Kindle 3 WPA Supplicant

[wengang]

Originally Posted by Caster

The problem might be that your company's network has different authentication method than PEAP/MSCHAPV2, or other settings. The ones in script are specific for eduroam networks, so you should change them according to your company's manual or the settings used in your laptop or something.

Or are you saying that it already worked with 3.0 firmware and now it doesn't?

Hello,
The first time I tried ~usbNetwork is with firmware 3.1.
You are right and I missed this one. My company uses LEAP. I will try and get back

[wengang]

I managed to connect to my company network finally! Woooohooo! Thanks for the tip!!

This is what I used. My company uses LEAP and TKIP. I just replaced the SSID/LOGIN/PASSWORD, and it just connects superbly and automatically.

#!/bin/sh

sleep 6

id="`wpa_cli list_networks | grep SSID | cut -f1 | sed -n '1p'`"

exec="`wpa_cli << EOF
set_network $id ssid \"SSID\"
set_network $id scan_ssid 1
set_network $id key_mgmt WPA-EAP
set_network $id pairwise TKIP
set_network $id group TKIP
set_network $id eap LEAP
set_network $id identity \"LOGIN\"
set_network $id password \"PASSWORD\"
enable_network $id
quit
EOF
`"
echo $exec
#!/usr/bin/perl

[victoria0217]

Hello guys. I've been following this thread and trying to get my kindle 3 to work with my college wifi. but so far, no luck.
I followed everything mentioned in the posts and have been tweaking my config script, but I haven't been able to get it to work.

Here's what my college suggest people to do in Linux to get online:

network={
	ssid="SchoolName"         # essid...                                            [REQUIRED]
	proto=WPA              # only WPA works, only required with b43 drivers      [REQUIRED]
	key_mgmt=WPA-EAP       # only TKIP works need to prevent default to WPA-PSK  [REQUIRED]
	pairwise=CCMP          # only CCMP & TKIP work, CCMP is more secure
	group=TKIP             # only TKIP works
	eap=PEAP               # only PEAP works
	phase1="peapver=0 peaplabel=0" # only peaplabel=0 works, only peapver=0 works
	phase2="auth=MSCHAPV2" # works, not sure what it does, or what else works
	scan_ssid=1            # 0 and 1 work, 0 is possibly faster

	identity="<username>"  # username                                   [REQUIRED]
	password="<password>"  #password                                   [REQUIRED]
}

And here is what I have for my script:

#!/bin/sh

sleep 6

id="`wpa_cli list_networks | grep schoolName | cut -f1 | sed -n '1p'`"

exec="`wpa_cli << EOF
set_network $id ssid \"SchoolName\"
set_network $id scan_ssid 1
set_network $id key_mgmt WPA-EAP
set_network $id pairwise CCMP
set_network $id group TKIP
set_network $id eap PEAP
set_network $id phase1 \"peapver=0 peaplabel=0\"
set_network $id phase2 \"auth=MSCHAPV2\"

set_network $id identity \"username\"
set_network $id password \"password\"

enable_network $id
quit
EOF
`"
echo $exec
#!/usr/bin/perl

I don't know what I'm missing here, could you please tell me what might be wrong with this? I tried with and without specifying phase1 and phase 2.
And also I don't know much about shell script, but I have a parenthesis and a colon in my password, do they mess up the script？

Thanks a lot!

[otichy]

Did you create your personal wifi with the same SSID and did you succesfully connected to it?

[victoria0217]

otichy,
what do you mean by my personal wifi? I used the same ssid for my Ubuntu and successfully connected to it

[otichy]

See #27 & #28.

You need to setup a (personal) wifi that has the same name (ssid) as the enterprise/university network that you want your kindle connected to - say the ssid is "eduroam".

This personal wifi can have some simple wep/wpa authentication, so that there is no problem connecting to it with your kindle. Once the kindle has been connected to any wifi with the ssid "eduroam", it will remember it as a "known" network and it will connect automatically to any network with that same ssid. Even to an enterprise/university network, if you have the hack applied.

[victoria0217]

I got it to work! Thanks otichy!
I should have read the post more carefully

Thanks!

[otichy]

No prob, good to hear it worked!

[MacUsers]

Originally Posted by otichy

#!/bin/sh

sleep 6

id="`wpa_cli list_networks | grep SSID | cut -f1 | sed -n '1p'`"

exec="`wpa_cli << EOF
set_network $id ssid \"SSID\"
set_network $id scan_ssid 1
.....
.....
set_network $id phase2 \"auth=MSCHAPV2\"
set_network $id ca_cert \"CERTIFICATE\"
enable_network $id
quit
EOF
`"
echo $exec
#!/usr/bin/perl

One question: What does the very last line do - #!/usr/bin/perl ?? Is it a typo?
And, can anyone confirm if it still works with v3.2.1 firmware? Cheers!!!

