1 About eduroam Wired eduroam... 1

Transcription

1 Contents 1 About eduroam Wired eduroam Microsoft Windows eduroam on Windows XP eduroam on Windows Vista eduroam on Windows Setting up SecureW Using other clients for eduroam support Mac OSX eduroam on Mac OSX eduroam on Mac OSX Linux eduroam on Ubuntu eduroam on Ubuntu Alternative setup using Wicd About eduroam When you want to access to the internet from your laptop, you must log on the to eduroam network. eduroam is an international collaboration for education- and research-institutions, which provides (primaryly) wireless internet access to members of participating organization. DIKU is participating in this collaboration, which means that students and researchers from DIKU can use wireless networks hosted at other participants, and guests can use the wireless network at DIKU. If order to log on to eduroam you need an identity in the format <username>@<domain>, where <domain> is the domain of an organization participating the the eduroam collaboration. In order to log on to eduroam using the username and password you get from your DIKU account, you must use the subdomain di.ku.dk (not diku.dk). Likewise, students from the Institute of Mathematics must use the subdomain math.ku.dk in order to use their accounts, and so forth. 1.1 Wired eduroam At DIKU it is possible to get wired eduroam. This means that you will get network access through a normal network cable. The IT-department recommends this solution where possible, for instance if you are at the same workplace most days. All network outlets marked with a red or green dot are eduroam outlets. This includes the outlets in øvelsesgangen on the ground floor in the north wing and the student outlets in the north wing, in the cafeterie, and the student workplaces in the penthouse. If you want 1

2 to have eduroam in your local network outlet please contact the IT-department. 2 Microsoft Windows In order to get access to eduroam your username and password must be approved through the protocol EAP-TTLS. Unfortunately neither Windows XP, Windows Vista nor Windows 7 support this protocol by default, so you have to install a client in order to get access to eduroam. If you know your installation of Windows already supports TTLS through a third-party client fell free to use that one. Otherwise you can use SecureW2 from Alfa&Ariss. The program is easy to install as you simply answer OK to all questions. As you most likely don t have a network connection at this point, you can find SecureW2 on your USB-stick. 2.1 eduroam on Windows XP After installing SecureW2 the connection is set up as follows: Open the start menu and select connect to, right click on Wireless Network Connection and select Properties. 2

3 Choose Wireless Networks. Click on Add... unless there already is an eduroam on the list. In that case select it and click on Properties. Fill out the boxes as show above. Network Authentication: WPA Data Encryption: TKIP 3

4 Choose Authentication and select SecureW2 as EAP-type. Please make sure that none of the boxes are ticked. Click on Properties under SecureW2 to bring up the set up of SecureW2 (see section 2.4 below). Wired eduroam Wired eduroam have to be set up in the same manner as the wireless. The only difference is you have to configure a different network device. Start -> Control panel -> Network connections -> LAN-connection Set SecureW2 as EAP type Please refer to the set up guide for wireless eduroam above. Please note that if you have service pack 3 on your Windows XP, you have to start the service Wired AutoConfig in order to use the 802.1x network - including eduroam on a wired network. A guide can be found here eduroam on Windows Vista Open Network and Sharing Center. 4

5 Choose Connect to a network. 5

6 Choose Set up a connection or network. From the list, choose Manually connect to a wireless network. Fill out the boxes as shown above. 6

7 We are almost there, we only need to tell Windows to use SecureW2. We do this by clicking on Change connection settings. 7

8 On the tap Security change network authentication method to SecureW2 and click on Settings to bring up the set up of SecureW2 (see section 2.4 below). Wired eduroam Please note that in Windows Vista Cabled 802.1x Network is not enabled by default. You therefore have to start the service Wired AutoConfig to be able to use wired eduroam. One guide can be found at Windows\_Vista\_802.1x\_Wired Wired eduroam have to be set up in the same manner as the wireless. The only difference is you have to configure a different network device. Set up you LAN connection the same way as you did the wireless eduroam. Set SecureW2 as EAP type Please refer to the set up guide for wireless eduroam above. 2.3 eduroam on Windows 7 Open Network and Sharing Center. Choose Set up a new connection or network 8

9 From the list choose Manually connect to a wireless network Fill out the boxes as shown above. 9

10 We are almost there, we only need to tell Windows to use SecureW2. We do this by clicking on Change connection settings. 10

11 On the tap Security change network authentication method to SecureW2 and clicking on Settings brings up the set up of SecureW2 (see section 2.4 below). After this, simply choose connect to... in the previous window. Wired eduroam Please note that in Windows 7 Cabled 802.1x Network is not enabled by default. You therefore have to start the service Wired AutoConfig to be able to use wired eduroam. One guide can be found at x_Wired. The guide is for Windows Vista but it also works on Windows7. Wired eduroam have to be set up in the same manner as the wireless. The only difference is you have to configure a different network device. Set up you LAN connection the same way as you did the wireless eduroam. Set SecureW2 as EAP type Please refer to the set up guide for wireless eduroam above. 11

12 2.4 Setting up SecureW2 Click on Configure Make sure that Use anonymous outer identity is selected as shown. 12

13 Click on Certificate and remove the tick in the Verify server certifate box. Click on Authentication and make sure it is set to PAP. 13

14 Under User account you can either enter your username and password or tick off the box Prompt for credentials Remember to use di.ku.dk as the domain!!! Click Advanced and remove the tick from the box Server certificate must be installed on local computer. SecureW2 is now set up to log on to the eduroam network. 2.5 Using other clients for eduroam support Unfortunately it is not possible to explain exactly how to set up other clients than SecureW2 - but some things you have to make sure are set up correctly are: 14

