UMR wifi (802.1X) with linux laptop

hygnos · **Posted:** Tue 08-15-2006 11:03AM

Hi,

Has anybody had any luck in setting up a wireless connection to the campus wireless connection on linux??

I have tried wpa_supplicant and xsupplicant. Both of them should be able to do the job... But for some reason I can not seem to get it to work.

I have registred my ethernet card!!

/hygnos

creepy · **Posted:** Tue 08-15-2006 12:10PM

First, Last year you could still use WEP to connect to the network and I know that is a lot easier to get to work if you want to try that. If not, what linux distro are you using, and what have you gotten to work so far?

FuzzyLogic · **Posted:** Tue 08-15-2006 12:20PM

Have you gotten your WEP key? If not go to the bottom of the page here and make sure you did everything else.

bsiever · **Posted:** Tue 08-15-2006 12:44PM

You might want to take a look at wpa_supplicant - it seems to work for me.

hygnos · **Posted:** Tue 08-15-2006 1:15PM

hey,

thanks for the prompt reponses!!

I am running a gentoo linux 2.6.15 box.

well about the static WEP connection. I have acually tried that... But it did not seem to connect, so I guessed that the service had been shut down. But apparently not??! I have only tried from the Havener Center. Do you know if the AP's broadcast their ssid?

In fact I am not quite sure how much that is really working. However, I can connect to WEP (usually ;-)

), WPA-PSK and unencrypted networks. I have posted the outputs, when I from the command line try to connect via wpa_supplicant or xsupplicant. You can also see the relevant parts of my wpa_supplicant.conf and xsupplicant.conf

bsiever, can you post your wpa_supplicant.conf?? Don't you need a server certificate in order for PEAP outer athentication to work? And how do you get such an certificate. In MS it fetched it automatically...

Code:

wpa_supplicant.conf (relevant sections)

eapol_version=1
ap_scan=1
fast_reauth=1

network={
   ssid="ssid"
   scan_ssid=1
   key_mgmt=IEEE8021X WPA-EAP
   eap=PEAP
   identity="xxxxx"
   password="xxxxxxx"
   priority=1
   phase1="peaplabel=1"
   phase2="auth=MSCHAPV2" 

Code:

xsupplicant (relevant parts)

ssid
{
  type = wireless

  allow_types = all

  identity = xxxxx
 
  wpa_pairwise_cipher = WEP104 #WEP40 WEP104 TKIP WRAP
  wpa_group_cipher = WEP104 #WEP40 WEP104 TKIP

  eap-peap {
      identity = xxxxx
      chunk_size = 1398
      #random_file = /path/to/random/source     
      cncheck = radius.server.address

      cnexact = yes                         
      session_resume = yes

      proper_peap_v1_keying = yes     

      allow_types = all # where all = MSCHAPv2, MD5, OTP, GTC, SIM

      eap-mschapv2 {
        username = xxxxx   
        password = xxxxxx
      }
  }
 
  eap-mschapv2 {
      username = xxxx 
      password = xxxxxx
  }
     
} 

If I start wpa_supplicant from the command line I will get this output

Code:

