Add PEAP support?

[Elektron]

Kobo not supporting PEAP for WiFi has caused me A LOT of grief the last few days. Is there a hack to enable support? Could someone create one? I can't be the only one with this problem... BTW it uses MSChapV2.

[DNSB]

Originally Posted by Elektron

Kobo not supporting PEAP for WiFi has caused me A LOT of grief the last few days. Is there a hack to enable support? Could someone create one? I can't be the only one with this problem... BTW it uses MSChapV2.

Try Googling Linux WPA2 Enterprise PEAP MSCHAPv2 and see what pops up. And yes, Enterprise belongs there.

The usual workaround I suggest is to connect your phone as a hot spot and then connecting your ereader to the phone's WiFi SSID. Though given that most of those connections are made through corporate networks, you might want to check the corporate policy on such connections. I tend to disable the network connection first and then listen to explanations second—a real advantage to having written the network acceptable use policy (it's part of that stack of paper/eforms you get handed when you're hired and very few people ever seem to read before signing). There is also a certain love for the BOFH.

[Elektron]

Unfortunately I don't own a phone, @DNSB.
Also something that I don't understand is why doesn't Kobo support PEAP when it supports EAP!

[DNSB]

Originally Posted by Elektron

Unfortunately I don't own a phone, @DNSB.
Also something that I don't understand is why doesn't Kobo support PEAP when it supports EAP!

PEAP is generally used in corporate environments as part of a WPA2 Enterprise setup. Public/private keys are used to encrypt the EAP traffic (the Protected in PEAP). It also allows for devices to be moved securely to a new VLAN after authentication. All kinds of nice features that are not generally found or needed in a home network.

The first time I sucessfully worked on connecting a Linux laptop to a WPA2 Enterprise network was with Linux Mint back in 2017 and that was—for certain definitions of fun—fun.

[Elektron]

Is there a way to make the kobo support PEAP instead of a workaround?

[DNSB]

Originally Posted by Elektron

Is there a way to make the kobo support PEAP instead of a workaround?

There is all sorts of information for connecting Linux computers to PEAP wireless networks posted around the Internet. As of two years back, none of them seem to work on a Kobo ereader.

[Elektron]

Maybe somehow modify the EAP option on the Kobo to include PEAP?

[frostschutz]

at least the wpa_supplicant binary on the Kobo mentions both PEAP and MSCHAPV2, so some kind of support might be there?

but since I don't have access to such a wifi network there's no way for me to try and see if it could be made to work (by changing /etc/wpa_supplicant/conf or whatever)

ctrl_interface=/var/run/wpa_supplicant
update_config=1

# example from wpa_supplicant man page
network={
	ssid="example"
	scan_ssid=1
	key_mgmt=WPA-EAP
	eap=PEAP
	identity="user@example.com"
	password="foobar"
	ca_cert="/etc/cert/ca.pem" # you have to provide this file yourself
	phase1="peaplabel=0"
	phase2="auth=MSCHAPV2"
}

[Elektron]

thanks Ill check it out
EDIT: Where is /etc/cert/ca.pem and how do I "provide" it?

ca_cert="/etc/cert/ca.pem"

[PeterT]

Welcome to the world of why Kobo does not offer support for PEAP

[Elektron]

That didn't answer my question

[DNSB]

Originally Posted by Elektron

thanks Ill check it out
EDIT: Where is /etc/cert/ca.pem and how do I "provide" it?

ca_cert="/etc/cert/ca.pem"

It lives in the Linux system partition on your Kobo ereader though as far as I recall, the cert directory does not exist by default. You could generate a KoboRoot.tgz file with that certificate in it and install it that way or use FTP to transfer it. One question is if you will need the CA cert and if you can set it as not needed, if you are going to be comfortable with chaining the certs together (I used OpenSSL to handle that task when I was playing with this). In our corporate case, we did not need the CA cert but you did need to get the client certificate from IT. I've added a sample what wpa_supplicant.conf looked like in one test:

identity=ABCDEFGHIJ123@xxxxxyyyy.ca
password=alpha/numeric/symbol/etc
client_cert="/etc/ssl/ABCDEFGHIJ123@xxxxxyyyy.ca.p12"
ca_cert="/etc/ssl/cacert.pem"
private_key="/etc/ssl/ABCDEFGHIJ123@xxxxxyyyy.ca.key"
private_key_passwd==passwordsuppliedbyIT
system_ca-certs=false

Note that I used /etc/ssl/ insteadl of /etc/cert/.

[Elektron]

1. Whats the difference of those dirs?
2. How do I get a CA cert?

[Elektron]

Where is ca.pem?????

[Elektron]

Aah :| I dont know how to get ca.pem. @DNSB where did you get yours???