Android on BYOD - Smoothwall

[E_G_R2]

Hi

 

pupil can use their mobile devices on out network on our BYOD wifi channel on our Smoothwall using RADIUS to authenticate.

 

Problem we have is that newer Android devices now want a certificate installed to connect.

 

I seem to remember but can't find anything specific that you point them at a page with a link to the certificate and that they then download it to their device.

 

If I am right does anyone have a link to simple instructions on how to set this up and how a device that isn't connected connects.

[supportman]

Hi

 

pupil can use their mobile devices on out network on our BYOD wifi channel on our Smoothwall using RADIUS to authenticate.

 

Problem we have is that newer Android devices now want a certificate installed to connect.

 

I seem to remember but can't find anything specific that you point them at a page with a link to the certificate and that they then download it to their device.

 

If I am right does anyone have a link to simple instructions on how to set this up and how a device that isn't connected connects.

Yeh, It's a big problem as your Radius server would need a public certificate to work. I'm not even sure if that's possible!

 

Its only going to get worse as more users upgrade their android OS.

 

In the previous versions of android you could bypass the certificate, but not latest. It wasn't ideal anyway as the setting confused users.

 

There are some commercial solutions out there like SecureW2 | Complete Platform for Passwordless Security

 

Personally we are in the process of moving to MAC address authentication for our student BYOD users inside unify.

 

This has the advantage of not needing them to sign in or any extra servers, but also restricting the BYOD system to a single device. We register those devices with a simple Microsoft form and copy the MAC address list in batch to a text file which you can upload to unify. Seems to work very smoothly now! wish I had done it sooner rather than messing with Radius servers for years 😂

Edited September 20, 2024 by supportman

[Primus]

Yeh, It's a big problem as your Radius server would need a public certificate to work. I'm not even sure if that's possible!

 

Its only going to get worse as more users upgrade their android OS.

 

In the previous versions of android you could bypass the certificate, but not latest. It wasn't ideal anyway as the setting confused users.

 

There are some commercial solutions out there like SecureW2 | Complete Platform for Passwordless Security

 

Personally we are in the process of moving to MAC address authentication for our student BYOD users inside unify.

 

This has the advantage of not needing them to sign in or any extra servers, but also restricting the BYOD system to a single device. We register those devices with a simple Microsoft form and copy the MAC address list in batch to a text file which you can upload to unify. Seems to work very smoothly now! wish I had done it sooner rather than messing with Radius servers for years 😂

 

But MAC addresses are trivially easy to spoof?

[supportman]

But MAC addresses are trivially easy to spoof?

Easily picked up in the Unify backend under settings >> Wi-fi >> student SSID >> clients.

 

Also not been an issue for us in 10 years on our main network.

 

Lastly most BYOD users are iPads in our school, not trivial at all to set a new MAC address. Private Wifi Address feature is no good either.

[Primus]

Easily picked up in the Unify backend under settings >> Wi-fi >> student SSID >> clients.

 

Also not been an issue for us in 10 years on our main network.

 

Lastly most BYOD users are iPads in our school, not trivial at all to set a new MAC address. Private Wifi Address feature is no good either.

 

It is trivially easy for an iPad to spoof a MAC address - that's literally what private WiFi addresses does.

 

Advising people to move from RADIUS authentication to MAC authentication is an interesting one.

[E_G_R2]

Is there not a way that you point them at a page on the smoothwall box where they then download the certificate or did I dream that option (or is it out dated)?

[Primus]

Is there not a way that you point them at a page on the smoothwall box where they then download the certificate or did I dream that option (or is it out dated)?

 

That would be for the MITM SSL interception certificate and at that point they're on the network so if they can't join the network they cannot get to that page.

 

You could host the RADIUS certificate on your website and then people could download it over their 4G, trust it and then Android devices would allow connection as far as I'm aware.

[supportman]

It is trivially easy for an iPad to spoof a MAC address - that's literally what private WiFi addresses does.

 

Advising people to move from RADIUS authentication to MAC authentication is an interesting one.

 

That doesnt work, that just uses a randomized MAC which will also not be authenticated. We use a whitelist.

 

There is no way to spoof an ipad mac that I know of. And even if there was it would be spotted instantly by our monitoring.

[Primus]

That doesnt work, that just uses a randomized MAC which will also not be authenticated. We use a whitelist.

 

There is no way to spoof an ipad mac that I know of. And even if there was it would be spotted instantly by our monitoring.

 

So it spoofs a MAC address - the very thing you said couldn't be done?

