imported>Ram |
imported>Echarlie |
| Line 1: |
Line 1: |
| − | Since the fall of 2008, there have been two wireless networks on campus. One network, called '''VT-Wireless''', encrypts all traffic and is secured with EAP-TLS or PEAP-MSCHAPv2. The other network, called [[VT_WLAN]] was an unencrypted network captive portal using PID authentication. In July, 2013 VT_WLAN was superseded by CONNECTtoVT-Wireless, an unencrypted, captive portal wireless network designed to set up connecting to VT-Wireless without offering Internet access. Due to user issues faced during deployment, CONNECTtoVT-Wireless began offering captive portal access to VT users. In January 2015, '''eduroam''' access was enabled, allowing members of any eduroam-affiliated institution to use wifi at any other institution. Connections to VT-Wireless and eduroam are secure by default, and has one of two different methods to connect.
| + | == Date, Time and Location == |
| | + | * Thursday, August 11<sup>th</sup> |
| | + | * 8:30pm - 10:30pm |
| | + | * 261 [[gp:Durham Hall|Durham Hall]] |
| | | | |
| − | As of January 2015 the [https://www.computing.vt.edu/content/eduroam preferred method] of wireless access at Virginia Tech is through the [https://eduroam.org/ Eduroam] network. Eduroam is a wireless access service that was developed for the use of research and educational institutions. One of the advantages of the Eduroam network over the VT-Wireless network is that you will be able to connect to the Internet at any participating institution using your Virginia Tech credentials. The Eduroam-US site provides a [https://eduroam.us/technical_overview technical overview] of how the network authenticates you to the Virginia Tech RADIUS servers.
| + | == Announcements == |
| | + | * Meeting next week may or may not be in this room, but we'll try to have one somewhere |
| | | | |
| − | <!-- '''PEAP-MSCHAPv2''' is a wireless authentication scheme used by Virginia Tech as an alternative to [[EAP-TLS]] for connections to [[VT-Wireless]]. -->
| + | == Discussion == |
| | + | * [http://www.neowin.net/news/university-of-wisconsin-hacked-75000-ssns-exposed University of Wisconsin got owned] |
| | + | * Plans for the fall |
| | + | * IPSec VPNs |
| | + | * [https://mailman.archlinux.org/pipermail/arch-dev-public/2011-August/021294.html pacman 4.0.0rc1] |
| | | | |
| − | ==Connection information== | + | == Hacking == |
| − | ===eduroam===
| + | * [[gp:Main page|Gobblerpedia]] |
| − | The following settings are recommended for connecting to the Eduroam network:
| + | * [[OpenStreetMap]] building addresses [http://www.vtnews.vt.edu/articles/2011/07/072811-tcs-physicaladdress.html] |
| | + | * Wiki meeting page creation script |
| | | | |
| − | * SSID: eduroam
| + | [[Category:VTLUUG:Meetings]] |
| − | * EAP: PEAP
| |
| − | * Phase 2: MSCHAPv2
| |
| − | * Identity: pid@vt.edu (So if your PID was "hokiebird", hokiebird@vt.edu)
| |
| − | * Anonymous Identity: anonymous@vt.edu
| |
| − | * Password: [https://www.computing.vt.edu/kb/entry/3765 Your Network Password]
| |
| − | | |
| − | ====RADIUS certificates====
| |
| − | The certificate verification methods vary greatly between different network managers, but the certificate currently in use for the Virginia Tech RADIUS servers is available from the [https://ash.eprov.seti.vt.edu/EJBCAWebRequest/certSearch?cmd=search&keyword=VT-Wireless PKI Certificate Search site] and the certificate chain is the (Obsolete) [https://secure.hosting.vt.edu/www.pki.vt.edu/developer/rootca.html#globalserver Virginia Tech Global Server CA] chain.
| |
| − | | |
| − | Unfortunately, the PKI Certificate Search is only available from campus IPs.
| |
| − | | |
| − | ==A word of caution on MSCHAPv2==
| |
| − | Warning: Use of PEAP-MSCHAPv2 to connect to the Virginia Tech network is strongly discouraged by the Linux and Unix Users Group due to attacks that can allow all traffic to be decrypted with a 100% success rate. Unfortunately, VT has deprecated its use so users will soon lose the choice to use certificates.
| |
| − | | |
| − | At DefCon 20 in July 2012, an attack was announced for MSCHAPv2 that allows the protocol to be cracked quickly with a 100% success rate.<ref>[https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/]</ref> '''Use of MSCHAPv2 is strongly discouraged.'''
| |
| − | | |
| − | | |
| − | ==Set your remote access (network) passphrase==
| |
| − | Regardless of what software you use to establish your connection, you must first set your remote passphrase by going to [https://my.vt.edu my.vt.edu]→Settings→Change Network Password.
