lmn-client/doc/wlan.md

WLAN support

Supported modes authenticating via WLAN:

• WPA-Personal (WPA-PSK)
  authentication via preshared key (psk)
• WPA-Enterprise (WPA-802.1x) with EAP-TLS
  authentication via client certificates (eap-tls)

Which method is used is determined by the variable wlan

Choices:

• "none" <- (default)
• "psk"
• "eap-tls"

WPA-Personal

Requirements

WLAN with configured WPA-Personal (WPA-PSK)

Configuration / Variables

• wlan
  Authentication mode
  Type: String
  Values:
  • "none" <-- (default)
  • "psk" <-- set to use WPA-Personal
  • "eap-tls"
• wlan_ssid
  SSID of used WLAN
  Type: String
• wlan_password
  Password of WLAN. Only for wlan: "psk"
  Type: String

Examples

One class of devices with wlan access

inventory.yml

laptop:
  hosts:
    10.0.13.[1-28]:
  vars:
    wlan: "psk"
    wlan_ssid: "devicesPSK"
    wlan_password: "topsecretpasswd"

Two device classes with different wlan access

inventory.yml

laptop_students:
  hosts:
    10.0.13.[1-28]:
  vars:
    wlan: "psk"
    wlan_ssid: "Students"
    wlan_password: "topsecretpasswd1"
laptop_teachers:
  hosts:
    10.0.23.[1-82]:
  vars:
    wlan: "psk"
    wlan_ssid: "Teachers"
    wlan_password: "topsecretpasswd2"

WPA-Enterprise with EAP-TLS

Authentication is based on individual certificates, which will be automaticaly created on the radius server.
Every devices gets his own certificate. When creating new certificates, the old one will be revoked.

Requirements

• You need to run a freeradius server. For installation see https://codeberg....
• The user, running this playbook, must have access to the radius-Server via ssh.

Configuration / Variables

• wlan
  Authentication mode
  Type: String
  Values:
  • "none" <-- (default)
  • "psk"
  • "eap-tls" <-- set to use WPA Enterprise with EAP-TLS
• wlan_ssid
  SSID of used WLAN
  Type: String
• wlan_eap_ca
  CA data for certs and crl
  Type: Dictionary of Strings
  Keys:
  • C <-- default: "DE"
  • ST <-- default: "Baden-Wuerttemberg"
  • L <-- default: "Reutlingen"
  • O <-- default: "Linuxschule"
  • emailAddress <-- default: "admin@example.com"
  • CN <-- default: "Radius Certificate Authority"
  • password <-- default: "OtherVerySecurePassw0rd"
• wlan_force_issue
  Force to issue a new certificate
  Only for wlan: "eap-tls"
  Type: Bolean
  Values:
  • true
  • false <-- (default)

Examples

inventory.yml:

infrastructure:
  hosts:
    radius_server:
      ansible_host: 10.0.0.15
      ansible_user: ansible
laptop:
  vars:
    wlan: "eap-tls"
    wlan_ssid: "devices8021x"
    wlan_eap_ca:
      C: "DE"
      ST: "Baden-Wuerttemberg"
      L: "Reutlingen"
      O: "Linuxschule"
      emailAddress: "admin@example.com"
      CN: "Radius Certificate Authority"
      password: "secret4radiusCA"

complex example with both modes

We have three groups of devices (one with psk, two with eap-tls):

inventory.yml

all:
  vars:
    wlan_ssid: "WLAName" # teacher and staff are using the same ssid
    radiusca_password: "secret4radiusCA"
    country_name: "DE"
    state_or_province_name: "Baden-Württemberg"
    locality_name: "Stuttgart"
    organization_name: "Baumschule"
    admin_email: "admin@example.com"

infrastructure:
  hosts:
    radius_server:
      ansible_host: 10.0.0.15
      ansible_user: ansible
  
laptop_students:
  hosts:
    10.0.13.[1-28]:
  vars:
    wlan: "psk"
    wlan_ssid: "Students" # ssid "WLAN" from group "all" will be overwritten
    wlan_password: "topsecretpasswd"
laptop_teachers:
  hosts:
    10.0.23.[1-82]:
  vars:
    wlan: "eap-tls"
laptop_staff:
  hosts:
    10.0.61.[1-20]:
  vars:
    wlan: "eap-tls"

example: Force issue of new certs

The issue of certificates can be forced.

Force issue of new certs for hosts in group laptop_teacher. If there is a valid certificate, the old one will be revoked and a new certificate will be issued.

ansible-playbook -i myinventory.yml -l laptop_teachers lmn-client.yml -e "wlan_force_issue=true"