Troubles with Wireless Security

Tyriel · 2009-01-27 12:30:50

Hey Guys,

I am new to Arch and have my fingers crossed that one of you may be able to help me with this problem. I have a fresh install on my laptop and everything is running fine but I can not get my wireless to connect with any form of encryption. I am using Wicd and can connect to my router when it is unsecure, however as soon as I try WEP or WPA1/WPA2 it gets stuck on trying to obtain an IP address.

Does anyone have any ideas on how I solve this problem? I have attached my /etc/rc.conf just in case it is needed. Thanks in advance.

#
# /etc/rc.conf - Main Configuration for Arch Linux
#

# -----------------------------------------------------------------------
# LOCALIZATION
# -----------------------------------------------------------------------
#
# LOCALE: available languages can be listed with the 'locale -a' command
# HARDWARECLOCK: set to "UTC" or "localtime"
# USEDIRECTISA: use direct I/O requests instead of /dev/rtc for hwclock
# TIMEZONE: timezones are found in /usr/share/zoneinfo
# KEYMAP: keymaps are found in /usr/share/kbd/keymaps
# CONSOLEFONT: found in /usr/share/kbd/consolefonts (only needed for non-US)
# CONSOLEMAP: found in /usr/share/kbd/consoletrans
# USECOLOR: use ANSI color sequences in startup messages
#
LOCALE="en_AU.utf8"
HARDWARECLOCK="localtime"
USEDIRECTISA="no"
TIMEZONE="Australia/Melbourne"
KEYMAP="us"
CONSOLEFONT="ter-v16b"
CONSOLEMAP=
USECOLOR="yes"

# -----------------------------------------------------------------------
# HARDWARE
# -----------------------------------------------------------------------
#
# MOD_AUTOLOAD: Allow autoloading of modules at boot and when needed
# MOD_BLACKLIST: Prevent udev from loading these modules
# MODULES: Modules to load at boot-up. Prefix with a ! to blacklist.
#
# NOTE: Use of 'MOD_BLACKLIST' is deprecated. Please use ! in the MODULES array.
#
MOD_AUTOLOAD="yes"
#MOD_BLACKLIST=() #deprecated
MODULES=(r8169 iwl4965 snd-mixer-oss snd-pcm-oss snd-hwdep snd-page-alloc snd-pcm snd-timer snd snd-hda-intel soundcore fuse !snd_pcsp)

# Scan for LVM volume groups at startup, required if you use LVM
USELVM="yes"

# -----------------------------------------------------------------------
# NETWORKING
# -----------------------------------------------------------------------
#
# HOSTNAME: Hostname of machine. Should also be put in /etc/hosts
#
HOSTNAME="myhost"

# Use 'ifconfig -a' or 'ls /sys/class/net/' to see all available interfaces.
#
# Interfaces to start at boot-up (in this order)
# Declare each interface then list in INTERFACES
#   - prefix an entry in INTERFACES with a ! to disable it
#   - no hyphens in your interface names - Bash doesn't like it
# 
# DHCP:     Set your interface to "dhcp" (eth0="dhcp")
# Wireless: See network profiles below
#
# eth0="dhcp"
# wlan0="dhcp"

INTERFACES=(!eth0 !wlan0 wmaster0)

# Routes to start at boot-up (in this order)
# Declare each route then list in ROUTES
#   - prefix an entry in ROUTES with a ! to disable it
#
gateway="default gw 192.168.0.1"
ROUTES=(!gateway)
 
# Enable these network profiles at boot-up.  These are only useful
# if you happen to need multiple network configurations (ie, laptop users)
#   - set to 'menu' to present a menu during boot-up (dialog package required)
#   - prefix an entry with a ! to disable it
#
# Network profiles are found in /etc/network.d
#
# This now requires the netcfg package
#
#NETWORKS=(main)

# -----------------------------------------------------------------------
# DAEMONS
# -----------------------------------------------------------------------
#
# Daemons to start at boot-up (in this order)
#   - prefix a daemon with a ! to disable it
#   - prefix a daemon with a @ to start it up in the background
#
DAEMONS=(syslog-ng hal !network wicd netfs crond fam alsa gdm)

.:B:. · 2009-01-27 12:48:11

Use netcfg2 to configure your wireless network .

tomk · 2009-01-27 12:53:56

Standard advice for these kind of issues is to try it first using the basic tools and utilities e.g. iwconfig, wpa_supplicant, etc. If you can get it working that way, then you can re-introduce your chosen frontend - wicd, in your case. No matter how you approach it, though, you should be checking your logs during/after each connection attempt, and posting relevant excerpts here if you don't understand what you're looking at. Nobody can do very much for you if the only information available is that "it gets stuck".

