1

My college has a WPA2 Enterprise network, which I can connect to on my Pi after adding the network in wpa_supplicant.conf.

I don't want my Wi-Fi password stored in plain text, so I use echo -n $password | iconv -t utf16le | openssl md4 to hash it, and then store the MD4 hash instead of the plain text password in the file.

I've helped a lot of students to get their Pis connected to the network, and doing this has always worked, until last night when it wasn't working for someone. It seems like the problem is that their password is longer than 14 characters, which is great for security, but it causes problems with the MD4 hash algorithm.

Is there a way to hash passwords in the wpa_supplicant.conf file that are longer than 14 characters? I guess I should try using only the first 14 characters of the password to connect, but if that worked it would seem insecure.

Improve this question

1 Answer 1

Reset to default
1

I have never seen the procedure you suggest, but have you tried wpa_passphrase as suggested in https://www.raspberrypi.org/documentation/configuration/wireless/wireless-cli.md

This should work for passphrases from 8-63 characters

Storing passwords in wpa_supplicant.conf is not really a security risk, as the file is only readable by root.

Improve this answer
3
  • 1
    wpa_passphrase won't work because it generates a PSK for a WPA-PSK network. My school's network is WPA-EAP, which requires a separate username and password, and is why I've been using NTLM password hashing instead.
    – tjohnson
    Commented Sep 28, 2017 at 15:38
  • this is enterprise wlan, your user/passphrase is often used for a whole lot of important things. If someone steals the hashed pw then they can use the wlan, if someone steals the plain text pw then they can access your email too. The fact that root owns it is a false sense of security, you can read it directly off the sd card... Imagine a raspberry pi running a display case, very public
    – crasic
    Commented Sep 28, 2017 at 17:33
  • @crasic Yes, I wrote a Bash script to automatically add the network to wpa_supplicant.conf which originally stored the password in plain text, but when I asked the IT department to approve it, they said it should be hashed and I can understand why. When my script stored the password in plain text, I had to help a professor set it up on their machine and ended up seeing their password in the process.
    – tjohnson
    Commented Sep 28, 2017 at 19:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.