Virginia Tech Wifi - Revision history

Waldrep: Undo revision 7818 by Waldrep (talk)

2023-06-28T14:00:21Z

Undo revision 7818 by Waldrep (talk)

2023-06-28T13:59:32Z

Modern OpenSSL the legacy provider to use MD4

2023-03-31T15:30:35Z

Getting your network password hash: OpenSSL 3 requires the legacy provider

2021-10-14T23:28:20Z

Undo revision 7760 by Waldrep (talk)

2021-10-14T23:27:58Z

update links; remove reference to pinning cert

2021-10-09T01:26:49Z

Trim summary

2021-09-14T16:45:20Z

Update OpenBSD instructions

2021-08-11T13:31:24Z

InCommon didn't issue their own intermediate cert

2021-08-11T13:28:32Z

Update grammar to reflect May 2020 is in the past.

2021-03-10T21:19:14Z

‎Android Instructions

@@ Line 88: / Line 88: @@
 printf 'YOUR-NETW-ORKP-SSWD' \
    | iconv -f ASCII -t UTF-16LE \
-   | openssl dgst -provider legacy -md4 \
+   | openssl dgst -md4 \
    | cut -d ' ' -f 2
 </pre>

@@ Line 88: / Line 88: @@
 printf 'YOUR-NETW-ORKP-SSWD' \
    | iconv -f ASCII -t UTF-16LE \
-   | openssl dgst -md4 \
+   | openssl dgst -provider legacy -md4 \
    | cut -d ' ' -f 2
 </pre>

@@ Line 88: / Line 88: @@
 printf 'YOUR-NETW-ORKP-SSWD' \
    | iconv -f ASCII -t UTF-16LE \
-   | openssl md4 \
+   | openssl dgst -md4 \
    | cut -d ' ' -f 2
 </pre>

@@ Line 1: / Line 1: @@
-On campus, there are 2 wireless networks. '''eduroam''' is the preferred method, which uses PEAP-MSCHAPv2 to authenticate to the RADIUS server, while the second SSID, '''VirginiaTech''', provides a captive-portal and allows for guest account creation.
+On campus, there are 2 wireless networks:
-As of January 2015 the [https://4help.vt.edu/sp?id=kb_article&sys_id=3886a7206f7721003fbcb03f5d3ee42f preferred method] of wireless access at Virginia Tech is through the [https://eduroam.org/ eduroam] network. eduroam is a secure wireless access service that was developed for the use of research and educational institutions. One of the advantages of the eduroam network is that you will be able to connect to the Internet at any participating institution using your Virginia Tech credentials. The eduroam-US site provides a [https://www.eduroam.us/technical_overview technical overview] of how the network authenticates you to the Virginia Tech RADIUS servers.
+Because '''eduroam''''s credentials are federated, it means that a VT user is able to automatically connect to the Internet at participating institutions. The eduroam-US site provides a [https://www.eduroam.us/technical_overview technical overview] of the authentication system.
 ==General Connection Information==

@@ Line 130: / Line 130: @@
       phase2="auth=MSCHAPV2"
       anonymous_identity="anonymous@vt.edu"
-     #THIS HASH IS OUT OF DATE, PLEASE FOLLOW INSTRUCTIONS ABOVE
+      # if you prefer to pin the certificate, follow the instructions above to generate a hash
-      # if you prefer to pin the certificate
+      ca_cert="hash://server/sha256/0000111122223333444455556666777788889999aaaabbbbccccddddeeeeffff"
       # if you prefer to dynamically validate the certificate by its cryptographic attributes
       ca_cert="/path/to/USERTrust_RSA_Certification_Authority.pem"
       domain_match="eduroam.nis.vt.edu"
-      identity="YourPidHere@vt.edu"
+      identity="PID@vt.edu"
-      password="YourNetworkPasswordHere"
+      password="YOUR_NETWORK_PASSWORD"
+  }
@@ Line 144: / Line 143: @@
   $ sudo wpa_supplicant -B -i wlan0 -c /etc/wpa_supplicant/eduroam.conf
   $ sudo dhcpcd wlan0
 Alternate config options, besides domain_match are as follows (obviously not correct):
@@ Line 158: / Line 150: @@
 More thorough documentation is available at [https://w1.fi/cgit/hostap/plain/wpa_supplicant/wpa_supplicant.conf]
 ==netctl Instructions==

@@ Line 42: / Line 42: @@
 ''Subject:'' C = US, ST = MI, L = Ann Arbor, O = Internet2, OU = InCommon, CN = InCommon RSA Server CA
-This is an intermediate certificate issued by InCommon. You can get it directly from InCommon [http://crt.usertrust.com/InCommonRSAServerCA_2.crt here].
+This is an intermediate certificate issued to InCommon. You can get it directly from InCommon [http://crt.usertrust.com/InCommonRSAServerCA_2.crt here].
 ====eduroam.nis.vt.edu====

@@ Line 34: / Line 34: @@
 ''Subject:'' C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority
-This is a common root CA and should have shipped with your OS. It is likely located in <code>/etc/ssl/certs/USERTrust_RSA_Certification_Authority.pem</code>. Note that if you follow the Authority Information Access of the intermediate certificate, it may direct you to a URL which points to a different version of this certficate, which is cross signed by AddTrust and expires in May 2020. The one in your cert store is self-signed and expires in 2038. You want the one from your cert store.
+This is a common root CA and should have shipped with your OS. It is likely located in <code>/etc/ssl/certs/USERTrust_RSA_Certification_Authority.pem</code>. Note that if you follow the Authority Information Access of the intermediate certificate, it may direct you to a URL which points to a different version of this certficate, which is cross signed by AddTrust and expired in May 2020. The one in your cert store is self-signed and expires in 2038. You want the one from your cert store.
 ====InCommon RSA Server CA====

@@ Line 279: / Line 279: @@
 * From the "WiFi networks" listing, click on eduroam.
 * Choose PEAP as the EAP method and MSCHAPv2 as the phase two authentication mechanism.
-* For the CA certificate, select "Use system certificates"
+* For the CA certificate, select "Use system certificates". Optionally, import the root CA from above, and select that instead for better security.
 * For the domain, enter ```eduroam.nis.vt.edu```
 * Enter your pid@vt.edu for the identity