Connecting to Campus Networks on Linux - Revision history

D2wn: update sha1sum

2025-01-20T20:29:24Z

update sha1sum

← Older revision		Revision as of 20:29, 20 January 2025
Line 85:		Line 85:
	Confirm that you have the correct file, and if so move it to <code>/var/lib/iwd/eduroam.pem</code>:		Confirm that you have the correct file, and if so move it to <code>/var/lib/iwd/eduroam.pem</code>:

	<code>echo "~~736c7004527b8d42c27526a5e8ad67b39f395d2d~~ eduroam.pem" \| sha1sum -c && sudo mv eduroam.pem /var/lib/iwd/eduroam.pem</code>		<code>echo "6f721c8150972c401148464c71c2c3701a031932 eduroam.pem" \| sha1sum -c && sudo mv eduroam.pem /var/lib/iwd/eduroam.pem</code>

	If the command returns <code>eduroam.pem: FAILED</code>, proceed to the section below. Otherwise, skip it and proceed to "'''Connecting to eduroam'''".		If the command returns <code>eduroam.pem: FAILED</code>, proceed to the section below. Otherwise, skip it and proceed to "'''Connecting to eduroam'''".

D2wn: change sed to grep

2025-01-20T20:27:27Z

change sed to grep

← Older revision		Revision as of 20:27, 20 January 2025
Line 81:		Line 81:
	Next, you need Tech's eduroam certificate. You can get it by parsing eduroam's "Configuration Assistant Tool" python script from their website:		Next, you need Tech's eduroam certificate. You can get it by parsing eduroam's "Configuration Assistant Tool" python script from their website:

	<code>curl -s '<nowiki>https://cat.eduroam.org/user/API.php?action=downloadInstaller&lang=en&profile=3932&device=linux&generatedfor=user&openroaming=0'</nowiki> \| ~~sed~~ -e ~~'s/Config.CA~~ ~~= """//g~~' -ne ~~'1083,1152p~~' > eduroam.pem</code>		<code>curl -s '<nowiki>https://cat.eduroam.org/user/API.php?action=downloadInstaller&lang=en&profile=3932&device=linux&generatedfor=user&openroaming=0'</nowiki> \| grep -Pzo -- '-----BEGIN CERTIFICATE-----(\n\|.)*-----END CERTIFICATE-----' > eduroam.pem</code>

	Confirm that you have the correct file, and if so move it to <code>/var/lib/iwd/eduroam.pem</code>:		Confirm that you have the correct file, and if so move it to <code>/var/lib/iwd/eduroam.pem</code>:

D2wn: Changed small formatting and added background to iwd

2024-07-17T05:22:12Z

Changed small formatting and added background to iwd

← Older revision		Revision as of 05:22, 17 July 2024
Line 47:		Line 47:

	=== iwd ===		=== iwd ===
			If you use Intel's wireless daemon, you can't add the network from the iwctl utility and must instead manually create a configuration file with all the details about the network.

	Create the following file in <code>/var/lib/iwd/eduroam.8021x</code>:		Create the following file in <code>/var/lib/iwd/eduroam.8021x</code>:

Line 69:		Line 71:

	Type your password, immediately followed by <code>CTRL+D</code> (You may need to press it twice). '''DO NOT PRESS <code>ENTER</code>!''' Pressing enter will mess up the hash, and you will not be able to authenticate to Tech's network with it!		Type your password, immediately followed by <code>CTRL+D</code> (You may need to press it twice). '''DO NOT PRESS <code>ENTER</code>!''' Pressing enter will mess up the hash, and you will not be able to authenticate to Tech's network with it!



Line 75:		Line 78:
	This is of course not advisable for security reasons, but it is technically an option if you cannot get the previous method to work.		This is of course not advisable for security reasons, but it is technically an option if you cannot get the previous method to work.

	==== Getting the certificate (the easy way): ====		==== Getting the certificate (the easy way) ====
	Next, you need Tech's eduroam certificate. You can get it by parsing eduroam's "Configuration Assistant Tool" python script from their website:		Next, you need Tech's eduroam certificate. You can get it by parsing eduroam's "Configuration Assistant Tool" python script from their website:

Line 86:		Line 89:
	If the command returns <code>eduroam.pem: FAILED</code>, proceed to the section below. Otherwise, skip it and proceed to "'''Connecting to eduroam'''".		If the command returns <code>eduroam.pem: FAILED</code>, proceed to the section below. Otherwise, skip it and proceed to "'''Connecting to eduroam'''".

