Eduroam does not work with linux 4.12.13

Asaf K. · 2017-10-05 13:08:21

I am using a Dell XPS 13 (9360) with NetworkManager, and until September eduroam worked perfectly on my computer. I could connect with ease to eduroam in over a dozen universities where I had tried to do so.

However, I went abroad for a few weeks, and now eduroam does not work anymore (other wireless networks work fine, for the most part). There is no significant information in the dmesg log, mostly it shows that it's trying to authenticate or trying to associate with the router, and fails.

When I was abroad I was visiting two universities. In the one university I still have a working access to the local network, which also an enterprise wpa2 network. This worked fine. At the other university I had to rely on eduroam, and it did not work there already.

My trick to overcome this is to tether my phone with a cable and use it as usb router (my phone connects to eduroam without any problems).

I've triple checked my settings against the university servers, and everything should be fine. The only thing I can think of is some package that I might have upgraded during my three weeks abroad. I can only think about the kernel, but it might be some other package. Here are the three relevant kernel upgrades that I had made when I was abroad. With 4.12.8 the eduroam connection was fine; with 4.12.13, not anymore. If the eduroam failing at the aforementioned university is due to an upgrade, then it has to be the first upgrade.

[2017-09-06 09:12] [ALPM] upgraded linux (4.12.8-2 -> 4.12.10-1)
[2017-09-14 18:05] [ALPM] upgraded linux (4.12.10-1 -> 4.12.12-1)
[2017-09-17 09:02] [ALPM] upgraded linux (4.12.12-1 -> 4.12.13-1)

Does anyone have similar experience, or any idea of what might be causing this?

seth · 2017-10-05 14:10:46

https://wiki.archlinux.org/index.php/Wi … nual_setup
https://wiki.archlinux.org/index.php/Wi … on#eduroam
https://wiki.archlinux.org/index.php/Ne … HCP_client

Asaf K. · 2017-10-06 06:27:53

seth wrote:

https://wiki.archlinux.org/index.php/Wi … nual_setup
https://wiki.archlinux.org/index.php/Wi … on#eduroam
https://wiki.archlinux.org/index.php/Ne … HCP_client

Yes, do you want to tell me more things which are obvious? Maybe turn on my computer?

Let me repeat what I wrote above, the configuration worked fine until a month ago. And I did not change it, at all. And wifi works fine with other networks.

seth · 2017-10-06 06:59:21

The very first "obvious" link is to try a manual connection - to, guess what, see what actually fails.
Which in turn, guess what, might get you "any idea of what might be causing this" - eg. your credentials being withdrawn, your MAC blocked or god knows why eduroam does not let you log in.

Maybe I should I have said that in a more obvious way. Please tell me if I have to get even more obvious.

HiImTye · 2017-10-06 07:18:05

Asaf K. wrote:

When I was abroad I was visiting two universities. In the one university I still have a working access to the local network, which also an enterprise wpa2 network. This worked fine. At the other university I had to rely on eduroam, and it did not work there already.

you have several threads on which you are experiencing various wifi related problems. that doesn't sound like it was 'working fine' without eduroam. did you ever resolve the issues in your previous threads, because none of them seem like they have come to a conclusive solution.

Asaf K. · 2017-10-06 07:21:03

HiImTye wrote:

Asaf K. wrote:
When I was abroad I was visiting two universities. In the one university I still have a working access to the local network, which also an enterprise wpa2 network. This worked fine. At the other university I had to rely on eduroam, and it did not work there already.
you have several threads on which you are experiencing various wifi related problems. that doesn't sound like it was 'working fine' without eduroam. did you ever resolve the issues in your previous threads, because none of them seem like they have come to a conclusive solution.

Well, the one about 4.13.3 is going to be solved when a newer version of the kernel is finally pushed to the stable repository and I can test that it works. The other one is only about cellular hotspots. For the most of my days I spend times within non-eduroam and non-hotspots wifi. So yeah, "working fine" is how I'd pretty much describe the whole situation.

Asaf K. · 2017-10-06 07:21:35

seth wrote:

The very first "obvious" link is to try a manual connection - to, guess what, see what actually fails.
Which in turn, guess what, might get you "any idea of what might be causing this" - eg. your credentials being withdrawn, your MAC blocked or god knows why eduroam does not let you log in.
Maybe I should I have said that in a more obvious way. Please tell me if I have to get even more obvious.

When you use your words I understand you.

I will try that when I get to the university later today.

Asaf K. · 2017-10-06 15:15:25

Okay, I tried to connect manually and this is the log I get from wpa_supplicant:

Successfully initialized wpa_supplicant
nl80211: Could not set interface 'p2p-dev-wlp58s0' UP
nl80211: deinit ifname=p2p-dev-wlp58s0 disabled_11b_rates=0
p2p-dev-wlp58s0: Failed to initialize driver interface
P2P: Failed to enable P2P Device interface
wlp58s0: CTRL-EVENT-REGDOM-CHANGE init=BEACON_HINT type=UNKNOWN
wlp58s0: SME: Trying to authenticate with f4:7f:35:2f:8f:3f (SSID='eduroam' freq=5220 MHz)
wlp58s0: Trying to associate with f4:7f:35:2f:8f:3f (SSID='eduroam' freq=5220 MHz)
wlp58s0: Associated with f4:7f:35:2f:8f:3f
wlp58s0: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0
wlp58s0: CTRL-EVENT-DISCONNECTED bssid=f4:7f:35:2f:8f:3f reason=3 locally_generated=1
wlp58s0: SME: Trying to authenticate with f4:7f:35:2f:8f:30 (SSID='eduroam' freq=2437 MHz)
wlp58s0: Trying to associate with f4:7f:35:2f:8f:30 (SSID='eduroam' freq=2437 MHz)
wlp58s0: Associated with f4:7f:35:2f:8f:30
wlp58s0: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0
wlp58s0: CTRL-EVENT-DISCONNECTED bssid=f4:7f:35:2f:8f:30 reason=3 locally_generated=1
wlp58s0: CTRL-EVENT-REGDOM-CHANGE init=BEACON_HINT type=UNKNOWN
wlp58s0: SME: Trying to authenticate with f4:7f:35:2f:8f:3f (SSID='eduroam' freq=5220 MHz)
wlp58s0: Trying to associate with f4:7f:35:2f:8f:3f (SSID='eduroam' freq=5220 MHz)
wlp58s0: CTRL-EVENT-REGDOM-CHANGE init=BEACON_HINT type=UNKNOWN
wlp58s0: Associated with f4:7f:35:2f:8f:3f
wlp58s0: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0
wlp58s0: CTRL-EVENT-DISCONNECTED bssid=f4:7f:35:2f:8f:3f reason=3 locally_generated=1
wlp58s0: CTRL-EVENT-REGDOM-CHANGE init=BEACON_HINT type=UNKNOWN
wlp58s0: SME: Trying to authenticate with f4:7f:35:2f:8f:30 (SSID='eduroam' freq=2437 MHz)
wlp58s0: Trying to associate with f4:7f:35:2f:8f:30 (SSID='eduroam' freq=2437 MHz)
wlp58s0: Associated with f4:7f:35:2f:8f:30
wlp58s0: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0
wlp58s0: CTRL-EVENT-DISCONNECTED bssid=f4:7f:35:2f:8f:30 reason=3 locally_generated=1
wlp58s0: CTRL-EVENT-REGDOM-CHANGE init=BEACON_HINT type=UNKNOWN
wlp58s0: SME: Trying to authenticate with f4:7f:35:2f:8f:3f (SSID='eduroam' freq=5220 MHz)
wlp58s0: Trying to associate with f4:7f:35:2f:8f:3f (SSID='eduroam' freq=5220 MHz)
wlp58s0: Associated with f4:7f:35:2f:8f:3f
wlp58s0: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0
wlp58s0: CTRL-EVENT-EAP-STARTED EAP authentication started
wlp58s0: CTRL-EVENT-DISCONNECTED bssid=f4:7f:35:2f:8f:3f reason=3 locally_generated=1
wlp58s0: CTRL-EVENT-SSID-TEMP-DISABLED id=0 ssid="eduroam" auth_failures=1 duration=10 reason=CONN_FAILED
wlp58s0: CTRL-EVENT-REGDOM-CHANGE init=BEACON_HINT type=UNKNOWN
wlp58s0: CTRL-EVENT-SSID-REENABLED id=0 ssid="eduroam"
wlp58s0: SME: Trying to authenticate with f4:7f:35:2f:8f:30 (SSID='eduroam' freq=2437 MHz)
wlp58s0: CTRL-EVENT-SSID-TEMP-DISABLED id=0 ssid="eduroam" auth_failures=2 duration=23 reason=CONN_FAILED
nl80211: deinit ifname=wlp58s0 disabled_11b_rates=0
wlp58s0: CTRL-EVENT-TERMINATING

