Wireless WPA (Breezy)

[R S Gill]

Hi,

I am trying to connect to the wireless network at Purdue University. 
Purdue's wireless network uses PEAP to authenticate users.

I am trying to connect to the wireless network with a Netgear WG511T 
wireless card which works with Breezy out of the box. I have tried 
connecting to the network using wpa_supplicant and xsupplicant. I have 
also installed the ca-certificates package.

So far I have been unsuccessful.

As a reference, the instructions (Windows and Mac) that Purdue provides 
to connect to the wireless network can be dound at:
http://www.itap.purdue.edu/airlink/instructions.cfm

I have consulted the Purdue Liux User Group and even their 
wpa_supplicant file does not seem to work. The wpa_supplicant file that 
the Purdue Linux User Group provides is as follows:

##### Example wpa_supplicant configuration file ###############################
# Empty lines and lines starting with # are ignored

# NOTE! This file may contain password information and should probably be made
# readable only by root user on multiuser systems.

# global configuration (shared by all network blocks)
#
# Interface for separate control program. If this is specified, wpa_supplicant
# will create this directory and a UNIX domain socket for listening to requests
# from external programs (CLI/GUI, etc.) for status information and
# configuration. The socket file will be named based on the interface name, so
# multiple wpa_supplicant processes can be run at the same time if more than
# one interface is used.
# /var/run/wpa_supplicant is the recommended directory for sockets and by
# default, wpa_cli will use it when trying to connect with wpa_supplicant.
ctrl_interface=/var/run/wpa_supplicant

# Access control for the control interface can be configured by setting the
# directory to allow only members of a group to use sockets. This way, it is
# possible to run wpa_supplicant as root (since it needs to change network
# configuration and open raw sockets) and still allow GUI/CLI components to be
# run as non-root users. However, since the control interface can be used to
# change the network configuration, this access needs to be protected in many
# cases. By default, wpa_supplicant is configured to use gid 0 (root). If you
# want to allow non-root users to use the control interface, add a new group
# and change this value to match with that group. Add users that should have
# control interface access to this group. If this variable is commented out or
# not included in the configuration file, group will not be changed from the
# value it got by default when the directory or socket was created.
#
# This variable can be a group name or gid.
#ctrl_interface_group=wheel
ctrl_interface_group=0

# IEEE 802.1X/EAPOL version
# wpa_supplicant was implemented based on IEEE 802-1X-REV-d8 which defines
# EAPOL version 2. However, there are many APs that do not handle the new
# version number correctly (they seem to drop the frames completely). In order
# to make wpa_supplicant interoperate with these APs, the version number is set
# to 1 by default. This configuration value can be used to set it to the new
# version (2).
eapol_version=1

# AP scanning/selection
# By default, wpa_supplicant requests driver to perform AP scanning and then
# uses the scan results to select a suitable AP. Another alternative is to
# allow the driver to take care of AP scanning and selection and use
# wpa_supplicant just to process EAPOL frames based on IEEE 802.11 association
# information from the driver.
# 1: wpa_supplicant initiates scanning and AP selection
# 0: driver takes care of scanning, AP selection, and IEEE 802.11 association
#    parameters (e.g., WPA IE generation); this mode can also be used with
#    non-WPA drivers when using IEEE 802.1X mode; do not try to associate with
#    APs (i.e., external program needs to control association). This mode must
#    also be used when using wired Ethernet drivers.
# 2: like 0, but associate with APs using security policy and SSID (but not
#    BSSID); this can be used, e.g., with ndiswrapper and NDIS drivers to
#    enable operation with hidden SSIDs and optimized roaming; in this mode,
#    the network blocks in the configuration file are tried one by one until
#    the driver reports successful association; each network block should have
#    explicit security policy (i.e., only one option in the lists) for
#    key_mgmt, pairwise, group, proto variables
ap_scan=1

# EAP fast re-authentication
# By default, fast re-authentication is enabled for all EAP methods that
# support it. This variable can be used to disable fast re-authentication.
# Normally, there is no need to disable this.
fast_reauth=1