 

MAC address spoofing is trivially easy, do not rely on it as it's not secure at all.

[supportman]

So it spoofs a MAC address - the very thing you said couldn't be done?

 

MAC address spoofing is trivially easy, do not rely on it as it's not secure at all.

 

So how would you spoof a MAC address on an iPad then to break the security? I'm genuinely interested. Our whitelist only allows specific Wi-Fi addresses linked to the students name, and model number.

 

I get what your saying, but there is no way to set a specific MAC address on an iPad. The apple setting "Private Wi-Fi address" is random and has no config that I can see. I just tested it on an iPad myself and as soon as I enable it the device is blocked from our network again

[Primus]

So how would you spoof a MAC address on an iPad then to break the security? I'm genuinely interested. Our whitelist only allows specific Wi-Fi addresses linked to the students name, and model number.

 

I get what your saying, but there is no way to set a specific MAC address on an iPad. The apple setting "Private Wi-Fi address" is random and has no config that I can see. I just tested it on an iPad myself and as soon as I enable it the device is blocked from our network again

 

Are you managing them or could they jailbreak them?

 

Are they the only device ever used?

[supportman]

Are you managing them or could they jailbreak them?

 

Are they the only device ever used?

 

Good point, exactly the kind of critical thinking I was hoping for to find the flaws

 

They are personal 1:1 iPad devices in our 6th form. Mostly iPad 10's but some 9's also. Hopefully not jailbreakable but yet but its definitely something I hadn't thought of.

 

I think its important to note as well, we are not working for Mi5 here. If a student decides to try and get around the rules we simply detect and sort it out with the student.

 

One other thing is I limited the vlan IP range of the devices to never go over our limit of maximum devices expected. I doubt it will actually make any difference but its another useful took as well as the Unify client bandwidth limiter.

Edited September 20, 2024 by supportman

[tom_newton]

These things are increasingly hard - you may have seen some of our efforts at lobbying the big firms to "do better" for Education. It is a long slog.

[E_G_R2]

These things are increasingly hard - you may have seen some of our efforts at lobbying the big firms to "do better" for Education. It is a long slog.

 

Does Smoothwall have a 'recommended way of doing this and if so can you link it please?

[Primus]

Good point, exactly the kind of critical thinking I was hoping for to find the flaws

 

They are personal 1:1 iPad devices in our 6th form. Mostly iPad 10's but some 9's also. Hopefully not jailbreakable but yet but its definitely something I hadn't thought of.

 

I think its important to note as well, we are not working for Mi5 here. If a student decides to try and get around the rules we simply detect and sort it out with the student.

 

One other thing is I limited the vlan IP range of the devices to never go over our limit of maximum devices expected. I doubt it will actually make any difference but its another useful took as well as the Unify client bandwidth limiter.

 

Whilst there's a balance, moving from RADIUS which works fine with iOS and iPad OS to MAC address filtering is a massive step backwards.

[3s-gtech]

We host the Smoothwall inspection cert on a public page (which they have to sign in to and use on their data/at home to do so).

 

This installs the self-signed cert for the Smoothwall, which still works on newer Android versions. It doesn’t need to be a public/proper cert. The device will check that the user wants to trust it.

 

The user can then connect to the SSID and select the cert from their device in the connection settings.

 

It’s quite complex, but does work.

[tom_newton]

It's more of a WiFi AP thing than a Smoothwall thing - we suggest saying "do not verify" on the Android devices

https://kb.smoothwall.com/hc/en-us/articles/360005291260-Connecting-an-Android-phone-to-an-802-1x-Wifi-SSID-using-RADIUS

[3s-gtech]

Here's my instruction list:

 

 

1. Go to the website on your device, using mobile data or home wifi
   
2. Choose sign in with your logon details
   
3. Click on the link, and download the file
   
4. Go to 'Settings' on your phone
   
5. Choose 'Connections', then 'Wi-Fi', then the three dots and 'Advanced'
   
6. Click on 'Install network certificates'
   
7. Select the menu icon in the top right then 'Internal Storage'
   
8. Choose the certificate file from the folder you saved it to (Downloads usually).
   
9. Click Done and call it SchoolCA
   
10. Connect to the network 'YourSSID'
    
11. When asked for username ('Identity') enter username@domain
    
12. When asked for a password enter your password (the same one you use for the computers)
    
13. Click on CA certificate and chose SchoolCA
    
14. Type 'school.ca.domain' in the Domain box
    
15. Click Connect
    
16. It may be slow to connect - be patient!