My office LAN does not have a Windows Active Directory.

The Wifi use WPA with a pre-shared key, which means that everyone in the world knows what the key is.

I was thinking of implementing a RADIUS server and switching to that. The question is, what stops a user from sharing his key with everyone else? I looked at Windows NPS and FreeRadius. Don't see any way to restrict a key to one or two devices only.

What do hotels use? You know, where you get a Wifi key for your room which allows only 2/3 devices to connect and is valid for a limited number of days. It shows a web page to enter the key the first time you connect to the Wifi. Could something like that be good for a small office?

  • What is your role in your company? What research have you done so far?
    – Tom K.
    Feb 26 '18 at 15:43
  • @TomK not sure why that's relevant, esp. the first part.
    – Joe
    Feb 26 '18 at 19:54
  • It depends, RADIUS has many EAP protocols, like EAP-SIM, so only devices registered can access like with the phone#, some are made to only work with windows, and some require special hardware like a card-reader, etc, so you need to extend some more your investigation.
    – Azteca
    Feb 27 '18 at 6:58
  • @Joe OP asks "Could something like that be good for a small office?". Depending on his/her role, different arguments can be presented to push for an implementation. (For instance admin vs. regular employee)
    – Tom K.
    Feb 27 '18 at 9:17
  • @TomK.I am part of the senior management. Although I have a lot of IT knowledge / experience, this is not something I am knowledgeable about. I've read up on Hotspots, DD-WRT, NPS, etc. I configured NPS on a machine but didn't deploy that solution. My primary concern is that a password can never be secured short of threatening employees with severe bodily harm (grin) as too many people are in the habit of writing things down. Hence, some way of restricting so that the same password can't be used on multiple devices. Feb 27 '18 at 18:04

In a corporate environment, the best way to accomplish this is via certificates issued to copmany devices and possibly MAC addresses. Mind you, this can be beaten if the users have IT security know-how and critically if they have admin rights on their devices. Your company doesn't have a Windows AD server so I presume it would be rather difficult to setup an internal PKI for this.

There's an issue using RADIUS servers like FreeRadius with temporary passwords where laptops and mobile devices continue to try to connect automatically and usually end up locking the account due to an expired password, or using up server resources by processing erroneous login requests.

Hotels and general guest access is normally implemented using a wireless system with a Captive Portal (http://www.hitechmv.com/list-of-open-source-captive-portal-software-and-network-access-control-nac/). This is similar to when you connect to Starbucks or McDonalds without a pre-shared key but you get a webpage that you need to login or click through to get Internet access. This will give you the functionality you're looking for, but at the expense of convenience for the staff.

Ultimately, there's no best answer. It all depends on what level of control you actually have, how much you trust your users, and how important this actually is to the company. An flexible and fully featured system will cost time and/or money.

I understand what you mean about trust. What I meant was that since you don't have a directory server to control user machines centrally, you'll have to trust that your users won't abuse the system (if they do have admin rights).

As far as RADIUS goes, you'll need to configure Change of Authorisation (CoA). Without CoA, you can't end a session that is in progress and the new authorisation would only be applied to the next time the user tries to login.

Edit: In the case of 1) assuming you don't have CoA configured, if you block an ex-employee while their device is still connected, you can't kick them off the network just by disabling their user account. You would have to do it manually on the wireless access point by ending the session based on the MAC address. Next time they try to login, they would be blocked by a failed RADIUS authentication. If you do have CoA, then changing the privileges associated with the account might prompt an immediate change and kick them off.

For 2) that would depend on the wireless system. I have seen some that you can specify a maximum session duration, but there's no way to stop them from reconnecting immediately since the PSK is shared among all users on the same wireless network. You could do MAC address filtering but whether it's fine automatically or manually would depend on the wireless system or RADIUS server.

Implementing 2) with a captive portal is a lot easier because the authentication timer is usually done with an http session cookie that can be invalidated at any time, thus killing the user session.

  • I am reading up on captive portals. From what I understand, I'd need to either get routers of a particular model or those on which the firmware can be replaced by DD-WRT Feb 27 '18 at 18:09
  • It's not a question of trusting the employees. They are trusted hence they have access to company network and physical building, right? What is of import are (1) ex-employees who should get blocked ASAP and (2) visitors who are given wifi access for a limited time but with WPA-PSK password saving feature, how do I end their access? Feb 27 '18 at 18:14
  • I edited my response with additional comments. Hope it's clear. Feb 28 '18 at 19:03
  • True, I agree that not much can be done with active sessions. My takeaway here is that this is too much requirements driven so would need more thought. Thanks. Mar 2 '18 at 5:25

If the devices are not owned by the company you cant avoid key sharing. Restricting to X devices is usually done with MAC checks which can be bypassed.

If the devices are owned by the company, you can use authentication that uses hardware methods (for example a TPM), or software methods


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.