Changes

=DateSince the fall of 2008, Time there have been two wireless networks on campus. One network, called '''VT-Wireless''', encrypts all traffic and Location=* Thursdayis secured with EAP-TLS or PEAP-MSCHAPv2. The other network, February 10th* 8:30pm - 10:30pm* 261 called [[Durham HallVT_WLAN]]was an unencrypted network captive portal using PID authentication. In July, 2013 VT_WLAN was superseded by CONNECTtoVT-Wireless, an unencrypted, captive portal wireless network designed to set up connecting to VT-Wireless without offering Internet access. Due to user issues faced during deployment, CONNECTtoVT-Wireless began offering captive portal access to VT users. In January 2015, '''eduroam''' access was enabled, allowing members of any eduroam-affiliated institution to use wifi at any other institution. Connections to VT-Wireless and eduroam are secure by default, and has one of two different methods to connect.

=Agenda=* Announcements** T-shirt progress** Wargame update** Should we host design team files and how?** Yi was today* As of January 2015 the [[CCDC]]** Review results** Lessons learned** Plans for next year* [httphttps://vtnewswww.computing.vt.edu/articlescontent/eduroam preferred method] of wireless access at Virginia Tech is through the [https:/2011/02eduroam.org/020811Eduroam] network. Eduroam is a wireless access service that was developed for the use of research and educational institutions. One of the advantages of the Eduroam network over the VT-unirelWireless network is that you will be able to connect to the Internet at any participating institution using your Virginia Tech credentials. The Eduroam-password.html Required password change]* US site provides a [httphttps://secretgeekeduroam.netus/fuv_intro.asp fuv]* Should we run Bugzilla?** No* SSL** GPG-signed SSL fingerprints** Monkeysphere!* Add [[OpenNIC]technical_overview technical overview] of how the network authenticates you to services on about pagethe Virginia Tech RADIUS servers.

=Hacking=* Purchase <!-- '''PEAP-MSCHAPv2''' is a wireless authentication scheme used by Virginia Tech as an alternative to [[Hardware_Selection_Task_Force#To_Purchase|new partsEAP-TLS]]* Better publicize SEC support on OSM rendering, git, wikis* Fix acidburn firewall so the Frozen Bubble server gets listed globally* Frozen Bubble again?for connections to [[VT-Wireless]]. -->

=External Links=Connection information==* [https://secure.hosting.vt.edu/www.calendar.vt.edu/main.php?view=event&eventid=1296004805041 VT Calendar entry]=eduroam===The following settings are recommended for connecting to the Eduroam network:

