lmn-client/doc/wlan.md

WLAN support

Supported modes authenticating via WLAN:

• WPA-Personal (WPA-PSK) authentication via preshared key (psk)
• WPA-Enterprise (WPA-802.1x) with EAP-TLS authentication via client certificates (eap-tls)

Which method is used is determined by the variable wlan

Choices:

• "none" <- (default)
• "psk"
• "eap-tls"

Common Configuration / Variables

• wlan Authentication mode Type: String Values:
  • "none" <-- (default)
  • "psk" <-- set to use WPA-Personal
  • "eap-tls" <-- set to use WPA-Enterprise with EAP-TLS
• wlan_ssid SSID of used WLAN Type: String
• wlan_enable_on_boot If set to true wlan will be enabled on boot Type: Boolean Default: true

WPA-Personal

Requirements

WLAN with configured WPA-Personal (WPA-PSK)

Additional Configuration / Variables

• wlan_password Password of WLAN. Only for wlan: "psk" Type: String

Examples

One class of devices with wlan access

inventory.yml

laptop:
  hosts:
    10.0.13.[1-28]:
  vars:
    wlan: "psk"
    wlan_ssid: "devicesPSK"
    wlan_password: "topsecretpasswd"

Two device classes with different wlan access

inventory.yml

laptop_students:
  hosts:
    10.0.13.[1-28]:
  vars:
    wlan: "psk"
    wlan_ssid: "Students"
    wlan_password: "topsecretpasswd1"
laptop_teachers:
  hosts:
    10.0.23.[1-82]:
  vars:
    wlan: "psk"
    wlan_ssid: "Teachers"
    wlan_password: "topsecretpasswd2"

WPA-Enterprise with EAP-TLS

Authentication is based on individual certificates, which will be automaticaly created on the radius server. Every devices gets his own certificate. When creating new certificates, the old one will be revoked.

Requirements

• You need to run a freeradius server. For installation see https://codeberg....
• The user, running this playbook, must have access to the radius-Server via ssh.

Additional Configuration / Variables

• wlan_eap_ca CA data for certs and crl Type: Dictionary of StringsKeys:
  • C <-- default: "DE"
  • ST <-- default: "Baden-Wuerttemberg"
  • L <-- default: "Reutlingen"
  • O <-- default: "Linuxschule"
  • emailAddress <-- default: "admin@example.com"
  • CN <-- default: "Radius Certificate Authority"
  • password <-- default: "OtherVerySecurePassw0rd"
• wlan_force_issue Force to issue a new certificateOnly for wlan: "eap-tls" Type: Bolean Values:
  • true
  • false <-- (default)
• wlan_eap_ca_crl URL of the certificate revocation list Type: String Default: "http://radius.{{ domain }}/radius-ca.crl"

Examples

inventory.yml:

infrastructure:
  hosts:
    radius_server:
      ansible_host: 10.0.0.15
      ansible_user: ansible
laptop:
  vars:
    wlan: "eap-tls"
    wlan_ssid: "devices8021x"
    wlan_eap_ca:
      C: "DE"
      ST: "Baden-Wuerttemberg"
      L: "Reutlingen"
      O: "Linuxschule"
      emailAddress: "admin@example.com"
      CN: "Radius Certificate Authority"
      password: "secret4radiusCA"
    wlan_eap_ca_crl: "http://radius.example.com/radius-ca.crl"

complex example with both modes

We have three groups of devices (one with psk, two with eap-tls):

inventory.yml

all:
  vars:
    wlan_ssid: "WLAName" # teacher and staff are using the same ssid
    wlan_eap_ca:
      C: "DE"
      ST: "Baden-Wuerttemberg"
      L: "Reutlingen"
      O: "Linuxschule"
      emailAddress: "admin@example.com"
      CN: "Radius Certificate Authority"
      password: "secret4radiusCA"
    wlan_eap_ca_crl: "http://radius.example.com/radius-ca.crl"

infrastructure:
  hosts:
    radius_server:
      ansible_host: 10.0.0.15
      ansible_user: ansible
  
laptop_students:
  hosts:
    10.0.13.[1-28]:
  vars:
    wlan: "psk"
    wlan_ssid: "Students" # ssid "WLAN" from group "all" will be overwritten
    wlan_password: "topsecretpasswd"
laptop_teachers:
  hosts:
    10.0.23.[1-82]:
  vars:
    wlan: "eap-tls"
    wlan_enable_on_boot: false
laptop_staff:
  hosts:
    10.0.61.[1-20]:
  vars:
    wlan: "eap-tls"

example: Force issue of new certs

The issue of certificates can be forced.

Force issue of new certs for hosts in group laptop_teacher. If there is a valid certificate, the old one will be revoked and a new certificate will be issued.

ansible-playbook -i myinventory.yml -l laptop_teachers lmn-client.yml -e "wlan_force_issue=true"