band got their name
Blonde Redhead – Melody of Certain Three
PHEW!!! So there we go folks. It's all in the family.
And I ended Pony 4 Honey, for the month of March with a little ode to the crooked cops of our country:
Julie Ruin – I Wanna Know what Love Is
>how many girls stay awake all night
i wanna know what love is
what the fuck if we all got guns
i wanna know what love is
the killers and the cops give us special advice
i wanna know what love is
so i'll stay awake almost every night
i don't care how we get it but we'll get it someday<
Posted 4680 days ago | By Melissa | Comment [1]
Two-piece craziness! I was lucky enough to catch this band in London in July 2006, opening for the Gossip. Akiko the singer/drummer was dressed in pink underwear and drummed and screamed and stomped around the stage and was an amazing whirlwind of energy. Simon the guitarist reminded me heaps of Brace Paine, I think it was the hair and the way he stood off to the side, a force unto himself, but letting her take the stage.
I was blown away by their raw style, it was like the best of riot grrrl (Huggy Bear etc) but threatening in a different way, it was like the riot mixed with something more dark and sexy.
The music was scrawling guitars and thudding drums, screamed vocals, a spontaneous performance that would appeal to lovers of noise: Yokel Ono style, diy/riot punk: the aforementioned Huggy Bear, and garage music alike (i.e. a great complement to the main act of the night, The Gossip – Akiko stood in the wings while they played, ecstatically dancing along and helped Beth Ditto with the "whoa whoa whooooa"s in "Standing in the Way of Control").
Watching Comanechi, I knew I'd probably not see something like that again for a long while (and probably not til I go overseas again where people seem able to let loose on stage, or at least where the audience condones it).
Their website is great too:
Come to New Zealand Comanechi! You can play in the, uh, Schooner Tavern?...
Watch Comanechi "Death Of You"
Posted 4687 days ago | By Melissa | Comment
Pony 4 Honey playlist 20/03/07
Not in order, but anyway…
All for the Night – New England Roses
Tues 11pm-1am(ish)
Posted 4687 days ago | By Melissa | Comment
An adventure close to home
Who can believe that the night before last New Zealanders were actually given the opportunity to jump around to "Vindictive" being played live by the actual Slits?
That song was pretty much played on a loop for 2 weeks when I first bought the Slits: Peel Sessions. I love it so much! And live, it was just ridiculous.
It's funny cos a lot of times during moments like that (the Breeders playing "Canonball", Le Tigre playing "Decepticon", Sleater Kinney playing "Dig Me Out" etc), I've actually been too overwhelmed to purely enjoy the moment, like, I just can't fully be there because I'm too busy trying to BE THERE and comprehend the moment (does anyone else do this, or am I the only freak?). But when the Slits played "Vindictive" it was just so much fun and I remember it perfectly.
I was totally impressed by the band, I kind of had no real expectations, and thought it could go either way (though after reading reviews of their US live shows by actual fans and their musical peers on the Typical Girls list, I thought it was more likely to be good). But the fact that they were so down to earth, not trying to be anything but what they were (which was awesome), just meant that the show could be enjoyed, no holds barred.
One of the best things about the Slits, I think, is that they're not just an old band doing some lame reunion tour. The Slits are a continuing band (if that makes sense), who have changed their sound and shape throughout their nearly 30 year history. So their show wasn't about nostalgia, and yet luckily (for us NZers) they were still keen to do their old songs with enthusiasm, as most of us either weren't born when Cut came out, or weren't in London in '79! It was kind of like we were seeing a rare piece of history and at the same time a totally exciting band of today.
Their mix of songs was great, I think they played "Newtown", "FM" "Shoplifting" (twice) & "Typical Girls" from Cut, and the other songs I recognised were "Man Next Door" & "Vindictive/Let's Do the Split". They did "Medusa" from Return of the Giant Slits (I don't know that album, but they had a competition to see who could name the song, and that's how I know what is was) and also "Hated By Many, Loved By a Few", which apparently is a new song that hasn't been released. The only song they did from the new EP was "Kill them with Love". I was a little sad that they didn't do "Number One Enemy" because that is my current favourite, but they pretty much satisfied with their set list otherwise.
I thought Ari-Up's banter with the crowd was cool too, the little "how well do you know the Slits" quizzes were a good way to include the audience and "make a show" (re: Ian MacKaye's mantra during the Evens' show). The crowd was keen, which completely added to the all round good vibes of course. Everyone uproariously got into singing along to "Shoplifting". The tall boys in front made way for shorter girls to get in, and pretty much it seemed like everyone had a fun time, and felt very lucky to be there! The mohawked girl in the front got to say what I think everyone was thinking – just thank you to the Slits for coming, fucking awesome. Fucking legendary.
Posted 4690 days ago | By Melissa | Comment
This started as a review of the Evens...
I probably would've gone to see The Evens anyway, whether or not Ian MacKaye was in the band, but it has to be said that I was curious to see what the "legend" was like in real life, having never gone to a Fugazi show.
So the thing is, I was a little mad at Ian after this dumb comment he made on the Kerri Koch directed, 2006 documentary on Riot Grrrl, "Don't Need You". On the documentary they were discussing the Fugazi song "Suggestion" in which Ian begins the song by taking on the persona of a woman ("Why can't i walk down a street free of suggestion? Is my body the only trait in the eyes of men?").
Apparently some women had got in his face about it at the time and said something about how he had no right to sing about that. And he was aghast, angry, incredulous, and said he was all, "Fuck You!!", kind of like, how dare you tell me what I can and can't sing about!
Ok,in my opinion it's cool he did the song, and really there's not much Ian MacKaye could have got out of positioning himself as a victimised woman (except the annoying fact that he'd get way more pats on the back for being a guy and pointing out sexism that then any girl would), so you can't accuse him of appropriating for selfish reasons. He was just joining the conversation about sexual inequalities that was becoming louder and louder with the advent of riot grrrl.
BUT!! What kind of a reaction is that to a feminist protest? "Fuck You"?? Hello! wasn't that the kind of bull-headed, aggressive male outbursting that riot grrrls had to cope with every day?
Wasn't the point meant to be that boys were the ones who were supposed to shut up and listen and be taught by the girls for a change, rather than be the ones always doing the telling, the dogmatising?
Why would you just slap them in the face with a Fuck You. Be quiet. You're wrong. I'm right. Your notion that women's experience of sexual violence can only be voiced, explained and presented by women because up until now that experience has been warped, ignored or exploited by men is WRONG, Fuck You!
If feminist women were saying that kind of thing to him, didn't he think, hey! maybe I need to sit back and figure out their point! instead of overreacting and acting like his precious freedom of speech was being threatened?
Maybe he did consider that at the time, I mean I only saw that interview, not the context around it. But the way he discussed it on this, a documentary about riot grrrl, with such forceful singlemindedness – Fuck You! All bug eyed and irritated. Couldn't he have worded it differently? And why did they keep that comment in in doco anyway? Is it because they thought he provided a much needed male point of view? Where was Billy Karren?
Before I saw "Don't Need You" I read a review online somewhere which mentioned how it has interviews with a lot of the key players like Kathleen Hanna, and Corin Tucker, and then it said something like "and of course, Ian MacKaye, what punk documentary would be complete without him?". And I'm thinking, uh, a documentary on Riot Grrrl perhaps?
So ok, cool, he recorded Bikini Kill's first album, and that's important, but did we really need to have him singing their praises to drive home the fact they really were awesome? And then have him dismiss the concerns of other women involved in Riot Grrrl? Nothing against Ian MacKaye and his contributions, but I just find it weird that his view was thought to be so particularly important in this context.
All I want to know is when will we start to review the musical canon that is so taken for granted and stop using bands like Fugazi as shorthand for great, and start believing in our own greatness just as is, no boy-idol approval necessary?
Posted 4694 days ago | By Melissa | Comment
Recent Articles
Recent Comments


