2.2.10.1. Configuring 802.1X Security
802.1X security is the name of the IEEE standard for
port-based Network Access Control (
PNAC). It is also called
WPA Enterprise. Simply put, 802.1X security is a way of controlling access to a
logical network from a physical one. All clients who want to join the logical network must authenticate with the server (a router, for example) using the correct 802.1X authentication method.
802.1X security is most often associated with securing wireless networks (WLANs), but can also be used to prevent intruders with physical access to the network (LAN) from gaining entry. In the past, DHCP servers were configured not to lease IP addresses to unauthorized users, but for various reasons this practice is both impractical and insecure, and thus is no longer recommended. Instead, 802.1X security is used to ensure a logically-secure network through port-based authentication.
802.1X provides a framework for WLAN and LAN access control and serves as an envelope for carrying one of the Extensible Authentication Protocol (EAP) types. An EAP type is a protocol that defines how security is achieved on the network.
Procedure 2.9. For a Wired Connection
Select a Wired network interface from the left-hand-side menu.
Either click on Add Profile to add a new network connection profile for which you want to configure 802.1X security, or select an existing connection profile and click the gear wheel icon.
Then select Security and set the symbolic power button to ON to enable settings configuration.
Procedure 2.10. For a Wireless Connection
Select a Wireless network interface from the left-hand-side menu. If necessary, set the symbolic power button to ON and check that your hardware switch is on.
Either select the connection name of a new connection, or click the gear wheel icon of an existing connection profile, for which you want to configure 802.1X security. In the case of a new connection, complete any authentication steps to complete the connection and then click the gear wheel icon.
Select Security.
From the drop-down menu select one of the following security methods: , , or .
2.2.10.1.1. Configuring TLS (Transport Layer Security) Settings
With Transport Layer Security, the client and server mutually authenticate using the TLS protocol. The server demonstrates that it holds a digital certificate, the client proves its own identity using its client-side certificate, and key information is exchanged. Once authentication is complete, the TLS tunnel is no longer used. Instead, the client and server use the exchanged keys to encrypt data using AES, TKIP or WEP.
The fact that certificates must be distributed to all clients who want to authenticate means that the EAP-TLS authentication method is very strong, but also more complicated to set up. Using TLS security requires the overhead of a public key infrastructure (PKI) to manage certificates. The benefit of using TLS security is that a compromised password does not allow access to the (W)LAN: an intruder must also have access to the authenticating client's private key.
NetworkManager does not determine the version of TLS supported. NetworkManager gathers the parameters entered by the user and passes them to the daemon, wpa_supplicant, that handles the procedure. It in turn uses OpenSSL to establish the TLS tunnel. OpenSSL itself negotiates the SSL/TLS protocol version. It uses the highest version both ends support.
Selecting an Authentication Method
Select from one of following authentication methods:
2.2.10.1.2. Configuring TLS Settings
- Identity
Provide the identity of this server.
- User certificate
Click to browse for, and select, a personal X.509 certificate file encoded with
Distinguished Encoding Rules (
DER) or
Privacy Enhanced Mail (
PEM).
- CA certificate
Click to browse for, and select, an X.509
certificate authority certificate file encoded with
Distinguished Encoding Rules (
DER) or
Privacy Enhanced Mail (
PEM).
- Private key
Click to browse for, and select, a
private key file encoded with
Distinguished Encoding Rules (
DER),
Privacy Enhanced Mail (
PEM), or the
Personal Information Exchange Syntax Standard (
PKCS #12).
- Private key password
Enter the password for the private key in the Private key field. Select Show password to make the password visible as you type it.
2.2.10.1.3. Configuring FAST Settings
- Anonymous Identity
Provide the identity of this server.
- PAC provisioning
Select the check box to enable and then select from , , and .
- PAC file
Click to browse for, and select, a
protected access credential (
PAC) file.
- Inner authentication
— Generic Token Card.
— Microsoft Challenge Handshake Authentication Protocol version 2.
- Username
Enter the user name to be used in the authentication process.
- Password
Enter the password to be used in the authentication process.
2.2.10.1.4. Configuring Tunneled TLS Settings
- Anonymous identity
This value is used as the unencrypted identity.
- CA certificate
Click to browse for, and select, a Certificate Authority's certificate.
- Inner authentication
— Password Authentication Protocol.
— Challenge Handshake Authentication Protocol.
— Microsoft Challenge Handshake Authentication Protocol version 2.
— Challenge Handshake Authentication Protocol.
- Username
Enter the user name to be used in the authentication process.
