HOWTO: Wireless Security - WPA1, WPA2, LEAP, etc.

[squibT]

So it looks like you CAN use your routers 64 hex key to setup your Network-applet and Interfaces file.

I took my 64 char hex key and entered it in both the ascii and hex boxes (different times) and then followed page 4 of your doc and generated a psk for the Interfaces file. Entering both (at different times) worked fine. The only problem is at sudo /etc/init.d/networking restart....

* Reconfiguring network interfaces... Error for wireless request "Set Encode" (8B2A) :
invalid argument "0EGgN94V5rER1EAGNw7KIGOTJbfyBNoT3UQEeblubdYLvMZAP yYRk93CwPgGvdR".
That is my real hex key the Network-applet adds to your/my Interfaces file along with another entry for my ESSID, both at the bottom of the file. Delete them and restart networking and you get just an OK and no error.

AES works fine...same key I always had...no wpa_supplicant.conf file used.

Thanx weiman01...great HowToo....I just needed to understand the process a little better and not rely on what I thought was the correct procedure...read page 4

squibt

[wieman01]

Hi Squibt,

Reading this makes me smile... You have probably fallen into every single trap I have fallen into myself. So you have my sympathy... Apparently you need no more help, but I'd appreciate if you posted your "interfaces" file just for the fun of it. I am a bit nosy, that's all.

By the way... The Networking Applet won't help you in Dapper as it does not have a WPA option. Does the Edgy one have??

EDIT:
What "page 4" of my documentation are you referring to??? You mean the other thread mentioned?

[squibT]

Hi Squibt,

Reading this makes me smile... You have probably fallen into every single trap I have fallen into myself. So you have my sympathy... Apparently you need no more help, but I'd appreciate if you posted your "interfaces" file just for the fun of it. I am a bit nosy, that's all.

By the way... The Networking Applet won't help you in Dapper as it does not have a WPA option. Does the Edgy one have??

EDIT:
What "page 4" of my documentation are you referring to??? You mean the other thread mentioned?

Hey weiman01,
Lol...traps is right! but this thread and a little research was key to understanding what Edgy needs to get wl going. This "doc" is point number 9 of this thread...sorry I was not clear...when it prints out on paper page 4 is the key to getting your Internet connection working with any type of encryption...
I think it is on the first page of this same thread you will see the below quote...

>>9. address, netmask, network, broadcast, gateway, dns-nameservers:
>> Also self-explanatory... be aware that "broadcast" needs to end with ".255" for negotiation with the router. These lines need to be according to your own network settings.

As for WPA-PSK key generation, type the following command in a terminal:

Quote:
wpa_passphrase <your_essid> <your_ascii_key>
Resulting in an output like...

Quote:
network={
ssid="test"
#psk="12345678"
psk=fe727aa8b64ac9b3f54c72432da14faed933ea511ecab1 5bbc6c52e7522f709a
}
Copy the "hex_key" (next to "psk=...") and replace <your_hex_key> in the "interfaces" files with it. Then save the file and restart your network:

Quote:
sudo /etc/init.d/networking restart
You should be connecting to your router now...<<


Edgy's Networking_applet does not allow for any obvious differences in configuration...they just removed the word WEP and changed it to Network Password....I am thinking you do not need to use it at all to get setup or connected.....just follow your HowToo. Right now my wireless setup in the Networking_applet is now disabled...I enabled it to set it up last night thinking that was how Edgy would know I had a card, ESSID, PSK, etc....but I am thinking now it is not needed. Im guessing you did not use it? If you do use it you get this at the bottom of your Interfaces file:

auto lo
iface lo inet loopback

auto wlan0
iface wlan0 inet static
wpa-driver wext
wpa-conf managed
wpa-ssid Digger
wpa-ap-scan 2
wpa-proto RSA
wpa-pairwise CCMP
wpa-group CCMP
wpa-key-mgmt WPA-PSK
wpa-psk 2e89d446b73d2281c685f087c76742bb2409b17f175774acdd 82b3e438f0580a
address 10.18.81.25
netmask 255.255.255.0
network 10.18.81.0
broadcast 10.18.81.255
gateway 10.18.81.2
dns-nameservers 10.18.81.2
wireless-essid Digger
wireless-key 0EGgN94V5rER1EAGNw7KIGOTJbfyBNoT3UQEeblubdYLvMZAPy YRk93CwPgGvdR


That is my routers hex key entered into the Network_applet....you can simply delete the two lines and your Interface file works fine using /etc/init.d/networking restart....if you don't delete the lines /etc/init.d/networking restart, at cli, will generate errors but still work. Of course you still have to generate a wpa_passphrase like page 4 says "wpa_passphrase <essid> <hex or ascii key>"

and enter it into your Interfaces file. So I am thinking you do not need the Networking_applet at all for this. Just use an Interfaces file with a generated psk.