text:
Table Of Contents
4 Introduction to PKI and EAP-TLS
5 EAP-TLS Deployment in a WLAN Environment
5.3 Mixed EAP Protocol Deployments
6.3 Cisco Aironet Access Point Configuration
6.4 Microsoft XP Client Configuration
6 Troubleshooting Tips for EAP-TLS
8 Appendix A—Microsoft Windows 2000 Certificate Services Setup
8 Appendix B—Demo Certificates
White Paper
Extensible Authentication Protocol Transport Layer Security
Deployment Guide for Wireless LAN Networks
1 Scope
This document discusses the Extensible Authentication Protocol Transport Layer Security (EAP-TLS) authentication protocol deployment in wireless networks. It introduces the EAP-TLS architecture and then discusses deployment issues. An example enterprise rollout for EAP-TLS is discussed in the section "Validation Lab" (Section 6).
2 Background
In September 1999, the IEEE approved the 802.11b (2.4-gigahertz [GHz] range, 11-Mbps throughput) and 802.11a (5-GHz range, 54-Mbps throughput) extensions. Since then, adoption of wireless LAN (WLAN) solutions in vertical (retail, education, health care, transportation, and so on) and horizontal markets has accelerated. As standardized by the IEEE, security for 802.11 networks can be simplified into two main components: authentication and encryption. The implementation of these components has been proven insecure and has been extensively documented by the security community.
An alternative WLAN security approach focuses on developing a framework for providing centralized authentication and dynamic key distribution. A proposal jointly submitted to the IEEE by Cisco Systems, Microsoft, and other organizations introduced an end-to-end framework using 802.1X and the EAP to provide this enhanced functionality. Central to this proposal are two main elements:
•EAP allows wireless client adapters, which may support different authentication types, to communicate with different back-end servers such as Remote Access Dial-In User Service (RADIUS)
•IEEE 802.1X, a standard for port-based network access control
To support all popular operating systems, Cisco employees designed and implemented Lightweight Extensible Authentication Protocol (LEAP)—a network-EAP protocol based on 802.1x authentication framework—on Cisco Aironet® WLAN products and solutions. Microsoft's latest operating system, Windows XP, provides support for 802.1x (specifically EAP-TLS and EAP Message Digest 5 [MD5]). Thus, a variety of EAP authentication protocols can be used to authenticate users in today's WLAN networks. Figure 2-1 illustrates the mixed EAP protocol deployment in a WLAN network:
Figure 2-1
Mixed 802.1x Protocol Deployment in a Wireless LAN Network
As shown in Figure 2-1, either the Cisco Access Control Server (ACS) or the Cisco Access Registrar can be used for a combined LEAP and EAP-TLS protocol deployment in an enterprise network. Table 2-1 compares the characteristics of the widely available EAP protocols:
Table 2-1 Comparison of Widely Available 802.1x/EAP Authentication Protocols 802.1x/EAP Compliance Mutual Authentication Dynamic Wired Equivalent Privacy Support Operating System Support
Cisco EAP (LEAP)
Windows platforms (Windows XP, 2000, 98, 95, ME and NT), Windows CE, Linux, Disk Operation System (DOS), and Mac OS
Windows XP1
Windows XP1
1 Note: Microsoft has announced EAP support for legacy operating systems in 2002 (Windows 2000, Windows NT 4, Windows 98, Windows 98 Second Edition, and Windows ME). Also, there are third-party EAP supplicants that provide support for EAP-TLS on various operating systems (Meetinghouse Data Communications EAP supplicant, for example).
As shown in Table 2-1, EAP MD5 does not support mutual authentication nor dynamic derivation of the Wired Equivalent Privacy (WEP) key, which are essential for WLAN networks. Therefore, Cisco recommends that you do not deploy EAP MD5 in a WLAN environment.
This document focuses on EAP-TLS authentication protocol rollout in WLAN networks. Section 3 further introduces the reader to the EAP/802.1x architecture. Section 4 discusses Public Key Infrastructure (PKI) and EAP-TLS authentication protocol. In Section 5, EAP-TLS deployment criteria are examined in detail. Section 6 provides details about the Validation Lab that was built to illustrate an example EAP-TLS rollout in a WLAN network. Section 7 provides EAP-TLS troubleshooting tips. Appendix A details the setup for Windows 2000 Server Certificate Services. Appendix B provides instructions for configuring EAP-TLS using demo certificates (for proof of concept testing).
3 EAP Architecture
EAP provides a standard mechanism for supporting various authentication methods over wired and wireless networks. An authentication, authorization, and accounting (AAA) client (also known as a network access server) such as an access point that supports EAP need not have any understanding of the specific EAP type used in the EAP authentication process. The network access server tunnels the authentication messages between the peer (user machine trying to authenticate) and the AAA server (such as the Cisco Secure ACS). The network access server is aware only of when the EAP authentication process starts and when it ends.
There are EAP types, such as LEAP and EAP-TLS, in which the authentication is mutual: server authenticates user, and user authenticates server. Mutual authentication is usually required in a WLAN environment. For a detailed discussion about designing and implementing WLAN security (including 802.1x/EAP architecture), refer to www.cisco.com/warp/public/cc/so/cuso/epso/sqfr/safwl_wp.htm.
3.1 Relevant RFCs and Drafts
Table 3.1 lists other helpful reference documents.
Table 3.1 Relevant RFCs and Drafts Document Title RFC 2865
Remote Authentication Dial-In User Service (RADIUS)
Radius Extensions
Point-to-Point Protocol (PPP) EAP
PPP EAP-TLS Authentication Protocol
TLS Protocol
EAP-TLS uses concepts of PKI:
•A WLAN client (that is, a user's machine) requires a valid certificate to authenticate to the WLAN network
•The AAA server requires a "server" certificate to validate its identity to the clients
•The certificate-authority-server infrastructure issues certificates to the AAA server(s) and the clients
Sections 4 and 5 of this document discuss PKI and EAP-TLS authentication protocol in detail.
4 Introduction to PKI and EAP-TLS
EAP-TLS (RFC 2716) is using the TLS protocol (RFC 2246), which is the Internet Engineering Task Force's (IETF's) latest version of the Secure Socket Layer (SSL) protocol. TLS provides a way to use certificates for both user and server authentication and for dynamic session key generation.
EAP-TLS uses concepts of PKI. The following section introduces PKI and the concepts of certificates, certificate authorization, and validating user identity. A simple example of SSL usage that is familiar to most people will be examined briefly.
4.1 Overview of PKI
A Public Key Infrastructure (PKI) is a management system designed to administer asymmetrical cryptographic keys and public key certificates. It acts as a trusted component that guarantees the authenticity of the binding between a public key and security information, including identity, involved in securing a transaction with public key cryptography.
PKI protects information in several essential ways, described in Table 4-1.
Note: EAP-TLS uses the first attribute on this list, identity authentication, as we will see in a later example.
A certificate is a cryptographically signed structure, called the digital certificate, that guarantees the association between at least one identifier and a public key. It is valid for a limited period of time (called the validity period), for a specific usage, and under certain conditions and limitations described in a certificate policy. The authority that issues this certificate is called the certification authority.
A PKI should include at least five components, described in Table 4-2.
Figure 4-1 shows the PKI architectural model and the interactions between all entities.
Figure 4-1
PKI Architectural Model
The initialization process consists of setting the necessary configuration for a PKI entity to communicate with other PKI entities. For example, the initialization of an end entity involves providing it with the public key certificate of a trusted certification authority. The initialization of a certification authority involves the generation of its key pair.
During the registration process, an end entity makes itself known to a certification authority through a registration authority before that certification authority issues a certificate. The end entity provides its name and other attributes to be included in its public key certificate(s) and the certification authority (or the registration authority, or both) verifies the correctness of the provided information.
The key pair generation for an end entity may either take place in its own environment or is done by the certification authority (or registration authority). If the key pair is not generated by the end entity itself, then the generated private key must be distributed to the end entity in a secure way (for example, through a secure key distribution protocol, or by using a physical token such as a smart card).
The certification process takes place at the certification authority. After verifying the correctness of the end entity's name and attributes (and that the end entity possess the corresponding private key), the certification authority issues a certificate for the end entity's public key. That certificate is then returned to the end entity or posted in a repository where it is publicly available, or both.
Section 4.1.1 provides an example of PKI usage, and Section 4.1.2 discusses elements of trust in PKI.
4.1.1 The Amazon.com Example
Before sending a credit card number to buy a book at Amazon.com, a customer must verify that the Web site he or she entered is indeed Amazon.com. Also, a secured tunnel between the customer and Amazon must be established to send the credit card number safely. SSL provides this capability. In this case, the customer (using SSL) authenticates Amazon; but note that Amazon does not authenticate the customer. This is called server-side authentication (only the server is authenticated). With EAP-TLS, the RADIUS server authenticates the user, and the user authenticates the RADIUS server. This is called mutual authentication. EAP-TLS authentication will be examined in detail later.
There are two means to verify that Amazon is Amazon. If Amazon and the customer share a secret (a shared secret known only to the customer and to Amazon), the customer is then able to challenge Amazon and to verify that Amazon is holding the shared secret. The problem with this model is that it is impossible for everyone in the world to have a shared secret with everyone else. PKI was invented for this reason. PKI eliminates the need for a shared secret between you and Amazon. Digital certificates are used instead.
4.1.2 Elements of Trust in PKI
PKI authentication requires two elements of trust:
•Private-public key pair
•Certification authority
220.127.116.11 First Element of Trust: Private-Public Key Pair
Every certificate is associated with two keys: a private key and a public key. Only the owner of the certificate knows the private key, whereas the public key (hence its name) is known to everyone. With this key pair, asymmetric encryption is used. A message that was encrypted with the private key can be decrypted only with its corresponding public key and vice versa. Continuing with the example, Amazon encrypts the messages with its private key, and the customer decrypts them using Amazon's public key. In this way, the customer can be sure that any information he or she decrypted with the public key was encrypted using the corresponding private key. In the same way, if one wants to send an encrypted message to Amazon, the message is encrypted using Amazon's public key. Only the holder of the private key (Amazon.com) is able to decrypt the message. Using this method, a user can validate that Amazon is a legitimate key holder for a given digital certificate. However, trusting that someone is in possession of a digital certificate only provides a name/key-pair binding.
22.214.171.124 Second Element of Trust: Certification Authority
The second element of trust in PKI is the involvement of the certification authority server. Continuing our Amazon.com example, the customer also needs to verify that Amazon is really the entity he or she is communicating with. A third party is needed to validate the identity of Amazon. For this we have the signature of the authority (the certification-authority entity) that issued the certificate to Amazon.
If the customer trusts the certification authority that issued the certificate to Amazon, the user is able to check Amazon's certificate and validate that it is Amazon. The Web browser is configured with a list of trusted root certification authorities. This list is known as a certificate trust list (CTL). Any certificate in this list (that is, the certificate of a root certification authority) is automatically trusted by the client. Also note that a certificate of a trusted root certification authority is self-signed. This is like a passport seal on your passport. You trust the passport because you trust the preparation and identity checking that the passport office made when creating that passport. You trust digital certificates by installing the root certification authority signature for the same reasons.
