OS X 10.7 and 10.8 and 802.1X wifi configuration

So, new operating system new things to do. Just read the Help Center bit on "Connect to a network that requires 802.1X authentication". The interesting bit was:

In most cases your network administrator provides a configuration profile that contains the information and settings you need to authenticate with the network.

To get on the 802.1X you now need to do a lot of stuff. Looks like it needs a .mobileconfig file.

Just read this Apple Discussion on it which gives you a nice guide on how to do it.

After much time we finally got around to having a network administrator on the case.

So, we were looking for a way to connect to the wifi without using usernames and passwords. The answer was EAP-TLS. We followed the link above and created a certificate for the computer. Only trouble was we had problems enabling TLS on the wifi. Network administrator looking into this I think.

We resorted to PEAP I think. We made a .mobileconfig file using the iphone configuration utility, got hold of the wifi certificate, put that in the credentials payload of the .mobileconfig file, and loaded it up on the machine in question. It added the certificate to the Users keychain (not system!) and put the old 802.1X stuff in the network settings! When we turned the wifi on it tried to connect to the wifi (with the username and password we set in the .mobileconfig file) but it came up with an error. Could not verify the server. Looks like the configuration file was at fault. Seems that the certificate server is automatically dishing out expired certificates. Network administrator is trying to fix.

A handy page to manually create a .mobileconfig file with more settings then the iphone configuration utility can create was here. You can specify the certificate to be added to the system keychain, and also that the wifi loads at login window!


------

So far so good. Our network team has now made a new wifi SSID with EAP-TLS. Using this tutorial we made the machine have a signed certificate from the certificate server, and add the profile for the wifi. We used this certificate (with the username - host/DNSnameofMachineHere) to successfully get onto the wifi, but did it manually.

Next time we'll need to set this file up with the wifi details properly (we didn't add system login window stuff here).


-----

We're now giving up on the old 'manually edit the .mobileconfig file' and going for the 'Mavericks Server' option.

Here's the help page on it

So, we've set up a mavericks server (just a computer with Mavericks installed and the "Server" app installed).

I've enabled "Profile Manager" and set it up so in a browser you can go to:
http://YourMavericksServer.ac.uk/profilemanager

go to groups, general.
from the list of payloads, go to AD Certificate

found this article on how to configure the page

Not quite working yet. Getting an error when installing the profile.

Need to add devices, but I think it looks like you have to add users which are in charge of devices? Not sure.

Deploying 802.1X wifi profiles on OS X 10.6.6

I've just been told that the wifi routers and settings have just been updated and all MacBook Pro's need these settings updating too. Specifically for the 802.1X system Profile for logging in Wirelessly. I've put a few posts up about setting that up, and thankfully these new settings are very similar to the old.

ICT Services told me that the new wifi was WPA2 + AES, and had a different name.

What I really wanted to know was whether I could 'deploy' these settings to all the computers I administer. Well, it looks like the answer is 'Yes'.

I found this forum which discussed some command line tools which export and import, and change the settings. The command line tool was "networksetup" and I'm sure I've used it before.

Before starting down this route, I decided to look at the GUI, and I found that you could simply export all your settings as a file, double click this file to load it up on another computer. This, for the time being, was quicker (I realise not in the long run), but as my Short Term time was limited, I had to resort to it. Basically:

1. Set up one computer with profile and make sure it works
2. In Network Preferences, highlight Airport and click the cog at the bottom of the list
3. Select "Export Configurations..."



Airport Export Configurations...

1. 
   
4. I selected all the settings to export, thought there was no harm in this. Just being comprehensive.



Airport Export Configurations dialogue box

1. 
   

Loading this file on another computer worked just fine. Though in the end I just worked out all I had to change was the the previous System profile used the new Network.

I'll come back to the "networksetup' command line utility though, as it is the proper solution, meaning it could be fully automated - the ultimate solution.

802.1X login with OS X 10.6.6 and Active Directory

After re-imaging all the computer suites, there were a few machines without ethernet connections. These I had to set up using 802.1X logins on OS X 10.6.6, something I hadn't tested, although in theory there would be nothing different then the setup with OS X 10.5.8. But I've now just noticed that I have not written this process down, so this will be the first connotation of it:

After a few trials and tribulations I discovered the best (quickest and easiest) way to get the to log in wirelessly on Active Directory accounts using 802.1X.

1. Go to Network Settings in System Preferences
2. Click on Airport, turn it on and connect to ChesterfieldCollege wireless network:
3. 
4. Authenticate using the login details which will be used in the 802.1X authentication (needs to be the full username i.e. username@students.chesterfield.ac.uk. I think I also unticked the "Remember Password" box.
5. Accept the certificates (if you get any) and hopefully you should be connected
6. Click on Advanced and then go to the 802.1X tab
7. We are going to add a System Profile, so that whenever the computer is on, it'll always be authenticated on the wireless with a certain username and password.
8. You need to fill out the FULL username (.......@students.chesterfield.ac.uk) and password, tick TTLS and PEAP (might just apply to this wireless) and select ChesterfieldCollege as the wireless to use. Oh and WPA2 Enterprise.
9. Before we click OK I've found I also need to add the server certificate we just accepted (no.5) to the certificates. So go to Certificates, click add "Select Certificate from Keychain" and select the one you added:
10. 
11. Click OK, OK and when back on the initial Network Settings screen, click "Disconnect" under 802.1X.
12. Now restart the machine and see if it works!

In my experience, the wireless login takes a few more minutes to authenticate, so when restarting a machine you might want to give it a minute before trying to log in.

