68

My university uses WPA2 Enterprise encryption for students to login their wireless. In NetworkManager I have keyed in everything that they needed

  • Security : WPA & WPA2 Enterprise
  • Authentication : Protected EAP (PEAP)
  • CA certificate is not needed
  • PEAP version : Automatic
  • Inner authentication : MSCHAPv2
  • Username and Password are correct.

Everytime I try to connect, I get a window asking me to input my password over and over again

3
  • 4
    I have the same problem on my work's WPA2/PEAP/MSCHAPv2 network. I know this is old, but as of today, it still doesn't work on Ubuntu including the release candidate 19.04. However, I was fiddling with Fedora 29 and connecting works right away! This also works right away on Arch using Xorg and GNOME/NetworkManager GUI or KDE and NetworkManager. I'm not sure why it doesn't on Ubuntu/Mint/Debian/or OpenSUSE distributions like it does on Arch and Fedora >=29. (note it does NOT work on Fedora 28. I had the same input password dialog over and over just like you on Fedora 28). Mar 15, 2019 at 5:43
  • Is this a good reason to migrate to Fedora? May 6, 2019 at 12:16
  • I have this problem on Fedora 34 and 35 now. This problem is nonexistent on Ubuntu 20.04+. However, none of the solutions provided here work on Fedora. Jan 3 at 6:49

7 Answers 7

43

There is a bug report here: https://bugs.launchpad.net/ubuntu/+source/network-manager/+bug/1104476

A workaround is to remove the line

system-ca-cert=true

from the configuration file found in /etc/NetworkManager/system-connections/

7
  • It worked for me, I had exactly the same issue as the OP. Mar 26, 2014 at 8:20
  • 2
    still happening on 14.04 (current beta)
    – prusswan
    Apr 12, 2014 at 7:29
  • Yep, still in 14.04.
    – Reece
    Jun 4, 2014 at 20:25
  • still doesn't work without this line... Jul 29, 2014 at 22:28
  • 2
    This answer did not work for me. The line isn't present in later ubuntu versions. Oddly I have the same symptoms in Fedora version 28 but version 29 now works (arch does as well) OpenSUSE both tumbleweed and Leap15 don't work. Ubuntu 18.04, 18.10 and todays' 19.04 preview snapshot do not work. There's some setting that must be causing the issue that is not longer present in Fedora 29 or Arch but remains in Ubuntu that causes this issue. Mar 15, 2019 at 5:53
29

Here's a work around.

  1. Open a terminal (Alt + F2) and run the following commands:

    cd /etc/NetworkManager/system-connections
    sudo touch SSID #SSID is the name of the profile, e.g. eduroam
    sudo nano SSID
    
  2. Then edit the "SSID" profile as following:

    [ipv6]
    method=auto
    
    [connection]
    id=SSID #(e.g.EDUroam)
    uuid=9e123fbc-0123-46e3-97b5-f3214e123456 #unique uuid will be created upon creation of this profile
    type=802-11-wireless
    
    [802-11-wireless-security]
    key-mgmt=wpa-eap
    auth-alg=open
    
    [802-11-wireless]
    ssid=SSID
    mode=infrastructure
    mac-address=0A:12:3C:DA:C1:A5
    security=802-11-wireless-security
    
    [802-1x]
    eap=peap;
    identity=studentid123123
    phase2-auth=mschapv2
    password=mypass123123
    
    [ipv4]
    method=auto
    

Modify the above file and it should work.

2
  • 4
    It works! Thanks @keith! Here are the changes I had to do: (1) removed the line system-ca-cert=true and (2) replaced password-flags=1 with password=mypassword.
    – Marcelo
    Jul 24, 2014 at 12:57
  • 8 years after, this still works! Thank you.
    – Gautam J
    Dec 2, 2021 at 12:50
8

I had the same problem at work I followed the instructions and changed the system-ca-cert=false but I also had to go in and change the wireless driver settings once I made the changes it connected right up. check out the link where I got the info below

http://wireless.kernel.org/en/users/Documentation/wpa_supplicant

-o<driver> and -O<ctrl>

/usr/share/dbus-1/system-services/fi.epitest.hostap.WPASupplicant.service

[D-BUS Service]
Name=fi.epitest.hostap.WPASupplicant
Exec=/sbin/wpa_supplicant -u -f /var/log/wpa_supplicant.log
User=root

[D-BUS Service]
Name=fi.epitest.hostap.WPASupplicant
Exec=/sbin/wpa_supplicant -u -onl80211 -O/var/run/wpa_supplicant
User=root
1
  • Appending the second entry to my file worked for me, thanks! Jun 16, 2015 at 21:17
6

More recently, many eduroam deployments have broken on Ubuntu 22.04 LTS because they still use insecure renegotiation, which was deprecated by RFC 5746 in 2010 and for which OpenSSL dropped support for around March 2010 (along with TLS 1.0 and 1.1). Until your university fixes its network, you can re-enable insecure renegotiation by editing some config files.