The certificate is validated using the public-private key pairs of the certification authority. If you trust the certification authority, then you trust this certification authority's certificate. The certification authority's certificate includes the certification authority's public key. In the certificate issued by the certification authority to Amazon, a portion of the certificate is encrypted using the certification authority's private key. When the user receives Amazon's certificate (in the SSL handshake), the Web browser decrypts the encrypted part of the certificate using the certification authority's public key. For example, the certification authority might encrypt this message: "This certificate was issued to Amazon.com. It is valid from 1/1/1995 to 31/12/2015. The URL used by Amazon.com is `www.amazon.com'..." The encrypted portion of the message contains information about the certificate such as the name of the holder of the certificate, the period for which the certificate is valid, the URL of the holder of the certificate, and so on. Upon completion of the SSL handshake, a user knows he or she is communicating with Amazon.
A new session key is dynamically generated during the SSL handshake. This key is valid for this session only. At the end of SSL handshake, a secured encrypted tunnel is established to Amazon using the session key. (This encryption is symmetric, which is faster and less CPU-intensive than asymmetric encryption.)
4.2 EAP-TLS Model
This section discusses EAP-TLS authentication protocol in detail. EAP-TLS is based on SSL Version 3.0. In EAP-TLS, the SSL handshake is performed over EAP, whereas, on the Internet, the SSL handshake is conducted through Transmission Control Protocol (TCP). Thus, the difference between the SSL handshake in the Amazon example and in EAP-TLS is the transportation layer in which the SSL messages are exchanged.
Note: As with most technologies, EAP has its own terminology for common ideas. In EAP the end user's machine is known as the supplicant, the access point is known as the authenticator, and the RADIUS server is known as the authentication server.
As opposed to the one-way, or server-side, authentication discussed in the Amazon.com example, EAP-TLS performs mutual SSL authentication. This requires both the supplicant (the end user's machine) and the authentication server (the RADIUS server) to have a certificate. In mutual authentication, each side is required to prove its identity to the other using its certificate and its private key. The procedure is the same explained in the Amazon example, but for both sides.
4.2.1 How EAP with TLS Works
As previously mentioned, EAP-TLS authentication is based on 802.1x/EAP architecture. Components involved in the 802.1x/EAP authentication process are: supplicant (the end entity, or end user's machine), the authenticator (the access point), and the authentication server (back-end RADIUS server). The supplicant and the RADIUS server must support EAP-TLS authentication. The access point has to support the 802.1x/EAP authentication process. (The access point is not aware of the EAP authentication protocol type.)
Figure 4-2 illustrates the overall 802.1x/EAP authentication process with EAP-TLS as the authentication protocol. Note that LEAP and EAP MD5 also use the same 802.1x/EAP authentication process.
Figure 4-2
EAP-TLS Authentication Overview
Figure 4-3 illustrates the details of EAP-TLS exchange. The figure shows that, as part of the EAP request, the RADIUS server provides its certificate to the client and requests the client's certificate. The client validates the server certificate and responds with an EAP response message containing its certificate and also starts the negotiation for cryptographic specifications (cipher and compression algorithms). After the client's certificate is validated, the server responds with cryptographic specifications for the session.
Figure 4-3
EAP-TLS Authentication in Detail
4.2.2 Understanding the Trust Model in EAP-TLS
Before you configure EAP-TLS, you should understand the trust model you are going to implement.
220.127.116.11 Client Trusting Server
This part will help you understand the concept of the client side trust model. Section 6 of this guide provides specific configuration information.
In the client (for example, Microsoft Windows XP), you must configure one root certification authority. Using this root certification authority the client can validate the AAA server (for example, Cisco Secure ACS). For the XP client, no CTL exists. Specify one specific certification authority.
The certification authority you specify to trust can be public or private. If you decide to use a public root certification authority, it is important to understand that you have no control over it. An alternative is to use a private root certification authority for EAP-TLS deployment in your enterprise network. This allows you to build a PKI infrastructure based on a root certification authority sever and possibly several subcertification authority servers (as needed) to issue certificates to both the clients and the AAA servers. (A subcertification authority is a certification authority that is slaved to the root certification authority and unloads some of the burden of certificate processing.)
220.127.116.11 Server Trusting Client
This part will help you understand the concept of AAA server trust model. Specific configuration information is given in Section 6 of this document.
To support EAP-TLS, the AAA server (for example, Cisco Secure ACS) must have a certificate. Either a public certification authority or a private certification authority can be used to issue the AAA server certificate. The AAA server will trust a client certificate that was issued from the same root certification authority that issued its certificate.
If a server certificate was issued from a public certification authority, a client holding a certificate issued from the same root certification authority as the server is allowed in, provided that:
•The name in the certificate corresponds to the username
•The username was found in one of the databases that supports EAP-TLS.
For this reason, and to obtain the highest level of security, it is recommend that the certification authority issuing both clients' and server certificates be a private certification authority.
The AAA server (for example, the Cisco Secure ACS) usually contains a CTL. In the CTL, you can specify as many certification authorities as you intend to trust. Any client holding a certificate issued from a certification authority in the server CTL is allowed in, as long as the name in the certificate corresponds to the username and the username is found in one of the databases that supports EAP-TLS.
Note: In the ACS, by default, the CTL is empty. (In Microsoft Windows, for Web browser usage, the CTL contains the well-known public certification authorities by default.)
4.2.3 Session Key Derivation in EAP-TLS
Figure 4-4 illustrates how the session key is derived at the end of EAP-TLS authentication. As part of the TLS handshake between the server and the client, the client generates a pre-master secret and encrypts it with the server's public key and sends the pre-master secret to the server. Another option would be to use Diffie-Hellman exchange to derive the pre-master secret. The pre-master secret, server and client random values, and "master secret" string value are used to generate a master secret per session. The pseudo-random function (PRF) used to generate the master secret is defined in the TLS RFC (2246). EAP-TLS (RFC 2716) specifies how to derive the session key. The PRF is used again along with master secret, client and server random values, and "client EAP encryption" string value to generate the session keys, Message Authentication Code (MAC) keys and initialization values (for block ciphers only). Note that both the client and the RADIUS server independently derive the session keys. However, the length of the session key is determined by the authenticator (the access point) and is sent in the EAP-over-LAN key message at the end of the EAP authentication to the client (Figure 4-2).
Figure 4-4
Session Key Derivation in EAP-TLS Authentication
5 EAP-TLS Deployment in a WLAN Environment
This section details the system components that are required to roll out EAP-TLS in an enterprise network. Certificate requirements, both for the AAA server and the clients, are discussed in detail. Deployment issues, such as mixed EAP protocol deployment and AAA server scalability, are addressed in sections 5.3 and 5.4.
5.1 System Components
Table 5.1 lists the components that are required for accessing a wireless LAN network using EAP-TLS authentication:
Table 5-1 Components for Accessing a Wireless LAN Network Access point(s)
Cisco Wireless Access Point, operating system Version 11.06 or later, or equivalent device
AAA/RADIUS server
Cisco Secure ACS for Windows Version 3.0 or later, Cisco Access Registrar v3.0 or any other AAA/RADIUS server that supports EAP-TLS and supports Enhanced Key Usage (see Figure 5-1)
Client(s) (user machines)
Microsoft XP (other clients for non-XP operating systems may be available)1
Certification authority server
Microsoft certification authority server or any other certification authority server that supports Enhanced Key Usage (see Figure 5-1)
1 Note: Microsoft has announced EAP support for legacy operating systems in 2002 (Windows 2000, Windows NT® 4, Windows 98, Windows 98 Second Edition, and Windows ME). Also, there are third-party EAP supplicants that provide support for EAP-TLS on various operating systems (for example, Meetinghouse Data Communications EAP supplicant).
5.2 Certificate Requirements
This section discusses the certificate requirements on both the client and the AAA server sides.
5.2.1 Client Certificate Requirements
For a client (using Windows XP professional, for example) to authenticate using EAP-TLS, the client must obtain a personal client certificate. This certificate must meet several requirements:
Figure 5-1
Client Certificate and the Enhanced Key Usage Field
•The certificate has to be installed when the requested user is logged in to the machine. A personal certificate that will be installed when a different user is logged in will not be accessible by the requested user.
•The certificate has to be X.509 Version 3 (as shown in Figure 5-1).
•The certificate must have the Enhanced Key Usage (EKU) field. For the client certificate, the EKU field must contain the Client Authentication certificate purpose (OID "126.96.36.199.188.8.131.52.2" as shown in Figure 5-1).
•The subject name in the certificate must correspond to the user account name (either a username or the user ID of the account). This account name has to exist in one of the databases that support EAP-TLS. If, for example, the user account name is "TME USER5" (first name=TME, last name= USER5), the cn part of subject name in the certificate has to be "TME USER5" (as shown in Figure 5-2). Alternatively, as an example, if the account name is "eaptls1" (user ID is used instead of the username), the cn part of the subject name in the certificate has to be "eaptls1" (as shown in Figure 5-3). The @domainName.xxx part, if it exists, is not used in comparison.
Figure 5-2
Client Certificate: Subject/cn Field
Figure 5-3
Client Certificate 2: Subject/cn Field
•The client must have the corresponding private key. To verify that the private key exists, view the general section of the certificate and verify that you see the following message: "You have a private key that corresponds to this certificate" (Figure 5-4).
•When viewing the certificate, you have to verify that the following statement appears: "This certificate is intended to: Guarantee your identity to a remote computer" (Figure 5-4).
•When viewing the certificate you have to verify that the certificate date is valid. You can view the certificate "Valid from 12/3/2001 to 12/3/2003" (Figure 5-4).
Figure 5-4
Client Certificate: Date and Private Key Verification
5.2.2 AAA Server Certificate Requirements
For the server certificate installed on the AAA server several requirements must be met. (You should also read AAA server documentation before configuring the certificate.)
•The certificate must be X.509 Version 3 (Figure 5-5).
•The certificate must have the EKU field. For the server certificate, the Enhanced Key Usage must contain the Server Authentication certificate purpose (OID "22.214.171.124.188.8.131.52.1") (Figure 5-5).
•The AAA server must have the private key in order to use the certificate.
Figure 5-5
Server Authentication Certificate
5.3 Mixed EAP Protocol Deployments
The Cisco Aironet access point passes through any EAP authentication type presented to it by a client. It is up to the authentication server (RADIUS server) to accept or reject the authentication type and respond accordingly. In the situation of EAP-TLS, the AAA/RADIUS server must be able to reject the presented authentication type and respond with the desired type.