Tyriel · 2009-01-27 12:56:32

haha is it really that much better? From reading the forums many of you seen to prefer it.

Well I'll give that a try tomorrow morning and see for myself and hope is also fixes my issue. I would try now but it is late.

Tyriel · 2009-01-27 13:01:11

tomk wrote:

Standard advice for these kind of issues is to try it first using the basic tools and utilities e.g. iwconfig, wpa_supplicant, etc. If you can get it working that way, then you can re-introduce your chosen frontend - wicd, in your case. No matter how you approach it, though, you should be checking your logs during/after each connection attempt, and posting relevant excerpts here if you don't understand what you're looking at. Nobody can do very much for you if the only information available is that "it gets stuck".

Good point and yes I should have shared the logs but basically they just said trying to obtain ip addess then it timed out. Sorry I'll link that next time and will take your advice and will try with the basic tools.

mihi · 2009-01-27 13:22:52

Hi, I recently installed WiFi with WPA2 on my system, these wiki-pages really helped:

http://wiki.archlinux.org/index.php/Wireless
http://wiki.archlinux.org/index.php/WPA_Supplicant

After I got it working I switched to netcfg to enable networking at boot (I couldn't find a good way to do that manually).

Cheers!

Last edited by mihi (2009-01-27 13:23:14)

.:B:. · 2009-01-27 14:22:11

Tyriel wrote:

haha is it really that much better? From reading the forums many of you seen to prefer it.

It's not about being 'better', it's a tool, specifically designed for Arch, to allow you more flexibility when it comes to network configuration (specifically wireless). Rc.conf is good when you stick to the basics, netcfg is there for encrypted wireless setups etc.

As tomk said it's always good to know the basics - use wireless-tools and wpa_supplicant - but while wireless-tools is pretty easy (imho), the more complex stuff is wpa_supplicant - and you can tell netcfg to act as a frontend to it (what does not exempt you from having to set it up correctly, though).

Tyriel · 2009-01-28 11:57:57

Hey guys, I tried going over the wireless security again and unfortunetly the outcome is the same as yesterday. I have no issue connecting manually to wep or no encryption but fail as soon as I try to activate it with WPA. I believe I have done everything suggested in the Wiki pages but when I do dhcpcd wlan0 to a WPA network I get the following error:

wlan0: dhcpcd 4.0.7 starting
wlan0: broadcasting for a lease
wlan0: timed out

I believe it has something to do with wpa_supplicant as everything else seems fine and it may be a compatability issue with wpa_supplicant and my intel iwl4965 wireless driver so I'll try rebuilding it tomorrow. But if any of you have had any experience with this I would love to know. Also If there are any logs that could help with this please tell me as I have no idea about them.

Thanks Again.

Oh btw I tried out netcfg today after I tried all the above and I have to say it is great

.:B:. · 2009-01-28 12:15:14

I have an IWL4965 card here too, and I haven't got the slightest complaint about 'compatibility'. Usually Intel's wireless cards work quite flawlessly with wpa_supplicant, so the error is probably on your part .

You said you tried 'everything', yet you do not tell us what 'everything' is. The crystal bowls are still out of order last time I checked .

So provide us with a systematical overview of what you do and when (commands, sequence) with the related output and we might be able to pinpoint your problem.

Tyriel · 2009-01-28 12:58:59

Great that you have a IWL4965 working without compatability issues. So then I have to agree it is most likely is a problem that occured between the keyboard and I .

I can't right now (have to step out for a little) but when I get back I'll write up step by step what I have done and related output in the hope you guys can see exactly what I am doing wrong. Thanks for all the feedback so far... I appreciate it!

