Difference between revisions of "Static:Network"

From Camp_2015_Wiki
Jump to: navigation, search
(Created page with "There will be a network! Available in both wired and wireless flavours Be sure to read the Survival Guide before connecting your devices. <!--; c3ne...")
 
(Wireless)
Line 24: Line 24:
 
The following SSIDs are provided:
 
The following SSIDs are provided:
  
* '''{{XC3}}''' (WPA2 802.1X (see below), 5GHz)  
+
* '''{{XC3}}2015''' (WPA2 802.1X (see below), 5GHz)  
* '''{{XC3}}-legacy''' (WPA2 802.1X (see below), 2.4GHz)
+
* '''{{XC3}}2015-legacy''' (WPA2 802.1X (see below), 2.4GHz)
* '''{{XC3}}-open''' (open, 5GHz)
+
* '''{{XC3}}2015-open''' (open, 5GHz)
* '''{{XC3}}-open-legacy''' (open, 2.4GHz)
+
* '''{{XC3}}2015-open-legacy''' (open, 2.4GHz)
 
* '''spacenet''' (federated hacker authentication system, WPA2 802.1X, 2.4GHz+5GHz)
 
* '''spacenet''' (federated hacker authentication system, WPA2 802.1X, 2.4GHz+5GHz)
* '''hamburg.freifunk.net''' (extension of the Hamburg Freifunk network, open, 2.4GHz+5GHz)
+
<!--* '''berlin.freifunk.net''' (extension of the Berlin Freifunk network, open, 2.4GHz+5GHz) UNSURE IF WILL HAPPEN !-->
  
 
=== WPA2 802.1X, encryption ===
 
=== WPA2 802.1X, encryption ===
Line 36: Line 36:
 
You might think: "WTF!? Do I need to register a user and password blah, blah". Fortunately not. You can '''use any username/password combination using EAP-TTLS with PAP to login''' (example: "user: fbhfbhiaf pass: bgufwbnkqo" is valid), because we don't care who logs in and who you are. We just want to encrypt your data.
 
You might think: "WTF!? Do I need to register a user and password blah, blah". Fortunately not. You can '''use any username/password combination using EAP-TTLS with PAP to login''' (example: "user: fbhfbhiaf pass: bgufwbnkqo" is valid), because we don't care who logs in and who you are. We just want to encrypt your data.
  
Users which use MSCHAPv2 (like Windows users with default 802.1X supplicant) should use a fixed username and password. You can use "{{XC3}}/{{XC3}}" or "guest/guest" as "username/password".
+
Users which use MSCHAPv2 (like Windows users with default 802.1X supplicant) should use a fixed username and password. You can use "camp2015/camp2015" or "guest/guest" as "username/password".
  
 
==== Client Settings ====
 
==== Client Settings ====
  SSID: {{XC3}} or {{XC3}}-legacy
+
  SSID: {{XC3}}2015 or {{XC3}}2015-legacy
 
  Phase 1: EAP-TTLS or PEAP
 
  Phase 1: EAP-TTLS or PEAP
 
  Phase 2: MSCHAPv2 or EAP-MSCHAPv2 or PAP
 
  Phase 2: MSCHAPv2 or EAP-MSCHAPv2 or PAP
Line 53: Line 53:
 
You need an additional crypto setting for WiCD. Put this file into '''/etc/wicd/encryption/templates/eap-ttls''' (debian systems, might be different with other *nix flavours):
 
You need an additional crypto setting for WiCD. Put this file into '''/etc/wicd/encryption/templates/eap-ttls''' (debian systems, might be different with other *nix flavours):
  
   name = EAP-TTLS {{XC3}}
+
   name = EAP-TTLS {{XC3}}2015
 
   author = Felicitus
 
   author = Felicitus
 
   require identity *Identity password *password
 
   require identity *Identity password *password
Line 77: Line 77:
  
 
===== Jolla/connman =====
 
===== Jolla/connman =====
/var/lib/connman/{{XC3}}wifi.config :
+
/var/lib/connman/{{XC3}}2015wifi.config :
  