My config file:

auto lo
iface lo inet loopback

auto wlan0
iface wlan0 inet static
wpa-driver wext
wpa-conf managed
wpa-ssid Digger
wpa-ap-scan 2
wpa-proto RSA
wpa-pairwise CCMP
wpa-group CCMP
wpa-key-mgmt WPA-PSK
wpa-psk 2e89d446b73d2281c685f087c76742bb2409b17f175774acdd 82b3e438f0580a
address 10.18.81.25
netmask 255.255.255.0
network 10.18.81.0
broadcast 10.18.81.255
gateway 10.18.81.2
dns-nameservers 10.18.81.2

You can see the psk is the one generated by Edgy...not the one I have in my router or the one I put in Networking_applet (which is now turned off for all devices...actually it is on but all devices are not enabled....not needed)

Anyway...TKIP, then CCMP worked fine for me also....easy and quick change in testing. I think a lot of people do not understand this procedure and are getting stuck trying to config wl....some are using wpa_supplicant like I was but I believe this is the recommended configuration. It is simple if your drivers show they are working and active before you start configuring the Interfaces file.

Thanx again,

squibt

[wieman01]

The Gnome networking applet does WEP only. That's why it adds those 2 lines at the bottom of the "interfaces" configuration file. That's WEP terminology:

wireless-key 0EGgN94V5rER1EAGNw7KIGOTJbfyBNoT3UQEeblubdYLvMZAPy YRk93CwPgGvdR

So yes, we can forget about the applet if we use WPA.

If you choose to set up WPA encryption/authentication using "interfaces" then wpa_supplicant will configure "/etc/wpa_supplicant.conf" for you. The file is still there & apparently used by the system, it's just the way of controlling it what is different. Check it out on your system.

Ok, I think it makes probably sense to enhance this documentation & include WPA1, WEP, LEAP, EAP, etc. as well as other chipsets. Perhaps there is a chance that we get together soon.

[squibT]

So the Network_applet is misleading...they just renamed the Key box from WEP to Network Password....be nice if it would have the options WEP, WPA1, WPA2, Radius,...whatever and have it really config your Interface file for you. And allow you to enable and disable an interface via this tool so you can switch between wl and wired. Right now if you mess with the wl in it it sometimes deletes all your Interfaces settings. And too it seems a bit odd you can enter your Hex key from your router say....but it is not recognized by Edgy as a valid key....you have to tell Edgy to make a new key for the Interfaces file...from your router key...seems like a needless duplication to me.

Anyway, I will test out WEP, WPA1 (AES/TKIP fall back), WPA2 going by the HowToo step by step to make sure all works like it should.

I will keep in touch....

squibt

[wieman01]

Yes, I think the default network applet is kind of flawed. That's why most people prefer NetworkManager over the applet, however, NetworkManager has certain drawbacks (e.g. no support for static IP or hidden ESSID, etc.) that make it impossible for me to use.

BTW: AES (CCMP) is part of the WPA2 specification as opposed to TKIP (WPA1). You'll find all the technical details on the Wikipedia website.

EDIT:
Or more precisely, this guide covers what most people refer to as WPA2: AES with PSK (pre-shared key) rather than EAP (Extensible Authentication Protocol). The latter requires a authentication server which is costly & complex and therefore not suitable for home use. I have never tried out the full implementation of 802.11i (= WPA2) including an EAP server, simply because I don't happen to have one back home. My company has implemented it of course, but you can do nothing in a Windows based environment.

[squibT]

I guess Ubuntu/Edgy still needs some wl app-driver connectivity work...we will have to be patient till the devs get around to it and the IT community and companys dealing in wl products in general come more on onboard with Linux...and stop holding their proprietary drivers so close to their vests.

The reason why I included AES/TKIP is that I am using DD-WRT on my routers and have the options TKIP, AES, TKIP+AES which is supposed to give the client the option to fall back to TKIP if they cannot do AES....dunno if it works but I will test this also.

Later...

[wieman01]

This does work also... You can simply add options:

auto wlan0
iface wlan0 inet static
wpa-driver wext
wpa-conf managed
wpa-ssid <your_essid>
wpa-ap-scan 2
wpa-proto WPA RSN
wpa-pairwise TKIP CCMP
wpa-group TKIP CCMP
wpa-key-mgmt WPA-PSK
wpa-psk <your_hex_key>
address 192.168.168.40
netmask 255.255.255.0
network 192.168.168.0
broadcast 192.168.168.255
gateway 192.168.168.230
dns-nameservers 192.168.168.230

RSN stands for WPA2 actually; CCMP "kind of" for AES.

[mahy]

Hi,

what about moving around with a laptop? Will have to edit /etc/network/interfaces everytime i come across a new network? (Pretty clumsy, eh?) I hope not so. Can you explain it to me?

[wieman01]

Hi,

what about moving around with a laptop? Will have to edit /etc/network/interfaces everytime i come across a new network? (Pretty clumsy, eh?) I hope not so. Can you explain it to me?

In that case you have 2 options I am aware of:

1. gnome-network-manager (GUI), network-manager (daemon)
2. wifi-radar

Hope this helps.