- Password
Enter the password to be used in the authentication process.
2.2.10.1.5. Configuring Protected EAP (PEAP) Settings
- Anonymous Identity
This value is used as the unencrypted identity.
- CA certificate
Click to browse for, and select, a Certificate Authority's certificate.
- PEAP version
The version of Protected EAP to use. Automatic, 0 or 1.
- Inner authentication
— Microsoft Challenge Handshake Authentication Protocol version 2.
— Message Digest 5, a cryptographic hash function.
— Generic Token Card.
- Username
Enter the user name to be used in the authentication process.
- Password
Enter the password to be used in the authentication process.
2.2.10.4. Configuring IPv4 Settings
The
IPv4 Settings tab allows you to configure the method used to connect to a network, to enter
IP address, route, and
DNS information as required. The
IPv4 Settings tab is available when you create and modify one of the following connection types: wired, wireless, mobile broadband, VPN or DSL. If you need to configure
IPv6 addresses, see
Section 2.2.10.5, “Configuring IPv6 Settings”. If you need to configure static routes, click the
Routes button and proceed to
Section 2.2.10.6, “Configuring Routes”.
If you are using DHCP to obtain a dynamic IP address from a DHCP server, you can simply set Method to .
Setting the Method
Available IPv4 Methods by Connection Type
When you click the Method drop-down menu, depending on the type of connection you are configuring, you are able to select one of the following IPv4 connection methods. All of the methods are listed here according to which connection type, or types, they are associated with:
- Method
— Choose this option if the network you are connecting to uses a DHCP server to assign IP addresses. You do not need to fill in the DHCP client ID field.
— Choose this option if the network you are connecting to uses a DHCP server to assign IP addresses but you want to assign DNS servers manually.
— Choose this option if the network you are connecting to does not have a
DHCP server and you do not want to assign
IP addresses manually. Random addresses will be assigned as per
RFC 3927 with prefix
169.254/16.
— Choose this option if the interface you are configuring is for sharing an Internet or WAN connection. The interface is assigned an address in the
10.42.x.1/24 range, a
DHCP server and
DNS server are started, and the interface is connected to the default network connection on the system with
network address translation (
NAT).
— IPv4 is disabled for this connection.
- Wired, Wireless and DSL Connection Methods
— Choose this option if you want to assign IP addresses manually.
- Mobile Broadband Connection Methods
— Choose this option if the network you are connecting to assigns your IP address and DNS servers automatically.
— Choose this option if the network you are connecting to assigns your IP address automatically, but you want to manually specify DNS servers.
- VPN Connection Methods
— Choose this option if the network you are connecting to assigns your IP address and DNS servers automatically.
— Choose this option if the network you are connecting to assigns your IP address automatically, but you want to manually specify DNS servers.
- DSL Connection Methods
— Choose this option if the network you are connecting to assigns your IP address and DNS servers automatically.
— Choose this option if the network you are connecting to assigns your IP address automatically, but you wish to manually specify DNS servers.
2.2.10.6. Configuring Routes
A host's routing table will be automatically populated with routes to directly connected networks. The routes are learned by examining the network interfaces when they are “up”. This section describes entering static routes to networks or hosts which can be reached by traversing an intermediate network or connection, such as a VPN tunnel or leased line. In order to reach a remote network or host, the system is given the address of a gateway to which traffic should be sent.
When a host's interface is configured by DHCP, an address of a gateway that leads to an upstream network or the Internet is usually assigned. This gateway is usually referred to as the default gateway as it is the gateway to use if no better route is known to the system (and present in the routing table). Network administrators often use the first or last host IP address in the network as the gateway address; for example, 192.168.10.1 or 192.168.10.254. Not to be confused by the address which represents the network itself; in this example, 192.168.10.0, or the subnet's broadcast address; in this example 192.168.10.255.
Configuring Static Routes
- Routes
— Enter the IP address of a remote network, sub-net, or host.
— The netmask or prefix length of the IP address entered above.
— The IP address of the gateway leading to the remote network, sub-net, or host entered above.
— A network cost, a preference value to give to this route. Lower values will be preferred over higher values.
- Automatic
When Automatic is ON, routes from RA or DHCP are used, but you can also add additional static routes. When OFF, only static routes you define are used.
- Use this connection only for resources on its network
Select this check box to prevent the connection from becoming the default route. Typical examples are where a connection is a VPN tunnel or a leased line to a head office and you do not want any Internet-bound traffic to pass over the connection. Selecting this option means that only traffic specifically destined for routes learned automatically over the connection or entered here manually will be routed over the connection.
