You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 2 Next »

When connecting to the eduroam wifi SSID on a Linux computer.


Connecting to the eduroam network is very similar to connecting to UVA's VPN on linux. See VPN Setup for details there.

Step-by-step guide

For this tutorial, our example compute ID will be "jjruv4".

To start, you'll need three different files to connect to the eduroam network: an usher/CA certificate file, a personal/user certificate file, and a private key file

  1. Download the usher/CA certificate (usher.cer) - Download the certificate file from https://download.its.virginia.edu/local-auth/universal/usher.cer

  2. Download your combined certificate (.p12 file)
    1. Head to https://in.virginia.edu/limited (alternative link: https://cloud.securew2.com/public/82116/limited/?device=Unknown) and log in with Netbadge (if not logged in already)
    2. The "Operating System" field should be "Unknown", give a short description of this where this certificate will be used.

    3. (Optional) Enter the MAC/hardware address of the wireless network card for your device. If you don't know your MAC address, you can find it by opening a terminal and using the ip a command, then finding the interface that corresponds to your wifi network card. It may begin with "wlp" in the ID. Then, the hexadecimal string following "link/ether" will be your MAC address.

    4. Enter a passphrase for your private key.

      This is not your netbadge login password, or any other UVA password. This is a unique passphrase used only for this certificate file.

      Make sure to record this passphrase and put it somewhere safe! This passphrase is required to use your certificate, and no one can recover it after the fact, not even UVA IT.


    5. You should now be able to download a file with the suffix ".p12".

      This is your certificate file, but it has the user certificate and the private key merged into one file. So, we need to split the it into two components.

  3. Extract your personal/user certificate (.crt file)
    1. Enter a terminal and navigate to the directory that has your .p12 file.
    2. Use the openssl command as described in https://serverfault.com/a/413836. Assuming your file name is jjruv4.p12:

      openssl pkcs12 -in jjruv4.p12 -clcerts -nokeys -out jjruv4_user_cert.crt


  4. Extract your private key (.key file)
    1. Similar to the previous step, enter your terminal and navigate to the directory with your .p12 file (if you haven't already).
    2. Use openssl with a different set of parameters to extract your private key file:

      openssl pkcs12 -in jjruv4.p12 -nocerts -out jjruv4.key

    3. This will ask for your import password, which is the passphrase you created to download your .p12 file from UVA.

    4. It will then ask for a PEM passphrase. This is a passphrase that you set now that will encrypt the contents of your .key file. This the first time you are setting this passphrase, so it is not your import passphrase, your UVA netbadge login password, or any other password.

      Make sure to record and store your PEM passphrase in a safe location! You cannot connect to the network without it. If you lose your PEM passphrase, there is no way to recover it, and you will have to extract the .key file again.

    5. (Optional) This step is not recommended. You can, and should, skip this step. Alternatively, you can create your .key file without a PEM passphrase and, therefore without any encryption, but this is very insecure! You can add the -nodes flag to the previous openssl command:

      openssl pkcs12 -in jjruv4.p12 -nocerts -nodes -out jjruv4.key

      See https://stackoverflow.com/a/54719547 for more details.

  5. Configure your network connection
    1. Finally, you have everything you need to configure your eduroam connection. Open your network connection configuration menu. This will look different for every flavor of Linux/GUI framework, but this should generally be found under "System Settings" or on the task bar. You should be in the correct menu when you see a list of Wi-Fi networks that you can connect to.
    2. Enter the configuration menu for the eduroam network, and navigate to the "Security" tab (may also be named "Wi-Fi Security"

    3. Set your configuration as follows. Please note that the exact option names may be different on your OS. If a configuration option is not listed here, then it should (most likely) be on its default setting:

      SecurityWPA/WPA2 Enterprise
      AuthenticationTLS
      Identity<Your compute ID email address in all lower-case letters. Example: "jjruv4@virginia.edu">
      User Certificate<The full path to your .crt file. Use the file selection menu if possible. Otherwise, you may need to prefix the file path with the "file://" URI. Example: "file:///home/jjruv4/.certs/jjruv4.crt">
      CA Certificate<The full file path to your usher certificate (usher.cer). Use the file selection menu if possible. Otherwise, you may need to prefix the file path with the "file://" URI. Example: "file:///home/jjruv4/.certs/usher.cer">
      Private Key<The full file path to your private key (.key) file. Use the file selection menu if possible. Otherwise, you may need to prefix the file path with the "file://" URI. Example: "file:///home/jjruv4/.certs/jjruv4.key">
      Private Key Password<The password given when you created and downloaded the .p12 file from UVA in Step 2. This is not your UVA netbadge password, nor is it your PEM passphrase.>

    4. Make sure to uncheck the "All users may connect to this network" option in the "General" tab. This may also be named as "Available to all users", or similar.


  6. Connect to the network

    1. You should now be able to click on the eduroam network and connect!

    2. If you set a PEM passphrase, the network manager software will need this to de-crypt and use your private key file, so enter the passphrase when

Information for this how-to was taken from the UVA Physics site:

http://galileo.phys.virginia.edu/compfac/faq/linux-eduroam.html

Some of their steps did not work for my setup, and were edited accordingly in this write-up. Their configuration may work for you if you are having trouble with this one.



  • No labels