My credentials are just fine, as I can connect using my phone to eduroam just fine with the same credentials. So the problem is with the computer.

seth · 2017-10-06 18:32:49

Is networkmanager still running?

systemctl list-units | grep -iE '(net|wicd|dhcp|conn)'

Asaf K. · 2017-10-06 18:36:25

I am not at the university anymore until Monday morning. But at the moment NetworkManager is still "running", and I am fairly sure that it was running at the time I tried these things (mainly because right after that I connected the new USB-ethernet adapter, to test it, and it worked perfectly).

seth · 2017-10-06 18:38:57

Ok. That's gonna fail for sure (w/ the posted symptoms)
Ensure *no* other service tries to operate your interface when conducting a manual connection (in general: do not try to operate it from two sides at all - that will expectably fail)

Asaf K. · 2017-10-06 18:39:51

Okay. Then I will try again on Monday morning, and update!

Thanks for the tip.

Asaf K. · 2017-10-09 11:33:17

Okay, I killed the NM services, and I tried again. This time the results were slightly different indeed,

# wpa_supplicant -i wlp58s0 -c /etc/wpa_supplicant/wpa_supplicant.conf 
Successfully initialized wpa_supplicant
wlp58s0: CTRL-EVENT-REGDOM-CHANGE init=BEACON_HINT type=UNKNOWN
wlp58s0: CTRL-EVENT-REGDOM-CHANGE init=BEACON_HINT type=UNKNOWN
wlp58s0: SME: Trying to authenticate with f4:7f:35:2f:8f:3f (SSID='eduroam' freq=5220 MHz)
wlp58s0: Trying to associate with f4:7f:35:2f:8f:3f (SSID='eduroam' freq=5220 MHz)
wlp58s0: Associated with f4:7f:35:2f:8f:3f
wlp58s0: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0
wlp58s0: CTRL-EVENT-EAP-STARTED EAP authentication started
wlp58s0: Authentication with f4:7f:35:2f:8f:3f timed out.
wlp58s0: CTRL-EVENT-DISCONNECTED bssid=f4:7f:35:2f:8f:3f reason=3 locally_generated=1
wlp58s0: CTRL-EVENT-REGDOM-CHANGE init=BEACON_HINT type=UNKNOWN
wlp58s0: CTRL-EVENT-REGDOM-CHANGE init=BEACON_HINT type=UNKNOWN
wlp58s0: SME: Trying to authenticate with f4:7f:35:2f:8f:30 (SSID='eduroam' freq=2437 MHz)
wlp58s0: Trying to associate with f4:7f:35:2f:8f:30 (SSID='eduroam' freq=2437 MHz)
wlp58s0: Associated with f4:7f:35:2f:8f:30
wlp58s0: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0
wlp58s0: CTRL-EVENT-EAP-STARTED EAP authentication started
wlp58s0: Authentication with f4:7f:35:2f:8f:30 timed out.
wlp58s0: CTRL-EVENT-DISCONNECTED bssid=f4:7f:35:2f:8f:30 reason=3 locally_generated=1
wlp58s0: CTRL-EVENT-REGDOM-CHANGE init=BEACON_HINT type=UNKNOWN
wlp58s0: CTRL-EVENT-REGDOM-CHANGE init=BEACON_HINT type=UNKNOWN
wlp58s0: SME: Trying to authenticate with 2c:3f:38:59:13:70 (SSID='eduroam' freq=2412 MHz)
wlp58s0: Trying to associate with 2c:3f:38:59:13:70 (SSID='eduroam' freq=2412 MHz)
wlp58s0: CTRL-EVENT-ASSOC-REJECT bssid=2c:3f:38:59:13:70 status_code=17
wlp58s0: SME: Deauth request to the driver failed

(It then repeated until I broke it off with Ctrl-C)

seth · 2017-10-09 14:37:17

What does your /etc/wpa_supplicant/wpa_supplicant.conf look like? Does it notably contain phase2="auth=MSCHAPV2"
Does your university announce their eduroam configuration (protocols etc.) anywhere?

Asaf K. · 2017-10-09 14:53:24

network={
  ssid="eduroam"
  scan_ssid=1
  key_mgmt=WPA-EAP
  eap=TTLS
  anonymous_identity="anonymous@****"
  ca_cert="/etc/ca-certificates/extracted/cadir/AddTrust_External_Root.pem"
  phase2="auth=MSCHAPV2"
  identity="****"
  password="****"
}

(The identity fields have been removed, of course, but they are 100% correct.)

