From 80faaef434aafa04b2bab2096bf189452bbe4a89 Mon Sep 17 00:00:00 2001 From: Warren Block Date: Sun, 4 Dec 2011 20:54:59 +0000 Subject: [PATCH] Sand off some rough edges in the wireless section of advanced-networking. Approved by: gjb (mentor) --- .../handbook/advanced-networking/chapter.sgml | 119 +++++++++--------- 1 file changed, 61 insertions(+), 58 deletions(-) diff --git a/en_US.ISO8859-1/books/handbook/advanced-networking/chapter.sgml b/en_US.ISO8859-1/books/handbook/advanced-networking/chapter.sgml index 9de0f216a5..cefee1e01d 100644 --- a/en_US.ISO8859-1/books/handbook/advanced-networking/chapter.sgml +++ b/en_US.ISO8859-1/books/handbook/advanced-networking/chapter.sgml @@ -1168,7 +1168,7 @@ ifconfig_wlan0="authmode shared wepmode on weptxkey 1 authentication parameters, you will have to get an IP address to communicate. Most of time you will obtain your wireless IP address via DHCP. To achieve that, - simply edit /etc/rc.conf and add + edit /etc/rc.conf and add DHCP to the configuration for your device as shown in various examples above: @@ -1229,7 +1229,7 @@ ifconfig_wlan0="inet 192.168.1.100 netmask 192.168.1.100 netmask WPA-PSK - WPA-PSK also known as WPA-Personal is based on a + WPA-PSK, also known as WPA-Personal, is based on a pre-shared key (PSK) generated from a given password and that will be used as the master key in the wireless network. This means every wireless user will share the @@ -1293,7 +1293,7 @@ ifconfig_wlan0="inet 192.168.1.100 netmask wlans_ath0="wlan0" ifconfig_wlan0="WPA DHCP" - Then, we can bring up the interface: + Then we can bring up the interface: &prompt.root; /etc/rc.d/netif start Starting wpa_supplicant. @@ -1346,16 +1346,16 @@ wlan0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500 wme burst roaming MANUAL - If the /etc/rc.conf is set up - with the line ifconfig_wlan0="DHCP" - then it is no need to run the - dhclient command manually, - dhclient will be launched after - wpa_supplicant plumbs the - keys. + If /etc/rc.conf has an + ifconfig_wlan0 entry with the + DHCP string (like + ifconfig_wlan0="DHCP"), + dhclient will be launched + automatically after wpa_supplicant + associates with the access point. - In the case where the use of DHCP is not possible, + If DHCP is not possible or desired, you can set a static IP address after wpa_supplicant has authenticated the station: @@ -1374,7 +1374,7 @@ wlan0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500 wme burst roaming MANUAL When DHCP is not used, you also have to manually set - up the default gateway and the nameserver: + the default gateway and the nameserver: &prompt.root; route add default your_default_router &prompt.root; echo "nameserver your_DNS_server" >> /etc/resolv.conf @@ -1384,17 +1384,17 @@ wlan0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500 WPA with EAP-TLS The second way to use WPA is with an 802.1X backend - authentication server, in this case WPA is called - WPA-Enterprise to make difference with the less secure - WPA-Personal with its pre-shared key. The - authentication in WPA-Enterprise is based on EAP - (Extensible Authentication Protocol). + authentication server. In this case WPA is called + WPA-Enterprise to differentiate it from the less secure + WPA-Personal with its pre-shared key. + Authentication in WPA-Enterprise is based on the + Extensible Authentication Protocol (EAP). - EAP does not come with an encryption method, it was - decided to embed EAP inside an encrypted tunnel. Many - types of EAP authentication methods have been designed, - the most common methods are EAP-TLS, EAP-TTLS and - EAP-PEAP. + EAP does not come with an encryption method. + Instead, it was decided to embed EAP inside an encrypted + tunnel. There are many EAP authentication methods, but + EAP-TLS, EAP-TTLS, and EAP-PEAP are the most + common. EAP-TLS (EAP with Transport Layer Security) is a very well-supported authentication protocol in the @@ -1559,7 +1559,7 @@ wlan0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500 The ca_cert field indicates the pathname of the CA certificate file. This file - is needed to verify the server certificat. + is needed to verify the server certificate. @@ -1601,23 +1601,26 @@ wlan0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500 WPA with EAP-PEAP + + PEAPv0/EAP-MSCHAPv2 is the most common PEAP method. + In the rest of this document, we will use the PEAP term + to refer to that method. + + PEAP (Protected EAP) has been designed as an - alternative to EAP-TTLS. There are two types of PEAP - methods, the most common one is PEAPv0/EAP-MSCHAPv2. In - the rest of this document, we will use the PEAP term to - refer to that EAP method. PEAP is the most used EAP - standard after EAP-TLS, in other words if you have a - network with mixed OSes, PEAP should be the most - supported standard after EAP-TLS. + alternative to EAP-TTLS, and is the most used EAP + standard after EAP-TLS. In other words, if you have a + network with mixed OSes, PEAP should be the + most supported standard after EAP-TLS. PEAP is similar to EAP-TTLS: it uses a server-side certificate to authenticate clients by creating an encrypted TLS tunnel between the client and the authentication server, which protects the ensuing - exchange of authentication information. In term of - security the difference between EAP-TTLS and PEAP is - that PEAP authentication