Table of Contents
How to connect to Eduroam on Linux
Automatically
The UMD wireless setup tool works with Linux. Download and run the installer script. It should Just Work™.
Troubleshooting
If the script crashes, you probably don't have tools like which or certain Python libraries like python-dbus installed.
You can figure out what you need to install by reading the installer. It's a Bash script with an embedded gzipped Python script. Edit the Bash script to not delete the extracted Python files, and run the Python scripts manually, installing what you need on the way.
Otherwise, try manual configuration.
Manually
Visit the UMD wireless setup tool site and select “Non-specific OS”. Download the three certificates, then configure your network tool with the settings provided on the page.
Some settings that are easy to miss:
- Domain: wireless.umd.edu
- Identity: YourDirectoryID@umd.edu (not 123456789@umd.edu)
Example configurations
NetworkManager
Add a new connection with the Advanced Network Configuration GUI, or run nm-connection-editor in the terminal.
IWD
As described above, the eduroam certificates should first be downloaded and placed in an accessible location. Then the three certificates must be combined together like so (the order is important):
cat 'usertrustrsaca [jdk].cer' 'digicertglobalrootca [jdk].cer' 'comodoaaaca [jdk].cer' > eduroam.pem
Then create the following file, replacing YourDirectoryID and YourHash (the correct filename is crucial):
/var/lib/iwd/eduroam.8021x:
[Security] EAP-Method=PEAP EAP-Identity=anonymous@umd.edu EAP-PEAP-CACert=/var/lib/iwd/eduroam.pem EAP-PEAP-ServerDomainMask=wireless.umd.edu EAP-PEAP-Phase2-Method=MSCHAPV2 EAP-PEAP-Phase2-Identity=YourDirectoryID@umd.edu EAP-PEAP-Phase2-Password-Hash=YourHash
In this example, the config expects the combined certificate to be at /var/lib/iwd/eduroam.pem.
The arch wiki describes how YourHash may be generated. A password hash is used instead of the plaintext password for security. File permissions for the certificate and config file should also be made as restrictive as possible, e.g., owned by root with mode 600.
WPA Supplicant
Official UMD references
- https://ask.eng.umd.edu/page.php?id=105787port?id=kb_article_view&sysparm_article=KB0016964|UMD IT article]]
- UMD Engineering article