--
Since it appears that very few people take wireless security seriously, I'd like to come up with my first HOWTO and explain how I was able to configure a secure home network using WPA2, the latest encryption & authentication standard. There are also other types of configuration (WPA1, mixed mode, LEAP, PEAP, DHCP, etc.) shown in the appendix. Feedback is much appreciated.
Common stumbling blocks - Make sure that:
1. Ethernet cable is unplugged.
2. No firewall & configuration tool is running (e.g. Firestarter).
3. MAC filtering is disabled.
4. NetworkManager, Wifi-Radar & similar wireless configuration tools are disabled/turned off and not in use.
5. Some cards/drivers (e.g. Madwifi) do not support WPA2 (AES). Try WPA1 (TKIP) if WPA2 secured connections fail.
6. RTxxx (Ralink) drivers do not support this approach. Either install "ndiswrapper" replacing Serialmonkey's driver or visit this site.
7. Turn off "roaming" if you repeatedly fail to establish a connection.
My Requirements:
1. WPA2 / RSN
2. AES / CCMP
3. Hidden ESSID (no broadcast)
4. Static IP (because I use port forwarding & firewall, etc.)
5. Pre-shared key (no EAP)
If you want to know more about WPA / RSN & 802.11i security specification, I recommend this site.
Now let's get started:
0. Install "wpa-supplicant":
Quote:
| sudo apt-get install wpasupplicant |
Quote:
| iwconfig |
Quote:
| iwlist scan |
2. Open "/etc/network/interfaces":
Quote:
| sudo gedit /etc/network/interfaces |
Quote:
| auto lo iface lo inet loopback auto wlan0 iface wlan0 inet dhcp |
Quote:
| auto wlan0 iface wlan0 inet static address 192.168.168.40 gateway 192.168.168.230 dns-nameservers 192.168.168.230 netmask 255.255.255.0 wpa-driver wext wpa-ssid wpa-ap-scan 2 wpa-proto RSN wpa-pairwise CCMP wpa-group CCMP wpa-key-mgmt WPA-PSK wpa-psk |
- auto wlan0:
Your network interface (e.g. wlan0, eth1, rausb0, ra0, etc.).
- iface wlan0 inet static:
Self-explanatory... I am using a Static IP instead of DHCP. "iface wlan0" must correspond to your network interface (see above).
- address, netmask, [..], dns-nameservers:
Also self-explanatory... Be aware that "broadcast" needs to end with ".255" for negotiation with the router. These lines need to be according to your own (static) network settings. For DHCP see further below.
- wpa-driver:
That's the wpa-driver for your card ('wext' is a generic driver that is applicable when using "ndiswrapper"). Leave it as it is. Other drivers are:Quote:hostap = Host AP driver (Intersil Prism2/2.5/3)
atmel = ATMEL AT76C5XXx (USB, PCMCIA)
wext = Linux wireless extensions (generic)
madwifi = Atheros
wired = wpa_supplicant wired Ethernet driver
- wpa-ssid:
Your network's ESSID (no quotes "").
- wpa-ap-scan:
"1" = Broadcast of ESSID.
"2" = Hidden broadcast of ESSID.
- wpa-proto:
"RSN" = WPA(2)
"WPA" = WPA(1)
- wpa-pairwise & wpa-group:
"CCMP" = AES cipher as part of WPA(2) standard.
"TKIP" = TKIP cipher as part of WPA(1) standard.
- wpa-key-mgmt:
"WPA-PSK" = Authentication via pre-shared key (see 'key generation' further below).
"WPA-EAP" = Authentication via enterprise authentication server.
