Eduroam on NixOS

If you run esoteric Linux distributions like NixOS you know that if places do not provide tutorials that go down to the files - it can be hard to get things working. Unfortunately, this was (is? 2024) the case at my Uni.

[!NOTIFY] Update This is how you can gain access to an Easy-Roam Eduroam (Like it is/was the case for my Uni HSMW). For how to get access to an Eduroam Eduroam read below (last heading)

Here is how I got everything working:

The steps for Wi-Fi (Easyroam)

[!INFO] Info This has been tested on NixOS 23.11 Tapir for the HS-Mittweida University in Germany. If you use this guide and have additional info the might help others, email me at l.webcontact at nx2.site.

1. Get your p12 certificate

Go to cat.eduroam.org/, click on download, sign choose your University, sign in if necessary. You should land on www.easyroam.de/User/Generate, where it only offers a .deb package for Linux. There, click on Manual options below the main window. There, choose PKCS12 give it a name (doesn’t matter what) and download the .12 file.

2. Convert the certificate

You’ll need 3 files. All of them are “in” the .p12 file you got in step 1. You’ll need openssl to extract them. The import password of the .p12 file is empty. Enter Import Password with Return.

1
2

# Client certificate:
openssl pkcs12 -in my_easyroam_cert.p12 -legacy -nokeys -legacy | openssl x509 > easyroam_client_cert.pem

NM and wpa_supplicant generally only accept password-protected private keys, therefore, a password must be set during extraction. With the following command, Enter Import Password appears first, so confirm with <Return>, then Enter PEM pass phrase appears: Enter a new password here and make a note of it.

1
2

# Private key:
openssl pkcs12 -legacy -in my_easyroam_cert.p12 -nodes -nocerts | openssl rsa -aes256 -out easyroam_client_key.pem -legacy

1
2

# Root Certificate:
openssl pkcs12 -in my_easyroam_cert.p12 -legacy -cacerts -nokeys > easyroam_root_ca.pem

3. Place the 3 Files

Put the files somewhere where they can stay (usually in your .dotfiles or .nix-dots directory). Here you should consider the secrets scheme you’ve decided for since these obviously contain secret information. Then link them in your config. Here is how I’ve done it:

1
2
3
4
5

environment.etc = {
  "ssl/certs/easyroam_client_cert.pem".source = ../secrets/easyroam-hsmw/easyroam_client_cert.pem;
  "ssl/certs/easyroam_root_ca.pem".source = ../secrets/easyroam-hsmw/easyroam_root_ca.pem;
  "ssl/certs/easyroam_client_key.pem".source = ../secrets/easyroam-hsmw/easyroam_client_key.pem;
};

4. Get your Common Name (Identity)

You’ll need it in step 5.

1

openssl x509 -noout -subject -in easyroam_client_cert.pem | sed 's/.*CN = \(.*\), C.*/\1/'

5. Make a Connection Setting

If you don’t use Network Manager, 1. Why? You like pain? 2. you’ll have to figure that one out on your own. But if you do, make a nm-configuration:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

# eduroam.nix (redacted)
environment.etc."NetworkManager/system-connections/eduroam.nmconnection" = {
  text = ''
    [connection]
    id=eduroam
    uuid=d030506b-b66b-47b1-abd4-02af413a4aff
    type=wifi
    interface-name=wlp0s20f3

    [wifi]
    mode=infrastructure
    ssid=eduroam

    [wifi-security]
    key-mgmt=wpa-eap

    [802-1x]
    ca-cert=/etc/ssl/certs/easyroam_root_ca.pem
    client-cert=/etc/ssl/certs/easyroam_client_cert.pem
    eap=tls;
    identity=the output from step 4.
    private-key=/etc/ssl/certs/easyroam_client_key.pem
    private-key-password=the pw you entered in step 2.

    [ipv4]
    method=auto

    [ipv6]
    addr-gen-mode=default
    method=auto

    [proxy]
  '';
  mode = "0600";
}

6. Rebuild

Rebuild switch and try it.

Steps for VPN

1. Get packages

The VPN Connection works/ed via Strongswan at my Uni - so install it. So that the you’ll be able to use the binary ipsec.

1
2
3

environment.systemPackages = with pkgs; [
  strongswan
];

2. Extract the USERTrust Certificates

In NixOS the USERTrust Certificates do not exist as “solo”-file, but are bundled in /etc/ssl/certs/ca-certificates.crt. For me, they started at line 8254. Just copy and paste the contents so that you have 2 files: USERTrust-ECC-Certification-Authority.pem and USERTrust-RSA-Certification-Authority.pem. Then put them in your .dotfiles somewhere so you can link them in step 3. later.

3. Link files

You’ll need the files for 2. and your username and password. At my uni it’s just the email and the password we use everywhere (verrrry secure!!1). There are multiple ways to “put in” those details - I went the secrets file route because it was easiest in my head, but this method has the disadvantage that a clear-text file will exist in your file system that contains your password. Since I didn’t care, this is what I did:

1
2
3
4
5

environment.etc = {
  "ipsec.d/hsmw.secrets".text = ''${secrets.email.hsmw.mail} : EAP "${secrets.email.hsmw.password}"'';
  "ipsec.d/USERTrust-ECC.pem".source = ../secrets/vpn-hsmw/USERTrust-ECC-Certification-Authority.pem;
  "ipsec.d/USERTrust-RSA.pem".source = ../secrets/vpn-hsmw/USERTrust-RSA-Certification-Authority.pem;
}

Edit: Now I am using sops-nix for secrets.

Then configure the service for details on what to put into certain fields you’ll have to ask your Administrator or look up if there is a wiki that explains what settings for the connection and what plugins Strongswan needs.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

services.strongswan = {
  enable = true;
  setup = {
    cachecrls = "yes";
    strictcrlpolicy = "yes";
  };
  connections = {
    hsmw = {
        keyexchange = "ikev2";
        # ...
    };
  };
  managePlugins = true;
  enabledPlugins = [ 
    "curl"
    # ...
    "resolve"
  ];
  secrets = [ "/etc/ipsec.d/hsmw.secrets" ];
  ca = {
    hsmw = {
      auto = "add";
      cacert = "/etc/ipsec.d/USERTrust-RSA.pem";
    };
  };
};

[!EXAMPLE] Info The full file of my actual config can be found here: git.nx2.site/dotfiles/…

I do not guarantee that this file will always be publically available, since I am no longer at the HSMW.

4. Try it out

Be connected to the Internet, but not the Eduroam Wi-Fi, and the run sudo ipsec up hsmw (or whatever the connections key name is you entered in your config) and try to access something in the “intranet”. You can close the connection with sudo ipsec down hsmw.

[!MEMO] Trouble shooting If you experience issues with some connections e.g. local ones, maybe change the rightsubnet range (the number after the slash) to be bigger/smaller, so that the ip range matches what your uni uses.

Steps for the Wi-Fi (Eduroam)

[!INFO] Info This was tested at the TU-Darmstadt in 2024

It works via crating a eduroam.nmconnection file in the relevant etc directory. You also need a root cert. Look for information what cert you need at your uni or ask them. I needed the T-TeleSec_GlobalRoot_Class_2:1.crt which can be found in the package pkgs.cacert.unbundled (Thanks @Keksgesicht).

Here is the relevant config: git.nx2.site/nx2/dotfiles/system-modules/networking.nix

There are several typos, but I just can’t be bothered. If you need help you may contact me.