One other thing to consider in this is EAP-PWD. If you have a way to tell android devices apart by MAC and can change your EAP method, and if your credentials are stored with a compatible hash, it might be worth consideration. (Only Android devices can do it last time I checked). This does not use a certificate, and since Android security for EAP-PEAP is behind the curve it is a better option for those devices. You do sacrifice identity privacy (people can tell the username used by the device by sniffing OTA packets) but nobody seems to care about that when using EAP-PEAP, and it is already sacrificed under most PKI schemes used for EAP-TLS since the username is often embedded in the client cert. ________________________________________ From: Freeradius-Users <freeradius-users-bounces+bjulin=clarku.edu@lists.freeradius.org> on behalf of Denis Mirassou (UT3/DSI) <denis.mirassou@univ-tlse3.fr> Sent: Friday, August 24, 2018 10:30 AM To: freeradius-users@lists.freeradius.org Subject: Re: What is more secure: EAP-PEAP, EAP-TLS or EAP-TTLS? Seems better to me to allocate a certificate per device. Otherwise, how do you prevent a stolen phone from using your wifi ? I have no personnal experience on mdm, sorry ! On 24/08/2018 15:32, Elias Pereira wrote:
Thanks Denis!!! :)
Verify this rule with Radius logs: One certificate/One MAC (no
certificate share with numerous devices)
But the certificate is not per user? How would that look if it had a smartphone and a noteboot?
Use a Mobile Device Management
Do you have an example of this?
On Fri, Aug 24, 2018 at 9:13 AM Denis Mirassou (UT3/DSI) < denis.mirassou@univ-tlse3.fr> wrote:
- Tell your users to alert immediatly in case of lost/stolen phone - Client certificate revocation of stolen/lost phones - Appropriate (not too long) client certificate validity time - Lost phones MAC addresses blocking - Verify this rule with Radius logs: One certificate/One MAC (no certificate share with numerous devices) - Phones flash memories encrypted - Use a Mobile Device Management - User authentication on corporate applications once connected on wifi network ...?
Denis.
On 24/08/2018 13:06, Elias Pereira wrote:
Thanks for all clarification about the eap- * configs.
How can I mitigate the security issue if I do not use password for personal certificate?
On Tue, Aug 21, 2018 at 5:04 AM Nik Mitev <nik.mitev@jisc.ac.uk> wrote:
On 21/08/18 08:01, Denis Mirassou (UT3/DSI) wrote:
If your concern is about to authenticate devices (smartphones) and not users for sure (think of stolen phones), Client certificates should do the job.
If the private key for the client certificate is encrypted and requires a password, you can authenticate the user too and not just the device. That said, most of the time wifi passwords are stored in the phone and not required to connect.
Nik
- List info/subscribe/unsubscribe? See https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=02%7C01%7Cbjulin%40clarku.edu%7C589e21921314483cfe9d08d609ce3128%7Cb5b2263d68aa453eb972aa1421410f80%7C1%7C0%7C636707178539494994&sdata=RBg6MT%2BbiQxI6rO4fb0sO3uTtZaA4EM%2B8aooSxnZhdY%3D&reserved=0
- List info/subscribe/unsubscribe? See https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=02%7C01%7Cbjulin%40clarku.edu%7C589e21921314483cfe9d08d609ce3128%7Cb5b2263d68aa453eb972aa1421410f80%7C1%7C0%7C636707178539494994&sdata=RBg6MT%2BbiQxI6rO4fb0sO3uTtZaA4EM%2B8aooSxnZhdY%3D&reserved=0
- List info/subscribe/unsubscribe? See https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=02%7C01%7Cbjulin%40clarku.edu%7C589e21921314483cfe9d08d609ce3128%7Cb5b2263d68aa453eb972aa1421410f80%7C1%7C0%7C636707178539494994&sdata=RBg6MT%2BbiQxI6rO4fb0sO3uTtZaA4EM%2B8aooSxnZhdY%3D&reserved=0