HOWTO: Wireless Security - WPA1, WPA2, LEAP, etc.

[Terratoch]

No, the network program is running as expected when I log in. However, I always have to left-click the icon, go to 'Connect to other wireless networks', put in the SSID, and setup the configuration options (PEAP, TKIP, MSCHAPV2, User ID and password). Its not THAT big of a deal, but it is annoying enough to make me ask if there is a better way. I saw all the config files and wondered if there wasn't a file I could make it read from or something, anything, that I could do so that I don't have to do that anymore.

[wieman01]

No, the network program is running as expected when I log in. However, I always have to left-click the icon, go to 'Connect to other wireless networks', put in the SSID, and setup the configuration options (PEAP, TKIP, MSCHAPV2, User ID and password). Its not THAT big of a deal, but it is annoying enough to make me ask if there is a better way. I saw all the config files and wondered if there wasn't a file I could make it read from or something, anything, that I could do so that I don't have to do that anymore.

If you use NM, then scripts aren't an option. I know what you mean, NM can be quite a pain in the throat. Perhaps an update will fix it in future? Have you tried Hardy?

[Terratoch]

Damn. Alright, thanks anyway.

Have you tried hardy?

No. I tried Suse (10.3) for about... 3 days. Then I switched back to Ubuntu (7.10). I am not really keen on the idea of trying another OS this soon. Plus... I am presently out of CD-Rs.

[wieman01]

Damn. Alright, thanks anyway.

No. I tried Suse (10.3) for about... 3 days. Then I switched back to Ubuntu (7.10). I am not really keen on the idea of trying another OS this soon. Plus... I am presently out of CD-Rs.

A distribution upgrade will do. I did it last week (from Gutsy to Hardy) and it went OK.

[lucia_engel]

This guide is godsend!

I just purchased a Linksys wpc54g v4 card to replace my old laptop integrated network adapter. When I tried to configure it to use WEP, didn't work, so I thought maybe I'll try WPA instead. Following this guide, it JUST WORKED!

Now looking back at my Windows XP partition, for some reason, the new card only works with WEP but not WPA. You know Windows sucks when the official driver doesn't work but the linux driver can.

You're lifesaver!

[ramon13579]

Sorry for the looong post. This is probably my last try before my laptop flies off the window... In short: I can establish a WEP connection but cannot do the same with a WAP EAP-TTLS. I have read the first few posts of this thread and have also browsed through the thread, so I am sorry if the solution to my problem has already been explained.

The instructions I have been given to setup the wifi connection are:

1. Create the file /etc/wpa_supplicant.conf:

ctrl_interface=/var/run/wpa_supplicant
eapol_version=1
ap_scan=1
fast_reauth=0
network={
ssid="uib1x"
key_mgmt=WPA-EAP
proto=WPA
pairwise=TKIP
group=TKIP
eap=TTLS
identity="**********"
password="***********"
phase2="auth=PAP"
ca_cert="/etc/cert/ct_root.pem"
subject_match="sint.uib.es"
}

The ct_root.pem file supplied to me is in /etc/cert of course.

2. iwconfig wlan0 essid uib1x
No output

3. wpa_supplicant -B -i wlan0 -c /etc/wpa_supplicant.conf -D wext
This command fails. Output:

ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 4 value 0x0 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 5 value 0x1 -

I am absolutely lost here. Could this be a problem with kernel modules? I have tried to install the mac80211 subsystem and iwlwifi drivers from http://intellinuxwireless.org/?n=Downloads, but could not even recompile the kernel. Nevertheless, I do not even know whether I have the right drivers or not:

# lsmod |grep mac80211
iwlwifi_mac80211 200456 1 iwl4965
cfg80211 8720 1 iwlwifi_mac80211

Some more information (I need to restart the computer because after running wpa_supplicant the route command does not show wlan0):

#route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.138.0 * 255.255.255.0 U 0 0 0 eth0
link-local * 255.255.0.0 U 0 0 0 wlan0
link-local * 255.255.0.0 U 1000 0 0 eth0
default 192.168.138.1 0.0.0.0 UG 0 0 0 eth0
default * 0.0.0.0 U 1000 0 0 wlan0

# iwconfig
lo no wireless extensions.

eth0 no wireless extensions.

wmaster0 no wireless extensions.

