Wpa_supplicant eduroam errors

Mamo23 · October 1, 2019, 7:09am

I live in a university campus with eduroam network and I'm trying to use a router with OpenWrt (GlInet MT300N-V2) connected to a ethernet port on the wall to create a private WiFi subnetwork.

I'm using wpad to do the authentication process on the router but it's giving me some errors and I struggled to find a solution (even in the 2nd page on Google...).

The .conf file is provided by a shell script my university gives to users who want to connect a Linux PC to the network.

Execution of 'configuration shell script' and 'wpa_supplicant' with errors: (image)

JamesT42 · October 1, 2019, 7:21am

Hi! Please provide the cat_installer.conf file. Make sure to delete your personal info before posting it.

Mamo23 · October 1, 2019, 11:50am

here is the cat_installer.conf file my university shell script automatically generated.

this is for connecting with TTLS:

Mamo23 · October 1, 2019, 12:02pm

[i can only put 1 image each post]

and this is the .conf for connecting with TLS with a certificate instead of user and psw

mk24 · October 1, 2019, 12:57pm

Post code or logs with code tags.

You should be able to do this with UCI configuration. Note that you need to replace the default wpad-mini or wpad-basic package with the full wpad to have 802.1X support. Install the package named 'wpad' not any of the ones named wpa-supplicant. Wpad includes wpa-supplicant functionality.

Mamo23 · October 1, 2019, 1:01pm

I've already removed mini and installed full wpad.

JamesT42 · October 1, 2019, 1:10pm

Is openssl installed on the device? Why is the configuration twice in each file? What method does your university want, TLS or TTLS?

Mamo23 · October 1, 2019, 1:17pm

Openssl is installed.

The configuration is double because my university has its own network polimi-protected and the eduroam network coexisting. You can connect to either one at anytime.

The university network does not have a preference between TLS or TTLS. You can use either and it will work fine. TLS has the advantage of having a certificate instead of a US/PSW authentication and since my university requires you to change your password every six months TLS can be setup once and then never touched again. Therefore I'm trying to do it with TLS now.

Mamo23 · October 1, 2019, 1:54pm

Sorry I don't know HTML well

TLS:


network={

ssid="eduroam"

key_mgmt=WPA-EAP

pairwise=CCMP

group=CCMP TKIP

eap=TLS

ca_cert="/root/.cat_installer/ca.pem"

identity="xxxxxxxx@polimi.it"

domain_suffix_match="wifi.polimi.it"

private_key="/root/.cat_installer/user.p12"

private_key_passwd="xxxxxxxxxxxxxxx"

}
network={

ssid="polimi-protected"

key_mgmt=WPA-EAP

pairwise=CCMP

group=CCMP TKIP

eap=TLS

ca_cert="/root/.cat_installer/ca.pem"

identity="xxxxxxxx@polimi.it"

domain_suffix_match="wifi.polimi.it"

private_key="/root/.cat_installer/user.p12"

private_key_passwd="xxxxxxxxxxxxxxx"

}

TTLS:


network={

ssid="eduroam"

key_mgmt=WPA-EAP

pairwise=CCMP

group=CCMP TKIP

eap=TTLS

ca_cert="/root/.cat_installer/ca.pem"

identity="xxxxxxxx@polimi.it"

domain_suffix_match="wifi.polimi.it"

phase2="Auth=PAP"

password="xxxxxxxxxx"

anonymous_identity="anonymous@polimi.it"

}
network={

ssid="polimi-protected"

key_mgmt=WPA-EAP

pairwise=CCMP

group=CCMP TKIP

eap=TTLS

ca_cert="/root/.cat_installer/ca.pem"

identity="xxxxxxxx@polimi.it"

domain_suffix_match="wifi.polimi.it"

phase2="Auth=PAP"

password="xxxxxxxxxx"

anonymous_identity="anonymous@polimi.it"

}

lleachii · October 1, 2019, 3:20pm

@Mamo23, welcome to the community!

Why are you trying to load the conf file?...why don't you just properly copying the certificate to the device and entering these settings in the wireless web GUI page?

Mamo23 · October 1, 2019, 3:44pm

I just searched on the internet how to connect a OpenWrt router to a ethernet with TLS/TTLS.

If you know another method I'll be glad to try it out.

lleachii · October 1, 2019, 3:49pm

https://openwrt.org/docs/guide-user/network/wifi/basic#wpa_enterprise_client

Mamo23 · October 1, 2019, 4:06pm

You said GUI, so those changes to the options can be made in the wireless configuration page? Not from the openwrt terminal

lleachii · October 1, 2019, 4:10pm

Correct.

Just browse to Network > Wireless after installing software at System > Software. I apologize for not being clear where to browse.

There's not much effort to browsing the menu of the web GUI.

Mamo23 · October 1, 2019, 4:30pm

I made sure that full wpad and openssl were installed from the GUI.
But in network I have
-interfaces
-switch
-DHCP and DNS
-Hostnames
-Static routes
-Firewall
-Diagnostics

I guessed interfaces

Then I went to the voice "WAN" since that's the port connected to the ethernet.

But in there i only found physical/firewall/protocol settings. I couldn't find a page to set Those parameters.

lleachii · October 1, 2019, 4:37pm

Are you saying that you don't have a Wireless page?
Was it present before you changed software packages?

Mamo23 · October 1, 2019, 4:47pm

it's always been like this:

here you can also see what's in the interfaces web page.

mk24 · October 1, 2019, 6:55pm

If you don't have Network -- Wireless I would suggest to re-install OpenWrt and start over from a clean start. Likely something has been broken trying to follow instructions and run scripts intended for a desktop Linux. A main distinction of OpenWrt is that it has a suite of features to integrate configuration, particularly network related configuration.

The Network-Wireless web page leads to a file /etc/config/wireless, which is then parsed to make a temporary config file in wpa_supplicant format. Either edit /etc/config/wireless with the CLI, or use the GUI to make changes.

You should never need to or attempt to edit a wpa_supplicant config directly, let UCI build it (though it can be useful to inspect the file to see that it was built correctly). The file is placed on the RAM disk and rebuilt every time the wifi system is restarted.

Mamo23 · October 1, 2019, 10:59pm

Why most of the guides in openwrt forum make the user generate the .conf file themselves and run it with wpa_supplicant if it's not supposed to work that way?
Clearly this has worked for someone.
During my first try I also generated one myself, then I discovered that my university script when it can't setup the network manager creates a .conf file and I tried to use that.

By the way I still have the wireless configuration file in /etc/config. It just doesn't show up in the GUI if you say it's supposed to.

I'll try to reset the router to factory settings and see if something changes but it's still unclear whether I'll be able to connect to the network from the GUI or not.

mk24 · October 1, 2019, 11:36pm

The GUI is most likely the most up to date way to do this. Once you reach the page it is point and go, especially for password authentication. There are also some notes on the options in /etc/config/wireless here (scroll down to "WPA Enterprise (Client)
https://openwrt.org/docs/guide-user/network/wifi/basic
Writing your own conf file is definitely not recommended, it will conflict with the UCI system scripts. Are there any such recommendations in the OpenWrt wiki? it would be good to edit those.