By Eric Geier (NoWiresSecurity Founder & Owner)  - originally published on LinuxPlanet.com

 

In this tutorial, we'll first see how 802.1X authentication fits into the big picture of wireless LAN security. Then we'll configure the authentication settings in Ubuntu. Lastly, we'll review the manual configuration of 802.1X supplicants. Lets get started!

The transition from WEP to WPA to WPA2

Back when the vulnerabilities of WEP encryption for Wi-Fi networks were uncovered, the IEEE and wireless industry started developing new protocols and standards. They came up with the 802.11i, a standard to finally implement a fully secure encryption mechanism for wireless LANs. Before it was completed, the Wi-Fi Alliance released the Wi-Fi Protected Access (WPA) encryption standard, loosely based on 802.11i using RC4/TKIP for the underlying encryption. Later they released WPA2, which includes full support for 802.11i using CCMP/AES encryption.

As many news outlets have discussed lately, there have been more flaws found in the first version of WPA. However, unlike some reports say, it hasn't been cracked; full encryption keys or passphrases haven't been recovered. The flaws apply to the underlying RC4/TKIP encryption and affects both the Enterprise and PSK modes of the first version of WPA. This does not have anything to do with WPA2, which uses a fully secure CCMP/AES encryption. Though WPA currently provides adequate security, especially with long and mixed character passphrases, you should try to migrate to WPA2--and make sure you don't use WEP at all.

The two modes of Wi-Fi Protected Access

Both WPA and WPA2 can be used in two very different modes: Enterprise (802.1X/EAP) and Personal (PSK). In full WPA and WPA2 implementations, wireless clients authenticate themselves via the 802.1X/EAP protocol to an external RADIUS server, whereas the Personal mode doesn't. Though the Personal mode is much easier to setup and is fine for residential use, it is necessary to authenticate clients on business networks. Instead of entering static encryption keys into clients, the keys in the Enterprise mode are negotiated and changed automatically in the background after authentication when connecting to the network.

This dynamic keying of the Enterprise mode has real-world benefits. The actual encryption keys that unlock the Wi-Fi connections aren't stored on the computers like with the Personal mode. Therefore, if a computer is stolen, the thief doesn't have the keys to the network. Plus employees would never see the keys. They'd present a username and password, digital certificate, or smart card in order to access the network, which would be used in the 802.1X authentication. These credentials could be revoked by the network administrators as needed, unlike when using the Personal mode, where they'd have to change the encryption keys on all the computers.

802.1X supplicants

A fancy name for the client software that represents the client end of the authentication is a 802.1X supplicant. You input the credentials into the supplicant. The supplicant communicates with the authenticator, such as a wireless access point or switch, which then talks to the authentication (RADIUS) server.

So in order to connect to a 802.1X-enabled network, you must install a client. Years ago this wasn't the easiest task when using Linux. Cisco and Microsoft basically held the only supplicants. Even though open source supplicants were developed, they weren't very simple to configure. However, now some Linux distributions have integrated the 802.1X settings into the OS GUI, where configuring them and inputting the credentials is pretty trivial.

The two main 802.1X supplicants projects in Linux are Xsupplicant and wpa_supplicant. The Xsupplicant has been around since 2003 and is developed by Open1X and backed by the OpenSEA Alliance. The wpa_supplicant has been around since 2004 and is developed by Jouni Malinen and other contributors. Both clients run on Linux and Windows and have a GUI application in addition to text-based configuration. The wpa_supplicant project also supports BSD and Mac OS X.

 

Not only is Ubuntu 9.10 already loaded with the wpa_supplicant, its own networking GUI communicates directly with the supplicant. Configuring 802.1X authentication and connecting to WPA or WPA2 Enterprise networks in Ubuntu is pretty straightforward. When you're ready to connect, simply click the network icon on the top of the screen and select the network from the list.

If you're using a password-based EAP protocol, like the popular PEAPv0/EAP-MSCHAPv2, you'll be prompted to enter the authentication settings, such as seen in Figure 1. This also assumes the wireless card and driver supports WPA/WPA2.

 

First, verify Wireless Security is set to WPA & WPA2 Enterprise. Then choose the Authentication protocol that's supported by the authentication server, such as the popular PEAP protocol. Unless your authentication server is set to accept anonymous connections, ignore that setting.

Next you should choose a CA Certificate file, so the client can verify it's connecting to a legitimate authentication server before completing its authentication. Though you can skip this setting, it's recommended to validate the server's certificate for full security. If the authentication server is loaded with a SSL certificate purchased from a Certificate Authority like VeriSign or Godaddy, you'll have to download their public root certificates from their site since Ubuntu isn't already loaded with them like in Windows. If you created your own self signed certificates like with openssl, you need to select the root CA certificate that was created.

Now you can set the other settings for the EAP type you selected. If you selected PEAP, for example, you can leave the PEAP Version as Automatic and the Inner Authentication as MSCHAPv2.

