10

I know there are about a dozen other questions like this, but so far none have helped me.

My school uses a WPA2 Enterprise PEAP/MSCHAPv2 network without a cert(which I determined from a windows laptop that connected without an issue). I'm trying to connect with my Ubuntu 16.04 LTS machine (which is pretty much a fresh installation).

Unfortunately, it is unsuccessful. It tries to connect for a while, then brings up a username/password reentry dialogue. If you hit submit on this, it simply fails again and brings it back up.

The following shows the settings and the message that keeps coming up: enter image description here

The following is the /etc/NetworkManager/system-connections/ entry:

[connection]
id=tusd-students
uuid=d815af85-42ad-49b2-b207-1db6359e8c9a
type=wifi
permissions=user:ashwin:;
secondaries=

[wifi]
mac-address={my mac address}
mac-address-blacklist=
mac-address-randomization=0
mode=infrastructure
seen-bssids=
ssid=tusd-students

[wifi-security]
auth-alg=open
group=
key-mgmt=wpa-eap
pairwise=
proto=

[802-1x]
altsubject-matches=
eap=peap;
identity={my username}
password={my password}
phase2-altsubject-matches=
phase2-auth=mschapv2

[ipv4]
dns-search=
method=auto

[ipv6]
addr-gen-mode=stable-privacy
dns-search=
method=auto

I've read in many places that adding system-ca-certs=false fixes it, but that didn't work. I also tried adding the domain Domain\username but that didn't work. I've tried everything here and in many other posts. Not sure what to do, I'm new to Linux. Any help is greatly apreciated, if there is some other info I should include please let me know. Thanks!

note: I can't obtain a certificate because I seriously doubt I'll be able to contact someone who'd give me one (as I am a student). Not to mention, I don't think they'd be familiar with a Linux based system as the school issued computers are Windows 10.

edit: I read a lot that the problem was caused by Wpasupplicant 2.4. So, I tried downgrading to 2.1. This actually worked* when I restarted, but after a while disconnected and I couldn't get it to connect again. I even tried reinstalling wpasupplicant 2.1 but it still wouldn't connect. I'm not sure what all that implies, but at least I know that my laptop is capable of connecting to this network and I have the correct security settings/credentials.

*= the connection lasted for aprox. 10 minutes, and was much slower then it should've been. My windows laptop got 60 mbps download while this one got only 15 mbps. Granted however, Windows laptop is 2-3 years newer.

edit 2: My network card in the Ubuntu machine is a Centrino n 1000 Condor Peak from Intel. I'll gather more information on it when I get a chance.

Here is my NetworkManager log https://drive.google.com/file/d/0Bwv36xPVuImIdHQ3bjZvc25SNjg/view?usp=sharing

Here is my /var/log/syslog log https://drive.google.com/file/d/0Bwv36xPVuImIWlRaY2xFdVl1a3M/view?usp=sharing

The relevant portion of both seems to be:

Jul  6 07:58:10 smashtop NetworkManager[928]: <warn>  [1499353090.8128] device (wlp4s0): Activation: (wifi) association took too long
Jul  6 07:58:10 smashtop NetworkManager[928]: <info>  [1499353090.8129] device (wlp4s0): state change: config -> need-auth (reason 'none') [50 60 0]
Jul  6 07:58:10 smashtop kernel: [36118.979991] wlp4s0: deauthenticating from 64:d8:14:86:09:27 by local choice (Reason: 3=DEAUTH_LEAVING)
Jul  6 07:58:10 smashtop NetworkManager[928]: <warn>  [1499353090.8163] device (wlp4s0): Activation: (wifi) asking for new secrets
Jul  6 07:58:10 smashtop wpa_supplicant[1053]: wlp4s0: CTRL-EVENT-DISCONNECTED bssid=64:d8:14:86:09:27 reason=3 locally_generated=1
Jul  6 07:58:10 smashtop NetworkManager[928]: <warn>  [1499353090.8285] sup-iface[0x292acb0,wlp4s0]: connection disconnected (reason -3)

I can test mon-thurs since I'm near the network on those days.

  • I had this issue with my college as well and resolved it by using my college's CA cert (which was not needed on Windows for some odd reason). Is there anywhere you can go to get that certificate and try it out? They should be free for students -- my own university had a guest wifi network that allowed you to download it. – Kaz Wolfe Jul 5 '17 at 19:03
  • @KazWolfe just checked the guest network also, doesn't have the cert for me to download. – Ashwin Gupta Jul 5 '17 at 19:26
  • Have you tried adding interface-name={your interface} under connection and phase1-peapver=0 or phase1-peapver=1 under 802-1x? – user633551 Jul 5 '17 at 19:54
  • @user633551 Just tried, didn't work sadly. – Ashwin Gupta Jul 5 '17 at 20:00
  • what does /var/log/syslog say when you are trying to connect? – user633551 Jul 5 '17 at 20:10
3

This solved my problem (from here).

