Blog's control panel: | Home | Tags | Index | Rss 2.0

WPA2 and wpa_supplicant with Netgear WG511T and Broadcom BCM43XX AirForceOne

Fri, 09 Mar 2007 | Permalink | Tags: ,

I always backed off of wireless because it always looked like time consuming and really not worth it. Then I rented a 2 floors maisonette and a cable hanging down the stairs wasn't too appealing to me. The end result is 3 Linux boxes (2 laptops one desktop) connected via WPA2-PSK to a BT AP. No magic gnome buttons involved.

Really brief introduction to wireless security

Keeping it simple, WEP is an insult to whoever designed networking protocols. WPA is a bit better but still pretty bad. WPA2 is decent and provided there is always 'a way in', it can be considered secure enough. You will probably want to use a pre-shared key (PSK), where basically you configure a password on the access point (AP) which you then reuse on all the clients. Alternatively one might use more complicated systems so each user has his/her own password but it is out of the scope of this article. The other possible thing is restricting the devices that can access the AP using the mac address but it is easy enough to bruteforce it so it is not really worth it. Same goes for hiding the SSID. If anything is mentioned about encryption algorithms, AES is what you want.

wpa_supplicant under Ubuntu

Wpa_supplicant is is a WPA Supplicant with support for WPA and WPA2 (IEEE 802.11i / RSN). Supplicant is the IEEE 802.1X/WPA component that is used in the client stations. It implements key negotiation with a WPA Authenticator and it controls the roaming and IEEE 802.11 authentication/association of the wlan driver. For Ubuntu and debian you no longer need to take care of the wpa_daemon/init.d script, but you can do all of it from /etc/network/interfaces. Commonly you want something like this:

auto ath0
iface ath0 inet dhcp
 	wpa-driver madwifi
	wpa-proto RSN
	wpa-ssid SSID
	wpa-psk XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Values depends on your hw and AP's configuration. Wpa-psk can either be the password enclosed in " " or the encrypted version that you can retrieve executing `wpa_passphrase ESSID`.

Netgear WG511T

It works out of the box under ubuntu edgy, Atheros chipset, using the madwifi driver, and wpa_supplicant. This is what comes up in lspci:
03:00.0 Ethernet controller: Atheros Communications, Inc. AR5212 802.11abg NIC (rev 01)

Broadcom BCM43XX AirForceOne

For this card you need ndiswrapper and the windows drivers, plus wpa_supplicant, but it can be got to work with wpa2+aes. There are several approaches to this, but the easiest I've found is available here. Besides the exaplantions there's a script to download which will take care of the whole lot. Only thing to notice: that script compiles a kernel module, if you upgrade your kernel you'll have to re-run that or your card wont work.




SpikeLab.org is a Filippo Spike Morelli copyright 2005-2008
This work is licensed under Creative Commons Att-SA License.