Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [radius]

The tag has no usage guidance.

1
vote
2answers
73 views

WPA2 Enterprise: no risks for preconfigured clients when it comes to Rogue APs?

We are using, as default, PEAP and MS-CHAPv2 as inner authentication. I was concerned with security risks when it comes to rogue APs but a colleague told me that there are no risks for preconfigured ...
0
votes
1answer
111 views

How to verify if a RADIUS server certificate is really validated on Windows 10?

A RADIUS server has a self-signed certificate for radius.example.com. (There could also be Windows Active Directory Certificate Services PKI, but this should work similarly, shouldn't it?) The self-...
2
votes
0answers
76 views

How can a 802.11 client verify the authenticity of an AP it is trying to connect to?

With the onset of hardware like the WiFi pineapple, it has become somewhat harder to protect the privacy of your WiFi network. WPA2 Enterprise with Radius authentication could come to rescue here, but ...
0
votes
1answer
61 views

How does Authenticator gets the PMK which is used to calculate PTK?

I am trying to setup a Supplicant- authenticator and AAA server to perform EAPOL mechanism. I am able to successfully completed the EAP authentication procedure but 4-way handshake was not initiated ...
3
votes
2answers
380 views

WiFi security in 2018

On my wireless network I have implemented WPA2 protocol with AES encryption. Last year there was several warnings that WPA2 is broken, hacked. Now there are announcements that WPA3 is comming in 2018. ...
0
votes
2answers
353 views

How to prevent users sharing WPA RADIUS keys?

My office LAN does not have a Windows Active Directory. The Wifi use WPA with a pre-shared key, which means that everyone in the world knows what the key is. I was thinking of implementing a RADIUS ...
10
votes
2answers
4k views

My school wifi asks to 'trust' a certificate on Iphone's, does it this allow them to view SSL traffic?

There is a lot of confusion around this on here, so I am making this post to be sure to understand it correctly. My school uses Aruba networks wifi, and after I type my Active Directory username and ...
3
votes
0answers
146 views

Can a non-root process (MySQL) authenticate to RADIUS via PAM?

I've run across a dilemma with PAM RADIUS authentication for the database layer. In our environment, the OS login authenticates via PAM to a RADIUS server which accepts a token code and authenticates ...
3
votes
0answers
88 views

EAP-EKE with RADIUS, is the derived key useful?

If someone run a successful EAP-EKE for authentication with a RADIUS Server, the client will end up being authenticated (will have access to the network) and will have in place a session key that at ...
6
votes
3answers
5k views

Can someone explain in simple steps how WPA2-Enterprise authentication and encryption happens?

When I try asking this question on other websites I get massive downvotes and am told "We're not doing your homework. Use google." Also I sometimes get banned. Anyways, I've searched tens of pages of ...
1
vote
1answer
427 views

What does an NPS server actually do with client certificates?

Say an NPS server is authenticating users of an AD through EAP-TLS. When the client sends his certificate does the NPS server actually check to see if this certificate belongs to the user in the ...
0
votes
1answer
46 views

In a wireless network which is the Radius client, the switch or the wireless access point?

I'm sorry if this is a noobish question. If you have some cisco switch connected to d-link wireless access points, which acts as the Radius client?
1
vote
2answers
321 views

Should a server or a client be able to verify a client/server certificate - intermediate certificate chain with a known root ca?

I am trying to test the following setup: A RADIUS server works with the EAP-TLS protocol. The client and the server have the following certificates: Client Public Key: ...
4
votes
3answers
4k views

WiFi Hacking - Certificate based authentication instead of password

I would like to know if using a certificate based authentication instead of a WPA2 password in a WiFi network would be secure or insecure in terms of is it breakable or not? Since WPA2 can be ...
0
votes
0answers
142 views

How feasible would it be to sniff traffic between an Authentication Server and a RADIUS server in a corporate setting?

For WPA enterprise in the corporate world, is the RADIUS server connected to the Authenticator/Access Point wirelessly or 'wiredly' for most situations? If they are connected wirelessly, does this ...
3
votes
1answer
917 views

Access-Challenge EAP Request

From my understanding, after the Access-Request, the authentication server (RADIUS) sends a reply (encapsulated in the Access-Challenge packet) to the authenticator (AP). The Access-Challenge packet ...
0
votes
2answers
618 views

The benifits of Full NAC solution VS simple radius server

In case we want to enable dot1x authentication on the wired network without using host checker,do we still need NAC solution or just simple AAA server to authenticate the host and dynamic VLAN ...
2
votes
2answers
644 views

WPA2 with 802.1x - how is the server certificate validated?