	==== Getting the certificate (the hard way): ====		==== Getting the certificate (the hard way) ====
	Open [https://cat.eduroam.org cat.eduroam.org] in your browser, and navigate through the site until you reach the page to download the configuration script for Michigan Tech.		Open [https://cat.eduroam.org cat.eduroam.org] in your browser, and navigate through the site until you reach the page to download the configuration script for Michigan Tech.

Line 98:		Line 101:
	Now you can proceed to "'''Connecting to eduroam'''".		Now you can proceed to "'''Connecting to eduroam'''".

	==== Connecting to eduroam: ====		==== Connecting to eduroam ====
	You should be all good to go! Just connect to eduroam in <code>iwctl</code> and it should take care of the rest for you.		You should be all good to go! Just connect to eduroam in <code>iwctl</code> and it should take care of the rest for you.

Line 151:		Line 154:
	</syntaxhighlight>Where <code><USER></code> is the username of your account on your Linux computer, <code><MTU_ID></code> is your MTU Student ID (such as <code>noahholl</code>) and <code><PASSWORD></code> is your MTU password in plaintext.		</syntaxhighlight>Where <code><USER></code> is the username of your account on your Linux computer, <code><MTU_ID></code> is your MTU Student ID (such as <code>noahholl</code>) and <code><PASSWORD></code> is your MTU password in plaintext.

	==== Connecting to MichiganTech: ====		==== Connecting to MichiganTech ====
	You should be all good to go, so try connecting to MichiganTech via <code>nmcli</code>, <code>nmtui</code>, or one of the many NetworkManager GUIs (whichever you prefer)!		You should be all good to go, so try connecting to MichiganTech via <code>nmcli</code>, <code>nmtui</code>, or one of the many NetworkManager GUIs (whichever you prefer)!

Line 177:		Line 180:

	Type your password, immediately followed by <code>CTRL+D</code> (You may need to press it twice). '''DO NOT PRESS <code>ENTER</code>!''' Pressing enter will mess up the hash, and you will not be able to authenticate to Tech's network with it!		Type your password, immediately followed by <code>CTRL+D</code> (You may need to press it twice). '''DO NOT PRESS <code>ENTER</code>!''' Pressing enter will mess up the hash, and you will not be able to authenticate to Tech's network with it!



Line 183:		Line 187:
	This is of course not advisable for security reasons, but it is technically an option if you cannot get the previous method to work.		This is of course not advisable for security reasons, but it is technically an option if you cannot get the previous method to work.

	==== Connecting to MichiganTech: ====		==== Connecting to MichiganTech ====
	You should be all good to go! Just connect to MichiganTech in <code>iwctl</code> and it should take care of the rest for you.		You should be all good to go! Just connect to MichiganTech in <code>iwctl</code> and it should take care of the rest for you.

Line 225:		Line 229:

	== MichiganTechIoT ==		== MichiganTechIoT ==
	AFAIK, this network is like MichiganTechOpen (open ~~security~~, devices need to be MAC whitelisted) but devices are allowed to communicate between each other on the LAN.		AFAIK, this network is like MichiganTechOpen (open network, devices need to be MAC whitelisted) but devices are allowed to communicate between each other on the LAN.

	Primarily intended for IoT devices and gaming consoles.		Primarily intended for IoT devices and gaming consoles.
Line 264:		Line 268:

	<nowiki>https://wiki.archlinux.org/title/Wpa_supplicant#Advanced_usage</nowiki>		<nowiki>https://wiki.archlinux.org/title/Wpa_supplicant#Advanced_usage</nowiki>




	__FORCETOC__		__FORCETOC__
			[[Category:Michigan Technological University]]

D2wn: made initial entry

2024-07-17T02:19:25Z

made initial entry

New page

This aims to be an all-inclusive guide on connecting to every type of network Michigan Tech uses on Campus on a Linux machine. If you use Windows, follow [https://www.youtube.com/watch?v=_BoqSxHTTNs this guide] instead :P

'''If you run into any problems following these instructions, or just want someone to walk you through it step-by-step, feel free to ask for help in the #tech-support channel in LUG's [https://discord.gg/5mZUgcNWAK Discord] or [ircs://lug.mtu.edu:6697 IRC] and we'll be happy to help you out'''

== eduroam ==
[[eduroam]] is a collaborative project between institutions that allow students at one participating university to get an internet connection at any other participating universities with their university credentials, by connecting to the eduroam network there.

