So I'm using WPA2-EAP for a few years now with FreeRadius server. And it's pretty okay, I mean I don't really consider wifi access to be so super-duper critical break in success because it's pretty restricted anyways on other levels so I accepted any potential risk (which is still significantly lower than PSK). But I always wondered... How about server or workstation authentication? How secure RADIUS client <> server connection really is and how easy it is to deploy rogue RADIUS server authenticating everyone to everything?
Let's focus on 2 scenarios that come to my mind first:
Evil dude connecting between server and radius server:
[server] -> [switch] -> [evil dude] -> [switch] -> [RADIUS server]
User workstation outside of company network with disabled VPN:
[workstation] -> [dodgy hotspot] -> [evil dude]
Questions are following: Is in 1st case possible to inject rogue RADIUS allowing access to server with credentials like
Is 2nd case equivalent to workstation having no user credentials and unrestricted admin access? What is necessary to deploy rogue RADIUS and can it be mitigated by hardening auth between RADIUS server and client?
I don't consider accessing data available on RADIUS server real issue because if someone has access to it then it's game over anyways. But I'm a bit concerned about security of using secret for RADIUS client <> server connection and I'm not sure if it's valid concern from exploitation point of view. Always certificates made me more confident in this field than PSK.