Slashdot Mirror
Are You Using 802.1X?
"Here's our story: we're using Windows 2003 servers (for IAS) and PEAP/MSCHAPv2. We're not offering support for Windows clients prior to 2000 (even though clients do exist for 98/ME,etc). Windows 2000 supposedly has builtin support after SP3, but on June 10, Microsoft released a WEP patch that breaks 1x! (At least for our implementation...) Windows XP SP1 works in most cases, but certain onboard-wireless chipsets (Intel) don't work, regardless of OS. I heard that staff struggled with and finally successfully installed a 3rd party client for RedHat 9, and I'm told there's also a client for Mac OS 10.2.
As far as I can tell, the network guys did their homework--I promise--but this deployment is beginning to look like a disaster! Do you have any wisdom to share about how to pull victory from the clutches of shameful defeat? I realize my question is rather broad and vague ... but I'm really interested to see what discussion comes up. Thanks!"
No.
Next question please.
Get SP4 which gets the .1x support back.
Did "homework" include a reasonable test implementation? Anything that affects your infrastructure in such a drastic way should probably be banged on for several weeks with at least a dozen guinea pigs (assuming you don't have a test lab in these days of cost cutting).
Help save the critically endangered Blue Iguana
Take a look at what Purdue University does. They use a Cisco VPN client that is available on win/mac/linux/sun, and ties in with the student accounts to verify access. If you aren't using the VPN client, you are redirected to download it automagically. http://www.itap.purdue.edu/airlink/ This is the best solution I have seen.
not using even WEP is simply asking for trouble, using basic WEP (pre-shared keys) is a little better, but its still vulnerable and has the hassles of key management (each time you change the keys you need to update all clients). 802.1x is the way to go.
There is some support on OSes for 802.1x (Windows XP has it built it for some authentication methods, for Windows 2000 you can download it from the Microsoft website, for Linux and BSD use xsupplicant (http://www.open1x.org).
One important consideration is what 'EAP method' you use for security. 802.1x is a framework for security and you can tie-in different methods within this framework for doing the actual authentication and key generation.
If you use EAP-TLS then there is can be a problem of configuring certificates on client machines, though its pretty secure once setup. You can use the cisco proprietary LEAP with Cisco AP's and clients or go for a solution based on PEAP or EAP-TTLS.
LEAP only requires you to have a user-name/password type of setup and can be easily tied to existing authentication infrastructure (Eg: the windows network in your LAB). PEAP and EAP-TTLS need only a username and password if you use MS-CHAPV2 or some such method, though you still need valid server-side certificates.
Puneet
I used it on my last contract. 802.1x with WindowsXP SP1 works just fine. We used PEAP and Microsoft's IIS server for RADIUS authentication.
We wanted PEAP since it doesn't require manual certificates.
It took a lot of tweaking on the server, a small bit on the AP, but the client settings were just what you'd expect them to be.
I didn't try it with OS X (even though I used a Powerbook on the job). Take a look at http://www.mtghouse.com/
Per the message boards I've read, their client should work just fine.
Failure is not an option. It comes bundled with your Microsoft product. -- Ferenc Mantfeld
Outside of the Access-points we used all pre-existing equipment. We already had a Enterprise Root Cert Authority setup on our Root Win2k DC. We then created a cert for wireless access. We deployed the cert by using policies and used IAS to authenticate the users against a remote access policy that verified users group memberships.
For Hardware we used Cisco 1100's and Zyair B1000's (Http://www.zyxel.com). The B1000's have a beta firmware to support EAP-TLS and cost less than $100 bucks!
We only allow Win2k and Windows XP clients to use wireless, setting up the few win98 clients we have is too much of a pain!
With Windows XP Service Pack1 the user will get a prompt that says there is a wireless network available. Included in that is a check box to use 802.1x authentication and since the default is Certificates all the user does is click connect and they are on!
If you have clients other than windows clients you can still use the win2k cert server, just have then download the cert via the web manager. IT will be http://certservername/certsrv. Works great.
You're thinking of "802.11x" which generally means any of 802.11b, 802.11a, or 802.11g (wireless protocols). "802.1x" is a security protocol, not a wireless protocol per se. Very confusing, I know...
I don't know about you who use WEP, but please STOP.
It is BROKEN.
Use IPSec. There are many tutorials for using IPSec in tunnel mode as a replacement for WEP. Google it. I wrote the 3rd or 4th one down - it isn't that hard, guys. Please don't use WEP, it really isn't smart.
