802.1X wired network security

English Network/Internet
1

I need to connect with a wired IPv4 network with a 802.1X security enabled. Unfortunately, neither NetworkManager nor Yast allow security configuration for wired connections (at least I couldn’t find such option). Could someone help me with the task of manually configuring the connection? It will be a static IP with a private, password-protected certificate file together with a company’s root certificate.

I got it working under Ubuntu by using wpa_supplicant. I created a shell script to start wpa_supplicant with a configuration file like that:


ctrl_interface=/var/run/wpa_supplicant                                          
ctrl_interface_group=0                                                          
ap_scan=0                                                                       
network={                                                                       
  key_mgmt=WPA-EAP                                                              
  proto=WPA2                                                                    
  pairwise=CCMP TKIP                                                            
  eap=TLS                                                                       
  identity="MY_NAME@COMPANY.COM"

  ca_cert="/etc/wpa_supplicant/COMPANY_CERTIFICATE.der"

  private_key="/etc/wpa_supplicant/cert.p12"

  private_key_passwd="PASSWORD"
}

loaded by a line /etc/network/interfaces but I’m afraid I don’t know how to use it in openSUSE (ie. where to put so that wpa_supplicant is started every time eth0 starts).

2

To answer my own question - scripts to run for every connection are in /etc/sysconfig/network/if-up.d/ folder. I’ve put the following script inside called “wpa_start”:

#!/bin/sh

/usr/sbin/wpa_supplicant -B -Dwired -c /etc/wpa_supplicant/wpa.config -i eth0

where “/etc/wpa_supplicant/wpa.config” contains wpa_supplicant configuration I mentioned earlier. After setting the script as executable and restarting network deamon, my 802.1X-security protected wired connection works.