For example, Cisco Secure ACS supports fallback from LEAP to EAP-TLS. By default, ACS initially employs LEAP authentication when a client initiates EAP authentication (only if the access point is configured for Cisco Aironet as the RADIUS network-access-server type). If the client is a LEAP client, LEAP is used. If it is not a LEAP client, the client sends an EAP negative-acknowledgment (NAK) message with the desired EAP type. If this type is EAP-TLS and the ACS is configured to do EAP-TLS, the ACS starts EAP-TLS.
5.4 AAA Server Scalability
The AAA server's scalability plays a role in EAP-TLS deployment. The number of EAP-TLS clients along with EAP-TLS authentications per second (both worst case and average scenarios) must be considered when assessing the appropriate scalability and availability for the AAA servers.
As an example, though formal testing on ACS using EAP-TLS has not been performed, informal testing indicates a performance reduction, when compared with LEAP, because of the increased computation requirements of PKI over LEAP. A 20-30 percent reduction can be expected. With this in mind, LEAP has tested to perform 40-60 authentications per second. With the maximum expected performance reduction, you can reasonably expend .7 x 60, or 42, authentications per second using EAP-TLS.
You can calculate the load on ACS by applying this formula: (session length)/(number of connections). Using a value of 25 connections per access point and a 10-minute (600-second) session timeout to force WEP rekeying, you get 600/25 = 24 seconds/connection, which translates into 1 transaction every 24 seconds, or 1/24 (0.042) transactions per second. Table 5-1 below shows the transaction requirements for ACS based on the number of fully loaded access points being supported by a single ACS system.
From this table we can see that a single ACS could support about 1,000 access points with a rekey time of 10 minutes. As the rekey time is extended, the number of access points that a ACS can support increases. Conversely, any decrease in rekey time or increase in number of users per AP results in an increase of TPS and a lowering in the number of access points that a ACS can support.
Note that this does not take into account issues of network latency and loading, delays caused by external database usage, or network topographical issues.
Note: You can use Table 5-2 to determine the scalability of other RADIUS servers using EAP-TLS if you know the maximum number of transactions per second the RADIUS server can support when running EAP-TLS.
From a practical standpoint, the RADIUS server should be inside the general network, preferably within a secure subnet designated for servers, such as Dynamic Host Configuration Protocol (DHCP), Domain Name System (DNS), and so on. You should avoid requiring RADIUS requests to travel over WAN connections because of possible network delays and loss of connectivity. This is not always possible because of various reasons (that is, small, remote subnets requiring authentication support from the enterprise intranet). These issues are illustrated in Figure 5-6.
Figure 5-6
Network Topology
You must also consider backup authentication. You may use a system that is dedicated as the RADIUS secondary. Or you may have two synchronized systems that each support a different network segment but provide mutual backup if one fails. Refer to the documentation for the RADIUS server in use for database replication and the use of external databases.
6 Validation Lab
The authors built a Validation Lab to configure and test EAP-TLS deployment in an enterprise network scenario. Figure 6-1 illustrates the Validation Lab setup:
Figure 6-1
Validation Lab
The following sections discuss the Validation Lab setup and configuration in detail. Configuration information is provided for the Cisco Aironet access point, Cisco Secure ACS v3.0, and the Microsoft Windows XP Client. Note that several different RADIUS servers and certification authority servers could be used for EAP-TLS deployment, as noted in Section 5.1.
6.1 System Components
Following are descriptions and prerequisites for the Validation Lab components:
•Cisco Aironet access point—Minimum access point firmware of 11.06 for 802.1x Draft 10, recommended 11.10T or the latest version.
•Cisco Secure ACS v3.0—Cisco Secure ACS provides the AAA server functionality in a wireless/wired LAN network; Version 3.0 provides support for LEAP, EAP-TLS, and EAP MD5 authentication (802.1x) protocols.
•Microsoft XP Professional Client—Provides support for standards-based 802.1x authentication protocols such as EAP-TLS and EAP MD5.
•Microsoft 2000 Client—An Example LEAP client in an enterprise WLAN network.
•Microsoft certification authority server—Microsoft Windows 2000 Server running Microsoft Certification Authority Services; this is a private root certification authority server. Using a private root certification authority is preferred for enterprise PKI certificate distribution and management.
•Microsoft 2000 Server—Providing Active Directory Services for user management, DHCP, and DNS services (if preferred, DHCP and DNS services could run on individual servers).
6.2 ACS Configuration
This section discusses the steps required to configure the ACS v3.0 for EAP-TLS. (For information about generic ACS configuration details, refer also to ACS documentation.)
Configuring ACS for EAP-TLS requires three stages:
•Obtaining a ACS certificate
•Configuring ACS "System Configuration" parameters to enable EAP-TLS
•Configuring the appropriate network-access-server type for the access point in Network Configuration
6.2.1 Obtaining the Server-Side Certificate
As discussed in Section 4, the ACS server must obtain a server certificate from the enterprise root certification authority server to authenticate a WLAN EAP-TLS client. Obtaining a server certificate and installing it onto the ACS may be accomplished in one of these ways:
•Obtain a certificate file and private key file in any way you like and install it on the ACS (certificate file has to be base-64 encoded)
•Have a certificate in storage (local machine store) including private key and specify the name
In the Validation Lab, the second method was used. A Web browser on the ACS was used to obtain a server certificate from the private Microsoft root certification authority server. The obtained server certificate was installed onto the local machine store of the ACS.
Refer to Appendix A for instructions on how to configure the Microsoft certification authority server. Following is the procedure used to obtain a server certificate from a Microsoft certification authority server:
1. On the local ACS machine, point the browser at the Microsoft certification authority server as follows:
2. Log in as the Administrator.
3. Choose "Request a certificate" and click Next.
4. Choose "Advanced request" and click Next.
5. Choose "Submit a certificate request to this CA using form" and click Next.
6. Choose/specify the following options on the Advanced certificate request form:
a. Choose "Web Server" as the certificate template.
b. Specify the name for the certificate being issued to the ACS.
c. Specify 1024 bits as the key size.
d. Choose "Mark keys as exportable."
e. Choose "Use local machine store" and click Next.
7. Web browser should pop up with a message "Certificate Issued." Click "Install this certificate." This should result in successful installation of a server-side certificate (for EAP-TLS authentication) on the ACS.
Figure 6-2 illustrates steps 2 and 3 (from the above procedure) for obtaining a server certificate from a Microsoft certification authority server.
Figure 6-2
Steps 2 and 3 for Server Certificate Installation
Figure 6-3 illustrates steps 3 and 4 for obtaining the server certificate from a Microsoft certification authority server. As shown in the figure, an advanced request form is used to submit a certificate request to the certification authority server.
Figure 6-3
Steps 3 and 4 for Server Certificate Installation
Figure 6-4 illustrates the configuration required on the advanced certificate request form to obtain the server certificate. It is important to note the name given to the certificate; the name has to be specified when enabling EAP-TLS authentication on the ACS.
Figure 6-4
Step 5 for Server Certificate Installation
Figure 6-5 shows the steps required to install the server certificate onto the ACS local machine store.
Figure 6-5
Steps 6 and 7 for Server Certificate Installation
After you have completed these steps, a server certificate will be installed on the ACS's local machine store.
Server certificate verification:
The server certificate obtained should match the criteria specified in Section 5. Use the following procedure to verify the certificate issued to the ACS server:
1. On the Microsoft certification authority server, find the ACS server certificate under "Issued Certificates."
2. Double-click the ACS server certificate and ensure that all criteria specified in Section 5 are met.
6.2.2 System Configuration Parameters on ACS
After obtaining the ACS server certificate from the enterprise root certification authority server, the following steps were used to configure the ACS for EAP-TLS (and LEAP) authentication:
1. On the ACS menu, choose System Configuration >> ACS Certificate Setup.
2. Under ACS Certificate Setup, choose "Use existing certificate" and then the "Specify certificate from storage" option. Specify the name of the ACS certificate obtained from the certification authority server (in our example, "ACS-TMELAB" was specified in Section 6.2.1). Click Submit.
3. On the ACS menu, choose System Configuration >> "Certification Authority Setup." Click "Edit certificate trust list" and select the name(s) of the certification authority server(s) that were used to issue certificates to the ACS device(s) and EAP-TLS clients.
Note: The certificate trust list (CTL) has to be used when the root certification authority (ex: Root_CA_A) that issued the ACS certificate and the root certification authority that issued the client(s) certificate (Root_CA_B) are not the same. In this scenario, Root_CA_B has to be added to the ACS trust list. To do this, add the certificate of Root_CA_B to the ACS CTL. By default, ACS trusts certificates that were issued from the same root certification authority that issues its certificate. In our example (in the Validation Lab), we used the same root certification authority to obtain the ACS and client certificates; thus, the ACS will automatically trust the client certificates and you do not need to edit the CTL.
4. Choose the ACS menu and choose System Configuration >> Global Authentication Setup. Select the "Allow EAP-TLS ..." option and click the "Submit+Restart" button.
The following figures illustrate the above steps needed to configure the ACS for EAP-TLS:
Figure 6-6 shows the System Configuration menu options for EAP-TLS setup on the ACS.
Figure 6-6
ACS System Configuration Parameters
Figure 6-7 shows the required configuration for server certificate setup. As shown in the figure, the name of the certificate that was installed on the ACS local machine store (as discussed in Section 6.2.1) is specified under the option "Use certificate from storage."
Figure 6-7
Cisco Secure ACS System Configuration: ACS Certificate Setup Options
Figure 6-8 shows the global authentication setup under system administration. After enabling EAP-TLS authentication, click the "Submit+Restart" button for the changes to take effect.
Figure 6-8
Cisco Secure ACS Server System Configuration: Global Authentication Setup
6.2.3 Cisco Secure ACS Network-Access-Server Type Configuration
When adding the Cisco Aironet access point as a network access server to the ACS, several "Authenticate Using" options (that is, network-access-server types) are available. Choose "RADIUS (Cisco Aironet)" if the enterprise WLAN will have a mixed deployment of LEAP and EAP-TLS clients. However, if only EAP-TLS/EAP MD5 authentication is preferred, then choose "RADIUS (IETF)" option.
Figure 6-9 shows the access point configured to allow a mixed deployment of EAP-TLS and LEAP clients.
Figure 6-9
ACS >> Network Configuration >> AP>> "NAS type"
6.3 Cisco Aironet Access Point Configuration
As stated in sections 3 and 4, the access point can be configured to be a network access server for the 802.1x authentication process. The access point is capable of "understanding" and translating from 802.1x to RADIUS protocol (to communicate with the AAA server). However, the access point is not "aware" of the type of 802.1x authentication process taking place (that is, it does not know whether it is LEAP, EAP-TLS, or EAP MD5). This section details the required configuration on the access point to support the 802.1x authentication process.
The following procedure was used to configure the access points for 802.1x authentication in the Validation Lab:
1. Using the Web browser (as shown in Figure 6-10), verify that the access point version is 11.06 or later.
Figure 6-10
Cisco Aironet AP Firmware Version
2. Click Setup and then Security. On the Security Setup page, click Authentication Server link (as shown in Figure 6-11).
Figure 6-11
Security Setup Page
3. On the "Authentication Configuration" page (see Figure 6-12):
a. Choose "DRAFT 10" for 802.1x Protocol Version.
b. Configure the AAA server (ACS server) information as follows:
