IEEE8021X wpa_supplicant WIRED interface 16.10

Question

I am attempting to come up with automated standards for our department linux machines to connect to our Cisco ISE (802.1X) network.

In the past I have simply added lines such as the following to the end of /etc/rc.local.

ifdown eth0
sleep3
wpa_supplicant -c /etc/wpa_supplicant/wpa_supplicant.conf -Dwired -ieth0 &
sleep 5
ifup eth0

Then in my /etc/wpa_supplicant/wpa_supplicant.conf I have:

country=US
ctrl_interface=/var/run/wpa_supplicant
update_config=1
ap_scan=0
network={
       key_mgmt=IEEE8021X
       eap=PEAP
       identity="username"
       password=""
       eapol_flags=0
}

This seems to fit the bill but I know there is a much better way to do it and I was hoping someone could enlighten me!

Note: in this case it is a server and no Network Manager but I have had trouble getting the Network Manager gui and have fallen back to this method even with desktops.

Answer 1

OK I figured it out!

I dropped the /etc/rc.local business and now in addition to the wpa_supplicant.conf I now have the following in my /etc/network/interfaces.

auto enp0s31f6
iface enp0s31f6 inet dhcp
     pre-up wpa_supplicant  -c /etc/wpa_supplicant/wpa_supplicant.conf -Dwired -ienp0s31f6 &
     pre-up sleep 4
     post-down pkill wpa_supplicant

This works on reboot and also with ifup/ifdown. Yay!

Also if one wishes to be more secure you can do the following to generate a NTPasswordHash that you can use instead of plaintext password.

echo -n your_password | iconv -t utf16le | openssl md4

You will then place that in the password field for your network in wpa_supplicant.conf as follows:

password=hash:6602f435f01b9173889a8d3b9bdcfd0b

NOTE: You must omit the quotes or else it will try to send the actual string (with hash:) and fail.