3

This is about securing WiFi APs which are usually connected to broadband like DSL and Fibre. Some of them are at business site and some are at home.

To protect against Evil Twin attack (basically spoofing AP, stealing password and then breaking into LAN etc) there's seems to be a way - to introduce WPA2 Enterprise with EAP-TLS.

Now the thing is that some enterprise users do not have private clouds nor resources or space to put a small server or VM Instance to serve as RADIUS server (even they have, it is very often difficult).

So I am wondering if solution with RADIUS server on the public internet in Cloud would be something reasonable to implement?

Going by this path I found one online service serving this purpose, I think it's suitable for the home users and small businesses - see IronWifi

I believe this way the WiFi network can be then commissioned as safe to use. Is that correct? Would be there any sort of attack (with EAP-TLS) which can be deployed to circumvent this security in reasonable easy way? Like using standard hacking software / hardware?

All routers have been already setup to 11n mode by the way and 20MHz bandwidth. This is to make it more secure by using newer standards but because it is using 40MHz by default I have made it 20MHz so that I could zone them better.

Improve this question
2
  • My old phone can run a RADIUS server. It would be nothing for a Raspberry Pi, even. They are not very resource intensive, for small installations like those you describe.
    – Michael Hampton
    Sep 5, 2016 at 23:33
  • If you are already heavily cloud using - Google Apps for Business, say - some of these RADIUS-As-A-Service providers can provide nice integrations with your existing cloud directories. FreeRadius probably can, but I couldn't find an easy way to do it.
    – crovers
    Sep 6, 2016 at 15:28

1 Answer 1

Reset to default
0

The security of the system really depends on whether the service provider is trusted. When you deploys EAP-TLS, the private key of the RADIUS server must be stored in the disk, or at least in the memory, of the service provider's server. If the service provider is malicious, there are many things it can do to compromise the key.

Improve this answer
2
  • Well, any company of any size may turn malicious if one employee goes rouge. However, the companies managing the security services usually know how to manage insider threat. And that's how they make money.
    – Aria
    Sep 5, 2016 at 19:21
  • This is a trivially correct answer... of course you have to trust a provider. What about every other software/service provider that needs to be trusted for trust in a RADIUS service to matter?
    – le3th4x0rbot
    Jun 3, 2018 at 19:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .