First thing you will require is the SecureW2 Client. You can download that from the SecureW2 Homepage.
Extract the files to a location, I normally use C:\Temp\SecureW2. Now grab the following code (this is for the latest Client, v3.3.3):
; ; SecureW2.inf -- SecureW2 Pre-Configuration File ; ; Manufacturer: SecureW2 B.V. ; ; [Version] Signature = "$Windows NT$" Provider = "SecureW2" Config = 7 ; ; Global configuration ; ; Startup wired zero config before installing ; values: AUTO|NORMAL ; AUTO: will start the device and change the startup type to automatic ; NORMAL: will start the service, but will not change the startup type ;[DOT3SVC] ;Startup = AUTO ;Restart = FALSE ; Startup wireless zero config before installing ; values: AUTO|NORMAL ; AUTO: will start the device and change the startup type to automatic ; NORMAL: will start the service, but will not change the startup type [WZCSVC] Startup = AUTO Restart = TRUE ; GINA Configuration ; [GINA] ;UseSecureW2Gina = TRUE ;GinaDomainName = "securew2.com" ;GinaType = Novell ;UseGinaVLAN = TRUE ;GinaVLANIPAddress = 192.168.2.0 ;GinaVLANSubnetMask = 255.255.255.0 ; ; Install certificates ; [Certificates] ; ; Certificate.0 points server certificate, will be installed in local "MY" store ; Certificate.n points to a sub or root ca, will be installed in local "ROOT" store ; ;Certificate.0 = ext2.cer Certificate.1 = yourcert.cer ; ; SSID configuration ; The SSID configuration must start with SSID.1 and then continue with SSID.2, ; SSID.3 and so forth ; ; For more info on the connection values please see the following link: ; ; http://msdn2.microsoft.com/en-us/library/ms706965.aspx ; [SSID.1] Name = "eduroam" Profile = "eduroam" AuthenticationMode = "WPA" EncryptionType = "TKIP" ConnectionMode = "auto" ; ConnectionType = "ESS" ; NonBroadcast = "false" AutoSwitch = "false" ; ; Profile configuration ; ; The Profile configuration must start with Profile.1 and then continue with ; Profile.2, Profile.3 and so forth ; [Profile.1] Name = "eduroam" Description = "Enter the username and password of your Novell (NDS) Account:" ; ; Connection ; UseAlternateOuterIdentity = FALSE ;UseAnonymousOuterIdentity = TRUE ;AlternateOuterIdentity = user@somedomain.com UseSessionResumption = TRUE ; ; Certificates ; VerifyServerCertificate = TRUE ;ServerName = somedomain.com TrustedRootCA.0 = yourcertthumbprint ; ; Authentication ; AuthenticationMethod = PAP ;AuthenticationMethod = EAP ;EAPType = 4 ; MD5-Challenge (EAP-MD5) ;EAPType = 13 ; Smart Card or other Certificate (EAP-TLS) ;EAPType = 21 ; SecureW2 (EAP-TTLS) ;EAPType = 25 ; Protected EAP (EAP-PEAP) ;EAPType = 26 ; Secured password (EAP-MSCHAP v2) ;EAPType = 42 ; Mob@c (EAP-MOBAC) ; ; Use the following to alter the user credentials popup during authentication ; ;AltUsernameString = "Who are you" ;AltPasswordStr = "Enter your secret" ;AltRePasswordStr = "Re-Enter your secret"^M ;AltCredsTitle = "Welcome to ..." ;AltProfileStr = "Your profile is:" ; ; The following disables the "Save credentials" option in the popup AllowCachePW = TRUE ; ; User Account ; ; To ask the user for credentials during startup use the following example: PromptUserForCredentials = TRUE UserName = PROMPTUSER ;UserPassword = xxx ;UserDomain = alfa-ariss.com ; ; The following saves the user credentials as computer credentials ; allowing 802.1X authentication during startup ; UseUserCredentialsForComputer = TRUE ; ; Advanced ; ;UseAlternateComputerCredentials = TRUE ;ComputerUserName = admin ;ComputerPassword = xxx ;ComputerDomain = somedomain.com ;ServerCertificateOnLocalComputer = TRUE ;CheckForMicrosoftExtension = TRUE AllowNewConnections = TRUE ;UseEmptyOuterIdentity = FALSE RenewIPAddress = TRUE
Unedited version can be found here: SecureW2.inf
Paste this into a text editor. There are a few things you will need to edit here before saving. Firstly make sure you have you edit the [Certificate] section and enter the filename of your cert under Certificate.1. You will also be required to edit the profile and copy / paste the thumbprint of your certificate under the TrustedRootCA.0 section of the profile. You can edit anything else you want in here, for an explanation of the sections consult the Secure Wiki Admin Guide.
Save this file to the filename SecureW2.inf (case sensitive) and ensure it is in the same directory as the SecureW2 Installer. Also place your certificate file in this directory. Now simply run the SecureW2 executable, and it will push the above settings out to the PC. You will require a reboot to complete the installation, and you should get prompted for credentials during the install.
Now to make this solution a little neater, I have used the Nullsoft Scriptable Install System (NSIS). Download the NSIS Installer from the NSIS Homepageand install it on your machine. Once installed, grab the following code:
;--------------------------------
; Defines
!define APPLICATION "SecureW2 Swinburne Installer"
!define VERSION "1.0"
;--------------------------------
;Include Modern UI
!include "MUI.nsh"
;--------------------------------
;General
;Name and file
Name "${APPLICATION} ${VERSION}"
OutFile "SecureW2_Eduroam_2KXP_Vista.exe"
;--------------------------------
;Interface Settings
!define MUI_ICON "youricon.ico"
!define MUI_UNICON "youricon.ico"
!define MUI_ABORTWARNING
;--------------------------------
;Languages
!insertmacro MUI_LANGUAGE "English"
;--------------------------------
;Installer Sections
Section "${APPLICATION}" SecInstall
SectionIn RO
;
; Extract all file to the temp dir
;
SetOutPath $TEMPDIR
;
; Define all the files required for the installation here:
; SecureW2_220.exe,
; SecureW2.inf and
; all the certificates
; Note: The locations are relative to the .nsi file
;
File "SecureW2_TTLS_333.exe"
File "SecureW2.inf"
File "yourcert.cer"
ExecWait "SecureW2_TTLS_333.exe"
;
; If an error occurs then goto Error label else goto Continue label
;
IfErrors Error
Goto Continue
;
; Error Label, show error box and then quit
;
Error:
MessageBox MB_OK|MB_ICONEXCLAMATION "Error while installing SecureW2. Please try again, otherwise contact your System Adminstrator"
;
; Continue Label
;
Continue:
;
; Remove temporary files
;
Delete "$TEMPDIR\SecureW2_TTLS_333.exe"
Delete "$TEMPDIR\SecureW2.inf"
Delete "$TEMPDIR\yourcert.cer"
Quit
SectionEnd
Unedited version can be found here: SecureW2_example.NSI
Paste it in a text editor of your choice. You will need to edit a couple of things here, replace yourcert.cer with your certificate filename (make sure you do this in both the files required section and the remove temporary files section), and also replace youricon.ico with the icon you would like to use for the installer. You can then save this file, I'd recommend saving it into the same location as the SecureW2 installer, where you should already have your inf file and your certificate and giving it an appropriate name such as "SecureW2_Eduroam_2KXP_Vista.NSI" (Please note: You will need the .NSI extension for this script to work with NSIS). You will also need to ensure that you place your icon file in this same directory.
You can now run the MakeNSISW Program from within in the NSIS Program File Group, and point it to the .NSI script you have just saved. It should automatically build an installer for you with the name "SecureW2_Eduroam_2KXP_Vista.exe" and output it into the same directory. If you see an error in the log, just double check that you have all your filenames correct and in the directory you are working from.
Congratulations, you now have a single executable file that you can use to perform a scripted Eduroam install on any end user's PC!
(If you would like a copy of the above configuration files without any editing, please see the attachments section at the top of this page)