If it doesn't work, login as your administrator and see if it's connected to the wireless using 802.1X, and if not, delete the System Profile in Advanced and see if you can connect to it normally. Just keep on trying, and perhaps you added the wrong server certificate?



....
After doing this I always found a few machines which would come up with the "Error connecting to 802.1X" blaa blaa blaa. After a bit of trial and error it turns out that if I moved the machines to another part of the room it worked. Thus, the error message only came up when there was a low signal. Simple.

OS X Active Directory login issues - delete parallels

I keep coming across Apple Macs which have been working in Active Directory and yet not letting users log in (or even use kerberos in Firefox). The general symptoms are:

• "Some network accounts available" at login screen (i.e. active directory not working, open directory working)
• not letting active directory users log in
• showing active directory working in "Directory Utility"
• letting you re-bind to active directory with no problems
• trying to use firefox with kerberos authentication comes up with "unable to ......." (can't remember the exact error)

I tried the simple fixes such as reset the PR Ram and fsck -yf. I was going to do a disk permissions fix but thought it'd take too long. I looked in the console and found a few kerberos errors.

I found that there were a few errors with the network settings. I found that because the image was taken from a computer with Airport, it hadn't updated this and thought the ethernet connection was in fact an airport connection. I deleted the "Chesterfield College" location and made it "automatic" but deleted the airport which fixed that. I also noticed two Parallels shared connection network interfaces, which were set up when I was trialing Parallels. On deleting these and logging out, active directory accounts worked. But on reboot the devices were remade. So there was some files somewhere which remade the connections. I thought it be quicker looking for help rather then looking for files, and on a quick search I found some helpful stuff. Before I come to that I did notice that Parallels was actually still installed. So I recommend first you delete Parallels from the Applications folder.

Next would be deleting parallels library files. I found this forum, and down the bottom they mention:

cd /Library/
sudo rm -rf Parallels
cd /Library/Preferences/
sudo rm -rf Parallels
cd /Library/StartupItems/
sudo rm -rf ParallelsTransporter
cd /System/Library/Extensions/
sudo rm -rf prl_hid_hook.kext
sudo rm -rf prl_hypervisor.kext
sudo rm -rf prl_vnic.kext
sudo rm -rf prl_usb_connect.kext
sudo rm -rf prl_netbridge.kext
cd /Users//
sudo rm -rf .parallels/
sudo rm -rf .parallels_settings

I of course did all of this, but I think just deleting the Parallels application should do the job.




.... well, had a little play around and it turns out it's best doing all of it and heres ARD send command thing (under root)



rm -R /Applications/Parallels
rm -R /Applications/Parallels\ Desktop.app
rm -rf /Library/Parallels
rm -rf /Library/Preferences/Parallels
rm -rf /Library/StartupItems/ParallelsTransporter
rm -rf /System/Library/Extensions/prl_hid_hook.kext
rm -rf /System/Library/Extensions/prl_hypervisor.kext
rm -rf /System/Library/Extensions/prl_vnic.kext
rm -rf /System/Library/Extensions/prl_usb_connect.kext
rm -rf /System/Library/Extensions/prl_netbridge.kext
rm -rf /Users//.parallels/
rm -rf /Users//.parallels_settings

It's impossible to delete network devices via command line, but doing the above disconnects them, which is the next best thing.

MacBook Pro 10.5.7 802.1X Login Windows

Well, a little ambitious but I thought I'd try and get the MacBook Pro's logining into the 802.1X wireless network at the login window (by the way they are on AD). Oh, and this would be the second time of trying, but I am trying everything I tried back then, just incase a recent update of OS X or the wireless system has any influence.


Alas, a different problem this time. It appears the wireless is actually broken on the MacBook Pro's after many images and re-images. Just re-running an update to see if that fixes the wireless. When I try and connect to the college wireless it comes up with "802.1X Authentication failed" ...... (error 1 on en 1) doh!. It might be because the image might have come from some other hardware (not a MacBook Pro)......Well, happened again. This solution worked:


Delete the system wide network settings:
Go to Macintosh HD/Library/Preferences

• Drag SystemConfigurations to the trash, empty trash, restart.

found it on an apple discussion forum- http://discussions.apple.com/thread.jspa?threadID=1506347 


Seems to work fine on my iMac though.


Found this interesting page on Apple website:


http://support.apple.com/kb/HT3326


Seem to document it quite well, but I definitely tried all of this.


The most promising thing is the "Login Window" Profile. When that is ticked and ChesterfieldCollege is added to prefered networks, at the login screen it says "Network Login Required" or something similar. When you type in a username and password it thinks about it for a while with a spinny thinky thing to the right of the password box. But then shakes! looked at the logs and I did see the mention of "Certificate" failed to authenticate and something about 'not from a trusted authority' or something like that. This is what pointed me to the certificate problem.


Looking into it, when you first add yourself to the wireless you have to accept a certificate. If you look at the certificate before accepting it, it gives you the option to permanently accept it which is what I ticked. Still no luck.


One of my conclusions from before was that it was to do with the certificate. I found a lot of postings refering to a certificate you must get from your 'Administrator'. This must then be added permanently to the list of certificates in Keychain. So I'm probably best off talking to ICT Services.


Of course right now I have to deal with the MacBook Pro wireless error.... well, looks like I fixed that one by deleting Airport adaptor and re-adding it under the name "Airport 2". So I added to the wireless, went into keychain and made the certificates "Always trusted". Tried to login and got this message.


Definitely a certificate problem.


Well, last thing to try was a "System Login". Created one and worked a charm!!! Might create more wifi activity, but hopefully the system can cope with it. A note to make is that we login and use Networked home drives, so as soon as their is a weak signal, it all goes to pot. Oh well.