Asaf K. · 2017-10-09 14:58:48

Let me add that it seems that some universities use "DigiCert_Assured_ID_root_CA.pem" and not "AddTrust_External_Root.pem" for the certificate. But this would be a weird issue, since until a month ago, the same configuration worked flawlessly, and this is not the sort of thing that gets changed often.

progandy · 2017-10-09 16:01:35

Does it work again if you boot with linux-lts or reinstall the older kernel?

Asaf K. · 2017-10-09 16:27:41

progandy wrote:

Does it work again if you boot with linux-lts or reinstall the older kernel?

Hmm. I did not try that. I need to check how much trouble it would be to downgrade that long back, or what are the implications of installing a second kernel version. It will have to wait for tomorrow, but that's a good idea to look into.

seth · 2017-10-09 20:58:11

Installing the lts kernel is no big deal, ensure to update grub, though (and install the nvidia-lts packages, in case)

Also better check back with your university about trusted certificates, this smells a lot like a TLS issue.

Asaf K. · 2017-10-09 21:45:27

Thanks I will try that.

And let me point out again that by the end of August, before I went abroad, everything worked just peachy with eduroam. I came back three weeks later, and it doesn't work anymore. So the problem should be something upgraded in that gap. Maybe not the kernel, I don't know.

Even more, I had a problem in some university back around September 12th. So if that already indicative of the same problem, the interval for the updated packages is even smaller.

Even more, after the 12th, I was visiting my old university where I have an active profile on their local network that works fine. The profile there is also with MSCHAPv2, but without any needed CA certificates. So this might be the issue indeed. But why? What could possibly have affected this?

I will try reinstalling the ca-certificates* packages and see, maybe that will fix the problem somehow.

If anyone has any idea what sort of package might have this sort of impact, I'd be very happy to hear.

Asaf K. · 2017-10-10 10:00:04

Okay. I tried reinstalling the ca-certificates packages. I tried downgrading the kernel. I tried downgrading the gnupg (which was also updated in the "critical time interval"). None of these things worked.

I'm looking through old NetworkManager logs to see if there is something different in the log from two months ago, and it seems that the only difference is that it managed to connect. I know that the situation is almost the same with eduroam at a different university here, that I could connect before I went abroad (and my phone still manages to connect to eduroam also there).

So the problem should be local to my computer; it is not in the credentials I give to the network; and I have no more ideas.

progandy · 2017-10-10 10:27:28

Did you try different authentication schemes? I know that at least these three are in use at different universities:

eap=TTLS / phase2="auth=PAP"
eap=TTLS / phase2="auth=MSCHAPV2"
eap=PEAP / phase2="auth=MSCHAPV2"

Asaf K. · 2017-10-10 11:43:27

All eduroam configurations I've seen, including my current university and my old university had the eap value as PEAP; and phase2 as MSCHAPV2.

Here is the NetworkManager log from earlier today:

NetworkManager[305]: <info>  [1507628794.0272] device (wlp58s0): Activation: (wifi) connection 'eduroam' has security, and secrets exist.  No new secrets needed.
NetworkManager[305]: <info>  [1507628794.0272] Config: added 'ssid' value 'eduroam'
NetworkManager[305]: <info>  [1507628794.0272] Config: added 'scan_ssid' value '1'
NetworkManager[305]: <info>  [1507628794.0272] Config: added 'key_mgmt' value 'WPA-EAP'
NetworkManager[305]: <info>  [1507628794.0273] Config: added 'password' value '<hidden>'
NetworkManager[305]: <info>  [1507628794.0273] Config: added 'eap' value 'PEAP'
NetworkManager[305]: <info>  [1507628794.0273] Config: added 'fragment_size' value '1266'
NetworkManager[305]: <info>  [1507628794.0273] Config: added 'phase2' value 'auth=MSCHAPV2'
NetworkManager[305]: <info>  [1507628794.0273] Config: added 'ca_cert' value '/etc/ssl/certs/AddTrust_External_Root.pem'
NetworkManager[305]: <info>  [1507628794.0273] Config: added 'identity' value '****'
NetworkManager[305]: <info>  [1507628794.0273] Config: added 'anonymous_identity' value 'anonymous@****'
NetworkManager[305]: <info>  [1507628794.0273] Config: added 'bgscan' value 'simple:30:-65:300'
NetworkManager[305]: <info>  [1507628794.0273] Config: added 'proactive_key_caching' value '1'

That did not connect (the reason in the log is that association took too long, and maybe I need new secrets).