wlan0 IEEE 802.11g ESSID:""
Mode:Managed Frequency:2.412 GHz Access Point: Not-Associated
Retry min limit:7 RTS thr:off Fragment thr=2346 B
Encryption key:off
Link Quality:0 Signal level:0 Noise level:0
Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:0 Invalid misc:0 Missed beacon:0

# iwlist scan
lo Interface doesn't support scanning.

eth0 Interface doesn't support scanning.

wmaster0 Interface doesn't support scanning.

wlan0 Scan completed :
Cell 01 - Address: 00:19:07:05:7E:C0
ESSID:"uib1x"
Mode:Master
Channel:1
Frequency:2.412 GHz (Channel 1)
Quality=31/100 Signal level=-90 dBm Noise level=-127 dBm
Encryption key:on
IE: WPA Version 1
Group Cipher : WEP-40
Pairwise Ciphers (1) : WEP-40
Authentication Suites (1) : 802.1x
Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 6 Mb/s; 9 Mb/s
11 Mb/s; 12 Mb/s; 18 Mb/s; 24 Mb/s; 36 Mb/s
48 Mb/s; 54 Mb/s
Extra:tsf=00000058764a0b9e
...
(Cell 02 to Cell 05 omitted -- uib1x is the target network)

# lshw -C network
*-network
description: Wireless interface
product: PRO/Wireless 4965 AG or AGN Network Connection
vendor: Intel Corporation
physical id: 0
bus info: pci@0000:01:00.0
logical name: wmaster0
version: 61
serial: 00:13:e8:a1:2f:45
width: 64 bits
clock: 33MHz
capabilities: pm msi pciexpress bus_master cap_list logical ethernet physical wireless
configuration: broadcast=yes driver=iwl4965 latency=0 module=iwl4965 multicast=yes wireless=IEEE 802.11g
...
(Ethernet interface omitted)

# cat /etc/network/interfaces
auto lo
iface lo inet loopback

auto wlan0
iface wlan0 inet dhcp

# ifdown -v wlan0
Configuring interface wlan0=wlan0 (inet)
run-parts --verbose /etc/network/if-down.d
run-parts: executing /etc/network/if-down.d/avahi-autoipd
run-parts: executing /etc/network/if-down.d/wpasupplicant
dhclient3 -r -pf /var/run/dhclient.wlan0.pid -lf /var/lib/dhcp3/dhclient.wlan0.leases wlan0
There is already a pid file /var/run/dhclient.wlan0.pid with pid 5957
killed old client process, removed PID file
Internet Systems Consortium DHCP Client V3.0.5
Copyright 2004-2006 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/

wmaster0: unknown hardware address type 801
wmaster0: unknown hardware address type 801
Listening on LPF/wlan0/00:13:e8:a1:2f:45
Sending on LPF/wlan0/00:13:e8:a1:2f:45
Sending on Socket/fallback
DHCPRELEASE on wlan0 to 1.1.1.1 port 67
ifconfig wlan0 down
run-parts --verbose /etc/network/if-post-down.d
run-parts: executing /etc/network/if-post-down.d/avahi-daemon
run-parts: executing /etc/network/if-post-down.d/wireless-tools
run-parts: executing /etc/network/if-post-down.d/wpasupplicant

# ifup -v wlan0
Configuring interface wlan0=wlan0 (inet)
run-parts --verbose /etc/network/if-pre-up.d
run-parts: executing /etc/network/if-pre-up.d/wireless-tools
run-parts: executing /etc/network/if-pre-up.d/wpasupplicant

dhclient3 -e IF_METRIC=100 -pf /var/run/dhclient.wlan0.pid -lf /var/lib/dhcp3/dhclient.wlan0.leases wlan0
There is already a pid file /var/run/dhclient.wlan0.pid with pid 1
Internet Systems Consortium DHCP Client V3.0.5
Copyright 2004-2006 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/

wmaster0: unknown hardware address type 801
wmaster0: unknown hardware address type 801
Listening on LPF/wlan0/00:13:e8:a1:2f:45
Sending on LPF/wlan0/00:13:e8:a1:2f:45
Sending on Socket/fallback
DHCPDISCOVER on wlan0 to 255.255.255.255 port 67 interval 7
DHCPDISCOVER on wlan0 to 255.255.255.255 port 67 interval 11
DHCPDISCOVER on wlan0 to 255.255.255.255 port 67 interval 13
No DHCPOFFERS received.
No working leases in persistent database - sleeping.
run-parts --verbose /etc/network/if-up.d
run-parts: executing /etc/network/if-up.d/avahi-autoipd
run-parts: executing /etc/network/if-up.d/avahi-daemon
run-parts: executing /etc/network/if-up.d/mountnfs
run-parts: executing /etc/network/if-up.d/ntpdate
run-parts: executing /etc/network/if-up.d/wpasupplicant