# OpenSSL Engine support
# These options can be used to load OpenSSL engines.
# The two engines that are supported currently are shown below:
# They are both from the opensc project (http://www.opensc.org/)
# By default no engines are loaded.
# make the opensc engine available
opensc_engine_path=/usr/lib/opensc/engine_opensc.so
# make the pkcs11 engine available
pkcs11_engine_path=/usr/lib/opensc/engine_pkcs11.so
# configure the path to the pkcs11 module required by the pkcs11 engine
pkcs11_module_path=/usr/lib/pkcs11/opensc-pkcs11.so

# Driver interface parameters
# This field can be used to configure arbitrary driver interace parameters. The
# format is specific to the selected driver interface. This field is not used
# in most cases.
#driver_param="ndiswrapper"

# network block
#
# Each network (usually AP's sharing the same SSID) is configured as a separate
# block in this configuration file. The network blocks are in preference order
# (the first match is used).
#
# network block fields:
#
# disabled:
#       0 = this network can be used (default)
#       1 = this network block is disabled (can be enabled through ctrl_iface,
#           e.g., with wpa_cli or wpa_gui)
#
# ssid: SSID (mandatory); either as an ASCII string with double quotation or
#       as hex string; network name
#
# scan_ssid:
#       0 = do not scan this SSID with specific Probe Request frames (default)
#       1 = scan with SSID-specific Probe Request frames (this can be used to
#           find APs that do not accept broadcast SSID or use multiple SSIDs;
#           this will add latency to scanning, so enable this only when needed)
#
# bssid: BSSID (optional); if set, this network block is used only when
#       associating with the AP using the configured BSSID
#
# priority: priority group (integer)
# By default, all networks will get same priority group (0). If some of the
# networks are more desirable, this field can be used to change the order in
# which wpa_supplicant goes through the networks when selecting a BSS. The
# priority groups will be iterated in decreasing priority (i.e., the larger the
# priority value, the sooner the network is matched against the scan results).
# Within each priority group, networks will be selected based on security
# policy, signal strength, etc.
# Please note that AP scanning with scan_ssid=1 and ap_scan=2 mode are not
# using this priority to select the order for scanning. Instead, they try the
# networks in the order that used in the configuration file.
#
# mode: IEEE 802.11 operation mode
# 0 = infrastructure (Managed) mode, i.e., associate with an AP (default)
# 1 = IBSS (ad-hoc, peer-to-peer)
# Note: IBSS can only be used with key_mgmt NONE (plaintext and static WEP)
# and key_mgmt=WPA-NONE (fixed group key TKIP/CCMP). In addition, ap_scan has
# to be set to 2 for IBSS. WPA-None requires following network block options:
# proto=WPA, key_mgmt=WPA-NONE, pairwise=NONE, group=TKIP (or CCMP, but not
# both), and psk must also be set.
#
# proto: list of accepted protocols
# WPA = WPA/IEEE 802.11i/D3.0
# RSN = WPA2/IEEE 802.11i (also WPA2 can be used as an alias for RSN)
# If not set, this defaults to: WPA RSN
#
# key_mgmt: list of accepted authenticated key management protocols
# WPA-PSK = WPA pre-shared key (this requires 'psk' field)
# WPA-EAP = WPA using EAP authentication (this can use an external
#       program, e.g., Xsupplicant, for IEEE 802.1X EAP Authentication
# IEEE8021X = IEEE 802.1X using EAP authentication and (optionally) dynamically
#       generated WEP keys
# NONE = WPA is not used; plaintext or static WEP could be used
# If not set, this defaults to: WPA-PSK WPA-EAP
#
# auth_alg: list of allowed IEEE 802.11 authentication algorithms
# OPEN = Open System authentication (required for WPA/WPA2)
# SHARED = Shared Key authentication (requires static WEP keys)
# LEAP = LEAP/Network EAP (only used with LEAP)
# If not set, automatic selection is used (Open System with LEAP enabled if
# LEAP is allowed as one of the EAP methods).