Also, for some reason, it's typically the most reliable network on Tech's campus (yes, even more reliable than the actual MichiganTech network).

=== NetworkManager ===
'''NOTE: This whole section needs work, it's just here as a placeholder. Ask in the Discord/IRC if you need help.'''
If you use NetworkManager (the default on most distros), for some reason WPA2-EAP networks (such as eduroam) must be configured by manually creating a config file and cannot be added in the GUI.

As such, you can add eduroam as a connectable network by putting the following contents in <code>/etc/NetworkManager/system-connections/eduroam.nmconnection</code>:

''[ NOTE: I think the UUID is supposed to be generated on-demand? ]''<syntaxhighlight lang="toml">
[connection]
id=eduroam
uuid=1b5b76ef-7a0a-4160-ae51-1c110cf160b7
type=wifi
autoconnect=false
permissions=user:<USER>:;

[wifi]
mode=infrastructure
ssid=eduroam

[wifi-security]
key-mgmt=wpa-eap

[802-1x]
eap=peap;
identity=<MTU_ID>
password=<PASSWORD>
phase2-auth=mschapv2

[ipv4]
method=auto

[ipv6]
addr-gen-mode=stable-privacy
method=auto

[proxy]
</syntaxhighlight>Where <code><USER></code> is the username of your account on your Linux computer, <code><MTU_ID></code> is your MTU Student ID (such as <code>noahholl</code>) and <code><PASSWORD></code> is your MTU password in plaintext.

=== iwd ===
Create the following file in <code>/var/lib/iwd/eduroam.8021x</code>:

''[ NOTE: This config has <code>AlwaysRandomizeAddress=true</code>, which will randomize your WiFi card's MAC address on each connection. While not required, it can be nice to preserve your privacy when connecting to foreign networks. ]''<syntaxhighlight lang="toml">
[Settings]
AutoConnect=true
AlwaysRandomizeAddress=true

[Security]
EAP-Method=PEAP
EAP-Identity=anonymous@mtu.edu
EAP-PEAP-CACert=/var/lib/iwd/eduroam.pem
EAP-PEAP-ServerDomainMask=www.login.mtu.edu
EAP-PEAP-Phase2-Method=MSCHAPV2
EAP-PEAP-Phase2-Identity=<MTU_ID>@mtu.edu
EAP-PEAP-Phase2-Password-Hash=<PASSWORD_HASH>
</syntaxhighlight>Where <code><MTU_ID></code> is your MTU Student ID (such as <code>noahholl</code>) and <code><PASSWORD_HASH></code> is the MsCHAPv2 hash of your MTU password.

You can generate the MsCHAPv2 hash for your MTU password by running the following command:

<code>iconv -t utf16le | openssl md4 -provider legacy</code>

Type your password, immediately followed by <code>CTRL+D</code> (You may need to press it twice). '''DO NOT PRESS <code>ENTER</code>!''' Pressing enter will mess up the hash, and you will not be able to authenticate to Tech's network with it!

Alternatively, instead of <code>EAP-PEAP-Phase2-Password-Hash=<PASSWORD_HASH></code>, you can put <code>EAP-PEAP-Phase2-Password=<PASSWORD></code>, and you would replace <code><PASSWORD></code> with your actual MTU password, in plaintext.

This is of course not advisable for security reasons, but it is technically an option if you cannot get the previous method to work.

==== Getting the certificate (the easy way): ====
Next, you need Tech's eduroam certificate. You can get it by parsing eduroam's "Configuration Assistant Tool" python script from their website:

<code>curl -s '<nowiki>https://cat.eduroam.org/user/API.php?action=downloadInstaller&lang=en&profile=3932&device=linux&generatedfor=user&openroaming=0'</nowiki> | sed -e 's/Config.CA = """//g' -ne '1083,1152p' > eduroam.pem</code>

Confirm that you have the correct file, and if so move it to <code>/var/lib/iwd/eduroam.pem</code>:

<code>echo "736c7004527b8d42c27526a5e8ad67b39f395d2d eduroam.pem" | sha1sum -c && sudo mv eduroam.pem /var/lib/iwd/eduroam.pem</code>

If the command returns <code>eduroam.pem: FAILED</code>, proceed to the section below. Otherwise, skip it and proceed to "'''Connecting to eduroam'''".

==== Getting the certificate (the hard way): ====
Open [https://cat.eduroam.org cat.eduroam.org] in your browser, and navigate through the site until you reach the page to download the configuration script for Michigan Tech.