[ipv6]
method=auto

[connection]
id=SSID #(e.g.EDUroam)
uuid=9e123fbc-0123-46e3-97b5-f3214e123456 #unique uuid will be created upon creation of this profile
type=802-11-wireless

[802-11-wireless-security]
key-mgmt=wpa-eap
auth-alg=open

[802-11-wireless]
ssid=SSID
mode=infrastructure
mac-address=0A:12:3C:DA:C1:A5
security=802-11-wireless-security

[802-1x]
eap=peap;
identity=studentid123123
phase2-auth=mschapv2
password=mypass123123

[ipv4]
method=auto

Remove everything else.

I also patched DNSSEC with this, but I'm not sure if it is needed.

0

You need to obtain the CA Certificate for the network and install it as detailed In this answer. You should be able to obtain this by asking the IT technitians at the school

You will not be able to connect to the network properly otherwise because the network requires the client machine to have the certificate for authentification reasons. The reason it does not need to be done in windows is that when it connects to the network it automatically downloads and trusts the certificate during the connection process.

  • Ok Alex, I'll give it a shot today at our snack break. I hope that they will give me one. Thanks for the answer. I'll let you know how it goes. – Ashwin Gupta Jul 19 '17 at 13:32
  • good luck they were very happy to give the certificate to me at my school – LinuxSailorTech Jul 19 '17 at 13:43
  • What are you basing this off of? At my school no certificate is required for a setup that looks identical to this. – Seth Jul 19 '17 at 17:06
  • @Alex2012 sigh. So the on site IT person was completely useless. She didn't even know what a cert file or Ubuntu is. I'll be emailing the school district IT department, but it may take a while to get a response so I'll let you know. – Ashwin Gupta Jul 19 '17 at 17:11
  • @Seth yeah IDK if you need a cert, any alternative ideas? – Ashwin Gupta Jul 19 '17 at 17:11
0

All IT organizations that are not operating at level zero (chaos mode) of the ITSM publish procedures for standard operations such as connecting to the organizations network(s). One can always take their chances and try to connect to a network without consulting this document however, if using the standard, default connection choices doesn't work, step one would be to obtain a copy of your IT's wireless network connection procedure and follow it.

As an aside, it's very rare for non DOD/DOE environments to be especially rigid in their network connection protocols. This is especially true of academic environments, in my experience.

The OP posted a painfully long syslog file that turned out to be a log of a home network connection (which worked). That sort of information is obviously useless in troubleshooting this problem. You would need to look at

/var/log/syslog

after you try to connect to the school network and fail to succeed. It should be fairly obvious looking at syslog what is rejecting the connection and the solution may be obvious.

Likely suspects:

  • Incorrect/invalid username and/or password

  • Incorrect authentication type/settings

  • Attempting to connect to the wrong WiFi

Failing that, you are already aware of other relevant log files and tools that can help quickly zero in on your problem source.

I think the cert issue is a red herring. Your problem is likely to have a far less exotic cause.

Here's what seems to be the relevant log dialog:

Jul  6 07:57:45 smashtop wpa_supplicant[1053]: wlp4s0: SME: Trying to authenticate with 64:d8:14:86:09:27 (SSID='tusd-students' freq=2412 MHz)
Jul  6 07:57:45 smashtop kernel: [36094.105988] wlp4s0: authenticate with 64:d8:14:86:09:27
Jul  6 07:57:45 smashtop kernel: [36094.109190] wlp4s0: send auth to 64:d8:14:86:09:27 (try 1/3)
Jul  6 07:57:45 smashtop wpa_supplicant[1053]: wlp4s0: Trying to associate with 64:d8:14:86:09:27 (SSID='tusd-students' freq=2412 MHz)
Jul  6 07:57:45 smashtop kernel: [36094.126523] wlp4s0: authenticated
Jul  6 07:57:45 smashtop NetworkManager[928]: <info>  [1499353065.9681] device (wlp4s0): supplicant interface state: scanning -> authenticating
Jul  6 07:57:45 smashtop kernel: [36094.133417] wlp4s0: associate with 64:d8:14:86:09:27 (try 1/3)
Jul  6 07:57:45 smashtop NetworkManager[928]: <info>  [1499353065.9731] device (wlp4s0): supplicant interface state: authenticating -> associating
Jul  6 07:57:46 smashtop kernel: [36094.233907] wlp4s0: RX AssocResp from 64:d8:14:86:09:27 (capab=0x431 status=0 aid=19)
Jul  6 07:57:46 smashtop wpa_supplicant[1053]: wlp4s0: Associated with 64:d8:14:86:09:27
Jul  6 07:57:46 smashtop kernel: [36094.239782] wlp4s0: associated
Jul  6 07:57:46 smashtop kernel: [36094.239849] IPv6: ADDRCONF(NETDEV_CHANGE): wlp4s0: link becomes ready
Jul  6 07:57:46 smashtop wpa_supplicant[1053]: wlp4s0: CTRL-EVENT-REGDOM-CHANGE init=COUNTRY_IE type=COUNTRY alpha2=US
Jul  6 07:57:46 smashtop wpa_supplicant[1053]: wlp4s0: CTRL-EVENT-EAP-STARTED EAP authentication started
Jul  6 07:57:46 smashtop NetworkManager[928]: <info>  [1499353066.0795] device (wlp4s0): supplicant interface state: associating -> associated
Jul  6 07:57:46 smashtop kernel: [36094.298099] wlp4s0: Limiting TX power to 11 dBm as advertised by 64:d8:14:86:09:27
Jul  6 07:58:10 smashtop NetworkManager[928]: <warn>  [1499353090.8128] device (wlp4s0): Activation: (wifi) association took too long
Jul  6 07:58:10 smashtop NetworkManager[928]: <info>  [1499353090.8129] device (wlp4s0): state change: config -> need-auth (reason 'none') [50 60 0]
Jul  6 07:58:10 smashtop kernel: [36118.979991] wlp4s0: deauthenticating from 64:d8:14:86:09:27 by local choice (Reason: 3=DEAUTH_LEAVING)
Jul  6 07:58:10 smashtop NetworkManager[928]: <warn>  [1499353090.8163] device (wlp4s0): Activation: (wifi) asking for new secrets
Jul  6 07:58:10 smashtop wpa_supplicant[1053]: wlp4s0: CTRL-EVENT-DISCONNECTED bssid=64:d8:14:86:09:27 reason=3 locally_generated=1
Jul  6 07:58:10 smashtop NetworkManager[928]: <warn>  [1499353090.8285] sup-iface[0x292acb0,wlp4s0]: connection disconnected (reason -3)
Jul  6 07:58:10 smashtop NetworkManager[928]: <info>  [1499353090.8287] device (wlp4s0): supplicant interface state: associated -> disconnected
Jul  6 07:58:10 smashtop wpa_supplicant[1053]: wlp4s0: CTRL-EVENT-REGDOM-CHANGE init=CORE type=WORLD
Jul  6 07:58:10 smashtop gnome-session[1691]: nm-applet-Message: No keyring secrets found for tusd-students 1/802-1x; asking user

Right after the wireless transmit power is reduced your machine seems to "forget" that it just successfully authenticated. You're never given a DHCP lease and the client never asks for one.

Based on what I'm seeing in your logs I'd be looking for a wifi hardware or a wifi driver problem.

  • It's also worth noting, the IT organization at my school is in fact operating in chaos mode from what I have observed. The last IT person I talked to couldn't even provide a superior's email, claiming she didn't really know one. – Ashwin Gupta Jul 20 '17 at 23:39
  • Do whatever makes you happy. I posted my top suspects based on my own experience. I've been in the computer field for 50 years and I've lost track of how many times I tried and failed to log into the wrong server, wrong network or wrong whatever. No personal slight was intended. It's just that with problems like these you can often get tunnel vision and lose sight of the obvious. Since you obviously don't actually want help or advice, flag away. – jones0610 Jul 20 '17 at 23:52
  • that's fair enough, I do agree with what you said about tunnel vision. However, this still isn't really the type of answer I'm looking for. – Ashwin Gupta Jul 20 '17 at 23:54
  • Whatever. Be wary of insulting and flagging someone who is trying to help you... at least until after the problem source has been discovered. Otherwise you could spend a lot of time eating crow. No worries here. I wasn't aware that you had a specific answer you were looking for. I thought you just wanted help solving your problem. Best to you. – jones0610 Jul 21 '17 at 0:04
  • Jones, I think we got off on the wrong foot here. Please understand: I absolutely didn't intend to insult you. I've retracted the flag. I apologize, I realize you are trying to help me, I reacted too strongly after I misinterpreted the situation. That is my bad, please forgive me. (ironically enough, I do appear to be "eating crow" now.) Your recent edit is very helpful information. As a beginner at networking myself, I wouldn't understand the log portion you posted without the explanation you gave. Thanks for this. Any suggestion as to how to have the client "request" the DHCP lease? – Ashwin Gupta Jul 21 '17 at 0:21

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.