   [service_{{XC3}}]
+
   [service_{{XC3}}2015]
 
   Type=wifi
 
   Type=wifi
   Name={{XC3}}-legacy
+
   Name={{XC3}}2015-legacy
 
   EAP=peap
 
   EAP=peap
 
   Phase2=MSCHAPV2
 
   Phase2=MSCHAPV2
Line 91: Line 91:
  
 
   network={
 
   network={
   ssid="{{XC3}}"
+
   ssid="{{XC3}}2015"
 
   key_mgmt=WPA-EAP
 
   key_mgmt=WPA-EAP
 
   eap=TTLS
 
   eap=TTLS
Line 106: Line 106:
  
 
   iface wlan0 inet dhcp
 
   iface wlan0 inet dhcp
   wpa-ssid {{XC3}}
+
   wpa-ssid {{XC3}}2015
 
   wpa-identity edward
 
   wpa-identity edward
 
   wpa-password snowden
 
   wpa-password snowden
Line 117: Line 117:
  
 
===== netctl =====
 
===== netctl =====
  Description='{{XC3}} secure WPA2 802.1X config'
+
  Description='{{XC3}}2015 secure WPA2 802.1X config'
 
  Interface=wls1
 
  Interface=wls1
 
  Connection=wireless
 
  Connection=wireless
 
  Security=wpa-configsection
 
  Security=wpa-configsection
 
  IP=dhcp
 
  IP=dhcp
  ESSID={{XC3}}
+
  ESSID={{XC3}}2015
 
  WPAConfigSection=(
 
  WPAConfigSection=(
     'ssid="{{XC3}}"'
+
     'ssid="{{XC3}}2015"'
 
     'proto=RSN WPA'
 
     'proto=RSN WPA'
 
     'key_mgmt=WPA-EAP'
 
     'key_mgmt=WPA-EAP'
Line 139: Line 139:
  
 
* nat64/nat64 (for the nat64 VLAN)
 
* nat64/nat64 (for the nat64 VLAN)
* multicast/multicast (for the multicast over WiFi experimental VLAN)
+
* fixip/fixip (fixed IP - to be confirmed)
* {{XC3}}/{{XC3}} or 31c3/31c3 or guest/guest (for regular user VLAN - for devices that have correctly implemented MSCHAPv2, like Windows)
+
* camp/camp or camp2015/camp2015 or guest/guest (for regular user VLAN - for devices that have correctly implemented MSCHAPv2, like Windows)
  
 
Please note the username AND password are case-sensitive.
 
Please note the username AND password are case-sensitive.
Line 152: Line 152:
 
To keep the wireless working for you, keep a few things in mind:
 
To keep the wireless working for you, keep a few things in mind:
  
* We're aware you can break the WiFi infrastructure. We're hoping that you won't and don't want to be chased by 5000 hackers through Hamburg.
+
* We're aware you can break the WiFi infrastructure. We're hoping that you won't and don't want to be chased by 5000 hackers.
* If you want to download terabytes of data, you might be better off connecting to the wired network
+
* If you want to download terabytes of data, you might be better off connecting to the wired network.
* Don't set up any of your own access points. Wireless experimentation is only allowed in the hackcenter, 2.4GHz at channel 1 (2412MHz, 20MHz channel) and 5GHz at channel 36 (5180MHz, 20MHz channel). When we find you, the AP is ours!
+
* Don't set up any of your own access points.
  
 
== Helpdesk ==
 
== Helpdesk ==

Revision as of 10:32, 1 July 2015

There will be a network! Available in both wired and wireless flavours Be sure to read the Survival Guide before connecting your devices.


