Changes

<!--There are three wireless networks on campus. One network, called VT-Wireless, encrypts all traffic and is secured with [[EAP-TLS]] or PEAP-MSCHAPv2. A second network, CONNECTtoVT-Wireless, is an unencrypted, captive portal wireless network designed to set up connecting to VT-Wireless without offering Internet access. Due to user issues faced during deployment, CONNECTtoVT-Wireless began offering captive portal access to VT users.-->On campus, there are 2 wireless networks. '''Eduroameduroam''' is the preferred method, which uses PEAP-MSCHAPv2 to authenticate to the RADIUS server, while the second SSID, '''VirginiaTech''', provides a captive-portaland allows for guest account creation.

As of January 2015 the [https://www.computing.vt.edu/content/eduroam preferred method] of wireless access at Virginia Tech is through the [https://eduroam.org/ Eduroameduroam] network. Eduroam eduroam is a secure wireless access service that was developed for the use of research and educational institutions. One of the advantages of the Eduroam network over the VT-Wireless eduroam network is that you will be able to connect to the Internet at any participating institution using your Virginia Tech credentials. The Eduroameduroam-US site provides a [https://www.eduroam.us/technical_overview technical overview] of how the network authenticates you to the Virginia Tech RADIUS servers.

The following settings are recommended for connecting to the Eduroam eduroam network:

* '''Root CA:''' [https://2029.globalsign.com GlobalSign Root CA - R3] "USERTrust RSA Certification Authority" or pin the certificate (see below)

* GlobalSign Root CA - R3 USERTrust RSA Certification Authority** Trusted Root CA SHA256 G2*** Virginia Tech Global Qualified InCommon RSA Server CA**** eduroam.nis.vt.edu

====GlobalSign Root CA - R3USERTrust RSA Certification Authority====

''Filename:'' GlobalSign_Root_CA_-_R3USERTrust_RSA_Certification_Authority.pem

''Subject:'' OU C = GlobalSign Root CA - R3US, ST = New Jersey, L = Jersey City, O = GlobalSignThe USERTRUST Network, CN = GlobalSignUSERTrust RSA Certification Authority

This is a common root CA and should have shipped with your OS. It is likely located in <code>/etc/ssl/certs/GlobalSign_Root_CA_-_R3USERTrust_RSA_Certification_Authority.pem</code>. If Note that if you follow the Authority Information Access of the intermediate certificate, it may direct you are unable to locate it a URL which points to a different version of this certficate, which is cross signed by AddTrust and expires in May 2020. The one in your OS, you can get it directly cert store is self-signed and expires in 2038. You want the one from [https://2029.globalsign.com/ GlobalSign]your cert store.

====Trusted Root InCommon RSA Server CA SHA256 G2====

''Filename:'' TrustedRootCASHA256G2InCommonRSAServerCA_2.pem

''Subject:'' C = BEUS, OU ST = MI, L = Trusted RootAnn Arbor, O = GlobalSign nv-saInternet2, OU = InCommon, CN = Trusted Root InCommon RSA Server CA SHA256 G2

This is an intermediate certificate, again issued by GlobalSignInCommon. You can get it directly from GlobalSign InCommon [httpshttp://supportcrt.globalsignusertrust.com/customer/portal/articles/1211591-trusted-root-intermediate-certificates InCommonRSAServerCA_2.crt here]. ====Virginia Tech Global Qualified Server CA==== ''Filename:'' VirginiaTechGlobalQualifiedServerCA.pem ''Subject:'' C = US, ST = Virginia, L = Blacksburg, OU = Global Qualified Server CA, O = Virginia Polytechnic Institute and State University, CN = Virginia Tech Global Qualified Server CA This can be obtained from the Virginia Tech PKI [http://www.pki.vt.edu/developer/rootca.html#globalqualifiedserver website]. This website is only available from VT IP addresses (including VPN). Although certificates higher in the chain are also provided here, the page does ''not'' support https. '''''DO NOT''''' get your root CA here.