Tyriel · 2009-01-29 10:28:14

Hey guys here is what I have done to get WPA working. I hope this is what you needed to see.

lspci | grep -i net

02:00.0 Network controller: Intel Corporation PRO/Wireless 4965 AG or AGN [Kedron] Network Connection (rev 61)
08:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8111/8168B PCI Express Gigabit Ethernet controller (rev 01)

Of which I installed the iwl4965 driver and wireless_tools but not madwifi as I did not think I needed that unless I miss understood the wiki.

iwconfig

lo        no wireless extensions.

eth0      no wireless extensions.

wmaster0  no wireless extensions.

wlan0     IEEE 802.11abgn  ESSID:""  
          Mode:Managed  Frequency:2.412 GHz  Access Point: Not-Associated   
          Tx-Power=0 dBm   
          Retry min limit:7   RTS thr:off   Fragment thr=2352 B   
          Encryption key:off
          Power Management:off
          Link Quality:0  Signal level:0  Noise level:0
          Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:0  Invalid misc:0   Missed beacon:0

ifconfig wlan0 up

iwlist wlan0 scan

wlan0     Scan completed :
          Cell 01 - Address: 00:1D:7E:B5:48:D2
                    ESSID:"Matrix"
                    Mode:Master
                    Channel:9
                    Frequency:2.452 GHz (Channel 9)
                    Quality=99/100  Signal level:-22 dBm  Noise level=-127 dBm
                    Encryption key:on
                    IE: Unknown: 00064D6174726978
                    IE: Unknown: 010882848B960C121824
                    IE: Unknown: 030109
                    IE: IEEE 802.11i/WPA2 Version 1
                        Group Cipher : TKIP
                        Pairwise Ciphers (2) : CCMP TKIP
                        Authentication Suites (1) : PSK
                    IE: Unknown: 2A0100
                    IE: Unknown: 32043048606C
                    IE: Unknown: DD180050F2020101020003A4000027A4000042435E0062322F00
                    IE: Unknown: DD1E00904C334E1003FFFF000000000000000000000000000000000000000000
                    IE: Unknown: 2D1A4E1003FFFF000000000000000000000000000000000000000000
                    IE: Unknown: DD1A00904C3409071B00000000000000000000000000000000000000
                    IE: Unknown: 3D1609071B00000000000000000000000000000000000000
                    IE: Unknown: DD0900037F01010000FF7F
                    IE: Unknown: DD0A00037F04010001000000
                    IE: Unknown: DD7D0050F204104A0001101044000102103B00010210470010E7FE1B918CD5031098DD001D7EB548D2102100074C494E4B535953102300075741473136304E10240007575343303030311042000C3030314437454235343844321054000800060050F20400011011000F4C494E4B5359532D5741473136304E100800020084
                    Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 11 Mb/s; 6 Mb/s
                              9 Mb/s; 12 Mb/s; 18 Mb/s; 24 Mb/s; 36 Mb/s
                              48 Mb/s; 54 Mb/s
                    Extra:tsf=0000000001149180
                    Extra: Last beacon: 1580ms ago

Now I already installed WPA Supplicant earlier so here are the steps I took to setup and connect to the WPA wireless point.

Now I am trying to connect to a wireless router with the following details.
ESSID: Matrix
Security Mode: WPA2-Personal
Encryption: TKIP or AES
Pre-Shared Key: 12345678

Following the instructions of the Wiki I created a /etc/wpa_supplicant.conf file displayed below.

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=wheel

network={
        ssid="Matrix"
        #psk="12345678"
        psk=3caf5403fde0f2a278ddd748ea023feec6fc450d94e455ce4672a082ee189bc9
}

I do the following commands and get no visual feedback saying anything.

ifconfig wlan0 up
iwconfig wlan0 essid "Matrix"
wpa_supplicant -B -Dwext -i wlan0 -c /etc/wpa_supplicant.conf

Now here is where I have an issue trying to connect. As you can see it always times out
I did wait over 30 seconds before trying the below as well.

dhcpcd wlan0

wlan0: dhcpcd 4.0.7 starting
wlan0: broadcasting for a lease
wlan0: timed out

Now if I try WPA-Personal I got

wlan0: dhcpcd 4.0.7 starting
wlan0: waiting for carrier
wlan0: carrier acquired
wlan0: broadcasting for a lease
wlan0: timed out

I hope you guys can see what I am doing wrong as I am left scratching my head. Sorry if I missed any needed steps... just let me know and I'll post them asap. Thanks again!

Runiq · 2009-01-29 10:33:44

Try putting

key_mgmt=WPA-PSK
proto=RSN
pairwise=CCMP
group=TKIP

into your network array in wpa_supplicant.conf and see if it works.
EDIT: You could also start wpa_supplicant with the -d or even -dd switch to get more verbose output.