#
# pairwise: list of accepted pairwise (unicast) ciphers for WPA
# CCMP = AES in Counter mode with CBC-MAC [RFC 3610, IEEE 802.11i/D7.0]
# TKIP = Temporal Key Integrity Protocol [IEEE 802.11i/D7.0]
# NONE = Use only Group Keys (deprecated, should not be included if APs support
#       pairwise keys)
# If not set, this defaults to: CCMP TKIP
#
# group: list of accepted group (broadcast/multicast) ciphers for WPA
# CCMP = AES in Counter mode with CBC-MAC [RFC 3610, IEEE 802.11i/D7.0]
# TKIP = Temporal Key Integrity Protocol [IEEE 802.11i/D7.0]
# WEP104 = WEP (Wired Equivalent Privacy) with 104-bit key
# WEP40 = WEP (Wired Equivalent Privacy) with 40-bit key [IEEE 802.11]
# If not set, this defaults to: CCMP TKIP WEP104 WEP40
#
# psk: WPA preshared key; 256-bit pre-shared key
# The key used in WPA-PSK mode can be entered either as 64 hex-digits, i.e.,
# 32 bytes or as an ASCII passphrase (in which case, the real PSK will be
# generated using the passphrase and SSID). ASCII passphrase must be between
# 8 and 63 characters (inclusive).
# This field is not needed, if WPA-EAP is used.
# Note: Separate tool, wpa_passphrase, can be used to generate 256-bit keys
# from ASCII passphrase. This process uses lot of CPU and wpa_supplicant
# startup and reconfiguration time can be optimized by generating the PSK only
# only when the passphrase or SSID has actually changed.
#
# eapol_flags: IEEE 802.1X/EAPOL options (bit field)
# Dynamic WEP key require for non-WPA mode
# bit0 (1): require dynamically generated unicast WEP key
# bit1 (2): require dynamically generated broadcast WEP key
#       (3 = require both keys; default)
#
# proactive_key_caching:
# Enable/disable opportunistic PMKSA caching for WPA2.
# 0 = disabled (default)
# 1 = enabled
#
# Following fields are only used with internal EAP implementation.
# eap: space-separated list of accepted EAP methods
#       MD5 = EAP-MD5 (unsecure and does not generate keying material ->
#                       cannot be used with WPA; to be used as a Phase 2 method
#                       with EAP-PEAP or EAP-TTLS)
#       MSCHAPV2 = EAP-MSCHAPv2 (cannot be used separately with WPA; to be used
#               as a Phase 2 method with EAP-PEAP or EAP-TTLS)
#       OTP = EAP-OTP (cannot be used separately with WPA; to be used
#               as a Phase 2 method with EAP-PEAP or EAP-TTLS)
#       GTC = EAP-GTC (cannot be used separately with WPA; to be used
#               as a Phase 2 method with EAP-PEAP or EAP-TTLS)
#       TLS = EAP-TLS (client and server certificate)
#       PEAP = EAP-PEAP (with tunnelled EAP authentication)
#       TTLS = EAP-TTLS (with tunnelled EAP or PAP/CHAP/MSCHAP/MSCHAPV2
#                        authentication)
#       If not set, all compiled in methods are allowed.
#
# identity: Identity string for EAP
# anonymous_identity: Anonymous identity string for EAP (to be used as the
#       unencrypted identity with EAP types that support different tunnelled
#       identity, e.g., EAP-TTLS)
# password: Password string for EAP
# ca_cert: File path to CA certificate file. This file can have one or more
#       trusted CA certificates. If ca_cert is not included, server certificate
#       will not be verified. This is insecure and the CA file should always be
#       configured.
# client_cert: File path to client certificate file (PEM/DER)
# private_key: File path to client private key file (PEM/DER/PFX)
#       When PKCS#12/PFX file (.p12/.pfx) is used, client_cert should be
#       commented out. Both the private key and certificate will be read from
#       the PKCS#12 file in this case.
# private_key_passwd: Password for private key file (if left out, this will be
#       asked through control interface)
# dh_file: File path to DH/DSA parameters file (in PEM format)
#       This is an optional configuration file for setting parameters for an
#       ephemeral DH key exchange. In most cases, the default RSA
#       authentication does not use this configuration. However, it is possible
#       setup RSA to use ephemeral DH key exchange. In addition, ciphers with
#       DSA keys always use ephemeral DH keys. This can be used to achieve
#       forward secrecy. If the file is in DSA parameters format, it will be
#       automatically converted into DH params.
