Silicon Hill Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== WiFi ======

===== Basic info about SH WiFi =====

  * SSID: SiliconHill
  * Encryption: WPA2-Enterprise, AES
  * Authentication: PEAP
  * RADIUS server:
    * ldap.sh.cvut.cz 
    * Issuer: GEANT OV RSA CA 4
    * Intermediate CA: USERTrust RSA Certification Authority
    * Root CA: AAA Certificate Services

===== How to connect =====

First, registrar needs to register you to the network. You can reach him at adminX@siliconhill.cz (where X is the number of your block) and you need to tell him your MAC address.

Login credential are the same as to our [[klub:itsluzby:informacni_system|Information system]].

==== Windows 10 ====

  - The easy way
    - Most of the time, you can just click the WiFi icon in your taskbar, choose SiliconHill from the list and connect like you do with any other network. Only insted of password, you will be prompted to enter username and password. In the rare case this does not work, follow the instructions below:
  - Remove old SiliconHill network profile (if exists)
    - Use shortcut Win+I to open settings.\\ {{klub:itsluzby:wifi:wifi-win10-1-1.png?direct|}}
    - Go to Network and internet -> WiFi, and choose Manage known networks \\ {{klub:itsluzby:wifi:wifi-win10-1-2.png?direct|}}
    - Choose SiliconHill in the list and click remove. \\ {{klub:itsluzby:wifi:wifi-win10-1-3.png?direct|}}
  - Create new WiFi profile
    - Use shortcut Win+R to open Run window, enter //control// and click run.\\ {{klub:itsluzby:wifi:wifi-win10-2-1.png?direct|}}
    - In Control Panels choose Network connections and sharing centre.\\ {{klub:itsluzby:wifi:wifi-win10-2-2.png?direct|}}
    - Choose Set up new connection.\\ {{klub:itsluzby:wifi:wifi-win10-2-3.png?direct|}}
    - Fill in Network name //SiliconHill// and choose WPA2-Enterprise encryption.\\ {{klub:itsluzby:wifi:wifi-win10-3-1.png?direct|}}
  - Configure secure network parameters.
    - Choose change connection settings.\\ {{klub:itsluzby:wifi:wifi-win10-3-1-2.png?direct|}}
    - Select Security tab and click settings.\\ {{klub:itsluzby:wifi:wifi-win10-3-1-1.png?direct|}} 
    - Check Connect to this servers and fill in //ldap.sh.cvut.cz//, and choose AAA Certificate Services a USERTrust RSA Certification Authority of the list of truster root CA. Confirm with OK.\\ {{klub:itsluzby:wifi:wifi-win10-3-2.png?direct|}}
    - Choose Advanced.\\ {{klub:itsluzby:wifi:wifi-win10-3-1-1.png?direct|}} 
    - Check verification method, choose User verification from dropdown menu and Save login credentials. \\ {{klub:itsluzby:wifi:wifi-win10-3-3.png?direct|}} 
    -  In the popup window we fill in the login (same as for [[klub:itsluzby:informacni_system|is.sh.cvut.cz]]) and confirm with OK.\\ {{klub:itsluzby:wifi:wifi-win10-3-4.png?direct|}}
    -  Confirm all windows with OK until you are left with this one. Then close it. :\\ {{klub:itsluzby:wifi:wifi-win10-3-1-2.png?direct|}}
  -  We connect to the network. If we have issues with connecting, we first go back and check the password and enter it again.

==== Android ====


Select EAP methot to PEAP, PHASE 2 verification to MSCHAPSv2, fill in username (identity) and password (same as for [[klub:itsluzby:informacni_system|IS]]). Anonymous identity stays empty.

As a domain name, usually sh.cvut.cz is fine, but some devices need ldap.sh.cvut.cz.

Before connecting, you have to choose CA certificate. There are 3 options.

Před připojením je ještě nutné vyplnit pole Certifikát CA, existují 3 možnosti:

  * Use system certificates (should work with Android 8.0 and newer. Use ldap.sh.cvut.cz as domain name.
  * Download and install certificate from CA at https://www.identrust.com/node/935. Then the certificate will be shown in this menu under the name you choosed. Use ldap.sh.cvut.cz as domain name.
  * INSECURE OPTION - Do not verify. Although this option is insecure, it's widely used amongst users. To parahprase https://man.fit.cvut.cz/ict/eduroam/: If you do not provide RADIUS server name or disable certificate verification, your login credentials can be spoofed by someone who can then pretend to be you.

 
{{klub:itsluzby:wifi:wifi-android9.jpg?direct&400|}}

===== Disable MAC randomization =====

Andoid 10 and Windows 10 often have MAC randomization enabled. However, our network allows only known MAC addresses to connect, so this options needs to be disabled.


==== Android 10+ ====

MAC can be found in Settings -> About phone -> Status


{{:en:klub:itsluzby:500px-android-mac-step1.jpg?400|}}
{{:en:klub:itsluzby:500px-android-mac-step2.jpg?400|}}
{{:en:klub:itsluzby:500px-android-mac-step3.jpg?400|}}

Some phones have option to disable MAC randomization in WiFI -> Advanced. On some, you need to hold the network in list, choose Advanced, and disable it there for this network. 


==== iOS 14+ ====

If you have issues conncting, you have to disable //Private address// as shown below.

{{:klub:itsluzby:iphone_private_addr.png?direct&400|}}

If you can't connect at all, you need to perform manual network setup based on [[en:klub:itsluzby:wifi#basic_info_about_sh_wifi|WiFi]]

{{:klub:itsluzby:iphone_private_new1.png?direct&400|}}
{{:klub:itsluzby:iphone_private_new2.png?direct&400|}}

==== Windows 10 ====

Disable randomization:

  - First 3 steps are same like when removing network profile as show above on this page 
  - In the dropdown menu to choose randomized addresses select Off. \\ {{klub:itsluzby:wifi:win10-random-mac.png?direct&900|}}
Silicon Hill Wiki

User Tools

Site Tools

Page Tools