| |
| − | | |
| − | ==Android==
| |
| − | ===eduroam (preferred)===
| |
| − | TODO
| |
| − | === VT-Wireless (legacy)===
| |
| − | {{Version|2.2 (Froyo) of Android}}
| |
| − | | |
| − | * From the home screen, press the menu button and choose "Settings"→"Wireless & networks"→"Wi-Fi settings".
| |
| − | * Remove any existing entries for {{{networks|the network you'd like to add or any conflicting network}}}.
| |
| − | * From the "WiFi networks" listing, click on {{{network|the network you'd like to add}}}.
| |
| − | * Choose PEAP as the EAP method and MSCHAPv2 as the phase two authentication mechanism.
| |
| − | * Enter your credentials for the identity and press "Connect".
| |
| − | | |
| − | ==NetworkManager==
| |
| − | ===eduroam (preferred)===
| |
| − | * In your wireless configuration program, select eduroam.
| |
| − | * Choose PEAP as the EAP type.
| |
| − | * Choose MSCHAPv2 as the authentication method.
| |
| − | * Use PID@vt.edu and network passphrase as your login credentials.
| |
| − | * Use anonymous@vt.edu as your Anonymous Identity
| |
| − | * '''TODO:''' Certificate verification
| |
| − | | |
| − | ===VT-Wireless (legacy)===
| |
| − | * In your wireless configuration program, select VT-Wireless.
| |
| − | * Choose PEAP as the EAP type.
| |
| − | * Choose MSCHAPv2 as the authentication method.
| |
| − | * Use your {{{identity|PID}}} and network passphrase as your login credentials.
| |
| − | | |
| − | ==wpa_supplicant==
| |
| − | | |
| − | ===For eduroam (preferred)===
| |
| − | [http://w1.fi/wpa_supplicant/ wpa_supplicant] is a cross-platform supplicant which implements IEEE 802.1x/WPA and is used in many Linux/UNIX distributions.
| |
| − | | |
| − | In order to connect to the eduroam network, add the following to /etc/wpa_supplicant/eduroam.conf modifying the identity and password to reflect your PID and Network Password:
| |
| − | | |
| − | ctrl_interface=DIR=/run/wpa_supplicant GROUP=wheel
| |
| − | update_config=1
| |
| − | fast_reauth=1
| |
| − | ap_scan=1
| |
| − |
| |
| − | network={
| |
| − | ssid="eduroam"
| |
| − | proto=RSN
| |
| − | key_mgmt=WPA-EAP
| |
| − | eap=PEAP
| |
| − | phase2="auth=MSCHAPV2"
| |
| − | anonymous_identity="anonymous@vt.edu"
| |
| − | ca_cert="hash://server/sha256/216c5f2568c6e84860b12535efe93500623ccee999306b84260f951bcbd57b1a"
| |
| − |
| |
| − | identity="YourPidHere@vt.edu"
| |
| − | password="YourNetworkPasswordHere"
| |
| − | }
| |
| − | | |
| − | You can then connect to the network by running (where wlan0 is your wireless interface):
| |
| − | | |
| − | $ sudo wpa_supplicant -B -i wlan0 -c /etc/wpa_supplicant/eduroam.conf
| |
| − | $ sudo dhcpcd wlan0
| |
| − | | |
| − | ===For VT-Wireless (legacy)===
| |
| − | Add the following lines to /etc/wpa_supplicant.conf:
| |
| − | | |
| − | ctrl_interface=DIR=/run/wpa_supplicant GROUP=wheel
| |
| − | update_config=1
| |
| − | fast_reauth=1
| |
| − | ap_scan=1
| |
| − |
| |
| − | network={
| |
| − | ssid="VT-Wireless"
| |
| − | proto=WPA2
| |
| − | key_mgmt=WPA-EAP
| |
| − | eap=PEAP
| |
| − | phase2="auth=MSCHAPV2"
| |
| − | identity="your {{{identity|PID}}}"
| |
| − | password="your passphrase"
| |
| − | ca_cert="/etc/ssl/certs/GlobalSign_Root_CA.pem
| |
| − | }
| |
| − | | |
| − | ==Certificate pinning==
| |
| − | ===For eduroam===
| |
| − | In the above wpa_supplicant configuration, we pin the server certificate that we expect the RADIUS server to present. wpa_supplicant offers multiple mechanisms for certificate management. The ca\_cert parameter can point to a file which contains one or more CA certificates which will be used to validate the certificate. With that option you also have the ability to specify a substring match of the certificate's common name.
| |
| − | | |
| − | In our configuration we opted for a much stronger level of validation where in we specify the hash of the certificate that we expect to see. When using this method of certificate validation, you specify the ca_cert parameter as hash://server/sha256/<sha256 hash of DER encoded certificate>.