At our University we deployed 802.1x and in this
way we reached the highest possible level of security - nobody, even the authorized personel can not log-in. This means that users have complete
protection from hackers, viruses and similar.
You also can't broadcast the universities data to the world. It's definately a balance, but there are solutions that can work without being too restrictive. We use Funk software's Odyssey server at our University, and it supports a wide range of authentication types(TLS, TTLS, LEAP, PEAP). We have managed to get 98% of our users online without any trouble. Cisco hardware works fine on most OS's (Linux, BSD, pocketpc). There is also an open source TLS authentication method, but that involves issueing client certificates.
Like I said before, there has to be some balance between security and academic freedom, but there must be some sort of security policy in any large wireless network. I think what the industry really needs is a standard rather than 5 or more different solutions with marginal advantages over one another. Then we can work on getting that standard supported everywhere (PEAP I hope). Until then, wireless security will always be hit or miss or none at all.
Hi,
s Whitepaper.pdf
e x.html
;)
I work at the University of Utah. We're currently rolling out 802.1x.
My building has already rolled out 802.1x on about 36 access points. We've been running for over a month and a half.
We've got a lot of people interested in what we're doing. We're using a decentralized model that allows us to let various departments use their user accounts everywhere else on campus (that is using 802.1x).
Check out our whitepaper for more information:
http://utahgeeks.sourceforge.net/projects/Wireles
The paper covers various issues. Keep in mind that the paper is not quite done yet, but it does have a lot of useful information.
We're officially supporting Mac OS X, Windows 98, Windows 2k, and Windows XP. We're not officially supporting Linux, but my boss and I are lead developers on the open1x project (http://open1x.sourceforge.net).
It has Linux and Mac OS X support. We support TTLS, TLS, PEAP (in CVS), MD5, and we're going to be implementing EAP_AKA pretty soon.
If you're interested in the specifics please check out some of our support pages:
http://www.laptop.lib.utah.edu/global/support/ind
The biggest problem has been support for various cards on Windows. The support link above lists the cards we've tested.
We're currently only supporting Airport on Mac OS X due to the lack of a public API from Apple. (Please let apple know that you want a public wireless API so we can support more cards...
We're using a campus site license of the Meetinghouse supplicant for Mac OS X, and Windows. We're using Radiator, a perl based (VERY NICE!) radius server. It's 802.1x implementation rocks.
More info on Radiator: http://www.open.com.au
802.1x is becoming the University of Utah campus standard. All future wireless purchases made with student task force moneys will be required to be 802.1x compatible.
Please let us know if you have any questions regarding our setup.
You're a little bit confused about how 802.1x ties into everything...
;)
a) 802.1x was designed for port based access, not wireless. It was adapted for wireless. The keying method is WEP. The encryption tunnel for authentication happens VERY quickly. very little overhead.
b) 802.1x allows you to know WHO is on your network. Do you really want to have an open wide public network that some terrorist could potentially get on to talk to his buddies anonymously... not me...
c) Once again... the encryption for the authentication happens very quickly. We're talking miniscule amounts of time. The keying on the card is WEP, but the keys can be per-user, and can rotate at a specified interval. If you're using WEP at all your keys should be rotating no less than every 10 minutes, otherwise it would be very easy to crack.
d) 802.1x *IS* using SSL for its encryption... besides the fact that that portion only happens for authentication... as I said before WEP is used on the cards.
802.11i will provide per-packet keying, which is when you should really start to worry about the overhead...
Um... 802.1x *IS* an IEEE standard... people just need to start implementing it correctly... ;)
;)
Also, not only is there a TLS open source standard... the open1x project (http://www.open1x.org) has a TTLS release, and PEAP in CVS.
PEAP is a horrid ripoff of TTLS in my opinion.
P.S. The FUNK guys wrote the TTLS RFC.
M$ and Cisco wrote the PEAP RFC, but neither of them follow it, or each other.
Check out the open1x project.
;)
http://open1x.sourceforge.net
I'm not only a client, I'm also a developer.
The only credible attack in that paper was a DOS attack. A properly configured system would be able to avoid the man in the middle and session hijacking attacks described there. DOS probably isn't a really huge problem with low power wireless since it will be pretty easy to locate the attacker.
I don't want free as in beer. I just want free beer.