Connecting to Aarhus University eduroam with wpa_supplicant

Last modification on 2022-11-15

Eduroam is an international Wi-Fi roaming service that provides network access to university staff and visitors from other universities. Aarhus University provides instructions on connecting to eduroam via iOS/Android/Windows/Mac and a Python install script for Linux. In this post, I will explain how users of BSD or Linux can set up eduroam connectivity manually.

Preparing the system

First, install wpa_supplicant, which is the only prerequisite. Your system might already have it installed for authenticating with ordinary Wi-Fi networks. WPA supplicant supports many different authentication methods, and the configuration must be correct for the connection to succeed. On OpenBSD, install and enable the wpa_supplicant daemon with:

# pkg_add wpa_supplicant
# rcctl enable wpa_supplicant

On Gentoo Linux with OpenRC, the equivalent procedure is:

# emerge net-wireless/wpa_supplicant
# rc-update add wpa_supplicant default

Next, save the self-signed Aarhus University PEM certificate to the file /etc/ssl/au-eduroam-cert.pem. I extracted this key file from the official Python installer.

Option 1: Configuring wpa_supplicant manually

If your system does not use Network Manager, you must configure wpa_supplicant directly. Open (or create) /etc/wpa_supplicant/wpa_supplicant.conf. At minimum, it should contain the following configuration of the eduroam network. You can also add other Wi-Fi networks here.

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=wheel
disable_scan_offload=1
update_config=1
autoscan=periodic:10

network={
	ssid="eduroam"
	key_mgmt=WPA-EAP
	eap=TTLS PEAP
	identity="auNNNNNN@uni.au.dk"
	password="YOURPASSWORD"
	ca_cert="/etc/ssl/au-eduroam-cert.pem"
	phase2="auth=MSCHAPV2"
	mesh_fwding=1
	frequency=5200
}

The ctrl_interface line may look different on your system. Make sure to edit the identity and password values according to your AU ID.

Next, make sure that other users cannot read the contents of the file:

# chown root:root /etc/wpa_supplicant/wpa_supplicant.conf
# chmod 600 /etc/wpa_supplicant/wpa_supplicant.conf

On OpenBSD, associate wpa_supplicant with the network interface. In the following command, change "iwm0" to your wifi device name:

# rcctl set wpa_supplicant flags -c /etc/wpa_supplicant/wpa_supplicant.conf -s -D openbsd -i iwm0

It is now time to start the wpa_supplicant service:

# rcctl start wpa_supplicant		# OpenBSD
# rc-service wpa_supplicant start	# Gentoo (OpenRC)

You should now be connected to the Aarhus University eduroam network. In case of problems, you can stop the wpa_supplicant daemon and manually launch it with debugging messages enabled (-d):

# wpa_supplicant -d -c /etc/wpa_supplicant/wpa_supplicant.conf

Option 2: Using Network Manager

If your system uses Network Manager to configure networking, connect to the eduroam wifi with the following configuration:

Fig. 1: Aarhus University eduroam configuration in Network Manager.