broadcasts the username in - clear, only the password is sent in the encrypted TLS + exchange of authentication information. In terms of + security, the difference between EAP-TTLS and PEAP is + that PEAP authentication broadcasts the username in the + clear, with only the password sent in the encrypted TLS tunnel. EAP-TTLS will use the TLS tunnel for both username and password. @@ -1662,10 +1665,10 @@ wlan0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500 This field contains the parameters for the - first phase of the authentication (the TLS + first phase of authentication (the TLS tunnel). According to the authentication server used, you will have to specify a specific label - for the authentication. Most of time, the label + for authentication. Most of the time, the label will be client EAP encryption which is set by using peaplabel=0. More information can be found in the @@ -1686,7 +1689,7 @@ wlan0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500 wlans_ath0="wlan0" ifconfig_wlan0="WPA DHCP" - Then, we can bring up the interface: + Then we can bring up the interface: &prompt.root; /etc/rc.d/netif start Starting wpa_supplicant. @@ -1713,7 +1716,7 @@ wlan0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500 WEP (Wired Equivalent Privacy) is part of the original 802.11 standard. There is no authentication mechanism, - only a weak form of access control, and it is easily to be + only a weak form of access control, and it is easily cracked. WEP can be set up with @@ -1728,18 +1731,18 @@ wlan0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500 The weptxkey means which WEP key will be used in the transmission. Here we used the third key. This must match the setting in the access - point. If you do not have any idea of what is the key - used by the access point, you should try to use + point. If you do not have any idea of which key is + used by the access point, try 1 (i.e., the first key) for this value. - The wepkey means setting the - selected WEP key. It should in the format - index:key, if the index is - not given, key 1 is set. That is - to say we need to set the index if we use keys other + The wepkey selects one of the + WEP keys. It should be in the format + index:key. Key + 1 is used by default; the index + only needs to be set if we use a key other than the first key. @@ -1750,7 +1753,7 @@ wlan0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500 - You are encouraged to read &man.ifconfig.8; manual + You are encouraged to read the &man.ifconfig.8; manual page for further information. The wpa_supplicant facility also @@ -1781,7 +1784,7 @@ Associated with 00:13:46:49:41:76 IBSS mode, also called ad-hoc mode, is designed for point to point connections. For example, to establish an ad-hoc network between the machine A and the machine - B we will just need to choose two IP addresses + B, we will just need to choose two IP addresses and a SSID. On the box A: @@ -1826,7 +1829,7 @@ Associated with 00:13:46:49:41:76 protmode CTS wme burst Both A and B are now - ready to exchange informations. + ready to exchange information. @@ -1843,19 +1846,19 @@ Associated with 00:13:46:49:41:76 Before configuring your &os; machine as an AP, the kernel must be configured with the appropriate wireless networking support for your wireless card. You also have to - add the support for the security protocols you intend to + add support for the security protocols you intend to use. For more details, see . The use of the NDIS driver wrapper and the &windows; - drivers do not allow currently the AP operation. Only + drivers do not currently allow AP operation. Only native &os; wireless drivers support AP mode. - Once the wireless networking support is loaded, you can + Once wireless networking support is loaded, you can check if your wireless device supports the host-based access - point mode (also know as hostap mode): + point mode (also known as hostap mode): &prompt.root; ifconfig wlan0 create wlandev ath0 &prompt.root; ifconfig wlan0 list caps @@ -1865,8 +1868,8 @@ cryptocaps=1f<WEP,TKIP,AES,AES_CCM,TKIPMIC> This output displays the card capabilities; the HOSTAP word confirms this wireless card can act as an Access Point. Various supported ciphers are - also mentioned: WEP, TKIP, AES, etc., these informations - are important to know what security protocols could be set + also mentioned: WEP, TKIP, AES, etc. This information + is important to know what security protocols can be used on the Access Point. The wireless device can only be put into hostap mode @@ -1881,7 +1884,7 @@ cryptocaps=1f<WEP,TKIP,AES,AES_CCM,TKIPMIC> &prompt.root; ifconfig wlan0 create wlandev ath0 wlanmode hostap &prompt.root; ifconfig wlan0 inet 192.168.0.1 netmask 255.255.255.0 ssid freebsdap mode 11g channel 1 - Use again ifconfig to see the status + Use ifconfig again to see the status of the wlan0 interface: &prompt.root; ifconfig wlan0 @@ -2154,7 +2157,7 @@ freebsdap 00:11:95:c3:0d:ac 1 54M 22:1 100 EPS On &os;, it is possible to combine two or even more network interfaces together in a failover fashion, that is, to use the most preferred and available connection from a - group of network interfaces, and have the operating system to + group of network interfaces, and have the operating system switch automatically when the link state changes. We will cover link aggregation and failover in