WLAN
We're moving our wifi infrastructure to an authenticated and encrypted ssid. At the moment it's hard to change our internal wifi password, because our door system depends on it. If you are not in our internal wifi you can't operate the door.
This is one reason why we want to use 802.1x with EAP-TTLS. Every member has it's own username/password combination which can be reset or changed through a webinterface. If a member quits the space, we just have to deactivate the account and the internal access is gone.
The other reason is: Every member has its own encrypted channel to our access points. In addition the member has the possibility to check, if the SSID can be trusted (avoid roque APs) with an ssl certificate
certificate
To check if you're connecting to the correct SSID, you can and should add the ssl certificate to your connection setting. You can download the SSL CA-Certificate from our Server.
netctl
Save config as /etc/netctl/$interfacename-backspace_8021x. You have to restart netctl-auto (e.g. systemctl restart netctl-auto@$interface)
Description='backspace WPA2 802.1X'
Interface=wlp3s0
Connection=wireless
Security=wpa-configsection
IP=dhcp
ESSID="backspace 802.1x"
WPAConfigSection=(
'ssid="backspace 802.1x"'
'proto=RSN WPA'
'key_mgmt=WPA-EAP'
'eap=TTLS'
'identity="USERNAME"'
'password="YOUR_PASSWORD"'
'ca_cert="hash://server/sha256/885cf35fd8f4ef0c4ed24109a15df09c6bde6f6ca28e870df8ca9cc980fc7892"'
'phase2="auth=PAP"'
)FYI: Replace the interface name according to your system
wpa_supplicant
Add to /etc/wpa_supplicant/wpa_supplicant.conf:
network={
ssid="backspace 802.1x"
key_mgmt=WPA-EAP
eap=TTLS
identity="USERNAME"
password="YOUR_PASSWORD"
phase2="auth=PAP"
ca_cert="hash://server/sha256/885cf35fd8f4ef0c4ed24109a15df09c6bde6f6ca28e870df8ca9cc980fc7892"
}connman
UNTESTED!
[service_backspace]
Type=wifi
Name="backspace 802.1x"
EAP=ttls
Phase2=PAP
Identity=USERNAME
Passphrase=YOUR_PASSWORD
CACertFile = hash://server/sha256/885cf35fd8f4ef0c4ed24109a15df09c6bde6f6ca28e870df8ca9cc980fc7892Sailfish OS
Tested and working
Put the following into /var/lib/connman/wifi_bckspc-8021x.config
then
systemctl restart connman
[service_backspace]
Type = wifi
Name = backspace 802.1x
EAP = ttls
Phase2 = PAP
Identity = USERNAME
Passphrase = PASSWORD
CACertFile = hash://server/sha256/885cf35fd8f4ef0c4ed24109a15df09c6bde6f6ca28e870df8ca9cc980fc7892wicd
ctrl_interface=/var/run/wpa_supplicant
network={
ssid="backspace 802.1x"
scan_ssid=$_SCAN
identity="USERNAME"
password="YOUR_PASSWORD"
proto=WPA2
key_mgmt=WPA-EAP
group=CCMP
pairwise=CCMP
eap=TTLS
anonymous_identity="$_ANONYMOUS_IDENTITY"
phase2="auth=PAP"
ca_cert="hash://server/sha256/885cf35fd8f4ef0c4ed24109a15df09c6bde6f6ca28e870df8ca9cc980fc7892"
}Warning: This is not yet tested. ca_cert certificate checking should work as it does for netctl and wpa_supplicant. Adapted from 31c3 wiki
Android
This is how you can connect with the android operating system to our 802.1x WIFI (WPA2 Enterprise)
- Download our certificate at http://bckspc.de/8021x-cert
- Open downloaded certificate
- Save certificate as backspace.crt and type "Wifi"
- Modify/Configure your backspace 802.1x connection according to the screenshot below
- Attention: Some newer Android versions require a domain name if you use the certificate. Use radius.core.bckspc.de
- Firefox on android might fail to import the certificate, stating that the certificate authority is already trusted. In these cases, chrome can stil import the certificate.
Linux - NetworkManager
- Download the certificate
- Select the "backspace 802.1x" network in your WiFi settings
- Select the previously downloaded certificate
- Select "TTLS" and "PAP" as the authentication and inner authentication method, respectively (see below)
- Fill in your username and password (see below)
Mac OS X and IOS
The following procedure has been tested using Mac OS 10.11 El Capitan to macOS 10.13 High Sierra.
Earlier versions of OS X offered to specify the authentication protocol when connecting to a wireless network. However, in newer versions you'll have to install a configuration profile in order to connect to our network using 802.1X with EAP-TTLS/PAP. This configuration profile contains our certificate and all required settings.
It is fairly easy to generate a configuration file for your devices yourself with the added bonus of already including your username and password. This file can be used for all your Macs and iOS devices.
To generate the config file you need to download the Apple Configurator from the Mac App Store. [1]
Start the Configurator and choose File -> New Profile
In the General tab give the profile a name.
Then go down to Wi-Fi and configure the Payload:
SSID: backspace 802.1x
Security: Enterprise WPA2
EAP-TTLS
you can add your username and password here
Inner Authentification: PAP
Choose Save from the File menu and give the profile a name.
You can now install the profile on your Mac. (The installation only seems to work, if you have installed the Certificate under "Certificates" in the Configurator. But you must not click the certificate under "Trust" in the Wi-Fi payload, because that will fail the authentification. See below for trusting the RADIUS server.)
To install the file on your iOS device, simply connect the device to the laptop running Configurator via USB and drag the profile file onto the device when it shows up in the application. Alternatively you can send the file to yourself via email. Tap the file in the Mail app and install it on your iOS device.
When installing your profiles the systems will tell you that the certificate is not signed and that you need to trust the RADIUS server. You just need to accept both and are ready.
Windows 7
Windows 7 does not support EAP-TTLS / PAP from scratch. The same is true for eduroam networks and this is why there are a lot of instructions from universities which use SecureW2 as an additional Software to enable EAP-TTLS:
Unfortunately, SecureW2 is not free (it used to be, but they revoked that).
Another option could be XSupplicant from the Open1X project; they were working towards Windows 7 support, but it seems that they didn't make it. (Latest news is from 25 Sept 2010 that version 2.2.2 should support it; I tried v2.2.2.504.x64, didn't work).
To summarize, right now we do not know a free option to connect with EAP-TTLS / PAP under Windows 7.
(read this article for a good discussion on the tool market and other commercial options)
Windows 8 and above
Since Windows 8 the system itself is capable of EAP-TTLS.
TODO: Someone with windows should do some screenshots.
