Wpa supplicant - Revision history

Peter: /* Restrictions on Certificate Location */ Added hint for editing NetworkManager connections when using eduroam.

2026-04-10T08:50:03Z

Restrictions on Certificate Location: Added hint for editing NetworkManager connections when using eduroam.

← Older revision		Revision as of 08:50, 10 April 2026
Line 126:		Line 126:
	=== Restrictions on Certificate Location ===		=== Restrictions on Certificate Location ===
	For certificate-based setups, due to security hardening for wpa_supplicant in NixOS 26.05 and later users of wpa_supplicant face restrictions on where eduroam certificates can be stored<ref>https://discourse.nixos.org/t/breaking-changes-announcement-for-unstable/17574/116</ref>. Certificates should be placed in either <code>/etc/ssl/certs</code> or <code>/etc/wpa_supplicant</code> and should be owned by (or accessible to) the wpa_supplicant user.		For certificate-based setups, due to security hardening for wpa_supplicant in NixOS 26.05 and later users of wpa_supplicant face restrictions on where eduroam certificates can be stored<ref>https://discourse.nixos.org/t/breaking-changes-announcement-for-unstable/17574/116</ref>. Certificates should be placed in either <code>/etc/ssl/certs</code> or <code>/etc/wpa_supplicant</code> and should be owned by (or accessible to) the wpa_supplicant user.

			Some eduroam configuration scripts may hardcode paths in its relevant <code>/etc/NetworkManager/system-connections/<connection>.nmconnection</code>. In this case, editing the <code>ca-cert</code>, <code>client-cert</code>, and <code>private-key</code> to point at their new location should suffice.

	== WEP support ==		== WEP support ==

Natejank: /* Restrictions on Certificate Location */ remove comma splice

2026-01-26T18:56:34Z

Restrictions on Certificate Location: remove comma splice

← Older revision		Revision as of 18:56, 26 January 2026
Line 125:		Line 125:

	=== Restrictions on Certificate Location ===		=== Restrictions on Certificate Location ===
	For certificate-based setups, due to security hardening for wpa_supplicant in NixOS 26.05 and later, users of wpa_supplicant face restrictions on where eduroam certificates can be stored<ref>https://discourse.nixos.org/t/breaking-changes-announcement-for-unstable/17574/116</ref>. Certificates should be placed in either <code>/etc/ssl/certs</code> or <code>/etc/wpa_supplicant</code> and should be owned by (or accessible to) the wpa_supplicant user.		For certificate-based setups, due to security hardening for wpa_supplicant in NixOS 26.05 and later users of wpa_supplicant face restrictions on where eduroam certificates can be stored<ref>https://discourse.nixos.org/t/breaking-changes-announcement-for-unstable/17574/116</ref>. Certificates should be placed in either <code>/etc/ssl/certs</code> or <code>/etc/wpa_supplicant</code> and should be owned by (or accessible to) the wpa_supplicant user.

	== WEP support ==		== WEP support ==

Natejank: /* eduroam */ Add information regarding certificate location for NixOS Unstable and 26.05+ users

2026-01-26T18:49:48Z

eduroam: Add information regarding certificate location for NixOS Unstable and 26.05+ users

← Older revision		Revision as of 18:49, 26 January 2026
Line 113:		Line 113:

	== [[eduroam]] ==		== [[eduroam]] ==
			Nowadays, using EAP-PWD is preferred over MSCHAPv2 when connecting to [[eduroam]] or other institutional networks. It provides stronger [https://www.rfc-editor.org/rfc/rfc5931#page-35 security claims] and is simpler to set up. It also never transmits your password, doesn't require certificates and needs less authentication roundtrips. The identity and password should be given to you by your institution.<syntaxHighlight lang=nixos>
	Nowadays, using EAP-PWD is preferred over MSCHAPv2 when connecting to [[eduroam]] or other institutional networks. It provides stronger [https://www.rfc-editor.org/rfc/rfc5931#page-35 security claims] and is simpler to set up. It also never transmits your password, doesn't require certificates and needs less authentication roundtrips. The identity and password should be given to you by your institution.

	<syntaxHighlight lang=nixos>
	networking.wireless.networks.eduroam = {		networking.wireless.networks.eduroam = {
	auth = ''		auth = ''
Line 126:		Line 123:
	};		};
	</syntaxHighlight>		</syntaxHighlight>

			=== Restrictions on Certificate Location ===
			For certificate-based setups, due to security hardening for wpa_supplicant in NixOS 26.05 and later, users of wpa_supplicant face restrictions on where eduroam certificates can be stored<ref>https://discourse.nixos.org/t/breaking-changes-announcement-for-unstable/17574/116</ref>. Certificates should be placed in either <code>/etc/ssl/certs</code> or <code>/etc/wpa_supplicant</code> and should be owned by (or accessible to) the wpa_supplicant user.

