BACKSPACE

WLAN

von joe oudeis, foosinn Howto

We're moving our wifi infrastructure to an authenticated and encrypted ssid. At the moment it's hard to change our internal wifi password, because our door system depends on it. If you are not in our internal wifi you can't operate the door.

This is one reason why we want to use 802.1x with EAP-TTLS. Every member has it's own username/password combination which can be reset or changed through a webinterface. If a member quits the space, we just have to deactivate the account and the internal access is gone.

The other reason is: Every member has its own encrypted channel to our access points. In addition the member has the possibility to check, if the SSID can be trusted (avoid roque APs) with an ssl certificate

Linux

NetworkManager (GUI)

  • Select the "backspace 802.1x" network in your WiFi settings
  • Select "TTLS" and "PAP" as the authentication and inner authentication method, respectively (see below)
  • Configure radius.core.bckspc.de as the domain and tick the checkbox "No CA certificate required" (see below)
  • Fill in your username and password (see below)
Bild

NetworkManager (nmcli)

# update your nickname and if you want change the cert path
nickname=fnord

# copy and paste this
device=$(nmcli d show | grep -B1 'GENERAL.TYPE.*wifi$' | head -n1 | cut -f2 -d: | xargs)
nmcli c add save yes \
  ifname "$device" \
  type wifi \
  con-name bckspc \
  ssid "backspace 802.1x" \
  802-1x.eap ttls \
  802-1x.identity "$nickname" \
  802-1x.phase2-auth pap \
  wifi-sec.key-mgmt wpa-eap

# to connect use your gui or this command
nmcli c up bckspc --ask

netctl

This part is not validated. If you have an end device with this configuration, please update this section.

Save config as /etc/netctl/$interfacename-backspace_8021x. You have to restart netctl-auto (e.g. systemctl restart netctl-auto@$interface)

Description='backspace WPA2 802.1X'
Interface=wlp3s0
Connection=wireless
Security=wpa-configsection
IP=dhcp
ESSID="backspace 802.1x"
WPAConfigSection=(
    'ssid="backspace 802.1x"'
    'proto=RSN WPA'
    'key_mgmt=WPA-EAP'
    'eap=TTLS'
    'identity="USERNAME"'
    'password="YOUR_PASSWORD"'
    'ca_cert="/etc/ssl/certs/ISRG_Root_X1.pem"'
    'phase2="auth=PAP"'
)

Note: Replace the interface name according to your system

wpa_supplicant

This part is not validated. If you have an end device with this configuration, please update this section.

Add to /etc/wpa_supplicant/wpa_supplicant.conf:

network={
 ssid="backspace 802.1x"
 key_mgmt=WPA-EAP
 eap=TTLS
 identity="USERNAME"
 password="YOUR_PASSWORD"
 phase2="auth=PAP"
 ca_cert="/etc/ssl/certs/ISRG_Root_X1.pem"
}

Sailfish OS

This part is not validated. If you have an end device with this configuration, please update this section.

Tested and working

Put the following into /var/lib/connman/wifi_bckspc-8021x.config then systemctl restart connman.

[service_backspace]
Type = wifi
Name = backspace 802.1x
EAP = ttls
Phase2 = PAP
Identity = USERNAME
Passphrase = PASSWORD
CACertFile = /etc/ssl/certs/ISRG_Root_X1.pem

Android

This is how you can connect with the android operating system to our 802.1x WIFI (WPA2 Enterprise)

  • Modify/Configure your backspace 802.1x connection according to the screenshot below
  • Attention: Some newer Android versions require a domain name if you use the certificate. Use radius.core.bckspc.de
Bild

macOS and iOS

Final profile

This part is not validated. If you have an end device with this configuration, please update this section.

A ready profile file can be downloaded here (you need to provide your LDAP credentials when asked). You don't need to follow the other steps if you use this file. Note: For iOS you need to extract this ZIP file and send it to you phone (e.g. via email).

After downloading the profile search in the System Settings for "Profile". Accept the Wifi profile here and enter you credentials. The "Backspace 802.1x" wifi should now be kown and you can connect.

DIY version

This part is not validated. If you have an end device with this configuration, please update this section.

The following procedure has been tested using macOS 10.11 El Capitan to macOS 10.14 Mojave.

Earlier versions of macOS offered to specify the authentication protocol when connecting to a wireless network. However, in newer versions you'll have to install a configuration profile in order to connect to our network using 802.1X with EAP-TTLS/PAP. This configuration profile contains our certificate and all required settings.

It is fairly easy to generate a configuration file for your devices yourself with the added bonus of already including your username and password. This file can be used for all your Macs and iOS devices.

To generate the config file you need to download the Apple Configurator from the Mac App Store

  • Start the Configurator and choose File -> New Profile
  • In the General tab give the profile a name.
  • Then go down to Wi-Fi and configure the Payload:
  • SSID: backspace 802.1x
  • Security: Enterprise WPA2
  • EAP-TTLS
  • you can add your username and password here
  • Inner Authentification: PAP

Choose Save from the File menu and give the profile a name.

You can now install the profile on your Mac. (The installation only seems to work, if you have installed the Certificate under "Certificates" in the Configurator. But you must not click the certificate under "Trust" in the Wi-Fi payload, because that will fail the authentification. See below for trusting the RADIUS server.)

To install the file on your iOS device, simply connect the device to the laptop running Configurator via USB and drag the profile file onto the device when it shows up in the application.

Alternatively you can send the file to yourself via email. Tap the file in the Mail app and install it on your iOS device. WARNING: This will likely send your credentials unencrypted through the internet!

When installing your profiles the systems will tell you that the certificate is not signed and that you need to trust the RADIUS server. You just need to accept both and are ready.

Windows 8 and above

This part is not validated. If you have an end device with this configuration, please update this section.

Look at this tutorial in German language.

Windows 11

  • Open the "new" system control panel
  • "Netzwerk und Internet"
  • "WLAN"
  • "Bekannte Netzwerke verwalten"
  • "Netzwerk hinzufügen"
  • Netzwerkname: backspace 802.1x
  • Sicherheitstyp: WPA2-Enterprise AES
  • EAP-Methode: EAP-TTLS
  • Authentifizierungsmethode: Unverschlüsseltes Kennwort (PAP)