i. Enter the ACS IP address.
ii. Enter 1645 or 1812 (default) for port number.
iii. Enter the shared secret between the ACS and the access point (also configured in ACS).
iv. In "Use Server for," check EAP Authentication.
Figure 6-12
Authentication Configuration Page on the Cisco Aironet AP
4. Go back to the Security Setup page and click "Radio Data Encryption (WEP)" link (as shown in Figure 6-13).
Figure 6-13
Security Setup Page on the Cisco Aironet AP
5. On the AP Radio Data Encryption page (see Figure 6-14):
a. Choose "Full Encryption" as Use of Data encryption by Station.
b. For enabling EAP-TLS authentication (also enables EAP MD5):
i. Check Open in "Accept Authentication Type."
ii. Check "Require EAP" (only under open authentication).
c. For enabling LEAP authentication, select the "Network-EAP" option.
d. Set WEP Key 1 for Broadcast Key (in 11.10T and later releases, you can also enable broadcast key rotation).
e. Click Apply.
Figure 6-14
AP Radio Data Encryption Page
After the preceding steps have been completed, the access point is configured to allow only LEAP and EAP-TLS/MD5 clients to authenticate to the enterprise wireless LAN network.
6.4 Microsoft XP Client Configuration
The following procedure was used to configure a Windows XP client to authenticate to a WLAN network using EAP-TLS:
1. Obtain and install a client certificate; refer to Section 6.4.1.
2. Configure networking parameters on Microsoft XP Networking; refer to Section 6.4.2.
6.4.1 Obtaining the Client-Side Certificate
As discussed in Section 4, the client must obtain a certificate from a certification authority server for the ACS to authenticate a WLAN EAP-TLS client. Several ways of obtaining a client certificate and installing it onto the Windows XP machine are available. To acquire a valid certificate, the Windows XP user has to be logged in using his or her user ID and has to have a network connection (either a wired connection or a WLAN connection with 802.1x security disabled).
In the Validation Lab, a Web browser on the Windows XP client and a wired connection to the network were used to obtain a client certificate from the private root certification authority server. The following procedure was used to obtain the client certificate from a Microsoft certification authority server:
1. Using a Web browser on the client, point the browser to the certification authority server as follows: http://IP-address-of-Root-CA/certsrv.
2. Log in using "Domain_Name\user_name"; you must log in using the username of the individual who will be using the XP client. (The username gets embedded into the client certificate.)
3. On the "Welcome" screen, choose "Request a certificate" and click Next.
4. Choose "Advanced request" and click Next.
5. Choose "Submit a certificate request to this CA using a form" and click Next.
6. On the advanced certificate request form, choose the following (as shown in Figure 6-15):
a. Certificate Template as "Authenticated Session."
b. Specify Key Size to be 1024. Click Submit.
7. On the "Certificate Issued" screen, click "Install this certificate"; this should result in successful installation of a client certificate on the Windows XP client.
Figure 6-15
Step 6: Advanced Certificate Request for Obtaining a Client Certificate
Client certificate verification:
The client certificate should conform to the requirements specified in Section 5.2.1. The following procedure was used to verify the client certificate on the Windows XP machine:
1. Using Microsoft Internet Explorer, choose Tools >> Internet Options >> Content >> Certificates; a certificate with the name of the logged-in user ID/username should be present (as shown in Figure 6-16).
Figure 6-16
Microsoft Internet Explorer: Client Certificate Verification
2. Double-click the certificate and verify the following (as stated in Section 5.2.1):
a. Under the "General" section, verify the following (as shown in Figure 6-17): Purpose of the certificate is "Proves your identity to a remote computer." The "Issued to" field should contain the user ID or the username of the XP client, and a message should indicate, "You have a private key that corresponds to this certificate."
b. Under the "Details" section, verify the following (as shown in Figure 6-18): "Subject" field corresponds to the username or the user ID used to generate and install the certificate on the XP machine, and the "Enhanced Key Usage" field (as shown in Figure 6-19) should contain "Client Authentication code (184.108.40.206.126.96.36.199.2)". Refer to Section 5.2.1 for more details about the Enhanced Key Usage field.
c. Under the "Certification Path" section, verify the following statement: "This certificate is OK." Verify that the whole path of certificates until the root (the trusted root certification authority) has been installed (refer to Figure 6-20).
Figure 6-17
Client Certificate Verification: "General" Section
Figure 6-18
Client Certificate Verification: "Details" Section
Figure 6-19
Client Certificate Verification: "Details" Section, EKU Field
Figure 6-20
Client Certificate Verification: "Certification Path" Section
6.4.2 Microsoft Windows XP Wireless Networking Configuration
The Microsoft XP client wireless LAN networking should be configured to enable EAP-TLS authentication to the WLAN network. The following procedure was used to configure the XP machine:
1. In Microsoft XP >> Control Panel >> Network Connections configuration: Double-click the Wireless Network connection.
1. In "Authentication" section, configure the following options:
a. Select "Enable network access control using IEEE 802.1x" (see Figure 6-21).
b. Select EAP type as "Smart Card or other Certificate"; click Properties:
i. Select the "Use a certificate on this computer" option.
ii. Choose the "Validate server certificate" option and click "Trusted root certificate authority" and select the root certification authority server for the enterprise EAP-TLS clients and ACS device(s) (refer to figure 6-22).
iii. Click "OK."
2. In the "Wireless Networks" section, configure the following options:
a. Under Preferred networks, select the WLAN network (displayed using the Service Set Identifier [SSID] name of an access point) and click Properties (refer to figures 6-23 and 6-24).
i. Select the "Data Encryption (WEB enabled)" option.
ii. Select the "The key is provided for me automatically" option.
iii. Click "OK."
Figures 6-21 through 6-24 illustrate these three steps:
Figure 6-21
MS XP Client >> Network Connections >> Wireless LAN >> Authentication
Figure 6-22
EAP-Type (Smart Card or Other Certificate) Properties
Figure 6-23
Wireless Network Connection Properties
Figure 6-24
Wireless Networks Properties Configuration
At the end of above configuration steps, Microsoft XP clients should be able to authenticate to the enterprise WLAN using EAP-TLS.
6 Troubleshooting Tips for EAP-TLS
A modular troubleshooting approach is recommended for EAP-TLS. As discussed earlier in this document, three major components of EAP-TLS are EAP-TLS client, network access server (the access point), and the AAA server. Certification authority server infrastructure is also covered in this section.
Following are some troubleshooting tips for EAP-TLS:
1. Verify the configuration of the access point as described in Section 6.3.
2. Verify the configuration of Windows XP as described in Section 6.4. Ensure that EAP-TLS is configured for the user account. (Be aware that multiple user accounts and profiles could exist on a Windows XP client.)
3. If you see a message that indicates that Windows XP is failing to find a certificate to authenticate to the network, verify that you have installed a client certificate for the user account. The client certificate is invalid if the EKU field does not contain the "Client Authentication" OID (as described in sections 5.2.1 and 6.4.1).
4. Verify that the client certificate is formatted as X.509 Version 3.
5. Verify that the user account is the same name (username or user ID) as in the certificate.
6. Verify the configuration of the AAA server (ACS configuration is specified in Section 6.2). If the EAP-TLS clients and the AAA server(s) did not use the same root certification authority, then verify that the whole chain of certification authority servers' certificates have been installed on the AAA server. The same applies if the certificate was obtained from a subcertification authority.
7. Verify that the user account exists in the internal database of the AAA server or on one of the configured external databases.
8. Verify that the AAA server certificate contains EKU with the "Server Authentication" OID (as described in Section 5.2.2).
9. Verify that AAA server certificate complies with X.509 Version 3.
Figures 7-1 through 7-4 detail examples of invalid certificates:
Figure 7-1
Expired Certificate
Figure 7-2
Invalid Certificate: Not Intended for EAP-TLS Authentication
Figure 7-3
Invalid Certificate: Invalid Certification Authority
Figure 7-4
Invalid Certificate: Cannot Verify Root Certification Authority
8 Appendix A—Microsoft Windows 2000 Certificate Services Setup
This appendix provides the procedure used to configure the Microsoft Windows 2000 Server certification authority services in the Validation Lab. Please refer to Microsoft Windows 2000 Server documentation for further help.
Click Add/Remove Programs in the Control Panel and then choose the Add/Remove Windows Components option. Install and configure Certificate Services on the server:
•Select Enterprise Root CA when prompted for the certification authority type.
•Provide the certification authority identifying information.
•Select the default settings for the remaining setup options and allow the Certificate Services installation to complete.
•To set up certificate templates, begin by searching in Windows Help for "CA." From the listed topics, select "Certificate templates," and then under that topic, select the link titled "Establish the certificate types that an enterprise certification authority can issue." Follow the instructions for establishing the certificate type that can be issued, and when prompted select from the template list. Add all certificate templates in the list.
•The instructions for automatic certificate allocation can be found by searching for "auto enrollment" in Windows Help and selecting "Machine certificates for L2TP over IPSec VPN connections" from the list of displayed topics. This topic has a link titled "To configure automatic certificate allocation from an enterprise CA" that provides the necessary setup instructions. During the running of the Automatic Certificate Request Setup Wizard, select Computer or Domain Controller when prompted for a certificate template for certificates to be issued. After the setup wizard has completed the setup, create a computer certificate for the server by typing the following command at the Windows 2000 Server command prompt:
secedit /refreshpolicy machine_policy
8 Appendix B—Demo Certificates
Sample certificates are provided in the .zip file located at http://www.cisco.com/warp/public/cc/pd/sqsw/sq/tech/tcert.zip, to do EAP-TLS testing (without having to set up the certification authority server infrastructure):
•Three client certificates:
•One server certificate for the AAA server (Windows-based) and one corresponding private key file
–server.cer (certificate)
–server.pvk (private key file). Password is "acsi"
•One certification authority certificate that issued the AAA server and the client certificates
–ca.cer (certificate)
To use the client certificate:
1. Create a user account on the Microsoft XP client (with user-id eaptls1, eaptls2, or eaptls3).
2. Copy the appropriate client certificate to the XP machine and click it to install (private key is inside and does not require a password).
3. Follow instructions in Section 6.4 to complete the Microsoft XP client configuration.
To use the AAA server (Windows-based) and the certification authority certificates:
1. Copy the server certificate, private key file, and the certification authority certificate to the AAA server machine.
2. Install the server certificate and the private key.
3. Install the certification authority server certificate onto the AAA server.
4. Create user accounts for eaptls1, eaptls2, and eaptls3 on the internal AAA server database.
Instructions for installing the server and certification authority certificates onto ACS v3.0:
1. Server certificate installation: From the ACS main menu page, select System Configuration >> ACS certificate setup.
2. Certification authority server certificate installation: From the ACS main menu page select System Configuration >> Certification Authority Setup.
Figure 9-1
Step 1: Server Certificate Installation
After submitting, you should see the following (no need to restart ACS before you configure the certification authority and enable EAP-TLS):
Figure 9-2
Step 2: Certification Authority Server Certificate Installation
Details of the installed certification authority can be seen in the right side of the screen as shown in Figure 9-3 (you do not need to restart ACS before you enable EAP-TLS):
Figure 9-3
Certification Authority Detail Display
As the final step, enable EAP-TLS in the ACS "Global Authentication Setup" and submit and restart the ACS. (Refer to sections 6.2.2 and 6.2.3 for more Details.)