Last edited by Runiq (2009-01-29 10:35:21)

iphitus · 2009-01-29 11:03:43

don't background wpa_supplicant until you _know_ it's working as that config looks invalid.

And then, don't start dhcpcd until you know wpa_supplicant is working ("wpa_cli status" as root will show wpa_state=COMPLETED)

Try changing

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=wheel

to

ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=0

Last edited by iphitus (2009-01-29 11:04:37)

Tyriel · 2009-01-29 12:06:13

Hey guys I tried changing /etc/wpa_supplicant.conf to the following as suggested:

ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=0

network={
        ssid="Matrix"
        #psk="xxxxxxxxxxxxxxxxxxxxxxxxxx"
        key_mgmt=WPA-PSK
        proto=RSN
        pairwise=CCMP
        group=TKIP
        psk=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
}

Then I did the following and got the following output
# ifconfig wlan0 up
# iwconfig wlan0 essid "Matrix"
# wpa_supplicant -dd -B -Dwext -i wlan0 -c /etc/wpa_supplicant.conf

Initializing interface 'wlan0' conf '/etc/wpa_supplicant.conf' driver 'wext' ctrl_interface 'N/A' bridge 'N/A'
Configuration file '/etc/wpa_supplicant.conf' -> '/etc/wpa_supplicant.conf'
Reading configuration file '/etc/wpa_supplicant.conf'
ctrl_interface='DIR=/var/run/wpa_supplicant'
ctrl_interface_group='0' (DEPRECATED)
Line: 4 - start of a new network block
ssid - hexdump_ascii(len=6):
     4d 61 74 72 69 78                                 Matrix          
PSK - hexdump(len=32): [REMOVED]
Priority group 0
   id=0 ssid='Matrix'
Initializing interface (2) 'wlan0'
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: KEY_RX entering state NO_KEY_RECEIVE
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
SIOCGIWRANGE: WE(compiled)=22 WE(source)=21 enc_capa=0xf
  capabilities: key_mgmt 0xf enc 0xf
WEXT: Operstate: linkmode=1, operstate=5
Own MAC address: 00:1f:3b:06:6d:ef
wpa_driver_wext_set_wpa
wpa_driver_wext_set_key: alg=0 key_idx=0 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=1 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=2 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=3 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_countermeasures
wpa_driver_wext_set_drop_unencrypted
Setting scan request: 0 sec 100000 usec
Added interface wlan0
Daemonize..

Now I have never manually set up WPA before but the above does not seem right although I am not sure.

# wpa_cli status

Selected interface 'wlan0'
bssid=xx:xx:xx:xx:xx:xx
ssid=Matrix
id=0
pairwise_cipher=CCMP
group_cipher=TKIP
key_mgmt=WPA-PSK
wpa_state=COMPLETED

# dhcpcd wlan0

wlan0: dhcpcd 4.0.7 starting
wlan0: broadcasting for a lease
wlan0: timed out

Sorry I still must be doing something wrong.

Last edited by B (2009-01-29 20:58:37)

.:B:. · 2009-01-29 13:16:30

Afaik the encryption protocols should always be the same in proto and pairwise...

This is the way I set up a hybrid WPA network with AES and TKIP:

network={
        ssid="bla"
    key_mgmt=WPA-PSK
    proto=WPA
    pairwise=TKIP CCMP
    group=TKIP CCMP
        psk=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Normally WPA2 is AES only, no TKIP. Is there a reason why you enable TKIP on your AP if you use WPA2 exclusively?

I'd replace proto=WPA by proto=WPA2 and take out the TKIP of pairwise & group. Then try again. Your scan results say it's a WPA2-encrypted access point. However,

                    IE: IEEE 802.11i/WPA2 Version 1
                        Group Cipher : TKIP
                        Pairwise Ciphers (2) : CCMP TKIP
                        Authentication Suites (1) : PSK

I don't really get why it says TKIP for the Group Cipher alone and allows CCMP and TKIP for the Pairwise Ciphers.

Note: CCMP = AES encryption.

Runiq · 2009-01-29 13:19:20

Hm... Doesn't seem to be related to wpa_supplicant if I see correctly, my output looks frighteningly similar actually.

What does

dhcpcd -d wlan0

say?

EDIT: Whoops, got beaten to it.

