How to connect Echo Dot to University protected wifi

Question

I recently won an Echo dot in a Hackathon and I was very excited to try it out but sadly the dot does not connect to 'Eduroam', the university network. The Uni site says that eduroam uses '802.1x which uses special security principals which are not supported on a number of home devices'. To set up Eduroam on your laptop, for example, you need to download a certificate and authenticate yourself using uni credentials, which is why the dot can't connect - it's not just entering a password.

Does anyone know a way to get around this? I have done the mobile hotspotting to get it to connect but I need to go through the whole connection process every time I come back into the room with my phone, so it's not really convenient.

Does anyone know if a wifi extender would work, or would it have the same certification security stuff as the Uni network eduroam? Would it even allow me to set up an extender with eduroam?

I'm not sure if whitelisting would work because Eduroam is run throughout the country and not just by my Uni, so I doubt I could ask for them to whitelist the MAC.

Any networking enthusiasts that can help me?:)

Solution 1

Ask your university's IT admins first.

I'm not sure if whitelisting would work because Eduroam is run throughout the country and not just by my Uni, so I doubt I could ask for them to whitelist the MAC.

Your university's APs are still managed by your university and get Internet access from your university. Eduroam is only a network of various universities' authentication (RADIUS) servers, i.e. it just lets them automatically check visitors' login information by asking their "home" university.

However, MAC whitelisting doesn't make sense because it cannot bypass WPA – whether it's WPA-Personal (your typical password-only network) or whether it's WPA-Enterprise (Eduroam with usernames), it's still not something you can exempt individual devices from.

(The university's admins could possibly set up exceptions with alternate credentials, e.g. username + password for those devices which don't support certificates, but it would still remain WPA-Enterprise no matter what.)

The university's admins, who control Wi-Fi AP configuration, could set up an additional SSID for devices which cannot use WPA-Enterprise (for example, some locations use an open Wi-Fi network with a browser-based login system), but it's unlikely they will do this for just one person.

Does anyone know if a wifi extender would work, or would it have the same certification security stuff as the Uni network eduroam? Would it even allow me to set up an extender with eduroam?

If it's the kind of extender that acts as a full Wi-Fi client + access point, then yes, in theory it should work and would be mostly indistinguishable from any other Wi-Fi client. The problem is in finding one which supports connecting to WPA-Enterprise networks.

(It might be reasonably easy to build such a repeater out of an ordinary Wi-Fi router which has both 2.4 GHz and 5 GHz radios – one could be configured as the eduroam client, the other as an AP for your own SSID; essentially doing the same as an extender or a phone's hotspot.)

Note that if your university uses passwords for Eduroam, then the certificate you install is most likely only used for verifying the server – i.e. it's a regular CA certificate like in HTTPS. While some universities do use client certificates in place of a password, that's not very common.

Solution 2

Response from the University admins, in case anyone is wondering:

I'm afraid as you have already said, devices such as the Amazon Echo and Wireless Printers cannot connect to Eduroam. These devices lack an interface that can be used to download and install the Eduroam certificate, which is essential when connecting.

Unfortunately, we cannot whitelist devices such as these, as without the required Security certificate installed, they will not have a secure connection and therefore act as a vulnerability.

Hardware such as Network repeaters or external routers cannot be used on the network. These go against our Network policy.

Comments

[Ramhound]

We cannot determine if you are allow or disallowed to configure your own network extender on your university's network. You will have to contact the university's network administrators to determine that particular factoid.

[Ariane]

If I was allowed, however, would this get around the issue? Or would the certification carry on to the wifi extender and not allow me to connect the dot? Do the security configurations carry over?

[Ramhound]

"Do the security configurations carry over?" - What security settings are you refering to?

[Ariane]

The fact that the Univerisity network requires a user to download a certificate before allowing you access - this is why you cannot connect via dot because you don't just sign in with a password, you need a certificate to be able to connect. Therefore, if the extender was simply repeating this signal would the devices connected to the repeater be required to have the certificate...or would they be alright because the repeater will have been certified?

[Ramhound]

Ask the IT Administrators. You would need a router that supports 802.1x, those devices do exist, how you would install the certificate would be similar to the way you install it on your device. You would then be able to connect to your router through 802.11 ac or similar protocol.