''Filename:'' eduroam.nis.vt.edu.crtpem

''Subject:'' C = US, postalCode = 24061, ST = Virginia, L = Blacksburg, street = 800 Washington St. SW, O = Virginia Polytechnic Institute and State University, OU = Secure Identity Services, CN = eduroam.nis.vt.edu

This can be obtained from the [https://appscerts.pkiit.vt.edu/ca-manager/search VTCA VT Certificate Manager]. This requires PID login. Search for "eduroam.nis.vt.edu". '''Note''': As of 2017 June 19, there will be 2 results, due to some internal testing. Download Grab the certificate with the serial 3699307517ED7E8B. The certificate with serial 7A083CC134D0303D is ''incorrect''most recently issued.

<pre>$ cat GlobalSign_Root_CA_-_R3USERTrust_RSA_Certification_Authority.pem TrustedRootCASHA256G2InCommonRSAServerCA_2.pem VirginiaTechGlobalQualifiedServerCA.pem >> ca.pem</pre>

<pre>$ openssl verify -verbose -purpose sslserver -CAfile ca.pem eduroam.nis.vt.edu.crtpemeduroam.nis.vt.edu.crtpem: OK</pre>

$ openssl x509 -in VT-Wirelesseduroam.cnsnis.vt.edu.crt -outform der | sha256sum

We encourage you to take precautions against network eavesdropping and mischief (on the Eduroam eduroam network, and in general). Potential countermeasures that one might want to employ include using [https://www.eff.org/HTTPS-EVERYWHERE HTTPS when connecting to sites], using a [https://www.computing.vt.edu/content/virtual-private-network VPN], or using the [https://www.torproject.org/ Tor Browser Bundle].

* In your the list of wireless configuration programnetworks, select "eduroam".Set the following options: * Choose Wi-Fi security: WPA & WPA2 Enterprise* Authentication: Protected EAP (PEAP as the EAP type.)* Choose MSCHAPv2 as the authentication methodAnonymous identity: anonymous@vt.edu* Use PID@Domain: nis.vt.edu and network passphrase as your login credentials* CA certificate: Select <code>/path/to/USERTrust_RSA_Certification_Authority.pem</code> via the file picker* PEAP version: Automatic* Inner authentication: MSCHAPv2* Use anonymousUsername: PID@vt.edu as your Anonymous Identity* '''TODOPassword: YOUR_NETWORK_PASSWORD [[File:''' Certificate verification (Warning, until certificate verification is added, it is ''not'' recommended that you use this method of accessing the networkNm settings.)png]]

#alternately, if you can use this line below, but it is less secure than pinning prefer to dynamically validate the cert!certificate by its cryptographic attributes ca_cert="/path/to/USERTrust_RSA_Certification_Authority.pem" domain_match="VT-Wirelesseduroam.cnsnis.vt.edu"

On [[OpenBSD]], the process is a little more complicated:  # ifconfig wlan0 nwid eduroam wpa wpaakms 802.1x up # /usr/local/sbin/wpa_supplicant -B -i wlan0 -c /etc/wpa_supplicant.conf # dhclient wlan0 # ifconfig wlan0 inet6 autoconf Alternate config options, besides domain_match and ca_cert are as follows (obviously not correct):

domain_suffix_match="cnsnis.vt.edu"

More thourough thorough documentation is available at [https://w1.fi/cgit/hostap/plain/wpa_supplicant/wpa_supplicant.conf]

'domain_match="VT-Wirelesseduroam.cnsnis.vt.edu"'

CACertFile = /etc/ssl/certs/GlobalSign_Root_CA_-_R3USERTrust_RSA_Certification_Authority.pemDomainMatch = eduroam.nis.vt.edu

Eduroam eduroam at Virginia Tech is free for:* VT affiliates with VT-Wireless wireless entitlements (includes students) access and network passwords

* Your wifi probes identify The unencrypted portion of your authentication optionally identifies you as an eduroam user, "anonymous@vt.edu" rather than a VT affiliaterevealing your PID

The main disadvantage is that ===Does eduroam support EAP-TLS?===Currently, the Virginia Tech's eduroam implementation does RADIUS servers are not appear to support the deprecated [[configured for EAP-TLS]] system, while VT-Wireless does (as of February 2015).