Finally, input a Username and Password that's setup in the authentication server or backend database.

When you're done, click Connect. Give it a couple of seconds to complete the 802.1X process and it should successfully connect up to the network. If not, double-check the settings and check the debug or logs on the authentication server.

Configuring wpa_supplicant via the config file

If you've installed wpa_supplicant yourself, you can set it up via the configuration file. If the supplicant came with your Linux distribution, you still might choose to use the configuration file to fine-tune the authentication and encryption settings.

Here are a few general parameters you may want to set that apply to all networks you connect to:

 

• eapol_version: Set to either 1 or 2. By default, wpa_supplicant uses version 2 of EAPOL, as specified in the IEEE 802.1X-2004 standard. However, some APs still support only the first version.

• fast_reauth: Leave set to 1 to enable fast re-authentication for all supported EAP methods, or set to 2 to disable fast re-authentication.

 

You specify the details of networks you want to connect to in blocks using brackets. The supplicant will try to connect to the listed networks in the order they appear in. Before you take the time to configure all the settings, you might want to check if the supplicant is working fine with your wireless driver by connecting to an unencrypted AP first, using the following block:

 

# Connects to the specified open or unencrypted network

network = {

ssid="network_name"

key_mgmt=NONE

}

 

Before you configure more network blocks, let's review some of the possible fields you can use in them to configure the network settings:

 

• ssid: This required field specifies the network name.

• scan_ssid: When set to 1, this will add the SSID to the probe requests, in case you're connecting to a hidden network or an AP with multiple SSIDs.

• key_mgmt: Possible options include WPA-PSK (requires the psk field), WPA-EAP, IEEE8021X (authentication with or without dynamically generated WEP keys), and NONE (for open or static WEP networks).

• pairwise: If WPA is used, specify either CCMP (WPA2) or TKIP (WPA).

• eap: Space-separated list of the acceptable EAP methods: MD5, MSCHAPV2, OTP, GTC, TLS, PEAP, or TTLS.

• identity: String used for EAP identity, such as the username.

• password: String used for the EAP password.

• ca_cert: Full file path to CA certificate file in PEM or DER format, so the server certificate can be validated.

• ca_path: Full path to a directory where there are CA certificate files in PEM format you want to be added to the trusted list, so the server certificate can be validated.

• client_cert: Full file path to a client certificate file in PEM or DER format, so you can use EAP methods like TLS.

 

Now lets put some of these fields to use in some network block examples.

Here's an example of a network block configured to connect to a WPA-Enterprise network with 802.1X authentication (using the PEAP protocol which requires users to enter login credentials):

 

network = {

ssid="wpa-enterpise-peap example"

key_mgmt=WPA-EAP

pairwise=TKIP

group=TKIP

eap=PEAP

identity="user@your_domain"

password="your_password"

ca_cert="/etc/cert/ca.pem"

phase1="peapver=0"

phase2="MSCHAPV2"

}

 

For instance, this is an example of a network block configured to connect to a WPA2-Enterprise network with 802.1X authentication (using EAP-TLS which requires client and server certificates):

 

network = {

ssid="wpa2-enterpise-tls example"

key_mgmt=WPA-EAP

pairwise=CCMP

group=CCMP

eap=TLS

ca_cert="/etc/cert/ca.pem"

private_key="/etc/cert/user.p12"

private_key_passwd="PKCS#12 your_password"

}

 

Once you have the wpa_supplicant.conf file configured with the desired settings and network block(s), you can go ahead and give it a try. Here's an example of what you can run from the command-line:

 

wpa_supplicant -B -i wlan0 -c /etc/wpa_supplicant.conf

 

This runs the daemon in the background, uses the wlan0 network interface, and reads the configuration files from the etc directory. If you need additional help, run man wpa_supplicant to see it's manual. If you have any problems, try running the following command to see debugging information:

 

wpa_supplicant -i wlan0 -c /etc/wpa_supplicant.conf -d

 

So you don't have to run these commands after every boot, consider adding the following to the file at /etc/network/interfaces:

 

auto wlan0

iface wlan0 inet dhcp

pre-up wpa_supplicant -B -i wlan0 -c /etc/wpa_supplicant.conf

post-down killall -q wpa_supplicant

 

Using the wpa_gui application

If the command-line isn't appealing, you can use wpa_gui. It's a graphical utility that you can use to configure most of the wpa_supplicant settings. Depending upon your Linux distribution, this may be installed with the wpa_supplicant package or may have to be installed from a separate wpa_gui package.

Figure 2 shows an example of wpa_gui in Ubuntu. It is basically a graphical version of the command-line and configuration file method. You can scan for networks and save profiles for them. Plus you can see the network status, review the event history, and configure WPS settings.

Getting more help

We reviewed only some aspects of wpa_supplicant. The project offers many more examples in a full configuration file. Plus you can communicate and search on their mailing list.