Rules of Conduct

  • Be fair! Do not do to others what you do not wish done to yourself!
  • Protect your computer! We cannot be held responsible for any damage your computer may face due to attachment to our network. Be reminded that both internet access and the local network are unfirewalled and unfiltered. Even well-maintained systems can be attacked and get hacked, even more so at a hacker event.
  • Do not run your own DHCP server! Doing so is harmful.
  • Do not send IPv6 Router Advertisements.
  • Do not ARP spoof or otherwise impede the operation of the network!
  • While we are generally quite able to find and disconnect you in case of network misuse if necessary, we still prefer to not have to do so and that everybody respects the other visitors.
  • Think twice before you do something that affects others! If you hack someone, you might be prosecuted. Be aware that we cannot prevent law enforcement from acting within or related to our network.

Wireless

You can't live without wireless access, so we've built an awesome wireless network again. The setup is improved from last year:

CCC SSIDs

The following SSIDs are provided:

  • Camp2015 (WPA2 802.1X (see below), 5GHz)
  • Camp2015-legacy (WPA2 802.1X (see below), 2.4GHz)
  • Camp2015-open (open, 5GHz)
  • Camp2015-open-legacy (open, 2.4GHz)
  • spacenet (federated hacker authentication system, WPA2 802.1X, 2.4GHz+5GHz)

WPA2 802.1X, encryption

Due to popular demand (and with security in mind) we provide WPA2 802.1X. This will encrypt your traffic, preventing attackers from sniffing your data. Keep in mind that this won't protect you from other network attacks and you should still be aware that you are at a hacker conference! Your link layer should be secure if you do certificate checking (see below).

You might think: "WTF!? Do I need to register a user and password blah, blah". Fortunately not. You can use any username/password combination using EAP-TTLS with PAP to login (example: "user: fbhfbhiaf pass: bgufwbnkqo" is valid), because we don't care who logs in and who you are. We just want to encrypt your data.

Users which use MSCHAPv2 (like Windows users with default 802.1X supplicant) should use a fixed username and password. You can use "camp2015/camp2015" or "guest/guest" as "username/password".

Client Settings

SSID: Camp2015 or Camp2015-legacy
Phase 1: EAP-TTLS or PEAP
Phase 2: MSCHAPv2 or EAP-MSCHAPv2 or PAP

CN = radius.c3noc.net
CA = StartCom Certification Authority
Fingerprint = A9:15:4F:80:83:D9:C6:B4:AC:8A:3F:06:9A:D9:4E:9E:5F:D1:DF:0C

Make sure you check the certificate in order to know you are connecting to the correct network (you should check on both the CN and the CA). Check here for the complete certificate.

WICD

You need an additional crypto setting for WiCD. Put this file into /etc/wicd/encryption/templates/eap-ttls (debian systems, might be different with other *nix flavours):

 name = EAP-TTLS Camp2015
 author = Felicitus
 require identity *Identity password *password
 -----
 ctrl_interface=/var/run/wpa_supplicant
 network={
  ssid="$_ESSID"
  scan_ssid="$_SCAN"
  identity="$_IDENTITY"
  password="$_PASSWORD"
  proto=WPA2
  key_mgmt=WPA-EAP
  group=CCMP
  pairwise=CCMP
  eap=TTLS
  ca_cert="/etc/ssl/certs/StartCom_Certification_Authority.pem"
  anonymous_identity="$_ANONYMOUS_IDENTITY"
  phase2="auth=PAP"
  #priority=2
 }

Edit /etc/wicd/encryption/templates/active to include the eap-ttls config template. Restart the WiCD daemon, choose the proper encryption (EAP-TTLS Camp) and enter a random username/password.

Jolla/connman

/var/lib/connman/Camp2015wifi.config :

 [service_Camp2015]
 Type=wifi
 Name=Camp2015-legacy
 EAP=peap
 Phase2=MSCHAPV2
 Identity=$_IDENTITY
 Passphrase=$_PASSWORD
wpa_supplicant.conf

/etc/wpa_supplicant/wpa_supplicant.conf :

 network={
 	ssid="Camp2015"
 	key_mgmt=WPA-EAP
 	eap=TTLS
 	identity="fpletz"
 	password="fpletz"
 	# ca path on debian 7.x, modify accordingly
 	ca_cert="/etc/ssl/certs/StartCom_Certification_Authority.pem"
 	subject_match="CN=radius.c3noc.net"
 	phase2="auth=PAP"
 }
interfaces

