Easy 802.1X Onboarding with EAPConfig files and Supplicant Configuration Automatic Discovery (SCAD) Gareth Ayres (Speaker) Stefan Winter, RESTENA TNC 2015

About the Authors Gareth Ayres (me) Wireless Network Officer, Swansea University PhD Student (part-time) Author of SU1X, eduroamCAT Android App Stefan Winter RESTENA SENSE R&D Lead

Introduction – Key Terms I know I don’t need this slide here, but just in case… eduroam – (education roaming) is the secure, world-wide roaming access service developed for the international research and education community. Wi-Fi – Wireless LAN based on any standard Supplicant– Software on a device that authenticates to a 802.1x network EAP - Extensible Authentication Protocol – Framework for auth

The Onboarding Problem 802.1X networks very successfull eduroam is a great example of this Requirements on connected devices: 1.Supplicant Configuration 2.Certificate(s) 3.Credentials (private key or user/pass)

The Onboarding Problem If fully configured, then devices are secure. BUT can connect without a fully configured supplicant! 1.Supplicant Configuration –Server Name checks not mandatory 2.Certificate(s) –CA Cert not mandatory MITM attacks possible without these settings

The Onboarding Problem Managed devices typically OK, as provisioned correctly. BYOD not so good: 1.Burden on users to fully configure supplicant 2.Complicated for users 3.Some devices don’t even make it possible via GUI

The Onboarding Problem Supplicant configuration tools fixing this: 1.CAT (Configuration Assistant Tool) FREE 2.CloudPath XpressConnect $$$ 3.SecureW2 $$$ 4.Apple MobileConfig files FREE 5.SU1X Free

eduroamCAT for Android eduroam CAT: Configuration Assistance Tool Users can download customised configuration tools Contains IdP’s setting, certificates etc Problem: Android Play Store Delivery model Custom apps can not run on Android by default Forced to use Play Store, but don’t want thousands of similar apps One eduroam CAT app needed, that can be customised for each IdP

App Delivery Model Solution Solution: EAPConfig files Standard way of passing EAP configuration details around XML format can be detected by the app, which digests it. IETF Internet Draft, proposed by SENSE EAP-Config Contains: –IdP information –Authentication Methods (Certificates etc) –Helpdesk / Support Information

Example EAPConfig = bouncer.swan.ac.uk radauth.swan.ac.uk radauth2.swan.ac.uk

Example EAPConfig 26

Example EAPConfig Swansea University Swansea You must agree to abide by the University Computer Regulations and…

Configuration Discovery Problem Creative Commons Licence 1.User needs internet access. 2.Need App for that 3.Need internet to get App 4.App needs EAPConfig 5.Need internet to get EAPConfig What comes first, the chicken (internet) or the egg (secure access)

Solution: SCAD SCAD : Supplicant Configuration Automatic Discovery 1.Assuming user has the app installed: A.Make repositories like play accessible from setup networks? B.Assume limited use of 3G/4G acceptable to get App

Solution: SCAD SCAD : Supplicant Configuration Automatic Discovery Three potential automatic discovery techniques: 1.DNS Lookup 2.Realm Lookup 3.Location Awareness

SCAD: DNS Lookup DNS Lookup Method 1.Assumption: Connected to setup network of home site 2.Local Domain Name discoverable? (Android argh) 3.Prepend SCAD to DOMAIN: scad.swansea.ac.uk\scad.eap-config

SCAD: Realm Lookup Ream Lookup Method: 1.Ask users to enter username (e.g 2.Take realm part 3.Prepend scad and perform lookup: scad.swansea.ac.uk/scad.eap-config

SCAD: Location Awareness Location Awareness Method: 1.Most BYOD devices are location aware 2.Tablets / Phones (Android) know location 3.GeoIP a possibility too (HTML5) 4.Requires a known DB of EAPConfigs to search 5.cat.eduroam.org is a great example of this

Android example with eduroamCAT Location Awareness discovery code started and in SVN But don’t want to implement too much until certain good idea? Maybe available as alpha for people to try soon? Using CAT API works well.

SCAD Security Considerations Security Considerations: 1.Malicious fake EAPConfig discovery 1.Connect users to fake networks? 2.Should be spotted by checking EAPConfig before installing it 3.Signing EAPConfig files like MobileConfigs 4.No credentials in EAP-Config? 2.Accidental discovery of wrong EAPConfig 1.Branding can help users avoid this

Future Work SCAD needed? Worth defining better? Other OS support for SCAD? Other apps? SU1X soon… Apple has MobileCOnfig which is good Because iOS does not allow WIFI API But SCAD maybe to discover MobileConfig?

End Questions? Gareth Ayres Stefan Winter