1

My college has a WPA2 Enterprise network, which I can connect to on my Pi after adding the network in wpa_supplicant.conf.

I don't want my Wi-Fi password stored in plain text, so I use echo -n $password | iconv -t utf16le | openssl md4 to hash it, and then store the MD4 hash instead of the plain text password in the file.

I've helped a lot of students to get their Pis connected to the network, and doing this has always worked, until last night when it wasn't working for someone. It seems like the problem is that their password is longer than 14 characters, which is great for security, but it causes problems with the MD4 hash algorithm.

Is there a way to hash passwords in the wpa_supplicant.conf file that are longer than 14 characters? I guess I should try using only the first 14 characters of the password to connect, but if that worked it would seem insecure.

1

I have never seen the procedure you suggest, but have you tried wpa_passphrase as suggested in https://www.raspberrypi.org/documentation/configuration/wireless/wireless-cli.md

This should work for passphrases from 8-63 characters

Storing passwords in wpa_supplicant.conf is not really a security risk, as the file is only readable by root.

  • 1
    wpa_passphrase won't work because it generates a PSK for a WPA-PSK network. My school's network is WPA-EAP, which requires a separate username and password, and is why I've been using NTLM password hashing instead. – tjohnson Sep 28 '17 at 15:38
  • this is enterprise wlan, your user/passphrase is often used for a whole lot of important things. If someone steals the hashed pw then they can use the wlan, if someone steals the plain text pw then they can access your email too. The fact that root owns it is a false sense of security, you can read it directly off the sd card... Imagine a raspberry pi running a display case, very public – crasic Sep 28 '17 at 17:33
  • @crasic Yes, I wrote a Bash script to automatically add the network to wpa_supplicant.conf which originally stored the password in plain text, but when I asked the IT department to approve it, they said it should be hashed and I can understand why. When my script stored the password in plain text, I had to help a professor set it up on their machine and ended up seeing their password in the process. – tjohnson Sep 28 '17 at 19:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.