15 Type of WPA: WPA-EAP outer approval: TKIP/TTLS Alternative outer identity Inner approval: PAP 3 Mac OSX Mac OSX have support for eduroam from version eduroam on Mac OSX 10.4 Open a Finder window and select Applications Under Applications choose Internet Connect. If you have never worked with WPA security before, choose File New 802.1x Connection in the menu. Otherwise the configuration window will open automatically. Enter the following values: Configuration: eduroam Network Port: Airport 15

16 Username: or Password: <enter your password> Wireless Network: eduroam Alternatively you choose the Configuration under Edit Configuration. Add a new set up by clicking on the little plus sign in the lower left corner. Description: eduroam Network Port: Airport Username: <login>@di.ku.dk eller <login>@stud.ku.dk Password: <enter your password> Wireless Network: eduroam Authentication: TTLS Choose Configure... 16

17 TTLS Inner Authentication: PAP Outer Identity: Because DIKUs certificate is not signed by a known company, this warning will appear. eduroam should be working now. Wired eduroam Follow the set up for wireless eduroam above, if you haven t already done so. Plug in the cable and let it discover the EAPOL packages... it will handle the rest on it s own. 3.2 eduroam on Mac OSX 10.5 Open system preferences and choose network. 17

18 Choose advanced 18

19 If eduroam is present it is shown on the list. Double click on it. Fill out the boxes with the following values: 19

20 Security: WPA Enterprise Username: or Password: <Enter your password> 802.1X: TTLS - PAP Click Add, OK and choose eduroam as network name in the network menu. Finalize the configuration by clicking on Apply. If there is a pop up window, please enter user name and password. If it doesn t connect in the first attempt, try reconecting by disconecting and connecting using the network icon in the upper right corner. Because DIKUs certificate is not signed by a known company, this warning will appear. eduroam should be working now. Wired eduroam Follow the set up for wireless eduroam above, if you haven t already done so. Plug in the cable and let it discover the EAPOL packages... it will handle the rest on it s own. 4 Linux Linux have support for eduroam through wpa_supplicant, which is available in all major distributions. If wpa_supplicant is used directly, the configuration should be as follows: ctrl_interface_group=wheel ap_scan=1 eapol_version=1 update_config=0 network={ ssid="eduroam" scan_ssid=1 proto=wpa key_mgmt=wpa-eap pairwise=tkip 20

21 } eap=ttls password="<kodeord>" phase2="auth=pap" If you don t want to have your password in clear text directly in the configuration file, you can leave the password field empty and use wpa_gui to acquire it on demand. Exactly where the wpa_supplication configuration file is placed and how wpa_supplicant integrates which network setup, depends on the distribution. Please consult your distribution s documentation for specific details. Newer versions of wpa_supplicant also make the entire configuration directly from wpa_gui. Some distributions use a manager application of some sort to control wpa_supplicant indirectly. In this case you should configure the manager application instead of wpa_supplicant. One of the most commonly used manager applications is NetworkManager, which is used e.g. in Ubuntu. 4.1 eduroam on Ubuntu 8.04 Please be adviced, that Ubuntu systems, which have been upgraded from previous versions, are known to have problems accessing eduroam. Click on the network icon in the top right corner of the screen and select eduroam : 21

22 Fill out the fields as follows: Wireless Security: WPA Enterprise EAP Method: TTLS Phase2 Type: PAP Identity: Password: <dit password> Leave the rest as it is. When you click Connect you will be asked if you want to create a keyring for protecting your password. This can be practical, but it s not mandatory. Wired eduroam If you want to use wired eduroam, simply click on the network icon in the top right corner of the screen and select Connect to a 802.1X Protected Wired Network. The rest of the setup is identical to the wireless eduroam. 22

23 4.2 eduroam on Ubuntu 9.04 Click on the network icon in the top right corner of the screen and select eduroam : Fill out the fields as shown above, where <login> and <password> is your login and password. Because DIKUs certificate is not signed by a known company, this warning will appear. Simply click Ignore. 23

24 You will now be asked if you want to create a keyring for protecting your password. This can be practical, but it s not mandatory. Unfortunately Ubuntu 9.04 s NetworkManager is known for causing problems with eduroam. The problem seems to be cause by the combination of the NetworkManager and some specific network devices. If you are unlucky and have such a combination, one solution is to disable the NetworkManager and either use wpa_supplicant directly (through wpa_gui) or use another manager application. One such alternative setup is described below Alternative setup using Wicd An alternative to NetworkManager is called Wicd, and in this section we will describe how to setup Wicd for eduroam. However before continuing, you should know that this setup is completely at your own risk. Wicd is a much simpler manager application compared to NetworkManager, so some functionality might be lost. Also notice that any other network configurations made in NetworkManager will not automatically be ported to Wicd. First you need to install Wicd, which is done through the Synaptic Package Manager. Notice that is will also uninstall the NetworkManager. As you most likely don t have a network connection at this point, you can find the package on your USB-stick. Simply select File- >Add downloaded packages in Synaptics and select the directory Linux/Wicd-Ubuntu-9.04 on the USB-stick. Next you must install the eduroam template for Wicd, which is also located in the USBstick. For this you need to open a Terminal window. Run the installer using the command: sudo sh /media/disk/linux/wicd-ubuntu-9.04/wicd-eduroam.sh. Reboot your computer to activate Wicd. 24

25 Click on the network icon in the top right corner of the screen. Choose a eduroam access point (you will most likely have access to several) and click Advanced settings. Fill out the fields as shown above, where <login> and <password> is your login and password. Make sure to select Use these settings for all networks sharing this essid, or the configuration will only work for that specific access point. 25

26 Now you should be able to connect to any of the eduroam access points. 26