| |
| − | | |
| − | In order to generate the sha256 hash of the DER encoded certificate (so that you can validate that the above hash is correct), download the certificate by clicking the "Download" link on the [https://ash.eprov.seti.vt.edu/EJBCAWebRequest/certSearch?cmd=search&keyword=VT-Wireless Certifcate Search for VT-Wireless]
| |
| − | | |
| − | Validate that the certificate downloaded is in fact signed by the Virginia Tech Certificate Authority:
| |
| − | | |
| − | (TODO)
| |
| − | Then generate the sha256 hash (in the directory where the certificate downloaded to):
| |
| − | | |
| − | openssl x509 -in VT-Wireless.cns.vt.edu.crt -outform der | sha256sum
| |
| − | 216c5f2568c6e84860b12535efe93500623ccee999306b84260f951bcbd57b1a -
| |
| − | | |
| − | ==netctl==
| |
| − | [https://wiki.archlinux.org/index.php/netctl netctl] is a network manager which is native to the ArchLinux distribution. netctl makes use of wpa_supplicant under the hood, and so the configuration is similar.
| |
| − | | |
| − | ===eduroam (preferred)===
| |
| − | Put the following configuration in /etc/netctl/eduroam with your proper PID and Network Password. Further, this assumes that your wireless network device is wlan0, which you might have to change to match your system. The ca_cert line pins the server certificate and can be generated/validated using the mechanism described above.
| |
| − | | |
| − | Description='Federated Educational Wifi Network'
| |
| − | Interface=wlan0
| |
| − | Connection=wireless
| |
| − | Security=wpa-configsection
| |
| − |
| |
| − | IP=dhcp
| |
| − | IP6=stateless
| |
| − |
| |
| − | WPAConfigSection=(
| |
| − | 'ssid="eduroam"'
| |
| − | 'proto=RSN'
| |
| − | 'key_mgmt=WPA-EAP'
| |
| − | 'eap=PEAP'
| |
| − | 'phase2="auth=MSCHAPV2"'
| |
| − | 'anonymous_identity="anonymous@vt.edu"'
| |
| − | 'ca_cert="hash://server/sha256/216c5f2568c6e84860b12535efe93500623ccee999306b84260f951bcbd57b1a"'
| |
| − |
| |
| − | 'identity="YourPidHere@vt.edu"'
| |
| − | 'password="YourNetworkPasswordHere"'
| |
| − | )
| |
| − | | |
| − | Ensure that this file is owned by root and only readable by root:
| |
| − | | |
| − | $ sudo chown root:root /etc/netctl/eduroam
| |
| − | $ sudo chmod 600 /etc/netctl/eduroam
| |
| − | | |
| − | You can then start the connection using standard netctl methods:
| |
| − | | |
| − | $ sudo netctl start eduroam
| |
| − | | |
| − | ===For VT-Wireless (legacy)===
| |
| − | Tested on [[Arch Linux]] with netctl 0.8 (updated on 2013-04-12).
| |
| − | | |
| − | * Create a file, '''/etc/netctl/VT-Wireless''' and place this in it:
| |
| − | Description="VT-Wireless PEAP-MSCHAPv2"
| |
| − | Interface=wlan0
| |
| − | Connection=wireless
| |
| − | Security=wpa-configsection
| |
| − |
| |
| − | IP=dhcp
| |
| − | IP6=stateless
| |
| − |
| |
| − | WPAConfigSection=(
| |
| − | 'ssid="VT-Wireless"'
| |
| − | 'proto=RSN'
| |
| − | 'key_mgmt=WPA-EAP'
| |
| − | 'eap=PEAP'
| |
| − | 'phase2="auth=MSCHAPV2"'
| |
| − | 'identity="YOUR IDENTITY"'
| |
| − | 'password="NETWORK PASSWORD"
| |
| − | 'ca_cert="/etc/ssl/certs/GlobalSign_Root_CA.pem"'
| |
| − | )
| |
| − | | |
| − | Make sure to change '''IDENTITY''' to your {{{identity|PID}}}, and '''NETWORK PASSWORD''' to your network password.
| |
| − | | |
| − | * After creating this file, make sure to change the owner to root (<code>sudo chown root:root /etc/netctl/VT-Wireless</code>) and change the permissions so that it can be read only by the owner (<code>sudo chmod 0600 /etc/netctl/VT-Wireless</code>). This will ensure that your private key password cannot be read by others easily.
| |
| − | | |
| − | * To connect, simply type the following in a terminal:
| |
| − | sudo netctl start VT-Wireless
| |
| − | | |
| − | ==References==
| |
| − | <references/>
| |
| − | | |
| − | [[Category:Howtos]]
| |