	== WEP support ==		== WEP support ==

Vater: /* External links */moving (external) link about eduroam (about wpa_supplicant and NetworkManager) from this article to this article eduroam

2025-10-07T00:13:38Z

External links: moving (external) link about eduroam (about wpa_supplicant and NetworkManager) from this article to this article eduroam

← Older revision		Revision as of 00:13, 7 October 2025
Line 161:		Line 161:
	== External links ==		== External links ==

	* [https://www.stura.htw-dresden.de/stura/ref/hopo/dk/nachrichten/eduroam-meets-nixos (german) article ''eduroam meets NixOS'' (with configuration)] (instance ''University of Applied Sciences Dresden'': The [https://cat.eduroam.org/?idp=5106&profile=5098 eduroam installer for GNU/Linux] works [https://www.htw-dresden.de/en/university/organisation/zid/service-overview-and-instructions/wi-fi-/-wlan/eduroam/linux for example for Ubuntu] but not [[NixOS]])
	* [https://github.com/NixOS/nixpkgs/issues/177501 NixOs: Can't connect to a WEP network: failure to add network: invalid message format]		* [https://github.com/NixOS/nixpkgs/issues/177501 NixOs: Can't connect to a WEP network: failure to add network: invalid message format]

	[[Category:Software]]		[[Category:Software]]
	[[Category:Networking]]		[[Category:Networking]]

Vater: /* eduroam */

2025-10-07T00:05:49Z

eduroam

← Older revision		Revision as of 00:05, 7 October 2025
Line 112:		Line 112:
	Where you need to change the <code>wlan0</code> with your own wifi network interface. You can list your interfaces by running <code>ip link</code>, your wifi network interface should have "wl" prepended. Note that the above snippet fully randomizes your MAC address, for more information you can read macchanger's manpage. This obviously requires you to have the <code>macchanger</code> package installed.		Where you need to change the <code>wlan0</code> with your own wifi network interface. You can list your interfaces by running <code>ip link</code>, your wifi network interface should have "wl" prepended. Note that the above snippet fully randomizes your MAC address, for more information you can read macchanger's manpage. This obviously requires you to have the <code>macchanger</code> package installed.

	== ~~Eduroam~~ ==		== [[eduroam]] ==

	Nowadays, using EAP-PWD is preferred over MSCHAPv2 when connecting to eduroam or other institutional networks. It provides stronger [https://www.rfc-editor.org/rfc/rfc5931#page-35 security claims] and is simpler to set up. It also never transmits your password, doesn't require certificates and needs less authentication roundtrips. The identity and password should be given to you by your institution.		Nowadays, using EAP-PWD is preferred over MSCHAPv2 when connecting to [[eduroam]] or other institutional networks. It provides stronger [https://www.rfc-editor.org/rfc/rfc5931#page-35 security claims] and is simpler to set up. It also never transmits your password, doesn't require certificates and needs less authentication roundtrips. The identity and password should be given to you by your institution.

	<syntaxHighlight lang=nixos>		<syntaxHighlight lang=nixos>

Fschn90: option has changed from environmentFile to secretsFile

2025-06-08T14:47:57Z

option has changed from environmentFile to secretsFile

← Older revision		Revision as of 14:47, 8 June 2025
Line 46:		Line 46:
	</syntaxHighlight>		</syntaxHighlight>

	To avoid having your network password in accessible plaintext on your system or in your version control consider using [https://search.nixos.org/options?show=networking.wireless.~~environmentFile~~&from=0&size=50&sort=relevance&type=packages&query=networking.wireless networking.wireless.~~environmentFile~~].		To avoid having your network password in accessible plaintext on your system or in your version control consider using [https://search.nixos.org/options?channel=25.05&show=networking.wireless.secretsFile&from=0&size=50&sort=relevance&type=packages&query=networking.wireless networking.wireless.secretsFile].

	Another example of simple wpa2 auth:		Another example of simple wpa2 auth:

FliegendeWurst: short introduction

2025-03-09T16:09:16Z

short introduction

← Older revision		Revision as of 16:09, 9 March 2025
Line 1:		Line 1:
	{{DISPLAYTITLE:wpa_supplicant}}		{{DISPLAYTITLE:wpa_supplicant}}
			[https://w1.fi/wpa_supplicant/ wpa_supplicant] is a WPA Supplicant for Linux, BSD, Mac OS X, and Windows with support for WPA, WPA2 (IEEE 802.11i / RSN), and WPA3. It sets up connections to wireless networks.