subset: commoncrawl


text:
Processing your request...
Forgot Password?
All You Need for 3D Printing, All in One Place Simple Solutions for 3D Innovation in Science Education
Encourage student innovation and problem-solving in your science lessons using cutting-edge 3D printing technology from Boreal Science.
We've hand-selected a wide range of 3D printers designed specifically for hands-on learning, making it easy to incorporate 3D printing technology on your classroom and prepare students for real-world science careers with real-world equipment.
Copyright © 2019 Boreal Science. All rights reserved.


text:
Toggle navigation
Creepy Cult Classics
Books Into Film
Garden Style
A New Way 2 Move
Outlaw In-Laws
The Quon Dynasty
Style In Steel
A Taste of History
Urban American Outdoors
Wednesday Westerns
Danger Zone
The Art of Living
Boomer Initiative
Fraud Squad
Good Food, Good Deeds
Grannies on Safari
Growing Bolder
Money Matters with Jean Chatzky
Second Act
Seeking Solutions
Stanley On the Go
Taking Care with Joan Lunden
To Not Fade Away
What's Next?
Who's Cooking with Florence Henderson
Whole Body Health
Where to Watch
Full Episodes
Marie Osmond
From Who's Cooking with Florence Henderson
Marie Osmond cooks her favorite cheesecake with Florence Henderson. Chef Govind Armstrong provides an alternative to Osmond's delightful dessert.
Full episodes from Bookmark
Jude Deveraux & Peter Spiers
Host Daryn Kagan talks with Jude Deveraux (Moonlight Masquerade and True Love). Peter Spiers gives long life tips. Jeffery Lyons compares the Water For Elephants and Love Story books and movies. Tricia Springer explores a romance writers' conference.
Michael Tucker & Lynn Sherr
Host Daryn Kagan talks with Michael Tucker (After Annie) and Lynn Sherr [Swim). Film critic Jeffery Lyons helps weigh book and movie versions of The Sessions and The Grapes of Wrath. Tricia Springer takes us inside a crime writers' conference.
Mary Higgins Clark & Jon Meacham
Host Daryn Kagan talks with Mary Higgins Clark (Daddy's Gone A Hunting) and Jon Meacham (Thomas Jefferson). Jeffery Lyons compares book and movie versions of Life of Pi and Bridge Over River Kwai. Tricia Springer finds out how book covers are chosen.
Nicole Krauss & Dr. Ruth Westheimer
Host Daryn Kagan talks with Nicole Krauss (The History of Love) and Dr. Ruth Westheimer on Alzheimer's. Film critic Jeffery Lyons weighs the original Anna Karenina & A Streetcar Named Desire vs the movies. Tricia Springer explains poetry slams.
James McBride & Kerry Hannon
Host Daryn Kagan talks with James McBride (The Color of Water, Song Yet Sung) and AARP job expert Kerry Hannon (Great Jobs). Film critic Jeffery Lyons compares the book and movie of Cloud Atlas and The Godfather. Tricia Springer traces family trees.
Full episodes from Fraud Squad
Counterfeit Sports Memorabilia
Counterfeit products are a hot topic presently, and in the world of sports memorabilia counterfeit products can make criminals rich; then a story about a couple who used their knowledge of the real estate business to steal people's homes.
ID Theft
Throughout the world ID Theft has become a common and major part of fraudulent crime. Whether it's forging documents or stealing people's personal information, this crime is not limited by borders and affects people of all walks of life.
Senior Fraud
Seniors are often preyed upon by fraudsters, what's even more shocking is that these crimes frequently come at the hands of someone they know and trust. Victims share how their retirement savings were plundered by their loved ones.
Illness & Disaster Frauds
Society's altruism can be easily affirmed through the donations given to charities in times of need. However, there are individuals out there who want to exploit these good-natured donations and re-direct them into their own pockets.
Affinity Fraud
Affinity frauds are perpetrated against people of particular social or ethnic groups. Learn how to protect yourself as victims share how they were taken by these criminals because they all shared a common belief or background.
Full episodes from Good Food, Good Deeds
Florence Henderson and nutritionist Joy Bauer cook up a healthy take on meatloaf, and Florence joins the Meals on Wheels volunteers making healthy meals and important deliveries.
Florence Henderson and nutrition expert Joy Bauer prepare a healthy Grilled Chicken Salad, and actress Linda Gray helps save the day at the Meals on Wheels kitchen in Richmond, VA.
Florence Henderson and nutrition expert Joy Bauer prepare a gourmet Chicken Vegetable Curry, and Mariette Hartley goes the extra mile while volunteering with Meals on Wheels in Kissimmee.
Full episodes from Healthline
Colorectal Cancer
Award-winning medical journalist, Dr. Kevin Soden hosts an in depth segment at colon and colorectal cancer; in order to receive lifesaving treatment for these forms of cancer, he stresses the importance of screening and early detection.
Healthline discusses the signs of depression and the methods of treating this disease.
Healthline examines Myositis and its subtle symptoms.
Licensed physician and host Dr. Kevin Soden takes the opportunity to review some innovative ways to stay on top of getting the latest health care information; make sure you're up-to-date with recent medical advances that might impact your health.
Full episodes from Money Matters with Jean Chatzky
Best of: Smart Spending
Effective financial habits that can help you thrive in retirement. How to "fly high" with great deals on traveling. In this episode, Jean has pulled together these tips and more from this season's highlights on how to be a smart spender.
Dream Investments
Do you dream of investing in a racehorse, art, antiques, even a winery? With the help of New York Times columnist Paul Sullivan, Jean Chatzky seeks to help you have some fun with your money -- without hurting your nestegg.
Full episodes from Second Act
Icing on the Cake
With the kids grown, a woman decides to follow her dream of opening a bakery. Watch as the Second Act team led by Paul DiMeo helps her launch a cupcake truck and work to sell 1000 cupcakes in her make or break moment.
The Show Must Go On
A woman makes a second stab at running a non-profit theater group. Paul DiMeo and his team try to help her raise the curtain - without losing all her money.
Serving Up Success
A couple gets a second chance at their dream of owning a restaurant, but this time around they have Paul DiMeo and a team of experts to help. Watch as they gear up for their grand opening - and work together to succeed in the challenging restaurant business.
Comic Relief
What happens when a government attorney decides to try his hand at stand-up comedy? Find out on this episode of Second Act, as a team of experts led by Paul DiMeo helps one man follow his comedy dreams.
Full episodes from Who's Cooking with Florence Henderson
Leeza Gibbons
Leeza Gibbons bakes her favorite chocolate crisis cake with Florence Henderson. Chef Govind Armstrong provides an alternative to Gibbons' tempting treat.
Virginia Madsen
Virginia Madsen makes her favorite egg rolls with Florence Henderson. Chef Govind Armstrong provides an alternative to Madsen's scrumptious snack.
Marie Osmond
Marie Osmond cooks her favorite cheesecake with Florence Henderson. Chef Govind Armstrong provides an alternative to Osmond's delightful dessert.
5525 Research Park Drive
Baltimore, MD 21228
About RLTV
Contact Us
Our Team
Our Founder
Advertise With Us
Privacy Policy
Terms and Conditions


