Ethernet on campus

Gets a Linux or Mac device onto a campus Ethernet port, and onto the @thi network. Two different things can happen when you plug in, and the port decides which:

• 802.1X port authentication. The port asks your machine to log in, and you answer with your campus login. Nothing is registered in advance. This is the newer path and the one most ports now take.
• MAC address registration. The port compares your adapter's hardware address against a list, and lets it through if the address was registered. Some lecture-hall ports, the D building among them, still work this way. The same registration also covers the @thi Wi-Fi network.

Official documentation: MyTHI: network and Wi-Fi on campus (login required).

You may not need either

eduroam needs no registration, works in every building, and works at other universities too. Reach for a wired port when you specifically need one.

Which one does this port want

Plug in and watch. If a password prompt appears, or your machine reports that authentication is required, the port speaks 802.1X: use the first path below. If nothing is asked and you simply never get an address, the port is checking hardware addresses: use the second.

Trying 802.1X first costs nothing. A port that does not ask never sees the credential.

---

Path 1: 802.1X port authentication

Documented values

Item	Value
Method	PEAP
Inner method	MSCHAPv2
Identity	<kennung>, with no realm and no domain
Authentication mode	user, not machine
CA certificate	HARICA TLS RSA Root CA 2021
Server name to match	rz.fh-ingolstadt.de
Authentication server	rz-radius-01.rz.fh-ingolstadt.de

Both certificate settings are required. Your campus login is the password that also reaches your mail and everything else, and a profile that does not check the authentication server's certificate hands it to anything willing to ask. Wi-Fi on campus explains that at length, including why naming a CA without also matching a server name only narrows the attack rather than closing it.

The official configuration guide ticks Serverzertifikat überprüfen (check the server certificate) and then leaves the trusted authority unselected and Verbindung mit folgenden Servern herstellen (connect to these servers) empty, so the two values above do not come from it. They were read off a campus port on 2026-08-13 and confirmed out of band before being written down. The wired port and eduroam presented the same certificate chain that day, fingerprints included, so the wireless CA in facts/wifi.yaml and the wired one here name one server.

The click path

GNOME: Settings → Network → the wired connection's gear icon → Security tab → switch 802.1X Security on. Authentication Protected EAP (PEAP), inner authentication MSCHAPv2, username <kennung>, password your campus password.

KDE: System Settings → Wi-Fi & Networking → the wired connection → 802.1x Security, same four values.

Then the two certificate settings: CA certificate → /etc/ca-certificates/extracted/cadir/HARICA_TLS_RSA_Root_CA_2021.pem, which is HARICA TLS RSA Root CA 2021 as the ca-certificates package installs it, and Domain (GNOME) or Domain suffix match (KDE) → rz.fh-ingolstadt.de.

Leave anonymous identity empty.

GNOME: Settings → Network → the wired connection's gear icon → Security tab → switch 802.1X Security on. Authentication Protected EAP (PEAP), inner authentication MSCHAPv2, username <kennung>, password your campus password.

KDE: System Settings → Wi-Fi & Networking → the wired connection → 802.1x Security, same four values.

Then the two certificate settings: CA certificate → /etc/ssl/certs/HARICA_TLS_RSA_Root_CA_2021.pem, which is HARICA TLS RSA Root CA 2021 as the ca-certificates package installs it, and Domain (GNOME) or Domain suffix match (KDE) → rz.fh-ingolstadt.de.

Leave anonymous identity empty.

macOS asks by itself. Plug into a port that speaks 802.1X and a sign-in prompt appears for the Ethernet service; enter <kennung> and your campus password.

macOS then shows the authentication server's certificate and asks whether to trust it. That dialogue is the only server check you get here, and it is a one-time human decision rather than a setting: the name to expect is rz-radius-01.rz.fh-ingolstadt.de, issued under HARICA TLS RSA Root CA 2021. Read it before you accept it, because accepting stores it for good.

To configure it before plugging in: System Settings → Network → Ethernet → Details → 802.1X.

The terminal fast path

nmcli connection add type ethernet con-name "THI 802.1X" ifname enp0s31f6 \
  802-1x.eap peap \
  802-1x.phase2-auth mschapv2 \
  802-1x.identity "<kennung>" \
  802-1x.ca-cert "/etc/ca-certificates/extracted/cadir/HARICA_TLS_RSA_Root_CA_2021.pem" \
  802-1x.domain-suffix-match "rz.fh-ingolstadt.de" \
  802-1x.password-flags 2
nmcli connection up "THI 802.1X" --ask

ifname is the wired interface from ip -brief link show. password-flags 2 asks for the password at connect time instead of storing it; drop it and add 802-1x.password "<password>" if you would rather keep it in the keyring.

The profile name is yours to choose. It is a local label and campus systems never see it.

nmcli connection add type ethernet con-name "THI 802.1X" ifname enp0s31f6 \
  802-1x.eap peap \
  802-1x.phase2-auth mschapv2 \
  802-1x.identity "<kennung>" \
  802-1x.ca-cert "/etc/ssl/certs/HARICA_TLS_RSA_Root_CA_2021.pem" \
  802-1x.domain-suffix-match "rz.fh-ingolstadt.de" \
  802-1x.password-flags 2
nmcli connection up "THI 802.1X" --ask

ifname is the wired interface from ip -brief link show. password-flags 2 asks for the password at connect time instead of storing it; drop it and add 802-1x.password "<password>" if you would rather keep it in the keyring.

The profile name is yours to choose. It is a local label and campus systems never see it.

networksetup cannot create an 802.1X profile. Use the dialogue above, or install a .mobileconfig profile if your department distributes one.