Now convert your WPA ASCII password using the following command:
Quote:
| wpa_passphrase |
Quote:
| network={ ssid="test" #psk="12345678" psk=fe727aa8b64ac9b3f54c72432da14faed933ea511ecab1 5bbc6c52e7522f709a } |
Quote:
| sudo /etc/init.d/networking restart |
*****************************Revoking read-permission from 'others'*********************************
Quote:
| sudo chmod o=-r /etc/network/interfaces |
*****************************Sample configuration WPA2 & DHCP, ESSID broadcast enabled***************
Quote:
| auto wlan0 iface wlan0 inet dhcp wpa-driver wext wpa-ssid wpa-ap-scan 1 wpa-proto RSN wpa-pairwise CCMP wpa-group CCMP wpa-key-mgmt WPA-PSK wpa-psk |
*****************************Sample configuration WPA1 & DHCP, ESSID broadcast enabled***************
Quote:
| auto wlan0 iface wlan0 inet dhcp wpa-driver wext wpa-ssid wpa-ap-scan 1 wpa-proto WPA wpa-pairwise TKIP wpa-group TKIP wpa-key-mgmt WPA-PSK wpa-psk |
****************************Sample configuration mixed mode (WPA1, WPA2) & DHCP, ESSID broadcast*****
Quote:
| auto wlan0 iface wlan0 inet dhcp wpa-driver wext wpa-ssid wpa-ap-scan 1 wpa-proto WPA RSN wpa-pairwise TKIP CCMP wpa-group TKIP CCMP wpa-key-mgmt WPA-PSK wpa-psk |
****************************Sample conf. LEAP, WEP, DHCP, ESSID broadcast***************************
Quote:
| auto wlan0 iface wlan0 inet dhcp wpa-driver wext wpa-ssid wpa-ap-scan 1 wpa-eap LEAP wpa-key-mgmt IEEE8021X wpa-identity wpa-password |
****************************Sample conf. PEAP, AES, DHCP, ESSID broadcast***************************
Quote:
| auto wlan0 iface wlan0 inet dhcp wpa-driver wext wpa-ssid wpa-ap-scan 1 wpa-proto RSN wpa-pairwise CCMP wpa-group CCMP wpa-eap PEAP wpa-key-mgmt WPA-EAP wpa-identity wpa-password |
*****************************Sample conf. TTLS, WEP, DHCP, ESSID broadcast**************************
Quote:
| auto wlan0 iface wlan0 inet dhcp wpa-driver wext wpa-ssid wpa-ap-scan 1 wpa-eap TTLS wpa-key-mgmt IEEE8021X wpa-anonymous-identity wpa-identity wpa-password wpa-phase2 auth=PAP [Also: CHAP, MSCHAP, MSCHAPV2] |
*****************************NOT TESTED: Sample conf. EAP-FAST, WPA1/WPA2, DHCP, ESSID broadcast****
Quote:
| auto wlan0 iface wlan0 inet dhcp wpa-driver wext wpa-ssid wpa-ap-scan 1 wpa-proto RSN WPA wpa-pairwise CCMP TKIP wpa-group CCMP TKIP wpa-key-mgmt WPA-EAP wpa-eap FAST wpa-identity wpa-password wpa-phase1 fast_provisioning=1 wpa-pac-file /path/to/eap-pac-file |
*****************************Tested adapters****************************************** *********
Quote:
| 1. Linksys WUSB54G V4 (ndiswrapper; wpa-driver = wext) 2. Intel IPW2200 (Linux driver; wpa-driver = wext) 3. Linksys WPC54G (ndiswrapper; wpa-driver = wext) 4. D-Link WNA-2330 (Linux driver; wpa-driver = madwifi) 5. Linksys WMP54G V2 (ndiswrapper; wpa-driver = wext) 6. D-Link WDA-2320 (Linux driver; wpa-driver = madwifi) 7. Netgear WPN311 (Linux driver; wpa-driver = wext) 8. Netgear WG511v2 (ndiswrapper; wpa-driver = wext) |
*****************************Post this if you are stumped******************************************
Quote:
| # route # iwconfig # sudo iwlist scan # sudo lshw -C network # sudo cat /etc/network/interfaces # sudo ifdown -v # sudo ifup -v |
*****************************Other useful commands****************************************** ***
Quote:
# Ubuntu version & kernel >> uname -a # Root file access >> alt F2 then 'gksudo nautilus' in cli
# Get IP Address or Renew >> sudo dhclient wlan0 [or whatever your wl adapter is]
# Get wireless info >> iwconfig
# Get AP info >> iwlist scan
# Get wireless info >> iwlist (lots of options will list)
# Routes if wlan0 working >> route
# DNS resolving via eth1 >> cat /etc/resolv.conf
# List devices/modules >> lspci, lsusb, lshw, lsmod
# Restart network >> sudo /etc/init.d/networking restart
# Boot messages >> dmesg
# Kill NWM >> sudo killall NetworkManager
# Events from your wl >> iwevent
# Restart all daemons >> sudo /etc/init.d/dbus restart
# Restart network >> sudo /etc/init.d/networking restart
No comments:
Post a Comment