All this looks fine to my unexperienced eyes. Some ideas?

Cheers.

[gedden]

My problem is just like all the others in this thread. I appreciate any help as I have been learning quite a lot about Linux and I haven't had this much fun configuring a computer in a long time! thank you Ubuntu forums!

so for the background
Compaq armadaM300 old laptop. Cisco aironet 350 pc card. 7.10 version.
Card was working fine with linksys wrt54g router in mac filtering mode, until I learned a little bit more about wireless security. Switched to WPA personal pre shared key. Had to switch network manager to manual mode to get an option for wpa personal. Sometimes key disappears from NM. To finally get a connection I had to check, and uncheck the box upwards of 15 times. Eventually I would get a connection and browse away. After a while I wanted to get samba working the way it was before I implemented encryption. During my investigation of why it wasn't working two forum members helped me figure out that I wasn't connecting to my router after all! Thats when I started trying to figure out etc/network/interfaces. Initially I had a lot of garbage in that file, I might have made a back up I can post if needed. I was reading the online docs for NM and it stated to remove anything that you want controlled by NM from interfaces. So I did that, and it didn't do anything to change the problem. So then I started following the Howto from this thread. Below I will post all outputs I can think of.

iwconfig

lo        no wireless extensions.

eth0      no wireless extensions.

eth1      IEEE 802.11-DS  ESSID:"linksys"  
          Mode:Managed  Frequency:2.437 GHz  Access Point: 00:1C:10:14:F0:C3   
          Bit Rate:11 Mb/s   Tx-Power=20 dBm   Sensitivity=0/65535  
          Retry limit:16   RTS thr:off   Fragment thr:off
          Power Management:off
          Link Quality=55/100  Signal level=-68 dBm  Noise level=-91 dBm
          Rx invalid nwid:462  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:7  Invalid misc:251775   Missed beacon:0

wifi0     IEEE 802.11-DS  ESSID:"linksys"  
          Mode:Managed  Frequency:2.437 GHz  Access Point: 00:1C:10:14:F0:C3   
          Bit Rate:11 Mb/s   Tx-Power=20 dBm   Sensitivity=0/65535  
          Retry limit:16   RTS thr:off   Fragment thr:off
          Power Management:off
          Link Quality=55/100  Signal level=-68 dBm  Noise level=-91 dBm
          Rx invalid nwid:462  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:7  Invalid misc:251775   Missed beacon:0

gedden@gedden-laptop:~$ iwlist scan

lo        Interface doesn't support scanning.

eth0      Interface doesn't support scanning.

eth1      Scan completed :
          Cell 01 - Address: 00:1B:5B:DB:1F:E9
                    ESSID:"2WIRE491"
                    Mode:Master
                    Frequency:2.412 GHz (Channel 1)
                    Quality=54/100  Signal level=-69 dBm  Noise level:-92 dBm
                    Encryption key:on
                    Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 11 Mb/s
                    Extra:bcn_int=100
          Cell 02 - Address: 00:18:39:7E:4B:17
                    ESSID:"apartment"
                    Mode:Master
                    Frequency:2.437 GHz (Channel 6)
                    Quality=90/100  Signal level=-50 dBm  Noise level:-92 dBm
                    Encryption key:on
                    Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 11 Mb/s; 18 Mb/s
                              24 Mb/s; 36 Mb/s; 54 Mb/s
                    Extra:bcn_int=100
          Cell 03 - Address: 00:1C:10:14:F0:C3
                    ESSID:"linksys"
                    Mode:Master
                    Frequency:2.437 GHz (Channel 6)
                    Quality=50/100  Signal level=-70 dBm  Noise level:-92 dBm
                    Encryption key:off
                    Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 11 Mb/s; 18 Mb/s
                              24 Mb/s; 36 Mb/s; 54 Mb/s
                    Extra:bcn_int=100

