RADIUS and IAS

[HodgeHi]

Has anyone implemented a RADIUS server and / or IAS to authenticate a wireless network?

 

If so how easy is it to implement and run. Are there any security issues that need to be addressed beforehand to allow smooth running?

 

Would a linux RADIUS be best or are the switch variety better?

 

What about IAS on Server 2003?

 

Just a few questions to assist me in whether to set one up instead of standard encryption.

 

If anymore info available please feel free to post. The more the better.

[ChrisH]

Theres a discussion here on encryption and various radius implementations.

[Geoff]

W2k3 Server + IAS works but its a pig to do. There's an MS whitepaper you can follow to do it.

 

http://www.microsoft.com/technet/prodtechnol/winxppro/deploy/ed80211.mspx

 

Linux is simpler (from my POV). FreeRadius is what does the business.

 

http://www.freeradius.org/doc/EAPTLS.pdf

[HodgeHi]

CrhisH - Thanks for the heads up and sorry to re-post for old info.

 

Geoff - cheers for that info too. I have never really used Linux, but i will look into it as i have been wanting to get into Linux for a while.

[Slartibartfast]

We use Server 2003 with IAS to authenticate all of our wireless clients. After some unsuccessful experiments with certificates, we decided to use PEAP for authentication. The advantage (to us) is that machines with Active Directory computer accounts authenticate themselves.

 

Laptops which are not domain members are prompted for a domain username and password to connect to the wireless network.

[HodgeHi]

Sounds good slartibartfast. How difficult was IAS to set up initially? I am not in control of the DCs so it would be left to someone else to do.

 

I would like the option of knowing how to do both IAS and RADIUS authentication and have some information on problems some people have had with each so i can then go down the path with least resistance, hence the questions.

[plexer]

Slarti: Hey mate not far from me in little ole watton. Scalable and secure wireless is what I've been looking at for a while would love to see your setup and if you give some pointers on IAS setup that would be cool I've seen all the M$ stuff on using PKI's etc... but it's way too complicated.

 

The other alternative is Elektron from Corriente which is a simple install to give you a radius server for authenitcating wireless clients with a certificate so they can authenticate the server.

 

Trouble is atm Elektron only gives user authentication and not machine so domain users cuoldn't log using the wireless as the secure connection is only bought up after they have logged in.

 

Ben

[sahmeepee]

We use Server 2003 with IAS to authenticate all of our wireless clients. After some unsuccessful experiments with certificates, we decided to use PEAP for authentication. The advantage (to us) is that machines with Active Directory computer accounts authenticate themselves.

 

Laptops which are not domain members are prompted for a domain username and password to connect to the wireless network.

 

I'd settled on PEAP as the most likely candidate for when we do wireless "properly" (currently we only have one AP used in anger).

 

Your last statement about being able to connect to the wireless network with any old laptop logging in via a user account has me a bit worried though. Is that because users can add upto 10 computers to the domain by default or is it something different? Is there an easy way to stop that behaviour so that we don't get plagued by rogue laptops riddled with viruses and hacking tools?

[plexer]

I think he means that a domain computer can connect to the network using it's computer credentials but a laptop thats not part of the domain would be asked for a username and password to be entered before it's allowed access this would be the persons username, domain and their domain password if they are all correct then access is allowed.

 

Ben

[sahmeepee]

I think he means that a domain computer can connect to the network using it's computer credentials but a laptop thats not part of the domain would be asked for a username and password to be entered before it's allowed access this would be the persons username, domain and their domain password if they are all correct then access is allowed.

 

Ben

 

Yeah, that's how I understood it. Unfortunately that would allow any pupil with their own non-domain-member laptop to connect to the wireless network from anywhere on the site, which currently isn't acceptable for us. At least with wired connections we can tell which wall socket they're plugged into and go and ask them to pack it in. With large-scale wireless they could even be in the car park or a nearby house.

[plexer]

Yes they could but then you make it so that they can't log in and it's only domain computers or allowed mac adresses or some other scheme to prevent it thats just how he has it configured.

 

Ben

[Norphy]

If its IAS RADIUS autenticated, surely you could restrict authentication to certain users or groups? If you're not on the list, you can't get in

[_Bob_]

I have set up IAS for wireless. It works quite well, the only tedious bit was getting certificates onto the clients for authentication. You can use IAS policies to restrict the logons to certain user groups.

Recently i've been looking at Linux for this. Playing with replacing firmware on the AP to do extra fun stuff.

[Ric_]

Perhaps people would be willing to write a HOWTO guide for how they set their implementation of IAS/FreeRADIUS/woteva up?