* SSID: eduroam* EAP: PEAP* Phase 2: MSCHAPv2* Identity: pid@vt.edu (So if your PID was "hokiebird", hokiebird@vt.edu)* Anonymous Identity: anonymous@vt.edu* Password: [https://www.computing.vt.edu/kb/entry/3765 Your Network Password] ====RADIUS certificates====The certificate verification methods vary greatly between different network managers, but the certificate currently in use for the Virginia Tech RADIUS servers is available from the [https://ash.eprov.seti.vt.edu/EJBCAWebRequest/certSearch?cmd=search&keyword=VT-Wireless PKI Certificate Search site] and the certificate chain is the (Obsolete) [https://secure.hosting.vt.edu/www.pki.vt.edu/developer/rootca.html#globalserver Virginia Tech Global Server CA] chain. Unfortunately, the PKI Certificate Search is only available from campus IPs. ====Certificate pinning==== Many network managers for Linux/UNIX use wpa_supplicant as their underlying IEEE 802.1x/WPA Supplicant and generate a configuration file on the fly. As a result many network managers have similar configuration formats. In this section we will walk through generating a certificate pin for the Certificate used to authenticate the VT RADIUS servers in eduroam. wpa_supplicant offers multiple mechanisms for certificate management. The ca_cert parameter can point to a file which contains one or more CA certificates which will be used to validate the certificate. With that option you also have the ability to specify a substring match of the certificate's common name. In our configuration we opted for a much stronger level of validation where in we specify the hash of the certificate that we expect to see. When using this method of certificate validation, you specify the ca_cert parameter as hash://server/sha256/<sha256 hash of DER encoded certificate>. In order to generate the sha256 hash of the DER encoded certificate, download the certificate by clicking the "Download" link on the [https://ash.eprov.seti.vt.edu/EJBCAWebRequest/certSearch?cmd=search&keyword=VT-Wireless Certificate Search for VT-Wireless] Validate that the certificate downloaded is in fact signed by the Virginia Tech Certificate Authority:  (TODO) Then generate the sha256 hash (in the directory where the certificate downloaded to):  openssl x509 -in VT-Wireless.cns.vt.edu.crt -outform der | sha256sum 216c5f2568c6e84860b12535efe93500623ccee999306b84260f951bcbd57b1a - It is recommended that you perform these steps yourself rather than trusting the certificate hash presented in the configurations below. '''Note:''' As we are pinning the certificate instead of relying on a PKI, when CNS rotates the certificates being used, the configuration will need to be updated to match the new certificate. ==A word of caution on MSCHAPv2==Warning: Use of PEAP-MSCHAPv2 to connect to the Virginia Tech network is strongly discouraged by the Linux and Unix Users Group due to attacks that can allow all traffic to be decrypted with a 100% success rate. Unfortunately, VT has deprecated its use so users will soon lose the choice to use certificates. At DefCon 20 in July 2012, an attack was announced for MSCHAPv2 that allows the protocol to be cracked quickly with a 100% success rate.<ref>[https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/]</ref> '''Use of MSCHAPv2 is strongly discouraged.'''  ==Set your remote access (network) passphrase==Regardless of what software you use to establish your connection, you must first set your remote passphrase by going to [https://my.vt.edu my.vt.edu]→Settings→Change Network Password. ==Android=====eduroam (preferred)===TODO=== VT-Wireless (legacy)==={{Version|2.2 (Froyo) of Android}} * From the home screen, press the menu button and choose "Settings"→"Wireless & networks"→"Wi-Fi settings".* Remove any existing entries for {{{networks|the network you'd like to add or any conflicting network}}}.* From the "WiFi networks" listing, click on {{{network|the network you'd like to add}}}.* Choose PEAP as the EAP method and MSCHAPv2 as the phase two authentication mechanism.* Enter your credentials for the identity and press "Connect". ==NetworkManager=====eduroam (preferred)===* In your wireless configuration program, select eduroam.* Choose PEAP as the EAP type.* Choose MSCHAPv2 as the authentication method.* Use PID@vt.edu and network passphrase as your login credentials.* Use anonymous@vt.edu as your Anonymous Identity* '''TODO:''' Certificate verification ===VT-Wireless (legacy)===* In your wireless configuration program, select VT-Wireless.* Choose PEAP as the EAP type.* Choose MSCHAPv2 as the authentication method.* Use your {{{identity|PID}}} and network passphrase as your login credentials. ==wpa_supplicant== ===For eduroam (preferred)===[http://w1.fi/wpa_supplicant/ wpa_supplicant] is a cross-platform supplicant which implements IEEE 802.1x/WPA and is used in many Linux/UNIX distributions. In order to connect to the eduroam network, add the following to <code>/etc/wpa_supplicant/eduroam.conf</code> modifying the identity and password to reflect your PID and Network Password:  ctrl_interface=DIR=/run/wpa_supplicant GROUP=wheel update_config=1 fast_reauth=1 ap_scan=1 network={ ssid="eduroam" proto=RSN key_mgmt=WPA-EAP eap=PEAP phase2="auth=MSCHAPV2" anonymous_identity="anonymous@vt.edu" ca_cert="hash://server/sha256/216c5f2568c6e84860b12535efe93500623ccee999306b84260f951bcbd57b1a" identity="YourPidHere@vt.edu" password="YourNetworkPasswordHere" } You can then connect to the network by running (where wlan0 is your wireless interface):  $ sudo wpa_supplicant -B -i wlan0 -c /etc/wpa_supplicant/eduroam.conf $ sudo dhcpcd wlan0 ===For VT-Wireless (legacy)===Add the following lines to <code>/etc/wpa_supplicant.conf</code>:  ctrl_interface=DIR=/run/wpa_supplicant GROUP=wheel update_config=1 fast_reauth=1 ap_scan=1 network={ ssid="VT-Wireless" proto=WPA2 key_mgmt=WPA-EAP eap=PEAP phase2="auth=MSCHAPV2" identity="your {{{identity|PID}}}" password="your passphrase" ca_cert="/etc/ssl/certs/GlobalSign_Root_CA.pem } ==netctl==[https://wiki.archlinux.org/index.php/netctl netctl] is a network manager which is native to the ArchLinux distribution. netctl makes use of wpa_supplicant under the hood, and so the configuration is similar. ===eduroam (preferred)===Put the following configuration in <code>/etc/netctl/eduroam</code> with your proper PID and Network Password. Further, this assumes that your wireless network device is wlan0, which you might have to change to match your system. The ca_cert line pins the server certificate and can be generated/validated using the mechanism described above.  Description='Federated Educational Wifi Network' Interface=wlan0 Connection=wireless Security=wpa-configsection IP=dhcp IP6=stateless WPAConfigSection=( 'ssid="eduroam"' 'proto=RSN' 'key_mgmt=WPA-EAP' 'eap=PEAP' 'phase2="auth=MSCHAPV2"' 'anonymous_identity="anonymous@vt.edu"' 'ca_cert="hash://server/sha256/216c5f2568c6e84860b12535efe93500623ccee999306b84260f951bcbd57b1a"' 'identity="YourPidHere@vt.edu"' 'password="YourNetworkPasswordHere"' ) Ensure that this file is owned by root and only readable by root:  $ sudo chown root:root /etc/netctl/eduroam $ sudo chmod 600 /etc/netctl/eduroam You can then start the connection using standard netctl methods:  $ sudo netctl start eduroam ===For VT-Wireless (legacy)===Tested on [[Arch Linux]] with netctl 0.8 (updated on 2013-04-12). * Create a file, '''/etc/netctl/VT-Wireless''' and place this in it: Description="VT-Wireless PEAP-MSCHAPv2" Interface=wlan0 Connection=wireless Security=wpa-configsection IP=dhcp IP6=stateless WPAConfigSection=( 'ssid="VT-Wireless"' 'proto=RSN' 'key_mgmt=WPA-EAP' 'eap=PEAP' 'phase2="auth=MSCHAPV2"' 'identity="YOUR IDENTITY"' 'password="NETWORK PASSWORD" 'ca_cert="/etc/ssl/certs/GlobalSign_Root_CA.pem"' ) Make sure to change '''IDENTITY''' to your {{{identity|PID}}}, and '''NETWORK PASSWORD''' to your network password. * After creating this file, make sure to change the owner to root (<code>sudo chown root:root /etc/netctl/VT-Wireless</code>) and change the permissions so that it can be read only by the owner (<code>sudo chmod 0600 /etc/netctl/VT-Wireless</code>). This will ensure that your private key password cannot be read by others easily. * To connect, simply type the following in a terminal: sudo netctl start VT-Wireless ==References==<references/> [[Category:VTLUUG:MeetingsHowtos]]