Help / Advice with RADIUS

[S0ulsniper]

Hi all. Long-time browser of the forums but first-time posting!

 

Recently updated WiFi infrastructure around the school, installing Aruba APs. At the time, it was decided to set the SSIDs up as WPA-2 Personal, and give the passphrase to staff and sixth-form students for BYOD.

 

This is far from ideal from a security perspective and want to implement RADIUS so we can control who can connect to the WiFi via AD security groups.

 

I’ve been looking into it and there is a lot of information available online with differing suggestions on how to configure this. I am going with Windows NPS > RADIUS server for 802.1 X > EAP-MSCHA v2, as this seems to be a common setup?

 

The part I am struggling to understand is whether this setup requires certificates to be installed on the user’s device? I’m just looking for user authentication via AD credentials without certificate, if that is possible?

 

Any suggestions / help would be greatly appreciated. Thanks.

[mrbios]

MSCHAPv2 is user authentication based. It's generally been the way things were done for years but is now considered insecure, and the likes of Android (v14+) are starting to make it difficult to continue using.

 

EAP-TLS is certificate based and the best way to do things moving forwards. For domain devices you can easily onboard certificates issued by your own PKI. For BYOD devices, well, there are expensive solutions that make it easy, or there are open source solutions that take a good deal of time to setup. (I think PacketFence might be able to do it) .... personally I'm still looking for a good solution to the latter.

[dmj]

yeah. EAP-TLS these days. MSCHAP is past it.

[psydii]

What do people use for cloud-first shared device authentication (entra/intune / chromebooks/Workplace / Apple/mdm etc)? Edited December 13, 2024 by psydii