 

I have set up a wiki page for this purpose at http://www.russdev.com/edugeek/doku.php?id=wifisetup - happy wiki-ing!

[Slartibartfast]

Unfortunately that would allow any pupil with their own non-domain-member laptop to connect to the wireless network from anywhere on the site, which currently isn't acceptable for us.

 

There's an IAS remote access policy in place to prevent this.

 

If its IAS RADIUS autenticated, surely you could restrict authentication to certain users or groups? If you're not on the list, you can't get in

 

Exactly. User accounts need to be a member of a specific group to authenticate.

[Ric_]

Surely a quick example on http://www.russdev.com/edugeek/doku.php?id=wifisetup isn't too much to ask for

[HodgeHi]

Ric_

 

That is exactly what i would like to see. Some examples of what admins have already configured and setup and the methods in which they went about it. Possible pitfalls to avoid as problems arose from issues undocumented (how often does this happen?) , and things like that.

 

I am not the greatest technician in the world as i am more or less a newb, but would like to get better and more experienced, learning from other peoples experiences as much as possible.

[Richie1972]

I could be missing something here, but surely if you just use WEP encryption and ensure that only the IT techs have the WEP key, then they are the only people who can join a pc/laptop to the wireless network.

If a pupil/staff member brings in their own laptop, then without the WEP key (and without the rights to join a computer to the domain) the laptop can't connect to your network

[GrumbleDook]

Apart from the fact that there are a number of sniffers out there (one has been mentioned in a previous thread) that can get the WEP key in around 1 1/2 hours ... and then other software that can sniff traffic and can get permissions to join a domain in around 8-12 hours.

 

Each level of security is an additional detterrent ... the same way that locks on your windows, burglar alarms, padlocks and chains, etc are a detterent.

 

A determined person will get in ...

 

Already mentioned is ACLs ... only allowing certain MAC addresses to have access to your WLAN. This is another level of security but you have to remember that you MAC address can be spoofed with reasonable ease.

 

We have to remember that there are certain comanies and public organisiations out there that, for the number of wireless devices you may come across in schools now, actually have a person in their Network team dedicated to looking after the wireless side of things.

 

For a number of years the NSA documents were standards in securing windows networks (especially in a multi-platform environment) but even they went externally to sort out wireless security (2003, Certicom gain contract for writing advanced encryption technology. A certain chunk of this is now develpoed in house by NSA at the moment but still also written by several other groups, including 2 British companies)

[Ric_]

@Richie_OLSJ: As Grumbledook says, there are sniffers out there that can easily crack a WEP key with NO technical knowldge. Grumbledook mentions 1 1/2 hours but it can be done much quicker if you do it in a more brutal fashion

 

Intel has some documentation at http://www.intel.com/cd/ids/developer/asmo-na/eng/52700.htm?page=1 that may be of interest to people.

[CyberNerd]

BECTA say WPA2 and RADIUS for wireless

[Geoff]

Good luck with WPA2. Given that windows doesn't support it. (Linux does though!).

[CyberNerd]

?

SUMMARY

This article describes the Wi-Fi Protected Access 2 (WPA2)/Wireless Provisioning Services Information Element (WPS IE) Update. A link to download this update is included. You can install this update on a computer that is running Windows XP with Service Pack 2. The update supports the additional mandatory security features of the IEEE 802.11i standard that are not already included for products that support WPA. Additionally, after you install the update, Windows XP will display previously hidden Service Set Identifiers (SSIDs) in the Choose A Wireless Network dialog box. This functionality makes it easier for you to connect to public Wi-Fi networks to which you have not previously connected.

 

http://support.microsoft.com/?id=893357

[Geoff]

Ah, yes, now go try and make it work.

[spc-rocket]

We are have setup a mini test network for this and have managed to get the WPA access using RADIUS (Windows 2003 IAS). I got my colleague writing the step by step instructions for this at the moment. I will post it here when he's completed it.

 

The guide is intended at setting up a wireless network where clients authenticates using RADIUS. The two things we tested were using the username and password authentication i.e. PEAP and the other was certificates and both worked.

 

It is recommended to do both user and machine authentication to restrict user access and also computer authentication so GPO and startup scripts runs during the bootup.

 

Few things that are required:

 

- 802.1x supplicant support on the client, Windows XP SP1 and over has this already, Windows 2000 Pro - you can download hotfix which enables this functionality, linux,mac - don't know, never used it

 

- Access points which support 802.1x ideally with WPA/TKIP or AES

 

- RADIUS server (Windows server ships with IAS

 

- Certificate Authority (this can be on the same machine as the RADIUS server)

 

- Some time to test the damn thing

 

HTH,

 

 

Ash.