	== General ==		== General ==

Klinger: Category:Software Category:Networking

2024-12-28T20:23:38Z

Category:Software Category:Networking

← Older revision		Revision as of 20:23, 28 December 2024
Line 161:		Line 161:
	* [https://www.stura.htw-dresden.de/stura/ref/hopo/dk/nachrichten/eduroam-meets-nixos (german) article ''eduroam meets NixOS'' (with configuration)] (instance ''University of Applied Sciences Dresden'': The [https://cat.eduroam.org/?idp=5106&profile=5098 eduroam installer for GNU/Linux] works [https://www.htw-dresden.de/en/university/organisation/zid/service-overview-and-instructions/wi-fi-/-wlan/eduroam/linux for example for Ubuntu] but not [[NixOS]])		* [https://www.stura.htw-dresden.de/stura/ref/hopo/dk/nachrichten/eduroam-meets-nixos (german) article ''eduroam meets NixOS'' (with configuration)] (instance ''University of Applied Sciences Dresden'': The [https://cat.eduroam.org/?idp=5106&profile=5098 eduroam installer for GNU/Linux] works [https://www.htw-dresden.de/en/university/organisation/zid/service-overview-and-instructions/wi-fi-/-wlan/eduroam/linux for example for Ubuntu] but not [[NixOS]])
	* [https://github.com/NixOS/nixpkgs/issues/177501 NixOs: Can't connect to a WEP network: failure to add network: invalid message format]		* [https://github.com/NixOS/nixpkgs/issues/177501 NixOs: Can't connect to a WEP network: failure to add network: invalid message format]

			[[Category:Software]]
			[[Category:Networking]]

Phanirithvij: fix htw-dresden.de eduroam linux guide url

2024-09-15T09:25:43Z

fix htw-dresden.de eduroam linux guide url

← Older revision		Revision as of 09:25, 15 September 2024
Line 159:		Line 159:
	== External links ==		== External links ==

	* [https://www.stura.htw-dresden.de/stura/ref/hopo/dk/nachrichten/eduroam-meets-nixos (german) article ''eduroam meets NixOS'' (with configuration)] (instance ''University of Applied Sciences Dresden'': The [https://cat.eduroam.org/?idp=5106&profile=5098 eduroam installer for GNU/Linux] works [https://www.htw-dresden.de/en/university/organisation/~~it-~~service-~~centre/services-for-workplace~~-and-~~communication~~/wi-fi-/-wlan/eduroam/linux for example for Ubuntu] but not [[NixOS]])		* [https://www.stura.htw-dresden.de/stura/ref/hopo/dk/nachrichten/eduroam-meets-nixos (german) article ''eduroam meets NixOS'' (with configuration)] (instance ''University of Applied Sciences Dresden'': The [https://cat.eduroam.org/?idp=5106&profile=5098 eduroam installer for GNU/Linux] works [https://www.htw-dresden.de/en/university/organisation/zid/service-overview-and-instructions/wi-fi-/-wlan/eduroam/linux for example for Ubuntu] but not [[NixOS]])
	* [https://github.com/NixOS/nixpkgs/issues/177501 NixOs: Can't connect to a WEP network: failure to add network: invalid message format]		* [https://github.com/NixOS/nixpkgs/issues/177501 NixOs: Can't connect to a WEP network: failure to add network: invalid message format]

Tomkoid: Add WEP support example

2024-07-07T11:28:31Z

Add WEP support example

@@ Line 124: / Line 124: @@
   };
 </syntaxHighlight>
 == Fixing "legacy sigalg disallowed or unsupported" ==
@@ Line 142: / Line 159: @@
 == External links ==
-[https://www.stura.htw-dresden.de/stura/ref/hopo/dk/nachrichten/eduroam-meets-nixos (german) article ''eduroam meets NixOS'' (with configuration)] (instance ''University of Applied Sciences Dresden'': The [https://cat.eduroam.org/?idp=5106&profile=5098 eduroam installer for GNU/Linux] works [https://www.htw-dresden.de/en/university/organisation/it-service-centre/services-for-workplace-and-communication/wi-fi-/-wlan/eduroam/linux for example for Ubuntu] but not [[NixOS]])
+* [https://www.stura.htw-dresden.de/stura/ref/hopo/dk/nachrichten/eduroam-meets-nixos (german) article ''eduroam meets NixOS'' (with configuration)] (instance ''University of Applied Sciences Dresden'': The [https://cat.eduroam.org/?idp=5106&profile=5098 eduroam installer for GNU/Linux] works [https://www.htw-dresden.de/en/university/organisation/it-service-centre/services-for-workplace-and-communication/wi-fi-/-wlan/eduroam/linux for example for Ubuntu] but not [[NixOS]])