# subject_match: Substring to be matched against the subject of the
#       authentication server certificate. If this string is set, the server
#       sertificate is only accepted if it contains this string in the subject.
#       The subject string is in following format:
#       /C=US/ST=CA/L=San Francisco/CN=Test AS/emailAddress=as at example.com
# altsubject_match: Substring to be matched against the alternative subject
#       name of the authentication server certificate. If this string is set,
#       the server sertificate is only accepted if it contains this string in
#       an alternative subject name extension.
#       altSubjectName string is in following format: TYPE:VALUE
#       Example: DNS:server.example.com
#       Following types are supported: EMAIL, DNS, URI
# phase1: Phase1 (outer authentication, i.e., TLS tunnel) parameters
#       (string with field-value pairs, e.g., "peapver=0" or
#       "peapver=1 peaplabel=1")
#       'peapver' can be used to force which PEAP version (0 or 1) is used.
#       'peaplabel=1' can be used to force new label, "client PEAP encryption",
#       to be used during key derivation when PEAPv1 or newer. Most existing
#       PEAPv1 implementation seem to be using the old label, "client EAP
#       encryption", and wpa_supplicant is now using that as the default value.
#       Some servers, e.g., Radiator, may require peaplabel=1 configuration to
#       interoperate with PEAPv1; see eap_testing.txt for more details.
#       'peap_outer_success=0' can be used to terminate PEAP authentication on
#       tunneled EAP-Success. This is required with some RADIUS servers that
#       implement draft-josefsson-pppext-eap-tls-eap-05.txt (e.g.,
#       Lucent NavisRadius v4.4.0 with PEAP in "IETF Draft 5" mode)
#       include_tls_length=1 can be used to force wpa_supplicant to include
#       TLS Message Length field in all TLS messages even if they are not
#       fragmented.
#       sim_min_num_chal=3 can be used to configure EAP-SIM to require three
#       challenges (by default, it accepts 2 or 3)
# phase2: Phase2 (inner authentication with TLS tunnel) parameters
#       (string with field-value pairs, e.g., "auth=MSCHAPV2" for EAP-PEAP or
#       "autheap=MSCHAPV2 autheap=MD5" for EAP-TTLS)
# Following certificate/private key fields are used in inner Phase2
# authentication when using EAP-TTLS or EAP-PEAP.
# ca_cert2: File path to CA certificate file. This file can have one or more
#       trusted CA certificates. If ca_cert2 is not included, server
#       certificate will not be verified. This is insecure and the CA file
#       should always be configured.
# client_cert2: File path to client certificate file
# private_key2: File path to client private key file
# private_key2_passwd: Password for private key file
# dh_file2: File path to DH/DSA parameters file (in PEM format)
# subject_match2: Substring to be matched against the subject of the
#       authentication server certificate.
# altsubject_match2: Substring to be matched against the alternative subject
#       name of the authentication server certificate.
#
# EAP-PSK variables:
# eappsk: 16-byte (128-bit, 32 hex digits) pre-shared key in hex format
# nai: user NAI
# server_nai: authentication server NAI
#
# EAP-FAST variables:
# pac_file: File path for the PAC entries. wpa_supplicant will need to be able
#       to create this file and write updates to it when PAC is being
#       provisioned or refreshed.
# phase1: fast_provisioning=1 option enables in-line provisioning of EAP-FAST
#       credentials (PAC)
#
# wpa_supplicant supports number of "EAP workarounds" to work around
# interoperability issues with incorrectly behaving authentication servers.
# These are enabled by default because some of the issues are present in large
# number of authentication servers. Strict EAP conformance mode can be
# configured by disabling workarounds with eap_workaround=0.