I want to replace my current WPA2/PSK Setup with WPA2+802.1x with RADIUS authentication. There are various algorithms which can be used for that which can be roughly divided in two groups: a) the ...
0
votes
1answer
60 views

Secure way to save the local credentials?

In the network administration world, normally we configure the network devices to use an AAA server (Radius or tacacs+). As a backup, in case the AAA server is not reachable, we configure the network ...
0
votes
1answer
5k views

RADIUS Authentication and Shared Secret, is secure?

I am considering the implementation of a 2 Factor Authentication server and I am concerned that the RADIUS authentication via Shared Secret is not secure enough as for example an attacker could at ...
5
votes
2answers
2k views

WPA2 Enterprise EAP-TLS Key Exchange

I'm in the process of implementing 802.1x WPA2 Enterprise Authentication using FreeRadius and EAP-TLS (Mutual TLS Cert Based Auth). I am keen to understand how to actual protocols work together and ...
1
vote
2answers
2k views

Restrict Microsoft Network Policy Server (NPS) to only trust client certificates from a given CA?

I'm working on an install of a Microsoft Network Policy Sever (NPS) / RADIUS server for controlling access to corporate Wi-Fi using 802.1x / WPA2-Enterprise - using client certificates for ...
4
votes
1answer
4k views

If PAP is insecure why is it commonly the only authentication protocol available for Radius?

In configuring Radius authentication on multiple devices from a vendor, I discovered that PAP is the only supported protocol. I was initially surprised but discovered that even an f5 BigIP only ...
2
votes
1answer
696 views

RADIUS authentication: is it possible to get the user groups or other attributes?

RADIUS is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management. The question if is it possible to get the user groups or other attributes. ...
1
vote
2answers
3k views

Why not use Diameter over RADIUS?

The name of the protocol is a play on the word Diameter, which is twice the RADIUS of a circle - in other words, the author is trying to say it is twice as good and has more features. It seems like ...
0
votes
0answers
688 views

RADIUS for Access Point Authentication with Google Apps For Business

We're looking to move our current access points from using a static password potentially to RADIUS. However, the closest to a directory service we have is Google Apps for Business, which does support ...
2
votes
0answers
40 views

Windows NPS: Policy should check Issuing CA

I have some trouble in configuring a Windows NPS, maybe anybody of you have an idea. Is it possible for NPS to check whether a client certificate was signed by a specific issuing CA? I have two ...
0
votes
1answer
98 views

Should each radius client have its own key?

If I have many Cisco switches connected to Windows radius, should I assign a different key to each switch? Is it a best practice? If I leave the key same on every host, it would ease my deployment.
2
votes
2answers
145 views

Does any Wifi technology permit safe & secure sharing of an Internet connection?

I have an internet circuit that I would like to protect from untrusted peers. BUT I don't want the peers in the same broadcast domain to be able to affect other peers. (e.g. Wifi user 1 shouldn't be ...
0
votes
1answer
627 views

2FA with Windows NPS

I would like to set up two-factor authentication for my Wireless users. I have an Windows NPS server that is currently authenticating my wireless users and I want to add certificates or any other ...
0
votes
1answer
2k views

Should you use Radius and LDAP together?

For example I'm reading something right now that says: "The authentication server is a RADIUS server, which authenticates virtual machines through a Lightweight Directory Access Protocol (LDAP) ...
24
votes
4answers
57k views

What is the difference between a RADIUS server and Active Directory?

Why would I need a RADIUS server if my clients can connect and authenticate with Active Directory? When do I need a RADIUS server?
1
vote
0answers
178 views

Dynamic Key Management in WPA through Radius server

Can anybody tell me in detail (or provide good links), how the dynamic key management is done by the authentication server in WPA? In other words, let's say I gave my credentials to the authentication ...
5
votes
2answers
14k views

What's the difference between Radius and Kerberos?