The following steps were contributed to Launchpad Bug #1958267 by users "nfalse" (#22) and Simon Chopin (#36)

Step 1: Create specific openssl.cnf for wpa_supplicant

$ sudo cp /etc/ssl/openssl.cnf /etc/wpa_supplicant/

This will ensure that enabling TLS 1.0 applies only to WPA negotiations, which will mitigate the security impact of this change somewhat.

Step 2: Enable legacy TLS in the copied config file

As root, edit the new config file:

$ sudo gedit /etc/wpa_supplicant/openssl.cnf

Then, find the following lines:

[openssl_init]
providers = provider_sect

Immediately thereafter, insert the following lines:

ssl_conf = ssl_sect

[ssl_sect]
system_default = system_default_sect

[system_default_sect]
Options = UnsafeLegacyRenegotiation
CipherString = DEFAULT@SECLEVEL=1

Step 3: Make wpa_supplicant use the new configuration

As root, edit /usr/lib/systemd/system/wpa_supplicant.service.

$ sudo gedit /usr/lib/systemd/system/wpa_supplicant.service

Find the following lines:

[Service]
Type=dbus
BusName=fi.w1.wpa_supplicant1
ExecStart=/sbin/wpa_supplicant -u -s -O /run/wpa_supplicant
ExecReload=/bin/kill -HUP $MAINPID

After BusName, insert Environment="OPENSSL_CONF=/etc/wpa_supplicant/openssl.cnf". The whole section should read as follows:

[Service]
Type=dbus
BusName=fi.w1.wpa_supplicant1
Environment="OPENSSL_CONF=/etc/wpa_supplicant/openssl.cnf"
ExecStart=/sbin/wpa_supplicant -u -s -O /run/wpa_supplicant
ExecReload=/bin/kill -HUP $MAINPID

Step 4: Restart the wpa_supplicant

You can either reboot your whole computer at this point or just run the following commands:

$ sudo systemctl daemon-reload
$ sudo systemctl restart wpa_supplicant.service
2
  • 4
    I have Ubuntu 22, and can confirm that this works!
    – Jerfov2
    May 3 at 17:14
  • In step three, you're better off using systemctl edit wpa_supplicant.service, and adding those two lines between the comments: [Service] Environment="OPENSSL_CONF=/etc/wpa_supplicant/openssl.cnf" This keeps the original system file intact.
    – rubdos
    May 19 at 16:38
3

You might also need to specify the Domain of your enterprise by adding it before the username like so: Domain Name\Username beside commenting/deleting the above mentioned line..

1

I assume that you're using self-signed certificate (you said: "CA certificate is not needed"). If so, make sure that the certificate is trusted by you when establishing the connection.

5
  • 3
    No, by not needed I mean they do not require us to use any certificate while connecting. Apr 10, 2013 at 11:02
  • 1
    I don't understand what's the purpose of using PEAP without the certificate, but OK. Are you able to connect on any other OSes than Ubuntu? I'm having the same WiFi infrastructure in my company, so maybe I'll be able to help.
    – Guardian
    Apr 10, 2013 at 11:20
  • I'm able to connect using Windows fine. There's a guide on Windows connection here : studentprojects.wordpress.com/tutorial/… which I followed on Windows and it worked fine. Tried replicating it in Ubuntu and it failed. Apr 10, 2013 at 12:14
  • @Guardian you've apparently never tried PEAP-MSCHAPv2. First you connect only with username and password, then it allows you to download certificate. I've seen in this in around 5 universities already. And I have no idea how to download certificate after I've connected to network. wicd allows to connect without certificate.
    – holms
    Jan 18, 2017 at 6:55
  • I too do not need to download a certificate for work on any device (MacOS, iOS, Android, or Windows 10. Just Linux has problems. However oddly, the same exact config on Fedora 29 works but Fedora 28 doesn't. It doesn't work on any version of ubuntu including the 19.04 release candidate despite it using a newer version of kernel, NM, and wpa_supplicant Mar 15, 2019 at 5:45
1
  1. Try resetting your password (by contacting the sys admin or using an online form to send password reset link to your email address)
  2. via network manager gui, edit the wifi connection to update the password field with the new one and save.
  3. Reconnect to your wifi and it should be working now!

Not the answer you're looking for? Browse other questions tagged or ask your own question.