This article explains how to create and apply a Linux RADIUS Policy that instructs enrolled Linux devices to use secure Wi-Fi (WPA2/WPA3 Enterprise) via RADIUS authentication. By pushing this policy, you ensure all enrolled Linux endpoints automatically connect with the correct SSID, EAP settings, and certificates (including SCEP-issued certificates if applicable).
Prerequisites
Swif agent installed on your Linux device
Access to your Swif admin console
RADIUS server and certificate infrastructure (e.g., SCEPman or other SCEP provider)
Step 1: Assign the RADIUS Policy
You can assign a RADIUS Wi-Fi policy to Linux devices:
Here is the Policy JSON structure:
{
"policyName": "Linux Radius Policy",
"policyType": "LINUX_RADIUS_POLICY",
"policy": {
"configureType": "manual",
"ssid": "SSID",
"hiddenNetwork": false,
"eapType": "TLS",
"identity": "identity",
"password": "password"
}
}When you configure the Swif.ai app, it will replace
SSID,identity, andpasswordwith your actual Wi-Fi network and user credentials.
Step 2: Verify Configuration File
After assigning the policy, check that the file /etc/wpa_supplicant/wpa_supplicant.conf exists on the device and contains the configuration you specified.
Step 3: Configure with SCEPman (Certificate-Based Authentication)
To use SCEPman as your certificate provider, update your policy as follows:
Here is the SCEPman JSON structure:
{
"policyName": "Linux Radius Policy",
"policyType": "LINUX_RADIUS_POLICY",
"policy": {
"configureType": "scepman",
"ssid": "SSID",
"hiddenNetwork": false,
"eapType": "TLS",
"identity": "identity",
"password": "password",
"scepmanConfiguration": {
"tenantID": "",
"clientID": "",
"clientSecret": "",
"scepmanApiAppId": "",
"scepmanServiceDefaultDomain": ""
}
}
}
When you configure the policy on the Swif.ai app, the SCEPman configuration fields with your Azure/SCEPman details will be replaced.
For detailed SCEPman setup, see: How to Configure Swif.ai RADIUS Wi-Fi Policy Using SCEPman as the SCEP Certificate Provider
Step 4: Validate Certificate and Key Deployment
Ensure that the
private_keyis configured in/etc/wpa_supplicant/wpa_supplicant.confand that the referenced key file exists.The Swif agent will handle certificate requests and updates via SCEPman, and update the configuration file accordingly.
Troubleshooting
If the device does not connect, verify the SSID, EAP type, and certificate paths in
/etc/wpa_supplicant/wpa_supplicant.conf.Ensure the Swif agent is running and has the necessary permissions to update configuration files and manage certificates.
For issues with SCEPman integration, refer to the SCEPman configuration guide.
Related Articles:
This guide ensures your Linux devices can securely connect to enterprise Wi-Fi using RADIUS and certificate-based authentication, following the same standards as your Windows deployment.