2

My users are using Ubuntu on corporate laptops. They don't have sudo permissions. IT security policy deny connections to open WiFi networks. How to setup Network Manager to deny connections to that networks and permit connections only to encrypted wireless networks?

Users will connect to random wifi. I don't want to restrict connections only to known wifi networks.

1

There is a directory /etc/network/if-up.d. Scripts in this directory are runs when new connection are established. I write script that checks connection mode of wifi network and if it's Open or WEP connection is dropped.

#!/bin/bash

encryption=$(wpa_cli status | grep pairwise_cipher | cut -d "=" -f 2)
wifiname=$(wpa_cli status | grep -w ssid | cut -d "=" -f 2)
interface=$(wpa_cli status | grep interface | cut -d " " -f 3 | tr -d "'")

if [[ $encryption == WEP* ]]; then
    nmcli device disconnect $interface
fi
if [[ $encryption == NONE ]]; then
    nmcli device disconnect $interface
fi
0
  1. Change permissions access to Network Manager
  2. Delete all open wifi from configuration
  3. Check connect automatically to your wifi configuration, and enforce the configuration by adding mac address of your ap.

How do I ban a wifi network in Network Manager?

  • I don't know what MAC addresses will be. I want to disable possibility to connect to open wifi. – QkiZ Sep 2 '15 at 19:26
  • Are your users allowed to choose the connection? Is it possible to use custom script to handle this situation? – Nico Mkhatvari Sep 2 '15 at 20:06
  • There are possibility to run script after interface is connected. But I don't know how to check security mode of wifi connection. – QkiZ Sep 3 '15 at 10:30
0

I see the only one way to do it.

You can disable Network Manager and setup specific wireless networks in /etc/network/interfaces.

If you setup your interface there, NM will stop managing the interface automatically.

  • Don't know who downvoted but i see no issue with your answer. Perhaps a bit more details and steps will help – Sergiy Kolodyazhnyy Sep 3 '15 at 12:13
0
  • I thought the best is to use pre-up script which have all variable you need:

    /etc/network/if-pre-up.d/
    

    Check for example: /etc/network/if-pre-up.d/wireless-tools

    Sadly, NetworkManager/dispatcher has not implemented it. See:

    /etc/NetworkManager/dispatcher.d/01ifupdown

    # pre-up/pre-down not implemented. See
    # https://bugzilla.gnome.org/show_bug.cgi?id=387832
    #        pre-up)
    #            export MODE="start"
    #            export PHASE="pre-up"
    #            run-parts /etc/network/if-pre-up.d
    #            ;;
    #        pre-down)
    #            export MODE="stop"
    #            export PHASE="pre-down"
    #            run-parts /etc/network/if-down.d
    #            ;;
    
  • Anyway, I see you have used /etc/network/if-up.d . It does not have all information you want like encryption type, but it has some like interface name and WiFi SSID. You can minimize external calls.

    You can study any environment with a simple script as this:

    #!/bin/sh
    #myuser
    
    logfile=/home/myuser/Desktop/wireless-pre-up.log
    
    touch $logfile
    
    echo args: $@ >> $logfile
    env >> $logfile
    echo == >> $logfile
    

    Output (wireless-pre-up.log):

    args: wlan0 up
    DHCP4_REQUESTED_NTP_SERVERS=1
    DHCP4_REQUESTED_TIME_OFFSET=1
    DHCP4_SUBNET_MASK=255.255.255.0
    DHCP4_REQUESTED_DOMAIN_SEARCH=1
    DHCP4_REQUESTED_HOST_NAME=1
    DHCP4_REQUESTED_MS_CLASSLESS_STATIC_ROUTES=1
    CONNECTION_UUID=35821fc8-d6ce-4fb2-bb5d-ac4a52aa931e
    DHCP4_REQUESTED_SUBNET_MASK=1
    DEVICE_IFACE=wlan0
    IP4_NAMESERVERS=192.168.1.1
    DHCP4_DHCP_SERVER_IDENTIFIER=192.168.1.1
    DHCP4_REQUESTED_NETBIOS_NAME_SERVERS=1
    DHCP4_REQUESTED_DOMAIN_NAME=1
    DHCP4_DHCP_LEASE_TIME=86400
    DHCP4_EXPIRY=1441408529
    DHCP4_NETWORK_NUMBER=192.168.1.0
    IP4_NUM_ADDRESSES=1
    DHCP4_ROUTERS=192.168.1.1
    PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
    IP4_NUM_ROUTES=0
    IP4_ADDRESS_0=192.168.1.4/24 192.168.1.1
    DEVICE_IP_IFACE=wlan0
    DHCP4_REQUESTED_ROUTERS=1
    DHCP4_REQUESTED_STATIC_ROUTES=1
    DHCP4_BROADCAST_ADDRESS=192.168.1.255
    DHCP4_IP_ADDRESS=192.168.1.4
    DHCP4_NEXT_SERVER=0.0.0.0
    DHCP4_REQUESTED_INTERFACE_MTU=1
    DHCP4_DHCP_MESSAGE_TYPE=5
    DHCP4_REQUESTED_BROADCAST_ADDRESS=1
    DHCP4_DOMAIN_NAME_SERVERS=192.168.1.1
    CONNECTION_ID=MyWifiName
    DHCP4_REQUESTED_WPAD=1
    PWD=/
    DHCP4_REQUESTED_DOMAIN_NAME_SERVERS=1
    DHCP4_REQUESTED_NETBIOS_SCOPE=1
    DHCP4_REQUESTED_RFC3442_CLASSLESS_STATIC_ROUTES=1
    

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.