This tool automates network-switching for users who connect wirelessly at a workplace employing a rolling-password model for their wireless networks by automatically configuring network profiles according to locally cached passwords. Device-specific bytes of MAC-address are randomised during each connection routine. Furthermore, connecting to any other network profile is supported.
Through scripting CAS-login, downloading currently available passwords, caching them locally, and matching daily password with given date, automatic network-manager profile configuration is achieved for following days specified by service. In the case of Aalborg University; if chwifi has been invoked within the previous three days, the current daily password will be cached and available for automatic configuration, thus ensuring no manual input for consecutive five-day workweeks.
Note that this script has been developed specifically for use at Aalborg University's campuses but should be easily adaptable to other CAS-like authentication systems.
-
Installing chwifi through a package manager is advisable, currently
chwifiis packaged for AUR and can be easily installed by an AUR-helperyay -S chwifi-git
-
Manual installation is possible, but requires some work. Note that updates needs to be applied manually when installing manually.
# Clone the repository and cd into it git clone https://github.com/cogitantium/chwifi.git cd chwifi # Make directory structure mkdir -p /usr/lib/chwifi mkdir -p /usr/bin # Install script to /usr/lib/chwifi install chwifi passwordhandler.sh cashandler.sh setup.sh config.sample -t /usr/lib/chwifi # Symlink script from /usr/lib to /usr/bin ln -s /usr/lib/chwifi/chwifi /usr/bin/chwifi
-
Upon first run a configuration will be generated. A setup script prompts for username and password for CAS and puts the generated config at
$XDG_CONFIG_HOME/.config/chwifi/config.
A help message is displayed when passing no arguments, -h, or --help.
user@hostname ~> chwifi
Usage: chwifi [OPTION]... <PROFILE>
Connect to any netctl wireless networks, caching rolling passwords at work
Optional arguments:
-s, show [index|today|tomorrow] display the daily password of the given index or day
-r, restart [profile] restarts the given profile
-h, --help display this help and exit
chwifi is released under GPL-3.0 and comes with ABSOLUTELY NO WARRANTY, for details read LICENSE
Configuration of this script is done through the 'config' file, for documentation read README.md
To connect to a given profile under netctl, pass its' name as an argument.
chwifi home
chwifi work
chwifi profile-nameTo show a specific password pass '-s' or 'show' followed by an index, e.g., where 1 is tomorrow's password. Using the keywords 'today' and 'tomorrow' is also supported.
chwifi -s 3
chwifi show todayTo restart a given profile, pass either -r or restart followed by the profile-name.
chwifi -r home
chwifi restart workAll configuration is located in the config file which is installed into the home config upon first run, after prompting the user for username and password. Note that most can be left to defaults but if changes are necessary, the config can be found at $XDG_CONFIG_HOME/.config/chwifi/config.
# Credentials for CAS-authentication system.
username="username"
password="password"Rolling password syntax, set with a regex.
password_syntax="[a-z]+[0-9]+[a-z]+"System specific settings for network manager and wireless adapter follows. Adjust according to system configuration. Default is wlp3s0 for network adapter and netctl as network manager and assumes
86F1
profiles named 'home' and 'work'.
wireless_adapter="adapter"
network_manager="netctl"
network_manager_location="/etc/netctl/"
network_manager_connect="start"
network_manager_disconnect="stop"
network_manager_stopall="stop-all"
network_manager_restart="restart"
network_manager_home_profile="home"
network_manager_work_profile="work"
network_manager_other_profiles="a-profile,another-profile,last-profile"Options for macchanger, default is enabled which is set during setup and is either y or n, -e is the default option, which randomises only device-specific bytes and retains vendor-information.
macchanger_enabled="$MAC_ENABLED"
macchanger_options="-e"Settings for passwordhandler.sh, edit if other CAS-destination or temp-filenames are desired.
dest="https://wifipassword.aau.dk/oneday"
password_html_file="passwords.html"
password_file="$XDG_HOME_CONFIG/passwords"Host to ping for network connection test. Sensible to set to organisations homepage, since if network is restricted to organisation's local network and password-portal is still available, update of local cache is still possible during outage of public network access.
network_up_host="aau.dk"If required for specific use-case, a config-option is available to disable internal sudo-prefix to priviledged commands. This is not advised.
Set internal sudo for priviledged commands. Defaults to true. Set sudo for true, and null for false, e.g.; sudo="".
sudo="sudo"Example shows chwifi call, with work keyword, printing cached password if foun, and username used for updating cached passwords.
user@hostname ~> chwifi work
Updating recognised netctl profiles...
Connecting to work, checking for cached password
Daily work password is: amount42wind
Stopping all profiles
New MAC-address: 00:1a:e9:cb:55:ef
Connecting to profile: work
Waiting for network connection...
Connection took: 5.293s
Network connection established, updating cached passwords
Sourced credentials with username: username
Successfully updated cached passwords
Following lists dependencies with most recently tested version of commands appended to name:
bashGNU bash, version 5.0.0(1)-releaserequired to run scriptsudov1.8.27required to execute priviledged commandsnetctlv1.20or other network manager that takes arguments of the formnetwork_manageroperationprofileipLinux v4.20.13-arch1-1-ARCHrequired for resetting adapter between operationsdatev8.30required for matching valid date of password with given date, and measuring connection timesperlrev5 v28 subv1required for regex search and replacecurlv7.64.0required for accessing CAS-secured password-list and testing for network connectionlibxml2v2.9.9-2suppliesxmllintwhich is required for parsing resulting password-page htmlmacchanger1.7.0required for MAC-address spoofing