Is Radius just a better version of Kerberos? I can't find anything about this. If you set up a Radius server in a modern network do you need Kerberos at all?
1
vote
0answers
367 views

Help decrypting MS-MPPE-Send-Key/MS-MPPE-Recv-Key

I'm trying to decrypt Ms-MPPE keys received in a Access-Accept message from the Radius server. I'm following RFC2548 in order to do this. Although the keys are of size 32 octets, the one byte length ...
0
votes
1answer
4k views

Which method of WPA2 enterprise is more secure: TTLS or PEAP [closed]

Say we have two WPA2 enterprise setups using a RADIUS server. If both implementations use MSCHAPV2 and the same credentials. Which of the two would be more secure and how are these two implementations ...
8
votes
3answers
2k views

Protection of eduroam credentials

Recently my educational institution officially switched over from the their own wireless network to eduroam. If I understand correctly from the FAQ, credential authentication is performed on the ...
-1
votes
1answer
73 views

RADIUS use outside of network AAA [closed]

I've seen RADIUS used for wireless authentication, but are there any other use cases that RADIUS works well in? Has anyone had experience with using RADIUS for AAA between two applications? I'm ...
6
votes
2answers
7k views

WiFi security using IEEE 802.1X - how secure is it?

My company's set-up involves a single AP (TPlink) that is configured to authenticate clients using RADIUS. All works well, but: on a regular WPA/WPA2 network, once you have the PSK, you are able to ...
2
votes
1answer
6k views

FreeRADIUS EAP TLS Authenticate based on client certificate CN

I'd like to run FreeRADIUS for EAP TLS authentication but instead of running my own Certification Authority I'd like to use StartSSL. I've setup EAP TLS with StartCom as the only Trusted Root CA and ...
2
votes
0answers
695 views

Does EAP-TLS provide a two-factor authentication?

I am currently setting up FreeRADIUS on my pfSense firewall to authenticate WLAN clients (mainly iOS) via EAP-TLS. I have therefor created a user certificate and a user within the FreeRADIUS user ...
1
vote
0answers
421 views

Can a Radius server mitigate an ARP spoofing attack?

I'm helping my school network administrator to try to find a way to mitigate a current ARP spoofing attack on our wifi network. We detected an unknown host (MAC address seem to change, he is probably ...
4
votes
4answers
1k views

How to decode traffic on a LAN whose SSL certificates are expired

We have a campus Wi-Fi at my university and we authenticate through a log in page which to me seems like we are using a RADIUS server. Every time the page loads my browser warns me that the ...
1
vote
1answer
4k views

Forcing EAP-TLS 1.2 authentication with FreeRadius and OpenSSL

Been working with TLS DHECE certificate based handshake with a FreeRADIUS server and WPA_supplicant - both running OpenSSL 1.0.1j FIPS. Afer watching the Wireshark traffic, I notice that the client ...
4
votes
2answers
6k views

Certificate validation with 802.1x PEAP

I recently learned about how WPA-PSK works. If I understand correctly, the 4-way handshake enables the protocol to ensure mutual possession of the PMK (and therefor, the PSK) without sending the PMK/...
0
votes
1answer
893 views

EAP-TLS fragmentation implementation

I am trying to build an EAP-TLS client. The handshake I have to deal with involves receipt of fragmented messages from the RADIUS server. As a part of the client reply, I have to construct a ...
2
votes
1answer
661 views

Does WPA2 Enterprise also authenticate clients to the 802.1X protected switch port?

In an 802.1X protected LAN, the switch port is usually set to "Multiple Hosts" mode and the access point is configured as an 802.1X supplicant which authenticates to the switch and "opens" the port. ...
8
votes
3answers
4k views

Are RADIUS and TACACS+ Ever Allowed in FIPS 140-2 Compliant Scenarios?

Are RADIUS and TACACS+ Ever Allowed in FIPS 140-2 Compliant Scenarios? I understand that RADIUS uses the MD5 hashing algorithm and I'm pretty sure TACACS+ does too, and I do not believe there is any ...
14
votes
1answer
2k views

MPPE-Send and Receive key derivation from MS-CHAPv2

I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
1
vote
1answer
1k views

Can I used Google Authenticator with Radius and VMwareview

We're looking to add 2 factor and one of the options is google authenticator and I was wondering if we can attach that to a radius server attached to our VM infrastructure for remote access. All ...