wifi0     Scan completed :
          Cell 01 - Address: 00:1B:5B:DB:1F:E9
                    ESSID:"2WIRE491"
                    Mode:Master
                    Frequency:2.412 GHz (Channel 1)
                    Quality=54/100  Signal level=-69 dBm  Noise level:-92 dBm
                    Encryption key:on
                    Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 11 Mb/s
                    Extra:bcn_int=100
          Cell 02 - Address: 00:18:39:7E:4B:17
                    ESSID:"apartment"
                    Mode:Master
                    Frequency:2.437 GHz (Channel 6)
                    Quality=90/100  Signal level=-50 dBm  Noise level:-92 dBm
                    Encryption key:on
                    Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 11 Mb/s; 18 Mb/s
                              24 Mb/s; 36 Mb/s; 54 Mb/s
                    Extra:bcn_int=100
          Cell 03 - Address: 00:1C:10:14:F0:C3
                    ESSID:"linksys"
                    Mode:Master
                    Frequency:2.437 GHz (Channel 6)
                    Quality=50/100  Signal level=-70 dBm  Noise level:-92 dBm
                    Encryption key:off
                    Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 11 Mb/s; 18 Mb/s
                              24 Mb/s; 36 Mb/s; 54 Mb/s
                    Extra:bcn_int=100

This is the first time that wifi0 has responded to a scan request. Although I have had a duplicate in my NM for a while.

route

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.1.0     *               255.255.255.0   U     0      0        0 eth1
link-local      *               255.255.0.0     U     1000   0        0 eth1
default         192.168.1.1     0.0.0.0         UG    100    0        0 eth1

So following the How to I produced this interfaces file:

auto lo
iface lo inet loopback

auto eth1
iface eth1 inet dhcp
wpa-driver wext
wpa-ssid apartment
wpa-ap-scan 1
wpa-proto WPA
wpa-pairwise TKIP
wpa-group TKIP
wpa-key-mgmt WPA-PSK
wpa-psk 3732d419f65fcxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

And this produced the error

gedden@gedden-laptop:~$ sudo /etc/init.d/networking restart
[sudo] password for gedden:
 * Reconfiguring network interfaces... /etc/network/interfaces:76: duplicate interface
ifdown: couldn't read interfaces file "/etc/network/interfaces"
/etc/network/interfaces:76: duplicate interface
ifup: couldn't read interfaces file "/etc/network/interfaces"
                                                                         [fail]

So Ill post the output of if up/down

gedden@gedden-laptop:~$ ifdown -v eth1
ifdown: failed to open statefile /var/run/network/ifstate: Permission denied
gedden@gedden-laptop:~$ sudo ifdown -v eth1
Configuring interface eth1=eth1 (inet)
run-parts --verbose /etc/network/if-down.d
run-parts: executing /etc/network/if-down.d/avahi-autoipd
run-parts: executing /etc/network/if-down.d/wpasupplicant
dhclient3 -r -pf /var/run/dhclient.eth1.pid -lf /var/lib/dhcp3/dhclient.eth1.leases eth1
There is already a pid file /var/run/dhclient.eth1.pid with pid 14393
killed old client process, removed PID file
Internet Systems Consortium DHCP Client V3.0.5
Copyright 2004-2006 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/