Once you've downloaded the script, open it with a text editor and look for the two certificates.

They should be back-to-back, each beginning with <code>-----BEGIN CERTIFICATE-----</code> and ending with <code>-----END CERTIFICATE-----</code>.

Copy both certificates into the file <code>eduroam.pem</code>, then move the file to <code>/var/lib/iwd/eduroam.pem</code>:

<code>sudo mv eduroam.pem /var/lib/iwd/eduroam.pem</code>
Now you can proceed to "'''Connecting to eduroam'''".

==== Connecting to eduroam: ====
You should be all good to go! Just connect to eduroam in <code>iwctl</code> and it should take care of the rest for you.

In case you're new to iwd, this can be done by running <code>iwctl</code>, typing <code>station list</code>(identifying the interface of your WiFi card), then <code>station <interface> connect eduroam</code>.

Now you can <code>quit</code> out of iwctl and you should remain connected!

=== wpa_supplicant ===
'''NOTE: This whole section needs work, it's just here as a placeholder. Ask in the Discord/IRC if you need help.'''
wpa_supplicant is commonly used as a backend for NetworkManager, but if you use it standalone, you can use the following config

== MichiganTech ==
The MichiganTech network is WPA2-EAP, using PEAP and MSCHAPv2. The configuration needed to connect to the network is similar to that of eduroam, with a few notable differences.

For some reason IT recommends ignoring certificate errors for the MichiganTech network, opening users up to potential [https://en.wikipedia.org/wiki/Evil_twin_(wireless_networks) Evil Twin attacks]. We should eventually add sections on how to get the certificate for the network and enable certificate checking, but in the meantime since this is the configuration everyone is using I suppose it's good enough.

=== NetworkManager ===
'''NOTE: This whole section needs work, it's just here as a placeholder. Ask in the Discord/IRC if you need help.'''
If you use NetworkManager (the default on most distros), for some reason WPA2-EAP networks (such as MichiganTech) must be configured by manually creating a config file and cannot be added in the GUI.

As such, you can add MichiganTech as a connectable network by putting the following contents in <code>/etc/NetworkManager/system-connections/MichiganTech.nmconnection</code>:

''[ NOTE: I think the UUID is supposed to be generated on-demand? ]''<syntaxhighlight lang="toml">
[connection]
id=MichiganTech
uuid=0c38e990-aa9c-4d61-8e7e-f2ae28f2787d
type=wifi
autoconnect=true
permissions=user:<USER>:;

[wifi]
mode=infrastructure
ssid=MichiganTech

[wifi-security]
key-mgmt=wpa-eap

[802-1x]
eap=peap;
identity=<MTU_ID>
password=<PASSWORD>
phase2-auth=mschapv2

[ipv4]
method=auto

[ipv6]
addr-gen-mode=stable-privacy
method=auto

[proxy]
</syntaxhighlight>Where <code><USER></code> is the username of your account on your Linux computer, <code><MTU_ID></code> is your MTU Student ID (such as <code>noahholl</code>) and <code><PASSWORD></code> is your MTU password in plaintext.

==== Connecting to MichiganTech: ====
You should be all good to go, so try connecting to MichiganTech via <code>nmcli</code>, <code>nmtui</code>, or one of the many NetworkManager GUIs (whichever you prefer)!

=== iwd ===
Create the following file in <code>/var/lib/iwd/MichiganTech.8021x</code>:

''[ NOTE: This config has <code>AlwaysRandomizeAddress=true</code>, which will randomize your WiFi card's MAC address on each connection. While not required, it can be nice to preserve your privacy when connecting to foreign networks. ]''<syntaxhighlight lang="toml">
[Settings]
AutoConnect=true
AlwaysRandomizeAddress=true

[Security]
EAP-Method=PEAP
EAP-Identity=anonymous
EAP-PEAP-Phase2-Method=MSCHAPV2
EAP-PEAP-Phase2-Identity=<MTU_ID>
EAP-PEAP-Phase2-Password-Hash=<PASSWORD_HASH>

</syntaxhighlight>Where <code><MTU_ID></code> is your MTU Student ID (such as <code>noahholl</code>) and <code><PASSWORD_HASH></code> is the MsCHAPv2 hash of your MTU password.