text:
Senior Content Producer & Research Fellow
0131 455
Senior Research Fellow
0131 455
Esteves, A. & Oakley, I. (2011, January). Eco Planner: A Tabletop System for Scheduling Sustainable Routines. Presented at The 5th International Conference on Tangible, Embedded and Embodied Interaction, 2011., Madeira, Funchal, Portugal
This paper presents Eco Planner, a tangible system that aims to encourage users to behave more sustainably. It is based on a tabletop system showing a tabular view on which us...
Verweij, D., Khan, V., Esteves, A., & Bakker, S. (2017, June). Multi-user motion matching interaction for interactive television using Smartwatches. Poster presented at Adjunct Publication of the 2017 ACM International Conference on Interactive Experiences for TV and Online Video - TVX '17 Adjunct, Hilversum, The Netherlands
Motion matching input, following continuously moving targets by performing bodily movements, offers new interaction possibilities in multiple domains. Unlike optical motion ma...
Verweij, D., Esteves, A., Khan, V., & Bakker, S. (2017, May). WaveTrace: Motion Matching Input using Wrist-Worn Motion Sensors. Poster presented at Proceedings of the 2017 CHI Conference Extended Abstracts on Human Factors in Computing Systems - CHI EA '17, Denver, Colorado, USA
We present WaveTrace, a novel interaction technique based on selection by motion matching. In motion matching systems, targets move continuously in a singular and pre-defined ...
Arts & Humanities Research Council
Data Driven Innovation (DDI) is transforming society and the economy. DDI is defined as the challenge to make effective use of data to shape, develop and deliver innovative products and services to co...
Scottish Funding Council
Walks and Waterfalls is a multi-channel interactive project intended to design and roadmap a blended experience between a fine art photography book, a mobile augmented reality app and physical locatio...
The feeling of being immersed within a live performance by an ensemble of world class musicians can be a deeply engaging and highly valued cultural experience for audiences as well as for the performe...
22 November 2017
21 October 2017
The Dutch Design Week is one of the most prominent Design events internationally and the Mind the Step exhibition one of its highlights. It features design driven by technolog...
18 August 2017
04 April 2019
04 April 2019
CI Studios are new regular informal events open to anyone working in the creative industries to meet, share experiences, and explore using data and data-driven technologies.
12 December 2017
12 December 2017
Scottish Informatics and Computer Science Alliance (SICSA)
HCI; Theme All hands meeting
An opportunity to meet colleagues from across Scotland researching...
09 November 2017
09 November 2017
Sensorium Launch Event - User Experience (UX): Designing Future Interactions at Edinburgh Napier University
The Centre for Interaction Design in the School of Com...
Abreu Esteves, A., Quintal, F. & Oakley, I. (2014, February). TouchCloud: An Exploratory Study in Physically Tagging the Cloud. Poster presented at International Conference on Tangible, Embedded and Embodied Interaction, Munich, Germany
Smyth, M. (1999, January). Space, place and interface. Paper presented at Acradia Workshop
No abstract available.
Verweij, D., Abreu Esteves, A., Khan, V. & Bakker, S. WaveTrace Demo at the Dutch Design Week. Exhibited at Eindhoven, The Netherlands. 21 October 2017 - 29 October 2017. (Unpublished)
Every design has its own story, a story about ideas, exploring, decisions and adaptations. During Mind the Story, the lecture program that accompanies Mind the Step, the focus...
Alty, J., Knott, R., Anderson, B., & Smyth, M. (2000). A framework for engineering metaphor at the user interface. Interacting with Computers, 13(2), (301-322). ISSN 0953-5438
Interface metaphors facilitate the learning of new computer systems by supporting the transformation of existing knowledge in order to improve the comprehension of novel situa...
D. Benyon, & P. Palanque (Eds.), (1996). Critical Issues in User Interface Systems Engineering. https://doi.org/10.1007/978-1-4471-1001-9
This book developed from an IFIP workshop which brought together methods and architecture researchers in Human Computer Interaction and Software Engineering. To an extent this...
Benyon, D., & Murray, D. (1993). Adaptive systems: from intelligent tutoring to autonomous agents. Knowledge-Based Systems, 6(4), 197-219. https://doi.org/10.1016/0950-7051%2893%2990012-i
Computer systems which can automatically alter aspects of their functionality or interface to suit the needs of individuals or groups of users have appeared over the years in ...
Benyon, D. (1993). Adaptive systems: A solution to usability problems. User Modeling and User-Adapted Interaction, 3(1), 65-87. https://doi.org/10.1007/bf01099425
Improving the usability of computer systems is perhaps the most important goal of human-computer interaction research. Current approaches to usability engineering tend to focu...
Esteves, A., Quintal, F., Caires, F., Baptista, V., & Mendes, P. (2019). Wattom: Ambient Eco-feedback with Mid-air Input. In 2019 5th Experiment International Conference (exp.at'19)https://doi.org/10.1109/EXPAT.2019.8876565
This paper presents Wattom, a highly interactive ambient eco-feedback smart plug that aims to promote a more sustainable use of electricity in the home. This paper describes o...
Egan, C., Thompson, R., & O'Dowd, A. (in press). The Lions' Gate: Towards a Permaculture-inspired Blended Space. https://doi.org/10.1145/3338103.3338110
In light of the devastating ecological effects of climate breakdown and with human well-being under severe stress, this paper presents The Lions' Gate-an in-development, urban...
Smyth, M., & Helgason, I. (2019). DIY Community WiFi Networks: Insights on Participatory Design. In Extended Abstracts of the 2019 CHI Conference on Human Factors in Computing Systemshttps://doi.org/10.1145/3290607.3313073
This paper presents a first version of a set of insights developed collaboratively by researchers during a three-year participatory design project spread across four European ...
Mackamul, E. B., & Esteves, A. (2018). A Look at the Effects of Handheld and Projected Augmented-reality on a Collaborative Task. In SUI '18 Symposium on Spatial User Interactionhttps://doi.org/10.1145/3267782.3267793
This paper presents a comparative study between two popular AR systems during a collocated collaborative task. The goal of the study is to start a body of knowledge that descr...
Smyth, M., Helgason, I., Kresin, F., Balestrini, M., Unteidig, A. B., Lawson, S., …Dourish, P. (2018). Maker Movements, Do-It-Yourself Cultures and Participatory Design: Implications for HCI Research. In CHI EA '18 Extended Abstracts of the 2018 CHI Conference on Human Factors in Computing Systemsdoi:10.1145/3170427.3170604
Falling costs and the wider availability of computational components, platforms and ecosystems have enabled the expansion of maker movements and DIY cultures. This can be cons...
The perceived auditory environment is an increasingly important part of people's everyday interactive experiences. While sound design is an establish...
This research will investigate the nature of interactions between people and experience-oriented technologies such as new-media artw...
Augusto Esteves has been invited by the HCI group at the University of Bath to deliver a seminar on his work on motion matching input for the Internet-of-Things (IoT).
Abstract: Motion m...
22 November 2017
WaveTrace, a project that was internally funded, was awarded with an additional 5000€ from Design United, to prepare an exhibition at the acclaimed Dutch Design Week. This work was done in collaborati...
20 October 2017
The Royal Society for the Encouragement of Arts, Manufactures and Commerce (RSA) is a London-based, British organisation committed to finding practical solutions to social challenges. Founded in 1754 ...
17 August 2017
Work titled "Tailoring Methodological Bricolage to Investigate Non-Discretionary use of digital technology" by Emilia Sobolewska awarded Best Paper at British HCI 2017 Conference
4 July 2017
SICSA DEMOfest is the annual technology showcase of leading Informatics and Computer Science research from Scottish Universities and it creates an environment for industry partners and academics to co...
11 November 2016
Augusto joined 53,056 tech CEOs, founders, startups, investors and political leaders driving change across the world in Lisbon for the Web Summit. Over 2,000 of the world's leading media attended. Tog...
7 November 2016
Glassroom, Edinburgh Napier University, Merchiston Campus
10 Colinton Road
3 April 2019
The Glass Room
Merchiston Campus
Edinburgh Napier University
Edinburgh EH10 5DT
12 December 2017
Edinburgh Napier University, Merchiston Campus
10 Colinton Road
9 November 2017
Core44, room C44, Merchiston campus
27 June 2017
Core44, room c44, Merchiston campus
11 January 2017
Merchiston, Glass room
7 July 2016
C19, Merchiston, Edinburgh Napier University.
16 June 2016 - 22 June 2016
We use cookies to give you the best possible experience. If you continue, we'll assume you are happy to receive all cookies. See our cookie policy for more information.


text:
Game Wizard
Thank you for your interest in helping out. In order to add a game to the database, you must first log on to MobyGames. If you don't have an account, now would be a perfect time to create one.
Join our Discord to chat with fellow friendly gamers and our knowledgeable contributors!


text:
What? I agree with Ed Quillen's column?
Well, like they say "there is a first time for everything". Having read Ed Quillen's column over the years for my weekly "laughter is the best medicine" dose, and NEVER agreeing with anything he has ever said, his "Troubles in Paradise" column was spot-on!! It brought back memories of learning to ski at Breckenridge when lift ticket's were $7, and the grand opening of Lionshead
at Vail in 1969, and oh how the times have changed. Moving the Vail corporate offices to Broomfield? I bet Pete Seibert is rolling over in his grave. Yes, Ski Country U.S.A. had better rethink their agenda and priorities if they plan a sustainable future.
Kirk Conn, Loveland


text:
| February 25, 2015, 9:19 am
Sitting was the hardest part.
But Will Barton did what he had to do in Portland, where in two-and-a-half seasons he just never found himself in the plan for the talented Blazers.
What he didn't do, however, is sulk.
Sure, he had many moments of doubt, where it was necessary for those close to him to pick him up with words of encouragement. He detailed those in an interview with The Denver Post.