Here is the log from two months ago:

NetworkManager[310]: <info>  [1502354594.4970] device (wlp58s0): Activation: (wifi) connection 'eduroam' has security, and secrets exist.  No new secrets needed.
NetworkManager[310]: <info>  [1502354594.4970] Config: added 'ssid' value 'eduroam'
NetworkManager[310]: <info>  [1502354594.4970] Config: added 'scan_ssid' value '1'
NetworkManager[310]: <info>  [1502354594.4970] Config: added 'key_mgmt' value 'WPA-EAP'
NetworkManager[310]: <info>  [1502354594.4971] Config: added 'password' value '<hidden>'
NetworkManager[310]: <info>  [1502354594.4971] Config: added 'eap' value 'PEAP'
NetworkManager[310]: <info>  [1502354594.4971] Config: added 'fragment_size' value '1266'
NetworkManager[310]: <info>  [1502354594.4971] Config: added 'phase2' value 'auth=MSCHAPV2'
NetworkManager[310]: <info>  [1502354594.4971] Config: added 'ca_cert' value '/etc/ssl/certs/AddTrust_External_Root.pem'
NetworkManager[310]: <info>  [1502354594.4971] Config: added 'identity' value '****'
NetworkManager[310]: <info>  [1502354594.4971] Config: added 'anonymous_identity' value 'anonymous@****'
NetworkManager[310]: <info>  [1502354594.4971] Config: added 'bgscan' value 'simple:30:-65:300'
NetworkManager[310]: <info>  [1502354594.4971] Config: added 'proactive_key_caching' value '1'

The log then continues just fine with the connection.

seth · 2017-10-10 11:53:31

Asaf K. wrote:

All eduroam configurations I've seen, including my current university and my old university had the eap value as PEAP; and phase2 as MSCHAPV2.

Yet the config you posted in #15 says TTLS?
What university is this? Do they have public documentation about their eduroam config?

progandy · 2017-10-10 11:53:57

If you want to use PEAP, then please check your wpa_supplicant.conf. In post #15 you have "eap=TTLS".
Edit: Too slow...

Last edited by progandy (2017-10-10 11:54:28)

Arch Linux

#1 2017-10-05 13:08:21

Eduroam does not work with linux 4.12.13

#2 2017-10-05 14:10:46

Re: Eduroam does not work with linux 4.12.13

#3 2017-10-06 06:27:53

Re: Eduroam does not work with linux 4.12.13

#4 2017-10-06 06:59:21

Re: Eduroam does not work with linux 4.12.13

#5 2017-10-06 07:18:05

Re: Eduroam does not work with linux 4.12.13

#6 2017-10-06 07:21:03

Re: Eduroam does not work with linux 4.12.13

#7 2017-10-06 07:21:35

Re: Eduroam does not work with linux 4.12.13

#8 2017-10-06 15:15:25

Re: Eduroam does not work with linux 4.12.13

#9 2017-10-06 18:32:49

Re: Eduroam does not work with linux 4.12.13

#10 2017-10-06 18:36:25

Re: Eduroam does not work with linux 4.12.13

#11 2017-10-06 18:38:57

Re: Eduroam does not work with linux 4.12.13

#12 2017-10-06 18:39:51

Re: Eduroam does not work with linux 4.12.13

#13 2017-10-09 11:33:17

Re: Eduroam does not work with linux 4.12.13

#14 2017-10-09 14:37:17

Re: Eduroam does not work with linux 4.12.13

#15 2017-10-09 14:53:24

Re: Eduroam does not work with linux 4.12.13

#16 2017-10-09 14:58:48

Re: Eduroam does not work with linux 4.12.13

#17 2017-10-09 16:01:35

Re: Eduroam does not work with linux 4.12.13

#18 2017-10-09 16:27:41

Re: Eduroam does not work with linux 4.12.13

#19 2017-10-09 20:58:11

Re: Eduroam does not work with linux 4.12.13

#20 2017-10-09 21:45:27

Re: Eduroam does not work with linux 4.12.13

#21 2017-10-10 10:00:04

Re: Eduroam does not work with linux 4.12.13

#22 2017-10-10 10:27:28

Re: Eduroam does not work with linux 4.12.13

#23 2017-10-10 11:43:27

Re: Eduroam does not work with linux 4.12.13

#24 2017-10-10 11:53:31

Re: Eduroam does not work with linux 4.12.13

#25 2017-10-10 11:53:57

Re: Eduroam does not work with linux 4.12.13

Board footer