Eduroam: Difference between revisions
m Category:Networking added |
added pmf for greater compatibility |
||
| (4 intermediate revisions by 3 users not shown) | |||
| Line 3: | Line 3: | ||
== Setup == | == Setup == | ||
For manual setup using wpa_supplicant, iwd, NetworkManager et. al. you can follow the instructions in the [https://wiki.archlinux.org/title/Network_configuration/Wireless#eduroam Arch Linux Wiki]. Note that configuration of eduroam highly depends on the way your institution implemented it. That's why you should consult their guidelines first and adapt accordingly. | For manual setup using wpa_supplicant, iwd, NetworkManager et. al. you can follow the instructions in the [https://wiki.archlinux.org/title/Network_configuration/Wireless#eduroam Arch Linux Wiki]. Note that for wpa_supplicant users, [[Wpa supplicant#Restrictions on Certificate Location|additional restrictions are placed on where certificates can be located]]. Also note that configuration of eduroam highly depends on the way your institution implemented it. That's why you should consult their guidelines first and adapt accordingly. | ||
Declarative setup on Nix is possible for [[wpa_supplicant#eduroam]], [[iwd#eduroam]] (example in the respective articles) and [[NetworkManager]]. For the latter, an exemplary setup is described below. | Declarative setup on Nix is possible for [[wpa_supplicant#eduroam]], [[iwd#eduroam]] (example in the respective articles) and [[NetworkManager]]. For the latter, an exemplary setup is described below. | ||
| Line 13: | Line 13: | ||
openssl pkcs12 -in eduroam.p12 -nokeys -out cert.pem</syntaxhighlight> | openssl pkcs12 -in eduroam.p12 -nokeys -out cert.pem</syntaxhighlight> | ||
It may be advisable to move them to <code>/etc/ssl/certs/eduroam</code> and adjust permissions. | It may be advisable to move them to <code>/etc/ssl/certs/eduroam</code> / <code>/etc/wpa_supplicant</code> and adjust permissions. | ||
<syntaxhighlight lang="console"> | <syntaxhighlight lang="console"> | ||
sudo mkdir -p /etc/ssl/certs/eduroam | sudo mkdir -p /etc/ssl/certs/eduroam | ||
sudo mv | sudo mkdir -p /etc/wpa_supplicant | ||
sudo | sudo mv cert.pem /etc/ssl/certs/eduroam/ | ||
sudo mv private.key /etc/wpa_supplicant/private.key | |||
sudo chmod 644 /etc/ssl/certs/eduroam/cert.pem | sudo chmod 644 /etc/ssl/certs/eduroam/cert.pem | ||
sudo chown root:root /etc/ssl/certs/eduroam/*</syntaxhighlight> | sudo chown root:root /etc/ssl/certs/eduroam/* | ||
sudo chown wpa_supplicant:wpa_supplicant /etc/wpa_supplicant/private.key | |||
sudo chmod 400 /etc/wpa_supplicant/private.key | |||
</syntaxhighlight> | |||
Note that some universities just require a certificate some .crt or .pem certificate and authenticate via password, eliminating the need for a .key-file. Stick to your universities instructions for this. | Note that some universities just require a certificate some .crt or .pem certificate and authenticate via password, eliminating the need for a .key-file. Stick to your universities instructions for this. | ||
| Line 42: | Line 47: | ||
wifi-security = { | wifi-security = { | ||
key-mgmt = "wpa-eap"; ## adapt according to your universities setup | key-mgmt = "wpa-eap"; ## adapt according to your universities setup | ||
pmf = "1"; | |||
}; | }; | ||
"802-1x" = { ## not all or even some additional values may be needed here according to your institution | "802-1x" = { ## not all or even some additional values may be needed here according to your institution | ||
| Line 47: | Line 53: | ||
identity = "likely-youremail@youruniversity.edu"; | identity = "likely-youremail@youruniversity.edu"; | ||
client-cert = "/etc/ssl/certs/eduroam/cert.pem"; | client-cert = "/etc/ssl/certs/eduroam/cert.pem"; | ||
private-key = "/etc/ | private-key = "/etc/wpa_supplicant/private.key"; | ||
private-key-password = "p@ssw0rd-of-your-.key-file"; ## warning, this should only be done for testing purposes, as it makes the password world-readable. You should replace this with some form of secrets-management using sops-nix or agenix. | private-key-password = "p@ssw0rd-of-your-.key-file"; ## warning, this should only be done for testing purposes, as it makes the password world-readable. You should replace this with some form of secrets-management using sops-nix or agenix. | ||
ca-cert = "/etc/ssl/certs/certs.pem"; | ca-cert = "/etc/ssl/certs/certs.pem"; | ||