text:
Top 20 Most Influential Developers
Just prior to coming back to MMORPG.com, I worked with Massive Online Gamer magazine on the Top 20 Most Influential Developers in MMOs. The mag has finally released the list - you'll have to buy the magazine to get my detailed reasons why! - but I have to say, it's quite the process.
Last year, like everyone else, I played armchair quarterback and critiqued the work Bruce Woodcock and MOG Editor Doug Kale did putting it together. A year later, I was lucky enough to write the list with Doug and I must say, I'll never dimiss any ranking of this nature again.
It's a shockingly difficult thing to do. The list considers the most influential of 2008's calendar year, which is important to keep in mind when reading it, and the word "influential" has to be remembered too. We considered people who had a big influence, good or bad, in 2008.
That all said, it was a really fun exercise and an honor to write it. I do hope a few of you go out and pick up the issue to check out the full article, but for those who'd rather just see the list, it has begun to circulate online.
The full list is over at Massive Online Gamer, so check it out and let me know what you think!


text:
Sign In
or Join Now!
Exotic wood and miters
by DarthDonald
posted 11-04-2018 12:21 AM
Go to Pulse page »
©2020 Verticalscope Inc. All Rights Reserved. |
Terms of Service
| Copyright
| Privacy Policy
DISCLAIMER: Any posts on LJ are posted by individuals acting in their own right and do not necessarily reflect the views of LJ. LJ will not be held liable for the actions of any user.
Latest Projects |
Latest Blog Entries |
Latest Forum Topics


text:
Learn More
Zyagen Labs Rat mammary, E15 RNA is a high pure intact total RNA isolated from freshly harvested normal healthy Sprague Dawley RAT MAMMARY, E15 tissues, treated with DNase and dissolved in water. RNA is ready for immediate use in any downstream application.
Manufacturer: Zyagen Labs RR41415
Zyagen Total RNA is routinely extracted from freshly harvested normal healthy tissues of single donor using classical guanidine isothiocyanate–phenol:chloroform extraction method which allows the rapid isolation of total RNA including microRNAs. RNA is treated with RNase-free DNase to remove residual DNA, precisely quantified, and stored at -80oC. The integrity of each RNA sample as indicated by intact ribosomal RNA is verified by denatured agarose gel electrophoresis. The purity of RNA is assessed by NanoDrop (A260/A280: 1.9-2.1). Residual DNA contamination is tested by PCR. RNA is ideal for Northern blotting, ribonuclease protection assay, SI nuclease assay, RT-PCR/Q-PCR/RACE analysis, cDNA synthesis, RNA differential display, microRNA studies, and purification of mRNA for library construction. Total RNA sample is provided in RNase-free water at a concentration of 1 mg/ml and shipped on dry ice.
The Fisher Scientific Encompass Program offers items which are not part of our distribution portfolio. These products typically do not have pictures or detailed descriptions. However, we are committed to improving your shopping experience. Please use the form below to provide feedback related to the content on this product.
Your feedback has been submitted. Fisher Scientific is always working to improve our content for you. We appreciate your feedback.Ok


text:
TSS Schedule 599 Solicitations & Publications
Travel Services Solutions (TSS) Schedule 599 provides a vehicle for all government agencies to obtain quality travel services when required from qualified and experienced contractors under a GSA Multiple Award Schedule and in an efficient, streamlined, and cost-effective manner, in accordance with applicable statutes and regulations.
Schedule 599 covers:
Travel consulting services;
Travel agent/travel management center (TMC) services;
Lodging negotiation and management services;
Air charter services (owner operated or brokers);
Specialized conference facilities; and
New travel related products and services.
For more specifics regarding the TSS schedule, select the FedBizOpps link and search for solicitation number QMAD-CY-090001-B.
The TSS Schedule provides a variety of high-quality commercial travel services to support the government's travel needs. View the publication below for more detailed information on making travel easier, faster, and less expensive
.Travel Services Solutions, Schedule 599 [PDF - 550 KB] Publish date: 4/1/2005
For more information or assistance with the offerings under Schedule 599, Travel Services Solutions, call 888-472-5585 or email at email@example.com.


text:
Jason Dufner speaks to Auburn football team
Certainly Heisman Trophy winners Cam Newton and Bo Jackson carry a lot of weight when it comes to Auburn football. But not even the two former Tiger greats could pull Auburn out of one of its worst seasons in team history last season.
Enter PGA Championship winner Jason Dufner.
The 2000 Auburn graduate stopped by the athletic complex—with his Wanamaker Trophy—Thursday and spoke to Gus Malzahn's team about mental toughness. Dufner arrived at Auburn as a walk-on to the golf team and now owns three PGA Tour wins after outlasting Jim Furyk last weekend at the Oak Hill Country Club in Rochester, N.Y.
MORE: Instant celebrity | Howard Stern appearance | Malzahn's QB impact
His accomplishments were not lost on some of the Auburn players.
Punter Steven Clark gave Dufner his due while cutting himself down at the same time.
Steven Clark on Jason Dufner: "I have so much respect for him. I've been playing golf longer than I've been punting, and I suck at it."— Ryan Wood (@AUBlog) August 15, 2013
Clark: "If I can ever win the PGA Championship of punting, it would be the happiest day of my life too."— Ryan Wood (@AUBlog) August 15, 2013
Jason Dufner and I with his PGA Major Trophy #WarEagle http://t.co/RhcvI0Y81z— Cody Parkey (@CParkey36) August 15, 2013
Parkey on Jason Dufner's visit: "He told us his story, kind of how he was a walk-on. He's an incredible golfer, a true #Auburn man."— Ryan Wood (@AUBlog) August 15, 2013
Malzahn: "What he did this last weekend was really unbelievable. ... We're definitely big fans of Jason Dufner."— Ryan Wood (@AUBlog) August 15, 2013
The PGA champion @JasonDufner came to speak to us...War Eagle Sir Dufner! #AU #WDE— Mookie Harding (@2Duece2Duece) August 15, 2013


text:
In its "usual" usage in politics, it refers to the (forced) union of Germany and Austria in 1938.
And a literal translation of the word might be "closing."
Can the term be used to refer to a "merger of equals," e.g. of Poland and Lithuania around 1550? Or does it have the connotations of an "unequal" match, with one party swallowing up the other?


text:
Jeremy Glaser: For Morningstar, I am Jeremy Glaser.
"Apple" and "disappointing" are not two words we've seen in the same sentence together very often, but this quarter came in a little bit light. I am here with our analyst Michael Holt to take a look and get his take.
Mike, thanks for joining me.
Michael Holt: Thanks for having me.
Glaser: So, let's take a look at this quarter. Did it meet your expectations? What surprised you?
Holt: I think it definitely was a little lighter than we were expecting, specifically on the iPhone unit shipments, but you've got to take this with a grain of salt, because expectations got ahead of themselves with this quarter. We know that this is the third quarter since the iPhone has been released. We know that we are expecting a pullback. We just didn't know the exact magnitude. And we expect more of the same next quarter. It's going to be another wait-and-see quarter before we get another product launch that will drive things forward.
Glaser: So Apple may have failed to meet those lofty expectations, and certainly as you mentioned, the phone was the core of that. What's happened with the iPhone? How important is that to Apple right now?
Holt: The iPhone is still the most important device for Apple. Even in this quarter, we were light on iPhone units, but we actually exceeded my expectations on iPad units, but because of the gross margin differences between those devices--the iPad is a lower gross margin [product] than the iPhone--that's not enough to turn things around on the bottom line.
Glaser: So even with being in a couple of different categories, they can't make up that difference. When would you expect iPhone sales to take off again? Will the iPhone 5 really help reignite, or is this the start of a long decline as Android takes a bigger share?
Holt: We don't think this is a secular decline. This is really just the calm before the storm when the iPhone 5 will come out, but we're still one more quarter away from that. So, there is some time we have to wait.
And I think one of the important things to realize is consumers ... in general are just becoming more attuned to the product-release cycles. Many more people are aware that there is a phone coming out in the back half of this year then there would have been last year at this time.
Glaser: So is this lull giving an opportunity for some of those competitors--Nokia is obviously pushing Windows phone pretty heavily and with a lot of new Android devices--for people to maybe look across that fence and to think about switching? Does that pose a competitive threat?
Holt: I think the competitors, Samsung, HTC, even Nokia, they're starting to put out much more compelling devices, and when they have releases in the last couple of months and the iPhone hasn't been refreshed in nine months, then you start to see that it's looking a little bit more stale than it has in the past. So, it's a much bigger opportunity for [rivals] to come in and convert people who are going into the smartphone world for the first time into their ecosystems.
Glaser: Now, looking at the Mac business, obviously, it's not as big a part of the company as it was, but they did refresh the notebook line. Has that had any impact yet or would you expect that to have any impact on the long-term earnings of the company?
Holt: It is too early to see it, and you actually didn't see great year-over-year growth, but that really is tied to exactly what you were just referring to. Last year, they refreshed it in February. This year they refreshed it just last month. So, we're not going to see the impact of that new Mac product line until the next quarter.
Glaser: How about profitability? Anything surprising there?
Holt: Earnings per share were down, but more importantly, the gross margin was down a little bit more than we were expecting. This is due to two things: It's the iPhone and iPad both having different product mix shifts. So, it's the mix shift with iPads growing faster than iPhones and then it's also within those segments, the lower-price devices. So, more specifically, the iPad 2 at $399, that's been actually a pretty strong seller. It is not the best seller, but you're seeing a shift towards that lower price point, and that affects the gross profit.
Glaser: So, if this quarter was a little bit bumpy, it looks like next quarter is going to be more of the same?
Holt: Definitely. We think that until you get the next product release, you're in for more moderate results from Apple, but that doesn't change our long-term perspective on the Apple story and the stock.
So, we really see, if there is a pullback in this quarter or next quarter, that could be an opportunity for investors. Our long-term outlook is based on the fact that they are pulling new customers into their platform and they are locking them in with the content and services that they are providing. And that outlook is the same.
Glaser: Mike, thanks for your take today.
Holt: Thanks.
Glaser: For Morningstar, I'm Jeremy Glaser.