Last edited by Runiq (2009-01-29 13:21:11)

robmaloy · 2009-01-29 15:09:39

Tyriel wrote:

# wpa_cli status

Selected interface 'wlan0'
bssid=xx:xx:xx:xx:xx:xx
ssid=Matrix
id=0
pairwise_cipher=CCMP
group_cipher=TKIP
key_mgmt=WPA-PSK
wpa_state=COMPLETED

this looks quite good, check iwconfig if you're associated (you should be)

try using a static IP and/or
check if the other side's DHCP is running :>

Last edited by B (2009-01-29 20:57:47)

.:B:. · 2009-01-29 20:59:23

I edited out the MAC addresses and the keys. Try to be a little bit more careful Tyriel, everyone can see those .

Tyriel · 2009-01-30 10:46:56

B wrote:

I edited out the MAC addresses and the keys. Try to be a little bit more careful Tyriel, everyone can see those .

Thanks B, the keys were fake but I did forget about my MAC address.

Thanks to everyone for your suggestions and I have spent a few hours this afternoon trying them out but sadly to no avail. I can easily connect via DHCP with both WEP and Unencrypted networks but I fail only with WPA/WPA2

When I changed my /etc/wpa_supplicant.conf to the following or varients of:

ctrl_interface=DIR=/var/run/wpa_supplicant
ctrl_interface_group=0

network={
        ssid="Matrix"
        #psk="xxxxxxxxxxxxxxxxxx"
        key_mgmt=WPA-PSK
        proto=WPA2
        pairwise=CCMP
        group=CCMP
        psk=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
}

I would get the following wpa_cli status and nothing else

Selected interface 'wlan0'
wpa_state=SCANNING

So I reverted back to the previous one that seemed to work earlier. I tried connecting with a static ip which allocated me an IP address but I could not ping out, not even my router (unknown host).

Also I hope this helps but I did dhcpcd -d wlan0 and got the following:

wlan0: dhcpcd 4.0.7 starting
wlan0: hardware address = xx:xx:xx:xx:xx:xx
wlan0: executing `/usr/lib/dhcpcd/dhcpcd-run-hooks', reason PREINIT
wlan0: broadcasting for a lease
wlan0: sending DHCP_DISCOVER with xid 0x8b1cdb4, next in 3.01 seconds
wlan0: sending DHCP_DISCOVER with xid 0x8b1cdb4, next in 8.74 seconds
wlan0: sending DHCP_DISCOVER with xid 0x8b1cdb4, next in 15.45 seconds
wlan0: sending DHCP_DISCOVER with xid 0x8b1cdb4, next in 31.45 seconds
wlan0: timed out
wlan0: executing `/usr/lib/dhcpcd/dhcpcd-run-hooks', reason FAIL

This is just one of those issues that I find annoying as I hate not knowing the answer to these problems.

Last edited by B (2009-01-30 11:59:19)

Arch Linux

#1 2009-01-27 12:30:50

Troubles with Wireless Security

#2 2009-01-27 12:48:11

Re: Troubles with Wireless Security

#3 2009-01-27 12:53:56

Re: Troubles with Wireless Security

#4 2009-01-27 12:56:32

Re: Troubles with Wireless Security

#5 2009-01-27 13:01:11

Re: Troubles with Wireless Security

#6 2009-01-27 13:22:52

Re: Troubles with Wireless Security

#7 2009-01-27 14:22:11

Re: Troubles with Wireless Security

#8 2009-01-28 11:57:57

Re: Troubles with Wireless Security

#9 2009-01-28 12:15:14

Re: Troubles with Wireless Security

#10 2009-01-28 12:58:59

Re: Troubles with Wireless Security

#11 2009-01-29 10:28:14

Re: Troubles with Wireless Security

#12 2009-01-29 10:33:44

Re: Troubles with Wireless Security

#13 2009-01-29 11:03:43

Re: Troubles with Wireless Security

#14 2009-01-29 12:06:13

Re: Troubles with Wireless Security

#15 2009-01-29 13:16:30

Re: Troubles with Wireless Security

#16 2009-01-29 13:19:20

Re: Troubles with Wireless Security

#17 2009-01-29 15:09:39

Re: Troubles with Wireless Security

#18 2009-01-29 20:59:23

Re: Troubles with Wireless Security

#19 2009-01-30 10:46:56

Re: Troubles with Wireless Security

Board footer