[otichy]

Yes, that is just a typo, though i shouldnt' cause any problems. The hack works for 3.1 and i don't think there are any appreciable differences between 3.1 and 3.2.1.

[MacUsers]

Thanks otichy! I'll give it a try tomorrow. Forgot to create the fake "eduroam" and I'm at work now. Cheers!!

[MacUsers]

I can now confirm that eduroam "hack" works on 3.2.1 firmware as well. Thanks to everyone to make this thing happening.

Originally Posted by otichy

Yes, that is just a typo, though i shouldnt' cause any problems.

On a side note, even though it's "harmless", do you think you can remove the "#!/usr/bin/perl" bit from the original script please? This thing is all over the places in the net; people are copy-n-pasting blindfolded, which actually leaves a few extra error messages in the log. Not a very big deal for sure. Cheers!!

[RansomXvi]

Hey having trouble understanding the scripts. Is it the forum code tags that's escaping all the quotes or must you escape all special characters in a script?

Also, lines that include set_network @id ...., how do you know what viable options are? For instance, group is often set to TKIP. My network is AES. Do i simply change TKIP to AES or is there a different word where "group" should be.

I guess what I'm asking is what resource helps you to write a script like this? How can I know all the different settings that can be changed using set_network?

Thanks,

Ransom

[Caster]

Originally Posted by RansomXvi

Hey having trouble understanding the scripts. Is it the forum code tags that's escaping all the quotes or must you escape all special characters in a script?

The forum is not changing anything here. The quotes have to be escaped because the whole settings are assigned to an exec variable on the line that starts with exec="

Originally Posted by RansomXvi

I guess what I'm asking is what resource helps you to write a script like this? How can I know all the different settings that can be changed using set_network?

Probably the best resource is the commented wpa_supplicant.conf example available for example here (or as part of wpa_supplicant installation on any linux system). Note that the script is using wpa_cli commands instead of the configuration file (which the kindle doesn't use) hence the slightly different syntax. But all (or most) of the network-specific configuration options should be able to be configured, with the same option names and available values as in the example config.

[MacUsers]

Originally Posted by RansomXvi

How can I know all the different settings that can be changed using set_network?

The most notable commands (as far as this script is concerned) are:

set_network <network id> <variable> <value> = set network variables (shows list of variables when run without arguments)
enable_network <network id> = enable a network

Here you go with the complete list of available commands:

  status [verbose] = get current WPA/EAPOL/EAP status
  mib = get MIB variables (dot1x, dot11)
  help = show this usage help
  interface [ifname] = show interfaces/select interface
  level <debug level> = change debug level
  license = show full wpa_cli license
  logoff = IEEE 802.1X EAPOL state machine logoff
  logon = IEEE 802.1X EAPOL state machine logon
  set = set variables (shows list of variables when run without arguments)
  pmksa = show PMKSA cache
  reassociate = force reassociation
  reconfigure = force wpa_supplicant to re-read its configuration file
  preauthenticate <BSSID> = force preauthentication
  identity <network id> <identity> = configure identity for an SSID
  password <network id> <password> = configure password for an SSID
  new_password <network id> <password> = change password for an SSID
  pin <network id> <pin> = configure pin for an SSID
  otp <network id> <password> = configure one-time-password for an SSID
  passphrase <network id> <passphrase> = configure private key passphrase
    for an SSID
  bssid <network id> <BSSID> = set preferred BSSID for an SSID
  list_networks = list configured networks
  select_network <network id> = select a network (disable others)
  enable_network <network id> = enable a network
  disable_network <network id> = disable a network
  add_network = add a network
  remove_network <network id> = remove a network
  set_network <network id> <variable> <value> = set network variables (shows
    list of variables when run without arguments)
  get_network <network id> <variable> = get network variables
  save_config = save the current configuration
  disconnect = disconnect and wait for reassociate/reconnect command before
     connecting
  reconnect = like reassociate, but only takes effect if already disconnected
  scan = request new BSS scan
  scan_results = get latest scan results
  get_capability <eap/pairwise/group/key_mgmt/proto/auth_alg> = get capabilies
  ap_scan <value> = set ap_scan parameter
  stkstart <addr> = request STK negotiation with <addr>
  terminate = terminate wpa_supplicant
  quit = exit wpa_cli

All of these can be found from "wpa_cli" console with "h" or running wps-cli with -h switch. But, I would not recommend anyone to experiment with this if you don't have prior CLI experience. Cheers!!