thygeT40 linux # wpa_supplicant -i eth1 -c /etc/wpa_supplicant.conf -D wext -dd
Initializing interface 'eth1' conf '/etc/wpa_supplicant.conf' driver 'wext' ctrl_interface 'N/A' bridge 'N/A'
Configuration file '/etc/wpa_supplicant.conf' -> '/etc/wpa_supplicant.conf'
Reading configuration file '/etc/wpa_supplicant.conf'
ctrl_interface='/var/run/wpa_supplicant'
ctrl_interface_group=10 (from group name 'wheel')
eapol_version=2
ap_scan=0
fast_reauth=1
Line: 71 - start of a new network block
disabled=1 (0x1)
ssid - hexdump_ascii(len=5):
     xxxx                                    xxxx
key_mgmt: 0x2
pairwise: 0x8
group: 0x18
PSK - hexdump(len=32): [REMOVED]
priority=4 (0x4)
Line 81: removed CCMP from group cipher list since it was not allowed for pairwise cipher
Line: 84 - start of a new network block
disabled=1 (0x1)
ssid - hexdump_ascii(len=8):
     xxxx                                    xxxx
proto: 0x1
key_mgmt: 0x2
pairwise: 0x8
PSK (ASCII passphrase) - hexdump_ascii(len=14): [REMOVED]
priority=6 (0x6)
PSK (from passphrase) - hexdump(len=32): [REMOVED]
Line 93: removed CCMP from group cipher list since it was not allowed for pairwise cipher
Line: 97 - start of a new network block
disabled=1 (0x1)
ssid - hexdump_ascii(len=7):
     xxxx                                      xxxx
scan_ssid=1 (0x1)
key_mgmt: 0x4
wep_key0 - hexdump(len=13): [REMOVED]
wep_tx_keyidx=0 (0x0)
auth_alg: 0x1
priority=8 (0x8)
Line: 110 - start of a new network block
disabled=1 (0x1)
ssid - hexdump_ascii(len=12):
     xxxx                                      xxxx
key_mgmt: 0x4
priority=5 (0x5)
Line: 120 - start of a new network block
disabled=1 (0x1)
ssid - hexdump_ascii(len=5):
     xxxx                                       xxxx
scan_ssid=1 (0x1)
key_mgmt: 0x4
wep_key0 - hexdump(len=5): [REMOVED]
auth_alg: 0x1
priority=10 (0xa)
Line: 131 - start of a new network block
ssid - hexdump_ascii(len=3):
     xxxx                                         xxxx
scan_ssid=0 (0x0)
key_mgmt: 0x8
eap methods - hexdump(len=16): xxxxxxx
identity - hexdump_ascii(len=5):
     xxxx                                         xxxx
password - hexdump_ascii(len=10): [REMOVED]
phase1 - hexdump_ascii(len=11):
     70 65 61 70 6c 61 62 65 6c 3d 30                  peaplabel=0
phase2 - hexdump_ascii(len=13):
     61 75 74 68 3d 4d 53 43 48 41 50 56 32            auth=MSCHAPV2
priority=1 (0x1)
Line: 154 - start of a new network block
ssid - hexdump_ascii(len=9):
     xxxx                                          xxxx
key_mgmt: 0x4
priority=3 (0x3)
Line: 159 - start of a new network block
ssid - hexdump_ascii(len=10):
     xxxx                                          xxxx
scan_ssid=0 (0x0)
key_mgmt: 0x4
group: 0x1e
wep_key0 - hexdump(len=10): [REMOVED]
auth_alg: 0x1
priority=2 (0x2)
Priority group 10
   id=4 ssid='xxxx'
Priority group 8
   id=2 ssid='xxxx'
Priority group 6
   id=1 ssid='xxxx'
Priority group 5
   id=3 ssid='xxxx'
Priority group 4
   id=0 ssid='xxxx'
Priority group 3
   id=6 ssid='xxxx'
Priority group 2
   id=7 ssid='xxxx'
Priority group 1
   id=5 ssid='xxxx'
Initializing interface (2) 'eth1'
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: KEY_RX entering state NO_KEY_RECEIVE
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
SIOCGIWRANGE: WE(compiled)=19 WE(source)=18 enc_capa=0xf
  capabilities: key_mgmt 0xf enc 0xf
WEXT: Operstate: linkmode=1, operstate=5
Own MAC address: 00:04:23:8d:a4:78
wpa_driver_wext_set_wpa
wpa_driver_wext_set_key: alg=0 key_idx=0 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=1 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=2 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=3 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_countermeasures
wpa_driver_wext_set_drop_unencrypted
Setting scan request: 0 sec 100000 usec
Added interface eth1
Wireless event: cmd=0x8b06 len=8
RTM_NEWLINK, IFLA_IFNAME: Interface 'eth1' added
RTM_NEWLINK, IFLA_IFNAME: Interface 'eth1' added
EAPOL: External notification - portControl=Auto
Already associated with a configured network - generating associated event
Association info event
State: DISCONNECTED -> ASSOCIATED
WEXT: Operstate: linkmode=-1, operstate=5
Associated with 00:00:00:00:00:00
WPA: Association event - clear replay counter
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
EAPOL: External notification - portEnabled=1
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: SUPP_BE entering state IDLE
Setting authentication timeout: 10 sec 0 usec
EAPOL: startWhen --> 0
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: txStart
BSSID not set when trying to send an EAPOL frame
Using the source address of the last received EAPOL frame 00:00:00:00:00:00 as the EAPOL destination
TX EAPOL - hexdump(len=4): 02 01 00 00
Authentication with 00:00:00:00:00:00 timed out.
Added BSSID 00:00:00:00:00:00 into blacklist
State: ASSOCIATED -> DISCONNECTED
WEXT: Operstate: linkmode=-1, operstate=5
No keys have been configured - skip key clearing
EAPOL: External notification - portEnabled=0
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: SUPP_BE entering state INITIALIZE
EAPOL: External notification - portValid=0
Setting scan request: 0 sec 0 usec
EAPOL: External notification - portControl=Auto
Already associated with a configured network - generating associated event
Association info event
State: DISCONNECTED -> ASSOCIATED
WEXT: Operstate: linkmode=-1, operstate=5
Associated with 00:00:00:00:00:00
WPA: Association event - clear replay counter
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
EAPOL: External notification - portEnabled=1
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: SUPP_BE entering state IDLE
Setting authentication timeout: 10 sec 0 usec
EAPOL: startWhen --> 0
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: txStart
BSSID not set when trying to send an EAPOL frame
Using the source address of the last received EAPOL frame 00:00:00:00:00:00 as the EAPOL destination
TX EAPOL - hexdump(len=4): 02 01 00 00
Authentication with 00:00:00:00:00:00 timed out.
BSSID 00:00:00:00:00:00 blacklist count incremented to 2
State: ASSOCIATED -> DISCONNECTED
WEXT: Operstate: linkmode=-1, operstate=5
No keys have been configured - skip key clearing
EAPOL: External notification - portEnabled=0
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: SUPP_BE entering state INITIALIZE
EAPOL: External notification - portValid=0
Setting scan request: 0 sec 0 usec
EAPOL: External notification - portControl=Auto