# EAP-PEAP/MSCHAPv2 configuration for RADIUS servers that use the new peaplabel
# (e.g., Radiator)
network={
        ssid="PAL2.0"
#       scan_ssid="1"
        mode="0"
# This is where the cert is stored in debian.  apt-get install ca-certificates.
        ca_cert="/usr/share/ca-certificates/mozilla/Thawte_Premium_Server_CA.crt"
        proto=WPA
        key_mgmt=WPA-EAP
        auth_alg=OPEN
        pairwise=TKIP
        group=TKIP
        eap=PEAP
        identity="username"
        password="password"
        phase1="peaplabel=1"
        phase2="auth=MSCHAPV2"
        priority=1
}

Using the configuration above:

Command: sudo wpa_supplicant -i ath0 -d madwifi -c /etc/wpa_supplicant.conf

Output:

Initializing interface 'ath0' conf '/etc/wpa_supplicant.conf' driver 
'default'
Configuration file '/etc/wpa_supplicant.conf' -> '/etc/wpa_supplicant.conf'
Reading configuration file '/etc/wpa_supplicant.conf'
ctrl_interface='/var/run/wpa_supplicant'
ctrl_interface_group=0
eapol_version=1
ap_scan=1
fast_reauth=1
opensc_engine_path='/usr/lib/opensc/engine_opensc.so'
pkcs11_engine_path='/usr/lib/opensc/engine_pkcs11.so'
pkcs11_module_path='/usr/lib/pkcs11/opensc-pkcs11.so'
Priority group 1
   id=0 ssid='PAL2.0'
Initializing interface (2) 'ath0'
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: KEY_RX entering state NO_KEY_RECEIVE
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
Own MAC address: 00:09:5b:ed:97:0b
wpa_driver_hostap_set_wpa: enabled=1
wpa_driver_hostap_set_wpa: enabled=0
wpa_driver_hostap_set_drop_unencrypted: enabled=0
wpa_driver_hostap_set_countermeasures: enabled=0
wpa_driver_hostap_set_key: alg=none key_idx=0 set_tx=0 seq_len=0 key_len=0
Failed to set encryption.
wpa_driver_hostap_set_key: alg=none key_idx=1 set_tx=0 seq_len=0 key_len=0
Failed to set encryption.
wpa_driver_hostap_set_key: alg=none key_idx=2 set_tx=0 seq_len=0 key_len=0
Failed to set encryption.
wpa_driver_hostap_set_key: alg=none key_idx=3 set_tx=0 seq_len=0 key_len=0
Failed to set encryption.

My configuration file for xsupplicant 
(/etc/xsupplicant/xsupplicant.conf) is as follows:

# This is a configuration file for connecting to PAL2.0 using xsupplicant.

##########################################################################
#                              GLOBAL SECTION                            #
##########################################################################

network_list = PAL2.0

default_netname = PAL2.0

startup_command = <BEGIN_COMMAND>iwconfig %i essid PAL2.0<END_COMMAND>

first_auth_command = <BEGIN_COMMAND>dhclient %i<END_COMMAND>

reauth_command = <BEGIN_COMMAND>dhclient %i<END_COMMAND>

logfile = /var/log/xsupplicant.log

allow_interfaces = %i

deny_interfaces = eth0

##########################################################################
#                             NETWORK SECTION                            #
##########################################################################

PAL2.0 {

  allow_types = all

  identity = <BEGIN_ID>My username<END_ID>

  eap-peap {
      root_cert = 
/usr/share/ca-certificates/mozilla/Thawte_Premium_Server_CA.crt
      chunk_size = 1398
      random_file = /dev/urandom
      session_resume
     
      eap-mschapv2 {
        username = <BEGIN_UNAME>My username<END_UNAME>
        password = <BEGIN_PASS>My password<END_PASS>
      }
  }
}

With xsupplicant I get the following:

Command: sudo xsupplicant -i atho

Output:

Using default config!
network_list: "PAL2.0"
Default network: "PAL2.0"
Startup command: "iwconfig %i essid PAL2.0"
First_Auth command: "dhclient %i"
Reauth command: "dhclient %i"
Logfile: "/var/log/xsupplicant.log"
%allow_interface_list: "i"
deny_interface_list: "eth0"
Allow Types: ALL
ID: "rsgill"
peap root_cert: 
"/usr/share/ca-certificates/mozilla/Thawte_Premium_Server_CA.crt"
peap chunk: 1398
peap rand: "/dev/urandom"
Error (null), 39: Unkown token '/dev/urandom'
There was a problem with the config file.  We cannot continue.

Can anyone help???

Gill