You can generate the MsCHAPv2 hash for your MTU password by running the following command:

<code>iconv -t utf16le | openssl md4 -provider legacy</code>

Type your password, immediately followed by <code>CTRL+D</code> (You may need to press it twice). '''DO NOT PRESS <code>ENTER</code>!''' Pressing enter will mess up the hash, and you will not be able to authenticate to Tech's network with it!

Alternatively, instead of <code>EAP-PEAP-Phase2-Password-Hash=<PASSWORD_HASH></code>, you can put <code>EAP-PEAP-Phase2-Password=<PASSWORD></code>, and you would replace <code><PASSWORD></code> with your actual MTU password, in plaintext.

This is of course not advisable for security reasons, but it is technically an option if you cannot get the previous method to work.

==== Connecting to MichiganTech: ====
You should be all good to go! Just connect to MichiganTech in <code>iwctl</code> and it should take care of the rest for you.

In case you're new to iwd, this can be done by running <code>iwctl</code>, typing <code>station list</code>(identifying the interface of your WiFi card), then <code>station <interface> connect MichiganTech</code>.

Now you can <code>quit</code> out of iwctl and you should remain connected!

=== wpa_supplicant ===
'''NOTE: This whole section needs work, it's just here as a placeholder. Ask in the Discord/IRC if you need help.'''
wpa_supplicant is commonly used as a backend for NetworkManager, but if you use it standalone, you can use the following config to connect to the MichiganTech network:<syntaxhighlight lang="toml">
ctrl_interface=/run/wpa_supplicant
ap_scan=1
network={
key_mgmt=WPA-EAP
eap=PEAP
identity="<MTU_ID>"
password="<PASSWORD>"
phase2="autheap=MSCHAPV2"
}
</syntaxhighlight>Where <code><MTU_ID></code> is your MTU Student ID (such as <code>noahholl</code>) and <code><PASSWORD></code> is your MTU password, in plaintext. (does wpa_supplicant support MsCHAPv2 hashes?)

==== Connecting to MichiganTech: ====
You should be all good to go!

== MichiganTechGuest ==
MichiganTechGuest is an open network, you just have to accept the Terms and Conditions on the captive portal before you have internet access.

If you're having issues getting the captive portal to popup, try loading an http-only site such as [http://neverssl.com neverssl.com] or [http://captive.apple.com/hotspot-detect.html Apple's captive portal check domain].

However, it seems direct IP connections work without authenticating on the captive portal? If you have a VPN on, you can just skip accepting the ToC and access the internet as normal. (very useful when wpa_supplicant broke WPA2-EAP support leaving Linux users unable to connect to the proper MichiganTech WiFi)

The guest network has a weird IP range (<code>35.63.66.0/23</code>), it's not in Tech's normal <code>141.219.0.0/16</code>. (Perhaps to avoid getting the main IP range banned due to abuse?)

//todo

include my bash script that auto-confirms the ToC via a post request with curl (90% done, needs to wait until I'm back on campus to finish)

include how to auto run a script on interface up/down to auto re-authenticate yourself after taking laptop out of sleep mode

== MichiganTechIoT ==
AFAIK, this network is like MichiganTechOpen (open security, devices need to be MAC whitelisted) but devices are allowed to communicate between each other on the LAN.

Primarily intended for IoT devices and gaming consoles.

<nowiki>https://clearpass.tc.mtu.edu/guest/guest_index.php</nowiki> (have to be on Tech's network otherwise it 403's)

== MichiganTechOpen ==
For devices that don't support WPA2-EAP and can't connect to the main MichiganTech network.

It's an open network, but you have to whitelist your devices MAC address in clearpass first.

<nowiki>https://clearpass.tc.mtu.edu/guest/guest_index.php</nowiki> (have to be on Tech's network otherwise it 403's)

== Resnet ==
MAC register ethernet (dorms, datacenters are handled by IT?)

You should be able to just plug your device into an ethernet port connected to Resnet, and navigate to the clearpass URL to whitelist your device

<nowiki>https://clearpass.tc.mtu.edu/guest/guest_index.php</nowiki> (have to be on Tech's network otherwise it 403's)

Sources

<nowiki>https://wiki.ritlug.com/eduroam/</nowiki>

<nowiki>https://wiki.archlinux.org/title/Network_configuration/Wireless#eduroam</nowiki>

<nowiki>https://wiki.archlinux.org/title/Iwd#WPA_Enterprise</nowiki>

<nowiki>https://wiki.archlinux.org/title/Wpa_supplicant#Advanced_usage</nowiki>
__FORCETOC__