And it just continues...

If I try using xsupplicant from the command line it will give me the following output

Code:

thygeT40 linux # xsupplicant -i eth1 -d 9 -Dwext -c /etc/xsupplicant.conf -f
[STATE] Reinit state machine
[STATE] [backend_sm] REQUEST -> INITIALIZE
[STATE] [backend_sm] INITIALIZE -> IDLE
[STATE] [backend_sm] UNKNOWN -> INITIALIZE
[STATE] [backend_sm] INITIALIZE -> IDLE
[INT] Initializing socket for interface eth1..
[INT] Allmulti mode is already enabled on this device!
[INT] Interface eth1 is wireless!
[INT] Interface initialized!
[CONFIG] Working from config file /etc/xsupplicant.conf.
No configuration information for network "(null)" found.  Using default.
[INT] Opened socket descriptor #5
[INT] Interface eth1 is wireless!
Your card is currently set for wireless network "XXXX".  Looking for a config.
[CONFIG] Working from config file /etc/xsupplicant.conf.
Couldn't build a config for ESSD XXXX!
[STATE] Init wireless state machine.
UNASSOCIATED -> ACTIVE_SCAN
[STATE] Reinit state machine
[STATE] [backend_sm] IDLE -> INITIALIZE
[STATE] [backend_sm] INITIALIZE -> IDLE
Scanning for wireless networks ...
[INT] Issuing scan request for interface eth1!
[INT] Called cardif_clear_keys!
cardif_linux_wext_delete_key : Not supported by WE(17)!
cardif_linux_wext_delete_key : Not supported by WE(17)!
cardif_linux_wext_delete_key : Not supported by WE(17)!
cardif_linux_wext_delete_key : Not supported by WE(17)!
cardif_linux_wext_delete_key : Not supported by WE(17)!
[INT] Checking for returned SSID information....
[INT] Reaping data. (Size : 206)
14 00 15 8B 01 00 00 12 - 00 CD 09 40 D0 00 00 00 ...........@....
04 00 00 00 11 00 1B 8B - 09 00 01 00 3C 68 69 64 ............<hid
64 65 6E 3E 00 14 00 01 - 8B 49 45 45 45 20 38 30 den>.....IEEE.80
32 2E 31 31 62 67 00 00 - 00 08 00 07 8B 03 00 00 2.11bg..........
00 0C 00 05 8B 01 00 00 - 00 00 00 00 32 08 00 2B ............2..+
8B 00 00 00 08 54 00 21 - 8B 40 42 0F 00 00 00 00 .....T.!.@B.....
08 80 84 1E 00 00 00 00 - 08 60 EC 53 00 00 00 00 .........`.S....
08 C0 D8 A7 00 00 00 00 - 08 00 1B B7 00 00 00 00 ................
08 80 A8 12 01 00 00 00 - 08 00 36 6E 01 00 00 00 ..........6n....
08 00 51 25 02 00 00 00 - 08 00 6C DC 02 00 00 00 ..Q%......l.....
08 80 F9 37 03 00 00 00 - 08 08 00 01 8C 23 00 00 ...7.........#..
67 1D 00 02 8C 15 00 00 - 00 20 4C 61 73 74 20 62 g.........Last.b
    eacon:.4ms.ago
[INT] AP MAC : 00 12 00 CD 09 40
[CONFIG] Found new ESSID block, adding...
[INT] ESSID : <hidden>
[INT] IWEVCUSTOM :  Last beacon: 4ms ago
[INT] No valid network data!! (wireless_sm_check_globals)
[ALL]


Dumpping SSIDs:

[ALL] ESSID : <hidden>
[ALL] Abilities : 02
[CONFIG] Checking <hidden> with Priority 255
Scanning for wireless networks ...
[INT] Issuing scan request for interface eth1!
[INT] Checking for returned SSID information....
[INT] Reaping data. (Size : 0)

[INT] No valid network data!! (wireless_sm_check_globals)
[ALL]


Dumpping SSIDs:

Scanning for wireless networks ...
[INT] Issuing scan request for interface eth1!
[INT] Checking for returned SSID information....
[INT] Reaping data. (Size : 0)

[INT] No valid network data!! (wireless_sm_check_globals)
[ALL]


Dumpping SSIDs:

Scanning for wireless networks ...
[INT] Issuing scan request for interface eth1!
[INT] Checking for returned SSID information....
[INT] Reaping data. (Size : 206)
14 00 15 8B 01 00 00 12 - 00 CD 09 40 D0 00 00 00 ...........@....
04 00 00 00 11 00 1B 8B - 09 00 01 00 3C 68 69 64 ............<hid
64 65 6E 3E 00 14 00 01 - 8B 49 45 45 45 20 38 30 den>.....IEEE.80
32 2E 31 31 62 67 00 00 - 00 08 00 07 8B 03 00 00 2.11bg..........
00 0C 00 05 8B 01 00 00 - 00 00 00 00 32 08 00 2B ............2..+
8B 00 00 00 08 54 00 21 - 8B 40 42 0F 00 00 00 00 .....T.!.@B.....
08 80 84 1E 00 00 00 00 - 08 60 EC 53 00 00 00 00 .........`.S....
08 C0 D8 A7 00 00 00 00 - 08 00 1B B7 00 00 00 00 ................
08 80 A8 12 01 00 00 00 - 08 00 36 6E 01 00 00 00 ..........6n....
08 00 51 25 02 00 00 00 - 08 00 6C DC 02 00 00 00 ..Q%......l.....
08 80 F9 37 03 00 00 00 - 08 08 00 01 8C 23 00 00 ...7.........#..
67 1D 00 02 8C 15 00 00 - 00 20 4C 61 73 74 20 62 g.........Last.b
    eacon:.4ms.ago
[INT] AP MAC : 00 12 00 CD 09 40
[CONFIG] Found new ESSID block, adding...
[INT] ESSID : <hidden>
[INT] IWEVCUSTOM :  Last beacon: 4ms ago
[INT] No valid network data!! (wireless_sm_check_globals)
[ALL]

And this continues.

/hygnos

bsiever · **Posted:** Wed 08-16-2006 8:05AM

From what I understand the certificate is to ensure the identity of the AP.
(I.e. to make sure you aren't sending info. to a rogue AP). If you don't
have a certificate, you just don't get this extra level of security...
I rarely use wireless, so I haven't bothered worrying about it.

If I understand correctly, you can probably just get a certificate from
thawte or verisign...(I'm far from certain though - if I'm wrong, feel
free to correct me)

If anyone understands the certificate stuff and has a config that
works, please share - I wouldn't mind some extra security, but for my
limited use it hasn't been worth the effort/time.

Code:

network={
        ssid="UMR"
        scan_ssid=1
        key_mgmt=IEEE8021X
        eap=PEAP
        identity="bsiever"
        password="R3AL1y?"
        phase1="peaplabel=0"
        phase2="auth=MSCHAPV2"
        priority=10
}

hygnos · **Posted:** Wed 08-16-2006 3:20PM

thx for the config. But somehow that doesn't do the trick for me. Do you have any special modules loaded beside the ieee80211 pack?

You are probably right about the certificates (PEAP only needs a server certificate). I just did not think I could connect without first checking the this server certificate....

But I actually got the wep working -- I just realized that the key is given in hex, so wpa_supplicant wants the pwd without a surrounding "" :oops:

Now my laptop connects to UMR_Campus like a charm

I will have to try the 802.1X at a later point....

btw. which vpn client should I use? I have tried vpnc, but it wants a group ID and pass...

thank for your help

/hygnos

Chankster · **Posted:** Wed 08-16-2006 5:06PM

bsiever wrote:

From what I understand the certificate is to ensure the identity of the AP.
(I.e. to make sure you aren't sending info. to a rogue AP). If you don't
have a certificate, you just don't get this extra level of security...
I rarely use wireless, so I haven't bothered worrying about it.

Might want to edit out your password and username

bsiever · **Posted:** Wed 08-16-2006 7:30PM

Chankster wrote:

Might want to edit out your password and username

R3AL1y?

(Username was obvious anyway...
but is that R3AL1y my password?... No, not R3AL1y...)

bsiever · **Posted:** Wed 08-16-2006 7:49PM

hygnos wrote:

thx for the config. But somehow that doesn't do the trick for me. Do you have any special modules loaded beside the ieee80211 pack?

Nope, not really. The only option that might be significant is:

Code:

fast_reauth=1

It looks like I have to run dhclient manually for some reason (clearly a hack),
and I use the -w option for wpa_supplicant. (you might want to add -dd too to
get some idea where/what is failing)

UMR wifi (802.1X) with linux laptop

Who is online