As an alternative, you can specify the wpa_supplicant config options directly in /etc/network/interfaces:

 iface wlan0 inet dhcp
 	wpa-ssid Camp2015
 	wpa-identity edward
 	wpa-password snowden
 	wpa-proto WPA2
 	wpa-key_mgmt WPA-EAP
 	wpa-group CCMP
 	wpa-pairwise CCMP
 	wpa-eap TTLS
 	wpa-phase2 "auth=PAP"
netctl
Description='Camp2015 secure WPA2 802.1X config'
Interface=wls1
Connection=wireless
Security=wpa-configsection
IP=dhcp
ESSID=Camp2015
WPAConfigSection=(
    'ssid="Camp2015"'
    'proto=RSN WPA'
    'key_mgmt=WPA-EAP'
    'eap=TTLS'
    'identity="edward"'
    'password="snowden"'
    'ca_cert="/etc/ssl/certs/StartCom_Certification_Authority.pem"'
    'subject_match="CN=radius.c3noc.net"'
    'phase2="auth=PAP"'
)

Services

Last year we had separate SSID's for additional services like Fixed-IP. This year we're using WPA2 802.1X to push your client in the correct VLAN. The reason we are doing this is to keep the number of SSID's per wireless band to a minimum; this way we are saving airtime by not wasting it too much with 802.11 beacons/mgmt-frames. Use the following user/password combinations:

  • nat64/nat64 (for the nat64 VLAN)
  • fixip/fixip (fixed IP - to be confirmed)
  • camp/camp or camp2015/camp2015 or guest/guest (for regular user VLAN - for devices that have correctly implemented MSCHAPv2, like Windows)

Please note the username AND password are case-sensitive.

2.4GHz & 5GHz

The 2.4GHz spectrum is very limited. Previously we've tried to use the vendor implemented workarounds like band-steering and band-select to persuade clients to use 5GHz. This might work in a controlled enterprise environment, but it doesn't work with 5000 hackers with 50 different operating systems.

The default SSIDs are 5GHz only. The "legacy" SSIDs are 2.4GHz only. If your client supports both, don't use the *-legacy SSIDs. If you only see the legacy SSIDs, consider upgrading your device. We cannot guarantee that 2.4GHz works.

Rules

To keep the wireless working for you, keep a few things in mind:

  • We're aware you can break the WiFi infrastructure. We're hoping that you won't and don't want to be chased by 5000 hackers.
  • If you want to download terabytes of data, you might be better off connecting to the wired network.
  • Don't set up any of your own access points.

Helpdesk

If you have questions about the network or need help connecting or want to drop off a server for collocation during the event, drop by the friendly people of the Static:NOC Helpdesk, located near the Static:Infodesk in the Main Foyer.

NAT64/DNS64

Please see the Static:NAT64 page for more details.

Supporters

This is a list of companies providing network hardware and connectivity services. The event would not have been possible without their support (and a few unlisted), and we thank them for it.

Who For
200px http://www.a10networks.com/ A10 hardware loan from BMA Networks
Error creating thumbnail: File missing
http://www.arubanetworks.com WiFi Network Equipment
Supporter-babiel.jpg http://www.babiel.com/ Servers
Error creating thumbnail: File missing
http://www.flexoptix.net Optical Networking Equipment
200px http://www.ghipsystems.com/ Optical Networking Equipment
200px http://www.hibernianetworks.com/ IP Uplink
200px http://www.iphh.net/ Colocation / Logistics
200px http://www.juniper.net/ Network Equipment
Error creating thumbnail: File missing
http://www.kaiaglobal.com/ IP Uplink
Error creating thumbnail: File missing
http://www.kpn-international.com IP Uplink
200px https://www.rrbone.net/ IP Uplink
200px http://www.teamix.de/ Network Equipment