HOWTO: Portland State WPA + Debian network/interfaces + wpa_supplicant

Update 2012-10-31: Spencer of the PSU CAT pointed out to me that this 6-year-old HOWTO is stale, and should no longer be used. Try http://cat.pdx.edu/linux/secure-wireless-with-wpa-supplicant.html instead…

Portland State has two ways of authenticating users of its 802.11 network. One is NoCat, about which the less said the better. The other is a somewhat idiosyncratic WPA setup. Jules Kongslie and I got a client working with it recently; here's how.

I'm using Debian testing/unstable on an IBM T41 (IPW2100) laptop. I don't use any fancy network manager, just /etc/network/interfaces. My interfaces file uses interface schemas that can be set manually (outside the scope of this HOWTO); thus there are "mapping" lines in it. The relevant lines of my interfaces file are

iface ipw0-pdxnet inet dhcp
  wpa-conf /etc/wpa_supplicant/pdx.conf

The key, then, is the pdx.conf file. Mine looks like this:

network={
     ssid="pdx.edu"
     proto=WPA
     key_mgmt=WPA-EAP
     pairwise=TKIP
     group=TKIP
     eap=TTLS
     identity="masseyb"
     password="ntmypsswrd"
     auth_alg=OPEN
     anonymous_identity=""
     scan_ssid=1
     phase2="auth=PAP"
}

It would be nice to not have to give one's password in cleartext, but I can't figure a workaround. Make sure to keep this file 0600 or better.

The right way would be for PSU to replace the PAP auth with CHAP, or better yet to go to Radius, which I think they plan to do RSN. This would also make Linux Network Manager work, which would for example let me use the network reasonably from my Nokia 770.

At any rate, when I invoke ifup ipw0 on my laptop the laptop will run DHCP to get an IP, then run

wpa_supplicant \
  -i ipw0 \
  -c /etc/wpa_supplicant/pdx.conf \
  -D wext

(plus some other stuff). It takes a while in this setup to get a connection; be patient. Note that the generic wext driver is used; the ipw drivers should only be used with old kernels.

Hope this helps. Comments welcome. (B)