If you don't want to use the app, download the [https://letsencrypt.org/certs/isrgrootx1.pem ISRG Root X1], and [https://support.google.com/pixelphone/answer/2844832 install it] into your device's '''Wi-Fi certificate''' store, giving it any name you like. Then connect to the '''Camp2023''' network using the following information:
If you don't want to use the app, download the [ISRG Root X1](https://letsencrypt.org/certs/isrgrootx1.pem), and [install it](https://support.google.com/pixelphone/answer/2844832) into your device's <b>Wi-Fi certificate</b> store, giving it any name you like. Then connect to the <b>Camp2023</b> network using the following information:
{|padding
* EAP method: TTLS <i>(not TLS)</i>
| EAP method || TTLS ''(not TLS)''
* CA certificate: <i>(whatever name you gave the ISRG Root X1)</i>
|-
* Domain: radius.c3noc.net
| style="padding-right: 1em" | Phase 2 authentication || PAP
* Identity: camp
|-
* Password: camp
| CA certificate || ''(whatever name you gave the ISRG Root X1)''
|-
| Domain || radius.c3noc.net
|-
| Identity || mch
|-
| Password || mch
|}
It's fine to leave '''Online Certificate status''' as "Do not validate", and leave the '''Anonymous identity''' blank.
It's fine to leave '''Online Certificate status''' as "Do not validate", and leave the '''Anonymous identity''' blank.
== Linux, etc. ==
## Linux, etc.
=== Network Manager ===
### Network Manager
You can use the following config file:
You can use the following config file:
Please note that some versions of NM are buggy and will only work with 802.1X using MSCHAPv2, or not at all. If that affects you, it may be easiest to use wpa_supplicant.
Please note that some versions of NM are buggy and will only work with 802.1X using MSCHAPv2, or not at all. If that affects you, it may be easiest to use wpa_supplicant.
...
@@ -60,8 +52,8 @@ proto=
...
@@ -60,8 +52,8 @@ proto=
altsubject-matches=DNS:radius.c3noc.net
altsubject-matches=DNS:radius.c3noc.net
ca-cert=/etc/ssl/certs/ISRG_Root_X1.pem
ca-cert=/etc/ssl/certs/ISRG_Root_X1.pem
eap=ttls;
eap=ttls;
identity=mch
identity=camp
password=mch
password=camp
phase2-altsubject-matches=
phase2-altsubject-matches=
phase2-auth=pap
phase2-auth=pap
...
@@ -73,7 +65,7 @@ method=auto
...
@@ -73,7 +65,7 @@ method=auto
dns-search=
dns-search=
method=auto</pre>
method=auto</pre>
=== WiCD ===
### WiCD
You need an additional crypto setting for WiCD. Put this file into /etc/wicd/encryption/templates/eap-ttls (debian systems, might be different with other *nix flavours):
You need an additional crypto setting for WiCD. Put this file into /etc/wicd/encryption/templates/eap-ttls (debian systems, might be different with other *nix flavours):
<pre>
<pre>
...
@@ -85,8 +77,8 @@ You need an additional crypto setting for WiCD. Put this file into /etc/wicd/enc
...
@@ -85,8 +77,8 @@ You need an additional crypto setting for WiCD. Put this file into /etc/wicd/enc
network={
network={
ssid="Camp2023"
ssid="Camp2023"
scan_ssid=$_SCAN
scan_ssid=$_SCAN
identity="mch"
identity="camp"
password="mch"
password="camp"
proto=WPA2
proto=WPA2
key_mgmt=WPA-EAP
key_mgmt=WPA-EAP
group=CCMP
group=CCMP
...
@@ -101,7 +93,7 @@ You need an additional crypto setting for WiCD. Put this file into /etc/wicd/enc
...
@@ -101,7 +93,7 @@ You need an additional crypto setting for WiCD. Put this file into /etc/wicd/enc
</pre>
</pre>
Edit /etc/wicd/encryption/templates/active to include the eap-ttls config template. Restart the WiCD daemon, choose the proper encryption (EAP-TTLS Camp2023) and enter a random username/password.
Edit /etc/wicd/encryption/templates/active to include the eap-ttls config template. Restart the WiCD daemon, choose the proper encryption (EAP-TTLS Camp2023) and enter a random username/password.
=== Jolla/connman ===
### Jolla/connman
/var/lib/connman/Camp2023wifi.config :
/var/lib/connman/Camp2023wifi.config :
<pre>
<pre>
...
@@ -110,20 +102,20 @@ Edit /etc/wicd/encryption/templates/active to include the eap-ttls config templa
...
@@ -110,20 +102,20 @@ Edit /etc/wicd/encryption/templates/active to include the eap-ttls config templa
Name=Camp2023-legacy
Name=Camp2023-legacy
EAP=ttls
EAP=ttls
Phase2=PAP
Phase2=PAP
Identity=mch
Identity=camp
Passphrase=mch
Passphrase=camp
</pre>
</pre>
=== wpa_supplicant ===
### wpa_supplicant
This is the default option on Raspberry Pi OS. Edit /etc/wpa_supplicant/wpa_supplicant.conf and add the network:
This is the default option on Raspberry Pi OS. Edit /etc/wpa_supplicant/wpa_supplicant.conf and add the network:
network={
network={
ssid="Camp2023"
ssid="Camp2023"
key_mgmt=WPA-EAP
key_mgmt=WPA-EAP
eap=TTLS
eap=TTLS
identity="mch"
identity="camp"
password="mch"
password="camp"
# ca path on debian 7.x and raspberry pi OS, modify accordingly
# ca path on debian 7.x and raspberry pi OS, modify accordingly
ca_cert="/etc/ssl/certs/ISRG_Root_X1.pem"
ca_cert="/etc/ssl/certs/ISRG_Root_X1.pem"
altsubject_match="DNS:radius.c3noc.net"
altsubject_match="DNS:radius.c3noc.net"
...
@@ -131,14 +123,14 @@ This is the default option on Raspberry Pi OS. Edit /etc/wpa_supplicant/wpa_sup
...
@@ -131,14 +123,14 @@ This is the default option on Raspberry Pi OS. Edit /etc/wpa_supplicant/wpa_sup
}
}
</pre>
</pre>
=== Interfaces ===
### Interfaces
As an alternative, you can specify the wpa_supplicant config options directly in /etc/network/interfaces:
As an alternative, you can specify the wpa_supplicant config options directly in /etc/network/interfaces:
<pre>
<pre>
iface wlan0 inet dhcp
iface wlan0 inet dhcp
wpa-ssid Camp2023
wpa-ssid Camp2023
wpa-identity mch
wpa-identity camp
wpa-password mch
wpa-password camp
wpa-proto WPA2
wpa-proto WPA2
wpa-key_mgmt WPA-EAP
wpa-key_mgmt WPA-EAP
wpa-group CCMP
wpa-group CCMP
...
@@ -149,7 +141,7 @@ As an alternative, you can specify the wpa_supplicant config options directly in
...
@@ -149,7 +141,7 @@ As an alternative, you can specify the wpa_supplicant config options directly in
# Open a command prompt and execute: netsh wlan add profile filename=Camp2023.xml
* Open a command prompt and execute: netsh wlan add profile filename=Camp2023.xml
# Connect to the Camp2023 network; use "mch/mch" as the username/password when prompted. Alternatively, use "outboundonly/outboundonly" as the username/password to enable inbound traffic firewalling.
* Connect to the Camp2023 network; use "camp/camp" as the username/password when prompted. Alternatively, use "outboundonly/outboundonly" as the username/password to enable inbound traffic firewalling.
