Arch Linux

mabalenk

Member

Registered: 2017-04-28

Posts: 36

Debugging netctl profile to connect to eduroam (wirelessly)

Dear all,

I need help debugging an "eduroam" wireless connection with the `netctl`. In short our IT department changed the CA certificate and since then my wireless connection does not work. I believe this is due to the change of the certificate. Please find below my current `netctl` profile file called "eduroam":

Description='EduRoam'
Interface=wlp0...
Connection=wireless
Security=wpa-configsection
IP=dhcp
WPAConfigSection=(
    'ssid="eduroam"'
    'key_mgmt=WPA-EAP'
    'pairwise=CCMP'
    'group=CCMP'
    'eap=PEAP'
    'anonymous_identity="ANONYMOUS"'
    'identity="IDENTITY"'
    'password="PASSWORD"'
    'ca_cert="CERT"'
    'phase2="auth=MSCHAPV2"'
    'priority=1'
)

ANONYMOUS is an email address with my organisation's suffix, e.g. anonymous@organisation.org, IDENTITY is my full email address, PASSWORD is my password. It has special characters, but I hope quotation marks are taking care of those. CERT is the full path to the "*.pem" file with the certificate.

When I manually start the profile with `sudo netctl start eduroam` and view its status with `netctl status eduroam` I see the error:

WPA association/authentication failed for interface 'wlp0...'
Failed to bring the network up for profile 'eduroam'.

I was wondering, would it be possible to leave the username and password empty and let `netctl` ask me me for them interactively? This way I would check that the username and password are correct. Then I'm not very certain of the role of the CA certificate. Maybe the wi-fi connection should work without it, at least in a limited manner. Ideally, I would like to run the `netctl` in a verbose mode, if that exists, to see, what is going wrong.

Ferdinand

Member

From: Norway

Registered: 2020-01-02

Posts: 338

Re: Debugging netctl profile to connect to eduroam (wirelessly)

Is there a status code in that error, "WPA association/authentication failed..."?
I think there's supposed to be one, and it may point you in a potentially useful direction:
https://community.cisco.com/t5/wireless … -p/3148055

---

Xfce ⬩ No CSD ⬩ Arch Forum Readme

mabalenk

Member

Registered: 2017-04-28

Posts: 36

Re: Debugging netctl profile to connect to eduroam (wirelessly)

Thank you for your suggestion. Please find below the full output of the `sudo netctl status eduroam` command:

sudo netctl status eduroam
× netctl@eduroam.service - EduRoam
     Loaded: loaded (/usr/lib/systemd/system/netctl@.service; enabled; vendor preset: disabled)
    Drop-In: /etc/systemd/system/netctl@eduroam.service.d
             └─profile.conf
     Active: failed (Result: exit-code) since Tue 2021-12-07 16:54:33 GMT; 1min 8s ago
       Docs: man:netctl.profile(5)
    Process: 513 ExecStart=/usr/lib/netctl/network start eduroam (code=exited, status=1/FAILURE)
   Main PID: 513 (code=exited, status=1/FAILURE)
        CPU: 775ms

Dec 07 16:54:17 kilburn systemd[1]: Starting EduRoam...
Dec 07 16:54:17 kilburn network[513]: Starting network profile 'eduroam'...
Dec 07 16:54:17 kilburn systemd[1]: Started EduRoam.
Dec 07 16:54:33 kilburn network[513]: WPA association/authentication failed for interface 'wlp0...'
Dec 07 16:54:33 kilburn network[513]: Failed to bring the network up for profile 'eduroam'
Dec 07 16:54:33 kilburn systemd[1]: netctl@eduroam.service: Main process exited, code=exited, status=1>
Dec 07 16:54:33 kilburn systemd[1]: netctl@eduroam.service: Failed with result 'exit-code'.

There is the exit code of 1. But I think this is the netctl's code, not the 802.11 Association Status or a Death Reason code.

Ferdinand

Member

From: Norway

Registered: 2020-01-02

Posts: 338

Re: Debugging netctl profile to connect to eduroam (wirelessly)

I can't say that I see anything wrong - on the contrary, you seems to have read the wiki - but I'm no expert, alas
I still think an "WPA association/authentication failed" should have a status code somewhere.
Have you checked journalctl?

Also, maybe you'll see something useful if you turn on debugging info, by setting NETCTL_DEBUG=yes before running netctl?

---

Xfce ⬩ No CSD ⬩ Arch Forum Readme

progandy

Member

Registered: 2012-05-17

Posts: 5,319

Re: Debugging netctl profile to connect to eduroam (wirelessly)

For testing you could remove the ca_cert line so the certificate is not validated. That should not be used for regular access.

Also, can you compare your config with the data you can get from the configurator? (The Config. ... lines at the end of the python script) https://cat.eduroam.org/

Last edited by progandy (2022-05-03 17:19:29)

---

| alias CUTF='LANG=en_XX.UTF-8@POSIX ' | alias ENGLISH='LANG=C.UTF-8 ' |

mabalenk

Member

Registered: 2017-04-28

Posts: 36

Re: Debugging netctl profile to connect to eduroam (wirelessly)

Dear all,

Thank you very much for your suggestions. This is my office machine that we are talking about. I will be in the office tomorrow and continue debugging. Please give me one more day.