wifi0: unknown hardware address type 801
wifi0: unknown hardware address type 801
Listening on LPF/eth1/00:40:96:46:1d:9f
Sending on   LPF/eth1/00:40:96:46:1d:9f
Sending on   Socket/fallback
DHCPRELEASE on eth1 to 192.168.1.1 port 67
ifconfig eth1 down
run-parts --verbose /etc/network/if-post-down.d
run-parts: executing /etc/network/if-post-down.d/avahi-daemon
run-parts: executing /etc/network/if-post-down.d/wireless-tools
run-parts: executing /etc/network/if-post-down.d/wpasupplicant
wpa_supplicant: terminating wpa_supplicant daemon via pidfile /var/run/wpa_supplicant.eth1.pid
Stopped /sbin/wpa_supplicant (pid 14364).
gedden@gedden-laptop:~$ sudo ifup -v eth1
Configuring interface eth1=eth1 (inet)
run-parts --verbose /etc/network/if-pre-up.d
run-parts: executing /etc/network/if-pre-up.d/wireless-tools
run-parts: executing /etc/network/if-pre-up.d/wpasupplicant
wpa_supplicant: wpa-driver wext
wpa_supplicant: /sbin/wpa_supplicant -B -P /var/run/wpa_supplicant.eth1.pid -i eth1 -D wext -C /var/run/wpa_supplicant
Starting /sbin/wpa_supplicant...
ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 7 value 0x1 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 4 value 0x0 - wpa_supplicant: ctrl_interface socket located at /var/run/wpa_supplicant/eth1
wpa_supplicant: configuring network block -- 0
wpa_supplicant: wpa-ssid "apartment" -- OK
wpa_supplicant: wpa-psk ***** -- OK
wpa_supplicant: wpa-key-mgmt WPA-PSK -- OK
wpa_supplicant: wpa-proto WPA -- OK
wpa_supplicant: enabling network block 0 -- OK

dhclient3 -e IF_METRIC=100 -pf /var/run/dhclient.eth1.pid -lf /var/lib/dhcp3/dhclient.eth1.leases eth1
There is already a pid file /var/run/dhclient.eth1.pid with pid 134519120
Internet Systems Consortium DHCP Client V3.0.5
Copyright 2004-2006 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/

wifi0: unknown hardware address type 801
wifi0: unknown hardware address type 801
Listening on LPF/eth1/00:40:96:46:1d:9f
Sending on   LPF/eth1/00:40:96:46:1d:9f
Sending on   Socket/fallback
DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 4
DHCPOFFER from 192.168.1.1
DHCPREQUEST on eth1 to 255.255.255.255 port 67
DHCPACK from 192.168.1.1
bound to 192.168.1.111 -- renewal in 39668 seconds.
run-parts --verbose /etc/network/if-up.d
run-parts: executing /etc/network/if-up.d/avahi-autoipd
run-parts: executing /etc/network/if-up.d/avahi-daemon
run-parts: executing /etc/network/if-up.d/mountnfs
run-parts: executing /etc/network/if-up.d/ntp
run-parts: executing /etc/network/if-up.d/ntpdate
run-parts: executing /etc/network/if-up.d/wpasupplicant

I know this is a long post but just a little more.
So I edited out all the stuff I added from interfaces and restarted the network.

gedden@gedden-laptop:~$ sudo /etc/init.d/networking restart
 * Reconfiguring network interfaces...                                          RTNETLINK answers: No such process
There is already a pid file /var/run/dhclient.eth1.pid with pid 10613
removed stale PID file
Internet Systems Consortium DHCP Client V3.0.5
Copyright 2004-2006 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/

wifi0: unknown hardware address type 801
wifi0: unknown hardware address type 801
Listening on LPF/eth1/00:40:96:46:1d:9f
Sending on   LPF/eth1/00:40:96:46:1d:9f
Sending on   Socket/fallback
DHCPRELEASE on eth1 to 192.168.1.1 port 67
send_packet: Network is unreachable
send_packet: please consult README file regarding broadcast address.
ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 7 value 0x1 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 4 value 0x0 - There is already a pid file /var/run/dhclient.eth1.pid with pid 134519120
Internet Systems Consortium DHCP Client V3.0.5
Copyright 2004-2006 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/

wifi0: unknown hardware address type 801
wifi0: unknown hardware address type 801
Listening on LPF/eth1/00:40:96:46:1d:9f
Sending on   LPF/eth1/00:40:96:46:1d:9f
Sending on   Socket/fallback
DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 6
DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 20
DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 5
No DHCPOFFERS received.
No working leases in persistent database - sleeping.
                                                                         [ OK ]

So, Thats everything I can think of right now. Thanks in advance for any help!.

Andy

[ramon13579]

The problem I posted two days ago (Apr 23 2008) is SOLVED after an upgrade from Gutsy to Hardy.

Cheers,

Ramon

[wieman01]

gedden,

It appears you are using the wrong wpa-driver. What wireless adapter have you got?

Please post the output of:

sudo lshw -C network

Have you removed NM entirely?

[lucky760]

[accidental double post - please disregard and see the next comment]