# CONNECTING TO AARHUS UNIVERSITY EDUROAM WITH WPA_SUPPLICANT
Eduroam is an international Wi-Fi roaming service that provides network
access to university staff and visitors from other universities.
Aarhus University provides instructions on connecting to eduroam via
iOS/Android/Windows/Mac and a Python install script for Linux. In this
post, I will explain how users of BSD or Linux can set up eduroam
connectivity manually.
## Preparing the system
First, install wpa_supplicant, which is the only prerequisite. Your
system might already have it installed for authenticating with ordinary
Wi-Fi networks. WPA supplicant supports many different authentication
methods, and the configuration must be correct for the connection to
succeed. On OpenBSD, install and enable the wpa_supplicant daemon with:
# pkg_add wpa_supplicant
# rcctl enable wpa_supplicant
On Gentoo Linux with OpenRC, the equivalent procedure is:
# emerge net-wireless/wpa_supplicant
# rc-update add wpa_supplicant default
Next, save the self-signed Aarhus University PEM certificate to the
file /etc/ssl/au-eduroam-cert.pem. I extracted this key file from the
official Python installer.
-----BEGIN CERTIFICATE-----
MIIFKTCCAxGgAwIBAgIQLOmOuuesHKhIiSJDwYO+mzANBgkqhkiG9w0BAQsFADAn
MSUwIwYDVQQDExxBYXJodXMgVW5pdmVyc2l0eSBSb290IENBIDAxMB4XDTE3MDUy
OTEzMDc0MFoXDTM3MDUyOTEzMTczOFowJzElMCMGA1UEAxMcQWFyaHVzIFVuaXZl
cnNpdHkgUm9vdCBDQSAwMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB
AKDUr/VJncuuucByREHn8w6stgbSs2vhuBC8+2oe9Tbs/XUOfg5p3Z/Yft1smtIC
4W1hfmohb3BO9S8OWSl3bDahJNDSyzzG5dgLTnGT7M41tu1Kiuwx5UlzpCyFqf/J
XbuYaTKKVlWzfOH21+/qBAm5PTtomf3x/eCcjpmA0f97QtDXnfHOXv+BmToOSdjo
JTLq0VNCI1VC4y0ymLs6sSaZU6NGBE8bkB0LcilXH7OcLtNYIBryIFR/40LVch/H
M5Vjeg1GI1mFqEW3pUBoETJA/lfOWae6yRNBfut+aiFn57NUaG8ILBjK1Dt/uCJF
5tW4i7MYQdv1J1kNxdaYf948fANcsWMZO/M9zb0ua3q6TbwBmKDiz53pg9hwnUgI
MYs9HNB6uRzim8+wvYI65g2fBWAX502a9Q7+LDXbg9mUI9lrolUBJzk1Uw1dDoEd
r4B++7ZGurM1U/WrgPL6K+hW1rhO282djXXABt8MAJdhUu+z6hY5ICrorpy9XKe4
QO47/TqIK+q+2tXypwu5M6Ki38eTkDpOS6jVDUBekZh99E9mJmP59Z61mR+tc9Ku
/soVmwx7EgvtYZ4s08IPAJXMg/tV7DxZ5xmHW7HdwMIt5UszUBnZ2b+u7voqg6BJ
y4DO7YOXEz/f9JK9wGuqbD0VozntiMVBj7chUrbMht/zAgMBAAGjUTBPMAsGA1Ud
DwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQbwmI/AJyVzSmugXig
FFb+NWisoDAQBgkrBgEEAYI3FQEEAwIBADANBgkqhkiG9w0BAQsFAAOCAgEAZ3tm
sWH6oAEgo7NX6EWc/64j2ylknSmyOIoQsL6pwKGhNU1e/eEgFh9I/jhLTo0YcOH/
hUIad06nQtAKVXfHdBdCqG5a7Gxy6FdzBja8kI3OkYCgiJ4jcU4dbxa4OJSZ6lh+
MHqduxiTnnhutEcNhLxUuzrabf6gxgLaSlxJ6Cksyg8zfkG6Yj1pSoBoqqzDq9bD
v3vrlZOcT3KAmvR9ERfGzFR87j07Cy89CeCCR1e5VMRWPt4H3EwHDPuqdV9M+GMR
FgEC+xaTzYUidTVOCg2dIxwbNc8qWQ+hJ1T4lLNy6PvTP931Mpc+M+gmafOl3mRF
fwQ2BWUy/L9kUzC9eppd2R70akYbSvDWxS/XnhdUUoeoJk+kUgSD/RFmbVqCLTQ2
5qB2MHV2m1O42pvnWLZCQIV0yRdyDd7fGWMlCwN87vnKm4avSAm3El1vhkDeqrQI
JNi4x9bWp/UEWaH7zwG0r+iTR6+VdO87MXWzNrLB2iT0E+nFcjhA6w2bZf0E6Ye5
Sgga4GMNc+sJddtCWoi44MMg9vRNqgjxjCdN0QkXCNxmv6iMvSSthQwX1PPfWdox
tHzbj47Aqa4+XKeZhS+k1JIBnmKvFaSAKYoUCCo9Zp02qmN/wptGoxHbJwN0APUK
+jElU2tp7xJDgLDtVZJJfNC9I41/4WFILzaI8jk=
-----END CERTIFICATE-----
## Option 1: Configuring wpa_supplicant manually
If your system _does not_ use Network Manager, you must configure
wpa_supplicant directly. Open (or create)
/etc/wpa_supplicant/wpa_supplicant.conf. At minimum, it should
contain the following configuration of the eduroam network. You
can also add other Wi-Fi networks here.
ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=wheel
disable_scan_offload=1
update_config=1
autoscan=periodic:10
network={
ssid="eduroam"
key_mgmt=WPA-EAP
eap=TTLS PEAP
identity="
[email protected]"
password="YOURPASSWORD"
ca_cert="/etc/ssl/au-eduroam-cert.pem"
phase2="auth=MSCHAPV2"
mesh_fwding=1
frequency=5200
}
The ctrl_interface line may look different on your system. Make sure
to edit the identity and password values according to your AU ID.
Next, make sure that other users cannot read the contents of the file:
# chown root:root /etc/wpa_supplicant/wpa_supplicant.conf
# chmod 600 /etc/wpa_supplicant/wpa_supplicant.conf
On OpenBSD, associate wpa_supplicant with the network interface. In the
following command, change "iwm0" to your wifi device name:
# rcctl set wpa_supplicant flags -c /etc/wpa_supplicant/wpa_supplicant.conf -s -D openbsd -i iwm0
It is now time to start the wpa_supplicant service:
# rcctl start wpa_supplicant # OpenBSD
# rc-service wpa_supplicant start # Gentoo (OpenRC)
You should now be connected to the Aarhus University eduroam network.
In case of problems, you can stop the wpa_supplicant daemon and manually
launch it with debugging messages enabled (-d):
# wpa_supplicant -d -c /etc/wpa_supplicant/wpa_supplicant.conf
## Option 2: Using Network Manager
If your system uses Network Manager to configure networking, connect to
the eduroam wifi with the following configuration:
gopher://adamsgaard.dk/I/tmp/eduroam-network-manager.png