Verify

network-verify.sh Download

Reports the profile, the address the port handed out, and the hardware addresses that would each need their own registration

curl -fsSLO https://hutzelmann.github.io/thi-linux-macos-setup/scripts/network-verify.sh
less network-verify.sh   # read it first
sh network-verify.sh --dry-run

Runs on its own. The documented values and helpers are built in, no clone needed. --dry-run prints what it would do and changes nothing.

It covers both paths on this page, and --evidence writes down everything it saw. A wired port is the one thing here you have to be standing next to, so recording the run is worth more than reading it.

nmcli -f GENERAL.STATE,IP4.ADDRESS device show enp0s31f6
nmcli -f 802-1x.ca-cert,802-1x.domain-suffix-match connection show "THI 802.1X"

nmcli -f GENERAL.STATE,IP4.ADDRESS device show enp0s31f6
nmcli -f 802-1x.ca-cert,802-1x.domain-suffix-match connection show "THI 802.1X"

ifconfig en0 | grep 'inet '

An address from the campus network means the login was accepted. An address in 169.254.x.x, or none at all, means it was not, or that this port wants a registered MAC address instead.

The second command prints the two certificate fields. Both must be non-empty, and the suffix must read rz.fh-ingolstadt.de. A profile built by following only the official guide has neither, and it authenticates exactly as well as one that does, which is why this is worth looking at rather than assuming.

---

Path 2: registration by MAC address

Why registration rather than the official client

Where a port checks hardware addresses, authentication is based on a whitelist. The documented route to get onto that list is a dedicated onboarding network and the vendor's onboarding client.

That client supports Windows and macOS, and its Linux support is very limited. For the systems it does not cover, IT's own advice is to register the device manually with the form for IoT devices. That is not merely a workaround: it means no additional software runs with administrative rights on your machine, which is a genuine advantage.

That client supports Windows and macOS, and its Linux support is very limited. For the systems it does not cover, IT's own advice is to register the device manually with the form for IoT devices. That is not merely a workaround: it means no additional software runs with administrative rights on your machine, which is a genuine advantage.

That client covers macOS, so it is available to you. Registering the device manually with the form for IoT devices is the alternative, and it is the route this page describes: no additional software runs with administrative rights on your machine, which is a genuine advantage.

The trade-off is that a manual registration expires after 1 year and has to be renewed.

Documented values

Item	Value
Registration form	IoT device form
Valid for	1 year
Wi-Fi network it also covers	@thi
Onboarding network, for the official client	thi-onboard

Step 1: collect the MAC addresses

Every port, adapter and docking station has its own MAC address, and each one needs a separate registration. A laptop with a built-in port and a dock is two submissions.

ip -brief link show

Interfaces named enp… or eth… are wired, wlp… or wlan… are wireless.

ip -brief link show

Interfaces named enp… or eth… are wired, wlp… or wlan… are wireless.

networksetup -listallhardwareports

Each block names a hardware port and its address. Ethernet and Thunderbolt Ethernet are the wired ones; Wi-Fi is the wireless one.

If you cannot tell which entry is the dock, unplug it, run the command again, and compare.

Step 2: submit the form

Open the IoT device form once per MAC address. Each address can be enabled for one area only, so it appears in exactly one submission.

For a wired port:

1. Welche Art von Gerät möchten Sie registrieren? (What kind of device?) → Sonstiges (auch Linux ARM)
2. Benötigen Sie für das Gerät WLAN? (Does the device need Wi-Fi?) → Nein
3. Gerätename (Device name) → <hostname>
4. MAC-Adresse → the wired interface's address
5. Beschreibung (Description) → what it is for, e.g. teaching or research access
6. Betriebssystem inkl. Buildversion (Operating system and build) → the system you run and its version, as you would name it yourself
7. Freischaltung Bereich (Area to enable) → the network area you need

For @thi Wi-Fi: the same form, with Benötigen Sie für das Gerät WLAN? set to Ja and the MAC address of the wireless interface.

Field labels are quoted in German because that is what the form shows. A translated label is one you cannot find on screen.

Step 3: wait

Submitting starts an approval request handled by a person. Progress notifications arrive by Teams and email.

For @thi you receive separate credentials. For Ethernet you get a general release for campus ports, valid 1 year.

Start this early if you know you will need it. Nothing about it is instant.

Verify

Plug into a campus port and check that you got an address from the campus network rather than a self-assigned one:

ip -brief address show

ip -brief address show

ifconfig en0 | grep 'inet '

An address in 169.254.x.x, or no address at all, means authentication did not succeed: the registration is not active yet, or that MAC was never submitted.

---

Known quirks

The identity carries no realm. Wired 802.1X and @thi want the bare <kennung>; eduroam wants <kennung>@thi.de. Mixing them up gives an authentication failure with no useful message. Leave the Windows-style domain field empty as well.

User, not machine. The official configuration authenticates the person, so the port comes up after you log in rather than at boot. A machine expected to be reachable while nobody is signed in is a different setup, and this page does not document one.

One MAC, one area. An address registered for one network area cannot be submitted again for another.

Renewal is on you. Nothing warns you before the 1 year expires; it simply stops working. A calendar reminder at eleven months is the practical answer.

Docks shared between people are a trap, in opposite directions. Under registration the MAC belongs to the dock, so a colleague plugging into your registered dock inherits your registration. Under 802.1X the credential is yours and travels with the machine, so a shared dock is not the problem; the port asking a second device on the same dock is.

Reference: 802.1X LAN configuration (PDF), a Windows click path, useful here for the values rather than the steps.